monora-ai 2.0.0 → 2.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +441 -150
- package/dist/aims_governance.d.ts +238 -0
- package/dist/aims_governance.d.ts.map +1 -0
- package/dist/aims_governance.js +922 -0
- package/dist/alerts.d.ts +16 -0
- package/dist/alerts.d.ts.map +1 -1
- package/dist/alerts.js +16 -0
- package/dist/api.d.ts +6 -0
- package/dist/api.d.ts.map +1 -1
- package/dist/api.js +6 -0
- package/dist/assessment.d.ts +269 -0
- package/dist/assessment.d.ts.map +1 -0
- package/dist/assessment.js +1232 -0
- package/dist/attestation.js +23 -1
- package/dist/attribution.d.ts +349 -0
- package/dist/attribution.d.ts.map +1 -0
- package/dist/attribution.js +987 -0
- package/dist/autodetect.d.ts +69 -1
- package/dist/autodetect.d.ts.map +1 -1
- package/dist/autodetect.js +644 -1
- package/dist/bias.d.ts +130 -0
- package/dist/bias.d.ts.map +1 -0
- package/dist/bias.js +223 -0
- package/dist/circuit_breaker.js +3 -3
- package/dist/cli/diagnostics.d.ts +5 -1
- package/dist/cli/diagnostics.d.ts.map +1 -1
- package/dist/cli/diagnostics.js +31 -8
- package/dist/cli/doctor.d.ts +25 -0
- package/dist/cli/doctor.d.ts.map +1 -0
- package/dist/cli/doctor.js +381 -0
- package/dist/cli/fix.d.ts +16 -0
- package/dist/cli/fix.d.ts.map +1 -0
- package/dist/cli/fix.js +284 -0
- package/dist/cli/init.d.ts +57 -0
- package/dist/cli/init.d.ts.map +1 -0
- package/dist/cli/init.js +205 -0
- package/dist/cli.js +1611 -126
- package/dist/complianceTargets.d.ts +111 -0
- package/dist/complianceTargets.d.ts.map +1 -0
- package/dist/complianceTargets.js +521 -0
- package/dist/config.d.ts +301 -17
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +428 -36
- package/dist/config_migrations.d.ts +41 -0
- package/dist/config_migrations.d.ts.map +1 -1
- package/dist/config_migrations.js +205 -0
- package/dist/config_schema.d.ts +2900 -731
- package/dist/config_schema.d.ts.map +1 -1
- package/dist/config_schema.js +257 -55
- package/dist/context.d.ts +34 -0
- package/dist/context.d.ts.map +1 -1
- package/dist/context.js +118 -7
- package/dist/control_backbone.d.ts +122 -0
- package/dist/control_backbone.d.ts.map +1 -0
- package/dist/control_backbone.js +698 -0
- package/dist/data-governance.d.ts +187 -0
- package/dist/data-governance.d.ts.map +1 -0
- package/dist/data-governance.js +424 -0
- package/dist/dataResidency.d.ts +44 -0
- package/dist/dataResidency.d.ts.map +1 -0
- package/dist/dataResidency.js +203 -0
- package/dist/dispatcher.d.ts +32 -0
- package/dist/dispatcher.d.ts.map +1 -1
- package/dist/dispatcher.js +91 -4
- package/dist/events.d.ts.map +1 -1
- package/dist/events.js +38 -0
- package/dist/evidence_store.d.ts +103 -0
- package/dist/evidence_store.d.ts.map +1 -0
- package/dist/evidence_store.js +459 -0
- package/dist/executiveSummary.d.ts +65 -8
- package/dist/executiveSummary.d.ts.map +1 -1
- package/dist/executiveSummary.js +289 -26
- package/dist/identity.d.ts +143 -0
- package/dist/identity.d.ts.map +1 -0
- package/dist/identity.js +231 -0
- package/dist/impact-assessment.d.ts +350 -0
- package/dist/impact-assessment.d.ts.map +1 -0
- package/dist/impact-assessment.js +580 -0
- package/dist/index.d.ts +25 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +300 -4
- package/dist/instrumentation.d.ts +1 -1
- package/dist/instrumentation.d.ts.map +1 -1
- package/dist/instrumentation.js +243 -27
- package/dist/integrations/anthropic.d.ts +3 -0
- package/dist/integrations/anthropic.d.ts.map +1 -1
- package/dist/integrations/anthropic.js +284 -79
- package/dist/integrations/governance.d.ts +33 -0
- package/dist/integrations/governance.d.ts.map +1 -0
- package/dist/integrations/governance.js +208 -0
- package/dist/integrations/langchain.d.ts +7 -0
- package/dist/integrations/langchain.d.ts.map +1 -1
- package/dist/integrations/langchain.js +387 -143
- package/dist/integrations/openai.d.ts +9 -0
- package/dist/integrations/openai.d.ts.map +1 -1
- package/dist/integrations/openai.js +673 -73
- package/dist/iso42001_consolidation.d.ts +16 -0
- package/dist/iso42001_consolidation.d.ts.map +1 -0
- package/dist/iso42001_consolidation.js +413 -0
