@stratum-hq/compliance 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Christian Crank
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,105 @@
+# @stratum-hq/compliance
+
+A content-free compliance **kernel** for [Stratum](https://github.com/stratum-hq/Stratum): the pure mechanics and type shapes any compliance product needs, with none of the content. Zero runtime dependencies, no database, no network, no provider, and no built-in catalog.
+
+It gives you three things:
+
+1. **Coverage scoring** — diff a declared baseline against a resolved state and get a per-control breakdown plus a 0 to 100 score.
+2. **A finding state machine** — a pure decision for whether a new evaluation outcome should open, resolve, or leave a finding alone.
+3. **A control type vocabulary** — structural interfaces for describing a catalog of controls.
+
+> [!NOTE]
+> This is **not** a batteries-included compliance solution. It ships no frameworks, no controls, no provider mappings, and no thresholds. **Bring your own catalog:** you supply the content and the persistence; this package supplies the arithmetic and the shapes.
+
+## Installation
+
+```bash
+npm install @stratum-hq/compliance
+```
+
+## Coverage scoring
+
+`scoreCoverage` compares a `baseline` (what each control is expected to be) against a `resolved` map (what each control actually is). Only baseline keys are scored; extra resolved keys are ignored.
+
+```typescript
+import { scoreCoverage } from "@stratum-hq/compliance";
+
+const baseline = { mfaRequired: true, passwordMinLength: 12 };
+const resolved = {
+  mfaRequired: { value: "true" }, // resolved config often arrives as strings
+  passwordMinLength: { value: 8 },
+  // passwordMinLength is present but wrong; a key omitted here would be "missing"
+};
+
+const result = scoreCoverage(baseline, resolved);
+// {
+//   total: 2, compliant: 1, drift: 1, missing: 0, score: 50,
+//   details: [
+//     { key: "mfaRequired",       expected: true, actual: "true", status: "compliant" },
+//     { key: "passwordMinLength", expected: 12,   actual: 8,      status: "drift" },
+//   ],
+// }
+```
+
+- `status` is `"compliant"` (matches), `"drift"` (present but wrong), or `"missing"` (no resolved entry for that key).
+- `score` is `round(compliant / total * 100)`. An **empty baseline scores 100** — nothing is required, so nothing is out of compliance.
+
+### Equality
+
+The default comparator is `looseEqual`: booleans, numbers, and strings compare by their **textual form** (`true` equals `"true"`, `5` equals `"5"`), while objects and arrays compare by their **JSON form** (order-sensitive). This tolerates config values that come back as strings. Override it for strict or domain-specific comparison:
+
+```typescript
+import { scoreCoverage, looseEqual } from "@stratum-hq/compliance";
+
+scoreCoverage(baseline, resolved, { equals: (e, a) => e === a }); // strict
+looseEqual(true, "true"); // => true
+```
+
+## Finding state machine
+
+`reconcileFinding` decides what should happen to a control's finding when a new evaluation outcome arrives. It is a pure decision — you persist the result.
+
+```typescript
+import { reconcileFinding } from "@stratum-hq/compliance";
+
+reconcileFinding("fail", "none"); // { type: "open" }    — new gap
+reconcileFinding("fail", "open"); // { type: "noop" }    — already tracked
+reconcileFinding("pass", "open"); // { type: "resolve" } — gap closed
+reconcileFinding("pass", "accepted"); // { type: "noop" } — accepted risk untouched
+reconcileFinding("na", "open"); // { type: "noop" }      — na/error never change a finding
+```
+
+The rules:
+
+- `fail` **opens** a finding, unless one is already active (`open` / `remediating`) or the risk was formally `accepted`.
+- `pass` **resolves** an active finding (`open` / `remediating`), and leaves an `accepted` finding untouched; otherwise there is nothing to resolve.
+- `na` and `error` are always no-ops.
+
+Map `{ type: "open" }` and `{ type: "resolve" }` onto your own inserts and updates — the state machine has no opinion about storage.
+
+## Type vocabulary
+
+Structural, content-free interfaces for describing a catalog. They carry no data and no provider mapping; populate them with your own content.
+
+```typescript
+import type {
+  FieldType, // "boolean" | "number" | "enum"
+  Verification, // "verified" | "attestation" | "declared"
+  CatalogField,
+  CatalogGroup,
+  ManualControl,
+  ControlDef,
+} from "@stratum-hq/compliance";
+```
+
+## Design
+
+Everything here is a pure function or a type. No side effects, no IO, no global state, and nothing to configure. That is deliberate: the reusable part of compliance is the arithmetic and the vocabulary, so the interesting, product-specific parts (which controls, mapped to which real settings, for which framework, loaded and stored how) stay entirely on your side of the boundary.
+
+## Links
+
+- GitHub: https://github.com/stratum-hq/Stratum
+
+## License
+
+MIT © Christian Crank

