vaspera 2.8.0 → 2.9.0

package/dist/compliance/cfr42-part2.js

@@ -0,0 +1,408 @@
+/**
+ * 42 CFR Part 2 Compliance Controls
+ *
+ * Confidentiality of Substance Use Disorder Patient Records
+ * (Stricter than HIPAA for SUD treatment records)
+ *
+ * @module compliance/cfr42-part2
+ */
+/**
+ * 42 CFR Part 2 control categories
+ */
+export const CFR42_PART2_CATEGORIES = [
+    "General Provisions",
+    "Disclosures With Consent",
+    "Disclosures Without Consent",
+    "Security Safeguards",
+    "Audit and Accountability",
+    "Re-disclosure Restrictions",
+    "Qualified Service Organizations",
+    "Patient Rights",
+];
+/**
+ * 42 CFR Part 2 controls for SUD confidentiality
+ *
+ * These controls are STRICTER than HIPAA and apply specifically to
+ * substance use disorder (SUD) treatment records.
+ */
+export const CFR42_PART2_CONTROLS = [
+    // General Provisions (Subpart B)
+    {
+        id: "2.12",
+        framework: "42-CFR-PART-2",
+        category: "General Provisions",
+        title: "Prohibition on Disclosure",
+        description: "Records of the identity, diagnosis, prognosis, or treatment of any patient maintained in connection with the performance of any SUD program shall be confidential and disclosed only as permitted.",
+        keywords: [
+            "substance use",
+            "SUD",
+            "confidential",
+            "disclosure",
+            "patient record",
+            "addiction",
+            "treatment",
+        ],
+        findingCategories: [
+            "phi-exposure",
+            "sud-disclosure",
+            "data-exposure",
+            "logging",
+        ],
+        cweIds: ["CWE-200", "CWE-532", "CWE-359"],
+        severityThreshold: "high",
+    },
+    {
+        id: "2.13",
+        framework: "42-CFR-PART-2",
+        category: "General Provisions",
+        title: "Confidentiality Restrictions",
+        description: "Part 2 programs, lawful holders, and other individuals may not disclose patient identifying information or seek, use, or disclose records except as permitted by Part 2.",
+        keywords: [
+            "confidentiality",
+            "restrictions",
+            "patient identifying information",
+            "lawful holder",
+        ],
+        findingCategories: [
+            "phi-exposure",
+            "access-control-gap",
+            "authorization",
+            "broken-access-control",
+        ],
+        cweIds: ["CWE-284", "CWE-862", "CWE-863"],
+        severityThreshold: "high",
+    },
+    {
+        id: "2.14",
+        framework: "42-CFR-PART-2",
+        category: "General Provisions",
+        title: "Minor Patient Consent",
+        description: "When state law requires parental consent for SUD treatment of a minor, consent for disclosure must come from both the minor and parent/guardian.",
+        keywords: [
+            "minor",
+            "parental consent",
+            "guardian",
+            "age verification",
+            "dual consent",
+        ],
+        findingCategories: ["consent-bypass", "consent-missing", "authorization"],
+        cweIds: ["CWE-862"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "2.15",
+        framework: "42-CFR-PART-2",
+        category: "General Provisions",
+        title: "Incompetent Patient Consent",
+        description: "For patients lacking capacity, consent must be obtained from guardian or authorized representative with patient notification.",
+        keywords: [
+            "incompetent",
+            "guardian",
+            "authorized representative",
+            "capacity",
+        ],
+        findingCategories: ["consent-bypass", "consent-missing", "authorization"],
+        cweIds: ["CWE-862"],
+        severityThreshold: "medium",
+    },
+    // Disclosures With Consent (Subpart C)
+    {
+        id: "2.31",
+        framework: "42-CFR-PART-2",
+        category: "Disclosures With Consent",
+        title: "Written Consent Requirements",
+        description: "Consent must be in writing and include: patient name, program name, recipient name, purpose, information to be disclosed, signature, date, expiration, and right to revoke.",
