@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/audit/report-templates/prompts/index.js

@@ -0,0 +1,43 @@
+/**
+ * Per-framework narrative prompt specs -- barrel export.
+ *
+ * Eight compliance frameworks each declare section headings,
+ * evidence-linkage requirements, and required control mappings.
+ * The AuditNarrativeGenerator uses these specs to structure
+ * LLM prompts and validate evidence coverage before generation.
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+// Per-framework prompt specs
+export { HIPAA_PROMPT_SPEC } from './hipaa.js';
+export { HITECH_PROMPT_SPEC } from './hitech.js';
+export { SOC2_PROMPT_SPEC } from './soc2.js';
+export { ISO27001_PROMPT_SPEC } from './iso27001.js';
+export { EU_AI_ACT_PROMPT_SPEC } from './euaiact.js';
+export { DORA_PROMPT_SPEC } from './dora.js';
+export { PCI_DSS_PROMPT_SPEC } from './pcidss.js';
+export { GDPR_PROMPT_SPEC } from './gdpr.js';
+// ---------------------------------------------------------------------------
+// Registry -- all 8 prompt specs keyed by frameworkId
+// ---------------------------------------------------------------------------
+import { HIPAA_PROMPT_SPEC } from './hipaa.js';
+import { HITECH_PROMPT_SPEC } from './hitech.js';
+import { SOC2_PROMPT_SPEC } from './soc2.js';
+import { ISO27001_PROMPT_SPEC } from './iso27001.js';
+import { EU_AI_ACT_PROMPT_SPEC } from './euaiact.js';
+import { DORA_PROMPT_SPEC } from './dora.js';
+import { PCI_DSS_PROMPT_SPEC } from './pcidss.js';
+import { GDPR_PROMPT_SPEC } from './gdpr.js';
+export const FRAMEWORK_PROMPT_REGISTRY = new Map([
+    [HIPAA_PROMPT_SPEC.frameworkId, HIPAA_PROMPT_SPEC],
+    [HITECH_PROMPT_SPEC.frameworkId, HITECH_PROMPT_SPEC],
+    [SOC2_PROMPT_SPEC.frameworkId, SOC2_PROMPT_SPEC],
+    [ISO27001_PROMPT_SPEC.frameworkId, ISO27001_PROMPT_SPEC],
+    [EU_AI_ACT_PROMPT_SPEC.frameworkId, EU_AI_ACT_PROMPT_SPEC],
+    [DORA_PROMPT_SPEC.frameworkId, DORA_PROMPT_SPEC],
+    [PCI_DSS_PROMPT_SPEC.frameworkId, PCI_DSS_PROMPT_SPEC],
+    [GDPR_PROMPT_SPEC.frameworkId, GDPR_PROMPT_SPEC],
+]);
+//# sourceMappingURL=index.js.map

package/dist/esm/audit/report-templates/prompts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,6BAA6B;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,MAAM,CAAC,MAAM,yBAAyB,GAA6C,IAAI,GAAG,CAAC;IACzF,CAAC,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAClD,CAAC,kBAAkB,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACpD,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC;IAChD,CAAC,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC;IACxD,CAAC,qBAAqB,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC1D,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC;IAChD,CAAC,mBAAmB,CAAC,WAAW,EAAE,mBAAmB,CAAC;IACtD,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC;CACjD,CAAC,CAAC"}