package/dist/finding.d.ts

@@ -0,0 +1,24 @@
+/** The outcome of evaluating a single control. */
+export type ControlOutcome = "pass" | "fail" | "na" | "error";
+/** The current state of a control's finding. `none` means no finding exists. */
+export type FindingState = "open" | "remediating" | "resolved" | "accepted" | "none";
+export type FindingAction = {
+    type: "open";
+} | {
+    type: "resolve";
+} | {
+    type: "noop";
+};
+/**
+ * Decide what should happen to a control's finding given the new evaluation
+ * outcome and the current finding state. Pure.
+ *
+ * Rules:
+ * - `fail` opens a finding, unless one is already active (`open` /
+ *   `remediating`) or the risk was formally `accepted`.
+ * - `pass` resolves an active finding (`open` / `remediating`), and leaves an
+ *   `accepted` finding untouched; there is nothing to resolve otherwise.
+ * - `na` and `error` never change a finding.
+ */
+export declare function reconcileFinding(newOutcome: ControlOutcome, currentState: FindingState): FindingAction;
+//# sourceMappingURL=finding.d.ts.map

package/dist/finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAQA,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;AAE9D,gFAAgF;AAChF,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,aAAa,GACb,UAAU,GACV,UAAU,GACV,MAAM,CAAC;AAEX,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,cAAc,EAC1B,YAAY,EAAE,YAAY,GACzB,aAAa,CAsBf"}

package/dist/finding.js

@@ -0,0 +1,41 @@
+"use strict";
+// Finding state machine.
+//
+// A pure decision function for reconciling a control's finding when a new
+// evaluation outcome arrives. It decides only what should happen (open a
+// finding, resolve the active one, or do nothing); persisting that decision is
+// the caller's job. This keeps the transition rules testable in isolation from
+// any storage.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconcileFinding = reconcileFinding;
+/**
+ * Decide what should happen to a control's finding given the new evaluation
+ * outcome and the current finding state. Pure.
+ *
+ * Rules:
+ * - `fail` opens a finding, unless one is already active (`open` /
+ *   `remediating`) or the risk was formally `accepted`.
+ * - `pass` resolves an active finding (`open` / `remediating`), and leaves an
+ *   `accepted` finding untouched; there is nothing to resolve otherwise.
+ * - `na` and `error` never change a finding.
+ */
+function reconcileFinding(newOutcome, currentState) {
+    switch (newOutcome) {
+        case "fail":
+            if (currentState === "open" ||
+                currentState === "remediating" ||
+                currentState === "accepted") {
+                return { type: "noop" };
+            }
+            return { type: "open" };
+        case "pass":
+            if (currentState === "open" || currentState === "remediating") {
+                return { type: "resolve" };
+            }
+            return { type: "noop" };
+        case "na":
+        case "error":
+            return { type: "noop" };
+    }
+}
+//# sourceMappingURL=finding.js.map

package/dist/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":";AAAA,yBAAyB;AACzB,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,eAAe;;AA6Bf,4CAyBC;AApCD;;;;;;;;;;GAUG;AACH,SAAgB,gBAAgB,CAC9B,UAA0B,EAC1B,YAA0B;IAE1B,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,IACE,YAAY,KAAK,MAAM;gBACvB,YAAY,KAAK,aAAa;gBAC9B,YAAY,KAAK,UAAU,EAC3B,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAE1B,KAAK,MAAM;YACT,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAE1B,KAAK,IAAI,CAAC;QACV,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { scoreCoverage, looseEqual } from "./scoring.js";
+export type { ControlStatus, ScoredControl, CoverageResult, ScoreOptions, } from "./scoring.js";
+export { reconcileFinding } from "./finding.js";
+export type { ControlOutcome, FindingState, FindingAction } from "./finding.js";
+export type { FieldType, Verification, CatalogField, CatalogGroup, ManualControl, ControlDef, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzD,YAAY,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhF,YAAY,EACV,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+"use strict";
+// @stratum-hq/compliance
+//
+// A content-free compliance kernel: baseline coverage scoring, a finding state
+// machine, and a control type vocabulary. Pure TypeScript, zero runtime
+// dependencies, no database, no provider, no built-in catalog. Bring your own
+// catalog and persistence; this package supplies only the mechanics and shapes.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconcileFinding = exports.looseEqual = exports.scoreCoverage = void 0;
+var scoring_js_1 = require("./scoring.js");
+Object.defineProperty(exports, "scoreCoverage", { enumerable: true, get: function () { return scoring_js_1.scoreCoverage; } });
+Object.defineProperty(exports, "looseEqual", { enumerable: true, get: function () { return scoring_js_1.looseEqual; } });
+var finding_js_1 = require("./finding.js");
+Object.defineProperty(exports, "reconcileFinding", { enumerable: true, get: function () { return finding_js_1.reconcileFinding; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,yBAAyB;AACzB,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,8EAA8E;AAC9E,gFAAgF;;;AAEhF,2CAAyD;AAAhD,2GAAA,aAAa,OAAA;AAAE,wGAAA,UAAU,OAAA;AAQlC,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA"}