+        keywords: [
+            "written consent",
+            "consent form",
+            "signature",
+            "expiration",
+            "revocation",
+            "purpose limitation",
+        ],
+        findingCategories: [
+            "consent-bypass",
+            "consent-missing",
+            "authorization",
+            "audit-gap",
+        ],
+        cweIds: ["CWE-862", "CWE-778"],
+        severityThreshold: "high",
+    },
+    {
+        id: "2.32",
+        framework: "42-CFR-PART-2",
+        category: "Re-disclosure Restrictions",
+        title: "Re-disclosure Notice Requirement",
+        description: "Each disclosure made with consent must include a written statement prohibiting re-disclosure except as permitted by Part 2.",
+        keywords: [
+            "re-disclosure",
+            "prohibition notice",
+            "downstream disclosure",
+            "notice statement",
+        ],
+        findingCategories: [
+            "redisclosure-violation",
+            "third-party-risk",
+            "data-flow",
+        ],
+        cweIds: ["CWE-200", "CWE-359"],
+        severityThreshold: "high",
+    },
+    {
+        id: "2.33",
+        framework: "42-CFR-PART-2",
+        category: "Qualified Service Organizations",
+        title: "QSOA Requirements",
+        description: "Qualified Service Organization Agreement required before disclosing records to contractors providing services to the program.",
+        keywords: [
+            "QSOA",
+            "qualified service organization",
+            "contractor",
+            "third-party",
+            "business associate",
+            "vendor",
+        ],
+        findingCategories: [
+            "qsoa-violation",
+            "third-party-risk",
+            "vendor",
+            "supply-chain",
+        ],
+        cweIds: ["CWE-200"],
+        severityThreshold: "high",
+    },
+    {
+        id: "2.34",
+        framework: "42-CFR-PART-2",
+        category: "Disclosures With Consent",
+        title: "Consent Revocation",
+        description: "Patients may revoke consent at any time. Programs must honor revocation prospectively.",
+        keywords: [
+            "revocation",
+            "revoke consent",
+            "withdraw consent",
+            "prospective",
+        ],
+        findingCategories: ["consent-bypass", "consent-missing", "authorization"],
+        cweIds: ["CWE-862"],
+        severityThreshold: "medium",
+    },
+    // Security Safeguards (Subpart B §2.16)
+    {
+        id: "2.16(a)",
+        framework: "42-CFR-PART-2",
+        category: "Security Safeguards",
+        title: "Safeguards Against Unauthorized Access",
+        description: "Part 2 programs must have formal policies and procedures to protect patient records from unauthorized access.",
+        keywords: [
+            "safeguards",
+            "unauthorized access",
+            "policies",
+            "procedures",
+            "access control",
+        ],
+        findingCategories: [
+            "access-control-gap",
+            "broken-access-control",
+            "authorization",
+            "authentication",
+        ],
+        cweIds: ["CWE-284", "CWE-287", "CWE-862"],
+        severityThreshold: "high",
+    },
+    {
+        id: "2.16(b)",
+        framework: "42-CFR-PART-2",
+        category: "Security Safeguards",
+        title: "Electronic Records Security",
+        description: "Programs maintaining electronic records must implement security measures including access controls, encryption, and audit trails.",
+        keywords: [
+            "electronic records",
+            "encryption",
+            "access control",
+            "audit trail",
+            "security measures",
+        ],
+        findingCategories: [
+            "encryption",
+            "missing-encryption",
+            "access-control-gap",
+            "audit-gap",
+        ],
+        cweIds: ["CWE-311", "CWE-312", "CWE-778"],
+        severityThreshold: "high",
