@connexum/ai-governance 1.0.0-beta.11

package/dist/audit/webhook-delivery.js

@@ -0,0 +1,381 @@
+"use strict";
+/**
+ * WebhookDelivery -- HTTP POST delivery for EventBus events.
+ *
+ * Forwards governance events to external SIEM/webhook endpoints
+ * with retry logic, HMAC signing, and dead-letter queue.
+ *
+ * Supports:
+ *   - Splunk HEC, Datadog, Elastic SIEM, generic webhook
+ *   - HMAC-SHA256 request signing
+ *   - Exponential backoff retry (3 attempts)
+ *   - Dead-letter queue for failed deliveries
+ *   - Event filtering by type
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookDelivery = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const https = __importStar(require("https"));
+const http = __importStar(require("http"));
+const crypto = __importStar(require("crypto"));
+const log_1 = require("../util/log");
+const log = (0, log_1.createLogger)('webhook');
+class WebhookDelivery {
+    config;
+    dlqFile;
+    statsDelivered = 0;
+    statsFailed = 0;
+    constructor(config) {
+        this.config = {
+            maxRetries: 3,
+            retryDelayMs: 1000,
+            timeoutMs: 10000,
+            allowInsecure: false,
+            ...config,
+        };
+        if (!fs.existsSync(config.dlqDir)) {
+            fs.mkdirSync(config.dlqDir, { recursive: true });
+        }
+        this.dlqFile = path.join(config.dlqDir, 'webhook-dlq.jsonl');
+    }
+    /**
+     * Deliver an event to all matching endpoints.
+     */
+    async deliver(event) {
+        const results = [];
+        for (const endpoint of this.config.endpoints) {
+            if (endpoint.enabled === false)
+                continue;
+            // Filter by event type
+            if (endpoint.eventTypes && endpoint.eventTypes.length > 0) {
+                if (!endpoint.eventTypes.includes(event.type))
+                    continue;
+            }
+            // Validate URL security
+            if (!this.config.allowInsecure && !endpoint.url.startsWith('https://')) {
+                results.push({
+                    endpoint: endpoint.name,
+                    success: false,
+                    attempts: 0,
+                    error: 'HTTPS required (set allowInsecure for testing)',
+                });
+                continue;
+            }
+            const result = await this.deliverToEndpoint(event, endpoint);
+            results.push(result);
+        }
+        return results;
+    }
+    /**
+     * Get dead-letter queue entries.
+     */
+    getDLQ(limit = 100) {
+        if (!fs.existsSync(this.dlqFile))
+            return [];
+        try {
+            const lines = fs.readFileSync(this.dlqFile, 'utf-8')
+                .trim()
+                .split('\n')
+                .filter(Boolean);
+            return lines
+                .slice(-limit)
+                .map(line => {
+                try {
+                    return JSON.parse(line);
+                }
+                catch {
+                    return null;
+                }
+            })
+                .filter((e) => e !== null);
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Retry all dead-letter queue entries.
+     */
+    async retryDLQ() {
+        const entries = this.getDLQ();
+        if (entries.length === 0)
+            return [];
+        const results = [];
+        for (const entry of entries) {
+            const endpoint = this.config.endpoints.find(e => e.name === entry.endpoint);
+            if (!endpoint)
+                continue;
+            const result = await this.deliverToEndpoint(entry.event, endpoint);
+            results.push(result);
+        }
+        // If all succeeded, clear the DLQ
+        const allSuccess = results.every(r => r.success);
+        if (allSuccess && results.length > 0) {
+            try {
+                fs.writeFileSync(this.dlqFile, '');
+            }
+            catch { /* ignore */ }
+        }
+        return results;
+    }
+    /**
+     * Get delivery statistics.
+     */
+    getStats() {
+        let dlqSize = 0;
+        if (fs.existsSync(this.dlqFile)) {
+            try {
+                const content = fs.readFileSync(this.dlqFile, 'utf-8').trim();
+                dlqSize = content ? content.split('\n').length : 0;
+            }
+            catch { /* ignore */ }
+        }
+        return {
+            delivered: this.statsDelivered,
+            failed: this.statsFailed,
+            dlqSize,
+            endpoints: this.config.endpoints.filter(e => e.enabled !== false).length,
+        };
+    }
+    /**
+     * Add an endpoint at runtime.