- package/dist/iso42001_workflows.d.ts +263 -0
- package/dist/iso42001_workflows.d.ts.map +1 -0
- package/dist/iso42001_workflows.js +781 -0
- package/dist/lifecycle.d.ts +299 -0
- package/dist/lifecycle.d.ts.map +1 -0
- package/dist/lifecycle.js +624 -0
- package/dist/lineage.d.ts +2 -2
- package/dist/lineage.d.ts.map +1 -1
- package/dist/lineage.js +12 -17
- package/dist/middleware/express.d.ts.map +1 -1
- package/dist/middleware/express.js +33 -3
- package/dist/middleware/nextjs.d.ts.map +1 -1
- package/dist/middleware/nextjs.js +42 -68
- package/dist/model.d.ts +143 -0
- package/dist/model.d.ts.map +1 -0
- package/dist/model.js +371 -0
- package/dist/onboarding.d.ts +42 -0
- package/dist/onboarding.d.ts.map +1 -0
- package/dist/onboarding.js +1022 -0
- package/dist/oversight.d.ts +264 -0
- package/dist/oversight.d.ts.map +1 -0
- package/dist/oversight.js +497 -0
- package/dist/pdf_report.d.ts.map +1 -1
- package/dist/pdf_report.js +42 -21
- package/dist/presets.d.ts +88 -0
- package/dist/presets.d.ts.map +1 -0
- package/dist/presets.js +520 -0
- package/dist/propagation.d.ts.map +1 -1
- package/dist/propagation.js +34 -2
- package/dist/quotas.d.ts +171 -0
- package/dist/quotas.d.ts.map +1 -0
- package/dist/quotas.js +259 -0
- package/dist/register.d.ts +13 -0
- package/dist/register.d.ts.map +1 -0
- package/dist/register.js +99 -0
- package/dist/registry.d.ts +1 -0
- package/dist/registry.d.ts.map +1 -1
- package/dist/registry.js +7 -0
- package/dist/registryData.json +43 -6
- package/dist/report.d.ts +2 -1
- package/dist/report.d.ts.map +1 -1
- package/dist/report.js +189 -2
- package/dist/reporting.d.ts +125 -0
- package/dist/reporting.d.ts.map +1 -1
- package/dist/reporting.js +196 -5
- package/dist/resources.d.ts +285 -0
- package/dist/resources.d.ts.map +1 -0
- package/dist/resources.js +643 -0
- package/dist/risk.d.ts +120 -0
- package/dist/risk.d.ts.map +1 -0
- package/dist/risk.js +220 -0
- package/dist/runtime.d.ts +74 -1
- package/dist/runtime.d.ts.map +1 -1
- package/dist/runtime.js +598 -22
- package/dist/schemaInference.d.ts +92 -0
- package/dist/schemaInference.d.ts.map +1 -0
- package/dist/schemaInference.js +466 -0
- package/dist/schema_validation.js +2 -2
- package/dist/schemas/config.schema.json +169 -6
- package/dist/schemas/event.schema.json +4 -0
- package/dist/security_report.js +4 -4
- package/dist/signing.d.ts +1 -1
- package/dist/signing.d.ts.map +1 -1
- package/dist/signing.js +4 -0
- package/dist/sinks/file.d.ts +19 -1
- package/dist/sinks/file.d.ts.map +1 -1
- package/dist/sinks/file.js +82 -13
- package/dist/sinks/https.d.ts +10 -0
- package/dist/sinks/https.d.ts.map +1 -1
- package/dist/sinks/https.js +76 -16
- package/dist/sinks/stdout.d.ts +1 -0
- package/dist/sinks/stdout.d.ts.map +1 -1
- package/dist/sinks/stdout.js +12 -1
- package/dist/spec.d.ts +159 -0
- package/dist/spec.d.ts.map +1 -0
- package/dist/spec.js +391 -0
- package/dist/stakeholders.d.ts +199 -0
- package/dist/stakeholders.d.ts.map +1 -0
- package/dist/stakeholders.js +398 -0
- package/dist/standards.d.ts.map +1 -1
- package/dist/standards.js +160 -2
- package/dist/standards_ingest.d.ts +2 -2
- package/dist/standards_ingest.d.ts.map +1 -1
- package/dist/standards_ingest.js +105 -23
- package/dist/streaming.d.ts.map +1 -1
- package/dist/streaming.js +7 -2
- package/dist/telemetry.d.ts +16 -2
- package/dist/telemetry.d.ts.map +1 -1
- package/dist/telemetry.js +79 -14
- package/dist/templates/controls/iso42001_control_catalog.json +1443 -0
- package/dist/traced_emitter.d.ts +3 -0
- package/dist/traced_emitter.d.ts.map +1 -1
- package/dist/traced_emitter.js +142 -25
- package/dist/trust_package.d.ts +21 -1
- package/dist/trust_package.d.ts.map +1 -1
- package/dist/trust_package.js +101 -4
- package/dist/verify.d.ts.map +1 -1
- package/dist/verify.js +9 -2
- package/dist/wal.d.ts.map +1 -1
- package/dist/wal.js +2 -1
- package/package.json +14 -1
- package/scripts/postinstall.js +119 -97
- package/templates/controls/iso42001_control_catalog.json +1443 -0
|
@@ -0,0 +1,459 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Evidence store with hash chaining and lineage graph support.
