@zanii/compliance 0.2.1 → 0.2.3

package/README.md

@@ -1,42 +1,44 @@
-# @zanii/compliance
-
-Turn a Zanii **audit bundle** into an auditor-ready compliance report — verified
-offline, no network, no trust in Zanii's servers. Action breakdown by control,
-on-chain anchoring coverage, and a Markdown renderer you can hand straight to an
-auditor.
-
-```sh
-npm install @zanii/compliance
-```
-
-## Usage
-
-```ts
-import { buildComplianceReport, renderComplianceMarkdown } from '@zanii/compliance';
-
-// bundle = the JSON from `zanii export <did>` (or GET /v1/export/<did>)
-const report = buildComplianceReport(bundle, {
-  controls: {
-    crm:   'AC-2 Account Management',
-    email: 'AU-2 Audit Events',
-    pay:   'SC-13 Cryptographic Protection',
-  },
-});
-
-console.log(report.verified, report.flags);   // false-verified bundles still summarize, with a flag
-console.log(renderComplianceMarkdown(report)); // → hand to the auditor
-```
-
-`buildComplianceReport` verifies the bundle with `@zanii/core` first; every figure
-is derived from the receipts, and anything an auditor should notice (failed
-verification, unanchored receipts, revoked delegations, unmapped namespaces)
-lands in `report.flags`.
-
-## Changelog
-
-- **0.2.0** — added `reconcile` (provider-vs-ledger omission catcher).
-- **0.1.0** — initial release: `buildComplianceReport`, `renderComplianceMarkdown`, `ControlMap`.
-
-## License
-
-Apache-2.0.
+# @zanii/compliance
+
+Turn a Zanii **audit bundle** into an auditor-ready compliance report — verified
+offline, no network, no trust in Zanii's servers. Action breakdown by control,
+on-chain anchoring coverage, and a Markdown renderer you can hand straight to an
+auditor.
+
+```sh
+npm install @zanii/compliance
+```
+
+## Usage
+
+```ts
+import { buildComplianceReport, renderComplianceMarkdown } from '@zanii/compliance';
+
+// bundle = the JSON from `zanii export <did>` (or GET /v1/export/<did>)
+const report = buildComplianceReport(bundle, {
+  controls: {
+    crm:   'AC-2 Account Management',
+    email: 'AU-2 Audit Events',
+    pay:   'SC-13 Cryptographic Protection',
+  },
+});
+
+console.log(report.verified, report.flags);   // false-verified bundles still summarize, with a flag
+console.log(renderComplianceMarkdown(report)); // → hand to the auditor
+```
+
+`buildComplianceReport` verifies the bundle with `@zanii/core` first; every figure
+is derived from the receipts, and anything an auditor should notice (failed
+verification, unanchored receipts, revoked delegations, unmapped namespaces)
+lands in `report.flags`.
+
+## Changelog
+
+- **0.2.3** — Framework mappings (`mapToFramework`: EU AI Act, ISO/IEC 42001, NIST AI RMF, SOC 2, DORA, NIS2, HIPAA, PCI DSS 4.0, GDPR), each control met / partial / not-evidenced with the evidence stated; `controlTimeline`, provably random `sampleSelector`, `exceptionRegister` with remediations, an AI Act Annex IV `aiActTechnicalFile` draft, `incidentReport` with deadlines, `postMarketMonitoring`, signed control-owner attestations, JSON-LD `regulatorExport` and an offline `renderAuditorPortal`.
+- **0.2.2** — now depends on `@zanii/core` 0.5 (protocol 1.2), so it shares one core with `@zanii/sdk` 0.5 instead of pulling in a second, older copy. No API change.
+- **0.2.0** — added `reconcile` (provider-vs-ledger omission catcher).
+- **0.1.0** — initial release: `buildComplianceReport`, `renderComplianceMarkdown`, `ControlMap`.
+
+## License
+
+Apache-2.0.

package/dist/frameworks.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Control-by-control evidence for the frameworks auditors ask about, computed from a
+ * verified audit bundle. "met" means the log carries evidence for the control; it is
+ * evidence for an auditor, never a certification. Controls the log cannot evidence are
+ * reported as `not-evidenced`, not as failed or passed.
+ */
+import { type AuditBundle, type SignedObject } from '@zanii/core';
+import { type Regime } from '@zanii/regulator';
+export type Framework = 'eu-ai-act' | 'iso42001' | 'nist-ai-rmf' | 'soc2' | 'dora' | 'nis2' | 'hipaa' | 'pci4' | 'gdpr';
+export type ControlStatus = 'met' | 'partial' | 'not-evidenced';
+export interface ControlResult {
+    id: string;
+    title: string;
+    status: ControlStatus;
+    evidence: string;
+}
+/** Evidence per control for one framework. */
+export declare function mapToFramework(bundle: AuditBundle, framework: Framework): {
+    framework: Framework;
+    verified: boolean;
+    controls: ControlResult[];
+};
+/** Re-evaluate the framework window by window: a control that slips shows up when it slipped. */
+export declare function controlTimeline(bundles: Array<{
+    period: string;
+    bundle: AuditBundle;
+}>, framework: Framework): {
+    period: string;
+    verified: boolean;
+    met: number;
+    total: number;
+    gaps: string[];
+}[];
+/**
+ * A provably random audit sample: commit the seed before seeing the population, then
+ * draw. The auditor can redo the draw from the seed.
