@connexum/ai-governance 1.0.0-beta.11

package/dist/scanner/manifest-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-integrity.js","sourceRoot":"","sources":["../../src/scanner/manifest-integrity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AA+CH,4CAgHC;AAKD,8CAEC;AApKD,qCAA2C;AAE3C,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,oBAAoB,CAAC,CAAC;AAoB/C,iFAAiF;AACjF,MAAM,eAAe,GAAsB;IACzC,MAAM;IACN,aAAa;IACb,OAAO;IACP,MAAM;CACP,CAAC;AAEF,oEAAoE;AACpE,MAAM,aAAa,GAAsB;IACvC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO;CACjF,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,KAAoB;IACnD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEjC,2CAA2C;IAC3C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,IAAI;YACX,IAAI;YACJ,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,oEAAoE;gBACpE,uEAAuE;gBACvE,mDAAmD;SACtD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oCAAoC;IACpC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,CAAC,GAAI,QAAoC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,MAAM;gBAChB,KAAK;gBACL,IAAI;gBACJ,OAAO,EAAE,4BAA4B,KAAK,wBAAwB;gBAClE,WAAW,EACT,YAAY,KAAK,4CAA4C;oBAC7D,iEAAiE;oBACjE,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAI,QAAoC,CAAC,IAAI,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,MAAM;YACb,IAAI;YACJ,OAAO,EAAE,gDAAgD,OAAO,OAAO,GAAG;YAC1E,WAAW,EAAE,mEAAmE;SACjF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAI,QAAoC,CAAC,WAAW,CAAC;IAClE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,aAAa;YACpB,IAAI;YACJ,OAAO,EAAE,6CAA6C,OAAO,OAAO,GAAG;YACvE,WAAW,EAAE,gDAAgD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAI,QAAoC,CAAC,KAAK,CAAC;IAC7D,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,OAAO;YACd,IAAI;YACJ,OAAO,EAAE,iEAAiE,OAAO,QAAQ,GAAG;YAC5F,WAAW,EAAE,4DAA4D;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,WAAW,GAAI,QAAoC,CAAC,QAAQ,CAAC;IACnE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,UAAU;gBACjB,IAAI;gBACJ,OAAO,EAAE,oCAAoC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACxE,WAAW,EACT,6DAA6D;oBAC7D,+DAA+D;oBAC/D,wBAAwB;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,MAAM;gBACb,IAAI;gBACJ,OAAO,EACL,kBAAkB,OAAO,8BAA8B,QAAQ,KAAK;oBACpE,oEAAoE;oBACpE,kBAAkB;gBACpB,WAAW,EACT,uBAAuB,OAAO,mCAAmC;oBACjE,aAAa,QAAQ,6CAA6C;oBAClE,sDAAsD;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,KAAK,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,MAAuB;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/scanner/remediation.d.ts

@@ -0,0 +1,72 @@
+/**
+ * RemediationPlanner -- Generates actionable remediation plans from gap reports.
+ *
+ * For each identified governance gap, produces specific steps including
+ * files to create/modify, configuration changes, and pack recommendations.
+ * Steps are priority-ordered with critical gaps first.
+ *
+ * GATE 9: T-148
+ *
+ * @connexum/ai-governance
+ */
+import type { GapReport } from './gap-report';
+/** Estimated effort level for a remediation step */
+export type EffortLevel = 'low' | 'medium' | 'high';
+/** A single remediation step */
+export interface RemediationStep {
+    /** Priority order (1 = highest) */
+    priority: number;
+    /** Agent this step applies to */
+    agent: string;
+    /** The gap being addressed */
+    gap: {
+        controlId: string;
+        name: string;
+        severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+    };
+    /** Ordered actions to take */
+    actions: string[];
+    /** Files to create or modify */
+    files: string[];
+    /** Estimated effort to complete */
+    estimatedEffort: EffortLevel;
+    /** Compliance packs that benefit from this fix */
+    relatedPacks: string[];
+}
+/** Complete remediation plan */
+export interface RemediationPlan {
+    /** Project directory */
+    projectDir: string;
+    /** ISO timestamp of plan generation */
+    generatedAt: string;
+    /** Overall governance score from gap report */
+    currentScore: number;
+    /** Projected score after full remediation */
+    projectedScore: number;
+    /** Total number of steps */
+    totalSteps: number;
+    /** Ordered remediation steps (critical first) */
+    steps: RemediationStep[];
+    /** Summary of effort distribution */
+    effortSummary: {
+        low: number;
+        medium: number;
+        high: number;
+    };
+}
+export declare class RemediationPlanner {
+    /**
+     * Generate a remediation plan from a gap report.