|
|
4
|
+
*/
|
|
5
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
6
|
+
if (k2 === undefined) k2 = k;
|
|
7
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
8
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
9
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
10
|
+
}
|
|
11
|
+
Object.defineProperty(o, k2, desc);
|
|
12
|
+
}) : (function(o, m, k, k2) {
|
|
13
|
+
if (k2 === undefined) k2 = k;
|
|
14
|
+
o[k2] = m[k];
|
|
15
|
+
}));
|
|
16
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
17
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
18
|
+
}) : function(o, v) {
|
|
19
|
+
o["default"] = v;
|
|
20
|
+
});
|
|
21
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
22
|
+
var ownKeys = function(o) {
|
|
23
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
24
|
+
var ar = [];
|
|
25
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
26
|
+
return ar;
|
|
27
|
+
};
|
|
28
|
+
return ownKeys(o);
|
|
29
|
+
};
|
|
30
|
+
return function (mod) {
|
|
31
|
+
if (mod && mod.__esModule) return mod;
|
|
32
|
+
var result = {};
|
|
33
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
34
|
+
__setModuleDefault(result, mod);
|
|
35
|
+
return result;
|
|
36
|
+
};
|
|
37
|
+
})();
|
|
38
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
39
|
+
exports.EvidenceStore = void 0;
|
|
40
|
+
exports.computeEvidenceItemHash = computeEvidenceItemHash;
|
|
41
|
+
exports.verifyEvidenceHashChain = verifyEvidenceHashChain;
|
|
42
|
+
exports.buildEvidenceHashChain = buildEvidenceHashChain;
|
|
43
|
+
exports.buildEvidenceLineageGraph = buildEvidenceLineageGraph;
|
|
44
|
+
exports.buildHashedEvidenceManifest = buildHashedEvidenceManifest;
|
|
45
|
+
exports.getRuntimeEvidenceStore = getRuntimeEvidenceStore;
|
|
46
|
+
exports.clearRuntimeEvidenceStore = clearRuntimeEvidenceStore;
|
|
47
|
+
exports.recordRuntimeEvidence = recordRuntimeEvidence;
|
|
48
|
+
exports.buildRuntimeEvidenceManifest = buildRuntimeEvidenceManifest;
|
|
49
|
+
const crypto = __importStar(require("crypto"));
|
|
50
|
+
function utcNow() {
|
|
51
|
+
return new Date().toISOString();
|
|
52
|
+
}
|
|
53
|
+
function isPlainObject(value) {
|
|
54
|
+
return Object.prototype.toString.call(value) === '[object Object]';
|
|
55
|
+
}
|
|
56
|
+
function canonicalizeValue(value) {
|
|
57
|
+
if (Array.isArray(value)) {
|
|
58
|
+
return value.map((item) => canonicalizeValue(item));
|
|
59
|
+
}
|
|
60
|
+
if (value && typeof value === 'object') {
|
|
61
|
+
if (!isPlainObject(value)) {
|
|
62
|
+
return value;
|
|
63
|
+
}
|
|
64
|
+
const sortedEntries = Object.entries(value).sort(([a], [b]) => a.localeCompare(b));
|
|
65
|
+
const result = {};
|
|
66
|
+
for (const [key, nestedValue] of sortedEntries) {
|
|
67
|
+
result[key] = canonicalizeValue(nestedValue);
|
|
68
|
+
}
|
|
69
|
+
return result;
|
|
70
|
+
}
|
|
71
|
+
return value;
|
|
72
|
+
}
|
|
73
|
+
function stableStringify(value) {
|
|
74
|
+
return JSON.stringify(canonicalizeValue(value));
|
|
75
|
+
}
|
|
76
|
+
function normalizeList(value) {
|
|
77
|
+
if (value === null || value === undefined) {
|
|
78
|
+
return [];
|
|
79
|
+
}
|
|
80
|
+
if (Array.isArray(value)) {
|
|
81
|
+
return value
|
|
82
|
+
.map((item) => String(item).trim())
|
|
83
|
+
.filter(Boolean);
|
|
84
|
+
}
|
|
85
|
+
return String(value)
|
|
86
|
+
.replace(/;/g, ',')
|
|
87
|
+
.split(',')
|
|
88
|
+
.map((item) => item.trim())
|
|
89
|
+
.filter(Boolean);
|
|
90
|
+
}
|
|
91
|
+
function validateAlgorithm(algorithm) {
|
|
92
|
+
const normalized = (algorithm || '').trim().toLowerCase() || 'sha256';
|
|
93
|
+
const supported = new Set(crypto.getHashes());
|
|
94
|
+
if (!supported.has(normalized)) {
|
|
95
|
+
throw new Error(`Invalid hash_algorithm: ${algorithm || '(empty)'}; supported algorithms: ${Array.from(supported).join(', ')}`);
|
|
96
|
+
}
|
|
97
|
+
return normalized;
|
|
98
|
+
}
|
|
99
|
+
