nsauditor-ai 0.1.72 → 0.1.74

package/README.md

@@ -17,10 +17,11 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.1.72 + Enterprise 0.11.0** (May 2026)
+**Latest: CE 0.1.74 + Enterprise 0.12.0** (May 2026)
 
-- 🆕 **PCI DSS v4.0.1** (PCI SSC, June 2024 errata) is now the fourth supported compliance framework in Enterprise — alongside SOC 2, HIPAA, and NIST CSF 2.0. Sub-requirement-level mapping (auditor-canonical for QSA Report on Compliance workflow): 20 covered + 8 partial + 39 OOS across 67 of ~250 sub-requirements (MVP-67). Generate evidence for any combination from a single scan: `--compliance soc2,hipaa,nist-csf,pci-dss` (Enterprise only).
-- 💳 **Defined-vs-Customized Approach discipline per PCI DSS v4.0.1 Appendix E** — 15 Defined-only sub-requirements enforced at schema layer. **Cardholder Data Environment (CDE) scope operator-attested** via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. **Card-brand AOC enforcement priority view** (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC).
+- 🆕 **ISO/IEC 27001:2022** (ISO + IEC, October 2022 — 2013 edition retired October 31, 2025) is now the fifth supported compliance framework in Enterprise — alongside SOC 2, HIPAA, NIST CSF 2.0, and PCI DSS v4.0.1. Per-Annex-A-code mapping (auditor-canonical for ISO/IEC 17021-1 certification body assessors walking Stage 1 / Stage 2 / annual surveillance / 3-year recertification): 17 covered + 14 partial + 62 OOS across 93 Annex A controls — the complete Annex A universe across 4 themes (A.5 Organizational 37 + A.6 People 8 + A.7 Physical 14 + A.8 Technological 34). 11 NEW 2022 controls explicitly enumerated (3 covered + 2 partial + 6 OOS). Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design framing + 5-attribute taxonomy. Generate evidence for any combination from a single scan: `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001` (Enterprise only).
+- 💳 **PCI DSS v4.0.1** (added in EE 0.11.0) — Defined-vs-Customized Approach discipline per Appendix E. CDE scope operator-attested. Card-brand AOC enforcement priority view (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC).
+- 📋 **Statement of Applicability per Clause 6.1.3.d discipline** for ISO 27001:2022 — engine produces substrate for INCLUDED controls; SoA inclusion/exclusion is operator-side. **ISMS Clauses 4-10 OOS-by-design** with 7 Major Nonconformity classes (absence of internal audit per Clause 9.2 or management review per Clause 9.3 = auto-fail Stage 2). Skill #18 `audit-iso-27001-2022-statement-of-applicability` authored 2026-05-24 via /skill-creator (Per-Framework Adversarial-Audit Skill Pairing institutional pattern).
 - ⚡ **NIST Cybersecurity Framework 2.0** (added in EE 0.10.0) — 13 covered + 10 partial + 83 OOS Subcategories across 106 of CSF 2.0's 107 Subcategories.
 - 🏥 **HIPAA Security Rule §164.312** (added in EE 0.9.0) — Zero BAA required; your ePHI never leaves your infrastructure.
 - ☁️ **24 cloud plugins** across AWS, Azure, GCP — fully integrated SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 evidence pipeline (Enterprise).
@@ -66,7 +67,7 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, or PCI DSS audit** — or
 - 🔗 **Native GRC platform integration** — push evidence directly to **Vanta** (live; Drata + Secureframe planned). Idempotent retries, per-tenant token rotation, rate-limit handling, signed-envelope round-trip integrity.
 - 🗄️ **WORM evidence storage** — S3 Object Lock COMPLIANCE-mode for SEC Rule 17a-4(f) / FINRA 4511 retention compliance
 - 📊 **SLA / MTTR tracking + recurring-scan attestation** — the **Type II operating-effectiveness evidence** auditors actually demand (not just point-in-time snapshots)
-- 🎯 **8 adversarial-audit Claude Code skills** authored per the NEW Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 5-of-5 COMPLETE for shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + GRC connector)
+- 🎯 **9 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 6-of-6 COMPLETE for shipped + in-flight frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + GRC connector)
 