+     */
+    generate(gapReport: GapReport): RemediationPlan;
+    /**
+     * Build a remediation step for a specific missing control.
+     */
+    private buildStep;
+    /**
+     * Project the governance score after full remediation.
+     * Assumes all steps are completed successfully.
+     */
+    private projectScore;
+}
+//# sourceMappingURL=remediation.d.ts.map

package/dist/scanner/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/scanner/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,SAAS,EAA4B,MAAM,cAAc,CAAC;AAIxE,oDAAoD;AACpD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEpD,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,GAAG,EAAE;QACH,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;KAClD,CAAC;IACF,8BAA8B;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gCAAgC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mCAAmC;IACnC,eAAe,EAAE,WAAW,CAAC;IAC7B,kDAAkD;IAClD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,qCAAqC;IACrC,aAAa,EAAE;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAUD,qBAAa,kBAAkB;IAC7B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe;IAgD/C;;OAEG;IACH,OAAO,CAAC,SAAS;IA2CjB;;;OAGG;IACH,OAAO,CAAC,YAAY;CAYrB"}

package/dist/scanner/remediation.js

@@ -0,0 +1,292 @@
+"use strict";
+/**
+ * RemediationPlanner -- Generates actionable remediation plans from gap reports.
+ *
+ * For each identified governance gap, produces specific steps including
+ * files to create/modify, configuration changes, and pack recommendations.
+ * Steps are priority-ordered with critical gaps first.
+ *
+ * GATE 9: T-148
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemediationPlanner = void 0;
+const path = __importStar(require("path"));
+const log_1 = require("../util/log");
+const log = (0, log_1.createLogger)('remediation-planner');
+/** Severity weight for priority ordering */
+const SEVERITY_WEIGHT = {
+    CRITICAL: 4,
+    HIGH: 3,
+    MEDIUM: 2,
+    LOW: 1,
+};
+class RemediationPlanner {
+    /**
+     * Generate a remediation plan from a gap report.
+     */
+    generate(gapReport) {
+        log.info(`Generating remediation plan for ${gapReport.agentGaps.length} agents`);
+        const steps = [];
+        // Generate steps for each agent gap
+        for (const agentGap of gapReport.agentGaps) {
+            for (const control of agentGap.missingControls) {
+                const step = this.buildStep(agentGap, control, gapReport.projectDir);
+                steps.push(step);
+            }
+        }
+        // Sort by priority (severity weight descending, then alphabetical by agent)
+        steps.sort((a, b) => {
+            const weightDiff = SEVERITY_WEIGHT[b.gap.severity] - SEVERITY_WEIGHT[a.gap.severity];
+            if (weightDiff !== 0)
+                return weightDiff;
+            return a.agent.localeCompare(b.agent);
+        });
+        // Assign sequential priority numbers after sorting
+        steps.forEach((step, idx) => {
+            step.priority = idx + 1;
+        });
+        // Compute effort summary
+        const effortSummary = {
+            low: steps.filter(s => s.estimatedEffort === 'low').length,
+            medium: steps.filter(s => s.estimatedEffort === 'medium').length,
+            high: steps.filter(s => s.estimatedEffort === 'high').length,
+        };
+        // Project the score improvement
+        const projectedScore = this.projectScore(gapReport);
+        log.info(`Remediation plan: ${steps.length} steps, projected score: ${projectedScore}/100`);
+        return {
+            projectDir: gapReport.projectDir,
+            generatedAt: new Date().toISOString(),
+            currentScore: gapReport.overallScore,
+            projectedScore,
+            totalSteps: steps.length,
+            steps,
+            effortSummary,
+        };
+    }
+    /**
+     * Build a remediation step for a specific missing control.