function buildId(prefix, ...parts) {
|
|
100
|
+
const seed = `${prefix}:${parts.join(':')}:${utcNow()}`;
|
|
101
|
+
const digest = crypto.createHash('sha256').update(seed).digest('hex').slice(0, 12);
|
|
102
|
+
return `${prefix}_${digest}`;
|
|
103
|
+
}
|
|
104
|
+
function clone(value) {
|
|
105
|
+
return JSON.parse(JSON.stringify(value));
|
|
106
|
+
}
|
|
107
|
+
function sanitizeEvidencePayload(payload) {
|
|
108
|
+
const sanitized = clone(payload);
|
|
109
|
+
delete sanitized.evidence_hash;
|
|
110
|
+
delete sanitized.prev_hash;
|
|
111
|
+
delete sanitized.hash_chain;
|
|
112
|
+
return sanitized;
|
|
113
|
+
}
|
|
114
|
+
function computeEvidenceItemHash(item, options) {
|
|
115
|
+
const algorithm = validateAlgorithm(options?.algorithm);
|
|
116
|
+
const prevHash = options?.prevHash || null;
|
|
117
|
+
const payload = sanitizeEvidencePayload(item);
|
|
118
|
+
const canonical = stableStringify(payload);
|
|
119
|
+
const hasher = crypto.createHash(algorithm);
|
|
120
|
+
if (prevHash) {
|
|
121
|
+
hasher.update(prevHash);
|
|
122
|
+
}
|
|
123
|
+
hasher.update(canonical);
|
|
124
|
+
return `${algorithm}:${hasher.digest('hex')}`;
|
|
125
|
+
}
|
|
126
|
+
function verifyEvidenceHashChain(evidenceItems, records, algorithm) {
|
|
127
|
+
const normalized = validateAlgorithm(algorithm);
|
|
128
|
+
const byId = new Map();
|
|
129
|
+
for (const item of evidenceItems) {
|
|
130
|
+
const evidenceId = String(item.evidence_id || '').trim();
|
|
131
|
+
if (evidenceId) {
|
|
132
|
+
byId.set(evidenceId, item);
|
|
133
|
+
}
|
|
134
|
+
}
|
|
135
|
+
let prevHash = null;
|
|
136
|
+
for (let index = 0; index < records.length; index += 1) {
|
|
137
|
+
const record = records[index];
|
|
138
|
+
const evidenceId = String(record.evidence_id || '').trim();
|
|
139
|
+
if (!evidenceId) {
|
|
140
|
+
return { valid: false, error: `Missing evidence_id at index ${index}` };
|
|
141
|
+
}
|
|
142
|
+
const item = byId.get(evidenceId);
|
|
143
|
+
if (!item) {
|
|
144
|
+
return { valid: false, error: `Evidence item ${evidenceId} missing for hash verification` };
|
|
145
|
+
}
|
|
146
|
+
if ((record.prev_hash || null) !== prevHash) {
|
|
147
|
+
return {
|
|
148
|
+
valid: false,
|
|
149
|
+
error: `Chain break at index ${index}: prev_hash=${record.prev_hash} expected ${prevHash}`,
|
|
150
|
+
};
|
|
151
|
+
}
|
|
152
|
+
const computed = computeEvidenceItemHash(item, { prevHash, algorithm: normalized });
|
|
153
|
+
if (computed !== record.evidence_hash) {
|
|
154
|
+
return { valid: false, error: `Hash mismatch at index ${index} for evidence ${evidenceId}` };
|
|
155
|
+
}
|
|
156
|
+
prevHash = record.evidence_hash;
|
|
157
|
+
}
|
|
158
|
+
return { valid: true };
|
|
159
|
+
}
|
|
160
|
+
function buildEvidenceHashChain(evidenceItems, options) {
|
|
161
|
+
const algorithm = validateAlgorithm(options?.algorithm);
|
|
162
|
+
const sortBy = options?.sortBy || ((item) => {
|
|
163
|
+
const collected = item.collected_at || '';
|
|
164
|
+
const evidenceId = item.evidence_id || '';
|
|
165
|
+
return `${collected}:${evidenceId}`;
|
|
166
|
+
});
|
|
167
|
+
const ordered = [...evidenceItems].sort((a, b) => {
|
|
168
|
+
const left = sortBy(a);
|
|
169
|
+
const right = sortBy(b);
|
|
170
|
+
return left.localeCompare(right);
|
|
171
|
+
});
|
|
172
|
+
const records = [];
|
|
173
|
+
let prevHash = null;
|
|
174
|
+
for (const item of ordered) {
|
|
175
|
+
const evidenceHash = computeEvidenceItemHash(item, { prevHash, algorithm });
|
|
176
|
+
records.push({
|
|
177
|
+
evidence_id: String(item.evidence_id || ''),
|
|
178
|
+
evidence_hash: evidenceHash,
|
|
179
|
+
prev_hash: prevHash,
|
|
180
|
+
recorded_at: utcNow(),
|
|
181
|
+
collected_at: item.collected_at || null,
|
|
182
|
+
});
|
|
183
|
+
prevHash = evidenceHash;
|
|
184
|
+
}
|
|
185
|
+
const verification = verifyEvidenceHashChain(evidenceItems, records, algorithm);
|
|
186
|
+
return {
