@evalops/maestro 0.10.8 → 0.10.11

package/dist/services/compliance/recorder.js

@@ -0,0 +1,89 @@
+import { createLogger } from "../../utils/logger.js";
+import { resolveUsageAgentId, resolveUsageWorkspaceId, } from "../usage-analytics/recorder.js";
+import { getComplianceService } from "./service.js";
+const logger = createLogger("compliance:recorder");
+function costMetadata(message) {
+    const usage = message.usage;
+    if (!usage)
+        return {};
+    return {
+        inputTokens: usage.input,
+        outputTokens: usage.output,
+        cacheReadTokens: usage.cacheRead,
+        cacheWriteTokens: usage.cacheWrite,
+        totalTokens: usage.input + usage.output + usage.cacheRead + usage.cacheWrite,
+        ...(typeof usage.cost?.total === "number"
+            ? { costUsd: usage.cost.total }
+            : {}),
+    };
+}
+export function trackComplianceAgentAction(input) {
+    try {
+        getComplianceService().trackAgentAction(input);
+    }
+    catch (error) {
+        logger.warn("Compliance action tracking failed", {
+            error: error instanceof Error ? error.message : String(error),
+            type: input.type,
+            workspaceId: input.workspaceId,
+            agentId: input.agentId,
+        });
+    }
+}
+export function trackComplianceGovernanceEvaluation(input) {
+    try {
+        getComplianceService().trackGovernanceEvaluation(input);
+    }
+    catch (error) {
+        logger.warn("Compliance governance tracking failed", {
+            error: error instanceof Error ? error.message : String(error),
+            actionType: input.actionType,
+            workspaceId: input.workspaceId,
+            agentId: input.agentId,
+        });
+    }
+}
+export function recordComplianceToolAction(params) {
+    const { event } = params;
+    const sessionId = params.sessionId;
+    trackComplianceAgentAction({
+        actionId: event.toolCallId,
+        workspaceId: resolveUsageWorkspaceId(params.req),
+        agentId: resolveUsageAgentId(params),
+        type: "tool_call",
+        status: event.isError ? "failure" : "success",
+        resource: event.toolName,
+        description: event.summaryLabel ??
+            `Tool ${event.toolName} ${event.isError ? "failed" : "completed"}`,
+        metadata: {
+            toolCallId: event.toolCallId,
+            toolName: event.toolName,
+            ...(event.displayName ? { displayName: event.displayName } : {}),
+            ...(event.summaryLabel ? { summaryLabel: event.summaryLabel } : {}),
+            ...(sessionId ? { sessionId } : {}),
+        },
+    });
+}
+export function recordComplianceAssistantAction(params) {
+    const { message } = params;
+    const occurredAt = typeof message.timestamp === "number" && Number.isFinite(message.timestamp)
+        ? new Date(message.timestamp)
+        : new Date();
+    const sessionId = params.sessionId;
+    trackComplianceAgentAction({
+        workspaceId: resolveUsageWorkspaceId(params.req),
+        agentId: resolveUsageAgentId(params),
+        type: "llm_inference",
+        status: "success",
+        resource: message.model,
+        timestamp: occurredAt,
+        description: `LLM completion generated by ${message.provider}/${message.model}`,
+        metadata: {
+            provider: message.provider,
+            model: message.model,
+            ...(sessionId ? { sessionId } : {}),
+            ...costMetadata(message),
+        },
+    });
+}
+//# sourceMappingURL=recorder.js.map

package/dist/services/compliance/recorder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorder.js","sourceRoot":"","sources":["../../../src/services/compliance/recorder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACN,mBAAmB,EACnB,uBAAuB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAOpD,MAAM,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAOnD,SAAS,YAAY,CACpB,OAAyB;IAEzB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO;QACN,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,eAAe,EAAE,KAAK,CAAC,SAAS;QAChC,gBAAgB,EAAE,KAAK,CAAC,UAAU;QAClC,WAAW,EACV,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,UAAU;QAChE,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ;YACxC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IACjE,IAAI,CAAC;QACJ,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAChD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mCAAmC,CAClD,KAAgC;IAEhC,IAAI,CAAC;QACJ,oBAAoB,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACpD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAK1C;IACA,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,0BAA0B,CAAC;QAC1B,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,WAAW,EAAE,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC;QAChD,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACpC,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EACV,KAAK,CAAC,YAAY;YAClB,QAAQ,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE;QACnE,QAAQ,EAAE;YACT,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAK/C;IACA,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,UAAU,GACf,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1E,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7B,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACf,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,0BAA0B,CAAC;QAC1B,WAAW,EAAE,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC;QAChD,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACpC,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,OAAO,CAAC,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,WAAW,EAAE,+BAA+B,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE;QAC/E,QAAQ,EAAE;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,YAAY,CAAC,OAAO,CAAC;SACxB;KACD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { IncomingMessage } from \"node:http\";\nimport type { AgentEvent, AssistantMessage } from \"../../agent/types.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nimport {\n\tresolveUsageAgentId,\n\tresolveUsageWorkspaceId,\n} from \"../usage-analytics/recorder.js\";\nimport { getComplianceService } from \"./service.js\";\nimport type {\n\tAgentActionInput,\n\tComplianceJsonValue,\n\tGovernanceEvaluationInput,\n} from \"./types.js\";\n\nconst logger = createLogger(\"compliance:recorder\");\n\ntype ToolExecutionEndEvent = Extract<\n\tAgentEvent,\n\t{ type: \"tool_execution_end\" }\n>;\n\nfunction costMetadata(\n\tmessage: AssistantMessage,\n): Record<string, ComplianceJsonValue> {\n\tconst usage = message.usage;\n\tif (!usage) return {};\n\treturn {\n\t\tinputTokens: usage.input,\n\t\toutputTokens: usage.output,\n\t\tcacheReadTokens: usage.cacheRead,\n\t\tcacheWriteTokens: usage.cacheWrite,\n\t\ttotalTokens:\n\t\t\tusage.input + usage.output + usage.cacheRead + usage.cacheWrite,\n\t\t...