 → **[See sample EE scan output](https://www.nsauditor.com/ai/docs/sample-scan/)** — full evidence pack against synthetic Acme Corp AWS account (no signup required)
 → **[Buy NSAuditor AI Enterprise Edition](https://www.nsauditor.com/ai/pricing/)** — $2k / $5k / $10k+ per year for 5 / 25 / unlimited seats + custom SLA. Onboarding call included.
@@ -572,7 +573,7 @@ nsauditor-ai --version     (or -v, or `version`)
 | `--interval <min>` | Rescan interval in minutes (requires `--watch`) | `60` |
 | `--webhook-url <url>` | Webhook URL for delta alerts | — |
 | `--alert-severity <sev>` | Minimum severity for webhook alerts | `high` |
-| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, or any combination like `soc2,hipaa,nist-csf,pci-dss`). **Enterprise license required.** Supported frameworks as of EE 0.11.0: `soc2` (AICPA TSC 2017) + `hipaa` (HIPAA Security Rule §164.312 Technical Safeguards) + `nist-csf` (NIST Cybersecurity Framework 2.0 Core, CSWP 29 Feb 2024) + `pci-dss` (PCI DSS v4.0.1, PCI SSC June 2024 errata). See `@nsasoft/nsauditor-ai-ee` README for per-framework coverage details. | — |
+| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, `iso-27001`, or any combination like `soc2,hipaa,nist-csf,pci-dss,iso-27001`). **Enterprise license required.** Supported frameworks as of EE 0.12.0: `soc2` (AICPA TSC 2017) + `hipaa` (HIPAA Security Rule §164.312 Technical Safeguards) + `nist-csf` (NIST Cybersecurity Framework 2.0 Core, CSWP 29 Feb 2024) + `pci-dss` (PCI DSS v4.0.1, PCI SSC June 2024 errata) + `iso-27001` (ISO/IEC 27001:2022, ISO + IEC October 2022). See `@nsasoft/nsauditor-ai-ee` README for per-framework coverage details. | — |
 | `--compliance-scope <path>` | Optional JSON file describing the assessment scope (passed to the compliance engine for cover-page attestation) | — |
 | `--help`, `-h` | Print usage block (subcommands, flags, env vars, examples) and exit 0 | — |
 | `--version`, `-v` | Print `nsauditor-ai <version>` and exit 0 | — |