|
|
187
|
+
chain_type: 'evidence_hash_chain',
|
|
188
|
+
algorithm,
|
|
189
|
+
generated_at: utcNow(),
|
|
190
|
+
item_count: records.length,
|
|
191
|
+
first_hash: records.length > 0 ? records[0].evidence_hash : null,
|
|
192
|
+
last_hash: records.length > 0 ? records[records.length - 1].evidence_hash : null,
|
|
193
|
+
verification_status: verification.valid ? 'verified' : 'invalid',
|
|
194
|
+
verification_error: verification.error || null,
|
|
195
|
+
records,
|
|
196
|
+
};
|
|
197
|
+
}
|
|
198
|
+
function extractMetadataValues(metadata, keys) {
|
|
199
|
+
const values = [];
|
|
200
|
+
for (const key of keys) {
|
|
201
|
+
if (key in metadata) {
|
|
202
|
+
values.push(...normalizeList(metadata[key]));
|
|
203
|
+
}
|
|
204
|
+
}
|
|
205
|
+
return values;
|
|
206
|
+
}
|
|
207
|
+
function buildEvidenceLineageGraph(evidenceItems) {
|
|
208
|
+
const nodes = [];
|
|
209
|
+
const edges = [];
|
|
210
|
+
const nodeIndex = new Map();
|
|
211
|
+
const edgeKeys = new Set();
|
|
212
|
+
const addNode = (id, type, attrs) => {
|
|
213
|
+
if (nodeIndex.has(id)) {
|
|
214
|
+
return;
|
|
215
|
+
}
|
|
216
|
+
const payload = { id, type, ...(attrs || {}) };
|
|
217
|
+
nodeIndex.set(id, payload);
|
|
218
|
+
nodes.push(payload);
|
|
219
|
+
};
|
|
220
|
+
const addEdge = (from, to, type, attrs) => {
|
|
221
|
+
const key = `${from}|${to}|${type}`;
|
|
222
|
+
if (edgeKeys.has(key)) {
|
|
223
|
+
return;
|
|
224
|
+
}
|
|
225
|
+
edgeKeys.add(key);
|
|
226
|
+
edges.push({ from, to, type, ...(attrs || {}) });
|
|
227
|
+
};
|
|
228
|
+
for (const item of evidenceItems) {
|
|
229
|
+
const evidenceId = String(item.evidence_id || '').trim();
|
|
230
|
+
if (!evidenceId) {
|
|
231
|
+
continue;
|
|
232
|
+
}
|
|
233
|
+
const evidenceNodeId = `evidence:${evidenceId}`;
|
|
234
|
+
addNode(evidenceNodeId, 'evidence', {
|
|
235
|
+
evidence_id: evidenceId,
|
|
236
|
+
title: item.title,
|
|
237
|
+
source: item.source,
|
|
238
|
+
category: item.category,
|
|
239
|
+
collected_at: item.collected_at,
|
|
240
|
+
status: item.status,
|
|
241
|
+
});
|
|
242
|
+
for (const controlId of normalizeList(item.control_ids)) {
|
|
243
|
+
const controlNodeId = `control:${controlId}`;
|
|
244
|
+
addNode(controlNodeId, 'control', { control_id: controlId });
|
|
245
|
+
addEdge(evidenceNodeId, controlNodeId, 'satisfies');
|
|
246
|
+
}
|
|
247
|
+
const metadata = item.metadata && typeof item.metadata === 'object'
|
|
248
|
+
? item.metadata
|
|
249
|
+
: {};
|
|
250
|
+
const nestedMeta = metadata.metadata && typeof metadata.metadata === 'object'
|
|
251
|
+
? metadata.metadata
|
|
252
|
+
: {};
|
|
253
|
+
const workflowIds = [
|
|
254
|
+
...extractMetadataValues(metadata, ['workflow_id']),
|
|
255
|
+
...extractMetadataValues(nestedMeta, ['workflow_id']),
|
|
256
|
+
];
|
|
257
|
+
for (const workflowId of new Set(workflowIds)) {
|
|
258
|
+
const workflowNodeId = `workflow:${workflowId}`;
|
|
259
|
+
addNode(workflowNodeId, 'workflow', { workflow_id: workflowId });
|
|
260
|
+
addEdge(evidenceNodeId, workflowNodeId, 'workflow');
|
|
261
|
+
}
|
|
262
|
+
const systemIds = [
|
|
263
|
+
...extractMetadataValues(metadata, ['system_id', 'system']),
|
|
264
|
+
...extractMetadataValues(nestedMeta, ['system_id', 'system', 'systems']),
|
|
265
|
+
];
|
|
266
|
+
if (item.system_id) {
|
|
267
|
+
systemIds.push(String(item.system_id));
|
|
268
|
+
}
|
|
269
|
+
else if (item.system) {
|
|
270
|
+
systemIds.push(String(item.system));
|
|
271
|
+
}
|
|
272
|
+
for (const systemId of new Set(systemIds)) {
|
|
273
|
+
const systemNodeId = `system:${systemId}`;
|
|
274
|
+
addNode(systemNodeId, 'system', { system_id: systemId });
|
|
275
|
+
addEdge(evidenceNodeId, systemNodeId, 'system');
|
|
276
|
+
}
|
|
277
|
+
const eventIds = [
|
|
278
|
+
...extractMetadataValues(metadata, ['event_id', 'event_ids', 'evidence_event_ids', 'source_event_ids']),
|
|
279
|
+