package/dist/esm/audit/report-templates/prompts/iso27001.js

@@ -0,0 +1,107 @@
+/**
+ * ISO 27001 per-framework narrative prompt context.
+ *
+ * Declares section headings, evidence-linkage requirements, and required
+ * control mappings for ISO/IEC 27001:2022 compliance narratives.
+ *
+ * References:
+ *   ISO/IEC 27001:2022 -- Information Security Management Systems (ISMS)
+ *   ISO/IEC 27002:2022 -- Security controls guidance
+ *   ISO/IEC 27005:2022 -- Information security risk management
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export const ISO27001_PROMPT_SPEC = {
+    frameworkId: 'iso27001',
+    frameworkName: 'ISO/IEC 27001:2022',
+    version: 'ISO/IEC 27001:2022 (Third edition, 2022-10)',
+    sections: [
+        {
+            sectionId: 'iso27001-clause5-leadership',
+            heading: 'Clause 5 Leadership and Commitment',
+            regulatoryRef: 'ISO/IEC 27001:2022 Clause 5.1-5.3',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                '5.1 -- Leadership and commitment (top management sponsorship)',
+                '5.2 -- Information security policy (formal policy establishment)',
+                '5.3 -- Organizational roles, responsibilities, and authorities',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Document leadership and governance structure of the AI security management system. ' +
+                'Describe how agent registration events reflect top-management-approved onboarding ' +
+                'processes. Note the policy framework under which governance verdicts are issued. ' +
+                'This section establishes the organisational context required by Clause 5.',
+        },
+        {
+            sectionId: 'iso27001-clause6-planning',
+            heading: 'Clause 6 Planning (Risk Management)',
+            regulatoryRef: 'ISO/IEC 27001:2022 Clause 6.1-6.3',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                '6.1.1 -- Actions to address risks and opportunities',
+                '6.1.2 -- Information security risk assessment',
+                '6.1.3 -- Information security risk treatment',
+                '6.2 -- Information security objectives',
+                '6.3 -- Planning of changes',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document risk identification and treatment activities surfaced by the AI governance ' +
+                'runtime. Cite governance verdict events as evidence that risk treatment controls fired. ' +
+                'Cite deny-decision events where risk-based access restrictions were enforced. ' +
+                'Quantify the risk treatment coverage rate (governance decisions / total agent actions). ' +
+                'Address any residual risks identified in the audit window.',
+        },
+        {
+            sectionId: 'iso27001-annex-a5-organisational',
+            heading: 'Annex A.5 Organisational Controls',
+            regulatoryRef: 'ISO/IEC 27001:2022 Annex A, Controls 5.1-5.37',
+            requiredEventTypes: ['governance:verdict', 'approval:decided'],
+            controlMappings: [
+                'A.5.2 -- Information security roles and responsibilities',
+                'A.5.10 -- Acceptable use of information and assets',
+                'A.5.15 -- Access control policy',
+                'A.5.16 -- Identity management',
+                'A.5.17 -- Authentication information',
+                'A.5.18 -- Access rights (least privilege, review, revocation)',
+                'A.5.23 -- Information security for use of cloud services',
+                'A.5.26 -- Response to information security incidents',
+                'A.5.36 -- Compliance with policies and standards',
+                'A.5.37 -- Documented operating procedures',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Map governance runtime controls to Annex A.5 organisational controls. ' +
+                'For A.5.15-5.18 (access controls), cite governance verdicts and deny decisions. ' +
+                'For A.5.26 (incident response), cite any incident events and response timelines. ' +
+                'For A.5.36 (compliance), cite governance verdict events showing policy conformance rates. ' +
+                'Quantify: policy violations, access control decisions, and incident response actions.',
+        },
+        {
+            sectionId: 'iso27001-annex-a8-technological',
+            heading: 'Annex A.8 Technological Controls',
+            regulatoryRef: 'ISO/IEC 27001:2022 Annex A, Controls 8.1-8.34',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                'A.8.2 -- Privileged access rights management',
+                'A.8.3 -- Information access restriction',
+                'A.8.4 -- Access to source code',
+                'A.8.5 -- Secure authentication',
+                'A.8.9 -- Configuration management',
+                'A.8.15 -- Logging (audit logs generation and protection)',
+                'A.8.16 -- Monitoring activities',
+                'A.8.17 -- Clock synchronisation',
+                'A.8.24 -- Use of cryptography',
+                'A.8.25 -- Secure development lifecycle',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document technological controls active in the AI governance platform. ' +
+                'For A.8.15 (logging), describe audit chain completeness and tamper-resistance. ' +
+                'For A.8.16 (monitoring), cite anomaly detection and circuit-breaker events. ' +
+                'For A.8.24 (cryptography), note SHA-256 chain integrity and transport encryption. ' +
+                'For A.8.2-8.5 (access), cite deny events as evidence of privilege enforcement. ' +
+                'Provide quantified coverage metrics for each relevant sub-control.',
+        },
+    ],
+};
+//# sourceMappingURL=iso27001.js.map