+    },
+    // Audit and Accountability
+    {
+        id: "2.52",
+        framework: "42-CFR-PART-2",
+        category: "Audit and Accountability",
+        title: "Accounting of Disclosures",
+        description: "Programs must maintain records of disclosures made with or without consent, including date, recipient, purpose, and information disclosed.",
+        keywords: [
+            "accounting",
+            "disclosure log",
+            "audit trail",
+            "disclosure record",
+            "recipient tracking",
+        ],
+        findingCategories: ["audit-gap", "logging", "insufficient-logging"],
+        cweIds: ["CWE-778", "CWE-223"],
+        severityThreshold: "high",
+    },
+    {
+        id: "2.53",
+        framework: "42-CFR-PART-2",
+        category: "Audit and Accountability",
+        title: "Breach Notification",
+        description: "Programs must notify patients and HHS of breaches of unsecured SUD records.",
+        keywords: [
+            "breach",
+            "notification",
+            "incident response",
+            "unsecured records",
+        ],
+        findingCategories: [
+            "security-misconfiguration",
+            "logging",
+            "audit-gap",
+        ],
+        cweIds: ["CWE-778"],
+        severityThreshold: "high",
+    },
+    // Disclosures Without Consent (Subpart D)
+    {
+        id: "2.51",
+        framework: "42-CFR-PART-2",
+        category: "Disclosures Without Consent",
+        title: "Medical Emergency Exception",
+        description: "Disclosure without consent permitted only for medical emergencies where delay would increase health risk.",
+        keywords: [
+            "medical emergency",
+            "emergency disclosure",
+            "health risk",
+            "exception",
+        ],
+        findingCategories: ["consent-bypass", "audit-gap", "logging"],
+        cweIds: ["CWE-778"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "2.63",
+        framework: "42-CFR-PART-2",
+        category: "Disclosures Without Consent",
+        title: "Research Exception Requirements",
+        description: "Research disclosures require IRB/Privacy Board approval, data use agreement, and prohibition on re-identification.",
+        keywords: [
+            "research",
+            "IRB",
+            "privacy board",
+            "data use agreement",
+            "de-identification",
+        ],
+        findingCategories: ["consent-bypass", "authorization", "audit-gap"],
+        cweIds: ["CWE-359"],
+        severityThreshold: "medium",
+    },
+    // Patient Rights
+    {
+        id: "2.23",
+        framework: "42-CFR-PART-2",
+        category: "Patient Rights",
+        title: "Patient Access to Records",
+        description: "Patients have the right to inspect and obtain copies of their SUD treatment records upon request.",
+        keywords: ["patient access", "record access", "copy", "inspect", "request"],
+        findingCategories: ["access-control-gap", "authorization"],
+        cweIds: ["CWE-284"],
+        severityThreshold: "low",
+    },
+    {
+        id: "2.24",
+        framework: "42-CFR-PART-2",
+        category: "Patient Rights",
+        title: "Patient Amendment Rights",
+        description: "Patients may request amendment of inaccurate or incomplete records.",
+        keywords: ["amendment", "correction", "inaccurate", "incomplete"],
+        findingCategories: ["data-integrity", "authorization"],
+        severityThreshold: "low",
+    },
+    // Additional Technical Controls
+    {
+        id: "2.16(c)",
+        framework: "42-CFR-PART-2",
+        category: "Security Safeguards",
+        title: "Data Transmission Security",
+        description: "SUD records transmitted electronically must be encrypted and protected against interception.",
+        keywords: [
+            "transmission",
+            "encryption",
+            "TLS",
+            "HTTPS",
+            "interception",
+            "network security",
+        ],
+        findingCategories: [
+            "transport-security",