...extractMetadataValues(nestedMeta, ['event_id', 'event_ids', 'evidence_event_ids', 'source_event_ids']),
|
|
280
|
+
];
|
|
281
|
+
const traceIds = [
|
|
282
|
+
...extractMetadataValues(metadata, ['trace_id', 'trace_ids']),
|
|
283
|
+
...extractMetadataValues(nestedMeta, ['trace_id', 'trace_ids']),
|
|
284
|
+
];
|
|
285
|
+
for (const eventId of new Set(eventIds)) {
|
|
286
|
+
const eventNodeId = `event:${eventId}`;
|
|
287
|
+
addNode(eventNodeId, 'event', { event_id: eventId });
|
|
288
|
+
addEdge(evidenceNodeId, eventNodeId, 'evidence_event');
|
|
289
|
+
for (const traceId of new Set(traceIds)) {
|
|
290
|
+
const traceNodeId = `trace:${traceId}`;
|
|
291
|
+
addNode(traceNodeId, 'trace', { trace_id: traceId });
|
|
292
|
+
addEdge(eventNodeId, traceNodeId, 'trace');
|
|
293
|
+
}
|
|
294
|
+
}
|
|
295
|
+
for (const traceId of new Set(traceIds)) {
|
|
296
|
+
const traceNodeId = `trace:${traceId}`;
|
|
297
|
+
addNode(traceNodeId, 'trace', { trace_id: traceId });
|
|
298
|
+
addEdge(evidenceNodeId, traceNodeId, 'trace');
|
|
299
|
+
}
|
|
300
|
+
const artifacts = Array.isArray(item.artifacts) ? item.artifacts : [];
|
|
301
|
+
for (const artifact of artifacts) {
|
|
302
|
+
const artifactId = artifact.sha256 || artifact.path;
|
|
303
|
+
if (!artifactId) {
|
|
304
|
+
continue;
|
|
305
|
+
}
|
|
306
|
+
const artifactNodeId = `artifact:${artifactId}`;
|
|
307
|
+
addNode(artifactNodeId, 'artifact', {
|
|
308
|
+
sha256: artifact.sha256,
|
|
309
|
+
path: artifact.path,
|
|
310
|
+
size_bytes: artifact.size_bytes,
|
|
311
|
+
content_type: artifact.content_type,
|
|
312
|
+
collected_at: artifact.collected_at,
|
|
313
|
+
});
|
|
314
|
+
addEdge(evidenceNodeId, artifactNodeId, 'artifact');
|
|
315
|
+
}
|
|
316
|
+
}
|
|
317
|
+
const nodeCounts = {};
|
|
318
|
+
for (const node of nodes) {
|
|
319
|
+
const type = String(node.type || 'unknown');
|
|
320
|
+
nodeCounts[type] = (nodeCounts[type] || 0) + 1;
|
|
321
|
+
}
|
|
322
|
+
return {
|
|
323
|
+
graph_type: 'evidence_lineage',
|
|
324
|
+
generated_at: utcNow(),
|
|
325
|
+
node_counts: nodeCounts,
|
|
326
|
+
nodes,
|
|
327
|
+
edges,
|
|
328
|
+
};
|
|
329
|
+
}
|
|
330
|
+
function buildHashedEvidenceManifest(options) {
|
|
331
|
+
const includeLineage = options.includeLineage !== false;
|
|
332
|
+
const includeHashChain = options.includeHashChain !== false;
|
|
333
|
+
const manifest = {
|
|
334
|
+
manifest_type: 'evidence_manifest',
|
|
335
|
+
manifest_version: '1.0.0',
|
|
336
|
+
standard: options.standard,
|
|
337
|
+
generated_at: options.generatedAt || utcNow(),
|
|
338
|
+
scope: options.scope,
|
|
339
|
+
generated_by: options.generatedBy,
|
|
340
|
+
notes: options.notes,
|
|
341
|
+
evidence_items: options.evidenceItems,
|
|
342
|
+
};
|
|
343
|
+
if (includeHashChain) {
|
|
344
|
+
manifest.hash_chain = buildEvidenceHashChain(options.evidenceItems, {
|
|
345
|
+
algorithm: options.hashAlgorithm,
|
|
346
|
+
});
|
|
347
|
+
}
|
|
348
|
+
if (includeLineage) {
|
|
349
|
+
manifest.lineage_graph = buildEvidenceLineageGraph(options.evidenceItems);
|
|
350
|
+
}
|
|
351
|
+
return manifest;
|
|
352
|
+
}
|
|
353
|
+
function ensureEvidenceRecord(payload) {
|
|
354
|
+
const evidence = clone(payload || {});
|
|
355
|
+
if (!evidence.evidence_id) {
|
|
356
|
+
evidence.evidence_id = buildId('evd', evidence.title || 'evidence');
|
|
357
|
+
}
|
|
358
|
+
if (!evidence.title) {
|
|
359
|
+
evidence.title = `Evidence for ${evidence.evidence_id}`;
|
|
360
|
+
}
|
|
361
|
+
if (!evidence.source) {
|
|
362
|
+
evidence.source = 'manual';
|
|
363
|
+
}
|
|
364
|
+
if (!evidence.category) {
|
|
365
|
+
evidence.category = 'evidence';
|
|
366
|
+
}
|
|
367
|
+
if (!evidence.collection_method) {
|
|
368
|
+
evidence.collection_method = 'manual';
|
|
369
|
+
}
|
|
370
|
+
if (!evidence.collected_at) {
|
|
371
|
+
evidence.collected_at = utcNow();
|
|
372
|
+
}
|
|
373
|
+
