vaspera 2.5.0

package/dist/compliance/iso27001.d.ts

@@ -0,0 +1,30 @@
+/**
+ * ISO 27001:2022 Annex A Controls
+ *
+ * ISO 27001 controls mapped to security finding categories.
+ * Based on ISO/IEC 27001:2022 Annex A.
+ *
+ * @module compliance/iso27001
+ */
+import type { ComplianceControl } from "./types.js";
+/**
+ * ISO 27001 Annex A Controls relevant to code security
+ */
+export declare const ISO27001_CONTROLS: ComplianceControl[];
+/**
+ * Get all ISO 27001 controls
+ */
+export declare function getISO27001Controls(): ComplianceControl[];
+/**
+ * Get ISO 27001 controls by category
+ */
+export declare function getISO27001ControlsByCategory(category: string): ComplianceControl[];
+/**
+ * Get ISO 27001 control by ID
+ */
+export declare function getISO27001ControlById(id: string): ComplianceControl | undefined;
+/**
+ * Get ISO 27001 categories
+ */
+export declare function getISO27001Categories(): string[];
+//# sourceMappingURL=iso27001.d.ts.map

package/dist/compliance/iso27001.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso27001.d.ts","sourceRoot":"","sources":["../../src/compliance/iso27001.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBAAiB,EAmUhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,EAAE,CAEzD;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAEnF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAEhF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAEhD"}

