@kevinrabun/judges-cli 3.124.0

package/dist/commands/compliance-map.js

@@ -0,0 +1,374 @@
+/**
+ * Compliance map — map findings to multiple compliance frameworks
+ * (HIPAA, SOC2, PCI-DSS, ISO 27001, NIST 800-53).
+ *
+ * Produces a unified cross-walk matrix with gap analysis.
+ * All analysis local — no data leaves the machine.
+ */
+import { existsSync, readFileSync, mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+// ─── Frameworks ─────────────────────────────────────────────────────────────
+const FRAMEWORKS = [
+    {
+        id: "hipaa",
+        name: "HIPAA",
+        controls: [
+            {
+                id: "164.312(a)(1)",
+                title: "Access Control",
+                description: "Implement technical policies for electronic information systems access",
+            },
+            {
+                id: "164.312(a)(2)(iv)",
+                title: "Encryption and Decryption",
+                description: "Implement encryption mechanism for ePHI",
+            },
+            {
+                id: "164.312(c)(1)",
+                title: "Integrity",
+                description: "Implement policies to protect ePHI from improper alteration",
+            },
+            {
+                id: "164.312(d)",
+                title: "Authentication",
+                description: "Implement procedures to verify person or entity seeking access",
+            },
+            {
+                id: "164.312(e)(1)",
+                title: "Transmission Security",
+                description: "Implement technical security measures for electronic transmission",
+            },
+            {
+                id: "164.308(a)(1)(ii)(D)",
+                title: "Information System Activity Review",
+                description: "Implement procedures for regular review of records",
+            },
+        ],
+    },
+    {
+        id: "soc2",
+        name: "SOC 2",
+        controls: [
+            { id: "CC6.1", title: "Logical Access Security", description: "Logical access security over information assets" },
+            { id: "CC6.3", title: "Role-Based Access", description: "Role-based access and least privilege" },
+            { id: "CC6.6", title: "System Boundaries", description: "Security measures at system boundaries" },
+            { id: "CC6.7", title: "Data Transmission", description: "Restrict transmission of data to authorized parties" },
+            { id: "CC7.2", title: "System Monitoring", description: "Monitor system components for anomalies" },
+            { id: "CC8.1", title: "Change Management", description: "Changes to infrastructure and software are authorized" },
+        ],
+    },
+    {
+        id: "pci-dss",
+        name: "PCI-DSS v4.0",
+        controls: [
+            { id: "Req-2.2.1", title: "System Hardening", description: "Primary function configuration standards" },
+            { id: "Req-3.4", title: "PAN Protection", description: "Render PAN unreadable anywhere it's stored" },
+            { id: "Req-4.2.1", title: "Strong Cryptography", description: "Strong cryptography for PAN transmission" },
+            { id: "Req-6.2.4", title: "Secure Coding", description: "Software engineering techniques prevent attacks" },
+            {
+                id: "Req-6.3.1",
+                title: "Vulnerability Management",
+                description: "Security vulnerabilities identified and managed",
+            },
+            { id: "Req-8.3.1", title: "Authentication", description: "Strong authentication for user access" },
+            { id: "Req-10.2.1", title: "Audit Logs", description: "Logging mechanisms enabled" },
+        ],
+    },
+    {
+        id: "iso27001",
+        name: "ISO 27001:2022",
+        controls: [
+            { id: "A.5.15", title: "Access Control", description: "Rules for access control based on business requirements" },
+            {
+                id: "A.8.3",
+                title: "Information Access Restriction",
+                description: "Access to information restricted per access control policy",
+            },
+            {
+                id: "A.8.9",
+                title: "Configuration Management",
+                description: "Configurations including security configurations managed",
+            },