+            "encryption",
+            "insecure-transmission",
+        ],
+        cweIds: ["CWE-319", "CWE-523"],
+        severityThreshold: "high",
+    },
+    {
+        id: "2.16(d)",
+        framework: "42-CFR-PART-2",
+        category: "Security Safeguards",
+        title: "Data Segmentation",
+        description: "SUD records should be segmented from general health records to prevent inadvertent disclosure under HIPAA.",
+        keywords: [
+            "segmentation",
+            "segregation",
+            "separate storage",
+            "data isolation",
+        ],
+        findingCategories: ["access-control-gap", "data-exposure", "phi-exposure"],
+        cweIds: ["CWE-284", "CWE-668"],
+        severityThreshold: "high",
+    },
+];
+/**
+ * Get all 42 CFR Part 2 controls
+ */
+export function getCFR42Part2Controls() {
+    return CFR42_PART2_CONTROLS;
+}
+/**
+ * Get 42 CFR Part 2 controls by category
+ */
+export function getCFR42Part2ControlsByCategory(category) {
+    return CFR42_PART2_CONTROLS.filter((c) => c.category === category);
+}
+/**
+ * Get 42 CFR Part 2 control by ID
+ */
+export function getCFR42Part2ControlById(id) {
+    return CFR42_PART2_CONTROLS.find((c) => c.id === id);
+}
+/**
+ * Get 42 CFR Part 2 categories
+ */
+export function getCFR42Part2Categories() {
+    return CFR42_PART2_CATEGORIES;
+}
+/**
+ * Cross-reference mapping to HIPAA controls
+ * 42 CFR Part 2 often overlaps with but is stricter than HIPAA
+ */
+export const CFR42_TO_HIPAA_MAPPING = {
+    "2.12": ["164.308(a)(1)", "164.312(a)(1)"],
+    "2.13": ["164.308(a)(4)", "164.312(a)(1)"],
+    "2.16(a)": ["164.312(a)(1)", "164.308(a)(3)"],
+    "2.16(b)": ["164.312(a)(2)(iv)", "164.312(b)"],
+    "2.16(c)": ["164.312(e)(1)", "164.312(e)(2)(ii)"],
+    "2.31": ["164.508"],
+    "2.52": ["164.312(b)", "164.528"],
+    "2.53": ["164.402", "164.404"],
+};
+//# sourceMappingURL=cfr42-part2.js.map

package/dist/compliance/cfr42-part2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cfr42-part2.js","sourceRoot":"","sources":["../../src/compliance/cfr42-part2.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,oBAAoB;IACpB,0BAA0B;IAC1B,6BAA6B;IAC7B,qBAAqB;IACrB,0BAA0B;IAC1B,4BAA4B;IAC5B,iCAAiC;IACjC,gBAAgB;CACR,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,iCAAiC;IACjC;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,oMAAoM;QACtM,QAAQ,EAAE;YACR,eAAe;YACf,KAAK;YACL,cAAc;YACd,YAAY;YACZ,gBAAgB;YAChB,WAAW;YACX,WAAW;SACZ;QACD,iBAAiB,EAAE;YACjB,cAAc;YACd,gBAAgB;YAChB,eAAe;YACf,SAAS;SACV;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QACzC,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,0KAA0K;QAC5K,QAAQ,EAAE;YACR,iBAAiB;YACjB,cAAc;YACd,iCAAiC;YACjC,eAAe;SAChB;QACD,iBAAiB,EAAE;YACjB,cAAc;YACd,oBAAoB;YACpB,eAAe;YACf,uBAAuB;SACxB;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QACzC,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,kJAAkJ;QACpJ,QAAQ,EAAE;YACR,OAAO;YACP,kBAAkB;YAClB,UAAU;YACV,kBAAkB;YAClB,cAAc;SACf;QACD,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,CAAC;QACzE,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,+HAA+H;QACjI,QAAQ,EAAE;YACR,aAAa;YACb,UAAU;YACV,2BAA2B;YAC3B,UAAU;SACX;QACD,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,CAAC;QACzE,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IAED,uCAAuC;IACvC;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,0BAA0B;QACpC,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,6KAA6K;QAC/K,QAAQ,EAAE;YACR,iBAAiB;YACjB,cAAc;YACd,WAAW;YACX,YAAY;YACZ,YAAY;YACZ,oBAAoB;SACrB;QACD,iBAAiB,EAAE;YACjB,gBAAgB;YAChB,iBAAiB;YACjB,eAAe;YACf,WAAW;SACZ;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,4BAA4B;QACtC,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,6HAA6H;QAC/H,QAAQ,EAAE;YACR,eAAe;YACf,oBAAoB;YACpB,uBAAuB;YACvB,kBAAkB;SACnB;QACD,iBAAiB,EAAE;YACjB,wBAAwB;YACxB,kBAAkB;YAClB,WAAW;SACZ;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,iCAAiC;QAC3C,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,+HAA+H;QACjI,QAAQ,EAAE;YACR,MAAM;YACN,gCAAgC;YAChC,YAAY;YACZ,aAAa;YACb,oBAAoB;YACpB,QAAQ;SACT;QACD,iBAAiB