/**
 * HIPAAAuditBot -- Automated HIPAA Security Rule auditing.
 *
 * Inspects the governance directory structure to verify that HIPAA
 * technical safeguards are in place. Checks for file existence,
 * configuration presence, and control readiness. Does NOT call external APIs.
 *
 * GATE 11: Compliance Audit Bot System (T-155)
 *
 * @connexum/ai-governance
 */
import * as fs from 'fs';
import * as path from 'path';
import { computeAuditScore, } from './scheduler.js';
export class HIPAAAuditBot {
    logDir;
    governanceDir;
    constructor(config) {
        this.logDir = config.logDir;
        this.governanceDir = config.governanceDir;
    }
    /**
     * Run the full HIPAA audit.
     */
    runAudit() {
        const checks = [
            this.checkAccessControlAuth(),
            this.checkAccessControlRBAC(),
            this.checkAuditControlLogging(),
            this.checkAuditControlIntegrity(),
            this.checkIntegrityHashManifest(),
            this.checkIntegrityTamperDetection(),
            this.checkTransmissionEncryption(),
            this.checkPHIClassification(),
            this.checkMinimumNecessary(),
            this.checkBreachNotification(),
        ];
        const { score, passed, failed, warnings } = computeAuditScore(checks);
        return {
            auditId: '',
            packId: 'hipaa',
            timestamp: new Date().toISOString(),
            checks,
            score,
            passed,
            failed,
            warnings,
        };
    }
    // --- 164.312(a): Access Controls ---
    checkAccessControlAuth() {
        const authFile = path.join(this.governanceDir, 'agent-auth.json');
        const exists = fs.existsSync(authFile);
        return {
            id: 'hipaa-312a-auth',
            title: '164.312(a): Agent authentication',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Agent authentication configured per 164.312(a)(1)'
                : 'Missing agent-auth.json -- unique user identification not implemented',
            evidence: exists ? authFile : undefined,
        };
    }
    checkAccessControlRBAC() {
        const permFile = path.join(this.governanceDir, 'PERMISSIONS.md');
        const permJson = path.join(this.governanceDir, 'permissions.json');
        const rolesFile = path.join(this.governanceDir, 'roles.json');
        const exists = fs.existsSync(permFile) || fs.existsSync(permJson) || fs.existsSync(rolesFile);
        return {
            id: 'hipaa-312a-rbac',
            title: '164.312(a): Role-based permissions',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Role-based access controls found'
                : 'No permissions or roles files -- access not restricted by role',
            evidence: exists
                ? [permFile, permJson, rolesFile].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
    // --- 164.312(b): Audit Controls ---
    checkAuditControlLogging() {
        const hasLogs = fs.existsSync(this.logDir) &&
            fs.readdirSync(this.logDir).some((f) => f.endsWith('.jsonl'));
        return {
            id: 'hipaa-312b-logging',
            title: '164.312(b): Audit logging',
            status: hasLogs ? 'pass' : 'fail',
            detail: hasLogs
                ? 'Audit log files found per 164.312(b)'
                : 'No JSONL audit logs -- audit controls not operational',
            evidence: hasLogs ? this.logDir : undefined,
        };
    }
    checkAuditControlIntegrity() {
        const chainFiles = fs.existsSync(this.logDir) &&
            fs.readdirSync(this.logDir).some((f) => f.includes('audit-chain'));
        return {
            id: 'hipaa-312b-integrity',
            title: '164.312(b): Audit log integrity verification',
            status: chainFiles ? 'pass' : 'warning',
            detail: chainFiles
                ? 'Hash-chained audit logs found'
                : 'No hash-chained audit logs -- integrity verification recommended',
            evidence: chainFiles ? this.logDir : undefined,
        };
    }
    // --- 164.312(c): Integrity Controls ---
    checkIntegrityHashManifest() {
        const hashFile = path.join(this.governanceDir, 'hash-manifest.json');
        const exists = fs.existsSync(hashFile);
        return {
            id: 'hipaa-312c-hash',
            title: '164.312(c): Hash manifest for integrity',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Hash manifest provides integrity controls per 164.312(c)(1)'
                : 'Missing hash-manifest.json -- data integrity not verifiable',
            evidence: exists ? hashFile : undefined,
        };
    }
    checkIntegrityTamperDetection() {
        const govFile = path.join(this.governanceDir, 'governance.json');
        const hashFile = path.join(this.governanceDir, 'hash-manifest.json');
        const bothExist = fs.existsSync(govFile) && fs.existsSync(hashFile);
        return {
            id: 'hipaa-312c-tamper',
            title: '164.312(c): Tamper detection',
            status: bothExist ? 'pass' : 'fail',
            detail: bothExist
                ? 'Governance file protected by hash manifest'
                : 'Tamper detection incomplete -- need both governance.json and hash-manifest.json',
            evidence: bothExist ? `${govFile}, ${hashFile}` : undefined,
        };
    }
    // --- 164.312(e): Transmission Security ---
    checkTransmissionEncryption() {
        const encConfig = path.join(this.governanceDir, 'encryption.json');
        const exists = fs.existsSync(encConfig);
        return {
            id: 'hipaa-312e-encryption',
            title: '164.312(e): Encrypted storage',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Encryption configuration found per 164.312(e)(1)'
                : 'Missing encryption.json -- data not encrypted at rest',
            evidence: exists ? encConfig : undefined,
        };
    }
    // --- PHI Data Classification ---
    checkPHIClassification() {
        const classifierConfig = path.join(this.governanceDir, 'data-classifier.json');
        const exists = fs.existsSync(classifierConfig);
        return {
            id: 'hipaa-phi-classification',
            title: 'PHI Data Classification',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Data classifier configured for PHI pattern detection'
                : 'Missing data-classifier.json -- PHI not being identified',
            evidence: exists ? classifierConfig : undefined,
        };
    }
    // --- Minimum Necessary ---
    checkMinimumNecessary() {
        const capFile = path.join(this.governanceDir, 'capability-bundles.json');
        const permFile = path.join(this.governanceDir, 'permissions.json');
        const exists = fs.existsSync(capFile) || fs.existsSync(permFile);
        return {
            id: 'hipaa-minimum-necessary',
            title: 'Minimum Necessary: Capability bundles',
            status: exists ? 'pass' : 'warning',
            detail: exists
                ? 'Capability bundles or permissions limit agent scope'
                : 'No capability-bundles.json or permissions.json -- minimum necessary principle may not be enforced',
            evidence: exists
                ? [capFile, permFile].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
    // --- Breach Notification Readiness ---
    checkBreachNotification() {
        const notifyConfig = path.join(this.governanceDir, 'incident-notification.json');
        const irConfig = path.join(this.governanceDir, 'incident-response.json');
        const exists = fs.existsSync(notifyConfig) || fs.existsSync(irConfig);
        return {
            id: 'hipaa-breach-notification',
            title: 'Breach Notification Readiness',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Incident notification/response configuration found'
                : 'No incident-notification.json or incident-response.json -- breach notification not configured',
            evidence: exists
                ? [notifyConfig, irConfig].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
}
//# sourceMappingURL=hipaa.js.map