+     */
+    buildStep(agentGap, control, projectDir) {
+        const template = REMEDIATION_TEMPLATES[control.controlId];
+        if (template) {
+            return {
+                priority: 0, // Will be set after sorting
+                agent: agentGap.name,
+                gap: {
+                    controlId: control.controlId,
+                    name: control.name,
+                    severity: control.severity,
+                },
+                actions: template.actions(agentGap.name, projectDir),
+                files: template.files(agentGap.name, projectDir),
+                estimatedEffort: template.effort,
+                relatedPacks: control.frameworks,
+            };
+        }
+        // Fallback for unknown controls
+        return {
+            priority: 0,
+            agent: agentGap.name,
+            gap: {
+                controlId: control.controlId,
+                name: control.name,
+                severity: control.severity,
+            },
+            actions: [
+                `Review governance requirements for control ${control.controlId}`,
+                `Implement ${control.name} for agent '${agentGap.name}'`,
+                'Validate implementation and update governance configuration',
+            ],
+            files: [],
+            estimatedEffort: 'medium',
+            relatedPacks: control.frameworks,
+        };
+    }
+    /**
+     * Project the governance score after full remediation.
+     * Assumes all steps are completed successfully.
+     */
+    projectScore(gapReport) {
+        if (gapReport.agentGaps.length === 0)
+            return 100;
+        // If all gaps are fixed, each agent reaches 100% coverage
+        // But realistically, project a high but not perfect score
+        // to account for ongoing monitoring needs
+        const currentScore = gapReport.overallScore;
+        const gapSize = 100 - currentScore;
+        // Remediation closes ~90% of the gap (10% remains for validation/monitoring)
+        return Math.min(100, Math.round(currentScore + gapSize * 0.9));
+    }
+}
+exports.RemediationPlanner = RemediationPlanner;
+/**
+ * Remediation templates for each governance control.
+ * Provides specific, actionable guidance per control type.
+ */
+const REMEDIATION_TEMPLATES = {
+    'GOV-001': {
+        actions: (agentName, projectDir) => [
+            `Create permissions file for agent '${agentName}'`,
+            'Define allowed tools with ALLOWED status',
+            'Define blocked tools with BLOCKED status',
+            'Set APPROVAL_REQUIRED for sensitive operations',
+            'Run governance validation to confirm deny-by-default is active',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+        ],
+        effort: 'low',
+    },
+    'GOV-002': {
+        actions: (agentName) => [
+            `Enable deny-by-default access model for agent '${agentName}'`,
+            'Ensure no permissions file means zero tool access (not full access)',
+            'Verify GovernanceRuntime.filterTools() returns empty array for unknown agents',
+            'Test that unlisted tools are blocked',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+            path.join(projectDir, '.claude', 'governance.json'),
+        ],
+        effort: 'low',
+    },
+    'GOV-003': {
+        actions: (agentName) => [
+            'Configure audit logging for all agent tool calls',
+            'Set up JSONL audit trail with timestamps, agent ID, tool name, and result',
+            'Enable activity log persistence to disk',
+            'Verify log rotation is configured to prevent disk exhaustion',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'logs', `activity-${agentName}.jsonl`),
+            path.join(projectDir, '.claude', 'hooks', 'audit-logger.sh'),
+        ],
+        effort: 'medium',
+    },
+    'GOV-004': {
+        actions: (agentName) => [
+            'Enable SHA-256 tamper detection on governance files',
+            'Generate initial hash manifest for all governance files',
+            'Configure verification check on session start',
