@aigrc/core 0.1.0

package/dist/schemas/index.js

@@ -0,0 +1,213 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/schemas/index.ts
+var schemas_exports = {};
+__export(schemas_exports, {
+  ApprovalSchema: () => ApprovalSchema,
+  AssetCardSchema: () => AssetCardSchema,
+  ClassificationSchema: () => ClassificationSchema,
+  ConstraintsSchema: () => ConstraintsSchema,
+  ControlStatusSchema: () => ControlStatusSchema,
+  GovernanceSchema: () => GovernanceSchema,
+  IntentSchema: () => IntentSchema,
+  JurisdictionClassificationSchema: () => JurisdictionClassificationSchema,
+  OwnerSchema: () => OwnerSchema,
+  RiskFactorsSchema: () => RiskFactorsSchema,
+  TechnicalSchema: () => TechnicalSchema,
+  TrustworthinessCharacteristicSchema: () => TrustworthinessCharacteristicSchema,
+  TrustworthinessSchema: () => TrustworthinessSchema
+});
+module.exports = __toCommonJS(schemas_exports);
+var import_zod = require("zod");
+var OwnerSchema = import_zod.z.object({
+  name: import_zod.z.string().min(1),
+  email: import_zod.z.string().email(),
+  team: import_zod.z.string().optional()
+});
+var TechnicalSchema = import_zod.z.object({
+  type: import_zod.z.enum(["model", "agent", "api_client", "framework", "pipeline"]),
+  framework: import_zod.z.string().optional(),
+  frameworkVersion: import_zod.z.string().optional(),
+  components: import_zod.z.array(
+    import_zod.z.object({
+      type: import_zod.z.string(),
+      provider: import_zod.z.string().optional(),
+      model: import_zod.z.string().optional()
+    })
+  ).optional(),
+  sourceFiles: import_zod.z.array(import_zod.z.string()).optional()
+});
+var RiskFactorsSchema = import_zod.z.object({
+  autonomousDecisions: import_zod.z.boolean().default(false),
+  customerFacing: import_zod.z.boolean().default(false),
+  toolExecution: import_zod.z.boolean().default(false),
+  externalDataAccess: import_zod.z.boolean().default(false),
+  piiProcessing: import_zod.z.enum(["yes", "no", "unknown"]).default("unknown"),
+  highStakesDecisions: import_zod.z.boolean().default(false)
+});
+var ControlStatusSchema = import_zod.z.object({
+  controlId: import_zod.z.string(),
+  status: import_zod.z.enum(["implemented", "partial", "not_implemented", "not_applicable"]),
+  evidence: import_zod.z.string().optional(),
+  notes: import_zod.z.string().optional(),
+  lastUpdated: import_zod.z.string().datetime().optional()
+});
+var JurisdictionClassificationSchema = import_zod.z.object({
+  /** Profile/jurisdiction ID (e.g., "eu-ai-act", "us-omb-m24") */
+  jurisdictionId: import_zod.z.string(),
+  /** Risk level mapped to this jurisdiction's terminology */
+  riskLevel: import_zod.z.string(),
+  /** Jurisdiction-specific category (e.g., EU AI Act category) */
+  category: import_zod.z.string().optional(),
+  /** Status of controls for this jurisdiction */
+  controlStatuses: import_zod.z.array(ControlStatusSchema).optional(),
+  /** Required artifacts for this jurisdiction */
+  requiredArtifacts: import_zod.z.array(
+    import_zod.z.object({
+      artifactId: import_zod.z.string(),
+      status: import_zod.z.enum(["pending", "complete", "not_applicable"]),
+      path: import_zod.z.string().optional()
+    })
+  ).optional(),
+  /** Last compliance check date */
+  lastChecked: import_zod.z.string().datetime().optional(),
+  /** Compliance percentage for this jurisdiction */
+  compliancePercentage: import_zod.z.number().min(0).max(100).optional()
+});
+var TrustworthinessCharacteristicSchema = import_zod.z.object({
+  score: import_zod.z.number().min(0).max(100).optional(),
+  notes: import_zod.z.string().optional(),
+  lastAssessed: import_zod.z.string().datetime().optional(),
+  assessedBy: import_zod.z.string().optional()
