@vorionsys/security 1.0.0

package/dist/common/validation.js

@@ -0,0 +1,221 @@
+/**
+ * Input Validation and Sanitization Utilities
+ *
+ * Provides schema-based validation and sanitization for API inputs.
+ * Built on top of Zod with additional security features.
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+/**
+ * Common validation patterns
+ */
+export const patterns = {
+    // UUID v4
+    uuid: /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
+    // ISO 8601 datetime
+    isoDateTime: /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?(?:Z|[+-]\d{2}:\d{2})$/,
+    // Slug (URL-safe identifier)
+    slug: /^[a-z0-9]+(?:-[a-z0-9]+)*$/,
+    // Email (basic)
+    email: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
+    // Alphanumeric with underscores
+    identifier: /^[a-zA-Z][a-zA-Z0-9_]*$/,
+    // Semantic version
+    semver: /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9]+(?:\.[a-zA-Z0-9]+)*)?$/,
+};
+/**
+ * Sanitize a string by removing potentially dangerous characters
+ */
+export function sanitizeString(input) {
+    return input
+        // Remove null bytes
+        .replace(/\0/g, '')
+        // Remove control characters (except newlines and tabs)
+        .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '')
+        // Normalize unicode to NFC form
+        .normalize('NFC')
+        // Trim whitespace
+        .trim();
+}
+/**
+ * Sanitize an object recursively
+ */
+export function sanitizeObject(obj) {
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        // Sanitize keys too
+        const sanitizedKey = sanitizeString(key);
+        if (typeof value === 'string') {
+            result[sanitizedKey] = sanitizeString(value);
+        }
+        else if (Array.isArray(value)) {
+            result[sanitizedKey] = value.map((item) => typeof item === 'string'
+                ? sanitizeString(item)
+                : typeof item === 'object' && item !== null
+                    ? sanitizeObject(item)
+                    : item);
+        }
+        else if (typeof value === 'object' && value !== null) {
+            result[sanitizedKey] = sanitizeObject(value);
+        }
+        else {
+            result[sanitizedKey] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Common Zod schemas
+ */
+export const schemas = {
+    /** UUID v4 */
+    uuid: z.string().uuid(),
+    /** Entity ID (UUID) */
+    entityId: z.string().uuid().describe('Entity identifier'),
+    /** Intent ID (UUID) */
+    intentId: z.string().uuid().describe('Intent identifier'),
+    /** Proof ID (UUID) */
+    proofId: z.string().uuid().describe('Proof identifier'),
+    /** ISO 8601 timestamp */
+    timestamp: z.string().datetime().describe('ISO 8601 timestamp'),
+    /** Trust score (0-1000) */
+    trustScore: z.number().int().min(0).max(1000).describe('Trust score'),
+    /** Trust level (0-7) */
+    trustLevel: z.number().int().min(0).max(7).describe('Trust level'),
+    /** Non-empty string */
+    nonEmptyString: z.string().min(1).max(10000).describe('Non-empty string'),
+    /** Safe object (with depth limit) */
+    safeObject: z.record(z.unknown()).refine((obj) => {
+        // Check depth
+        const checkDepth = (o, depth) => {
+            if (depth > 10)
+                return false;
+            if (typeof o !== 'object' || o === null)
+                return true;
+            return Object.values(o).every((v) => checkDepth(v, depth + 1));
+        };
+        return checkDepth(obj, 0);
+    }, { message: 'Object nesting too deep (max 10 levels)' }),
+    /** Pagination parameters */
+    pagination: z.object({
+        offset: z.number().int().min(0).max(100000).default(0),
+        limit: z.number().int().min(1).max(1000).default(100),
+    }),
+    /** Sort parameters */
+    sort: z.object({
+        field: z.string().max(100),
+        order: z.enum(['asc', 'desc']).default('desc'),
+    }),
+};