+            'Set up GovernanceTamperError handling',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'hash-manifest.json'),
+            path.join(projectDir, '.claude', 'hooks', 'verify-governance.sh'),
+        ],
+        effort: 'medium',
+    },
+    'GOV-005': {
+        actions: (agentName) => [
+            `Define explicit capability boundaries for agent '${agentName}'`,
+            'List all tools the agent may use in its permissions file',
+            'Document the rationale for each allowed capability',
+            'Block capabilities outside the agent\'s role',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+        ],
+        effort: 'low',
+    },
+    'GOV-006': {
+        actions: (agentName) => [
+            'Implement web access rate limiting (max 20 requests per session)',
+            'Enable content safety scanning for fetched web content',
+            'Enforce isolation between web fetch and consequential actions',
+            'Configure HTTPS-only policy for all web requests',
+            'Block raw IP address requests',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.claude', 'rules', 'web-interaction-security.md'),
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+        ],
+        effort: 'medium',
+    },
+    'GOV-007': {
+        actions: (agentName) => [
+            'Enable DataClassifier for PHI/PII detection in agent interactions',
+            'Configure scan categories for the relevant compliance framework',
+            'Set up automated alerts for sensitive data exposure',
+            'Implement data masking for logged content',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'data-classification.json'),
+            path.join(projectDir, '.claude', 'hooks', 'data-classifier.sh'),
+        ],
+        effort: 'high',
+    },
+    'GOV-008': {
+        actions: (agentName) => [
+            'Configure incident response procedures',
+            'Set breach notification deadline per compliance requirements',
+            'Define notification recipients and escalation paths',
+            'Create incident response template',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'incident-response.json'),
+            path.join(projectDir, '.governance', 'notification-template.md'),
+        ],
+        effort: 'medium',
+    },
+    'GOV-009': {
+        actions: (agentName) => [
+            'Enable TransparencyInjector for AI content labeling',
+            'Configure AI-generated content markers per EU AI Act Art. 50',
+            'Verify labels are present in all agent-generated outputs',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'transparency.json'),
+        ],
+        effort: 'low',
+    },
+    'GOV-010': {
+        actions: (agentName) => [
+            'Configure approval queue for critical agent actions',
+            'Define which tool calls require human approval',
+            'Set up approval notification channel',
+            'Implement timeout handling for pending approvals',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'approval-queue.json'),
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+        ],
+        effort: 'high',
+    },
+};
+//# sourceMappingURL=remediation.js.map

package/dist/scanner/remediation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../src/scanner/remediation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,2CAA6B;AAC7B,qCAA2C;AAG3C,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,qBAAqB,CAAC,CAAC;AAiDhD,4CAA4C;AAC5C,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACP,CAAC;AAEF,MAAa,kBAAkB;IAC7B;;OAEG;IACH,QAAQ,CAAC,SAAoB;QAC3B,GAAG,CAAC,IAAI,CAAC,mCAAmC,SAAS,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,CAAC;QAEjF,MAAM,KAAK,GAAsB,EAAE,CAAC;QAEpC,oCAAoC;QACpC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrF,IAAI,UAAU,KAAK,CAAC;gBAAE,OAAO,UAAU,CAAC;YACxC,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,mDAAmD;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,yBAAyB;QACzB,MAAM,aAAa,GAAG;YACpB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,MAAM;YAC1D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,MAAM;YAChE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,MAAM;SAC7D,CAAC;QAEF,gCAAgC;QAChC,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAEpD,GAAG,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,MAAM,4BAA4B,cAAc,MAAM,CAAC,CAAC;QAE5F,OAAO;YACL,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc;YACd,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,KAAK;YACL,aAAa;SACd,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,SAAS,CACf,QAAkB,EAClB,OAAuB,EACvB,UAAkB;QAElB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,CAAC,EAAE,4BAA4B;gBACzC,KAAK,EAAE,QAAQ,CAAC,IAAI;gBACpB,GAAG,EAAE;oBACH,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B;gBACD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;gBACpD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;gBAChD,eAAe,EAAE,QAAQ,CAAC,MAAM;gBAChC,YAAY,EAAE,OAAO,CAAC,UAAU;aACjC,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,QAAQ,CAAC,IAAI;YACpB,GAAG,EAAE;gBACH,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;YACD,OAAO,EAAE;gBACP,8CAA8C,OAAO,CAAC,SAAS,EAAE;gBACjE,aAAa,OAAO,CAAC,IAAI,eAAe,QAAQ,CAAC,IAAI,GAAG;gBACxD,6DAA6D;aAC9D;YACD,KAAK,EAAE,EAAE;YACT,eAAe,EAAE,QAAQ;YACzB,YAAY,EAAE,OAAO,CAAC,UAAU;SACjC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,SAAoB;QACvC,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAEjD,0DAA0D;QAC1D,0DAA0D;QAC1D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAC5C,MAAM,OAAO,GAAG,GAAG,GAAG,YAAY,CAAC;QAEnC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC;IACjE,CAAC;CACF;AAlHD,gDAkHC;AAED;;;GAGG;AACH,MAAM,qBAAqB,GAItB;IACH,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAClC,sCAAsC,SAAS,GAAG;YAClD,0CAA0C;YAC1C,0CAA0C;YAC1C,gDAAgD;YAChD,gEAAgE;SACjE;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;SACnE;QACD,MAAM,EAAE,KAAK;KACd;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,kDAAkD,SAAS,GAAG;YAC9D,qEAAqE;YACrE,+EAA+E;YAC/E,sCAAsC;SACvC;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,iBAAiB,CAAC;SACpD;QACD,MAAM,EAAE,KAAK;KACd;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,kDAAkD;YAClD,2EAA2E;YAC3E,yCAAyC;YACzC,8DAA8D;SAC/D;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,SAAS,QAAQ,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC;SAC7D;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,qDAAqD;YACrD,yDAAyD;YACzD,+CAA+C;YAC/C,uCAAuC;SACxC;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,oBAAoB,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC;SAClE;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,oDAAoD,SAAS,GAAG;YAChE,0DAA0D;YAC1D,oDAAoD;YACpD,8CAA8C;SAC/C;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;SACnE;QACD,MAAM,EAAE,KAAK;KACd;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,kEAAkE;YAClE,wDAAwD;YACxD,+DAA+D;YAC/D,kDAAkD;YAClD,+BAA+B;SAChC;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;SACnE;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,mEAAmE;YACnE,iEAAiE;YACjE,qDAAqD;YACrD,2CAA2C;SAC5C;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,0BAA0B,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,CAAC;SAChE;QACD,MAAM,EAAE,MAAM;KACf;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,wCAAwC;YACxC,8DAA8D;YAC9D,qDAAqD;YACrD,mCAAmC;SACpC;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,wBAAwB,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,0BAA0B,CAAC;SACjE;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,qDAAqD;YACrD,8DAA8D;YAC9D,0DAA0D;SAC3D;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,CAAC;SAC1D;QACD,MAAM,EAAE,KAAK;KACd;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,qDAAqD;YACrD,gDAAgD;YAChD,sCAAsC;YACtC,kDAAkD;SACnD;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,qBAAqB,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;SACnE;QACD,MAAM,EAAE,MAAM;KACf;CACF,CAAC"}

package/dist/security/access-review.d.ts

@@ -0,0 +1,122 @@
+/**
+ * AccessReview -- Quarterly access review for compliance frameworks.
+ *
+ * SOC 2, HIPAA, and ISO 27001 require periodic review of access rights.
+ * This module automates the review process:
+ *   - Generates access review reports
+ *   - Flags inactive operators for deactivation
+ *   - Tracks review completion status
+ *   - Maintains review audit trail
+ *
+ * T-060: Quarterly access review automation.