,EAAE;YACjB,gBAAgB;YAChB,kBAAkB;YAClB,QAAQ;YACR,cAAc;SACf;QACD,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,0BAA0B;QACpC,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,wFAAwF;QAC1F,QAAQ,EAAE;YACR,YAAY;YACZ,gBAAgB;YAChB,kBAAkB;YAClB,aAAa;SACd;QACD,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,CAAC;QACzE,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IAED,wCAAwC;IACxC;QACE,EAAE,EAAE,SAAS;QACb,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,qBAAqB;QAC/B,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EACT,+GAA+G;QACjH,QAAQ,EAAE;YACR,YAAY;YACZ,qBAAqB;YACrB,UAAU;YACV,YAAY;YACZ,gBAAgB;SACjB;QACD,iBAAiB,EAAE;YACjB,oBAAoB;YACpB,uBAAuB;YACvB,eAAe;YACf,gBAAgB;SACjB;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QACzC,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,SAAS;QACb,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,qBAAqB;QAC/B,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,mIAAmI;QACrI,QAAQ,EAAE;YACR,oBAAoB;YACpB,YAAY;YACZ,gBAAgB;YAChB,aAAa;YACb,mBAAmB;SACpB;QACD,iBAAiB,EAAE;YACjB,YAAY;YACZ,oBAAoB;YACpB,oBAAoB;YACpB,WAAW;SACZ;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QACzC,iBAAiB,EAAE,MAAM;KAC1B;IAED,2BAA2B;IAC3B;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,0BAA0B;QACpC,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,4IAA4I;QAC9I,QAAQ,EAAE;YACR,YAAY;YACZ,gBAAgB;YAChB,aAAa;YACb,mBAAmB;YACnB,oBAAoB;SACrB;QACD,iBAAiB,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,sBAAsB,CAAC;QACnE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,0BAA0B;QACpC,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,6EAA6E;QAC/E,QAAQ,EAAE;YACR,QAAQ;YACR,cAAc;YACd,mBAAmB;YACnB,mBAAmB;SACpB;QACD,iBAAiB,EAAE;YACjB,2BAA2B;YAC3B,SAAS;YACT,WAAW;SACZ;QACD,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,MAAM;KAC1B;IAED,0CAA0C;IAC1C;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,2GAA2G;QAC7G,QAAQ,EAAE;YACR,mBAAmB;YACnB,sBAAsB;YACtB,aAAa;YACb,WAAW;SACZ;QACD,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,WAAW,EAAE,SAAS,CAAC;QAC7D,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,oHAAoH;QACtH,QAAQ,EAAE;YACR,UAAU;YACV,KAAK;YACL,eAAe;YACf,oBAAoB;YACpB,mBAAmB;SACpB;QACD,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,WAAW,CAAC;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IAED,iBAAiB;IACjB;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,mGAAmG;QACrG,QAAQ,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC;QAC3E,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC1D,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,qEAAqE;QACvE,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC;QACjE,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;QACtD,iBAAiB,EAAE,KAAK;KACzB;IAED,gCAAgC;IAChC;QACE,EAAE,EAAE,SAAS;QACb,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,qBAAqB;QAC/B,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,8FAA8F;QAChG,QAAQ,EAAE;YACR,cAAc;YACd,YAAY;YACZ,KAAK;YACL,OAAO;YACP,cAAc;YACd,kBAAkB;SACnB;QACD,iBAAiB,EAAE;YACjB,oBAAoB;YACpB,YAAY;YACZ,uBAAuB;SACxB;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,SAAS;QACb,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,qBAAqB;QAC/B,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,4GAA4G;QAC9G,QAAQ,EAAE;YACR,cAAc;YACd,aAAa;YACb,kBAAkB;YAClB,gBAAgB;SACjB;QACD,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,cAAc,CAAC;QAC1E,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB;IAEhB,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,EAAU;IAEV,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA6B;IAC9D,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,SAAS,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IAC7C,SAAS,EAAE,CAAC,mBAAmB,EAAE,YAAY,CAAC;IAC9C,SAAS,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;IACjC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B,CAAC"}

package/dist/compliance/compliance-bundle.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Compliance Assessment Bundle
+ *
+ * Orchestrates compliance assessment with evidence collection and audit
+ * trail verification for any combination of frameworks.