(typeof usage.cost?.total === \"number\"\n\t\t\t? { costUsd: usage.cost.total }\n\t\t\t: {}),\n\t};\n}\n\nexport function trackComplianceAgentAction(input: AgentActionInput): void {\n\ttry {\n\t\tgetComplianceService().trackAgentAction(input);\n\t} catch (error) {\n\t\tlogger.warn(\"Compliance action tracking failed\", {\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\ttype: input.type,\n\t\t\tworkspaceId: input.workspaceId,\n\t\t\tagentId: input.agentId,\n\t\t});\n\t}\n}\n\nexport function trackComplianceGovernanceEvaluation(\n\tinput: GovernanceEvaluationInput,\n): void {\n\ttry {\n\t\tgetComplianceService().trackGovernanceEvaluation(input);\n\t} catch (error) {\n\t\tlogger.warn(\"Compliance governance tracking failed\", {\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\tactionType: input.actionType,\n\t\t\tworkspaceId: input.workspaceId,\n\t\t\tagentId: input.agentId,\n\t\t});\n\t}\n}\n\nexport function recordComplianceToolAction(params: {\n\treq: IncomingMessage;\n\tevent: ToolExecutionEndEvent;\n\tsessionId?: string;\n\tsubject?: string;\n}): void {\n\tconst { event } = params;\n\tconst sessionId = params.sessionId;\n\ttrackComplianceAgentAction({\n\t\tactionId: event.toolCallId,\n\t\tworkspaceId: resolveUsageWorkspaceId(params.req),\n\t\tagentId: resolveUsageAgentId(params),\n\t\ttype: \"tool_call\",\n\t\tstatus: event.isError ? \"failure\" : \"success\",\n\t\tresource: event.toolName,\n\t\tdescription:\n\t\t\tevent.summaryLabel ??\n\t\t\t`Tool ${event.toolName} ${event.isError ? \"failed\" : \"completed\"}`,\n\t\tmetadata: {\n\t\t\ttoolCallId: event.toolCallId,\n\t\t\ttoolName: event.toolName,\n\t\t\t...(event.displayName ? { displayName: event.displayName } : {}),\n\t\t\t...(event.summaryLabel ? { summaryLabel: event.summaryLabel } : {}),\n\t\t\t...(sessionId ? { sessionId } : {}),\n\t\t},\n\t});\n}\n\nexport function recordComplianceAssistantAction(params: {\n\treq: IncomingMessage;\n\tmessage: AssistantMessage;\n\tsessionId?: string;\n\tsubject?: string;\n}): void {\n\tconst { message } = params;\n\tconst occurredAt =\n\t\ttypeof message.timestamp === \"number\" && Number.isFinite(message.timestamp)\n\t\t\t? new Date(message.timestamp)\n\t\t\t: new Date();\n\tconst sessionId = params.sessionId;\n\ttrackComplianceAgentAction({\n\t\tworkspaceId: resolveUsageWorkspaceId(params.req),\n\t\tagentId: resolveUsageAgentId(params),\n\t\ttype: \"llm_inference\",\n\t\tstatus: \"success\",\n\t\tresource: message.model,\n\t\ttimestamp: occurredAt,\n\t\tdescription: `LLM completion generated by ${message.provider}/${message.model}`,\n\t\tmetadata: {\n\t\t\tprovider: message.provider,\n\t\t\tmodel: message.model,\n\t\t\t...(sessionId ? { sessionId } : {}),\n\t\t\t...costMetadata(message),\n\t\t},\n\t});\n}\n"]}

package/dist/services/compliance/service.d.ts

@@ -0,0 +1,24 @@
+import { type TracesService } from "../traces/index.js";
+import type { AgentActionInput, AgentActionRecord, ComplianceControl, ComplianceControlEvidence, ComplianceEvidenceQuery, ComplianceFramework, ComplianceReport, ComplianceReportRequest, GovernanceEvaluationInput, GovernanceEvaluationRecord } from "./types.js";
+type TraceServiceProvider = () => Pick<TracesService, "listTraces">;
+export declare class ComplianceService {
+    private readonly getTraceService;
+    private readonly now;
+    private readonly trackedActions;
+    private readonly trackedGovernanceEvents;
+    constructor(getTraceService?: TraceServiceProvider, now?: () => Date);
+    trackAgentAction(input: AgentActionInput): AgentActionRecord;
+    trackGovernanceEvaluation(input: GovernanceEvaluationInput): GovernanceEvaluationRecord;
+    listControls(frameworks?: ComplianceFramework[]): ComplianceControl[];
+    generateReport(input: ComplianceReportRequest): Promise<ComplianceReport>;
+    getEvidenceForControl(controlId: string, query: ComplianceEvidenceQuery): Promise<ComplianceControlEvidence | null>;
+    clearTrackedActionsForTest(): void;
+    private trackedActionsForRequest;
+    private evidenceFromActions;
+    private evidenceFromTraces;
+    private collectEvidence;
+}
+export declare function getComplianceService(): ComplianceService;
+export declare function setComplianceServiceForTest(service: ComplianceService | null): void;
+export {};
+//# sourceMappingURL=service.d.ts.map

package/dist/services/compliance/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/services/compliance/service.ts"],"names":[],"mappings":"AACA,OAAO,EAGN,KAAK,aAAa,EAGlB,MAAM,oBAAoB,CAAC;AAY5B,OAAO,KAAK,EACX,gBAAgB,EAChB,iBAAiB,EAKjB,iBAAiB,EACjB,yBAAyB,EAGzB,uBAAuB,EACvB,mBAAmB,EAEnB,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAE1B,MAAM,YAAY,CAAC;AAKpB,KAAK,oBAAoB,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AAwTpE,qBAAa,iBAAiB;IAK5B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG;IALrB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAoC;gBAG1D,eAAe,GAAE,oBAAuC,EACxD,GAAG,GAAE,MAAM,IAAuB;IAGpD,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB;IAY5D,yBAAyB,CACxB,KAAK,EAAE,yBAAyB,GAC9B,0BAA0B;IAY7B,YAAY,CAAC,UAAU,CAAC,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,EAAE;IAI/D,cAAc,CACnB,KAAK,EAAE,uBAAuB,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAiDtB,qBAAqB,CAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,uBAAuB,GAC5B,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAmB5C,0BAA0B,IAAI,IAAI;IAKlC,OAAO,CAAC,wBAAwB;IA0BhC,OAAO,CAAC,mBAAmB;YAkBb,kBAAkB;YAmClB,eAAe;CAU7B;AAID,wBAAgB,oBAAoB,IAAI,iBAAiB,CAGxD;AAED,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAC/B,IAAI,CAEN"}

package/dist/services/compliance/service.js

@@ -0,0 +1,426 @@
+import { createHash } from "node:crypto";
+import { TracesUnavailableError, getTracesService, } from "../traces/index.js";
+import { controlIdsForActionType, getComplianceControl, listComplianceControls, } from "./controls.js";
+import { actionWithinPeriod, normalizeAgentActionInput, normalizeComplianceReportRequest, normalizeGovernanceEvaluationInput, } from "./normalize.js";
+const MAX_TRACKED_ACTIONS = 5_000;
+const TRACE_EVIDENCE_LIMIT = 100;
+function hashId(prefix, payload) {
+    const digest = createHash("sha256")
+        .update(JSON.stringify(payload))
+        .digest("hex")
+        .slice(0, 16);
+    return `${prefix}_${digest}`;
+}
+function reportPeriod(request) {
+    return {
+        ...(request.from ? { from: request.from.toISOString() } : {}),
+        ...(request.to ? { to: request.to.toISOString() } : {}),
+    };
+}
+function evidenceTimestampInRange(timestamp, query) {
+    const value = Date.parse(timestamp);
+    if (Number.isNaN(value))
+        return false;
+    if (query.from && value < query.from.getTime())
+        return false;
+    if (query.to && value > query.to.getTime())
+        return false;
+    return true;
+}
+function actionMatchesWorkspace(action, workspaceId) {
+    return !workspaceId || action.workspaceId === workspaceId;
+}
+function evidenceMatchesWorkspace(evidence, workspaceId) {
+    return !workspaceId || evidence.workspaceId === workspaceId;
+}
+function governanceEventMatchesWorkspace(event, workspaceId) {
+    return !workspaceId || event.workspaceId === workspaceId;
+}
+function decisionToActionStatus(decision) {
+    switch (decision) {
+        case "allow":
+        case "allowed":
+        case "approve":
+        case "approved":
+        case "success":
+            return "success";
+        case "deny":
+        case "denied":
+        case "block":
+        case "blocked":
+        case "reject":
+        case "rejected":
+            return "denied";
+        case "escalate":
+        case "escalated":
+        case "review":
+        case "needs_review":
+            return "needs_review";
