@vorionsys/security 1.0.0

package/dist/compliance/export/hash-verifier.d.ts

@@ -0,0 +1,181 @@
+/**
+ * Hash Verifier
+ *
+ * Provides tamper-evident hashing capabilities for compliance evidence exports.
+ * Includes SHA-256 hashing, Merkle tree generation, and digital signatures.
+ *
+ * @packageDocumentation
+ */
+import type { EvidenceCollection } from './evidence-collector.js';
+/**
+ * Hash entry for a single evidence item
+ */
+export interface EvidenceHash {
+    /** Unique identifier for the evidence item */
+    id: string;
+    /** Type of evidence */
+    type: string;
+    /** SHA-256 hash of the evidence content */
+    hash: string;
+    /** Timestamp when hash was computed */
+    computedAt: string;
+}
+/**
+ * Merkle tree proof for evidence verification
+ */
+export interface EvidenceMerkleProof {
+    /** Merkle root hash */
+    root: string;
+    /** Total number of evidence items (leaves) */
+    leafCount: number;
+    /** Tree depth */
+    treeDepth: number;
+    /** Algorithm used */
+    algorithm: 'sha256';
+    /** Timestamp when tree was built */
+    builtAt: string;
+}
+/**
+ * Digital signature for evidence package
+ */
+export interface EvidenceSignature {
+    /** Signature algorithm */
+    algorithm: 'RSASSA-PKCS1-v1_5' | 'ECDSA' | 'HMAC-SHA256';
+    /** Base64-encoded signature */
+    signature: string;
+    /** Key identifier used for signing */
+    keyId: string;
+    /** Timestamp when signed */
+    signedAt: string;
+    /** Hash of the signed content */
+    contentHash: string;
+}
+/**
+ * Complete tamper-evident package
+ */
+export interface TamperEvidentPackage {
+    /** Package version */
+    version: string;
+    /** Package identifier */
+    packageId: string;
+    /** Created timestamp */
+    createdAt: string;
+    /** Individual evidence hashes */
+    evidenceHashes: EvidenceHash[];
+    /** Merkle tree proof */
+    merkleProof: EvidenceMerkleProof;
+    /** Digital signature (if signing key available) */
+    signature?: EvidenceSignature;
+    /** Verification instructions */
+    verificationInstructions: VerificationInstructions;
+}
+/**
+ * Instructions for verifying the evidence package
+ */
+export interface VerificationInstructions {
+    /** Steps for manual verification */
+    steps: string[];
+    /** Algorithm details */
+    algorithms: {
+        hash: string;
+        merkle: string;
+        signature?: string;
+    };
+    /** Sample code for verification */
+    sampleCode: {
+        language: string;
+        code: string;
+    };
+    /** Contact for verification assistance */
+    verificationContact?: string;
+}
+/**
+ * Configuration for the hash verifier
+ */
+export interface HashVerifierConfig {
+    /** Signing key (optional, for digital signatures) */
+    signingKey?: CryptoKey;
+    /** Signing key ID */
+    signingKeyId?: string;
+    /** Signing algorithm */
+    signatureAlgorithm?: 'RSASSA-PKCS1-v1_5' | 'ECDSA' | 'HMAC-SHA256';
+    /** Verification contact email */
+    verificationContact?: string;
+}
+/**
+ * Hash Verifier for creating tamper-evident evidence packages
+ */
+export declare class HashVerifier {
+    private readonly version;
+    private config;
+    constructor(config?: HashVerifierConfig);
+    /**
+     * Create a tamper-evident package for an evidence collection
+     */
+    createTamperEvidentPackage(collection: EvidenceCollection): Promise<TamperEvidentPackage>;
+    /**
+     * Compute SHA-256 hashes for all evidence items
+     */
+    private computeEvidenceHashes;
+    /**
+     * Build Merkle tree from evidence hashes
+     */
+    private buildMerkleProof;
+    /**
+     * Sign the package using the configured key
+     */