+});
+var TrustworthinessSchema = import_zod.z.object({
+  /** Valid and reliable: produces accurate, consistent results */
+  valid: TrustworthinessCharacteristicSchema.optional(),
+  reliable: TrustworthinessCharacteristicSchema.optional(),
+  /** Safe: minimizes harm and risk */
+  safe: TrustworthinessCharacteristicSchema.optional(),
+  /** Secure: protected against threats */
+  secure: TrustworthinessCharacteristicSchema.optional(),
+  /** Accountable: clear responsibility and oversight */
+  accountable: TrustworthinessCharacteristicSchema.optional(),
+  /** Transparent: understandable and open about limitations */
+  transparent: TrustworthinessCharacteristicSchema.optional(),
+  /** Explainable: decisions can be understood */
+  explainable: TrustworthinessCharacteristicSchema.optional(),
+  /** Privacy-enhanced: protects personal information */
+  privacyEnhanced: TrustworthinessCharacteristicSchema.optional(),
+  /** Fair: avoids bias and discrimination */
+  fair: TrustworthinessCharacteristicSchema.optional()
+});
+var ClassificationSchema = import_zod.z.object({
+  /** Primary AIGRC risk level */
+  riskLevel: import_zod.z.enum(["minimal", "limited", "high", "unacceptable"]),
+  /** Risk factors that influenced the classification */
+  riskFactors: RiskFactorsSchema,
+  /** EU AI Act specific classification (legacy, prefer jurisdictions) */
+  euAiAct: import_zod.z.object({
+    category: import_zod.z.string(),
+    transparencyRequired: import_zod.z.boolean().default(false)
+  }).optional(),
+  /** Required artifacts based on classification */
+  requiredArtifacts: import_zod.z.array(
+    import_zod.z.object({
+      type: import_zod.z.string(),
+      status: import_zod.z.enum(["pending", "complete", "not_applicable"]),
+      path: import_zod.z.string().optional()
+    })
+  ).optional(),
+  /** Per-jurisdiction classifications for multi-jurisdiction compliance */
+  jurisdictions: import_zod.z.array(JurisdictionClassificationSchema).optional(),
+  /** NIST AI RMF trustworthiness characteristics */
+  trustworthiness: TrustworthinessSchema.optional()
+});
+var IntentSchema = import_zod.z.object({
+  linked: import_zod.z.boolean().default(false),
+  ticketSystem: import_zod.z.enum(["jira", "ado", "github", "gitlab"]).nullable().optional(),
+  ticketId: import_zod.z.string().nullable().optional(),
+  ticketUrl: import_zod.z.string().url().nullable().optional(),
+  businessJustification: import_zod.z.string().nullable().optional(),
+  riskTolerance: import_zod.z.enum(["low", "medium", "high"]).nullable().optional(),
+  importedAt: import_zod.z.string().datetime().nullable().optional()
+});
+var ApprovalSchema = import_zod.z.object({
+  role: import_zod.z.string(),
+  name: import_zod.z.string(),
+  email: import_zod.z.string().email().optional(),
+  date: import_zod.z.string(),
+  source: import_zod.z.string().optional()
+});
+var GovernanceSchema = import_zod.z.object({
+  status: import_zod.z.enum(["draft", "linked", "approved", "production", "deprecated", "revoked"]),
+  approvals: import_zod.z.array(ApprovalSchema).default([]),
+  deployment: import_zod.z.object({
+    environments: import_zod.z.array(import_zod.z.string()).default([]),
+    lastDeployed: import_zod.z.string().datetime().nullable().optional()
+  }).optional()
+});
+var ConstraintsSchema = import_zod.z.object({
+  runtime: import_zod.z.object({
+    maxIterations: import_zod.z.number().positive().optional(),
+    timeoutSeconds: import_zod.z.number().positive().optional(),
+    maxTokensPerRequest: import_zod.z.number().positive().optional(),
+    maxCostPerRequestUsd: import_zod.z.number().positive().optional()
+  }).optional(),