+ *
+ * @connexum/ai-governance
+ */
+export interface AccessReviewConfig {
+    /** Directory for review data */
+    reviewDir: string;
+    /** Review frequency in ms (default: 90 days / quarterly) */
+    reviewFrequencyMs?: number;
+    /** Days of inactivity before flagging (default: 30) */
+    inactivityThresholdDays?: number;
+    /** Organization name for reports */
+    organizationName?: string;
+}
+export interface ReviewCycle {
+    id: string;
+    startedAt: string;
+    deadline: string;
+    completedAt?: string;
+    status: 'IN_PROGRESS' | 'COMPLETED' | 'OVERDUE';
+    entries: ReviewEntry[];
+    summary?: ReviewSummary;
+}
+export interface ReviewEntry {
+    operatorId: string;
+    operatorName: string;
+    role: string;
+    active: boolean;
+    lastActivity?: string;
+    flags: ReviewFlag[];
+    decision: 'RETAIN' | 'MODIFY' | 'REVOKE' | 'PENDING';
+    reviewedBy?: string;
+    reviewedAt?: string;
+    notes?: string;
+}
+export type ReviewFlag = 'INACTIVE' | 'ELEVATED_PRIVILEGES' | 'NO_RECENT_LOGIN' | 'ROLE_MISMATCH' | 'NEW_OPERATOR';
+export interface ReviewSummary {
+    totalOperators: number;
+    retained: number;
+    modified: number;
+    revoked: number;
+    pending: number;
+    flaggedInactive: number;
+    completionRate: number;
+}
+export interface OperatorInfo {
+    id: string;
+    name: string;
+    role: string;
+    active: boolean;
+    lastActivity?: string;
+    createdAt?: string;
+}
+export declare class AccessReview {
+    private config;
+    private cyclesFile;
+    private auditFile;
+    constructor(config: AccessReviewConfig);
+    /**
+     * Start a new review cycle.
+     */
+    startReview(operators: OperatorInfo[]): ReviewCycle;
+    /**
+     * Record a review decision for an operator.
+     */
+    recordDecision(cycleId: string, operatorId: string, decision: 'RETAIN' | 'MODIFY' | 'REVOKE', reviewedBy: string, notes?: string): void;
+    /**
+     * Complete a review cycle (all decisions must be recorded).
+     */
+    completeReview(cycleId: string): ReviewSummary;
+    /**
+     * Check if a review is due based on the last completed review.
+     *
+     * SYSTEMIC-M2 contract (2026-04-22): the return direction is
+     * "review IS due" -- callers must treat `true` as "access must be
+     * re-attested NOW" and `false` as "review not yet due, no action
+     * needed." Any caller that interprets `true` as "no review needed"
+     * has the direction inverted and must be fixed immediately.
+     *
+     * @returns {boolean} true = review is due (access must be re-attested);
+     *                    false = review not yet due, no action needed.
+     */
+    isReviewDue(): boolean;
+    /**
+     * Get the current (most recent) review cycle.
+     */
+    getCurrentCycle(): ReviewCycle | undefined;
+    /**
+     * Get all review cycles.
+     */
+    getAllCycles(): ReviewCycle[];
+    /**
+     * Get overdue review cycles.
+     */
+    getOverdue(): ReviewCycle[];
+    /**
+     * Get review statistics across all cycles.
+     */
+    getStats(): {
+        totalCycles: number;
+        completedCycles: number;
+        overdueCycles: number;
+        isReviewDue: boolean;
+        lastCompletedAt?: string;
+    };
+    private createEntry;
+    private computeSummary;
+    private loadCycles;
+    private saveCycles;
+    private audit;
+}
+//# sourceMappingURL=access-review.d.ts.map

package/dist/security/access-review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-review.d.ts","sourceRoot":"","sources":["../../src/security/access-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uDAAuD;IACvD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;IAChD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,qBAAqB,GACrB,iBAAiB,GACjB,eAAe,GACf,cAAc,CAAC;AAEnB,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;gBAEd,MAAM,EAAE,kBAAkB;IAgBtC;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,WAAW;IAoBnD;;OAEG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACxC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,IAAI;IAkBP;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa;IAoB9C;;;;;;;;;;;OAWG;IACH,WAAW,IAAI,OAAO;IAYtB;;OAEG;IACH,eAAe,IAAI,WAAW,GAAG,SAAS;IAK1C;;OAEG;IACH,YAAY,IAAI,WAAW,EAAE;IAI7B;;OAEG;IACH,UAAU,IAAI,WAAW,EAAE;IAU3B;;OAEG;IACH,QAAQ,IAAI;QACV,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,OAAO,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAmBD,OAAO,CAAC,WAAW;IAwCnB,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,KAAK;CAcd"}