const controlIds = new Set(normalizeList(evidence.control_ids));
|
|
374
|
+
evidence.control_ids = Array.from(controlIds).sort();
|
|
375
|
+
if (!evidence.metadata || typeof evidence.metadata !== 'object') {
|
|
376
|
+
evidence.metadata = {};
|
|
377
|
+
}
|
|
378
|
+
if (!evidence.status) {
|
|
379
|
+
evidence.status = 'collected';
|
|
380
|
+
}
|
|
381
|
+
return evidence;
|
|
382
|
+
}
|
|
383
|
+
class EvidenceStore {
|
|
384
|
+
constructor(options) {
|
|
385
|
+
this.algorithm = validateAlgorithm(options?.hashAlgorithm);
|
|
386
|
+
this.items = new Map();
|
|
387
|
+
}
|
|
388
|
+
clear() {
|
|
389
|
+
this.items = new Map();
|
|
390
|
+
}
|
|
391
|
+
addEvidence(item) {
|
|
392
|
+
const evidence = ensureEvidenceRecord(item);
|
|
393
|
+
this.items.set(String(evidence.evidence_id), clone(evidence));
|
|
394
|
+
return clone(evidence);
|
|
395
|
+
}
|
|
396
|
+
addMany(items) {
|
|
397
|
+
return items.map((item) => this.addEvidence(item));
|
|
398
|
+
}
|
|
399
|
+
listItems() {
|
|
400
|
+
return Array.from(this.items.values()).map((item) => clone(item));
|
|
401
|
+
}
|
|
402
|
+
get(evidenceId) {
|
|
403
|
+
const stored = this.items.get(evidenceId);
|
|
404
|
+
return stored ? clone(stored) : null;
|
|
405
|
+
}
|
|
406
|
+
buildManifest(options) {
|
|
407
|
+
return buildHashedEvidenceManifest({
|
|
408
|
+
standard: options.standard,
|
|
409
|
+
evidenceItems: this.listItems(),
|
|
410
|
+
scope: options.scope,
|
|
411
|
+
generatedBy: options.generatedBy,
|
|
412
|
+
notes: options.notes,
|
|
413
|
+
includeLineage: options.includeLineage,
|
|
414
|
+
includeHashChain: options.includeHashChain,
|
|
415
|
+
hashAlgorithm: this.algorithm,
|
|
416
|
+
});
|
|
417
|
+
}
|
|
418
|
+
getHashAlgorithm() {
|
|
419
|
+
return this.algorithm;
|
|
420
|
+
}
|
|
421
|
+
}
|
|
422
|
+
exports.EvidenceStore = EvidenceStore;
|
|
423
|
+
let runtimeEvidenceStore = new EvidenceStore();
|
|
424
|
+
function getRuntimeEvidenceStore() {
|
|
425
|
+
return runtimeEvidenceStore;
|
|
426
|
+
}
|
|
427
|
+
function clearRuntimeEvidenceStore() {
|
|
428
|
+
runtimeEvidenceStore.clear();
|
|
429
|
+
}
|
|
430
|
+
function recordRuntimeEvidence(item) {
|
|
431
|
+
return runtimeEvidenceStore.addEvidence(item);
|
|
432
|
+
}
|
|
433
|
+
function buildRuntimeEvidenceManifest(options) {
|
|
434
|
+
const manifest = buildHashedEvidenceManifest({
|
|
435
|
+
standard: options?.standard || 'ISO42001',
|
|
436
|
+
evidenceItems: runtimeEvidenceStore.listItems(),
|
|
437
|
+
scope: options?.scope,
|
|
438
|
+
generatedBy: options?.generatedBy,
|
|
439
|
+
notes: options?.notes,
|
|
440
|
+
includeLineage: options?.includeLineage !== false,
|
|
441
|
+
includeHashChain: options?.includeHashChain !== false,
|
|
442
|
+
hashAlgorithm: runtimeEvidenceStore.getHashAlgorithm(),
|
|
443
|
+
});
|
|
444
|
+
if (options?.includeControlWorkflowState !== false) {
|
|
445
|
+
// Lazy require to avoid circular imports
|
|
446
|
+
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
447
|
+
const { buildWorkflowStatePayload } = require('./control_backbone');
|
|
448
|
+
manifest.control_workflow_state = buildWorkflowStatePayload({
|
|
449
|
+
catalog: options?.controlCatalog,
|
|
450
|
+
evidenceItems: manifest.evidence_items,
|
|
451
|
+
});
|
|
452
|
+
}
|
|
453
|
+
if (options?.includeAimsGovernanceState !== false) {
|
|
454
|
+
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
455
|
+
const { buildAimsGovernanceStatePayload } = require('./aims_governance');
|
|
456
|
+
manifest.aims_governance_state = buildAimsGovernanceStatePayload();
|
|
457
|
+
}
|
|
458
|
+
return manifest;
|
|
459
|
+
}
|
|
@@ -9,23 +9,80 @@ export interface ComplianceScoreResult {
|
|
|
9
9
|
grade: string;
|
|
10
10
|
breakdown: Record<string, number>;
|
|
11
11
|
max_score: number;
|
|
12
|
+
framework?: string;
|
|
12
13
|
}
|
|
14
|
+
/**
|
|
15
|
+
* Framework-specific compliance weighting profiles.