+/**
+ * Create a validated and sanitized request body parser
+ */
+export function createBodyParser(schema) {
+    return {
+        parse: (data) => {
+            // Sanitize if object
+            const sanitized = typeof data === 'object' && data !== null
+                ? sanitizeObject(data)
+                : data;
+            // Validate with schema
+            return schema.parse(sanitized);
+        },
+        safeParse: (data) => {
+            // Sanitize if object
+            const sanitized = typeof data === 'object' && data !== null
+                ? sanitizeObject(data)
+                : data;
+            // Validate with schema
+            return schema.safeParse(sanitized);
+        },
+    };
+}
+/**
+ * Validate array size
+ */
+export function validateArraySize(arr, maxSize, fieldName) {
+    if (arr.length > maxSize) {
+        throw new ValidationError(`${fieldName} exceeds maximum size of ${maxSize}`, 'ARRAY_TOO_LARGE');
+    }
+}
+/**
+ * Validate string length
+ */
+export function validateStringLength(str, maxLength, fieldName) {
+    if (str.length > maxLength) {
+        throw new ValidationError(`${fieldName} exceeds maximum length of ${maxLength}`, 'STRING_TOO_LONG');
+    }
+}
+/**
+ * Custom validation error
+ */
+export class ValidationError extends Error {
+    code;
+    field;
+    constructor(message, code = 'VALIDATION_ERROR', field) {
+        super(message);
+        this.name = 'ValidationError';
+        this.code = code;
+        this.field = field;
+    }
+}
+/**
+ * Rate limiting helper for validation
+ */
+export function createRateLimitedValidator(validator, maxPerMinute) {
+    const calls = [];
+    return (data) => {
+        const now = Date.now();
+        const oneMinuteAgo = now - 60000;
+        // Clean old entries
+        while (calls.length > 0 && calls[0] < oneMinuteAgo) {
+            calls.shift();
+        }
+        // Check rate limit
+        if (calls.length >= maxPerMinute) {
+            throw new ValidationError('Rate limit exceeded for validation', 'RATE_LIMIT_EXCEEDED');
+        }
+        // Record call and validate
+        calls.push(now);
+        validator(data);
+    };
+}
+/**
+ * Validate JSON payload size
+ */
+export function validatePayloadSize(payload, maxSizeBytes = 1048576 // 1MB default
+) {
+    const size = new TextEncoder().encode(JSON.stringify(payload)).length;
+    if (size > maxSizeBytes) {
+        throw new ValidationError(`Payload size ${size} exceeds maximum of ${maxSizeBytes} bytes`, 'PAYLOAD_TOO_LARGE');
+    }
+}
+/**
+ * Check for potential injection patterns
+ */
+export function checkInjectionPatterns(input) {
+    const dangerousPatterns = [
+        // SQL injection
+        /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b)/i,
+        // Script injection
+        /<script[^>]*>/i,
+        // Template injection
+        /\$\{[^}]+\}/,
+        /\{\{[^}]+\}\}/,
+        // Command injection
+        /[;&|`$]/,
+        // Path traversal
+        /\.\.\//,
+    ];
+    return dangerousPatterns.some((pattern) => pattern.test(input));
+}
+/**
+ * Validate that input doesn't contain injection patterns
+ */
+export function validateNoInjection(input, fieldName) {
+    if (checkInjectionPatterns(input)) {
+        throw new ValidationError(`${fieldName} contains potentially dangerous patterns`, 'INJECTION_DETECTED', fieldName);