+    private signPackage;
+    /**
+     * Generate verification instructions
+     */
+    private generateVerificationInstructions;
+    /**
+     * Verify a tamper-evident package
+     */
+    verifyPackage(evidence: EvidenceCollection, pkg: TamperEvidentPackage): Promise<{
+        valid: boolean;
+        errors: string[];
+        details: {
+            hashesVerified: number;
+            hashMismatches: string[];
+            merkleRootValid: boolean;
+            signatureValid?: boolean;
+        };
+    }>;
+    /**
+     * Verify a digital signature
+     */
+    private verifySignature;
+    /**
+     * Compute SHA-256 hash of arbitrary data
+     */
+    computeHash(data: string | object): Promise<string>;
+    /**
+     * Generate a simple hash verification report
+     */
+    generateHashReport(collection: EvidenceCollection): Promise<{
+        collectionId: string;
+        totalItems: number;
+        hashAlgorithm: string;
+        hashes: Array<{
+            id: string;
+            type: string;
+            hash: string;
+        }>;
+        combinedHash: string;
+        generatedAt: string;
+    }>;
+}
+/**
+ * Get the singleton hash verifier instance
+ */
+export declare function getHashVerifier(config?: HashVerifierConfig): HashVerifier;
+/**
+ * Reset the singleton (for testing)
+ */
+export declare function resetHashVerifier(): void;
+/**
+ * Create a new HashVerifier instance with custom config
+ */
+export declare function createHashVerifier(config?: HashVerifierConfig): HashVerifier;
+//# sourceMappingURL=hash-verifier.d.ts.map

package/dist/compliance/export/hash-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-verifier.d.ts","sourceRoot":"","sources":["../../../src/compliance/export/hash-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAQlE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,SAAS,EAAE,QAAQ,CAAC;IACpB,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0BAA0B;IAC1B,SAAS,EAAE,mBAAmB,GAAG,OAAO,GAAG,aAAa,CAAC;IACzD,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAC;IAElB,iCAAiC;IACjC,cAAc,EAAE,YAAY,EAAE,CAAC;IAE/B,wBAAwB;IACxB,WAAW,EAAE,mBAAmB,CAAC;IAEjC,mDAAmD;IACnD,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAE9B,gCAAgC;IAChC,wBAAwB,EAAE,wBAAwB,CAAC;CACpD;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wBAAwB;IACxB,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,mCAAmC;IACnC,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,0CAA0C;IAC1C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,qBAAqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,kBAAkB,CAAC,EAAE,mBAAmB,GAAG,OAAO,GAAG,aAAa,CAAC;IACnE,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,GAAE,kBAAuB;IAK3C;;OAEG;IACG,0BAA0B,CAC9B,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAAC,oBAAoB,CAAC;IAwDhC;;OAEG;YACW,qBAAqB;IA6FnC;;OAEG;YACW,gBAAgB;IA8B9B;;OAEG;YACW,WAAW;IAqDzB;;OAEG;IACH,OAAO,CAAC,gCAAgC;IA6ExC;;OAEG;IACG,aAAa,CACjB,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE;YACP,cAAc,EAAE,MAAM,CAAC;YACvB,cAAc,EAAE,MAAM,EAAE,CAAC;YACzB,eAAe,EAAE,OAAO,CAAC;YACzB,cAAc,CAAC,EAAE,OAAO,CAAC;SAC1B,CAAC;KACH,CAAC;IA0EF;;OAEG;YACW,eAAe;IA4C7B;;OAEG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKzD;;OAEG;IACG,kBAAkB,CACtB,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAAC;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC1D,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CAgBH;AAQD;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAKzE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAE5E"}

package/dist/compliance/export/hash-verifier.js

@@ -0,0 +1,425 @@
+/**
+ * Hash Verifier
+ *
+ * Provides tamper-evident hashing capabilities for compliance evidence exports.