+  humanApprovalRequired: import_zod.z.array(import_zod.z.string()).optional(),
+  monitoring: import_zod.z.object({
+    logAllDecisions: import_zod.z.boolean().default(true),
+    logToolInvocations: import_zod.z.boolean().default(true)
+  }).optional()
+});
+var AssetCardSchema = import_zod.z.object({
+  $schema: import_zod.z.string().optional(),
+  id: import_zod.z.string().regex(/^aigrc-\d{4}-[a-f0-9]{8}$/),
+  name: import_zod.z.string().min(1).max(100),
+  description: import_zod.z.string().max(500).optional(),
+  version: import_zod.z.string().default("1.0.0"),
+  created: import_zod.z.string().datetime(),
+  updated: import_zod.z.string().datetime(),
+  ownership: import_zod.z.object({
+    owner: OwnerSchema,
+    team: import_zod.z.string().optional()
+  }),
+  technical: TechnicalSchema,
+  classification: ClassificationSchema,
+  intent: IntentSchema,
+  governance: GovernanceSchema,
+  constraints: ConstraintsSchema.optional()
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ApprovalSchema,
+  AssetCardSchema,
+  ClassificationSchema,
+  ConstraintsSchema,
+  ControlStatusSchema,
+  GovernanceSchema,
+  IntentSchema,
+  JurisdictionClassificationSchema,
+  OwnerSchema,
+  RiskFactorsSchema,
+  TechnicalSchema,
+  TrustworthinessCharacteristicSchema,
+  TrustworthinessSchema
+});
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/index.ts"],"sourcesContent":["import { z } from \"zod\";\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// OWNER SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const OwnerSchema = z.object({\r\n  name: z.string().min(1),\r\n  email: z.string().email(),\r\n  team: z.string().optional(),\r\n});\r\n\r\nexport type Owner = z.infer<typeof OwnerSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// TECHNICAL SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const TechnicalSchema = z.object({\r\n  type: z.enum([\"model\", \"agent\", \"api_client\", \"framework\", \"pipeline\"]),\r\n  framework: z.string().optional(),\r\n  frameworkVersion: z.string().optional(),\r\n  components: z\r\n    .array(\r\n      z.object({\r\n        type: z.string(),\r\n        provider: z.string().optional(),\r\n        model: z.string().optional(),\r\n      })\r\n    )\r\n    .optional(),\r\n  sourceFiles: z.array(z.string()).optional(),\r\n});\r\n\r\nexport type Technical = z.infer<typeof TechnicalSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// RISK FACTORS SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const RiskFactorsSchema = z.object({\r\n  autonomousDecisions: z.boolean().default(false),\r\n  customerFacing: z.boolean().default(false),\r\n  toolExecution: z.boolean().default(false),\r\n  externalDataAccess: z.boolean().default(false),\r\n  piiProcessing: z.enum([\"yes\", \"no\", \"unknown\"]).default(\"unknown\"),\r\n  highStakesDecisions: z.boolean().default(false),\r\n});\r\n\r\nexport type RiskFactors = z.infer<typeof RiskFactorsSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// JURISDICTION CLASSIFICATION SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const ControlStatusSchema = z.object({\r\n  controlId: z.string(),\r\n  status: z.enum([\"implemented\", \"partial\", \"not_implemented\", \"not_applicable\"]),\r\n  evidence: z.string().optional(),\r\n  notes: z.string().optional(),\r\n  lastUpdated: z.string().datetime().optional(),\r\n});\r\n\r\nexport type ControlStatus = z.infer<typeof ControlStatusSchema>;\r\n\r\nexport const JurisdictionClassificationSchema = z.object({\r\n  /** Profile/jurisdiction ID (e.g., \"eu-ai-act\", \"us-omb-m24\") */\r\n  jurisdictionId: z.string(),\r\n  /** Risk level mapped to this jurisdiction's terminology */\r\n  riskLevel: z.string(),\r\n  /** Jurisdiction-specific