+        default:
+            return decision;
+    }
+}
+function actionForGovernanceEvent(event) {
+    const metadata = {
+        ...event.metadata,
+        source: "governance",
+        governanceEvaluationId: event.evaluationId,
+        actionType: event.actionType,
+        decision: event.decision,
+        ...(event.policyId ? { policyId: event.policyId } : {}),
+        ...(event.riskLevel ? { riskLevel: event.riskLevel } : {}),
+        ...(event.reason ? { reason: event.reason } : {}),
+    };
+    return {
+        actionId: event.evaluationId,
+        type: "policy_evaluation",
+        status: decisionToActionStatus(event.decision),
+        timestamp: event.timestamp,
+        resource: event.policyId ?? event.actionType,
+        description: event.policyId
+            ? `Governance policy ${event.policyId} ${event.decision} for ${event.actionType}`
+            : `Governance evaluation ${event.decision} for ${event.actionType}`,
+        metadata,
+        ...(event.workspaceId ? { workspaceId: event.workspaceId } : {}),
+        ...(event.agentId ? { agentId: event.agentId } : {}),
+    };
+}
+function sourceTypeForAction(action) {
+    if (action.type === "trace_recorded") {
+        return "execution_trace";
+    }
+    if (action.type === "policy_evaluation" &&
+        action.metadata.source === "governance") {
+        return "governance_policy_evaluation";
+    }
+    return action.type;
+}
+function evidenceForAction(action, control) {
+    const summary = action.description
+        ? `${control.title}: ${action.description}`
+        : `${control.title}: ${action.type} ${action.status}`;
+    const metadata = {
+        actionType: action.type,
+        ...action.metadata,
+    };
+    return {
+        evidenceId: hashId("evidence", {
+            controlId: control.id,
+            actionId: action.actionId,
+        }),
+        controlId: control.id,
+        framework: control.framework,
+        sourceType: sourceTypeForAction(action),
+        timestamp: action.timestamp,
+        summary,
+        actionId: action.actionId,
+        status: action.status,
+        metadata,
+        ...(action.workspaceId ? { workspaceId: action.workspaceId } : {}),
+        ...(action.agentId ? { agentId: action.agentId } : {}),
+        ...(action.resource ? { resource: action.resource } : {}),
+    };
+}
+function evidenceForTrace(trace, control) {
+    return {
+        evidenceId: hashId("evidence", {
+            controlId: control.id,
+            traceId: trace.traceId,
+        }),
+        controlId: control.id,
+        framework: control.framework,
+        sourceType: "execution_trace",
+        timestamp: trace.createdAt,
+        summary: `${control.title}: execution trace ${trace.traceId} recorded with ${trace.status} status`,
+        workspaceId: trace.workspaceId,
+        agentId: trace.agentId,
+        traceId: trace.traceId,
+        status: trace.status,
+        metadata: {
+            durationMs: trace.durationMs,
+            spanCount: trace.spanCount,
+        },
+    };
+}
+function compareEvidence(a, b) {
+    const byTime = Date.parse(b.timestamp) - Date.parse(a.timestamp);
+    if (byTime !== 0)
+        return byTime;
+    return a.evidenceId.localeCompare(b.evidenceId);
+}
+function dedupeEvidence(evidence) {
+    const byId = new Map();
+    for (const item of evidence) {
+        byId.set(item.evidenceId, item);
+    }
+    return Array.from(byId.values()).sort(compareEvidence);
+}
+function sourceManifest(evidence) {
+    const bySource = new Map();
+    for (const item of evidence) {
+        const current = bySource.get(item.sourceType) ?? { count: 0 };
+        current.count += 1;
+        if (!current.firstSeenAt || item.timestamp < current.firstSeenAt) {
+            current.firstSeenAt = item.timestamp;
+        }
+        if (!current.lastSeenAt || item.timestamp > current.lastSeenAt) {
+            current.lastSeenAt = item.timestamp;
+        }
+        bySource.set(item.sourceType, current);
+    }
+    return Array.from(bySource.entries())
+        .map(([sourceType, entry]) => ({
+        sourceType,
+        evidenceCount: entry.count,
+        ...(entry.firstSeenAt ? { firstSeenAt: entry.firstSeenAt } : {}),
+        ...(entry.lastSeenAt ? { lastSeenAt: entry.lastSeenAt } : {}),
+    }))
+        .sort((a, b) => a.sourceType.localeCompare(b.sourceType));
+}
+function controlMatrixRows(controls, evidence) {
+    return controls.map((entry) => {
+        const controlEvidence = evidence.filter((item) => item.controlId === entry.control.id);
+        const sourceTypes = Array.from(new Set(controlEvidence.map((item) => item.sourceType))).sort();
+        const latest = controlEvidence
+            .map((item) => item.timestamp)
+            .sort()
+            .at(-1);
+        return {
+            controlId: entry.control.id,
+            framework: entry.control.framework,
+            title: entry.control.title,
+            status: entry.status,
+            evidenceCount: controlEvidence.length,
+            evidenceIds: controlEvidence.map((item) => item.evidenceId),
+            evidenceSources: sourceTypes,
+            ...(latest ? { lastEvidenceAt: latest } : {}),
+        };
+    });
+}
+function gapSeverity(control) {
+    return control.evidenceTypes.some((type) => type.includes("access") || type === "approval")
+        ? "high"
+        : "medium";
+}
+function artifactGaps(controls) {
+    return controls
+        .filter((entry) => entry.status === "missing")
+        .map((entry) => ({
+        controlId: entry.control.id,
+        framework: entry.control.framework,
+        title: entry.control.title,
+        severity: gapSeverity(entry.control),
+        reason: `No evidence found for expected sources: ${entry.control.evidenceTypes.join(", ")}.`,
+        remediation: "Connect governance, approvals, trace, audit, or identity events that satisfy this control for the requested period.",
+    }));
+}
+function executiveSummary(report) {
+    const frameworkList = report.frameworks.join(", ").toUpperCase();
+    return `${report.summary.satisfied} of ${report.summary.controls} ${frameworkList} controls are satisfied with ${report.summary.evidenceItems} evidence item(s); ${report.summary.missing} control(s) need additional evidence.`;
+}
+function renderComplianceArtifact(report, evidence, controls) {
+    const matrix = controlMatrixRows(controls, evidence);
+    return {
+        artifactId: hashId("compliance_artifact", {
+            reportId: report.reportId,
+            evidenceIds: evidence.map((item) => item.evidenceId),
+        }),
+        format: "auditor_json",
+        reportId: report.reportId,
+        generatedAt: report.generatedAt,
+        period: report.period,
+        frameworks: report.frameworks,
+        executiveSummary: executiveSummary(report),
+        controlMatrix: matrix,
+        evidenceIndex: evidence,
+        gaps: artifactGaps(controls),
+        sourceManifest: sourceManifest(evidence),
+        exports: {
+            drata: {
+                controlEvidence: matrix.map((row) => ({
+                    controlExternalId: row.controlId,
+                    evidenceIds: row.evidenceIds,
+                    status: row.status === "satisfied" ? "ready" : "gap",
+                })),
+            },
+            vanta: {
+                customEvidence: matrix.map((row) => ({
+                    controlId: row.controlId,
+                    title: row.title,
+                    evidenceCount: row.evidenceCount,
+                })),
+            },
+        },
+        ...(report.workspaceId ? { workspaceId: report.workspaceId } : {}),
+    };
+}
+export class ComplianceService {
+    constructor(getTraceService = getTracesService, now = () => new Date()) {
+        this.getTraceService = getTraceService;
+        this.now = now;
+        this.trackedActions = [];
+        this.trackedGovernanceEvents = [];
+    }
+    trackAgentAction(input) {
+        const action = normalizeAgentActionInput(input);
+        this.trackedActions.push(action);
+        if (this.trackedActions.length > MAX_TRACKED_ACTIONS) {
+            this.trackedActions.splice(0, this.trackedActions.length - MAX_TRACKED_ACTIONS);
+        }
+        return action;
+    }
+    trackGovernanceEvaluation(input) {
+        const event = normalizeGovernanceEvaluationInput(input);
+        this.trackedGovernanceEvents.push(event);
+        if (this.trackedGovernanceEvents.length > MAX_TRACKED_ACTIONS) {
+            this.trackedGovernanceEvents.splice(0, this.trackedGovernanceEvents.length - MAX_TRACKED_ACTIONS);
+        }
+        return event;
+    }
+    listControls(frameworks) {
+        return listComplianceControls(frameworks);
+    }
+    async generateReport(input) {
+        const request = normalizeComplianceReportRequest(input);
+        const controls = listComplianceControls(request.frameworks);
+        const evidence = await this.collectEvidence(request, controls);
+        const controlsWithEvidence = controls.map((control) => {
+            const controlEvidence = evidence.filter((item) => item.controlId === control.id);
+            return {
+                control,
+                status: controlEvidence.length > 0 ? "satisfied" : "missing",
+                evidenceCount: controlEvidence.length,
+                ...(request.includeEvidence ? { evidence: controlEvidence } : {}),
+            };
+        });
+        const satisfied = controlsWithEvidence.filter((control) => control.status === "satisfied").length;
+        const generatedAt = this.now().toISOString();
+        const report = {
+            reportId: hashId("compliance_report", {
+                generatedAt,
+                workspaceId: request.workspaceId,
+                frameworks: request.frameworks,
+                period: reportPeriod(request),
+                evidenceIds: evidence.map((item) => item.evidenceId),
+            }),
+            generatedAt,
+            period: reportPeriod(request),
+            frameworks: request.frameworks,
+            summary: {
+                controls: controls.length,
+                satisfied,
+                missing: controls.length - satisfied,
+                evidenceItems: evidence.length,
+            },
+            controls: controlsWithEvidence,
+            ...(request.workspaceId ? { workspaceId: request.workspaceId } : {}),
+        };
+        if (request.includeArtifact) {
+            report.artifact = renderComplianceArtifact(report, evidence, controlsWithEvidence);
+        }
+        return report;
+    }
+    async getEvidenceForControl(controlId, query) {
+        const control = getComplianceControl(controlId);
+        if (!control)
+            return null;
+        const request = {
+            frameworks: [control.framework],
+            actions: [],
+            governanceEvents: [],
+            includeEvidence: true,
+            includeArtifact: false,
+            ...(query.workspaceId ? { workspaceId: query.workspaceId } : {}),
+            ...(query.from ? { from: query.from } : {}),
+            ...(query.to ? { to: query.to } : {}),
+        };
+        const evidence = (await this.collectEvidence(request, [control])).filter((item) => item.controlId === control.id);
+        return { control, evidence };
+    }
+    clearTrackedActionsForTest() {
+        this.trackedActions.length = 0;
+        this.trackedGovernanceEvents.length = 0;
+    }
+    trackedActionsForRequest(request) {
+        const governanceActions = [
+            ...this.trackedGovernanceEvents,
+            ...request.governanceEvents,
+        ]
+            .filter((event) => governanceEventMatchesWorkspace(event, request.workspaceId))
+            .filter((event) => evidenceTimestampInRange(event.timestamp, request))
+            .map(actionForGovernanceEvent);
+        const actions = [
+            ...this.trackedActions,
+            ...request.actions,
+            ...governanceActions,
+        ];
+        const byId = new Map();
+        for (const action of actions) {
+            if (!actionMatchesWorkspace(action, request.workspaceId))
+                continue;
+            if (!actionWithinPeriod(action, request))
+                continue;
+            byId.set(action.actionId, action);
+        }
+        return Array.from(byId.values());
+    }
+    evidenceFromActions(request, controls) {
+        const controlsById = new Map(controls.map((control) => [control.id, control]));
+        const evidence = [];
+        for (const action of this.trackedActionsForRequest(request)) {
+            for (const controlId of controlIdsForActionType(action.type)) {
+                const control = controlsById.get(controlId);
+                if (!control)
+                    continue;
+                evidence.push(evidenceForAction(action, control));
+            }
+        }
+        return evidence;
+    }
+    async evidenceFromTraces(request, controls) {
+        const traceControls = controls.filter((control) => control.mappedActionTypes.includes("trace_recorded"));
+        if (traceControls.length === 0)
+            return [];
+        const query = {
+            limit: TRACE_EVIDENCE_LIMIT,
+            offset: 0,
+        };
+        if (request.workspaceId) {
+            query.workspaceId = request.workspaceId;
+        }
+        try {
+            const result = await this.getTraceService().listTraces(query);
+            const evidence = [];
+            for (const trace of result.traces) {
+                if (!evidenceTimestampInRange(trace.createdAt, request))
+                    continue;
+                for (const control of traceControls) {
+                    evidence.push(evidenceForTrace(trace, control));
+                }
+            }
+            return evidence;
+        }
+        catch (error) {
+            if (error instanceof TracesUnavailableError) {
+                return [];
+            }
+            throw error;
+        }
+    }
+    async collectEvidence(request, controls) {
+        const evidence = [
+            ...this.evidenceFromActions(request, controls),
+            ...(await this.evidenceFromTraces(request, controls)),
+        ].filter((item) => evidenceMatchesWorkspace(item, request.workspaceId));
+        return dedupeEvidence(evidence);
+    }
+}
+let defaultComplianceService = null;
+export function getComplianceService() {
+    defaultComplianceService ??= new ComplianceService();