package/dist/esm/audit/report-templates/prompts/iso27001.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso27001.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/iso27001.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,WAAW,EAAE,UAAU;IACvB,aAAa,EAAE,oBAAoB;IACnC,OAAO,EAAE,6CAA6C;IACtD,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,6BAA6B;YACxC,OAAO,EAAE,oCAAoC;YAC7C,aAAa,EAAE,mCAAmC;YAClD,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,+DAA+D;gBAC/D,kEAAkE;gBAClE,gEAAgE;aACjE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,qFAAqF;gBACrF,oFAAoF;gBACpF,mFAAmF;gBACnF,2EAA2E;SAC9E;QACD;YACE,SAAS,EAAE,2BAA2B;YACtC,OAAO,EAAE,qCAAqC;YAC9C,aAAa,EAAE,mCAAmC;YAClD,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,qDAAqD;gBACrD,+CAA+C;gBAC/C,8CAA8C;gBAC9C,wCAAwC;gBACxC,4BAA4B;aAC7B;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,sFAAsF;gBACtF,0FAA0F;gBAC1F,gFAAgF;gBAChF,0FAA0F;gBAC1F,4DAA4D;SAC/D;QACD;YACE,SAAS,EAAE,kCAAkC;YAC7C,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,+CAA+C;YAC9D,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;YAC9D,eAAe,EAAE;gBACf,0DAA0D;gBAC1D,oDAAoD;gBACpD,iCAAiC;gBACjC,+BAA+B;gBAC/B,sCAAsC;gBACtC,+DAA+D;gBAC/D,0DAA0D;gBAC1D,sDAAsD;gBACtD,kDAAkD;gBAClD,2CAA2C;aAC5C;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,wEAAwE;gBACxE,kFAAkF;gBAClF,mFAAmF;gBACnF,4FAA4F;gBAC5F,uFAAuF;SAC1F;QACD;YACE,SAAS,EAAE,iCAAiC;YAC5C,OAAO,EAAE,kCAAkC;YAC3C,aAAa,EAAE,+CAA+C;YAC9D,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,8CAA8C;gBAC9C,yCAAyC;gBACzC,gCAAgC;gBAChC,gCAAgC;gBAChC,mCAAmC;gBACnC,0DAA0D;gBAC1D,iCAAiC;gBACjC,iCAAiC;gBACjC,+BAA+B;gBAC/B,wCAAwC;aACzC;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,wEAAwE;gBACxE,iFAAiF;gBACjF,8EAA8E;gBAC9E,oFAAoF;gBACpF,iFAAiF;gBACjF,oEAAoE;SACvE;KACF;CACF,CAAC"}