+ *
+ * @module compliance/compliance-bundle
+ */
+import type { Finding } from "../certification/types.js";
+import type { ComplianceReport, ComplianceFramework, MultiFrameworkReport } from "./types.js";
+import type { EvidenceBundle } from "../evidence/types.js";
+import type { IntegrityVerificationResult } from "../history/types.js";
+/**
+ * Compliance assessment result for a single framework
+ */
+export interface SingleFrameworkAssessmentResult {
+    /** Compliance report */
+    report: ComplianceReport;
+    /** Formatted markdown report */
+    markdownReport: string;
+    /** Evidence bundle if collected */
+    evidenceBundle?: EvidenceBundle;
+    /** Audit trail verification result */
+    auditVerification?: IntegrityVerificationResult;
+    /** Path where evidence was stored */
+    evidencePath?: string;
+    /** Overall assessment status */
+    status: "compliant" | "at_risk" | "non_compliant";
+}
+/**
+ * Compliance assessment result for multiple frameworks
+ */
+export interface MultiFrameworkAssessmentResult {
+    /** Individual reports per framework */
+    reports: Partial<Record<ComplianceFramework, ComplianceReport>>;
+    /** Multi-framework report */
+    multiFrameworkReport: MultiFrameworkReport;
+    /** Formatted markdown report */
+    markdownReport: string;
+    /** Evidence bundle if collected */
+    evidenceBundle?: EvidenceBundle;
+    /** Audit trail verification result */
+    auditVerification?: IntegrityVerificationResult;
+    /** Path where evidence was stored */
+    evidencePath?: string;
+    /** Overall assessment status */
+    status: "compliant" | "at_risk" | "non_compliant";
+    /** Combined compliance score (average across frameworks) */
+    combinedScore: number;
+}
+/**
+ * Options for running compliance assessment
+ */
+export interface ComplianceAssessmentOptions {
+    /** Project path to assess */
+    projectPath: string;
+    /** Security findings from certification/scanning */
+    findings: Finding[];
+    /** Framework(s) to assess */
+    frameworks: ComplianceFramework[];
+    /** Certification ID to associate with */
+    certificationId?: string;
+    /** Collect evidence bundle for audit defensibility */
+    collectEvidence?: boolean;
+    /** Sign evidence with Sigstore */
+    sign?: boolean;
+    /** Verify audit trail integrity */
+    verifyAuditTrail?: boolean;
+    /** Store evidence bundle to disk */
+    storeEvidence?: boolean;
+    /** Include attestation section in report */
+    includeAttestation?: boolean;
+}
+/**
+ * Run a compliance assessment for a single framework
+ *
+ * This function orchestrates:
+ * 1. Compliance control mapping for the framework
+ * 2. Audit trail integrity verification (optional)
+ * 3. Evidence bundle collection (optional)
+ * 4. Audit-defensible report generation
+ */
+export declare function runSingleFrameworkAssessment(options: Omit<ComplianceAssessmentOptions, "frameworks"> & {
+    framework: ComplianceFramework;
+}): Promise<SingleFrameworkAssessmentResult>;
+/**
+ * Run a compliance assessment for multiple frameworks
+ *
+ * This function orchestrates:
+ * 1. Compliance control mapping for all frameworks
+ * 2. Audit trail integrity verification (optional)
+ * 3. Evidence bundle collection (optional)
+ * 4. Unified audit-defensible report generation
+ */
+export declare function runComplianceAssessment(options: ComplianceAssessmentOptions): Promise<MultiFrameworkAssessmentResult>;
+/**
+ * Generate a quick compliance summary
+ */
+export declare function generateComplianceSummary(result: MultiFrameworkAssessmentResult): string;
+//# sourceMappingURL=compliance-bundle.d.ts.map

package/dist/compliance/compliance-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-bundle.d.ts","sourceRoot":"","sources":["../../src/compliance/compliance-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,wBAAwB;IACxB,MAAM,EAAE,gBAAgB,CAAC;IAEzB,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IAEvB,mCAAmC;IACnC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAEhD,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,gCAAgC;IAChC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEhE,6BAA6B;IAC7B,oBAAoB,EAAE,oBAAoB,CAAC;IAE3C,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IAEvB,mCAAmC;IACnC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAEhD,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,gCAAgC;IAChC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;IAElD,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IAEpB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,EAAE,CAAC;IAEpB,6BAA6B;IAC7B,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAElC,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,kCAAkC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,oCAAoC;IACpC,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,4CAA4C;IAC5C,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG;IAAE,SAAS,EAAE,mBAAmB,CAAA;CAAE,GAC5F,OAAO,CAAC,+BAA+B,CAAC,CA8E1C;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,8BAA8B,CAAC,CAmIzC;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,8BAA8B,GACrC,MAAM,CA4BR"}