+            { id: "A.8.12", title: "Data Leakage Prevention", description: "Measures applied to prevent data leakage" },
+            { id: "A.8.24", title: "Cryptography", description: "Rules for effective use of cryptography" },
+            { id: "A.8.25", title: "Secure Development", description: "Rules for secure development of software" },
+            { id: "A.8.28", title: "Secure Coding", description: "Secure coding principles applied to development" },
+        ],
+    },
+    {
+        id: "nist800-53",
+        name: "NIST 800-53 Rev 5",
+        controls: [
+            { id: "AC-3", title: "Access Enforcement", description: "Enforce approved authorizations for access" },
+            { id: "AC-6", title: "Least Privilege", description: "Employ principle of least privilege" },
+            { id: "AU-2", title: "Event Logging", description: "Identify events requiring logging" },
+            { id: "IA-5", title: "Authenticator Management", description: "Manage information system authenticators" },
+            { id: "SC-8", title: "Transmission Confidentiality", description: "Protect transmitted information" },
+            { id: "SC-13", title: "Cryptographic Protection", description: "Implement cryptographic mechanisms" },
+            { id: "SI-10", title: "Information Input Validation", description: "Check validity of information inputs" },
+            { id: "SA-11", title: "Developer Testing", description: "Require system developer to create test plan" },
+        ],
+    },
+];
+// ─── Rule-to-control mappings ───────────────────────────────────────────────
+const RULE_MAPPINGS = [
+    {
+        rulePattern: /sql[-_]?inject|inject|xss|command[-_]?inject|input[-_]?valid/i,
+        frameworks: {
+            hipaa: ["164.312(c)(1)"],
+            soc2: ["CC6.6"],
+            "pci-dss": ["Req-6.2.4"],
+            iso27001: ["A.8.28"],
+            "nist800-53": ["SI-10"],
+        },
+    },
+    {
+        rulePattern: /crypt|encrypt|hash|tls|ssl|cert/i,
+        frameworks: {
+            hipaa: ["164.312(a)(2)(iv)", "164.312(e)(1)"],
+            soc2: ["CC6.7"],
+            "pci-dss": ["Req-4.2.1"],
+            iso27001: ["A.8.24"],
+            "nist800-53": ["SC-8", "SC-13"],
+        },
+    },
+    {
+        rulePattern: /auth|login|session|token|credential|password/i,
+        frameworks: {
+            hipaa: ["164.312(d)"],
+            soc2: ["CC6.1"],
+            "pci-dss": ["Req-8.3.1"],
+            iso27001: ["A.5.15"],
+            "nist800-53": ["IA-5", "AC-3"],
+        },
+    },
+    {
+        rulePattern: /access[-_]?control|privilege|rbac|permission|author/i,
+        frameworks: {
+            hipaa: ["164.312(a)(1)"],
+            soc2: ["CC6.3"],
+            "pci-dss": ["Req-8.3.1"],
+            iso27001: ["A.8.3"],
+            "nist800-53": ["AC-3", "AC-6"],
+        },
+    },
+    {
+        rulePattern: /log|audit|monitor|trace/i,
+        frameworks: {
+            hipaa: ["164.308(a)(1)(ii)(D)"],
+            soc2: ["CC7.2"],
+            "pci-dss": ["Req-10.2.1"],
+            iso27001: ["A.8.9"],
+            "nist800-53": ["AU-2"],
+        },
+    },
+    {
+        rulePattern: /secret|leak|expos|sensitive|pii|pan|credit[-_]?card/i,
+        frameworks: {
+            hipaa: ["164.312(a)(2)(iv)"],
+            soc2: ["CC6.7"],
+            "pci-dss": ["Req-3.4"],
+            iso27001: ["A.8.12"],
+            "nist800-53": ["SC-13"],
+        },
+    },
+    {
+        rulePattern: /config|harden|secure[-_]?default|misconfigur/i,
+        frameworks: {
+            soc2: ["CC8.1"],
+            "pci-dss": ["Req-2.2.1"],
+            iso27001: ["A.8.9"],
+            "nist800-53": ["SA-11"],
+        },
+    },
+    {
+        rulePattern: /vuln|cve|dependency|outdated|package/i,
+        frameworks: {
+            "pci-dss": ["Req-6.3.1"],
+            iso27001: ["A.8.25"],
+            "nist800-53": ["SA-11"],
+        },
+    },
+];
+function loadFindings(inputPath) {
+    const content = readFileSync(inputPath, "utf-8");
+    const data = JSON.parse(content);
+    // SARIF format
+    if (data.$schema?.includes("sarif") || data.runs) {
+        const findings = [];
+        for (const run of data.runs || []) {
+            for (const result of run.results || []) {
+                const r = result;