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/common/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/common/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,UAAU;IACV,IAAI,EAAE,wEAAwE;IAC9E,oBAAoB;IACpB,WAAW,EAAE,wEAAwE;IACrF,6BAA6B;IAC7B,IAAI,EAAE,4BAA4B;IAClC,gBAAgB;IAChB,KAAK,EAAE,4BAA4B;IACnC,gCAAgC;IAChC,UAAU,EAAE,yBAAyB;IACrC,mBAAmB;IACnB,MAAM,EAAE,sDAAsD;CAC/D,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK;QACV,oBAAoB;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnB,uDAAuD;SACtD,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC;QACjD,gCAAgC;SAC/B,SAAS,CAAC,KAAK,CAAC;QACjB,kBAAkB;SACjB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAoC,GAAM;IACtE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,oBAAoB;QACpB,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,YAAY,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,OAAO,IAAI,KAAK,QAAQ;gBACtB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC;gBACtB,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;oBACzC,CAAC,CAAC,cAAc,CAAC,IAA+B,CAAC;oBACjD,CAAC,CAAC,IAAI,CACX,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvD,MAAM,CAAC,YAAY,CAAC,GAAG,cAAc,CAAC,KAAgC,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,cAAc;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAEvB,uBAAuB;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAEzD,uBAAuB;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAEzD,sBAAsB;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAEvD,yBAAyB;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAE/D,2BAA2B;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;IAErE,wBAAwB;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;IAElE,uBAAuB;IACvB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAEzE,qCAAqC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACtC,CAAC,GAAG,EAAE,EAAE;QACN,cAAc;QACd,MAAM,UAAU,GAAG,CAAC,CAAU,EAAE,KAAa,EAAW,EAAE;YACxD,IAAI,KAAK,GAAG,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACrD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC;QACF,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC,EACD,EAAE,OAAO,EAAE,yCAAyC,EAAE,CACvD;IAED,4BAA4B;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACtD,CAAC;IAEF,sBAAsB;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;KAC/C,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAyB,MAAS;IAChE,OAAO;QACL,KAAK,EAAE,CAAC,IAAa,EAAc,EAAE;YACnC,qBAAqB;YACrB,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;gBACvC,CAAC,CAAC,cAAc,CAAC,IAA+B,CAAC;gBACjD,CAAC,CAAC,IAAI,CAAC;YAEX,uBAAuB;YACvB,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAED,SAAS,EAAE,CAAC,IAAa,EAAE,EAAE;YAC3B,qBAAqB;YACrB,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;gBACvC,CAAC,CAAC,cAAc,CAAC,IAA+B,CAAC;gBACjD,CAAC,CAAC,IAAI,CAAC;YAEX,uBAAuB;YACvB,OAAO,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAQ,EACR,OAAe,EACf,SAAiB;IAEjB,IAAI,GAAG,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,4BAA4B,OAAO,EAAE,EACjD,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,SAAiB,EACjB,SAAiB;IAEjB,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,8BAA8B,SAAS,EAAE,EACrD,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IAEf,YAAY,OAAe,EAAE,OAAe,kBAAkB,EAAE,KAAc;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAA4B,EAC5B,YAAoB;IAEpB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,OAAO,CAAC,IAAO,EAAQ,EAAE;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,GAAG,GAAG,KAAK,CAAC;QAEjC,oBAAoB;QACpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,GAAG,YAAY,EAAE,CAAC;YACpD,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,eAAe,CACvB,oCAAoC,EACpC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,eAAuB,OAAO,CAAC,cAAc;;IAE7C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACtE,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,gBAAgB,IAAI,uBAAuB,YAAY,QAAQ,EAC/D,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,iBAAiB,GAAG;QACxB,gBAAgB;QAChB,uDAAuD;QACvD,mBAAmB;QACnB,gBAAgB;QAChB,qBAAqB;QACrB,aAAa;QACb,eAAe;QACf,oBAAoB;QACpB,SAAS;QACT,iBAAiB;QACjB,QAAQ;KACT,CAAC;IAEF,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,SAAiB;IAClE,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,0CAA0C,EACtD,oBAAoB,EACpB,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/compliance/export/evidence-collector.d.ts

@@ -0,0 +1,252 @@
+/**
+ * Evidence Collector
+ *
+ * Collects audit events, policy changes, access logs, and other compliance
+ * evidence for external auditor export.