+     */
+    addEndpoint(endpoint) {
+        this.config.endpoints.push(endpoint);
+    }
+    /**
+     * Remove an endpoint by name.
+     */
+    removeEndpoint(name) {
+        const idx = this.config.endpoints.findIndex(e => e.name === name);
+        if (idx === -1)
+            return false;
+        this.config.endpoints.splice(idx, 1);
+        return true;
+    }
+    // --- Private ---
+    async deliverToEndpoint(event, endpoint) {
+        const body = this.formatBody(event, endpoint);
+        let lastError = '';
+        for (let attempt = 1; attempt <= this.config.maxRetries; attempt++) {
+            try {
+                const statusCode = await this.sendRequest(endpoint, body);
+                if (statusCode >= 200 && statusCode < 300) {
+                    this.statsDelivered++;
+                    return {
+                        endpoint: endpoint.name,
+                        success: true,
+                        statusCode,
+                        attempts: attempt,
+                        deliveredAt: new Date().toISOString(),
+                    };
+                }
+                lastError = `HTTP ${statusCode}`;
+            }
+            catch (err) {
+                lastError = err.message;
+            }
+            // Exponential backoff before retry
+            if (attempt < this.config.maxRetries) {
+                const delay = this.config.retryDelayMs * Math.pow(2, attempt - 1);
+                await new Promise(r => setTimeout(r, delay));
+            }
+        }
+        // All retries exhausted -- write to DLQ
+        this.statsFailed++;
+        this.writeDLQ(event, endpoint.name, lastError);
+        return {
+            endpoint: endpoint.name,
+            success: false,
+            attempts: this.config.maxRetries,
+            error: lastError,
+        };
+    }
+    formatBody(event, endpoint) {
+        if (endpoint.format === 'splunk-hec') {
+            return JSON.stringify({
+                event: {
+                    ...event.data,
+                    eventType: event.type,
+                    source: event.source,
+                    target: event.target,
+                },
+                time: Math.floor(new Date(event.timestamp).getTime() / 1000),
+                sourcetype: 'ai:governance',
+                source: event.source,
+            });
+        }
+        // T-066: RFC 5424 syslog format
+        if (endpoint.format === 'syslog') {
+            return this.formatSyslog(event);
+        }
+        // F-NEW-CRIT-6 (2026-05-02): Elasticsearch _bulk NDJSON format.
+        // Each event becomes a two-line NDJSON pair: {"index":{"_index": ...}}
+        // followed by the event document. Elasticsearch's _bulk endpoint
+        // requires a trailing newline on the last line. The index defaults
+        // to 'connexum-governance' when not specified per-endpoint.
+        if (endpoint.format === 'elastic') {
+            const indexName = endpoint.elasticIndex ?? 'connexum-governance';
+            const action = JSON.stringify({ index: { _index: indexName } });
+            const doc = JSON.stringify({
+                '@timestamp': event.timestamp,
+                event_type: event.type,
+                source: event.source,
+                target: event.target,
+                org_id: event.orgId,
+                ...event.data,
+            });
+            return action + '\n' + doc + '\n';
+        }
+        // Default JSON format
+        return JSON.stringify({
+            id: crypto.randomUUID(),
+            ...event,
+            deliveredAt: new Date().toISOString(),
+        });
+    }
+    /**
+     * T-066: Format event as RFC 5424 syslog message.
+     *
+     * Format: <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ID SD-PARAMS] MSG
+     *
+     * Facility: 16 (local0), Severity mapped from event type.