+                findings.push({
+                    ruleId: r.ruleId || "unknown",
+                    title: r.message?.text || r.ruleId || "Unknown",
+                    severity: r.level === "error" ? "high" : r.level === "warning" ? "medium" : "low",
+                });
+            }
+        }
+        return findings;
+    }
+    // Judges tribunal output
+    if (data.findings) {
+        return data.findings.map((f) => ({
+            ruleId: f.ruleId || "unknown",
+            title: f.title || f.ruleId || "Unknown",
+            severity: f.severity || "medium",
+        }));
+    }
+    // Array of findings
+    if (Array.isArray(data)) {
+        return data.map((f) => ({
+            ruleId: f.ruleId || "unknown",
+            title: f.title || "Unknown",
+            severity: f.severity || "medium",
+        }));
+    }
+    return [];
+}
+function mapToFrameworks(findings) {
+    return findings.map((f) => {
+        const frameworks = {};
+        const combined = `${f.ruleId} ${f.title}`;
+        for (const mapping of RULE_MAPPINGS) {
+            if (mapping.rulePattern.test(combined)) {
+                for (const [fwId, controls] of Object.entries(mapping.frameworks)) {
+                    if (!frameworks[fwId])
+                        frameworks[fwId] = [];
+                    for (const c of controls) {
+                        if (!frameworks[fwId].includes(c))
+                            frameworks[fwId].push(c);
+                    }
+                }
+            }
+        }
+        return { ruleId: f.ruleId, title: f.title, severity: f.severity, frameworks };
+    });
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runComplianceMap(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges compliance-map — Map findings to compliance frameworks
+
+Usage:
+  judges compliance-map <findings.json>
+  judges compliance-map report.sarif.json --frameworks hipaa,pci-dss
+  judges compliance-map findings.json --format json --output compliance.json
+
+Options:
+  --frameworks <list>   Filter frameworks (comma-separated: hipaa,soc2,pci-dss,iso27001,nist800-53)
+  --list-frameworks     List all supported frameworks and controls
+  --gap-analysis        Show which controls have no matching findings
+  --format json         JSON output
+  --output <file>       Write report to file
+  --help, -h            Show this help
+
+Supported Frameworks: ${FRAMEWORKS.map((f) => f.id).join(", ")}
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const outputFile = argv.find((_a, i) => argv[i - 1] === "--output");
+    if (argv.includes("--list-frameworks")) {
+        if (format === "json") {
+            console.log(JSON.stringify(FRAMEWORKS, null, 2));
+        }
+        else {
+            for (const fw of FRAMEWORKS) {
+                console.log(`\n  ${fw.name} (${fw.id})`);
+                console.log("  ──────────────────────────");
+                for (const c of fw.controls) {
+                    console.log(`    ${c.id.padEnd(20)} ${c.title}`);
+                }
+            }
+            console.log("");
+        }
+        return;
+    }
+    const inputFile = argv.find((a) => !a.startsWith("--") && !argv[argv.indexOf(a) - 1]?.startsWith("--"));
+    if (!inputFile || !existsSync(inputFile)) {
+        console.error("  Please provide a valid findings file (JSON or SARIF)");
+        return;
+    }
+    const fwFilter = argv.find((_a, i) => argv[i - 1] === "--frameworks");
+    const showGaps = argv.includes("--gap-analysis");
+    let findings;
+    try {
+        findings = loadFindings(inputFile);
+    }
+    catch (err) {
+        console.error(`  Failed to parse findings: ${err instanceof Error ? err.message : String(err)}`);
+        return;
+    }
+    const mapped = mapToFrameworks(findings);
+    let activeFrameworks = FRAMEWORKS;
+    if (fwFilter) {
+        const allowed = fwFilter.split(",");
+        activeFrameworks = FRAMEWORKS.filter((f) => allowed.includes(f.id));
+    }
+    // Build coverage matrix
+    const coverage = {};
+    for (const fw of activeFrameworks)
+        coverage[fw.id] = new Set();
+    for (const m of mapped) {
+        for (const [fwId, controls] of Object.entries(m.frameworks)) {
+            if (!coverage[fwId])
+                continue;
+            for (const c of controls)