package/dist/esm/audit/report-templates/prompts/pcidss.js

@@ -0,0 +1,108 @@
+/**
+ * PCI DSS per-framework narrative prompt context.
+ *
+ * Declares section headings, evidence-linkage requirements, and required
+ * control mappings for PCI DSS v4.0 compliance narratives.
+ *
+ * References:
+ *   PCI Security Standards Council -- PCI DSS v4.0 (March 2022)
+ *   PCI DSS v4.0 ROC Reporting Template
+ *   PCI DSS v4.0 SAQ (Self-Assessment Questionnaire) variants A through D
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export const PCI_DSS_PROMPT_SPEC = {
+    frameworkId: 'pci-dss',
+    frameworkName: 'PCI DSS v4.0',
+    version: 'PCI DSS v4.0 (March 2022)',
+    sections: [
+        {
+            sectionId: 'pcidss-req7-access-control',
+            heading: 'Requirement 7 Restrict Access to System Components',
+            regulatoryRef: 'PCI DSS v4.0 Requirement 7',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                '7.1.1 -- Processes for granting and revoking access to CHD components',
+                '7.2.1 -- Access control model covering all system components and data',
+                '7.2.2 -- Privileged user access assigned based on need-to-know',
+                '7.2.4 -- All user accounts reviewed at least every 6 months',
+                '7.3.1 -- Automated mechanisms to manage access rights',
+                '7.3.2 -- Automated access control systems to enforce access restrictions',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document access control enforcement over AI agents handling cardholder data (CHD). ' +
+                'Cite governance verdict events demonstrating that every AI agent action on CHD ' +
+                'components was evaluated against an access control policy. ' +
+                'Cite deny-decision events as evidence of need-to-know enforcement (7.2.2). ' +
+                'Quantify: total access decisions, denial rate, and any privileged access escalations.',
+        },
+        {
+            sectionId: 'pcidss-req8-authentication',
+            heading: 'Requirement 8 Identify Users and Authenticate Access',
+            regulatoryRef: 'PCI DSS v4.0 Requirement 8',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                '8.2.1 -- Unique IDs assigned to all users and system accounts',
+                '8.2.2 -- Group, shared, or generic accounts managed with approval',
+                '8.3.4 -- Invalid authentication attempts locked out after 10 attempts',
+                '8.4.1 -- MFA implemented for all non-console administrative access into CDE',
+                '8.6.1 -- System/application accounts managed by policies and procedures',
+                '8.6.2 -- Passwords/passphrases for system/application accounts not hard-coded',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Demonstrate AI agent identity controls under Requirement 8. ' +
+                'Cite agent registration events as evidence of unique ID assignment (8.2.1). ' +
+                'Cite governance verdict events showing that agent authentication status was ' +
+                'verified before CDE access was granted. Quantify: registered agent IDs, ' +
+                'authentication verification events, and any lockout/suspension actions. ' +
+                'Note that AI agents are treated as system/application accounts under 8.6.1.',
+        },
+        {
+            sectionId: 'pcidss-req10-logging',
+            heading: 'Requirement 10 Log and Monitor All Access',
+            regulatoryRef: 'PCI DSS v4.0 Requirement 10',
+            requiredEventTypes: ['governance:verdict', 'agent:registered'],
+            controlMappings: [
+                '10.2.1 -- Audit logs capturing all individual user access to CHD',
+                '10.2.1.1 -- All actions taken by root/admin privilege',
+                '10.2.1.2 -- All access to audit logs',
+                '10.2.1.3 -- All invalid logical access attempts',
+                '10.2.1.5 -- Use of and changes to identification/authentication mechanisms',
+                '10.3.1 -- Audit logs protected from destruction and modification',
+                '10.3.2 -- Audit log files protected from unauthorized modifications',
+                '10.5.1 -- Retain audit log history for at least 12 months',
+                '10.6.1 -- Synchronised system clocks (NTP/similar)',
+                '10.7.1 -- Failures of critical security controls detected and responded to',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Provide evidence of audit log completeness and integrity for PCI Requirement 10. ' +
+                'Describe the audit chain architecture: hash-linked chain, tamper detection, ' +
+                'all event types captured. Cite agent and governance events as log completeness evidence. ' +
+                'Document log retention period against the 12-month minimum (10.5.1). ' +
+                'Note SHA-256 chain integrity as evidence of log protection (10.3.1-10.3.2). ' +
+                'Quantify: events logged per day, coverage rate, and any chain gaps detected.',
+        },
+        {
+            sectionId: 'pcidss-req12-policies',
+            heading: 'Requirement 12 Security Policies and Programs',
+            regulatoryRef: 'PCI DSS v4.0 Requirement 12',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                '12.1.1 -- Overall information security policy established and communicated',
+                '12.3.1 -- Targeted risk analyses performed for PCI DSS requirements',
+                '12.6.2 -- Security awareness program reviewed at least annually',
+                '12.10.1 -- Incident response plan maintained and tested',
+                '12.10.7 -- Incident response procedures for payment page scripts',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Document policy and program controls for AI agent operations in the CDE. ' +
+                'Describe how compliance packs encode the security policies required by 12.1.1. ' +
+                'Reference agent registration events as evidence of the structured onboarding ' +
+                'program required for system accounts. Note governance verdict coverage as ' +
+                'evidence that policy awareness is operationalised, not merely documented.',
+        },
+    ],
+};
+//# sourceMappingURL=pcidss.js.map

package/dist/esm/audit/report-templates/prompts/pcidss.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pcidss.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/pcidss.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,MAAM,CAAC,MAAM,mBAAmB,GAAwB;IACtD,WAAW,EAAE,SAAS;IACtB,aAAa,EAAE,cAAc;IAC7B,OAAO,EAAE,2BAA2B;IACpC,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,4BAA4B;YACvC,OAAO,EAAE,oDAAoD;YAC7D,aAAa,EAAE,4BAA4B;YAC3C,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,uEAAuE;gBACvE,uEAAuE;gBACvE,gEAAgE;gBAChE,6DAA6D;gBAC7D,uDAAuD;gBACvD,0EAA0E;aAC3E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,qFAAqF;gBACrF,iFAAiF;gBACjF,6DAA6D;gBAC7D,6EAA6E;gBAC7E,uFAAuF;SAC1F;QACD;YACE,SAAS,EAAE,4BAA4B;YACvC,OAAO,EAAE,sDAAsD;YAC/D,aAAa,EAAE,4BAA4B;YAC3C,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,+DAA+D;gBAC/D,mEAAmE;gBACnE,uEAAuE;gBACvE,6EAA6E;gBAC7E,yEAAyE;gBACzE,+EAA+E;aAChF;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,8DAA8D;gBAC9D,8EAA8E;gBAC9E,8EAA8E;gBAC9E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,6EAA6E;SAChF;QACD;YACE,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,2CAA2C;YACpD,aAAa,EAAE,6BAA6B;YAC5C,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;YAC9D,eAAe,EAAE;gBACf,kEAAkE;gBAClE,uDAAuD;gBACvD,sCAAsC;gBACtC,iDAAiD;gBACjD,4EAA4E;gBAC5E,kEAAkE;gBAClE,qEAAqE;gBACrE,2DAA2D;gBAC3D,oDAAoD;gBACpD,4EAA4E;aAC7E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,mFAAmF;gBACnF,8EAA8E;gBAC9E,2FAA2F;gBAC3F,uEAAuE;gBACvE,8EAA8E;gBAC9E,8EAA8E;SACjF;QACD;YACE,SAAS,EAAE,uBAAuB;YAClC,OAAO,EAAE,+CAA+C;YACxD,aAAa,EAAE,6BAA6B;YAC5C,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,4EAA4E;gBAC5E,qEAAqE;gBACrE,iEAAiE;gBACjE,yDAAyD;gBACzD,kEAAkE;aACnE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,2EAA2E;gBAC3E,iFAAiF;gBACjF,+EAA+E;gBAC/E,4EAA4E;gBAC5E,2EAA2E;SAC9E;KACF;CACF,CAAC"}