+     */
+    formatSyslog(event) {
+        // Facility 16 (local0) = 128, severity based on event type
+        const severity = this.syslogSeverity(event.type);
+        const pri = 128 + severity; // local0 facility (16 * 8) + severity
+        const timestamp = event.timestamp; // Already ISO 8601
+        const hostname = '-'; // RFC 5424 NILVALUE for unknown hostname
+        const appName = 'ai-governance';
+        const procId = process.pid.toString();
+        const msgId = event.type.replace(/:/g, '_').toUpperCase();
+        // Structured Data (SD-ID = governance@connexum)
+        const sdParams = [
+            `source="${this.escapeSyslog(event.source)}"`,
+            event.target ? `target="${this.escapeSyslog(event.target)}"` : '',
+            `eventType="${this.escapeSyslog(event.type)}"`,
+        ].filter(Boolean).join(' ');
+        const sd = `[governance@connexum ${sdParams}]`;
+        const msg = JSON.stringify(event.data);
+        return `<${pri}>1 ${timestamp} ${hostname} ${appName} ${procId} ${msgId} ${sd} ${msg}`;
+    }
+    syslogSeverity(eventType) {
+        // RFC 5424 severity: 0=Emergency, 1=Alert, 2=Critical, 3=Error, 4=Warning, 5=Notice, 6=Info, 7=Debug
+        const severityMap = {
+            'governance:tampered': 1, // Alert
+            'memory:tampered': 1, // Alert
+            'circuit:opened': 2, // Critical
+            'anomaly:detected': 3, // Error
+            'approval:denied': 4, // Warning
+            'approval:requested': 5, // Notice
+            'approval:granted': 6, // Info
+            'handoff:created': 6, // Info
+            'handoff:received': 6, // Info
+            'session:started': 6, // Info
+            'session:ended': 6, // Info
+            'circuit:closed': 6, // Info
+        };
+        return severityMap[eventType] ?? 6; // Default: Informational
+    }
+    escapeSyslog(value) {
+        // RFC 5424: escape ", \, and ] in SD-PARAM values
+        return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\]/g, '\\]');
+    }
+    sendRequest(endpoint, body) {
+        return new Promise((resolve, reject) => {
+            const url = new URL(endpoint.url);
+            const isHttps = url.protocol === 'https:';
+            const transport = isHttps ? https : http;
+            // F-NEW-CRIT-6: Elasticsearch _bulk endpoint requires NDJSON content-type.
+            const defaultContentType = endpoint.format === 'elastic'
+                ? 'application/x-ndjson'
+                : 'application/json';
+            const headers = {
+                'Content-Type': defaultContentType,
+                'Content-Length': Buffer.byteLength(body).toString(),
+                'User-Agent': '@connexum/ai-governance webhook',
+                ...endpoint.headers,
+            };
+            // HMAC signing
+            if (endpoint.secret) {
+                const signature = crypto
+                    .createHmac('sha256', endpoint.secret)
+                    .update(body)
+                    .digest('hex');
+                headers['X-Governance-Signature'] = `sha256=${signature}`;
+            }
+            const req = transport.request({
+                hostname: url.hostname,
+                port: url.port || (isHttps ? 443 : 80),
+                path: url.pathname + url.search,
+                method: 'POST',
+                headers,
+                timeout: this.config.timeoutMs,
+            }, (res) => {
+                // Consume response body to free socket
+                res.resume();
+                resolve(res.statusCode || 0);
+            });
+            req.on('error', (err) => reject(err));
+            req.on('timeout', () => {
+                req.destroy(new Error('Request timeout'));
+            });
+            req.write(body);
+            req.end();
+        });
+    }
+    writeDLQ(event, endpointName, error) {
+        const entry = {
+            event,
+            endpoint: endpointName,
+            error,
+            attempts: this.config.maxRetries,
+            failedAt: new Date().toISOString(),
+        };
+        try {
+            fs.appendFileSync(this.dlqFile, JSON.stringify(entry) + '\n');
+        }
+        catch {
+            log.error('Failed to write to DLQ', { endpoint: endpointName });
+        }
+    }
+}
+exports.WebhookDelivery = WebhookDelivery;
+//# sourceMappingURL=webhook-delivery.js.map

package/dist/audit/webhook-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-delivery.js","sourceRoot":"","sources":["../../src/audit/webhook-delivery.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,6CAA+B;AAC/B,2CAA6B;AAC7B,+CAAiC;AACjC,qCAA2C;AAG3C,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,SAAS,CAAC,CAAC;AA0DpC,MAAa,eAAe;IAClB,MAAM,CAAkC;IACxC,OAAO,CAAS;IAChB,cAAc,GAAW,CAAC,CAAC;IAC3B,WAAW,GAAW,CAAC,CAAC;IAEhC,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,GAAG;YACZ,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,KAAK;YACpB,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,MAAM,OAAO,GAAqB,EAAE,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;gBAAE,SAAS;YAEzC,uBAAuB;YACvB,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;YAC1D,CAAC;YAED,wBAAwB;YACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,CAAC;oBACX,KAAK,EAAE,gDAAgD;iBACxD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB,GAAG;QACxB