+                coverage[fwId].add(c);
+        }
+    }
+    const report = {
+        findings: mapped,
+        coverage: Object.fromEntries(activeFrameworks.map((fw) => [
+            fw.id,
+            {
+                name: fw.name,
+                totalControls: fw.controls.length,
+                coveredControls: coverage[fw.id].size,
+                coveragePercent: fw.controls.length > 0 ? Math.round((coverage[fw.id].size / fw.controls.length) * 100) : 0,
+                covered: [...coverage[fw.id]],
+                gaps: fw.controls.filter((c) => !coverage[fw.id].has(c.id)).map((c) => c.id),
+            },
+        ])),
+        totalFindings: findings.length,
+        mappedFindings: mapped.filter((m) => Object.keys(m.frameworks).length > 0).length,
+        timestamp: new Date().toISOString(),
+    };
+    if (outputFile) {
+        const dir = join(".", ".judges-compliance");
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, outputFile), JSON.stringify(report, null, 2));
+        console.log(`  Report saved to .judges-compliance/${outputFile}`);
+    }
+    if (format === "json") {
+        console.log(JSON.stringify(report, null, 2));
+    }
+    else {
+        console.log(`\n  Compliance Mapping — ${findings.length} findings`);
+        console.log(`  Mapped: ${report.mappedFindings} | Unmapped: ${findings.length - report.mappedFindings}\n  ──────────────────────────`);
+        for (const fw of activeFrameworks) {
+            const cov = report.coverage[fw.id];
+            const bar = "█".repeat(Math.round(cov.coveragePercent / 5)) + "░".repeat(20 - Math.round(cov.coveragePercent / 5));
+            console.log(`\n    ${fw.name.padEnd(20)} ${bar} ${cov.coveragePercent}% (${cov.coveredControls}/${cov.totalControls})`);
+            if (showGaps && cov.gaps.length > 0) {
+                console.log(`      Gaps: ${cov.gaps.join(", ")}`);
+            }
+        }
+        // Cross-walk table
+        console.log("\n    Cross-Walk Matrix:");
+        console.log("    " + "Finding".padEnd(40) + activeFrameworks.map((f) => f.id.padEnd(12)).join(""));
+        console.log("    " + "─".repeat(40 + activeFrameworks.length * 12));
+        for (const m of mapped.slice(0, 20)) {
+            const cols = activeFrameworks
+                .map((f) => (m.frameworks[f.id]?.length ? `✓ (${m.frameworks[f.id].length})`.padEnd(12) : "—".padEnd(12)))
+                .join("");
+            console.log("    " + m.ruleId.substring(0, 38).padEnd(40) + cols);
+        }
+        if (mapped.length > 20)
+            console.log(`    ... and ${mapped.length - 20} more findings`);
+        console.log("");
+    }
+}

package/dist/commands/compliance-report.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `judges compliance-report` — Audit-ready compliance evidence generation.
+ *
+ * Maps findings to regulatory frameworks (SOC 2, OWASP Top 10, OWASP LLM Top 10,
+ * CWE, PCI-DSS) and generates structured evidence packets suitable for auditors.
+ *
+ * Usage:
+ *   judges compliance-report myFile.ts               # text report
+ *   judges compliance-report myFile.ts --json         # JSON evidence packet
+ *   judges compliance-report myFile.ts --framework soc2  # filter by framework
+ */
+import type { Finding } from "../types.js";
+export interface ComplianceMapping {
+    framework: string;
+    controlId: string;
+    controlTitle: string;
+    status: "pass" | "fail" | "not-assessed";
+    findings: Finding[];
+    evidence: string;
+}
+export interface ComplianceReport {
+    target: string;
+    generatedAt: string;
+    frameworks: Record<string, ComplianceMapping[]>;
+    summary: {
+        total: number;
+        pass: number;
+        fail: number;
+        notAssessed: number;
+        passRate: number;
+    };
+}
+export declare function buildComplianceReport(target: string, findings: Finding[], filterFramework?: string): ComplianceReport;
+export declare function formatComplianceReportText(report: ComplianceReport): string;

package/dist/commands/compliance-report.js

@@ -0,0 +1,161 @@
+/**
+ * `judges compliance-report` — Audit-ready compliance evidence generation.
+ *
+ * Maps findings to regulatory frameworks (SOC 2, OWASP Top 10, OWASP LLM Top 10,
+ * CWE, PCI-DSS) and generates structured evidence packets suitable for auditors.