+    return defaultComplianceService;
+}
+export function setComplianceServiceForTest(service) {
+    defaultComplianceService = service;
+}
+//# sourceMappingURL=service.js.map

package/dist/services/compliance/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/services/compliance/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAIN,sBAAsB,EACtB,gBAAgB,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,kBAAkB,EAClB,yBAAyB,EACzB,gCAAgC,EAChC,kCAAkC,GAClC,MAAM,gBAAgB,CAAC;AAsBxB,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAIjC,SAAS,MAAM,CAAC,MAAc,EAAE,OAAgB;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SAC/B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CAAC,OAA0C;IAC/D,OAAO;QACN,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAChC,SAAiB,EACjB,KAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAC9B,MAAyB,EACzB,WAAoB;IAEpB,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;AAC3D,CAAC;AAED,SAAS,wBAAwB,CAChC,QAA4B,EAC5B,WAAoB;IAEpB,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,CAAC;AAC7D,CAAC;AAED,SAAS,+BAA+B,CACvC,KAAiC,EACjC,WAAoB;IAEpB,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC/C,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS;YACb,OAAO,SAAS,CAAC;QAClB,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,UAAU;YACd,OAAO,QAAQ,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,cAAc;YAClB,OAAO,cAAc,CAAC;QACvB;YACC,OAAO,QAAQ,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAChC,KAAiC;IAEjC,MAAM,QAAQ,GAAwC;QACrD,GAAG,KAAK,CAAC,QAAQ;QACjB,MAAM,EAAE,YAAY;QACpB,sBAAsB,EAAE,KAAK,CAAC,YAAY;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,OAAO;QACN,QAAQ,EAAE,KAAK,CAAC,YAAY;QAC5B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU;QAC5C,WAAW,EAAE,KAAK,CAAC,QAAQ;YAC1B,CAAC,CAAC,qBAAqB,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,QAAQ,KAAK,CAAC,UAAU,EAAE;YACjF,CAAC,CAAC,yBAAyB,KAAK,CAAC,QAAQ,QAAQ,KAAK,CAAC,UAAU,EAAE;QACpE,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB;IACrD,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IACD,IACC,MAAM,CAAC,IAAI,KAAK,mBAAmB;QACnC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,YAAY,EACtC,CAAC;QACF,OAAO,8BAA8B,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CACzB,MAAyB,EACzB,OAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW;QACjC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,WAAW,EAAE;QAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAwC;QACrD,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,GAAG,MAAM,CAAC,QAAQ;KAClB,CAAC;IACF,OAAO;QACN,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;YAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;QACF,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACvC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,KAA4B,EAC5B,OAA0B;IAE1B,OAAO;QACN,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;YAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,OAAO,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC;QACF,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,iBAAiB;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,qBAAqB,KAAK,CAAC,OAAO,kBAAkB,KAAK,CAAC,MAAM,SAAS;QAClG,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE;YACT,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC1B;KACD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAqB,EAAE,CAAqB;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,QAA8B;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CACtB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAClE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YAChE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,KAAK;QAC1B,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAmC,EACnC,QAA8B;IAE9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,EAAE,CAC7C,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC7B,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CACvD,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,eAAe;aAC5B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;aAC7B,IAAI,EAAE;aACN,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACT,OAAO;YACN,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YAC3B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,eAAe,CAAC,MAAM;YACrC,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YAC3D,eAAe,EAAE,WAAW;YAC5B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CACnB,OAA0B;IAE1B,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,UAAU,CACxD;QACA,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CACpB,QAAmC;IAEnC,OAAO,QAAQ;SACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;SAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QAC3B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;QAC1B,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,MAAM,EAAE,2CAA2C,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC5F,WAAW,EACV,qHAAqH;KACtH,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAwB;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,aAAa,gCAAgC,MAAM,CAAC,OAAO,CAAC,aAAa,sBAAsB,MAAM,CAAC,OAAO,CAAC,OAAO,uCAAuC,CAAC;AAClO,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAwB,EACxB,QAA8B,EAC9B,QAAmC;IAEnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO;QACN,UAAU,EAAE,MAAM,CAAC,qBAAqB,EAAE;YACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;SACpD,CAAC;QACF,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAC1C,aAAa,EAAE,MAAM;QACrB,aAAa,EAAE,QAAQ;QACvB,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC;QAC5B,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC;QACxC,OAAO,EAAE;YACR,KAAK,EAAE;gBACN,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACrC,iBAAiB,EAAE,GAAG,CAAC,SAAS;oBAChC,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;iBACpD,CAAC,CAAC;aACH;YACD,KAAK,EAAE;gBACN,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,aAAa,EAAE,GAAG,CAAC,aAAa;iBAChC,CAAC,CAAC;aACH;SACD;QACD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAI7B,YACkB,kBAAwC,gBAAgB,EACxD,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QADlC,oBAAe,GAAf,eAAe,CAAyC;QACxD,QAAG,GAAH,GAAG,CAA+B;QALnC,mBAAc,GAAwB,EAAE,CAAC;QACzC,4BAAuB,GAAiC,EAAE,CAAC;IAKzE,CAAC;IAEJ,gBAAgB,CAAC,KAAuB;QACvC,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACtD,IAAI,CAAC,cAAc,CAAC,MAAM,CACzB,CAAC,EACD,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,mBAAmB,CAChD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,yBAAyB,CACxB,KAAgC;QAEhC,MAAM,KAAK,GAAG,kCAAkC,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,uBAAuB,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAC/D,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAClC,CAAC,EACD,IAAI,CAAC,uBAAuB,CAAC,MAAM,GAAG,mBAAmB,CACzD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,YAAY,CAAC,UAAkC;QAC9C,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,KAA8B;QAE9B,MAAM,OAAO,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,oBAAoB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACrD,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACvC,CAAC;YACF,OAAO;gBACN,OAAO;gBACP,MAAM,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBAC5D,aAAa,EAAE,eAAe,CAAC,MAAM;gBACrC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAC5C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAC3C,CAAC,MAAM,CAAC;QACT,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAqB;YAChC,QAAQ,EAAE,MAAM,CAAC,mBAAmB,EAAE;gBACrC,WAAW;gBACX,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;gBAC7B,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;aACpD,CAAC;YACF,WAAW;YACX,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;YAC7B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE;gBACR,QAAQ,EAAE,QAAQ,CAAC,MAAM;gBACzB,SAAS;gBACT,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS;gBACpC,aAAa,EAAE,QAAQ,CAAC,MAAM;aAC9B;YACD,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;QACF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,CAAC,QAAQ,GAAG,wBAAwB,CACzC,MAAM,EACN,QAAQ,EACR,oBAAoB,CACpB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,qBAAqB,CAC1B,SAAiB,EACjB,KAA8B;QAE9B,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAsC;YAClD,UAAU,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;YAC/B,OAAO,EAAE,EAAE;YACX,gBAAgB,EAAE,EAAE;YACpB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,KAAK;YACtB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CACvC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,0BAA0B;QACzB,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,CAAC;IACzC,CAAC;IAEO,wBAAwB,CAC/B,OAA0C;QAE1C,MAAM,iBAAiB,GAAG;YACzB,GAAG,IAAI,CAAC,uBAAuB;YAC/B,GAAG,OAAO,CAAC,gBAAgB;SAC3B;aACC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACjB,+BAA+B,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAC3D;aACA,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;aACrE,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG;YACf,GAAG,IAAI,CAAC,cAAc;YACtB,GAAG,OAAO,CAAC,OAAO;YAClB,GAAG,iBAAiB;SACpB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAClD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;gBAAE,SAAS;YACnE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAE,SAAS;YACnD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAEO,mBAAmB,CAC1B,OAA0C,EAC1C,QAA6B;QAE7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAC3B,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAChD,CAAC;QACF,MAAM,QAAQ,GAAyB,EAAE,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,KAAK,MAAM,SAAS,IAAI,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YACnD,CAAC;QACF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC/B,OAA0C,EAC1C,QAA6B;QAE7B,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CACjD,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACpD,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE1C,MAAM,KAAK,GAAmB;YAC7B,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,CAAC;SACT,CAAC;QACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAyB,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC;oBAAE,SAAS;gBAClE,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;oBACrC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;gBACjD,CAAC;YACF,CAAC;YACD,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC7C,OAAO,EAAE,CAAC;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,eAAe,CAC5B,OAA0C,EAC1C,QAA6B;QAE7B,MAAM,QAAQ,GAAG;YAChB,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC9C,GAAG,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;SACrD,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACxE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;CACD;AAED,IAAI,wBAAwB,GAA6B,IAAI,CAAC;AAE9D,MAAM,UAAU,oBAAoB;IACnC,wBAAwB,KAAK,IAAI,iBAAiB,EAAE,CAAC;IACrD,OAAO,wBAAwB,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,OAAiC;IAEjC,wBAAwB,GAAG,OAAO,CAAC;AACpC,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n\ttype ExecutionTraceSummary,\n\ttype TraceListQuery,\n\ttype TracesService,\n\tTracesUnavailableError,\n\tgetTracesService,\n} from \"../traces/index.js\";\nimport {\n\tcontrolIdsForActionType,\n\tgetComplianceControl,\n\tlistComplianceControls,\n} from \"./controls.js\";\nimport {\n\tactionWithinPeriod,\n\tnormalizeAgentActionInput,\n\tnormalizeComplianceReportRequest,\n\tnormalizeGovernanceEvaluationInput,\n} from \"./normalize.js\";\nimport type {\n\tAgentActionInput,\n\tAgentActionRecord,\n\tComplianceArtifact,\n\tComplianceArtifactControlMatrixRow,\n\tComplianceArtifactGap,\n\tComplianceArtifactSourceManifestEntry,\n\tComplianceControl,\n\tComplianceControlEvidence,\n\tComplianceControlReport,\n\tComplianceEvidence,\n\tComplianceEvidenceQuery,\n\tComplianceFramework,\n\tComplianceJsonValue,\n\tComplianceReport,\n\tComplianceReportRequest,\n\tGovernanceEvaluationInput,\n\tGovernanceEvaluationRecord,\n\tNormalizedComplianceReportRequest,\n} from \"./types.js\";\n\nconst MAX_TRACKED_ACTIONS = 5_000;\nconst TRACE_EVIDENCE_LIMIT = 100;\n\ntype TraceServiceProvider = () => Pick<TracesService, \"listTraces\">;\n\nfunction hashId(prefix: string, payload: unknown): string {\n\tconst digest = createHash(\"sha256\")\n\t\t.update(JSON.stringify(payload))\n\t\t.digest(\"hex\")\n\t\t.slice(0, 16);\n\treturn `${prefix}_${digest}`;\n}\n\nfunction reportPeriod(request: NormalizedComplianceReportRequest) {\n\treturn {\n\t\t...(request.from ? { from: request.from.toISOString() } : {}),\n\t\t...(request.to ? { to: request.to.toISOString() } : {}),\n\t};\n}\n\nfunction evidenceTimestampInRange(\n\ttimestamp: string,\n\tquery: ComplianceEvidenceQuery,\n): boolean {\n\tconst value = Date.parse(timestamp);\n\tif (Number.isNaN(value)) return false;\n\tif (query.from && value < query.from.getTime()) return false;\n\tif (query.to && value > query.to.getTime()) return false;\n\treturn true;\n}\n\nfunction actionMatchesWorkspace(\n\taction: AgentActionRecord,\n\tworkspaceId?: string,\n): boolean {\n\treturn !workspaceId || action.workspaceId === workspaceId;\n}\n\nfunction evidenceMatchesWorkspace(\n\tevidence: ComplianceEvidence,\n\tworkspaceId?: string,\n): boolean {\n\treturn !workspaceId || evidence.workspaceId === workspaceId;\n}\n\nfunction governanceEventMatchesWorkspace(\n\tevent: GovernanceEvaluationRecord,\n\tworkspaceId?: string,\n): boolean {\n\treturn !workspaceId || event.workspaceId === workspaceId;\n}\n\nfunction decisionToActionStatus(decision: string): string {\n\tswitch (decision) {\n\t\tcase \"allow\":\n\t\tcase \"allowed\":\n\t\tcase \"approve\":\n\t\tcase \"approved\":\n\t\tcase \"success\":\n\t\t\treturn \"success\";\n\t\tcase \"deny\":\n\t\tcase \"denied\":\n\t\tcase \"block\":\n\t\tcase \"blocked\":\n\t\tcase \"reject\":\n\t\tcase \"rejected\":\n\t\t\treturn \"denied\";\n\t\tcase \"escalate\":\n\t\tcase \"escalated\":\n\t\tcase \"review\":\n\t\tcase \"needs_review\":\n\t\t\treturn \"needs_review\";\n\t\tdefault:\n\t\t\treturn decision;\n\t}\n}\n\nfunction actionForGovernanceEvent(\n\tevent: GovernanceEvaluationRecord,\n): AgentActionRecord {\n\tconst metadata: Record<string, ComplianceJsonValue> = {\n\t\t...event.metadata,\n\t\tsource: \"governance\",\n\t\tgovernanceEvaluationId: event.evaluationId,\n\t\tactionType: event.actionType,\n\t\tdecision: event.decision,\n\t\t...(event.policyId ? { policyId: event.policyId } : {}),\n\t\t...(event.riskLevel ? { riskLevel: event.riskLevel } : {}),\n\t\t...(event.reason ? { reason: event.reason } : {}),\n\t};\n\treturn {\n\t\tactionId: event.evaluationId,\n\t\ttype: \"policy_evaluation\",\n\t\tstatus: decisionToActionStatus(event.decision),\n\t\ttimestamp: event.timestamp,\n\t\tresource: event.policyId ?? event.actionType,\n\t\tdescription: event.policyId\n\t\t\t? `Governance policy ${event.policyId} ${event.decision} for ${event.actionType}`\n\t\t\t: `Governance evaluation ${event.decision} for ${event.actionType}`,\n\t\tmetadata,\n\t\t...