package/dist/compliance/iso27001.js

@@ -0,0 +1,332 @@
+/**
+ * ISO 27001:2022 Annex A Controls
+ *
+ * ISO 27001 controls mapped to security finding categories.
+ * Based on ISO/IEC 27001:2022 Annex A.
+ *
+ * @module compliance/iso27001
+ */
+/**
+ * ISO 27001 Annex A Controls relevant to code security
+ */
+export const ISO27001_CONTROLS = [
+    // A.5 Organizational Controls
+    {
+        id: "A.5.1",
+        framework: "ISO27001",
+        category: "Organizational Controls",
+        title: "Policies for Information Security",
+        description: "Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel.",
+        keywords: ["policy", "security policy", "guidelines"],
+        findingCategories: ["security-misconfiguration"],
+        severityThreshold: "low",
+    },
+    {
+        id: "A.5.7",
+        framework: "ISO27001",
+        category: "Organizational Controls",
+        title: "Threat Intelligence",
+        description: "Information relating to information security threats shall be collected and analyzed to produce threat intelligence.",
+        keywords: ["threat intelligence", "vulnerability", "CVE", "security advisory"],
+        findingCategories: ["dependency-vuln"],
+        cweIds: ["CWE-1035"],
+        severityThreshold: "medium",
+    },
+    // A.8 Technological Controls
+    {
+        id: "A.8.2",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Privileged Access Rights",
+        description: "The allocation and use of privileged access rights shall be restricted and managed.",
+        keywords: ["privileged access", "admin", "root", "sudo", "elevation"],
+        findingCategories: ["auth-bypass", "broken-access-control"],
+        cweIds: ["CWE-250", "CWE-269"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.3",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Information Access Restriction",
+        description: "Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.",
+        keywords: ["access control", "authorization", "permissions"],
+        findingCategories: ["broken-access-control", "auth-bypass", "rls-bypass"],
+        cweIds: ["CWE-862", "CWE-863"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.4",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Access to Source Code",
+        description: "Read and write access to source code, development tools and software libraries shall be appropriately managed.",
+        keywords: ["source code", "repository", "git", "version control"],
+        findingCategories: ["secrets"],
+        cweIds: ["CWE-798"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.5",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Secure Authentication",
+        description: "Secure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control.",
+        keywords: ["authentication", "login", "password", "MFA", "2FA"],
+        findingCategories: ["auth-bypass", "weak-password"],
+        cweIds: ["CWE-287", "CWE-521"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.6",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Capacity Management",
+        description: "The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.",
+        keywords: ["capacity", "resource", "performance", "DoS"],
+        findingCategories: ["resource-exhaustion", "denial-of-service"],
+        cweIds: ["CWE-400", "CWE-770"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.7",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Protection Against Malware",
+        description: "Protection against malware shall be implemented and supported by appropriate user awareness.",
+        keywords: ["malware", "virus", "injection", "XSS"],
+        findingCategories: ["xss", "sql-injection", "command-injection", "code-injection"],
+        cweIds: ["CWE-79", "CWE-89", "CWE-78", "CWE-94"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.8",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Management of Technical Vulnerabilities",
+        description: "Information about technical vulnerabilities of information systems in use shall be obtained, the organization's exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken.",
+        keywords: ["vulnerability", "patch", "CVE", "security update"],
+        findingCategories: ["dependency-vuln"],
+        cweIds: ["CWE-1035"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.9",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Configuration Management",
+        description: "Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.",
+        keywords: ["configuration", "hardening", "baseline", "settings"],
+        findingCategories: ["security-misconfiguration"],
+        cweIds: ["CWE-16", "CWE-1188"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.10",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Information Deletion",
+        description: "Information stored in information systems, devices or in any other storage media shall be deleted when no longer required.",
+        keywords: ["data deletion", "secure delete", "data retention"],
+        findingCategories: ["data-exposure"],
+        cweIds: ["CWE-212", "CWE-226"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.11",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Data Masking",
+        description: "Data masking shall be used in accordance with the organization's topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.",
+        keywords: ["data masking", "anonymization", "PII", "sensitive data"],
+        findingCategories: ["data-exposure", "secrets"],
+        cweIds: ["CWE-200", "CWE-359"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.12",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Data Leakage Prevention",
+        description: "Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store or transmit sensitive information.",
+        keywords: ["DLP", "data leakage", "exfiltration", "sensitive data"],
+        findingCategories: ["data-exposure", "secrets", "ssrf"],
+        cweIds: ["CWE-200", "CWE-918"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.15",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Logging",
+        description: "Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analyzed.",
+        keywords: ["logging", "audit", "monitoring", "events"],
+        findingCategories: ["insufficient-logging"],