category (e.g., EU AI Act category) */\r\n  category: z.string().optional(),\r\n  /** Status of controls for this jurisdiction */\r\n  controlStatuses: z.array(ControlStatusSchema).optional(),\r\n  /** Required artifacts for this jurisdiction */\r\n  requiredArtifacts: z\r\n    .array(\r\n      z.object({\r\n        artifactId: z.string(),\r\n        status: z.enum([\"pending\", \"complete\", \"not_applicable\"]),\r\n        path: z.string().optional(),\r\n      })\r\n    )\r\n    .optional(),\r\n  /** Last compliance check date */\r\n  lastChecked: z.string().datetime().optional(),\r\n  /** Compliance percentage for this jurisdiction */\r\n  compliancePercentage: z.number().min(0).max(100).optional(),\r\n});\r\n\r\nexport type JurisdictionClassification = z.infer<typeof JurisdictionClassificationSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// TRUSTWORTHINESS CHARACTERISTICS SCHEMA (NIST AI RMF)\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const TrustworthinessCharacteristicSchema = z.object({\r\n  score: z.number().min(0).max(100).optional(),\r\n  notes: z.string().optional(),\r\n  lastAssessed: z.string().datetime().optional(),\r\n  assessedBy: z.string().optional(),\r\n});\r\n\r\nexport type TrustworthinessCharacteristic = z.infer<typeof TrustworthinessCharacteristicSchema>;\r\n\r\nexport const TrustworthinessSchema = z.object({\r\n  /** Valid and reliable: produces accurate, consistent results */\r\n  valid: TrustworthinessCharacteristicSchema.optional(),\r\n  reliable: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Safe: minimizes harm and risk */\r\n  safe: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Secure: protected against threats */\r\n  secure: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Accountable: clear responsibility and oversight */\r\n  accountable: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Transparent: understandable and open about limitations */\r\n  transparent: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Explainable: decisions can be understood */\r\n  explainable: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Privacy-enhanced: protects personal information */\r\n  privacyEnhanced: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Fair: avoids bias and discrimination */\r\n  fair: TrustworthinessCharacteristicSchema.optional(),\r\n});\r\n\r\nexport type Trustworthiness = z.infer<typeof TrustworthinessSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// CLASSIFICATION SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const ClassificationSchema = z.object({\r\n  /** Primary AIGRC risk level */\r\n  riskLevel: z.enum([\"minimal\", \"limited\", \"high\", \"unacceptable\"]),\r\n  /** Risk factors that influenced the classification */\r\n  riskFactors: RiskFactorsSchema,\r\n  /** EU AI Act specific classification (legacy, prefer jurisdictions) */\r\n  euAiAct: z\r\n    .object({\r\n      category: z.string(),\r\n      transparencyRequired: z.boolean().default(false),\r\n    })\r\n    .optional(),\r\n  /** Required artifacts based on classification */\r\n  requiredArtifacts: z\r\n    .array(\r\n      z.object({\r\n        type: z.string(),\r\n        status: z.enum([\"pending\", \"complete\", \"not_applicable\"]),\r\n        path: z.string().optional(),\r\n      })\r\n    )\r\n    .optional(),\r\n  /** Per-jurisdiction classifications for multi-jurisdiction compliance */\r\n  jurisdictions: z.array(JurisdictionClassificationSchema).optional(),\r\n  /** NIST AI RMF trustworthiness characteristics */\r\n  trustworthiness: TrustworthinessSchema.optional(),\r\n});\r\n\r\nexport type Classification = z.infer<typeof ClassificationSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// INTENT