+ */
+export declare function sampleSelector(bundle: AuditBundle, n: number, seed?: string): {
+    seed: string;
+    commitment: string | undefined;
+    sample: {
+        hash: string;
+        index: number;
+    }[];
+};
+/** Every exception an auditor should see, with any remediation recorded against it. */
+export declare function exceptionRegister(bundle: AuditBundle, remediations?: Array<{
+    exception: string;
+    action: string;
+    by: string;
+    ts: string;
+}>): {
+    open: number;
+    exceptions: {
+        id: string;
+        description: string;
+        remediation: (typeof remediations)[number] | null;
+    }[];
+};
+/** EU AI Act Annex IV technical documentation, drafted from what you supply plus what the log proves. */
+export declare function aiActTechnicalFile(system: {
+    name: string;
+    provider: string;
+    intendedPurpose: string;
+    version: string;
+    humanOversight: string;
+    accuracyMetrics?: Record<string, string>;
+}, bundle: AuditBundle): string;
+/** An incident report skeleton with the regime's deadlines and the receipts it concerns. */
+export declare function incidentReport(incident: {
+    id: string;
+    summary: string;
+    awareAt: string;
+    receipts: string[];
+}, regime: Regime): {
+    deadlines: import("@zanii/regulator").Deadline[];
+    evidence: string[];
+    id: string;
+    summary: string;
+    awareAt: string;
+    receipts: string[];
+    regime: Regime;
+};
+/** Trend across monitoring periods: activity, share of high-risk actions, guard decisions, failures. */
+export declare function postMarketMonitoring(periods: Array<{
+    period: string;
+    bundle: AuditBundle;
+}>): {
+    period: string;
+    verified: boolean;
+    actions: number;
+    highRiskShare: number;
+    guardDecisions: number;
+    incidents: number;
+}[];
+export type ControlAttestation = SignedObject<{
+    v: 1;
+    type: 'compliance.attestation';
+    control: string;
+    period: string;
+    statement: string;
+    ts: string;
+}>;
+/** A control owner's signed quarterly attestation. */
+export declare function attestControl(input: {
+    control: string;
+    period: string;
+    statement: string;
+    ts?: string;
+}, ownerPrivateKey: Uint8Array): ControlAttestation;
+export declare function verifyControlAttestation(a: ControlAttestation, ownerDid?: string): boolean;
+/** A framework mapping as JSON-LD for machine submission. */
+export declare function regulatorExport(mapping: ReturnType<typeof mapToFramework>, agent: string): {
+    '@context': {
+        '@vocab': string;
+        schema: string;
+    };
+    '@type': string;
+    agent: string;
+    framework: Framework;
+    verified: boolean;
+    controls: {
+        '@type': string;
+        identifier: string;
+        name: string;
+        status: ControlStatus;
+        evidence: string;
+    }[];
+};
+/**
+ * A single offline HTML file for an auditor: the framework mapping plus the full bundle
+ * embedded, so they can re-verify it with any Zanii verifier (or the /verify-bundle page).
+ */
+export declare function renderAuditorPortal(bundle: AuditBundle, frameworks: Framework[]): string;
+//# sourceMappingURL=frameworks.d.ts.map

package/dist/frameworks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frameworks.d.ts","sourceRoot":"","sources":["../src/frameworks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA8D,KAAK,WAAW,EAAqB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACjJ,OAAO,EAAyC,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEtF,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AACxH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,SAAS,GAAG,eAAe,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAmFD,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,GAAG;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,CAGhJ;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,EAAE,SAAS,EAAE,SAAS;;;;;;IAK5G;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;;;;;EAG3E;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,GAAE,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAM;;;YAE9G,MAAM;qBAAe,MAAM;qBAAe,CAAC,OAAO,YAAY,EAAE,MAAM,CAAC,GAAG,IAAI;;EAM7G;AAED,yGAAyG;AACzG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAoBtN;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,MAAM;;;QAA9E,MAAM;aAAW,MAAM;aAAW,MAAM;cAAY,MAAM,EAAE;;EAE1G;AAED,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;;;;;;;IAK3F;AAED,MAAM,MAAM,kBAAkB,GAAG,YAAY,CAAC;IAAE,CAAC,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAExJ,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,eAAe,EAAE,UAAU,GAAG,kBAAkB,CAEzJ;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAE1F;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;EAOxF;AAID;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAUxF"}

package/dist/frameworks.js

@@ -0,0 +1,169 @@
+/**
+ * Control-by-control evidence for the frameworks auditors ask about, computed from a
+ * verified audit bundle. "met" means the log carries evidence for the control; it is
+ * evidence for an auditor, never a certification. Controls the log cannot evidence are
+ * reported as `not-evidenced`, not as failed or passed.
+ */
+import { jcsHash, signObject, verifyAuditBundle, verifySignedObject } from '@zanii/core';
+import { commitSeed, drawSample, incidentClock } from '@zanii/regulator';
+const targetOf = (r) => r.target ?? r.body?.target ?? '';
+function facts(bundle) {
+    const report = verifyAuditBundle(bundle);
+    const targets = bundle.receipts.map((b) => targetOf(b.receipt));
+    const s = report.stats;
+    const days = s.first_ts && s.last_ts ? (Date.parse(s.last_ts) - Date.parse(s.first_ts)) / 86_400_000 : 0;
+    return {
+        report, verified: report.ok,
+        chainOk: !!report.checks.find((c) => /chain/i.test(c.label))?.ok,