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;iBACjD,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC,CAAC;YAEnB,OAAO,KAAK;iBACT,KAAK,CAAC,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,IAAI,CAAC,EAAE;gBACV,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,IAAI,CAAC;gBAAC,CAAC;YACzD,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,MAAM,OAAO,GAAqB,EAAE,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5E,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC;gBAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9D,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM;SACzE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAAyB;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAY;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB;IAEV,KAAK,CAAC,iBAAiB,CAC7B,KAAmB,EACnB,QAAyB;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,SAAS,GAAG,EAAE,CAAC;QAEnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACnE,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAE1D,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;oBAC1C,IAAI,CAAC,cAAc,EAAE,CAAC;oBACtB,OAAO;wBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,OAAO,EAAE,IAAI;wBACb,UAAU;wBACV,QAAQ,EAAE,OAAO;wBACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACtC,CAAC;gBACJ,CAAC;gBAED,SAAS,GAAG,QAAQ,UAAU,EAAE,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAI,GAAa,CAAC,OAAO,CAAC;YACrC,CAAC;YAED,mCAAmC;YACnC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;gBAClE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAE/C,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAChC,KAAK,EAAE,SAAS;SACjB,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,KAAmB,EAAE,QAAyB;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,KAAK,EAAE;oBACL,GAAG,KAAK,CAAC,IAAI;oBACb,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB;gBACD,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;gBAC5D,UAAU,EAAE,eAAe;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,gEAAgE;QAChE,uEAAuE;QACvE,iEAAiE;QACjE,mEAAmE;QACnE,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,IAAI,qBAAqB,CAAC;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;gBACzB,YAAY,EAAE,KAAK,CAAC,SAAS;gBAC7B,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,KAAK;gBACnB,GAAG,KAAK,CAAC,IAAI;aACd,CAAC,CAAC;YACH,OAAO,MAAM,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC;QACpC,CAAC;QAED,sBAAsB;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,GAAG,KAAK;YACR,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,KAAmB;QACtC,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,GAAG,QAAQ,CAAC,CAAC,sCAAsC;QAElE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,mBAAmB;QACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,yCAAyC;QAC/D,MAAM,OAAO,GAAG,eAAe,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAE1D,gDAAgD;QAChD,MAAM,QAAQ,GAAG;YACf,WAAW,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;YAC7C,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACjE,cAAc,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;SAC/C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5B,MAAM,EAAE,GAAG,wBAAwB,QAAQ,GAAG,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvC,OAAO,IAAI,GAAG,MAAM,SAAS,IAAI,QAAQ,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;IACzF,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,qGAAqG;QACrG,MAAM,WAAW,GAA2B;YAC1C,qBAAqB,EAAE,CAAC,EAAI,QAAQ;YACpC,iBAAiB,EAAE,CAAC,EAAQ,QAAQ;YACpC,gBAAgB,EAAE,CAAC,EAAS,WAAW;YACvC,kBAAkB,EAAE,CAAC,EAAO,QAAQ;YACpC,iBAAiB,EAAE,CAAC,EAAQ,UAAU;YACtC,oBAAoB,EAAE,CAAC,EAAK,SAAS;YACrC,kBAAkB,EAAE,CAAC,EAAO,OAAO;YACnC,iBAAiB,EAAE,CAAC,EAAQ,OAAO;YACnC,kBAAkB,EAAE,CAAC,EAAO,OAAO;YACnC,iBAAiB,EAAE,CAAC,EAAQ,OAAO;YACnC,eAAe,EAAE,CAAC,EAAU,OAAO;YACnC,gBAAgB,EAAE,CAAC,EAAS,OAAO;SACpC,CAAC;QACF,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB;IAC/D,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,kDAAkD;QAClD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAEO,WAAW,CAAC,QAAyB,EAAE,IAAY;QACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAEzC,2EAA2E;YAC3E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS;gBACtD,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,kBAAkB,CAAC;YACvB,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;gBACpD,YAAY,EAAE,iCAAiC;gBAC/C,GAAG,QAAQ,CAAC,OAAO;aACpB,CAAC;YAEF,eAAe;YACf,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,MAAM;qBACrB,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;qBACrC,MAAM,CAAC,IAAI,CAAC;qBACZ,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjB,OAAO,CAAC,wBAAwB,CAAC,GAAG,UAAU,SAAS,EAAE,CAAC;YAC5D,CAAC;YAED,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAC3B;gBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aAC/B,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,uCAAuC;gBACvC,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;YAC/B,CAAC,CACF,CAAC;YAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACrB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,KAAmB,EAAE,YAAoB,EAAE,KAAa;QACvE,MAAM,KAAK,GAAoB;YAC7B,KAAK;YACL,QAAQ,EAAE,YAAY;YACtB,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAChC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACnC,CAAC;QAEF,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF;AArWD,0CAqWC"}

package/dist/audit-bots/dora.d.ts

@@ -0,0 +1,59 @@
+/**
+ * DOCAAuditBot -- Automated DORA (Regulation EU 2022/2554) compliance auditing.