SCHEMA (Golden Thread)\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const IntentSchema = z.object({\r\n  linked: z.boolean().default(false),\r\n  ticketSystem: z.enum([\"jira\", \"ado\", \"github\", \"gitlab\"]).nullable().optional(),\r\n  ticketId: z.string().nullable().optional(),\r\n  ticketUrl: z.string().url().nullable().optional(),\r\n  businessJustification: z.string().nullable().optional(),\r\n  riskTolerance: z.enum([\"low\", \"medium\", \"high\"]).nullable().optional(),\r\n  importedAt: z.string().datetime().nullable().optional(),\r\n});\r\n\r\nexport type Intent = z.infer<typeof IntentSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// GOVERNANCE SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const ApprovalSchema = z.object({\r\n  role: z.string(),\r\n  name: z.string(),\r\n  email: z.string().email().optional(),\r\n  date: z.string(),\r\n  source: z.string().optional(),\r\n});\r\n\r\nexport const GovernanceSchema = z.object({\r\n  status: z.enum([\"draft\", \"linked\", \"approved\", \"production\", \"deprecated\", \"revoked\"]),\r\n  approvals: z.array(ApprovalSchema).default([]),\r\n  deployment: z\r\n    .object({\r\n      environments: z.array(z.string()).default([]),\r\n      lastDeployed: z.string().datetime().nullable().optional(),\r\n    })\r\n    .optional(),\r\n});\r\n\r\nexport type Governance = z.infer<typeof GovernanceSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// CONSTRAINTS SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const ConstraintsSchema = z.object({\r\n  runtime: z\r\n    .object({\r\n      maxIterations: z.number().positive().optional(),\r\n      timeoutSeconds: z.number().positive().optional(),\r\n      maxTokensPerRequest: z.number().positive().optional(),\r\n      maxCostPerRequestUsd: z.number().positive().optional(),\r\n    })\r\n    .optional(),\r\n  humanApprovalRequired: z.array(z.string()).optional(),\r\n  monitoring: z\r\n    .object({\r\n      logAllDecisions: z.boolean().default(true),\r\n      logToolInvocations: z.boolean().default(true),\r\n    })\r\n    .optional(),\r\n});\r\n\r\nexport type Constraints = z.infer<typeof ConstraintsSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// ASSET CARD SCHEMA (Main Schema)\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const AssetCardSchema = z.object({\r\n  $schema: z.string().optional(),\r\n  id: z.string().regex(/^aigrc-\\d{4}-[a-f0-9]{8}$/),\r\n  name: z.string().min(1).max(100),\r\n  description: z.string().max(500).optional(),\r\n  version: z.string().default(\"1.0.0\"),\r\n  created: z.string().datetime(),\r\n  updated: z.string().datetime(),\r\n  ownership: z.object({\r\n    owner: OwnerSchema,\r\n    team: z.string().optional(),\r\n  }),\r\n  technical: TechnicalSchema,\r\n  classification: ClassificationSchema,\r\n  intent: IntentSchema,\r\n  governance: GovernanceSchema,\r\n  constraints: ConstraintsSchema.optional(),\r\n});\r\n\r\nexport type AssetCard = z.infer<typeof AssetCardSchema>;"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAkB;AAMX,IAAM,cAAc,aAAE,OAAO;AAAA,EAClC,MAAM,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,OAAO,aAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,aAAE,OAAO,EAAE,SAAS;AAC5B,CAAC;AAQM,IAAM,kBAAkB,aAAE,OAAO;AAAA,EACtC,MAAM,aAAE,KAAK,CAAC,SAAS,SAAS,cAAc,aAAa,UAAU,CAAC;AAAA,EACtE,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,kBAAkB,aAAE,OAAO,EAAE,SAAS;AAAA,EACtC,YAAY,aACT;AAAA,IACC,aAAE,OAAO;AAAA,MACP,MAAM,aAAE,OAAO;AAAA,MACf,UAAU,aAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH,EACC,SAAS;AAAA,EACZ,aAAa,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAC5C,CAAC;AAQM,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACxC,qBAAqB,aAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC9C,gBAAgB,aAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACzC,eAAe,aAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,oBAAoB,aAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC7C,eAAe,aAAE,KAAK,CAAC,OAAO,MAAM,SAAS,CAAC,EAAE,QAAQ,SAAS;AAAA,EACjE,qBAAqB,aAAE,QAAQ,EAAE,QAAQ,KAAK;AAChD,CAAC;AAQM,IAAM,sBAAsB,aAAE,OAAO;AAAA,EAC1C,WAAW,aAAE,OAAO;AAAA,EACpB,QAAQ,aAAE,KAAK,CAAC,eAAe,WAAW,mBAAmB,gBAAgB,CAAC;AAAA,EAC9E,UAAU,aAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAa,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC9C,CAAC;AAIM,IAAM,mCAAmC,aAAE,OAAO;AAAA;AAAA,EAEvD,gBAAgB,aAAE,OAAO;AAAA;AAAA,EAEzB,WAAW,aAAE,OAAO;AAAA;AAAA,EAEpB,UAAU,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE9B,iBAAiB,aAAE,MAAM,mBAAmB,EAAE,SAAS;AAAA;AAAA,EAEvD,mBAAmB,aAChB;AAAA,IACC,aAAE,OAAO;AAAA,MACP,YAAY,aAAE,OAAO;AAAA,MACrB,QAAQ,aAAE,KAAK,CAAC,WAAW,YAAY,gBAAgB,CAAC;AAAA,MACxD,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,CAAC;AAAA,EACH,EACC,SAAS;AAAA;AAAA,EAEZ,aAAa,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE5C,sBAAsB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5D,CAAC;AAQM,IAAM,sCAAsC,aAAE,OAAO;AAAA,EAC1D,OAAO,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,YAAY,aAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAIM,IAAM,wBAAwB,aAAE,OAAO;AAAA;AAAA,EAE5C,OAAO,oCAAoC,SAAS;AAAA,EACpD,UAAU,oCAAoC,SAAS;AAAA;AAAA,EAEvD,MAAM,oCAAoC,SAAS;AAAA;AAAA,EAEnD,QAAQ,oCAAoC,SAAS;AAAA;AAAA,EAErD,aAAa,oCAAoC,SAAS;AAAA;AAAA,EAE1D,aAAa,oCAAoC,SAAS;AAAA;AAAA,EAE1D,aAAa,oCAAoC,SAAS;AAAA;AAAA,EAE1D,iBAAiB,oCAAoC,SAAS;AAAA;AAAA,EAE9D,MAAM,oCAAoC,SAAS;AACrD,CAAC;AAQM,IAAM,uBAAuB,aAAE,OAAO;AAAA;AAAA,EAE3C,WAAW,aAAE,KAAK,CAAC,WAAW,WAAW,QAAQ,cAAc,CAAC;AAAA;AAAA,EAEhE,aAAa;AAAA;AAAA,EAEb,SAAS,aACN,OAAO;AAAA,IACN,UAAU,aAAE,OAAO;AAAA,IACnB,sBAAsB,aAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjD,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,mBAAmB,aAChB;AAAA,IACC,aAAE,OAAO;AAAA,MACP,MAAM,aAAE,OAAO;AAAA,MACf,QAAQ,aAAE,KAAK,CAAC,WAAW,YAAY,gBAAgB,CAAC;AAAA,MACxD,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,CAAC;AAAA,EACH,EACC,SAAS;AAAA;AAAA,EAEZ,eAAe,aAAE,MAAM,gCAAgC,EAAE,SAAS;AAAA;AAAA,EAElE,iBAAiB,sBAAsB,SAAS;AAClD,CAAC;AAQM,IAAM,eAAe,aAAE,OAAO;AAAA,EACnC,QAAQ,aAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,cAAc,aAAE,KAAK,CAAC,QAAQ,OAAO,UAAU,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9E,UAAU,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,WAAW,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,uBAAuB,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,eAAe,aAAE,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,YAAY,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAQM,IAAM,iBAAiB,aAAE,OAAO;AAAA,EACrC,MAAM,aAAE,OAAO;AAAA,EACf,MAAM,aAAE,OAAO;AAAA,EACf,OAAO,aAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,MAAM,aAAE,OAAO;AAAA,EACf,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAEM,IAAM,mBAAmB,aAAE,OAAO;AAAA,EACvC,QAAQ,aAAE,KAAK,CAAC,SAAS,UAAU,YAAY,cAAc,cAAc,SAAS,CAAC;AAAA,EACrF,WAAW,aAAE,MAAM,cAAc,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,YAAY,aACT,OAAO;AAAA,IACN,cAAc,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,IAC5C,cAAc,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,CAAC,EACA,SAAS;AACd,CAAC;AAQM,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACxC,SAAS,aACN,OAAO;AAAA,IACN,eAAe,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC9C,gBAAgB,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC/C,qBAAqB,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACpD,sBAAsB,aAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,CAAC,EACA,SAAS;AAAA,EACZ,uBAAuB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACpD,YAAY,aACT,OAAO;AAAA,IACN,iBAAiB,aAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACzC,oBAAoB,aAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC9C,CAAC,EACA,SAAS;AACd,CAAC;AAQM,IAAM,kBAAkB,aAAE,OAAO;AAAA,EACtC,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,IAAI,aAAE,OAAO,EAAE,MAAM,2BAA2B;AAAA,EAChD,MAAM,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAa,aAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,SAAS,aAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,EACnC,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,aAAE,OAAO;AAAA,IAClB,OAAO;AAAA,IACP,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC;AAAA,EACD,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,aAAa,kBAAkB,SAAS;AAC1C,CAAC;","names":[]}

package/dist/schemas/index.mjs

@@ -0,0 +1,176 @@
+// src/schemas/index.ts
+import { z } from "zod";
+var OwnerSchema = z.object({
+  name: z.string().min(1),
+  email: z.string().email(),
+  team: z.string().optional()
+});
+var TechnicalSchema = z.object({
+  type: z.enum(["model", "agent", "api_client", "framework", "pipeline"]),
+  framework: z.string().optional(),
+  frameworkVersion: z.string().optional(),
+  components: z.array(
+    z.object({
+      type: z.string(),
+      provider: z.string().optional(),
+      model: z.string().optional()
+    })
+  ).optional(),
+  sourceFiles: z.array(z.string()).optional()
+});
+var RiskFactorsSchema = z.object({
+  autonomousDecisions: z.boolean().default(false),
+  customerFacing: z.boolean().default(false),
+  toolExecution: z.boolean().default(false),
+  externalDataAccess: z.boolean().default(false),
+  piiProcessing: z.enum(["yes", "no", "unknown"]).default("unknown"),
+  highStakesDecisions: z.boolean().default(false)
+});
+var ControlStatusSchema = z.object({
+  controlId: z.string(),
+  status: z.enum(["implemented", "partial", "not_implemented", "not_applicable"]),
+  evidence: z.string().optional(),
+  notes: z.string().optional(),
+  lastUpdated: z.string().datetime().optional()
+});
+var JurisdictionClassificationSchema = z.object({
+  /** Profile/jurisdiction ID (e.g., "eu-ai-act", "us-omb-m24") */
+  jurisdictionId: z.string(),
+  /** Risk level mapped to this jurisdiction's terminology */
+  riskLevel: z.string(),
+  /** Jurisdiction-specific category (e.g., EU AI Act category) */
+  category: z.string().optional(),
+  /** Status of controls for this jurisdiction */
+  controlStatuses: z.array(ControlStatusSchema).optional(),
+  /** Required artifacts for this jurisdiction */
+  requiredArtifacts: z.array(
+    z.object({
+      artifactId: z.string(),
+      status: z.enum(["pending", "complete", "not_applicable"]),
+      path: z.string().optional()
+    })
+  ).optional(),
+  /** Last compliance check date */
+  lastChecked: z.string().datetime().optional(),
+  /** Compliance percentage for this jurisdiction */
+  compliancePercentage: z.number().min(0).max(100).optional()
+});
+var TrustworthinessCharacteristicSchema = z.object({
+  score: z.number().min(0).max(100).optional(),
+  notes: z.string().optional(),
+  lastAssessed: z.string().datetime().optional(),
+  assessedBy: z.string().optional()
+});
+var TrustworthinessSchema = z.object({
+  /** Valid and reliable: produces accurate, consistent results */
+  valid: TrustworthinessCharacteristicSchema.optional(),
+  reliable: TrustworthinessCharacteristicSchema.optional(),
+  /** Safe: minimizes harm and risk */
+  safe: TrustworthinessCharacteristicSchema.optional(),
+  /** Secure: protected against threats */
+  secure: TrustworthinessCharacteristicSchema.optional(),
+  /** Accountable: clear responsibility and oversight */
+  accountable: TrustworthinessCharacteristicSchema.optional(),