+ *
+ * @packageDocumentation
+ */
+import type { ID, Timestamp } from '../../common/types.js';
+/**
+ * Evidence types that can be collected
+ */
+export declare const EVIDENCE_EVENT_TYPES: readonly ["audit", "policy_change", "access_decision", "trust_score_change", "escalation_decision", "data_retention"];
+export type EvidenceEventType = (typeof EVIDENCE_EVENT_TYPES)[number];
+/**
+ * Filter options for evidence collection
+ */
+export interface EvidenceCollectionFilter {
+    /** Tenant ID (required) */
+    tenantId: ID;
+    /** Start date for collection period */
+    startDate: Date;
+    /** End date for collection period */
+    endDate: Date;
+    /** Event types to include (defaults to all) */
+    eventTypes?: EvidenceEventType[];
+    /** Include full payloads (defaults to false for summary data) */
+    includePayloads?: boolean;
+    /** Maximum records per event type */
+    limit?: number;
+}
+/**
+ * Collected audit event
+ */
+export interface CollectedAuditEvent {
+    id: string;
+    timestamp: Timestamp;
+    eventType: string;
+    category: string;
+    severity: string;
+    actorId: string;
+    actorType: string;
+    actorName?: string;
+    action: string;
+    resourceType: string;
+    resourceId: string;
+    resourceName?: string;
+    outcome: string;
+    reason?: string;
+    tenantId: ID;
+    requestId?: string;
+    traceId?: string;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Collected policy change record
+ */
+export interface CollectedPolicyChange {
+    id: string;
+    timestamp: Timestamp;
+    policyId: string;
+    policyName: string;
+    version: string;
+    previousVersion?: string;
+    changeType: 'created' | 'updated' | 'published' | 'deprecated' | 'archived';
+    changedBy: string;
+    changedByType: string;
+    changeDescription?: string;
+    diff?: {
+        before?: Record<string, unknown>;
+        after?: Record<string, unknown>;
+    };
+}
+/**
+ * Collected access decision
+ */
+export interface CollectedAccessDecision {
+    id: string;
+    timestamp: Timestamp;
+    intentId: string;
+    entityId: string;
+    entityType: string;
+    action: string;
+    resource: string;
+    decision: 'granted' | 'denied';
+    reason?: string;
+    trustScore?: number;
+    trustLevel?: number;
+    policyEvaluated?: string[];
+    constraintsApplied?: string[];
+}
+/**
+ * Collected trust score change
+ */
+export interface CollectedTrustScoreChange {
+    id: string;
+    timestamp: Timestamp;
+    entityId: string;
+    entityType: string;
+    previousScore: number;
+    newScore: number;
+    previousLevel: number;
+    newLevel: number;
+    changeReason: string;
+    signalType?: string;
+    signalSource?: string;
+}
+/**
+ * Collected escalation decision
+ */
+export interface CollectedEscalationDecision {
+    id: string;
+    timestamp: Timestamp;
+    escalationId: string;
+    intentId: string;
+    reason: string;
+    escalatedTo: string;
+    status: 'pending' | 'approved' | 'rejected' | 'timeout';
+    resolvedBy?: string;
+    resolvedAt?: Timestamp;
+    resolutionNotes?: string;
+    timeToResolution?: number;
+}
+/**
+ * Collected data retention log
+ */
+export interface CollectedDataRetentionLog {
+    id: string;
+    timestamp: Timestamp;
+    operation: 'archive' | 'purge' | 'delete' | 'anonymize';
+    dataType: string;
+    recordCount: number;
+    retentionPolicy: string;
+    triggeredBy: 'scheduled' | 'manual' | 'gdpr_request';
+    requestId?: string;
+    success: boolean;
+    errorMessage?: string;
+}
+/**
+ * Complete evidence collection result
+ */
+export interface EvidenceCollection {
+    /** Collection metadata */
+    metadata: {
+        collectionId: string;
+        tenantId: ID;
+        collectedAt: Timestamp;
+        periodStart: Timestamp;
+        periodEnd: Timestamp;
+        collectorVersion: string;
+        eventTypesIncluded: EvidenceEventType[];
+        includePayloads: boolean;
+    };
+    /** Collected evidence by type */
+    auditEvents: CollectedAuditEvent[];
+    policyChanges: CollectedPolicyChange[];
+    accessDecisions: CollectedAccessDecision[];
+    trustScoreChanges: CollectedTrustScoreChange[];
+    escalationDecisions: CollectedEscalationDecision[];
+    dataRetentionLogs: CollectedDataRetentionLog[];
+    /** Summary statistics */
+    summary: {
+        totalRecords: number;
+        byEventType: Record<EvidenceEventType, number>;
+        byOutcome: Record<string, number>;
+        bySeverity: Record<string, number>;
+    };
+}
+/**
+ * Collector for compliance evidence
+ *
+ * Aggregates audit events, policy changes, access decisions, and other
+ * compliance-relevant data for export to external auditors.