+ * Includes SHA-256 hashing, Merkle tree generation, and digital signatures.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../../common/logger.js';
+import { buildMerkleTree, sha256, } from '../../proof/merkle.js';
+const logger = createLogger({ component: 'hash-verifier' });
+// =============================================================================
+// HASH VERIFIER
+// =============================================================================
+/**
+ * Hash Verifier for creating tamper-evident evidence packages
+ */
+export class HashVerifier {
+    version = '1.0.0';
+    config;
+    constructor(config = {}) {
+        this.config = config;
+        logger.info('Hash verifier initialized');
+    }
+    /**
+     * Create a tamper-evident package for an evidence collection
+     */
+    async createTamperEvidentPackage(collection) {
+        const packageId = crypto.randomUUID();
+        const createdAt = new Date().toISOString();
+        logger.info({
+            packageId,
+            collectionId: collection.metadata.collectionId,
+            totalRecords: collection.summary.totalRecords,
+        }, 'Creating tamper-evident package');
+        const startTime = Date.now();
+        // Compute individual evidence hashes
+        const evidenceHashes = await this.computeEvidenceHashes(collection);
+        // Build Merkle tree from hashes
+        const merkleProof = await this.buildMerkleProof(evidenceHashes);
+        // Create digital signature if key is available
+        let signature;
+        if (this.config.signingKey) {
+            signature = await this.signPackage(merkleProof.root, createdAt);
+        }
+        // Generate verification instructions
+        const verificationInstructions = this.generateVerificationInstructions(signature !== undefined);
+        const duration = Date.now() - startTime;
+        logger.info({
+            packageId,
+            hashCount: evidenceHashes.length,
+            merkleRoot: merkleProof.root.slice(0, 16) + '...',
+            signed: signature !== undefined,
+            durationMs: duration,
+        }, 'Tamper-evident package created');
+        return {
+            version: this.version,
+            packageId,
+            createdAt,
+            evidenceHashes,
+            merkleProof,
+            signature,
+            verificationInstructions,
+        };
+    }
+    /**
+     * Compute SHA-256 hashes for all evidence items
+     */
+    async computeEvidenceHashes(collection) {
+        const hashes = [];
+        const computedAt = new Date().toISOString();
+        // Hash audit events
+        for (const event of collection.auditEvents) {
+            const hash = await sha256(JSON.stringify(event));
+            hashes.push({
+                id: event.id,
+                type: 'audit_event',
+                hash,
+                computedAt,
+            });
+        }
+        // Hash policy changes
+        for (const change of collection.policyChanges) {
+            const hash = await sha256(JSON.stringify(change));
+            hashes.push({
+                id: change.id,
+                type: 'policy_change',
+                hash,
+                computedAt,
+            });
+        }
+        // Hash access decisions
+        for (const decision of collection.accessDecisions) {
+            const hash = await sha256(JSON.stringify(decision));
+            hashes.push({
+                id: decision.id,
+                type: 'access_decision',
+                hash,
+                computedAt,
+            });
+        }
+        // Hash trust score changes
+        for (const change of collection.trustScoreChanges) {
+            const hash = await sha256(JSON.stringify(change));
+            hashes.push({
+                id: change.id,
+                type: 'trust_score_change',
+                hash,
+                computedAt,
+            });
+        }
+        // Hash escalation decisions
+        for (const decision of collection.escalationDecisions) {
+            const hash = await sha256(JSON.stringify(decision));
+            hashes.push({
+                id: decision.id,
+                type: 'escalation_decision',
+                hash,
+                computedAt,
+            });
+        }
+        // Hash data retention logs
+        for (const log of collection.dataRetentionLogs) {
+            const hash = await sha256(JSON.stringify(log));
+            hashes.push({
+                id: log.id,
+                type: 'data_retention_log',
+                hash,
+                computedAt,
+            });
+        }
+        // Hash the collection metadata
+        const metadataHash = await sha256(JSON.stringify(collection.metadata));
+        hashes.push({
+            id: collection.metadata.collectionId,
+            type: 'collection_metadata',
+            hash: metadataHash,
+            computedAt,
+        });
+        // Hash the summary
+        const summaryHash = await sha256(JSON.stringify(collection.summary));
+        hashes.push({
+            id: `${collection.metadata.collectionId}_summary`,
+            type: 'collection_summary',
+            hash: summaryHash,