+        cweIds: ["CWE-778", "CWE-223"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.16",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Monitoring Activities",
+        description: "Networks, systems and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.",
+        keywords: ["monitoring", "anomaly detection", "alerting"],
+        findingCategories: ["insufficient-logging"],
+        cweIds: ["CWE-778"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.20",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Networks Security",
+        description: "Networks and network devices shall be secured, managed and controlled to protect information in systems and applications.",
+        keywords: ["network security", "firewall", "segmentation"],
+        findingCategories: ["ssrf", "security-misconfiguration"],
+        cweIds: ["CWE-918"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.21",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Security of Network Services",
+        description: "Security mechanisms, service levels and service requirements of network services shall be identified, implemented and monitored.",
+        keywords: ["network services", "API security", "service security"],
+        findingCategories: ["ssrf", "auth-bypass"],
+        cweIds: ["CWE-918", "CWE-287"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.24",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Use of Cryptography",
+        description: "Rules for the effective use of cryptography, including cryptographic key management, shall be defined and implemented.",
+        keywords: ["cryptography", "encryption", "keys", "TLS", "SSL"],
+        findingCategories: ["insecure-transmission", "weak-crypto"],
+        cweIds: ["CWE-327", "CWE-328", "CWE-319"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.25",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Secure Development Life Cycle",
+        description: "Rules for the secure development of software and systems shall be established and applied.",
+        keywords: ["SDLC", "secure development", "security by design"],
+        findingCategories: ["type-safety", "security-misconfiguration"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.26",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Application Security Requirements",
+        description: "Information security requirements shall be identified, specified and approved when developing or acquiring applications.",
+        keywords: ["application security", "security requirements", "secure coding"],
+        findingCategories: ["sql-injection", "xss", "auth-bypass"],
+        cweIds: ["CWE-89", "CWE-79", "CWE-287"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.27",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Secure System Architecture and Engineering Principles",
+        description: "Principles for engineering secure systems shall be established, documented, maintained and applied to any information system development activities.",
+        keywords: ["architecture", "secure design", "engineering"],
+        findingCategories: ["security-misconfiguration", "broken-access-control"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.28",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Secure Coding",
+        description: "Secure coding principles shall be applied to software development.",
+        keywords: ["secure coding", "OWASP", "input validation", "output encoding"],
+        findingCategories: ["sql-injection", "xss", "command-injection", "path-traversal"],
+        cweIds: ["CWE-89", "CWE-79", "CWE-78", "CWE-22"],
+        severityThreshold: "high",
+    },
+    {
+        id: "A.8.29",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Security Testing in Development and Acceptance",
+        description: "Security testing processes shall be defined and implemented in the development life cycle.",
+        keywords: ["security testing", "SAST", "DAST", "penetration testing"],
+        findingCategories: ["type-safety"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.30",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Outsourced Development",
+        description: "The organization shall direct, monitor and review the activities related to outsourced system development.",
+        keywords: ["outsourcing", "third-party", "vendor", "contractor"],
+        findingCategories: ["dependency-vuln"],
+        cweIds: ["CWE-1035"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.31",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Separation of Development, Test and Production Environments",
+        description: "Development, testing and production environments shall be separated and secured.",
+        keywords: ["environment separation", "dev", "test", "production"],
+        findingCategories: ["secrets", "security-misconfiguration"],
+        cweIds: ["CWE-798"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A.8.32",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Change Management",
+        description: "Changes to information processing facilities and information systems shall be subject to change management procedures.",
+        keywords: ["change management", "version control", "deployment"],
+        findingCategories: ["security-misconfiguration"],
+        severityThreshold: "low",
+    },
+    {
+        id: "A.8.33",
+        framework: "ISO27001",
+        category: "Technological Controls",
+        title: "Test Information",
+        description: "Test information shall be appropriately selected, protected and managed.",
+        keywords: ["test data", "test environment", "data protection"],
+        findingCategories: ["secrets", "data-exposure"],
+        cweIds: ["CWE-798"],
+        severityThreshold: "medium",
+    },
+];
+/**
+ * Get all ISO 27001 controls
+ */
+export function getISO27001Controls() {
+    return ISO27001_CONTROLS;
+}
+/**
+ * Get ISO 27001 controls by category
+ */
+export function getISO27001ControlsByCategory(category) {
+    return ISO27001_CONTROLS.filter((c) => c.category === category);
+}
+/**
+ * Get ISO 27001 control by ID
+ */
+export function getISO27001ControlById(id) {
+    return ISO27001_CONTROLS.find((c) => c.id === id);
+}
+/**
+ * Get ISO 27001 categories
+ */
+export function getISO27001Categories() {
+    return [...new Set(ISO27001_CONTROLS.map((c) => c.category))];
+}
+//# sourceMappingURL=iso27001.js.map