+        anchoredAll: s.anchored_through !== null && s.anchored_through >= Math.max(...bundle.receipts.map((r) => r.index), 0),
+        receipts: targets.length, days, targets,
+        oversight: targets.filter((t) => /confirm|approv|takeover|handback|review/i.test(t)).length,
+        guard: targets.filter((t) => t.startsWith('zanii.guard.')).length,
+        incidents: targets.filter((t) => /incident|estop|break-glass/i.test(t)).length,
+        revocations: s.revoked_certs,
+        highRisk: bundle.receipts.filter((b) => ['high', 'critical'].includes(b.receipt.risk)).length,
+    };
+}
+const c = (id, title, status, evidence) => ({ id, title, status, evidence });
+const logs = (f) => f.verified && f.chainOk ? (f.anchoredAll ? 'met' : 'partial') : 'not-evidenced';
+const logsText = (f) => `${f.receipts} signed, hash-chained records; offline verification ${f.verified ? 'passed' : 'FAILED'}; ${f.anchoredAll ? 'all anchored on-chain' : 'not all anchored yet'}`;
+const oversight = (f) => (f.oversight > 0 ? 'met' : f.highRisk === 0 ? 'partial' : 'not-evidenced');
+const oversightText = (f) => `${f.oversight} human confirmation / review records for ${f.highRisk} high-risk actions`;
+const FRAMEWORKS = {
+    'eu-ai-act': (f) => [
+        c('Art. 12', 'Record-keeping: automatic logging over the lifetime of the system', logs(f), logsText(f)),
+        c('Art. 14', 'Human oversight', oversight(f), oversightText(f)),
+        c('Art. 19 / 26(6)', 'Keep automatically generated logs for at least six months', f.days >= 182 ? 'met' : 'partial', `records span ${Math.round(f.days)} days`),
+        c('Art. 72', 'Post-market monitoring', f.guard > 0 ? 'met' : 'partial', `${f.guard} runtime security decisions recorded`),
+        c('Art. 73', 'Reporting of serious incidents', f.incidents > 0 ? 'partial' : 'not-evidenced', `${f.incidents} incident-type records; reporting itself happens outside the log`),
+    ],
+    iso42001: (f) => [
+        c('Clause 8.1', 'Operational planning and control', f.revocations >= 0 && f.verified ? 'met' : 'not-evidenced', 'every action carries the owner-signed delegation it ran under'),
+        c('Clause 9.1', 'Monitoring, measurement, analysis and evaluation', logs(f), logsText(f)),
+        c('Clause 10.2', 'Nonconformity and corrective action', f.incidents > 0 ? 'partial' : 'not-evidenced', `${f.incidents} incident records`),
+    ],
+    'nist-ai-rmf': (f) => [
+        c('GOVERN', 'Accountability structures are in place', f.verified ? 'met' : 'not-evidenced', 'actions are attributable to agents and owners through signed delegations'),
+        c('MEASURE', 'AI risks are tracked', f.highRisk > 0 || f.guard > 0 ? 'met' : 'partial', `${f.highRisk} risk-labelled high/critical actions, ${f.guard} guard decisions`),
+        c('MANAGE', 'Risks are responded to', f.revocations > 0 || f.incidents > 0 ? 'met' : 'partial', `${f.revocations} revocations, ${f.incidents} incident records`),
+    ],
+    soc2: (f) => [
+        c('CC6.1', 'Logical access controls', f.verified ? 'met' : 'not-evidenced', 'scoped, expiring delegations; revocation recorded'),
+        c('CC7.2', 'Monitoring of system components for anomalies', f.guard > 0 ? 'met' : 'partial', `${f.guard} guard decisions; complete activity log`),
+        c('CC8.1', 'Change management', f.targets.some((t) => t.includes('evolution') || t.includes('succession')) ? 'met' : 'not-evidenced', 'agent changes and key rotations as signed records'),
+    ],
+    dora: (f) => [
+        c('Art. 17', 'ICT-related incident management process', f.incidents > 0 ? 'partial' : 'not-evidenced', `${f.incidents} incident records`),
+        c('Art. 19', 'Reporting of major ICT-related incidents', 'not-evidenced', 'use @zanii/regulator incidentClock for the deadlines; filings happen outside the log'),
+        c('Art. 28', 'ICT third-party risk', f.targets.some((t) => t.startsWith('subprocessor') || t.startsWith('broker.')) ? 'partial' : 'not-evidenced', 'third-party calls through the broker / subprocessor records'),
+    ],
+    nis2: (f) => [
+        c('Art. 21', 'Cybersecurity risk-management measures', f.guard > 0 || f.revocations > 0 ? 'partial' : 'not-evidenced', `${f.guard} guard decisions, ${f.revocations} revocations`),
+        c('Art. 23', 'Reporting obligations', f.incidents > 0 ? 'partial' : 'not-evidenced', 'incident records; use incidentReport for the 24h / 72h / one-month clock'),
+    ],
+    hipaa: (f) => [c('164.312(b)', 'Audit controls: record and examine activity', logs(f), logsText(f))],
+    pci4: (f) => [c('Req. 10', 'Log and monitor all access to system components and data', logs(f), logsText(f))],
+    gdpr: (f) => [
+        c('Art. 5(2)', 'Accountability', f.verified ? 'met' : 'not-evidenced', 'processing actions are signed and attributable'),
+        c('Art. 30', 'Records of processing activities', f.receipts > 0 ? 'partial' : 'not-evidenced', 'activity records exist; the Art. 30 register itself is a separate document'),
+    ],
+};
+/** Evidence per control for one framework. */
+export function mapToFramework(bundle, framework) {
+    const f = facts(bundle);
+    return { framework, verified: f.verified, controls: FRAMEWORKS[framework](f) };
+}
+/** Re-evaluate the framework window by window: a control that slips shows up when it slipped. */
+export function controlTimeline(bundles, framework) {
+    return bundles.map(({ period, bundle }) => {
+        const m = mapToFramework(bundle, framework);
+        return { period, verified: m.verified, met: m.controls.filter((x) => x.status === 'met').length, total: m.controls.length, gaps: m.controls.filter((x) => x.status !== 'met').map((x) => x.id) };
+    });
+}
+/**
+ * A provably random audit sample: commit the seed before seeing the population, then
+ * draw. The auditor can redo the draw from the seed.