+ *
+ * Usage:
+ *   judges compliance-report myFile.ts               # text report
+ *   judges compliance-report myFile.ts --json         # JSON evidence packet
+ *   judges compliance-report myFile.ts --framework soc2  # filter by framework
+ */
+// ─── Framework Control Definitions ──────────────────────────────────────────
+const SOC2_CONTROLS = [
+    { id: "CC6.1", title: "Logical and Physical Access Controls", rulePatterns: [/^SEC-|^AUTH-|^CYBER-|^COMP-/] },
+    { id: "CC6.6", title: "System Boundaries and Threat Mitigation", rulePatterns: [/^SEC-|^RATE-|^CYBER-/] },
+    { id: "CC6.7", title: "Data Classification and Restricted Transmission", rulePatterns: [/^DSEC-|^COMP-|^SEC-/] },
+    { id: "CC7.1", title: "Detection and Monitoring", rulePatterns: [/^OBS-|^LOG-|^COMP-/] },
+    { id: "CC7.2", title: "Anomaly Detection and Incident Response", rulePatterns: [/^OBS-|^CYBER-|^REL-/] },
+    { id: "CC8.1", title: "Change Management", rulePatterns: [/^CICD-|^SW-|^DEP-/] },
+    { id: "CC9.1", title: "Risk Mitigation", rulePatterns: [/^SEC-|^PERF-|^REL-|^SCALE-/] },
+];
+const OWASP_TOP10 = [
+    {
+        id: "A01",
+        title: "Broken Access Control",
+        cweRanges: ["CWE-200", "CWE-284", "CWE-285", "CWE-639", "CWE-862", "CWE-863"],
+    },
+    {
+        id: "A02",
+        title: "Cryptographic Failures",
+        cweRanges: ["CWE-259", "CWE-261", "CWE-327", "CWE-328", "CWE-330", "CWE-916"],
+    },
+    { id: "A03", title: "Injection", cweRanges: ["CWE-20", "CWE-77", "CWE-78", "CWE-79", "CWE-89", "CWE-94"] },
+    { id: "A04", title: "Insecure Design", cweRanges: ["CWE-209", "CWE-256", "CWE-501", "CWE-522"] },
+    { id: "A05", title: "Security Misconfiguration", cweRanges: ["CWE-16", "CWE-611", "CWE-614", "CWE-1004"] },
+    { id: "A06", title: "Vulnerable and Outdated Components", cweRanges: ["CWE-1104"] },
+    { id: "A07", title: "Identification and Authentication Failures", cweRanges: ["CWE-255", "CWE-287", "CWE-384"] },
+    { id: "A08", title: "Software and Data Integrity Failures", cweRanges: ["CWE-345", "CWE-502", "CWE-829"] },
+    {
+        id: "A09",
+        title: "Security Logging and Monitoring Failures",
+        cweRanges: ["CWE-117", "CWE-223", "CWE-532", "CWE-778"],
+    },
+    { id: "A10", title: "Server-Side Request Forgery", cweRanges: ["CWE-918"] },
+];
+const PCI_DSS_CONTROLS = [
+    { id: "Req-3.4", title: "Render PAN unreadable", rulePatterns: [/^DSEC-|^SEC-.*(?:encrypt|hash)/i] },
+    { id: "Req-6.5", title: "Address common coding vulnerabilities", rulePatterns: [/^SEC-|^CYBER-/] },
+    { id: "Req-8.2", title: "Strong authentication methods", rulePatterns: [/^AUTH-|^SEC-/] },
+    { id: "Req-10.2", title: "Audit trail captures events", rulePatterns: [/^OBS-|^LOG-|^COMP-/] },
+];
+// ─── Mapping Logic ──────────────────────────────────────────────────────────
+function mapFindingsToSOC2(findings) {
+    return SOC2_CONTROLS.map((ctrl) => {
+        const matched = findings.filter((f) => ctrl.rulePatterns.some((p) => p.test(f.ruleId)));
+        const status = matched.length > 0 ? "fail" : "not-assessed";
+        return {
+            framework: "SOC 2",
+            controlId: ctrl.id,
+            controlTitle: ctrl.title,
+            status,
+            findings: matched,
+            evidence: matched.length > 0
+                ? `${matched.length} finding(s) impact this control: ${matched.map((f) => f.ruleId).join(", ")}`
+                : "No findings detected for this control. Manual review recommended.",
+        };
+    });
+}
+function mapFindingsToOWASP(findings) {
+    return OWASP_TOP10.map((cat) => {
+        const matched = findings.filter((f) => {
+            if (f.cweIds)
+                return f.cweIds.some((cwe) => cat.cweRanges.includes(cwe));
+            if (f.owaspIds)
+                return f.owaspIds.some((id) => id.startsWith(cat.id));
+            return false;
+        });
+        const status = matched.length > 0 ? "fail" : "not-assessed";
+        return {
+            framework: "OWASP Top 10",