|
|
16
|
+
*
|
|
17
|
+
* Each framework has different priorities for governance controls.
|
|
18
|
+
*/
|
|
19
|
+
export interface FrameworkWeights {
|
|
20
|
+
/** Weight for policy violations (default: 10 per violation) */
|
|
21
|
+
policyViolation: number;
|
|
22
|
+
/** Maximum penalty for policy violations */
|
|
23
|
+
maxPolicyPenalty: number;
|
|
24
|
+
/** Penalty for failed chain integrity */
|
|
25
|
+
chainIntegrityFailed: number;
|
|
26
|
+
/** Penalty for disabled chain integrity */
|
|
27
|
+
chainIntegrityDisabled: number;
|
|
28
|
+
/** Bonus for enabled signing */
|
|
29
|
+
signingEnabled: number;
|
|
30
|
+
/** Penalty for disabled signing */
|
|
31
|
+
signingDisabled: number;
|
|
32
|
+
/** Bonus for enabled WAL */
|
|
33
|
+
walEnabled: number;
|
|
34
|
+
/** Penalty for disabled WAL */
|
|
35
|
+
walDisabled: number;
|
|
36
|
+
/** Penalty per unknown model */
|
|
37
|
+
unknownModel: number;
|
|
38
|
+
/** Maximum penalty for unknown models */
|
|
39
|
+
maxUnknownPenalty: number;
|
|
40
|
+
/** Bonus for enabled data handling */
|
|
41
|
+
dataHandlingEnabled: number;
|
|
42
|
+
/** Penalty for disabled data handling */
|
|
43
|
+
dataHandlingDisabled: number;
|
|
44
|
+
/** Bonus for enabled AI Act compliance */
|
|
45
|
+
aiActEnabled: number;
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Framework-specific weight profiles.
|
|
49
|
+
*/
|
|
50
|
+
export declare const FRAMEWORK_WEIGHTS: Record<string, FrameworkWeights>;
|
|
51
|
+
/**
|
|
52
|
+
* Get weights for a specific compliance framework.
|
|
53
|
+
*/
|
|
54
|
+
export declare function getFrameworkWeights(framework?: string): FrameworkWeights;
|
|
13
55
|
/**
|
|
14
56
|
* Calculate compliance score (0-100) based on governance controls.
|
|
15
57
|
*
|
|
16
|
-
* Scoring
|
|
17
|
-
*
|
|
18
|
-
*
|
|
19
|
-
*
|
|
20
|
-
* -
|
|
21
|
-
*
|
|
22
|
-
*
|
|
58
|
+
* Scoring uses framework-specific weights when a compliance framework is specified.
|
|
59
|
+
* Supported frameworks: soc2, gdpr, hipaa, ai_act, iso27001, pci_dss
|
|
60
|
+
*
|
|
61
|
+
* @param report - The compliance report data
|
|
62
|
+
* @param chainStatus - Status of hash chain ('verified', 'failed', 'disabled')
|
|
63
|
+
* @param config - Monora configuration
|
|
64
|
+
* @param framework - Optional compliance framework for weighted scoring
|
|
23
65
|
*/
|
|
24
|
-
export declare function calculateComplianceScore(report: Record<string, any>, chainStatus: string, config: MonoraConfig): ComplianceScoreResult;
|
|
66
|
+
export declare function calculateComplianceScore(report: Record<string, any>, chainStatus: string, config: MonoraConfig, framework?: string): ComplianceScoreResult;
|
|
25
67
|
/**
|
|
26
68
|
* Generate a one-page Markdown executive summary.
|
|
27
69
|
*/
|
|
28
70
|
export declare function generateExecutiveSummary(report: Record<string, any>, events: Array<Record<string, any>>, chainStatus: string, config: MonoraConfig, traceId?: string): string;
|
|
71
|
+
/**
|
|
72
|
+
* Compliance control evidence mapping.
|
|
73
|
+
*/
|
|
74
|
+
export interface ComplianceControlEvidence {
|
|
75
|
+
controlId: string;
|
|
76
|
+
controlName: string;
|
|
77
|
+
framework: string;
|
|
78
|
+
eventTypes: string[];
|
|
79
|
+
eventCount: number;
|
|
80
|
+
sampleEventIds: string[];
|
|
81
|
+
}
|
|
82
|
+
/**
|
|
83
|
+
* Generate evidence mapping for compliance controls.
|
|
84
|
+
*/
|
|
85
|
+
export declare function generateEvidenceMapping(events: Array<Record<string, any>>, framework?: string): ComplianceControlEvidence[];
|
|
29
86
|
/**
|
|
30
87
|
* Write executive summary to a file.
|
|
31
88
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"executiveSummary.d.ts","sourceRoot":"","sources":["../src/executiveSummary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"executiveSummary.d.ts","sourceRoot":"","sources":["../src/executiveSummary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IACzB,yCAAyC;IACzC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2CAA2C;IAC3C,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sCAAsC;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;CACtB;AAqBD;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAwG9D,CAAC;AAEF;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAMxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,YAAY,EACpB,SAAS,CAAC,EAAE,MAAM,GACjB,qBAAqB,CAsGvB;AA4CD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CA+LR;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AA0CD;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,yBAAyB,EAAE,CAoD7B;AAsCD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAcf"}
|