package/dist/compliance/iso27001.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso27001.js","sourceRoot":"","sources":["../../src/compliance/iso27001.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB;IACpD,8BAA8B;IAC9B;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,yBAAyB;QACnC,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,sKAAsK;QACxK,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,YAAY,CAAC;QACrD,iBAAiB,EAAE,CAAC,2BAA2B,CAAC;QAChD,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,yBAAyB;QACnC,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,sHAAsH;QACxH,QAAQ,EAAE,CAAC,qBAAqB,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,CAAC;QAC9E,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;QACtC,MAAM,EAAE,CAAC,UAAU,CAAC;QACpB,iBAAiB,EAAE,QAAQ;KAC5B;IAED,6BAA6B;IAC7B;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,qFAAqF;QACvF,QAAQ,EAAE,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC;QACrE,iBAAiB,EAAE,CAAC,aAAa,EAAE,uBAAuB,CAAC;QAC3D,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,mJAAmJ;QACrJ,QAAQ,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,aAAa,CAAC;QAC5D,iBAAiB,EAAE,CAAC,uBAAuB,EAAE,aAAa,EAAE,YAAY,CAAC;QACzE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,gHAAgH;QAClH,QAAQ,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,CAAC;QACjE,iBAAiB,EAAE,CAAC,SAAS,CAAC;QAC9B,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,kKAAkK;QACpK,QAAQ,EAAE,CAAC,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;QAC/D,iBAAiB,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,+GAA+G;QACjH,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC;QACxD,iBAAiB,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;QAC/D,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,8FAA8F;QAChG,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC;QAClD,iBAAiB,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAClF,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChD,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,yCAAyC;QAChD,WAAW,EACT,8MAA8M;QAChN,QAAQ,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC;QAC9D,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;QACtC,MAAM,EAAE,CAAC,UAAU,CAAC;QACpB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,wKAAwK;QAC1K,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC;QAChE,iBAAiB,EAAE,CAAC,2BAA2B,CAAC;QAChD,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,4HAA4H;QAC9H,QAAQ,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;QAC9D,iBAAiB,EAAE,CAAC,eAAe,CAAC;QACpC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,kOAAkO;QACpO,QAAQ,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,CAAC;QACpE,iBAAiB,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,qJAAqJ;QACvJ,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,CAAC;QACnE,iBAAiB,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC;QACvD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,8HAA8H;QAChI,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC;QACtD,iBAAiB,EAAE,CAAC,sBAAsB,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,kKAAkK;QACpK,QAAQ,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,UAAU,CAAC;QACzD,iBAAiB,EAAE,CAAC,sBAAsB,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,2HAA2H;QAC7H,QAAQ,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,cAAc,CAAC;QAC1D,iBAAiB,EAAE,CAAC,MAAM,EAAE,2BAA2B,CAAC;QACxD,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,kIAAkI;QACpI,QAAQ,EAAE,CAAC,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,CAAC;QAClE,iBAAiB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;QAC1C,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,wHAAwH;QAC1H,QAAQ,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAC9D,iBAAiB,EAAE,CAAC,uBAAuB,EAAE,aAAa,CAAC;QAC3D,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QACzC,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,4FAA4F;QAC9F,QAAQ,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,oBAAoB,CAAC;QAC9D,iBAAiB,EAAE,CAAC,aAAa,EAAE,2BAA2B,CAAC;QAC/D,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,0HAA0H;QAC5H,QAAQ,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,CAAC;QAC5E,iBAAiB,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC;QAC1D,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;QACvC,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,uDAAuD;QAC9D,WAAW,EACT,sJAAsJ;QACxJ,QAAQ,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,aAAa,CAAC;QAC1D,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,uBAAuB,CAAC;QACzE,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,oEAAoE;QACtE,QAAQ,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;QAC3E,iBAAiB,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAClF,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChD,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,gDAAgD;QACvD,WAAW,EACT,4FAA4F;QAC9F,QAAQ,EAAE,CAAC,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC;QACrE,iBAAiB,EAAE,CAAC,aAAa,CAAC;QAClC,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,4GAA4G;QAC9G,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,CAAC;QAChE,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;QACtC,MAAM,EAAE,CAAC,UAAU,CAAC;QACpB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,6DAA6D;QACpE,WAAW,EACT,kFAAkF;QACpF,QAAQ,EAAE,CAAC,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC;QACjE,iBAAiB,EAAE,CAAC,SAAS,EAAE,2BAA2B,CAAC;QAC3D,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,wHAAwH;QAC1H,QAAQ,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,YAAY,CAAC;QAChE,iBAAiB,EAAE,CAAC,2BAA2B,CAAC;QAChD,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,0EAA0E;QAC5E,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;QAC9D,iBAAiB,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAgB;IAC5D,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAU;IAC/C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/compliance/mapper.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Compliance Mapper
+ *
+ * Maps security findings to compliance framework controls.
+ *
+ * @module compliance/mapper
+ */
+import type { Finding } from "../certification/types.js";
+import type { ComplianceControl, ComplianceFramework, ControlWithFindings, ComplianceStatus, ComplianceReport, ComplianceRecommendation, MultiFrameworkReport } from "./types.js";
+/**
+ * Get controls for a framework
+ */
+export declare function getControlsForFramework(framework: ComplianceFramework): ComplianceControl[];
+/**
+ * Check if a finding matches a control
+ */
+export declare function findingMatchesControl(finding: Finding, control: ComplianceControl): boolean;
+/**
+ * Check if finding severity meets control threshold
+ */
+export declare function meetsSeverityThreshold(finding: Finding, control: ComplianceControl): boolean;
+/**
+ * Map findings to controls for a framework
+ */
+export declare function mapFindingsToControls(findings: Finding[], framework: ComplianceFramework): ControlWithFindings[];
+/**
+ * Calculate compliance status from control mappings
+ */
+export declare function calculateComplianceStatus(framework: ComplianceFramework, controlMappings: ControlWithFindings[]): ComplianceStatus;
+/**
+ * Generate recommendations from control mappings
+ */
+export declare function generateRecommendations(controlMappings: ControlWithFindings[]): ComplianceRecommendation[];
+/**
+ * Generate a compliance report for a framework
+ */
+export declare function generateComplianceReport(findings: Finding[], framework: ComplianceFramework, projectPath: string, certificationId?: string): ComplianceReport;
+/**
+ * Generate a multi-framework compliance report
+ */
+export declare function generateMultiFrameworkReport(findings: Finding[], frameworks: ComplianceFramework[], projectPath: string, certificationId?: string): MultiFrameworkReport;
+//# sourceMappingURL=mapper.d.ts.map

package/dist/compliance/mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapper.d.ts","sourceRoot":"","sources":["../../src/compliance/mapper.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAqCpB;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,mBAAmB,GAAG,iBAAiB,EAAE,CA+B3F;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAoB3F;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAG5F;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,OAAO,EAAE,EACnB,SAAS,EAAE,mBAAmB,GAC7B,mBAAmB,EAAE,CAoCvB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,mBAAmB,EAAE,GACrC,gBAAgB,CAkClB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,mBAAmB,EAAE,GACrC,wBAAwB,EAAE,CA4C5B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,SAAS,EAAE,mBAAmB,EAC9B,WAAW,EAAE,MAAM,EACnB,eAAe,CAAC,EAAE,MAAM,GACvB,gBAAgB,CA0BlB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,OAAO,EAAE,EACnB,UAAU,EAAE,mBAAmB,EAAE,EACjC,WAAW,EAAE,MAAM,EACnB,eAAe,CAAC,EAAE,MAAM,GACvB,oBAAoB,CA+BtB"}