@stratum-hq/compliance 0.1.1 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -11
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -2,11 +2,13 @@
|
|
|
2
2
|
|
|
3
3
|
A content-free compliance **kernel** for [Stratum](https://github.com/stratum-hq/Stratum): the pure mechanics and type shapes any compliance product needs, with none of the content. Zero runtime dependencies, no database, no network, no provider, and no built-in catalog.
|
|
4
4
|
|
|
5
|
+
Read the documentation at [docs.stratum-hq.org](https://docs.stratum-hq.org/).
|
|
6
|
+
|
|
5
7
|
It gives you three things:
|
|
6
8
|
|
|
7
|
-
1. **Coverage scoring
|
|
8
|
-
2. **A finding state machine
|
|
9
|
-
3. **A control type vocabulary
|
|
9
|
+
1. **Coverage scoring:** diff a declared baseline against a resolved state and get a per-control breakdown plus a 0 to 100 score.
|
|
10
|
+
2. **A finding state machine:** a pure decision for whether a new evaluation outcome should open, resolve, or leave a finding alone.
|
|
11
|
+
3. **A control type vocabulary:** structural interfaces for describing a catalog of controls.
|
|
10
12
|
|
|
11
13
|
> [!NOTE]
|
|
12
14
|
> This is **not** a batteries-included compliance solution. It ships no frameworks, no controls, no provider mappings, and no thresholds. **Bring your own catalog:** you supply the content and the persistence; this package supplies the arithmetic and the shapes.
|
|
@@ -42,7 +44,7 @@ const result = scoreCoverage(baseline, resolved);
|
|
|
42
44
|
```
|
|
43
45
|
|
|
44
46
|
- `status` is `"compliant"` (matches), `"drift"` (present but wrong), or `"missing"` (no own resolved entry for that key).
|
|
45
|
-
- `score` is `round(compliant / total * 100)`. An **empty baseline scores 100
|
|
47
|
+
- `score` is `round(compliant / total * 100)`. An **empty baseline scores 100**. Nothing is required, so nothing is out of compliance.
|
|
46
48
|
|
|
47
49
|
### Equality
|
|
48
50
|
|
|
@@ -57,16 +59,16 @@ looseEqual(true, "true"); // => true
|
|
|
57
59
|
|
|
58
60
|
## Finding state machine
|
|
59
61
|
|
|
60
|
-
`reconcileFinding` decides what should happen to a control's finding when a new evaluation outcome arrives. It is a pure decision
|
|
62
|
+
`reconcileFinding` decides what should happen to a control's finding when a new evaluation outcome arrives. It is a pure decision; you persist the result.
|
|
61
63
|
|
|
62
64
|
```typescript
|
|
63
65
|
import { reconcileFinding } from "@stratum-hq/compliance";
|
|
64
66
|
|
|
65
|
-
reconcileFinding("fail", "none"); // { type: "open" }
|
|
66
|
-
reconcileFinding("fail", "open"); // { type: "noop" }
|
|
67
|
-
reconcileFinding("pass", "open"); // { type: "resolve" }
|
|
68
|
-
reconcileFinding("pass", "accepted"); // { type: "noop" }
|
|
69
|
-
reconcileFinding("na", "open"); // { type: "noop" }
|
|
67
|
+
reconcileFinding("fail", "none"); // { type: "open" } (new gap)
|
|
68
|
+
reconcileFinding("fail", "open"); // { type: "noop" } (already tracked)
|
|
69
|
+
reconcileFinding("pass", "open"); // { type: "resolve" } (gap closed)
|
|
70
|
+
reconcileFinding("pass", "accepted"); // { type: "noop" } (accepted risk untouched)
|
|
71
|
+
reconcileFinding("na", "open"); // { type: "noop" } (na/error never change a finding)
|
|
70
72
|
```
|
|
71
73
|
|
|
72
74
|
The rules:
|
|
@@ -75,7 +77,7 @@ The rules:
|
|
|
75
77
|
- `pass` **resolves** an active finding (`open` / `remediating`), and leaves an `accepted` finding untouched; otherwise there is nothing to resolve.
|
|
76
78
|
- `na` and `error` are always no-ops.
|
|
77
79
|
|
|
78
|
-
Map `{ type: "open" }` and `{ type: "resolve" }` onto your own inserts and updates
|
|
80
|
+
Map `{ type: "open" }` and `{ type: "resolve" }` onto your own inserts and updates. The state machine has no opinion about storage.
|
|
79
81
|
|
|
80
82
|
## Type vocabulary
|
|
81
83
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@stratum-hq/compliance",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
4
|
"description": "Content-free compliance kernel for Stratum: baseline coverage scoring, a finding state machine, and a control type vocabulary",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"compliance",
|
|
@@ -43,7 +43,7 @@
|
|
|
43
43
|
},
|
|
44
44
|
"license": "MIT",
|
|
45
45
|
"author": "Christian Crank",
|
|
46
|
-
"homepage": "https://
|
|
46
|
+
"homepage": "https://docs.stratum-hq.org/",
|
|
47
47
|
"bugs": "https://github.com/stratum-hq/Stratum/issues",
|
|
48
48
|
"engines": {
|
|
49
49
|
"node": ">=20.0.0"
|