package/dist/scoring.d.ts

@@ -0,0 +1,52 @@
+/** The computed state of one control against its baseline. */
+export type ControlStatus = "compliant" | "drift" | "missing";
+/** One control's contribution to a {@link CoverageResult}. */
+export interface ScoredControl {
+    key: string;
+    expected: unknown;
+    /** The resolved value, or `undefined` when the control is missing. */
+    actual: unknown;
+    status: ControlStatus;
+}
+export interface CoverageResult {
+    /** Number of controls in the baseline. */
+    total: number;
+    compliant: number;
+    drift: number;
+    missing: number;
+    /** 0 to 100, the share of baseline controls that are compliant. */
+    score: number;
+    details: ScoredControl[];
+}
+export interface ScoreOptions {
+    /**
+     * Value equality. Defaults to {@link looseEqual} (booleans / numbers /
+     * strings compare by textual form, objects by JSON). Callers can override,
+     * for example to compare strictly or with domain-specific tolerance.
+     */
+    equals?: (expected: unknown, actual: unknown) => boolean;
+}
+/**
+ * The default string-loose comparator, exported for reuse.
+ *
+ * Objects and arrays compare by their JSON form; every other value (booleans,
+ * numbers, strings, `null`, `undefined`) compares by its textual form, so
+ * `true` equals `"true"` and `5` equals `"5"`. This tolerates the common case
+ * where a resolved config value arrives as a string even though its baseline
+ * was declared as a boolean or number. Note JSON comparison is order-sensitive:
+ * objects whose keys are in a different order are treated as unequal.
+ */
+export declare function looseEqual(expected: unknown, actual: unknown): boolean;
+/**
+ * Diff a declared baseline against a resolved value map. Pure. No IO.
+ *
+ * Only the keys present in `baseline` are scored; extra keys in `resolved` are
+ * ignored. A baseline key with no matching entry in `resolved` is `missing`; a
+ * matching entry whose value satisfies `equals` is `compliant`, otherwise it is
+ * `drift`. An empty baseline scores 100 (nothing is required, so nothing is out
+ * of compliance).
+ */
+export declare function scoreCoverage(baseline: Record<string, unknown>, resolved: Record<string, {
+    value: unknown;
+}>, options?: ScoreOptions): CoverageResult;
+//# sourceMappingURL=scoring.d.ts.map

package/dist/scoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../src/scoring.ts"],"names":[],"mappings":"AAQA,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;CAC1D;AAMD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAMtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,EAC5C,OAAO,CAAC,EAAE,YAAY,GACrB,cAAc,CA+BhB"}

package/dist/scoring.js

@@ -0,0 +1,70 @@
+"use strict";
+// Baseline coverage scoring.
+//
+// A pure, content-free primitive for any product that measures a resolved state
+// against a declared baseline. Given a baseline map (what each control is
+// expected to be) and a resolved map (what each control actually is), it reports
+// per-control compliant / drift / missing and an overall coverage score. It
+// knows nothing about frameworks, providers, or where the values came from.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looseEqual = looseEqual;
+exports.scoreCoverage = scoreCoverage;
+function isObjectLike(value) {
+    return typeof value === "object" && value !== null;
+}
+/**
+ * The default string-loose comparator, exported for reuse.
+ *
+ * Objects and arrays compare by their JSON form; every other value (booleans,
+ * numbers, strings, `null`, `undefined`) compares by its textual form, so
+ * `true` equals `"true"` and `5` equals `"5"`. This tolerates the common case
+ * where a resolved config value arrives as a string even though its baseline
+ * was declared as a boolean or number. Note JSON comparison is order-sensitive:
+ * objects whose keys are in a different order are treated as unequal.
+ */
+function looseEqual(expected, actual) {
+    if (isObjectLike(expected) || isObjectLike(actual)) {
+        if (!isObjectLike(expected) || !isObjectLike(actual))
+            return false;
+        return JSON.stringify(expected) === JSON.stringify(actual);
+    }
+    return String(expected) === String(actual);
+}
+/**
+ * Diff a declared baseline against a resolved value map. Pure. No IO.
+ *
+ * Only the keys present in `baseline` are scored; extra keys in `resolved` are
+ * ignored. A baseline key with no matching entry in `resolved` is `missing`; a
+ * matching entry whose value satisfies `equals` is `compliant`, otherwise it is
+ * `drift`. An empty baseline scores 100 (nothing is required, so nothing is out
+ * of compliance).
+ */
+function scoreCoverage(baseline, resolved, options) {
+    const equals = options?.equals ?? looseEqual;
+    const details = [];
+    let compliant = 0;
+    let drift = 0;
+    let missing = 0;
+    for (const key of Object.keys(baseline)) {
+        const expected = baseline[key];
+        const entry = resolved[key];
+        if (entry === undefined) {
+            missing++;
+            details.push({ key, expected, actual: undefined, status: "missing" });
+            continue;
+        }
+        const actual = entry.value;
+        if (equals(expected, actual)) {
+            compliant++;
+            details.push({ key, expected, actual, status: "compliant" });
+        }
+        else {
+            drift++;
+            details.push({ key, expected, actual, status: "drift" });
+        }
+    }
+    const total = details.length;
+    const score = total === 0 ? 100 : Math.round((compliant / total) * 100);
+    return { total, compliant, drift, missing, score, details };
+}
+//# sourceMappingURL=scoring.js.map