+ *
+ * Covers: ICT risk management (Articles 5-15), digital operational resilience
+ * scoring, ICT incident timeline, third-party risk register, business continuity
+ * test correlation, threat-led pen test status, and regulator-incident-report
+ * generation. Does NOT call external APIs.
+ *
+ * Narrative writing is delegated to an injectable NarrativeWriter.
+ *
+ * P2A-08
+ *
+ * @connexum/ai-governance
+ */
+import { type AuditRunResult, type AuditRunner } from './scheduler';
+export interface NarrativeWriter {
+    write(controlId: string, context: string): string;
+}
+export declare class StubNarrativeWriter implements NarrativeWriter {
+    write(controlId: string, context: string): string;
+}
+export interface DORAConfig {
+    logDir: string;
+    governanceDir: string;
+    narrativeWriter?: NarrativeWriter;
+}
+export interface DORAGap {
+    article: string;
+    title: string;
+    detail: string;
+    mandatoryLevel: 'mandatory' | 'recommended';
+}
+export declare class DOCAAuditBot implements AuditRunner {
+    private logDir;
+    private governanceDir;
+    private narrativeWriter;
+    constructor(config: DORAConfig);
+    runAudit(): AuditRunResult;
+    private checkICTRiskManagementFramework;
+    private checkICTAssetManagement;
+    private checkICTSecurityPolicies;
+    private checkICTBusinessContinuity;
+    private checkICTIncidentManagement;
+    private checkICTIncidentClassification;
+    private checkICTIncidentReporting;
+    private checkBackupRestoration;
+    private checkPostIncidentReview;
+    private checkThirdPartyRiskRegister;
+    private checkCTPPOversight;
+    private checkICTTestingProgram;
+    private checkTLPTEvidence;
+    private checkContractualArrangements;
+    private checkEncryptionControls;
+    private checkAccessControls;
+    analyzeGaps(result: AuditRunResult): DORAGap[];
+    generateRegulatorReport(result: AuditRunResult): Record<string, unknown>;
+    generateReport(result: AuditRunResult, outputDir: string): string;
+}
+//# sourceMappingURL=dora.d.ts.map

package/dist/audit-bots/dora.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dora.d.ts","sourceRoot":"","sources":["../../src/audit-bots/dora.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,WAAW,EAEjB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACnD;AAED,qBAAa,mBAAoB,YAAW,eAAe;IACzD,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;CAGlD;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,aAAa,CAAC;CAC7C;AAED,qBAAa,YAAa,YAAW,WAAW;IAC9C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,eAAe,CAAkB;gBAE7B,MAAM,EAAE,UAAU;IAM9B,QAAQ,IAAI,cAAc;IA4C1B,OAAO,CAAC,+BAA+B;IAiBvC,OAAO,CAAC,uBAAuB;IAiB/B,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,0BAA0B;IAmBlC,OAAO,CAAC,0BAA0B;IAclC,OAAO,CAAC,8BAA8B;IAiBtC,OAAO,CAAC,yBAAyB;IAgBjC,OAAO,CAAC,sBAAsB;IAmB9B,OAAO,CAAC,uBAAuB;IAiB/B,OAAO,CAAC,2BAA2B;IAiBnC,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,sBAAsB;IAiB9B,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,4BAA4B;IAgBpC,OAAO,CAAC,uBAAuB;IAc/B,OAAO,CAAC,mBAAmB;IAqB3B,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,EAAE;IAe9C,uBAAuB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAyBxE,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;CA8BlE"}