+            controlId: cat.id,
+            controlTitle: cat.title,
+            status,
+            findings: matched,
+            evidence: matched.length > 0
+                ? `${matched.length} finding(s): ${matched.map((f) => `${f.ruleId} (${f.cweIds?.join(", ") || "no CWE"})`).join("; ")}`
+                : "No findings mapped to this category.",
+        };
+    });
+}
+function mapFindingsToPCI(findings) {
+    return PCI_DSS_CONTROLS.map((ctrl) => {
+        const matched = findings.filter((f) => ctrl.rulePatterns.some((p) => p.test(f.ruleId)));
+        const status = matched.length > 0 ? "fail" : "not-assessed";
+        return {
+            framework: "PCI-DSS",
+            controlId: ctrl.id,
+            controlTitle: ctrl.title,
+            status,
+            findings: matched,
+            evidence: matched.length > 0
+                ? `${matched.length} finding(s) impact this requirement: ${matched.map((f) => f.ruleId).join(", ")}`
+                : "No findings detected for this requirement.",
+        };
+    });
+}
+// ─── Report Builder ─────────────────────────────────────────────────────────
+export function buildComplianceReport(target, findings, filterFramework) {
+    const frameworks = {};
+    if (!filterFramework || filterFramework === "soc2") {
+        frameworks["SOC 2"] = mapFindingsToSOC2(findings);
+    }
+    if (!filterFramework || filterFramework === "owasp") {
+        frameworks["OWASP Top 10"] = mapFindingsToOWASP(findings);
+    }
+    if (!filterFramework || filterFramework === "pci") {
+        frameworks["PCI-DSS"] = mapFindingsToPCI(findings);
+    }
+    const allMappings = Object.values(frameworks).flat();
+    const total = allMappings.length;
+    const pass = allMappings.filter((m) => m.status === "pass").length;
+    const fail = allMappings.filter((m) => m.status === "fail").length;
+    const notAssessed = allMappings.filter((m) => m.status === "not-assessed").length;
+    return {
+        target,
+        generatedAt: new Date().toISOString(),
+        frameworks,
+        summary: {
+            total,
+            pass,
+            fail,
+            notAssessed,
+            passRate: total > 0 ? Math.round((pass / total) * 100) : 0,
+        },
+    };
+}
+// ─── CLI Formatters ─────────────────────────────────────────────────────────
+export function formatComplianceReportText(report) {
+    const lines = [];
+    lines.push("╔══════════════════════════════════════════════════════════════╗");
+    lines.push("║       Judges Panel — Compliance Evidence Report             ║");
+    lines.push("╚══════════════════════════════════════════════════════════════╝");
+    lines.push("");
+    lines.push(`  Target    : ${report.target}`);
+    lines.push(`  Generated : ${report.generatedAt.slice(0, 10)}`);
+    lines.push(`  Controls  : ${report.summary.total} (${report.summary.fail} failing, ${report.summary.notAssessed} not assessed)`);
+    lines.push("");
+    for (const [framework, mappings] of Object.entries(report.frameworks)) {
+        lines.push(`  ┌── ${framework} ${"─".repeat(50 - framework.length)}`);
+        for (const m of mappings) {
+            const icon = m.status === "pass" ? "✅" : m.status === "fail" ? "❌" : "⬜";
+            lines.push(`  │ ${icon} ${m.controlId.padEnd(10)} ${m.controlTitle}`);
+            if (m.status === "fail") {
+                lines.push(`  │   └─ ${m.evidence}`);
+            }
+        }
+        lines.push(`  └${"─".repeat(60)}`);
+        lines.push("");
+    }
+    return lines.join("\n");
+}

package/dist/commands/compliance-weight.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Compliance weight — dynamically adjust finding severity based on
+ * active compliance frameworks (PCI-DSS, HIPAA, GDPR, SOC2, ISO27001).
+ *
+ * Takes a judges report (JSON) and re-weights findings according to
+ * the specified framework(s). Stored config in `.judgesrc` or CLI flags.
+ */
+export declare function runComplianceWeight(argv: string[]): void;