package/cli.mjs

@@ -1038,6 +1038,84 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       console.log('── Installation provenance ──');
       console.log(`  nsauditor-ai (CE):              ${ceVersion}`);
       console.log(`  @nsasoft/nsauditor-ai-ee (EE):  ${eeVersion}`);
+    } else if (rawArgs.includes('--reset')) {
+      // CE-0.1.73 — atomic dual-channel license-state reset for macOS
+      // license-rotation flow. Discovered EE 0.11.0 first-install
+      // rehearsal (2026-05-23): customer rotates EE license, gets
+      // `license_id_mismatch` because the persisted licenseId binding
+      // (from a prior install) doesn't match the new JWT's licenseId.
+      //
+      // Single-surface clearing ("rm ~/.nsauditor/license-state.json")
+      // is a HALF-fix on macOS — _readLicenseState (license.mjs:402-434)
+      // ALSO reads from Keychain NSAUDITOR_LICENSE_ID, and Keychain wins
+      // on read (license.mjs:429: `state.licenseId = kcId; // Keychain
+      // wins`). Customer must additionally run
+      // `security delete-generic-password -s nsauditor-ai -a
+      // NSAUDITOR_LICENSE_ID` for the replay-defense check
+      // (license.mjs:664-670) to pass. This subcommand does both
+      // atomically so customers don't have to run cryptic `security`
+      // commands blind from a support email.
+      //
+      // Default: preserves NSAUDITOR_LICENSE_KEY (the JWT itself) for
+      // immediate re-activation on next license check. --purge also
+      // removes the JWT (forces full re-install with `license install`).
+      const purge = rawArgs.includes('--purge');
+      const { _getLicenseStateFilePath } = await import('./utils/license.mjs');
+      const { keychainDelete } = await import('./utils/keychain.mjs');
+      const fsp = await import('fs/promises');
+
+      const cleared = { stateFile: false, keychainId: false, jwtPurged: false };
+
+      // 1. Delete license-state.json (cross-platform path resolver).
+      const statePath = _getLicenseStateFilePath();
+      try {
+        await fsp.unlink(statePath);
+        cleared.stateFile = true;
+      } catch (e) {
+        if (e && e.code !== 'ENOENT') {
+          console.warn(`⚠  Could not delete ${statePath}: ${e.message}`);
+        }
+      }
+
+      // 2. Delete macOS Keychain NSAUDITOR_LICENSE_ID entry. Linux /
+      //    Windows have no Keychain side-channel — file delete is
+      //    sufficient there.
+      if (process.platform === 'darwin') {
+        try {
+          cleared.keychainId = await keychainDelete('NSAUDITOR_LICENSE_ID');
+        } catch { /* not fatal — file delete is the primary surface */ }
+      }
+
+      // 3. Optionally purge the JWT itself (forces full re-install).
+      //    Darwin-only for now; file-based JWT purge on Linux/Windows
+      //    requires editing ~/.nsauditor/.env which we leave to the
+      //    operator (deleting the file would also remove unrelated env
+      //    vars the operator may have placed there).
+      if (purge && process.platform === 'darwin') {
+        try {
+          cleared.jwtPurged = await keychainDelete('NSAUDITOR_LICENSE_KEY');
+        } catch { /* not fatal */ }
+      }
+
+      console.log('✓ License state reset');
+      console.log(`  License state file: ${cleared.stateFile ? 'deleted (' + statePath + ')' : 'not found (already clean)'}`);
+      if (process.platform === 'darwin') {
+        console.log(`  Keychain NSAUDITOR_LICENSE_ID: ${cleared.keychainId ? 'deleted' : 'not found (already clean)'}`);
+      }
+      if (purge) {
+        if (process.platform === 'darwin') {
+          console.log(`  Keychain NSAUDITOR_LICENSE_KEY (JWT): ${cleared.jwtPurged ? 'purged' : 'not found (already clean)'}`);
+        } else {
+          console.log('  JWT (NSAUDITOR_LICENSE_KEY): file-based JWT not purged on this platform — remove the NSAUDITOR_LICENSE_KEY line manually from ~/.nsauditor/.env if needed.');
+        }
+        console.log('');
+        console.log('  Re-install with: nsauditor-ai license install <KEY>');
+      } else {
+        console.log('  JWT (NSAUDITOR_LICENSE_KEY): preserved (default) — next license check will re-bind.');
+        console.log('');
+        console.log('  Verify with: nsauditor-ai license --status');
+        console.log('  (Add --purge to additionally clear the JWT for full uninstall.)');
+      }
     } else if (rawArgs.includes('install')) {
       // CE-0.1.30.4 — install command. Verify the JWT FIRST, then persist
       // to a platform-appropriate location (macOS Keychain / file).
@@ -1099,7 +1177,7 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       console.log('');
       console.log('  Verify with: nsauditor-ai license --status');
     } else {
-      console.log('Usage: nsauditor-ai license --status | --capabilities | --plugins | install <KEY>');
+      console.log('Usage: nsauditor-ai license --status | --capabilities | --plugins | install <KEY> | --reset [--purge]');
     }
     process.exit(0);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.1.72",
+  "version": "0.1.74",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,