(event.workspaceId ? { workspaceId: event.workspaceId } : {}),\n\t\t...(event.agentId ? { agentId: event.agentId } : {}),\n\t};\n}\n\nfunction sourceTypeForAction(action: AgentActionRecord): string {\n\tif (action.type === \"trace_recorded\") {\n\t\treturn \"execution_trace\";\n\t}\n\tif (\n\t\taction.type === \"policy_evaluation\" &&\n\t\taction.metadata.source === \"governance\"\n\t) {\n\t\treturn \"governance_policy_evaluation\";\n\t}\n\treturn action.type;\n}\n\nfunction evidenceForAction(\n\taction: AgentActionRecord,\n\tcontrol: ComplianceControl,\n): ComplianceEvidence {\n\tconst summary = action.description\n\t\t? `${control.title}: ${action.description}`\n\t\t: `${control.title}: ${action.type} ${action.status}`;\n\tconst metadata: Record<string, ComplianceJsonValue> = {\n\t\tactionType: action.type,\n\t\t...action.metadata,\n\t};\n\treturn {\n\t\tevidenceId: hashId(\"evidence\", {\n\t\t\tcontrolId: control.id,\n\t\t\tactionId: action.actionId,\n\t\t}),\n\t\tcontrolId: control.id,\n\t\tframework: control.framework,\n\t\tsourceType: sourceTypeForAction(action),\n\t\ttimestamp: action.timestamp,\n\t\tsummary,\n\t\tactionId: action.actionId,\n\t\tstatus: action.status,\n\t\tmetadata,\n\t\t...(action.workspaceId ? { workspaceId: action.workspaceId } : {}),\n\t\t...(action.agentId ? { agentId: action.agentId } : {}),\n\t\t...(action.resource ? { resource: action.resource } : {}),\n\t};\n}\n\nfunction evidenceForTrace(\n\ttrace: ExecutionTraceSummary,\n\tcontrol: ComplianceControl,\n): ComplianceEvidence {\n\treturn {\n\t\tevidenceId: hashId(\"evidence\", {\n\t\t\tcontrolId: control.id,\n\t\t\ttraceId: trace.traceId,\n\t\t}),\n\t\tcontrolId: control.id,\n\t\tframework: control.framework,\n\t\tsourceType: \"execution_trace\",\n\t\ttimestamp: trace.createdAt,\n\t\tsummary: `${control.title}: execution trace ${trace.traceId} recorded with ${trace.status} status`,\n\t\tworkspaceId: trace.workspaceId,\n\t\tagentId: trace.agentId,\n\t\ttraceId: trace.traceId,\n\t\tstatus: trace.status,\n\t\tmetadata: {\n\t\t\tdurationMs: trace.durationMs,\n\t\t\tspanCount: trace.spanCount,\n\t\t},\n\t};\n}\n\nfunction compareEvidence(a: ComplianceEvidence, b: ComplianceEvidence): number {\n\tconst byTime = Date.parse(b.timestamp) - Date.parse(a.timestamp);\n\tif (byTime !== 0) return byTime;\n\treturn a.evidenceId.localeCompare(b.evidenceId);\n}\n\nfunction dedupeEvidence(evidence: ComplianceEvidence[]): ComplianceEvidence[] {\n\tconst byId = new Map<string, ComplianceEvidence>();\n\tfor (const item of evidence) {\n\t\tbyId.set(item.evidenceId, item);\n\t}\n\treturn Array.from(byId.values()).sort(compareEvidence);\n}\n\nfunction sourceManifest(\n\tevidence: ComplianceEvidence[],\n): ComplianceArtifactSourceManifestEntry[] {\n\tconst bySource = new Map<\n\t\tstring,\n\t\t{ count: number; firstSeenAt?: string; lastSeenAt?: string }\n\t>();\n\tfor (const item of evidence) {\n\t\tconst current = bySource.get(item.sourceType) ?? { count: 0 };\n\t\tcurrent.count += 1;\n\t\tif (!current.firstSeenAt || item.timestamp < current.firstSeenAt) {\n\t\t\tcurrent.firstSeenAt = item.timestamp;\n\t\t}\n\t\tif (!current.lastSeenAt || item.timestamp > current.lastSeenAt) {\n\t\t\tcurrent.lastSeenAt = item.timestamp;\n\t\t}\n\t\tbySource.set(item.sourceType, current);\n\t}\n\treturn Array.from(bySource.entries())\n\t\t.map(([sourceType, entry]) => ({\n\t\t\tsourceType,\n\t\t\tevidenceCount: entry.count,\n\t\t\t...(entry.firstSeenAt ? { firstSeenAt: entry.firstSeenAt } : {}),\n\t\t\t...(entry.lastSeenAt ? { lastSeenAt: entry.lastSeenAt } : {}),\n\t\t}))\n\t\t.sort((a, b) => a.sourceType.localeCompare(b.sourceType));\n}\n\nfunction controlMatrixRows(\n\tcontrols: ComplianceControlReport[],\n\tevidence: ComplianceEvidence[],\n): ComplianceArtifactControlMatrixRow[] {\n\treturn controls.map((entry) => {\n\t\tconst controlEvidence = evidence.filter(\n\t\t\t(item) => item.controlId === entry.control.id,\n\t\t);\n\t\tconst sourceTypes = Array.from(\n\t\t\tnew Set(controlEvidence.map((item) => item.sourceType)),\n\t\t).sort();\n\t\tconst latest = controlEvidence\n\t\t\t.map((item) => item.timestamp)\n\t\t\t.sort()\n\t\t\t.at(-1);\n\t\treturn {\n\t\t\tcontrolId: entry.control.id,\n\t\t\tframework: entry.control.framework,\n\t\t\ttitle: entry.control.title,\n\t\t\tstatus: entry.status,\n\t\t\tevidenceCount: controlEvidence.length,\n\t\t\tevidenceIds: controlEvidence.map((item) => item.evidenceId),\n\t\t\tevidenceSources: sourceTypes,\n\t\t\t...(latest ? { lastEvidenceAt: latest } : {}),\n\t\t};\n\t});\n}\n\nfunction gapSeverity(\n\tcontrol: ComplianceControl,\n): ComplianceArtifactGap[\"severity\"] {\n\treturn control.evidenceTypes.some(\n\t\t(type) => type.includes(\"access\") || type === \"approval\",\n\t)\n\t\t? \"high\"\n\t\t: \"medium\";\n}\n\nfunction artifactGaps(\n\tcontrols: ComplianceControlReport[],\n): ComplianceArtifactGap[] {\n\treturn controls\n\t\t.filter((entry) => entry.status === \"missing\")\n\t\t.map((entry) => ({\n\t\t\tcontrolId: entry.control.id,\n\t\t\tframework: entry.control.framework,\n\t\t\ttitle: entry.control.title,\n\t\t\tseverity: gapSeverity(entry.control),\n\t\t\treason: `No evidence found for expected sources: ${entry.control.evidenceTypes.join(\", \")}.`,\n\t\t\tremediation:\n\t\t\t\t\"Connect governance, approvals, trace, audit, or identity events that satisfy this control for the requested period.\",\n\t\t}));\n}\n\nfunction executiveSummary(report: ComplianceReport): string {\n\tconst frameworkList = report.frameworks.join(\", \").toUpperCase();\n\treturn `${report.summary.satisfied} of ${report.summary.controls} ${frameworkList} controls are satisfied with ${report.summary.evidenceItems} evidence item(s); ${report.summary.missing} control(s) need additional evidence.`;\n}\n\nfunction renderComplianceArtifact(\n\treport: ComplianceReport,\n\tevidence: ComplianceEvidence[],\n\tcontrols: ComplianceControlReport[],\n): ComplianceArtifact {\n\tconst matrix = controlMatrixRows(controls, evidence);\n\treturn {\n\t\tartifactId: hashId(\"compliance_artifact\", {\n\t\t\treportId: report.reportId,\n\t\t\tevidenceIds: evidence.map((item) => item.evidenceId),\n\t\t}),\n\t\tformat: \"auditor_json\",\n\t\treportId: report.reportId,\n\t\tgeneratedAt: report.generatedAt,\n\t\tperiod: report.period,\n\t\tframeworks: report.frameworks,\n\t\texecutiveSummary: executiveSummary(report),\n\t\tcontrolMatrix: matrix,\n\t\tevidenceIndex: evidence,\n\t\tgaps: artifactGaps(controls),\n\t\tsourceManifest: sourceManifest(evidence),\n\t\texports: {\n\t\t\tdrata: {\n\t\t\t\tcontrolEvidence: matrix.map((row) => ({\n\t\t\t\t\tcontrolExternalId: row.controlId,\n\t\t\t\t\tevidenceIds: row.evidenceIds,\n\t\t\t\t\tstatus: row.status === \"satisfied\" ? \"ready\" : \"gap\",\n\t\t\t\t})),\n\t\t\t},\n\t\t\tvanta: {\n\t\t\t\tcustomEvidence: matrix.map((row) => ({\n\t\t\t\t\tcontrolId: row.controlId,\n\t\t\t\t\ttitle: row.title,\n\t\t\t\t\tevidenceCount: row.evidenceCount,\n\t\t\t\t})),\n\t\t\t},\n\t\t},\n\t\t...