+ */
+export declare class EvidenceCollector {
+    private db;
+    private initialized;
+    private readonly collectorVersion;
+    constructor();
+    /**
+     * Initialize the collector
+     */
+    initialize(): Promise<void>;
+    /**
+     * Ensure collector is initialized
+     */
+    private ensureInitialized;
+    /**
+     * Collect all evidence based on filters
+     */
+    collectEvidence(filter: EvidenceCollectionFilter): Promise<EvidenceCollection>;
+    /**
+     * Collect audit events from the audit log
+     */
+    private collectAuditEvents;
+    /**
+     * Collect policy change events
+     */
+    private collectPolicyChanges;
+    /**
+     * Map policy event type to change type
+     */
+    private mapPolicyEventToChangeType;
+    /**
+     * Collect access control decisions
+     */
+    private collectAccessDecisions;
+    /**
+     * Collect trust score change events
+     */
+    private collectTrustScoreChanges;
+    /**
+     * Collect escalation decision events
+     */
+    private collectEscalationDecisions;
+    /**
+     * Map escalation event type to status
+     */
+    private mapEscalationEventToStatus;
+    /**
+     * Collect data retention enforcement logs
+     */
+    private collectDataRetentionLogs;
+    /**
+     * Map data event type to operation
+     */
+    private mapDataEventToOperation;
+    /**
+     * Calculate summary statistics for the collection
+     */
+    private calculateSummary;
+    /**
+     * Get event counts by category for a time period
+     */
+    getEventCounts(tenantId: ID, startDate: Date, endDate: Date): Promise<Record<string, number>>;
+    /**
+     * Get event counts by time period (hourly, daily, weekly)
+     */
+    getEventCountsByPeriod(tenantId: ID, startDate: Date, endDate: Date, period: 'hour' | 'day' | 'week'): Promise<Array<{
+        period: string;
+        count: number;
+    }>>;
+}
+/**
+ * Get the singleton evidence collector instance
+ */
+export declare function getEvidenceCollector(): EvidenceCollector;
+/**
+ * Reset the singleton (for testing)
+ */
+export declare function resetEvidenceCollector(): void;
+//# sourceMappingURL=evidence-collector.d.ts.map

package/dist/compliance/export/evidence-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-collector.d.ts","sourceRoot":"","sources":["../../../src/compliance/export/evidence-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAc3D;;GAEG;AACH,eAAO,MAAM,oBAAoB,uHAOvB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,2BAA2B;IAC3B,QAAQ,EAAE,EAAE,CAAC;IACb,uCAAuC;IACvC,SAAS,EAAE,IAAI,CAAC;IAChB,qCAAqC;IACrC,OAAO,EAAE,IAAI,CAAC;IACd,+CAA+C;IAC/C,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,iEAAiE;IACjE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,EAAE,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,CAAC;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,WAAW,GAAG,QAAQ,GAAG,cAAc,CAAC;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,QAAQ,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,EAAE,CAAC;QACb,WAAW,EAAE,SAAS,CAAC;QACvB,WAAW,EAAE,SAAS,CAAC;QACvB,SAAS,EAAE,SAAS,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;QACxC,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF,iCAAiC;IACjC,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,aAAa,EAAE,qBAAqB,EAAE,CAAC;IACvC,eAAe,EAAE,uBAAuB,EAAE,CAAC;IAC3C,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;IAC/C,mBAAmB,EAAE,2BAA2B,EAAE,CAAC;IACnD,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;IAE/C,yBAAyB;IACzB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,CAAC;CACH;AAMD;;;;;GAKG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;;IAI5C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IASjC;;OAEG;YACW,iBAAiB;IAO/B;;OAEG;IACG,eAAe,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4FpF;;OAEG;YACW,kBAAkB;IAyChC;;OAEG;YACW,oBAAoB;IAsDlC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAmBlC;;OAEG;YACW,sBAAsB;IA4CpC;;OAEG;YACW,wBAAwB;IAyCtC;;OAEG;YACW,0BAA0B;IAkDxC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAmBlC;;OAEG;YACW,wBAAwB;IA6CtC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAW/B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IA2DxB;;OAEG;IACG,cAAc,CAClB,QAAQ,EAAE,EAAE,EACZ,SAAS,EAAE,IAAI,EACf,OAAO,EAAE,IAAI,GACZ,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAqBlC;;OAEG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,EAAE,EACZ,SAAS,EAAE,IAAI,EACf,OAAO,EAAE,IAAI,EACb,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAC9B,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CA+BrD;AAQD;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,CAKxD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}