+ */
+export function sampleSelector(bundle, n, seed) {
+    const s = seed ? { seed, commitment: undefined } : commitSeed();
+    return { seed: s.seed, commitment: s.commitment, sample: drawSample(bundle.receipts.map((r) => ({ hash: r.hash, index: r.index })), n, s.seed) };
+}
+/** Every exception an auditor should see, with any remediation recorded against it. */
+export function exceptionRegister(bundle, remediations = []) {
+    const f = facts(bundle);
+    const exceptions = [];
+    f.report.checks.filter((x) => !x.ok).forEach((x) => exceptions.push({ id: jcsHash({ check: x.label }), description: `verification check failed: ${x.label}`, remediation: null }));
+    if (!f.anchoredAll)
+        exceptions.push({ id: jcsHash({ e: 'anchoring', agent: bundle.agent_id }), description: 'not all records are anchored on-chain', remediation: null });
+    if (f.highRisk > 0 && f.oversight === 0)
+        exceptions.push({ id: jcsHash({ e: 'oversight', agent: bundle.agent_id }), description: `${f.highRisk} high-risk actions with no human confirmation on record`, remediation: null });
+    for (const e of exceptions)
+        e.remediation = remediations.find((r) => r.exception === e.id) ?? null;
+    return { open: exceptions.filter((e) => !e.remediation).length, exceptions };
+}
+/** EU AI Act Annex IV technical documentation, drafted from what you supply plus what the log proves. */
+export function aiActTechnicalFile(system, bundle) {
+    const m = mapToFramework(bundle, 'eu-ai-act');
+    const metrics = Object.entries(system.accuracyMetrics ?? {}).map(([k, v]) => `- ${k}: ${v}`).join('\n') || '- (to be supplied by the provider)';
+    return `# Technical documentation: ${system.name} ${system.version}
+
+## 1. General description
+- Provider: ${system.provider}
+- Intended purpose: ${system.intendedPurpose}
+
+## 2. Human oversight measures
+${system.humanOversight}
+
+## 3. Performance
+${metrics}
+
+## 4. Record-keeping and monitoring (from the transparency log)
+${m.controls.map((x) => `- **${x.id}** ${x.title}: ${x.status}. ${x.evidence}`).join('\n')}
+
+Log evidence for agent \`${bundle.agent_id}\`, verified offline: ${m.verified ? 'yes' : 'NO'}.
+`;
+}
+/** An incident report skeleton with the regime's deadlines and the receipts it concerns. */
+export function incidentReport(incident, regime) {
+    return { regime, ...incident, deadlines: incidentClock(regime, incident.awareAt), evidence: incident.receipts };
+}
+/** Trend across monitoring periods: activity, share of high-risk actions, guard decisions, failures. */
+export function postMarketMonitoring(periods) {
+    return periods.map(({ period, bundle }) => {
+        const f = facts(bundle);
+        return { period, verified: f.verified, actions: f.receipts, highRiskShare: f.receipts ? f.highRisk / f.receipts : 0, guardDecisions: f.guard, incidents: f.incidents };
+    });
+}
+/** A control owner's signed quarterly attestation. */
+export function attestControl(input, ownerPrivateKey) {
+    return signObject({ v: 1, type: 'compliance.attestation', ...input, ts: input.ts ?? new Date().toISOString() }, ownerPrivateKey);
+}
+export function verifyControlAttestation(a, ownerDid) {
+    return verifySignedObject(a) && a.type === 'compliance.attestation' && (!ownerDid || a.signer === ownerDid);
+}
+/** A framework mapping as JSON-LD for machine submission. */
+export function regulatorExport(mapping, agent) {
+    return {
+        '@context': { '@vocab': 'https://ledger.zanii.agency/vocab#', schema: 'https://schema.org/' },
+        '@type': 'ComplianceEvidence',
+        agent, framework: mapping.framework, verified: mapping.verified,
+        controls: mapping.controls.map((x) => ({ '@type': 'Control', identifier: x.id, name: x.title, status: x.status, evidence: x.evidence })),
+    };
+}
+const esc = (s) => s.replace(/[&<>"]/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[ch]);
+/**
+ * A single offline HTML file for an auditor: the framework mapping plus the full bundle
+ * embedded, so they can re-verify it with any Zanii verifier (or the /verify-bundle page).
+ */
+export function renderAuditorPortal(bundle, frameworks) {
+    const sections = frameworks.map((fw) => {
+        const m = mapToFramework(bundle, fw);
+        return `<h2>${esc(fw)}</h2><table><tr><th>Control</th><th>Status</th><th>Evidence</th></tr>${m.controls.map((x) => `<tr><td>${esc(x.id)} ${esc(x.title)}</td><td>${x.status}</td><td>${esc(x.evidence)}</td></tr>`).join('')}</table>`;
+    }).join('');
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Audit evidence</title><style>body{font:14px/1.5 system-ui,sans-serif;max-width:960px;margin:2rem auto;padding:0 1rem}table{border-collapse:collapse;width:100%}td,th{border:1px solid #ccc;padding:4px 8px;text-align:left;vertical-align:top}</style></head><body>
+<h1>Audit evidence for <code>${esc(bundle.agent_id)}</code></h1>
+<p>Bundle hash <code>${esc(jcsHash(bundle))}</code>. Re-verify the embedded bundle with <code>zanii offline-verify</code> or the offline page at /verify-bundle.</p>
+${sections}
+<script type="application/json" id="bundle">${JSON.stringify(bundle).replace(/</g, '\\u003c')}</script></body></html>`;
+}
+//# sourceMappingURL=frameworks.js.map

package/dist/frameworks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frameworks.js","sourceRoot":"","sources":["../src/frameworks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAA0D,MAAM,aAAa,CAAC;AACjJ,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAe,MAAM,kBAAkB,CAAC;AA2BtF,MAAM,QAAQ,GAAG,CAAC,CAAM,EAAU,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;AAEtE,SAAS,KAAK,CAAC,MAAmB;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO;QACL,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE;QAChE,WAAW,EAAE,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrH,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO;QACvC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QAC3F,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM;QACjE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QAC9E,WAAW,EAAE,CAAC,CAAC,aAAa;QAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAE,CAAC,CAAC,OAAe,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;KACvG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,MAAqB,EAAE,QAAgB,EAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnI,MAAM,IAAI,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC3G,MAAM,QAAQ,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,uDAAuD,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;AAC3M,MAAM,SAAS,GAAG,CAAC,CAAQ,EAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AAC1H,MAAM,aAAa,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,4CAA4C,CAAC,CAAC,QAAQ,oBAAoB,CAAC;AAE7H,MAAM,UAAU,GAAqD;IACnE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAClB,CAAC,CAAC,SAAS,EAAE,mEAAmE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,iBAAiB,EAAE,2DAA2D,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,gBAAgB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/J,CAAC,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,sCAAsC,CAAC;QACzH,CAAC,CAAC,SAAS,EAAE,gCAAgC,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,SAAS,kEAAkE,CAAC;KAChL;IACD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACf,CAAC,CAAC,YAAY,EAAE,kCAAkC,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,+DAA+D,CAAC;QAChL,CAAC,CAAC,YAAY,EAAE,kDAAkD,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,aAAa,EAAE,qCAAqC,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,SAAS,mBAAmB,CAAC;KAC1I;IACD,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACpB,CAAC,CAAC,QAAQ,EAAE,wCAAwC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,0EAA0E,CAAC;QACvK,CAAC,CAAC,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,QAAQ,yCAAyC,CAAC,CAAC,KAAK,kBAAkB,CAAC;QACxK,CAAC,CAAC,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,SAAS,mBAAmB,CAAC;KACjK;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACX,CAAC,CAAC,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,mDAAmD,CAAC;QAChI,CAAC,CAAC,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,yCAAyC,CAAC;QACjJ,CAAC,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,mDAAmD,CAAC;KAC3L;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACX,CAAC,CAAC,SAAS,EAAE,yCAAyC,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,SAAS,mBAAmB,CAAC;QACzI,CAAC,CAAC,SAAS,EAAE,0CAA0C,EAAE,eAAe,EAAE,sFAAsF,CAAC;QACjK,CAAC,CAAC,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,6DAA6D,CAAC;KAClN;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACX,CAAC,CAAC,SAAS,EAAE,wCAAwC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,WAAW,cAAc,CAAC;QAClL,CAAC,CAAC,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,0EAA0E,CAAC;KACjK;IACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,6CAA6C,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,0DAA0D,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7G,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACX,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,gDAAgD,CAAC;QACxH,CAAC,CAAC,SAAS,EAAE,kCAAkC,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,4EAA4E,CAAC;KAC7K;CACF,CAAC;AAEF,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,MAAmB,EAAE,SAAoB;IACtE,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAAuD,EAAE,SAAoB;IAC3G,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnM,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmB,EAAE,CAAS,EAAE,IAAa;IAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACnJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,MAAmB,EAAE,eAAqF,EAAE;IAC5I,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,UAAU,GAAkG,EAAE,CAAC;IACrH,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,8BAA8B,CAAC,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnL,IAAI,CAAC,CAAC,CAAC,WAAW;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,uCAAuC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1K,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,QAAQ,yDAAyD,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9N,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,CAAC,CAAC,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACnG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;AAC/E,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,kBAAkB,CAAC,MAAsJ,EAAE,MAAmB;IAC5M,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oCAAoC,CAAC;IAChJ,OAAO,8BAA8B,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO;;;cAGtD,MAAM,CAAC,QAAQ;sBACP,MAAM,CAAC,eAAe;;;EAG1C,MAAM,CAAC,cAAc;;;EAGrB,OAAO;;;EAGP,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;2BAE/D,MAAM,CAAC,QAAQ,yBAAyB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;CAC3F,CAAC;AACF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,QAA8E,EAAE,MAAc;IAC3H,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAClH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,OAAuD;IAC1F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IACzK,CAAC,CAAC,CAAC;AACL,CAAC;AAID,sDAAsD;AACtD,MAAM,UAAU,aAAa,CAAC,KAA0E,EAAE,eAA2B;IACnI,OAAO,UAAU,CAAC,EAAE,CAAC,EAAE,CAAU,EAAE,IAAI,EAAE,wBAAiC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;AACrJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAqB,EAAE,QAAiB;IAC/E,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,wBAAwB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAC9G,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,OAA0C,EAAE,KAAa;IACvF,OAAO;QACL,UAAU,EAAE,EAAE,QAAQ,EAAE,oCAAoC,EAAE,MAAM,EAAE,qBAAqB,EAAE;QAC7F,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC/D,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;KACzI,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;AAE1H;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB,EAAE,UAAuB;IAC9E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,OAAO,GAAG,CAAC,EAAE,CAAC,wEAAwE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC;IACzO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;+BACsB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;uBAC5B,GAAG,CAAC,OAAO,CAAC,MAAe,CAAC,CAAC;EAClD,QAAQ;8CACoC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,yBAAyB,CAAC;AACvH,CAAC"}

package/dist/index.d.ts

@@ -65,4 +65,5 @@ export interface ReconcileReport {
 }
 /** Reconcile provider settlement references against the ledger's. */
 export declare function reconcile(ledgerRefs: Iterable<string>, providerRefs: Iterable<string>): ReconcileReport;