(report.workspaceId ? { workspaceId: report.workspaceId } : {}),\n\t};\n}\n\nexport class ComplianceService {\n\tprivate readonly trackedActions: AgentActionRecord[] = [];\n\tprivate readonly trackedGovernanceEvents: GovernanceEvaluationRecord[] = [];\n\n\tconstructor(\n\t\tprivate readonly getTraceService: TraceServiceProvider = getTracesService,\n\t\tprivate readonly now: () => Date = () => new Date(),\n\t) {}\n\n\ttrackAgentAction(input: AgentActionInput): AgentActionRecord {\n\t\tconst action = normalizeAgentActionInput(input);\n\t\tthis.trackedActions.push(action);\n\t\tif (this.trackedActions.length > MAX_TRACKED_ACTIONS) {\n\t\t\tthis.trackedActions.splice(\n\t\t\t\t0,\n\t\t\t\tthis.trackedActions.length - MAX_TRACKED_ACTIONS,\n\t\t\t);\n\t\t}\n\t\treturn action;\n\t}\n\n\ttrackGovernanceEvaluation(\n\t\tinput: GovernanceEvaluationInput,\n\t): GovernanceEvaluationRecord {\n\t\tconst event = normalizeGovernanceEvaluationInput(input);\n\t\tthis.trackedGovernanceEvents.push(event);\n\t\tif (this.trackedGovernanceEvents.length > MAX_TRACKED_ACTIONS) {\n\t\t\tthis.trackedGovernanceEvents.splice(\n\t\t\t\t0,\n\t\t\t\tthis.trackedGovernanceEvents.length - MAX_TRACKED_ACTIONS,\n\t\t\t);\n\t\t}\n\t\treturn event;\n\t}\n\n\tlistControls(frameworks?: ComplianceFramework[]): ComplianceControl[] {\n\t\treturn listComplianceControls(frameworks);\n\t}\n\n\tasync generateReport(\n\t\tinput: ComplianceReportRequest,\n\t): Promise<ComplianceReport> {\n\t\tconst request = normalizeComplianceReportRequest(input);\n\t\tconst controls = listComplianceControls(request.frameworks);\n\t\tconst evidence = await this.collectEvidence(request, controls);\n\t\tconst controlsWithEvidence = controls.map((control) => {\n\t\t\tconst controlEvidence = evidence.filter(\n\t\t\t\t(item) => item.controlId === control.id,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tcontrol,\n\t\t\t\tstatus: controlEvidence.length > 0 ? \"satisfied\" : \"missing\",\n\t\t\t\tevidenceCount: controlEvidence.length,\n\t\t\t\t...(request.includeEvidence ? { evidence: controlEvidence } : {}),\n\t\t\t} as const;\n\t\t});\n\t\tconst satisfied = controlsWithEvidence.filter(\n\t\t\t(control) => control.status === \"satisfied\",\n\t\t).length;\n\t\tconst generatedAt = this.now().toISOString();\n\t\tconst report: ComplianceReport = {\n\t\t\treportId: hashId(\"compliance_report\", {\n\t\t\t\tgeneratedAt,\n\t\t\t\tworkspaceId: request.workspaceId,\n\t\t\t\tframeworks: request.frameworks,\n\t\t\t\tperiod: reportPeriod(request),\n\t\t\t\tevidenceIds: evidence.map((item) => item.evidenceId),\n\t\t\t}),\n\t\t\tgeneratedAt,\n\t\t\tperiod: reportPeriod(request),\n\t\t\tframeworks: request.frameworks,\n\t\t\tsummary: {\n\t\t\t\tcontrols: controls.length,\n\t\t\t\tsatisfied,\n\t\t\t\tmissing: controls.length - satisfied,\n\t\t\t\tevidenceItems: evidence.length,\n\t\t\t},\n\t\t\tcontrols: controlsWithEvidence,\n\t\t\t...(request.workspaceId ? { workspaceId: request.workspaceId } : {}),\n\t\t};\n\t\tif (request.includeArtifact) {\n\t\t\treport.artifact = renderComplianceArtifact(\n\t\t\t\treport,\n\t\t\t\tevidence,\n\t\t\t\tcontrolsWithEvidence,\n\t\t\t);\n\t\t}\n\t\treturn report;\n\t}\n\n\tasync getEvidenceForControl(\n\t\tcontrolId: string,\n\t\tquery: ComplianceEvidenceQuery,\n\t): Promise<ComplianceControlEvidence | null> {\n\t\tconst control = getComplianceControl(controlId);\n\t\tif (!control) return null;\n\t\tconst request: NormalizedComplianceReportRequest = {\n\t\t\tframeworks: [control.framework],\n\t\t\tactions: [],\n\t\t\tgovernanceEvents: [],\n\t\t\tincludeEvidence: true,\n\t\t\tincludeArtifact: false,\n\t\t\t...(query.workspaceId ? { workspaceId: query.workspaceId } : {}),\n\t\t\t...(query.from ? { from: query.from } : {}),\n\t\t\t...(query.to ? { to: query.to } : {}),\n\t\t};\n\t\tconst evidence = (await this.collectEvidence(request, [control])).filter(\n\t\t\t(item) => item.controlId === control.id,\n\t\t);\n\t\treturn { control, evidence };\n\t}\n\n\tclearTrackedActionsForTest(): void {\n\t\tthis.trackedActions.length = 0;\n\t\tthis.trackedGovernanceEvents.length = 0;\n\t}\n\n\tprivate trackedActionsForRequest(\n\t\trequest: NormalizedComplianceReportRequest,\n\t): AgentActionRecord[] {\n\t\tconst governanceActions = [\n\t\t\t...this.trackedGovernanceEvents,\n\t\t\t...request.governanceEvents,\n\t\t]\n\t\t\t.filter((event) =>\n\t\t\t\tgovernanceEventMatchesWorkspace(event, request.workspaceId),\n\t\t\t)\n\t\t\t.filter((event) => evidenceTimestampInRange(event.timestamp, request))\n\t\t\t.map(actionForGovernanceEvent);\n\t\tconst actions = [\n\t\t\t...this.trackedActions,\n\t\t\t...request.actions,\n\t\t\t...governanceActions,\n\t\t];\n\t\tconst byId = new Map<string, AgentActionRecord>();\n\t\tfor (const action of actions) {\n\t\t\tif (!actionMatchesWorkspace(action, request.workspaceId)) continue;\n\t\t\tif (!actionWithinPeriod(action, request)) continue;\n\t\t\tbyId.set(action.actionId, action);\n\t\t}\n\t\treturn Array.from(byId.values());\n\t}\n\n\tprivate evidenceFromActions(\n\t\trequest: NormalizedComplianceReportRequest,\n\t\tcontrols: ComplianceControl[],\n\t): ComplianceEvidence[] {\n\t\tconst controlsById = new Map(\n\t\t\tcontrols.map((control) => [control.id, control]),\n\t\t);\n\t\tconst evidence: ComplianceEvidence[] = [];\n\t\tfor (const action of this.trackedActionsForRequest(request)) {\n\t\t\tfor (const controlId of controlIdsForActionType(action.type)) {\n\t\t\t\tconst control = controlsById.get(controlId);\n\t\t\t\tif (!control) continue;\n\t\t\t\tevidence.push(evidenceForAction(action, control));\n\t\t\t}\n\t\t}\n\t\treturn evidence;\n\t}\n\n\tprivate async evidenceFromTraces(\n\t\trequest: NormalizedComplianceReportRequest,\n\t\tcontrols: ComplianceControl[],\n\t): Promise<ComplianceEvidence[]> {\n\t\tconst traceControls = controls.filter((control) =>\n\t\t\tcontrol.mappedActionTypes.includes(\"trace_recorded\"),\n\t\t);\n\t\tif (traceControls.length === 0) return [];\n\n\t\tconst query: TraceListQuery = {\n\t\t\tlimit: TRACE_EVIDENCE_LIMIT,\n\t\t\toffset: 0,\n\t\t};\n\t\tif (request.workspaceId) {\n\t\t\tquery.workspaceId = request.workspaceId;\n\t\t}\n\n\t\ttry {\n\t\t\tconst result = await this.getTraceService().listTraces(query);\n\t\t\tconst evidence: ComplianceEvidence[] = [];\n\t\t\tfor (const trace of result.traces) {\n\t\t\t\tif (!evidenceTimestampInRange(trace.createdAt, request)) continue;\n\t\t\t\tfor (const control of traceControls) {\n\t\t\t\t\tevidence.push(evidenceForTrace(trace, control));\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn evidence;\n\t\t} catch (error) {\n\t\t\tif (error instanceof TracesUnavailableError) {\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate async collectEvidence(\n\t\trequest: NormalizedComplianceReportRequest,\n\t\tcontrols: ComplianceControl[],\n\t): Promise<ComplianceEvidence[]> {\n\t\tconst evidence = [\n\t\t\t...this.evidenceFromActions(request, controls),\n\t\t\t...(await this.evidenceFromTraces(request, controls)),\n\t\t].filter((item) => evidenceMatchesWorkspace(item, request.workspaceId));\n\t\treturn dedupeEvidence(evidence);\n\t}\n}\n\nlet defaultComplianceService: ComplianceService | null = null;\n\nexport function getComplianceService(): ComplianceService {\n\tdefaultComplianceService ??= new ComplianceService();\n\treturn defaultComplianceService;\n}\n\nexport function setComplianceServiceForTest(\n\tservice: ComplianceService | null,\n): void {\n\tdefaultComplianceService = service;\n}\n"]}