+            computedAt,
+        });
+        return hashes;
+    }
+    /**
+     * Build Merkle tree from evidence hashes
+     */
+    async buildMerkleProof(evidenceHashes) {
+        if (evidenceHashes.length === 0) {
+            // Empty collection - use a placeholder hash
+            const emptyHash = await sha256('empty_evidence_collection');
+            return {
+                root: emptyHash,
+                leafCount: 0,
+                treeDepth: 0,
+                algorithm: 'sha256',
+                builtAt: new Date().toISOString(),
+            };
+        }
+        // Extract just the hashes for the Merkle tree
+        const hashes = evidenceHashes.map((e) => e.hash);
+        // Build the tree
+        const tree = await buildMerkleTree(hashes);
+        return {
+            root: tree.root,
+            leafCount: tree.leafCount,
+            treeDepth: tree.levels.length,
+            algorithm: 'sha256',
+            builtAt: new Date().toISOString(),
+        };
+    }
+    /**
+     * Sign the package using the configured key
+     */
+    async signPackage(merkleRoot, timestamp) {
+        if (!this.config.signingKey) {
+            throw new Error('No signing key configured');
+        }
+        // Content to sign: merkle root + timestamp
+        const contentToSign = `${merkleRoot}:${timestamp}`;
+        const contentHash = await sha256(contentToSign);
+        const encoder = new TextEncoder();
+        const data = encoder.encode(contentToSign);
+        // Determine algorithm parameters
+        const algorithm = this.config.signatureAlgorithm ?? 'RSASSA-PKCS1-v1_5';
+        let signatureAlgorithm;
+        switch (algorithm) {
+            case 'RSASSA-PKCS1-v1_5':
+                signatureAlgorithm = { name: 'RSASSA-PKCS1-v1_5' };
+                break;
+            case 'ECDSA':
+                signatureAlgorithm = { name: 'ECDSA', hash: { name: 'SHA-256' } };
+                break;
+            case 'HMAC-SHA256':
+                signatureAlgorithm = { name: 'HMAC' };
+                break;
+            default:
+                throw new Error(`Unsupported signature algorithm: ${algorithm}`);
+        }
+        // Sign the content
+        const signatureBuffer = await crypto.subtle.sign(signatureAlgorithm, this.config.signingKey, data);
+        // Convert to base64
+        const signatureArray = new Uint8Array(signatureBuffer);
+        const signatureBase64 = btoa(String.fromCharCode(...signatureArray));
+        return {
+            algorithm,
+            signature: signatureBase64,
+            keyId: this.config.signingKeyId ?? 'default',
+            signedAt: new Date().toISOString(),
+            contentHash,
+        };
+    }
+    /**
+     * Generate verification instructions
+     */
+    generateVerificationInstructions(includeSignatureVerification) {
+        const steps = [
+            '1. Parse the evidence JSON file and extract all evidence records.',
+            '2. For each evidence record, compute SHA-256 hash of the JSON-serialized content.',
+            '3. Verify that computed hashes match the hashes in the evidenceHashes array.',
+            '4. Collect all evidence hashes and build a Merkle tree using SHA-256.',
+            '5. Verify that the computed Merkle root matches the merkleProof.root value.',
+        ];
+        if (includeSignatureVerification) {
+            steps.push('6. To verify the digital signature, concatenate the Merkle root and signature timestamp with a colon.', '7. Verify the signature using the public key corresponding to the keyId.');
+        }
+        steps.push('', 'If any verification step fails, the evidence may have been tampered with.', 'Contact the verification contact for assistance.');
+        const algorithms = {
+            hash: 'SHA-256 (FIPS 180-4)',
+            merkle: 'Binary Merkle Tree with SHA-256 internal nodes',
+        };
+        if (includeSignatureVerification) {
+            algorithms.signature = this.config.signatureAlgorithm ?? 'RSASSA-PKCS1-v1_5';
+        }
+        const sampleCode = {
+            language: 'typescript',
+            code: `
+// Verification example using Web Crypto API
+async function verifyEvidence(evidence: any, evidenceHashes: any[], merkleRoot: string): Promise<boolean> {
+  // Step 1: Verify individual evidence hashes
+  for (const record of evidence) {
+    const computedHash = await sha256(JSON.stringify(record));
+    const expectedHash = evidenceHashes.find(h => h.id === record.id)?.hash;
+    if (computedHash !== expectedHash) {
+      console.error(\`Hash mismatch for record \${record.id}\`);
+      return false;
+    }
+  }
+
+  // Step 2: Build Merkle tree and verify root
+  const hashes = evidenceHashes.map(h => h.hash);
+  const tree = await buildMerkleTree(hashes);
+  if (tree.root !== merkleRoot) {
+    console.error('Merkle root mismatch');
+    return false;
+  }
+
+  return true;
+}
+
+async function sha256(data: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const buffer = await crypto.subtle.digest('SHA-256', encoder.encode(data));
+  return Array.from(new Uint8Array(buffer))
+    .map(b => b.toString(16).padStart(2, '0'))