+export * from './frameworks.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAErF,mFAAmF;AACnF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,2DAA2D;IAC3D,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9D,sEAAsE;IACtE,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACzD,gBAAgB,CAyClB;AAED,iDAAiD;AACjD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAwBpE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,eAAe,CASvG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAErF,mFAAmF;AACnF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,2DAA2D;IAC3D,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9D,sEAAsE;IACtE,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACzD,gBAAgB,CAyClB;AAED,iDAAiD;AACjD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAwBpE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,eAAe,CASvG;AACD,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -94,4 +94,5 @@ export function reconcile(ledgerRefs, providerRefs) {
             missing_from_provider.push(ref);
     return { ok: missing_from_ledger.length === 0, matched, missing_from_ledger, missing_from_provider };
 }
+export * from './frameworks.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,iBAAiB,EAAuC,MAAM,aAAa,CAAC;AAuBrF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,OAAwD,EAAE;IAE1D,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAA2C,CAAC,CAAC;IAE3F,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,SAAS;QACxB,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE9B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,SAAS;QACT,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,IAAI,YAAY;QACnD,OAAO;KACR,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC7G,IAAI,aAAa,GAAG,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,aAAa,OAAO,KAAK,yCAAyC,CAAC,CAAC;IACrH,IAAI,YAAY,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,iDAAiD,CAAC,CAAC;IAC3I,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5F,IAAI,QAAQ,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,uCAAuC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY;QACrD,QAAQ,EAAE,YAAY,CAAC,EAAE;QACzB,YAAY;QACZ,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE;QAChF,aAAa,EAAE,KAAK;QACpB,YAAY;QACZ,QAAQ,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,IAAI,KAAK,EAAE;QAC3E,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,wBAAwB,CAAC,CAAmB;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC;SAClE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACvF,OAAO;;iBAEQ,CAAC,CAAC,QAAQ;mBACR,CAAC,CAAC,YAAY;sBACX,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU;gBAClD,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG;iBAC9C,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK;;;;;;EAMvE,IAAI,IAAI,eAAe;;;;EAIvB,KAAK;CACN,CAAC;AACF,CAAC;AAmBD,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE,YAA8B;IACpF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxF,KAAK,MAAM,GAAG,IAAI,MAAM;QAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAC;AACvG,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,iBAAiB,EAAuC,MAAM,aAAa,CAAC;AAuBrF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,OAAwD,EAAE;IAE1D,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAA2C,CAAC,CAAC;IAE3F,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,SAAS;QACxB,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE9B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,SAAS;QACT,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,IAAI,YAAY;QACnD,OAAO;KACR,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC7G,IAAI,aAAa,GAAG,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,aAAa,OAAO,KAAK,yCAAyC,CAAC,CAAC;IACrH,IAAI,YAAY,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,iDAAiD,CAAC,CAAC;IAC3I,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5F,IAAI,QAAQ,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,uCAAuC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY;QACrD,QAAQ,EAAE,YAAY,CAAC,EAAE;QACzB,YAAY;QACZ,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE;QAChF,aAAa,EAAE,KAAK;QACpB,YAAY;QACZ,QAAQ,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,IAAI,KAAK,EAAE;QAC3E,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,wBAAwB,CAAC,CAAmB;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC;SAClE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACvF,OAAO;;iBAEQ,CAAC,CAAC,QAAQ;mBACR,CAAC,CAAC,YAAY;sBACX,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU;gBAClD,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG;iBAC9C,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK;;;;;;EAMvE,IAAI,IAAI,eAAe;;;;EAIvB,KAAK;CACN,CAAC;AACF,CAAC;AAmBD,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE,YAA8B;IACpF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxF,KAAK,MAAM,GAAG,IAAI,MAAM;QAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAC;AACvG,CAAC;AACD,cAAc,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanii/compliance",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Turn a Zanii audit bundle into an auditor-ready compliance report - offline verification, action breakdown, anchoring coverage, and control mapping, rendered to Markdown.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",
@@ -29,10 +29,11 @@
     "@types/node": "^26.1.0",
     "typescript": "^5.8.2",
     "vitest": "^3.0.9",
-    "@zanii/testing": "0.1.1"
+    "@zanii/testing": "0.1.2"
   },
   "dependencies": {
-    "@zanii/core": "^0.4.0"
+    "@zanii/core": "^0.5.4",
+    "@zanii/regulator": "^0.1.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",

package/src/frameworks.ts

@@ -0,0 +1,208 @@
+/**
+ * Control-by-control evidence for the frameworks auditors ask about, computed from a
+ * verified audit bundle. "met" means the log carries evidence for the control; it is
+ * evidence for an auditor, never a certification. Controls the log cannot evidence are
+ * reported as `not-evidenced`, not as failed or passed.
+ */
+import { jcsHash, signObject, verifyAuditBundle, verifySignedObject, type AuditBundle, type BundleReport, type SignedObject } from '@zanii/core';
+import { commitSeed, drawSample, incidentClock, type Regime } from '@zanii/regulator';
+
+export type Framework = 'eu-ai-act' | 'iso42001' | 'nist-ai-rmf' | 'soc2' | 'dora' | 'nis2' | 'hipaa' | 'pci4' | 'gdpr';
+export type ControlStatus = 'met' | 'partial' | 'not-evidenced';
+
+export interface ControlResult {
+  id: string;
+  title: string;
+  status: ControlStatus;
+  evidence: string;
+}
+
+interface Facts {
+  report: BundleReport;
+  verified: boolean;
+  chainOk: boolean;
+  anchoredAll: boolean;
+  receipts: number;
+  days: number;
+  targets: string[];
+  oversight: number;
+  guard: number;
+  incidents: number;
+  revocations: number;
+  highRisk: number;
+}
+
+const targetOf = (r: any): string => r.target ?? r.body?.target ?? '';