package/dist/scoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../src/scoring.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,EAAE;AACF,gFAAgF;AAChF,0EAA0E;AAC1E,iFAAiF;AACjF,4EAA4E;AAC5E,4EAA4E;;AAgD5E,gCAMC;AAWD,sCAmCC;AAlED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,QAAiB,EAAE,MAAe;IAC3D,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,aAAa,CAC3B,QAAiC,EACjC,QAA4C,EAC5C,OAAsB;IAEtB,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,UAAU,CAAC;IAC7C,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3B,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7B,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;IAExE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,50 @@
+/** The data type of a catalog field's value. */
+export type FieldType = "boolean" | "number" | "enum";
+/**
+ * How a control's compliance is established: machine-`verified` from evidence,
+ * covered by a signed operator `attestation`, or self-`declared` by the caller.
+ */
+export type Verification = "verified" | "attestation" | "declared";
+/** A single configurable control in a catalog. */
+export interface CatalogField {
+    key: string;
+    label: string;
+    /** The {@link CatalogGroup} this field belongs to, by name. */
+    group: string;
+    type: FieldType;
+    /** Choices for an `enum` field. */
+    options?: {
+        value: string;
+        label: string;
+    }[];
+    /** Suggested values for a `number` field. */
+    presets?: {
+        value: number;
+        label: string;
+    }[];
+    help: string;
+    verification: Verification;
+    /** For a `declared` field, the key of the verified control it maps to. */
+    verifiedControl?: string;
+}
+/** A named grouping of catalog fields. */
+export interface CatalogGroup {
+    name: string;
+    blurb: string;
+}
+/** A control that no automated check can prove, covered by an attestation. */
+export interface ManualControl {
+    key: string;
+    label: string;
+    /** The frameworks this manual control satisfies. */
+    frameworks: string[];
+    description: string;
+}
+/** A verified control definition. */
+export interface ControlDef {
+    key: string;
+    label: string;
+    /** The declared field this control backs, or `null` if it stands alone. */
+    declaredKey: string | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAOA,gDAAgD;AAChD,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC;AAEnE,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,6CAA6C;IAC7C,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qCAAqC;AACrC,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B"}

package/dist/types.js

@@ -0,0 +1,9 @@
+"use strict";
+// Control type vocabulary.
+//
+// Structural, content-free shapes for describing a catalog of controls: how a
+// field is typed, how it is verified, and how declared controls relate to
+// verified ones. These interfaces carry no data and no provider mapping. Bring
+// your own catalog: populate them with your product's own content.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA,2BAA2B;AAC3B,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,mEAAmE"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@stratum-hq/compliance",
+  "version": "0.1.0",
+  "description": "Content-free compliance kernel for Stratum: baseline coverage scoring, a finding state machine, and a control type vocabulary",
+  "keywords": [
+    "compliance",
+    "coverage",
+    "posture",
+    "drift",
+    "state-machine",
+    "control",
+    "audit",
+    "typescript",
+    "stratum"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "clean": "rm -rf dist"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.0",
+    "vitest": "^1.6.0"
+  },
+  "license": "MIT",
+  "author": "Christian Crank",
+  "homepage": "https://github.com/stratum-hq/Stratum/tree/main/packages/compliance#readme",
+  "bugs": "https://github.com/stratum-hq/Stratum/issues",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/stratum-hq/Stratum.git",
+    "directory": "packages/compliance"
+  }
+}