+    .join('');
+}
+`.trim(),
+        };
+        return {
+            steps,
+            algorithms,
+            sampleCode,
+            verificationContact: this.config.verificationContact,
+        };
+    }
+    /**
+     * Verify a tamper-evident package
+     */
+    async verifyPackage(evidence, pkg) {
+        const errors = [];
+        const hashMismatches = [];
+        let hashesVerified = 0;
+        logger.info({ packageId: pkg.packageId }, 'Verifying tamper-evident package');
+        // Step 1: Verify individual evidence hashes
+        const computedHashes = await this.computeEvidenceHashes(evidence);
+        for (const computed of computedHashes) {
+            const expected = pkg.evidenceHashes.find((h) => h.id === computed.id);
+            if (!expected) {
+                errors.push(`Missing hash for evidence ${computed.id}`);
+                hashMismatches.push(computed.id);
+            }
+            else if (computed.hash !== expected.hash) {
+                errors.push(`Hash mismatch for evidence ${computed.id}`);
+                hashMismatches.push(computed.id);
+            }
+            else {
+                hashesVerified++;
+            }
+        }
+        // Step 2: Verify Merkle root
+        const computedMerkle = await this.buildMerkleProof(computedHashes);
+        const merkleRootValid = computedMerkle.root === pkg.merkleProof.root;
+        if (!merkleRootValid) {
+            errors.push(`Merkle root mismatch: expected ${pkg.merkleProof.root}, computed ${computedMerkle.root}`);
+        }
+        // Step 3: Verify signature (if present and key available)
+        let signatureValid;
+        if (pkg.signature && this.config.signingKey) {
+            try {
+                signatureValid = await this.verifySignature(pkg.signature, pkg.merkleProof.root);
+                if (!signatureValid) {
+                    errors.push('Digital signature verification failed');
+                }
+            }
+            catch (err) {
+                errors.push(`Signature verification error: ${err.message}`);
+                signatureValid = false;
+            }
+        }
+        const valid = errors.length === 0;
+        logger.info({
+            packageId: pkg.packageId,
+            valid,
+            errorCount: errors.length,
+            hashesVerified,
+        }, 'Package verification completed');
+        return {
+            valid,
+            errors,
+            details: {
+                hashesVerified,
+                hashMismatches,
+                merkleRootValid,
+                signatureValid,
+            },
+        };
+    }
+    /**
+     * Verify a digital signature
+     */
+    async verifySignature(signature, merkleRoot) {
+        if (!this.config.signingKey) {
+            throw new Error('No signing key configured for verification');
+        }
+        // Reconstruct the signed content
+        const contentToSign = `${merkleRoot}:${signature.signedAt}`;
+        const encoder = new TextEncoder();
+        const data = encoder.encode(contentToSign);
+        // Decode the signature
+        const signatureBytes = Uint8Array.from(atob(signature.signature), (c) => c.charCodeAt(0));
+        // Determine algorithm parameters
+        let signatureAlgorithm;
+        switch (signature.algorithm) {
+            case 'RSASSA-PKCS1-v1_5':
+                signatureAlgorithm = { name: 'RSASSA-PKCS1-v1_5' };
+                break;
+            case 'ECDSA':
+                signatureAlgorithm = { name: 'ECDSA', hash: { name: 'SHA-256' } };
+                break;
+            case 'HMAC-SHA256':
+                signatureAlgorithm = { name: 'HMAC' };
+                break;
+            default:
+                throw new Error(`Unsupported signature algorithm: ${signature.algorithm}`);
+        }
+        // Verify the signature
+        return crypto.subtle.verify(signatureAlgorithm, this.config.signingKey, signatureBytes, data);
+    }
+    /**
+     * Compute SHA-256 hash of arbitrary data
+     */
+    async computeHash(data) {
+        const content = typeof data === 'string' ? data : JSON.stringify(data);
+        return sha256(content);
+    }
+    /**
+     * Generate a simple hash verification report
+     */
+    async generateHashReport(collection) {
+        const hashes = await this.computeEvidenceHashes(collection);
+        // Compute combined hash of all hashes
+        const allHashes = hashes.map((h) => h.hash).join('');
+        const combinedHash = await sha256(allHashes);
+        return {
+            collectionId: collection.metadata.collectionId,
+            totalItems: hashes.length,
+            hashAlgorithm: 'SHA-256',
+            hashes: hashes.map((h) => ({ id: h.id, type: h.type, hash: h.hash })),
+            combinedHash,
+            generatedAt: new Date().toISOString(),
+        };
+    }
+}
+// =============================================================================
+// SINGLETON
+// =============================================================================
+let hashVerifierInstance = null;
+/**
+ * Get the singleton hash verifier instance
+ */
+export function getHashVerifier(config) {