+
+function facts(bundle: AuditBundle): Facts {
+  const report = verifyAuditBundle(bundle);
+  const targets = bundle.receipts.map((b) => targetOf(b.receipt));
+  const s = report.stats;
+  const days = s.first_ts && s.last_ts ? (Date.parse(s.last_ts) - Date.parse(s.first_ts)) / 86_400_000 : 0;
+  return {
+    report, verified: report.ok,
+    chainOk: !!report.checks.find((c) => /chain/i.test(c.label))?.ok,
+    anchoredAll: s.anchored_through !== null && s.anchored_through >= Math.max(...bundle.receipts.map((r) => r.index), 0),
+    receipts: targets.length, days, targets,
+    oversight: targets.filter((t) => /confirm|approv|takeover|handback|review/i.test(t)).length,
+    guard: targets.filter((t) => t.startsWith('zanii.guard.')).length,
+    incidents: targets.filter((t) => /incident|estop|break-glass/i.test(t)).length,
+    revocations: s.revoked_certs,
+    highRisk: bundle.receipts.filter((b) => ['high', 'critical'].includes((b.receipt as any).risk)).length,
+  };
+}
+
+const c = (id: string, title: string, status: ControlStatus, evidence: string): ControlResult => ({ id, title, status, evidence });
+const logs = (f: Facts) => f.verified && f.chainOk ? (f.anchoredAll ? 'met' : 'partial') : 'not-evidenced';
+const logsText = (f: Facts) => `${f.receipts} signed, hash-chained records; offline verification ${f.verified ? 'passed' : 'FAILED'}; ${f.anchoredAll ? 'all anchored on-chain' : 'not all anchored yet'}`;
+const oversight = (f: Facts): ControlStatus => (f.oversight > 0 ? 'met' : f.highRisk === 0 ? 'partial' : 'not-evidenced');
+const oversightText = (f: Facts) => `${f.oversight} human confirmation / review records for ${f.highRisk} high-risk actions`;
+
+const FRAMEWORKS: Record<Framework, (f: Facts) => ControlResult[]> = {
+  'eu-ai-act': (f) => [
+    c('Art. 12', 'Record-keeping: automatic logging over the lifetime of the system', logs(f), logsText(f)),
+    c('Art. 14', 'Human oversight', oversight(f), oversightText(f)),
+    c('Art. 19 / 26(6)', 'Keep automatically generated logs for at least six months', f.days >= 182 ? 'met' : 'partial', `records span ${Math.round(f.days)} days`),
+    c('Art. 72', 'Post-market monitoring', f.guard > 0 ? 'met' : 'partial', `${f.guard} runtime security decisions recorded`),
+    c('Art. 73', 'Reporting of serious incidents', f.incidents > 0 ? 'partial' : 'not-evidenced', `${f.incidents} incident-type records; reporting itself happens outside the log`),
+  ],
+  iso42001: (f) => [
+    c('Clause 8.1', 'Operational planning and control', f.revocations >= 0 && f.verified ? 'met' : 'not-evidenced', 'every action carries the owner-signed delegation it ran under'),
+    c('Clause 9.1', 'Monitoring, measurement, analysis and evaluation', logs(f), logsText(f)),
+    c('Clause 10.2', 'Nonconformity and corrective action', f.incidents > 0 ? 'partial' : 'not-evidenced', `${f.incidents} incident records`),
+  ],
+  'nist-ai-rmf': (f) => [
+    c('GOVERN', 'Accountability structures are in place', f.verified ? 'met' : 'not-evidenced', 'actions are attributable to agents and owners through signed delegations'),
+    c('MEASURE', 'AI risks are tracked', f.highRisk > 0 || f.guard > 0 ? 'met' : 'partial', `${f.highRisk} risk-labelled high/critical actions, ${f.guard} guard decisions`),
+    c('MANAGE', 'Risks are responded to', f.revocations > 0 || f.incidents > 0 ? 'met' : 'partial', `${f.revocations} revocations, ${f.incidents} incident records`),
+  ],
+  soc2: (f) => [
+    c('CC6.1', 'Logical access controls', f.verified ? 'met' : 'not-evidenced', 'scoped, expiring delegations; revocation recorded'),
+    c('CC7.2', 'Monitoring of system components for anomalies', f.guard > 0 ? 'met' : 'partial', `${f.guard} guard decisions; complete activity log`),
+    c('CC8.1', 'Change management', f.targets.some((t) => t.includes('evolution') || t.includes('succession')) ? 'met' : 'not-evidenced', 'agent changes and key rotations as signed records'),
+  ],
+  dora: (f) => [
+    c('Art. 17', 'ICT-related incident management process', f.incidents > 0 ? 'partial' : 'not-evidenced', `${f.incidents} incident records`),
+    c('Art. 19', 'Reporting of major ICT-related incidents', 'not-evidenced', 'use @zanii/regulator incidentClock for the deadlines; filings happen outside the log'),
+    c('Art. 28', 'ICT third-party risk', f.targets.some((t) => t.startsWith('subprocessor') || t.startsWith('broker.')) ? 'partial' : 'not-evidenced', 'third-party calls through the broker / subprocessor records'),
+  ],
+  nis2: (f) => [
+    c('Art. 21', 'Cybersecurity risk-management measures', f.guard > 0 || f.revocations > 0 ? 'partial' : 'not-evidenced', `${f.guard} guard decisions, ${f.revocations} revocations`),
+    c('Art. 23', 'Reporting obligations', f.incidents > 0 ? 'partial' : 'not-evidenced', 'incident records; use incidentReport for the 24h / 72h / one-month clock'),
+  ],
+  hipaa: (f) => [c('164.312(b)', 'Audit controls: record and examine activity', logs(f), logsText(f))],
+  pci4: (f) => [c('Req. 10', 'Log and monitor all access to system components and data', logs(f), logsText(f))],
+  gdpr: (f) => [
+    c('Art. 5(2)', 'Accountability', f.verified ? 'met' : 'not-evidenced', 'processing actions are signed and attributable'),
+    c('Art. 30', 'Records of processing activities', f.receipts > 0 ? 'partial' : 'not-evidenced', 'activity records exist; the Art. 30 register itself is a separate document'),
+  ],
+};
+
+/** Evidence per control for one framework. */
+export function mapToFramework(bundle: AuditBundle, framework: Framework): { framework: Framework; verified: boolean; controls: ControlResult[] } {
+  const f = facts(bundle);
+  return { framework, verified: f.verified, controls: FRAMEWORKS[framework](f) };
+}
+
+/** Re-evaluate the framework window by window: a control that slips shows up when it slipped. */
+export function controlTimeline(bundles: Array<{ period: string; bundle: AuditBundle }>, framework: Framework) {
+  return bundles.map(({ period, bundle }) => {
+    const m = mapToFramework(bundle, framework);
+    return { period, verified: m.verified, met: m.controls.filter((x) => x.status === 'met').length, total: m.controls.length, gaps: m.controls.filter((x) => x.status !== 'met').map((x) => x.id) };
+  });
+}
+
+/**
+ * A provably random audit sample: commit the seed before seeing the population, then
+ * draw. The auditor can redo the draw from the seed.