package/dist/esm/audit/report-templates/prompts/soc2.js

@@ -0,0 +1,114 @@
+/**
+ * SOC 2 per-framework narrative prompt context.
+ *
+ * Declares section headings, evidence-linkage requirements, and required
+ * control mappings for SOC 2 Type II compliance narratives.
+ *
+ * References:
+ *   AICPA TSP Section 100 (2017) -- Trust Services Criteria
+ *   AICPA AT-C Section 205 -- Examination Engagements
+ *   AICPA Guide: Reporting on Controls at a Service Organization (SOC 2)
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export const SOC2_PROMPT_SPEC = {
+    frameworkId: 'soc2',
+    frameworkName: 'SOC 2 Type II',
+    version: 'AICPA TSP Section 100 (2017 Trust Services Criteria)',
+    sections: [
+        {
+            sectionId: 'soc2-cc1-control-environment',
+            heading: 'CC1 Control Environment',
+            regulatoryRef: 'AICPA TSP CC1.1-CC1.5',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                'CC1.1 -- COSO Principle 1: Commitment to integrity and ethical values',
+                'CC1.2 -- COSO Principle 2: Board oversight of internal control',
+                'CC1.3 -- COSO Principle 3: Organizational structures and authority',
+                'CC1.4 -- COSO Principle 4: Commitment to competence',
+                'CC1.5 -- COSO Principle 5: Accountability for internal control',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Describe the AI governance control environment. Cite agent registration events ' +
+                'demonstrating that only authorized agents operate within the service boundary. ' +
+                'Cite governance verdicts showing that controls are consistently applied and that ' +
+                'accountability mechanisms (agent IDs, decision logs) are in place. Quantify the ' +
+                'number of registered agents and governance decisions in the audit period.',
+        },
+        {
+            sectionId: 'soc2-cc2-communication',
+            heading: 'CC2 Communication and Information',
+            regulatoryRef: 'AICPA TSP CC2.1-CC2.3',
+            requiredEventTypes: ['agent:registered', 'approval:decided'],
+            controlMappings: [
+                'CC2.1 -- COSO Principle 13: Use of relevant quality information',
+                'CC2.2 -- COSO Principle 14: Internal communication of control information',
+                'CC2.3 -- COSO Principle 15: External communication to affected parties',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Document information flows within the AI governance platform relevant to CC2. ' +
+                'Describe how approval decisions are communicated, how agents receive policy updates, ' +
+                'and how governance findings are escalated to responsible parties. Reference approval ' +
+                'events as evidence of structured communication channels.',
+        },
+        {
+            sectionId: 'soc2-cc6-logical-access',
+            heading: 'CC6 Logical and Physical Access Controls',
+            regulatoryRef: 'AICPA TSP CC6.1-CC6.8',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                'CC6.1 -- Logical access security measures to meet objectives',
+                'CC6.2 -- Prior to issuing system credentials: registration and authorization',
+                'CC6.3 -- Role-based access and least-privilege enforcement',
+                'CC6.6 -- Logical access measures against threats from outside',
+                'CC6.7 -- Transmission of data restricted to authorised users',
+                'CC6.8 -- Controls to prevent or detect unauthorized software deployment',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Provide evidence of logical access control effectiveness. Cite governance verdict ' +
+                'events showing that role checks fired before every privileged agent action. ' +
+                'Cite deny-decision events demonstrating least-privilege enforcement. Quantify: ' +
+                'total access decisions, denial rate, and any access attempts outside registered ' +
+                'agent scopes. Transmission encryption controls should be noted if audit chain ' +
+                'shows HTTPS-enforced event submission.',
+        },
+        {
+            sectionId: 'soc2-cc7-system-operations',
+            heading: 'CC7 System Operations',
+            regulatoryRef: 'AICPA TSP CC7.1-CC7.5',
+            requiredEventTypes: ['governance:verdict', 'incident:created'],
+            controlMappings: [
+                'CC7.1 -- Detection and monitoring of new vulnerabilities',
+                'CC7.2 -- Monitoring of system components for anomalies',
+                'CC7.3 -- Evaluation of security events to identify incidents',
+                'CC7.4 -- Response to identified security incidents',
+                'CC7.5 -- Recovery of affected systems after a security incident',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document system operations and incident management posture. Describe anomaly ' +
+                'detection events (circuit-breaker trips, threshold violations) as evidence for CC7.2. ' +
+                'For any incident events, trace the detection-to-response timeline. If no incidents ' +
+                'occurred, document the absence of qualifying events with chain evidence. ' +
+                'Quantify monitoring coverage and detection latency where audit data permits.',
+        },
+        {
+            sectionId: 'soc2-cc9-risk-mitigation',
+            heading: 'CC9 Risk Mitigation',
+            regulatoryRef: 'AICPA TSP CC9.1-CC9.2',
+            requiredEventTypes: ['governance:verdict', 'approval:decided'],
+            controlMappings: [
+                'CC9.1 -- Identification and assessment of risks from vendors and business partners',
+                'CC9.2 -- Risk monitoring through approved vendor relationships',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Describe risk mitigation controls applied to AI agent vendor relationships. ' +
+                'Document how LLM provider integrations are governed (approval gates for new adapters, ' +
+                'vendor risk assessments). Cite approval events for any new LLM or orchestrator ' +
+                'provider onboarding during the audit window. Note any vendor-related governance ' +
+                'verdicts or policy changes.',
+        },
+    ],
+};
+//# sourceMappingURL=soc2.js.map