+    if (!hashVerifierInstance) {
+        hashVerifierInstance = new HashVerifier(config);
+    }
+    return hashVerifierInstance;
+}
+/**
+ * Reset the singleton (for testing)
+ */
+export function resetHashVerifier() {
+    hashVerifierInstance = null;
+}
+/**
+ * Create a new HashVerifier instance with custom config
+ */
+export function createHashVerifier(config) {
+    return new HashVerifier(config);
+}
+//# sourceMappingURL=hash-verifier.js.map

package/dist/compliance/export/hash-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-verifier.js","sourceRoot":"","sources":["../../../src/compliance/export/hash-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,eAAe,EACf,MAAM,GAEP,MAAM,uBAAuB,CAAC;AAG/B,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;AA+G5D,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,YAAY;IACN,OAAO,GAAG,OAAO,CAAC;IAC3B,MAAM,CAAqB;IAEnC,YAAY,SAA6B,EAAE;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,0BAA0B,CAC9B,UAA8B;QAE9B,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,CAAC,IAAI,CACT;YACE,SAAS;YACT,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY;YAC9C,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY;SAC9C,EACD,iCAAiC,CAClC,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,qCAAqC;QACrC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAEpE,gCAAgC;QAChC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAEhE,+CAA+C;QAC/C,IAAI,SAAwC,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QAED,qCAAqC;QACrC,MAAM,wBAAwB,GAAG,IAAI,CAAC,gCAAgC,CACpE,SAAS,KAAK,SAAS,CACxB,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,MAAM,CAAC,IAAI,CACT;YACE,SAAS;YACT,SAAS,EAAE,cAAc,CAAC,MAAM;YAChC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YACjD,MAAM,EAAE,SAAS,KAAK,SAAS;YAC/B,UAAU,EAAE,QAAQ;SACrB,EACD,gCAAgC,CACjC,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;YACT,SAAS;YACT,cAAc;YACd,WAAW;YACX,SAAS;YACT,wBAAwB;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB,CACjC,UAA8B;QAE9B,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE5C,oBAAoB;QACpB,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,aAAa;gBACnB,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,sBAAsB;QACtB,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,eAAe;gBACrB,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,IAAI,EAAE,iBAAiB;gBACvB,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,oBAAoB;gBAC1B,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,IAAI,EAAE,qBAAqB;gBAC3B,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,+BAA+B;QAC/B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY;YACpC,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,YAAY;YAClB,UAAU;SACX,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,YAAY,UAAU;YACjD,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,WAAW;YACjB,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,cAA8B;QAE9B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,4CAA4C;YAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,QAAQ;gBACnB,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEjD,iBAAiB;QACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAE3C,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC7B,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CACvB,UAAkB,EAClB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,2CAA2C;QAC3C,MAAM,aAAa,GAAG,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE3C,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,mBAAmB,CAAC;QACxE,IAAI,kBAAiE,CAAC;QAEtE,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,mBAAmB;gBACtB,kBAAkB,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;gBACnD,MAAM;YACR,KAAK,OAAO;gBACV,kBAAkB,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAiB,CAAC;gBACjF,MAAM;YACR,KAAK,aAAa;gBAChB,kBAAkB,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBACtC,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,mBAAmB;QACnB,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAC9C,kBAAkB,EAClB,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CACL,CAAC;QAEF,oBAAoB;QACpB,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC;QAErE,OAAO;YACL,SAAS;YACT,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,SAAS;YAC5C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gCAAgC,CACtC,4BAAqC;QAErC,MAAM,KAAK,GAAG;YACZ,mEAAmE;YACnE,mFAAmF;YACnF,8EAA8E;YAC9E,uEAAuE;YACvE,6EAA6E;SAC9E,CAAC;QAEF,IAAI,4BAA4B,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CACR,uGAAuG,EACvG,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,2EAA2E,EAC3E,kDAAkD,CACnD,CAAC;QAEF,MAAM,UAAU,GAA2C;YACzD,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,gDAAgD;SACzD,CAAC;QAEF,IAAI,4BAA4B,EAAE,CAAC;YACjC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,mBAAmB,CAAC;QAC/E,CAAC;QAED,MAAM,UAAU,GAAG;YACjB,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BX,CAAC,IAAI,EAAE;SACH,CAAC;QAEF,OAAO;YACL,KAAK;YACL,UAAU;YACV,UAAU;YACV,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SACrD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,QAA4B,EAC5B,GAAyB;QAWzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,IAAI,cAAc,GAAG,CAAC,CAAC;QAEvB,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAC5B,kCAAkC,CACnC,CAAC;QAEF,4CAA4C;QAC5C