+ */
+export function sampleSelector(bundle: AuditBundle, n: number, seed?: string) {
+  const s = seed ? { seed, commitment: undefined } : commitSeed();
+  return { seed: s.seed, commitment: s.commitment, sample: drawSample(bundle.receipts.map((r) => ({ hash: r.hash, index: r.index })), n, s.seed) };
+}
+
+/** Every exception an auditor should see, with any remediation recorded against it. */
+export function exceptionRegister(bundle: AuditBundle, remediations: Array<{ exception: string; action: string; by: string; ts: string }> = []) {
+  const f = facts(bundle);
+  const exceptions: Array<{ id: string; description: string; remediation: (typeof remediations)[number] | null }> = [];
+  f.report.checks.filter((x) => !x.ok).forEach((x) => exceptions.push({ id: jcsHash({ check: x.label }), description: `verification check failed: ${x.label}`, remediation: null }));
+  if (!f.anchoredAll) exceptions.push({ id: jcsHash({ e: 'anchoring', agent: bundle.agent_id }), description: 'not all records are anchored on-chain', remediation: null });
+  if (f.highRisk > 0 && f.oversight === 0) exceptions.push({ id: jcsHash({ e: 'oversight', agent: bundle.agent_id }), description: `${f.highRisk} high-risk actions with no human confirmation on record`, remediation: null });
+  for (const e of exceptions) e.remediation = remediations.find((r) => r.exception === e.id) ?? null;
+  return { open: exceptions.filter((e) => !e.remediation).length, exceptions };
+}
+
+/** EU AI Act Annex IV technical documentation, drafted from what you supply plus what the log proves. */
+export function aiActTechnicalFile(system: { name: string; provider: string; intendedPurpose: string; version: string; humanOversight: string; accuracyMetrics?: Record<string, string> }, bundle: AuditBundle): string {
+  const m = mapToFramework(bundle, 'eu-ai-act');
+  const metrics = Object.entries(system.accuracyMetrics ?? {}).map(([k, v]) => `- ${k}: ${v}`).join('\n') || '- (to be supplied by the provider)';
+  return `# Technical documentation: ${system.name} ${system.version}
+
+## 1. General description
+- Provider: ${system.provider}
+- Intended purpose: ${system.intendedPurpose}
+
+## 2. Human oversight measures
+${system.humanOversight}
+
+## 3. Performance
+${metrics}
+
+## 4. Record-keeping and monitoring (from the transparency log)
+${m.controls.map((x) => `- **${x.id}** ${x.title}: ${x.status}. ${x.evidence}`).join('\n')}
+
+Log evidence for agent \`${bundle.agent_id}\`, verified offline: ${m.verified ? 'yes' : 'NO'}.
+`;
+}
+
+/** An incident report skeleton with the regime's deadlines and the receipts it concerns. */
+export function incidentReport(incident: { id: string; summary: string; awareAt: string; receipts: string[] }, regime: Regime) {
+  return { regime, ...incident, deadlines: incidentClock(regime, incident.awareAt), evidence: incident.receipts };
+}
+
+/** Trend across monitoring periods: activity, share of high-risk actions, guard decisions, failures. */
+export function postMarketMonitoring(periods: Array<{ period: string; bundle: AuditBundle }>) {
+  return periods.map(({ period, bundle }) => {
+    const f = facts(bundle);
+    return { period, verified: f.verified, actions: f.receipts, highRiskShare: f.receipts ? f.highRisk / f.receipts : 0, guardDecisions: f.guard, incidents: f.incidents };
+  });
+}
+
+export type ControlAttestation = SignedObject<{ v: 1; type: 'compliance.attestation'; control: string; period: string; statement: string; ts: string }>;
+
+/** A control owner's signed quarterly attestation. */
+export function attestControl(input: { control: string; period: string; statement: string; ts?: string }, ownerPrivateKey: Uint8Array): ControlAttestation {
+  return signObject({ v: 1 as const, type: 'compliance.attestation' as const, ...input, ts: input.ts ?? new Date().toISOString() }, ownerPrivateKey);
+}
+
+export function verifyControlAttestation(a: ControlAttestation, ownerDid?: string): boolean {
+  return verifySignedObject(a) && a.type === 'compliance.attestation' && (!ownerDid || a.signer === ownerDid);
+}
+
+/** A framework mapping as JSON-LD for machine submission. */
+export function regulatorExport(mapping: ReturnType<typeof mapToFramework>, agent: string) {
+  return {
+    '@context': { '@vocab': 'https://ledger.zanii.agency/vocab#', schema: 'https://schema.org/' },
+    '@type': 'ComplianceEvidence',
+    agent, framework: mapping.framework, verified: mapping.verified,
+    controls: mapping.controls.map((x) => ({ '@type': 'Control', identifier: x.id, name: x.title, status: x.status, evidence: x.evidence })),
+  };
+}
+
+const esc = (s: string) => s.replace(/[&<>"]/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[ch]!);
+
+/**
+ * A single offline HTML file for an auditor: the framework mapping plus the full bundle
+ * embedded, so they can re-verify it with any Zanii verifier (or the /verify-bundle page).
+ */
+export function renderAuditorPortal(bundle: AuditBundle, frameworks: Framework[]): string {
+  const sections = frameworks.map((fw) => {
+    const m = mapToFramework(bundle, fw);
+    return `<h2>${esc(fw)}</h2><table><tr><th>Control</th><th>Status</th><th>Evidence</th></tr>${m.controls.map((x) => `<tr><td>${esc(x.id)} ${esc(x.title)}</td><td>${x.status}</td><td>${esc(x.evidence)}</td></tr>`).join('')}</table>`;
+  }).join('');
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Audit evidence</title><style>body{font:14px/1.5 system-ui,sans-serif;max-width:960px;margin:2rem auto;padding:0 1rem}table{border-collapse:collapse;width:100%}td,th{border:1px solid #ccc;padding:4px 8px;text-align:left;vertical-align:top}</style></head><body>
+<h1>Audit evidence for <code>${esc(bundle.agent_id)}</code></h1>
+<p>Bundle hash <code>${esc(jcsHash(bundle as never))}</code>. Re-verify the embedded bundle with <code>zanii offline-verify</code> or the offline page at /verify-bundle.</p>
+${sections}
+<script type="application/json" id="bundle">${JSON.stringify(bundle).replace(/</g, '\\u003c')}</script></body></html>`;
+}

package/src/index.ts

@@ -136,3 +136,4 @@ export function reconcile(ledgerRefs: Iterable<string>, providerRefs: Iterable<s
   for (const ref of ledger) if (!provider.has(ref)) missing_from_provider.push(ref);
   return { ok: missing_from_ledger.length === 0, matched, missing_from_ledger, missing_from_provider };
 }
+export * from './frameworks.js';