package/dist/esm/audit/report-templates/prompts/soc2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/soc2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,MAAM,CAAC,MAAM,gBAAgB,GAAwB;IACnD,WAAW,EAAE,MAAM;IACnB,aAAa,EAAE,eAAe;IAC9B,OAAO,EAAE,sDAAsD;IAC/D,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,8BAA8B;YACzC,OAAO,EAAE,yBAAyB;YAClC,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,uEAAuE;gBACvE,gEAAgE;gBAChE,oEAAoE;gBACpE,qDAAqD;gBACrD,gEAAgE;aACjE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,iFAAiF;gBACjF,iFAAiF;gBACjF,mFAAmF;gBACnF,kFAAkF;gBAClF,2EAA2E;SAC9E;QACD;YACE,SAAS,EAAE,wBAAwB;YACnC,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;YAC5D,eAAe,EAAE;gBACf,iEAAiE;gBACjE,2EAA2E;gBAC3E,wEAAwE;aACzE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,gFAAgF;gBAChF,uFAAuF;gBACvF,uFAAuF;gBACvF,0DAA0D;SAC7D;QACD;YACE,SAAS,EAAE,yBAAyB;YACpC,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,8DAA8D;gBAC9D,8EAA8E;gBAC9E,4DAA4D;gBAC5D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,yEAAyE;aAC1E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,oFAAoF;gBACpF,8EAA8E;gBAC9E,iFAAiF;gBACjF,kFAAkF;gBAClF,gFAAgF;gBAChF,wCAAwC;SAC3C;QACD;YACE,SAAS,EAAE,4BAA4B;YACvC,OAAO,EAAE,uBAAuB;YAChC,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;YAC9D,eAAe,EAAE;gBACf,0DAA0D;gBAC1D,wDAAwD;gBACxD,8DAA8D;gBAC9D,oDAAoD;gBACpD,iEAAiE;aAClE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,+EAA+E;gBAC/E,wFAAwF;gBACxF,qFAAqF;gBACrF,2EAA2E;gBAC3E,8EAA8E;SACjF;QACD;YACE,SAAS,EAAE,0BAA0B;YACrC,OAAO,EAAE,qBAAqB;YAC9B,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;YAC9D,eAAe,EAAE;gBACf,oFAAoF;gBACpF,gEAAgE;aACjE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,8EAA8E;gBAC9E,wFAAwF;gBACxF,iFAAiF;gBACjF,kFAAkF;gBAClF,6BAA6B;SAChC;KACF;CACF,CAAC"}