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAElE,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,6BAA6B,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxD,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,8BAA8B,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzD,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,cAAc,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC;QAErE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CACT,kCAAkC,GAAG,CAAC,WAAW,CAAC,IAAI,cAAc,cAAc,CAAC,IAAI,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,IAAI,cAAmC,CAAC;QACxC,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACjF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvE,cAAc,GAAG,KAAK,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,MAAM,CAAC,IAAI,CACT;YACE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,cAAc;SACf,EACD,gCAAgC,CACjC,CAAC;QAEF,OAAO;YACL,KAAK;YACL,MAAM;YACN,OAAO,EAAE;gBACP,cAAc;gBACd,cAAc;gBACd,eAAe;gBACf,cAAc;aACf;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAC3B,SAA4B,EAC5B,UAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,iCAAiC;QACjC,MAAM,aAAa,GAAG,GAAG,UAAU,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE3C,uBAAuB;QACvB,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAChB,CAAC;QAEF,iCAAiC;QACjC,IAAI,kBAAiE,CAAC;QAEtE,QAAQ,SAAS,CAAC,SAAS,EAAE,CAAC;YAC5B,KAAK,mBAAmB;gBACtB,kBAAkB,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;gBACnD,MAAM;YACR,KAAK,OAAO;gBACV,kBAAkB,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAiB,CAAC;gBACjF,MAAM;YACR,KAAK,aAAa;gBAChB,kBAAkB,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBACtC,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,uBAAuB;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,kBAAkB,EAClB,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,cAAc,EACd,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,IAAqB;QACrC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,UAA8B;QAS9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAE5D,sCAAsC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO;YACL,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY;YAC9C,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,YAAY;YACZ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;CACF;AAED,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,IAAI,oBAAoB,GAAwB,IAAI,CAAC;AAErD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAA2B;IACzD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,oBAAoB,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,oBAAoB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA2B;IAC5D,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC"}

package/dist/compliance/export/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Compliance Evidence Export
+ *
+ * Provides functionality for exporting compliance evidence to external auditors.
+ * Includes evidence collection, tamper-evident hashing, and report generation.
+ *
+ * @packageDocumentation
+ */
+export { EvidenceCollector, getEvidenceCollector, resetEvidenceCollector, type EvidenceCollectionFilter, type CollectedAuditEvent, type CollectedPolicyChange, type CollectedAccessDecision, type CollectedTrustScoreChange, type CollectedEscalationDecision, type CollectedDataRetentionLog, type EvidenceCollection, type EvidenceEventType, EVIDENCE_EVENT_TYPES, } from './evidence-collector.js';
+export { HashVerifier, getHashVerifier, resetHashVerifier, createHashVerifier, type EvidenceHash, type EvidenceMerkleProof, type EvidenceSignature, type TamperEvidentPackage, type VerificationInstructions, type HashVerifierConfig, } from './hash-verifier.js';
+export { ReportGenerator, getReportGenerator, resetReportGenerator, type ExportFormat, type ReportGenerationOptions, type ReportHeader, type ExecutiveSummary, type ComplianceEvidenceReport, type ReportSection, type ExportJobStatus, type ExportJob, } from './report-generator.js';
+export { ScheduledExportManager, getScheduledExportManager, resetScheduledExportManager, type ScheduledExportConfig, type ExportSchedule, type ExportDestination, type S3Destination, type EmailDestination, type WebhookDestination, type ScheduledExportJob, type ExportDeliveryResult, } from './scheduled-exports.js';
+export { ComplianceExportService, getComplianceExportService, resetComplianceExportService, type ExportRequest, type ExportResult, type ComplianceStatusSummary, type EventSummary, } from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/compliance/export/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compliance/export/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAEL,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EAGtB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EAGtB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAEL,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAGlB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAEL,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAGpB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAEL,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAG3B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAEL,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAG5B,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC"}