package/dist/esm/audit/report-templates/soc2-type-ii.js

@@ -0,0 +1,184 @@
+/**
+ * SOC 2 Type II Evidence Report Template
+ *
+ * Covers all five Trust Services Criteria (TSC): Security (CC), Availability
+ * (A), Confidentiality (C), Processing Integrity (PI), and Privacy (P).
+ *
+ * SOC 2 Type II attestations require evidence of operating effectiveness
+ * over a defined review period (AICPA AT-C 205). Every section in this
+ * template requires citations -- uncited claims are rejected before the
+ * rendered artefact is returned.
+ *
+ * Regulatory references:
+ *   AICPA Trust Services Criteria 2017 (TSC CC6.1-CC9.2)
+ *   AICPA AT-C Section 205 -- Examination Engagements
+ *   COSO Internal Control -- Integrated Framework 2013
+ *
+ * Spec: P4-AIR-02 item 1
+ *
+ * @connexum/ai-governance
+ */
+const CITATION_INSTRUCTION = `
+MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
+audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
+event IDs from the AVAILABLE EVENTS list supplied in context. If the available
+events do not support a claim, write "Insufficient evidence in the audit window
+to support this assertion." Never fabricate event IDs or invent facts.
+`.trim();
+export const SOC2_TYPE_II_TEMPLATE = {
+    templateId: 'tpl-soc2-type-ii-v1',
+    name: 'SOC 2 Type II Evidence Report',
+    framework: 'soc2',
+    requiredAuditEventTypes: [
+        'governance:verdict',
+        'approval:decided',
+        'agent:registered',
+    ],
+    artefactFormat: 'pdf',
+    legalReviewRequired: true,
+    sections: [
+        {
+            id: 'soc2-cc6-logical-access',
+            title: 'CC6: Logical and Physical Access Controls',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the CC6 (Logical and Physical Access Controls) section of a
+SOC 2 Type II evidence report for an AI governance platform.
+
+TSC Reference: CC6.1 (prior to granting access), CC6.2 (credentials management),
+CC6.3 (access removal), CC6.6 (network controls), CC6.7 (transmission encryption),
+CC6.8 (malware protection).
+
+Using ONLY the audit-chain events provided, describe:
+1. How AI agent access is granted, provisioned, and revoked (cite registration
+   and de-registration events from the chain).
+2. Evidence that the governance runtime enforced deny decisions for out-of-scope
+   tool invocations during the review period.
+3. Any access anomalies or policy violations detected and the enforcement actions
+   taken.
+4. Quantify: number of access-control events, deny rate, and any escalations.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs suitable for a Type II auditor package. Do not
+include the word "draft" -- this is the authoritative evidence narrative.
+`.trim(),
+        },
+        {
+            id: 'soc2-cc7-monitoring',
+            title: 'CC7: System Operations and Monitoring',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the CC7 (System Operations) section of a SOC 2 Type II report.
+
+TSC Reference: CC7.1 (detection and monitoring), CC7.2 (evaluation of security
+events), CC7.3 (response), CC7.4 (recovery), CC7.5 (post-incident review).
+
+Using ONLY the audit-chain events provided, describe:
+1. Continuous monitoring controls active during the review period, including
+   anomaly detection and circuit-breaker enforcement.
+2. Security events detected, their severity classification, and the response
+   actions taken.
+3. Evidence that monitoring controls operated continuously throughout the period
+   with no material gaps.
+4. Mean time to detect (MTTD) and mean time to respond (MTTR) where evidence
+   permits calculation.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs. Quantify where possible.
+`.trim(),
+        },
+        {
+            id: 'soc2-cc8-change-management',
+            title: 'CC8: Change Management',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the CC8 (Change Management) section of a SOC 2 Type II report.
+
+TSC Reference: CC8.1 (infrastructure and software changes authorised, tested,
+documented, and approved prior to implementation).
+
+Using ONLY the audit-chain events provided, describe:
+1. Evidence that AI agent policy changes (policy snapshots) were recorded and
+   version-controlled in the audit chain.
+2. Approval workflow events confirming that changes requiring human review
+   received documented approvals before taking effect.
+3. Any change failures, rollbacks, or emergency changes and the associated
+   approvals or post-hoc authorisations.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'soc2-cc9-risk-mitigation',
+            title: 'CC9: Risk Mitigation',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the CC9 (Risk Mitigation) section of a SOC 2 Type II report.
+
+TSC Reference: CC9.1 (risk mitigation activities), CC9.2 (vendor and business
+partner risk).
+
+Using ONLY the audit-chain events provided, describe:
+1. Automated risk-mitigation controls enforced by the governance runtime
+   (circuit breakers, approval gates, suspension events).
+2. Evidence of vendor or LLM provider governance: which adapters were active,
+   any provider-specific policy overrides applied.
+3. How the platform's HITL (human-in-the-loop) controls ensure that AI agent
+   risk is continuously mitigated.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'soc2-a1-availability',
+            title: 'A1: Availability',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the A1 (Availability) section of a SOC 2 Type II report.
+
+TSC Reference: A1.1 (capacity planning), A1.2 (environmental threats),
+A1.3 (recovery and continuity testing).
+
+Using ONLY the audit-chain events provided, describe:
+1. Evidence that the governance runtime remained operational throughout the
+   review period (uptime evidence from event timestamps).
+2. Any service interruptions, their duration, and recovery actions taken.
+3. Rate-limiting and circuit-breaker events that demonstrate the system
+   protected availability by preventing runaway agent behaviour.
+
+${CITATION_INSTRUCTION}
+
+Write 3-4 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'soc2-pi1-processing-integrity',
+            title: 'PI1: Processing Integrity',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the PI1 (Processing Integrity) section of a SOC 2 Type II report.
+
+TSC Reference: PI1.1 (complete, valid, accurate, timely processing), PI1.2
+(outputs are complete, accurate, and distributed to authorised parties).
+
+Using ONLY the audit-chain events provided, describe:
+1. Evidence that AI agent governance decisions (ALLOW/DENY/REQUIRE_APPROVAL)
+   were recorded completely and with integrity in the tamper-evident chain.
+2. Any detected chain-integrity violations or hash mismatches and their
+   resolution.
+3. Completeness of audit records relative to agent activity during the window.
+
+${CITATION_INSTRUCTION}
+
+Write 3-4 formal paragraphs.
+`.trim(),
+        },
+    ],
+};
+//# sourceMappingURL=soc2-type-ii.js.map

package/dist/esm/audit/report-templates/soc2-type-ii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2-type-ii.js","sourceRoot":"","sources":["../../../../src/audit/report-templates/soc2-type-ii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,MAAM,oBAAoB,GAAG;;;;;;CAM5B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,UAAU,EAAE,qBAAqB;IACjC,IAAI,EAAE,+BAA+B;IACrC,SAAS,EAAE,MAAM;IACjB,uBAAuB,EAAE;QACvB,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;KACnB;IACD,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,IAAI;IAEzB,QAAQ,EAAE;QACR;YACE,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,2CAA2C;YAClD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;EAiBpB,oBAAoB;;;;CAIrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uCAAuC;YAC9C,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;EAgBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,KAAK,EAAE,wBAAwB;YAC/B,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;EAcpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,KAAK,EAAE,sBAAsB;YAC7B,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;EAcpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,kBAAkB;YACzB,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;EAapB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,+BAA+B;YACnC,KAAK,EAAE,2BAA2B;YAClC,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;EAapB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;KACF;CACF,CAAC"}

package/dist/esm/audit/reporting-exports.js

@@ -0,0 +1,19 @@
+/**
+ * @connexum/ai-governance/reporting -- Public SDK subpath export
+ *
+ * Exports the AI audit reporting surface: narrative generator, types,
+ * errors, provenance helpers, and the render/seal functions.
+ *
+ * Usage:
+ *   import { AuditNarrativeGenerator, renderNarrativeReport } from '@connexum/ai-governance/reporting';
+ *
+ * Spec: P4-AIR-01 AC 24
+ *
+ * @connexum/ai-governance
+ */
+// Core generator + helpers
+export { AuditNarrativeGenerator, sealProvenanceToChain, renderNarrativeReport, verifyProvenanceSignature, } from './narrative-generator.js';
+// Errors
+export { UncitedClaimError, MissingEvidenceError, MissingProvenanceError, } from './narrative-types.js';
+export { REPORT_TEMPLATE_REGISTRY, validateEvidence, SOC2_TYPE_II_TEMPLATE, HIPAA_BREACH_NOTIFICATION_TEMPLATE, HIPAA_SECURITY_INCIDENT_TEMPLATE, EU_AI_ACT_ANNEX_IV_TEMPLATE, DORA_ICT_MAJOR_INCIDENT_TEMPLATE, PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE, GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE, ISO_42001_AMS_TEMPLATE, } from './report-templates/index.js';
+//# sourceMappingURL=reporting-exports.js.map

package/dist/esm/audit/reporting-exports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporting-exports.js","sourceRoot":"","sources":["../../../src/audit/reporting-exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,2BAA2B;AAC3B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAiBlC,SAAS;AACT,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,kCAAkC,EAClC,gCAAgC,EAChC,2BAA2B,EAC3B,gCAAgC,EAChC,mCAAmC,EACnC,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,6BAA6B,CAAC"}