+  /** Transparent: understandable and open about limitations */
+  transparent: TrustworthinessCharacteristicSchema.optional(),
+  /** Explainable: decisions can be understood */
+  explainable: TrustworthinessCharacteristicSchema.optional(),
+  /** Privacy-enhanced: protects personal information */
+  privacyEnhanced: TrustworthinessCharacteristicSchema.optional(),
+  /** Fair: avoids bias and discrimination */
+  fair: TrustworthinessCharacteristicSchema.optional()
+});
+var ClassificationSchema = z.object({
+  /** Primary AIGRC risk level */
+  riskLevel: z.enum(["minimal", "limited", "high", "unacceptable"]),
+  /** Risk factors that influenced the classification */
+  riskFactors: RiskFactorsSchema,
+  /** EU AI Act specific classification (legacy, prefer jurisdictions) */
+  euAiAct: z.object({
+    category: z.string(),
+    transparencyRequired: z.boolean().default(false)
+  }).optional(),
+  /** Required artifacts based on classification */
+  requiredArtifacts: z.array(
+    z.object({
+      type: z.string(),
+      status: z.enum(["pending", "complete", "not_applicable"]),
+      path: z.string().optional()
+    })
+  ).optional(),
+  /** Per-jurisdiction classifications for multi-jurisdiction compliance */
+  jurisdictions: z.array(JurisdictionClassificationSchema).optional(),
+  /** NIST AI RMF trustworthiness characteristics */
+  trustworthiness: TrustworthinessSchema.optional()
+});
+var IntentSchema = z.object({
+  linked: z.boolean().default(false),
+  ticketSystem: z.enum(["jira", "ado", "github", "gitlab"]).nullable().optional(),
+  ticketId: z.string().nullable().optional(),
+  ticketUrl: z.string().url().nullable().optional(),
+  businessJustification: z.string().nullable().optional(),
+  riskTolerance: z.enum(["low", "medium", "high"]).nullable().optional(),
+  importedAt: z.string().datetime().nullable().optional()
+});
+var ApprovalSchema = z.object({
+  role: z.string(),
+  name: z.string(),
+  email: z.string().email().optional(),
+  date: z.string(),
+  source: z.string().optional()
+});
+var GovernanceSchema = z.object({
+  status: z.enum(["draft", "linked", "approved", "production", "deprecated", "revoked"]),
+  approvals: z.array(ApprovalSchema).default([]),
+  deployment: z.object({
+    environments: z.array(z.string()).default([]),
+    lastDeployed: z.string().datetime().nullable().optional()
+  }).optional()
+});
+var ConstraintsSchema = z.object({
+  runtime: z.object({
+    maxIterations: z.number().positive().optional(),
+    timeoutSeconds: z.number().positive().optional(),
+    maxTokensPerRequest: z.number().positive().optional(),
+    maxCostPerRequestUsd: z.number().positive().optional()
+  }).optional(),
+  humanApprovalRequired: z.array(z.string()).optional(),
+  monitoring: z.object({
+    logAllDecisions: z.boolean().default(true),
+    logToolInvocations: z.boolean().default(true)
+  }).optional()
+});
+var AssetCardSchema = z.object({
+  $schema: z.string().optional(),
+  id: z.string().regex(/^aigrc-\d{4}-[a-f0-9]{8}$/),
+  name: z.string().min(1).max(100),
+  description: z.string().max(500).optional(),
+  version: z.string().default("1.0.0"),
+  created: z.string().datetime(),
+  updated: z.string().datetime(),
+  ownership: z.object({
+    owner: OwnerSchema,
+    team: z.string().optional()
+  }),
+  technical: TechnicalSchema,
+  classification: ClassificationSchema,
+  intent: IntentSchema,
+  governance: GovernanceSchema,
+  constraints: ConstraintsSchema.optional()
+});
+export {
+  ApprovalSchema,
+  AssetCardSchema,
+  ClassificationSchema,
+  ConstraintsSchema,
+  ControlStatusSchema,
+  GovernanceSchema,
+  IntentSchema,
+  JurisdictionClassificationSchema,
+  OwnerSchema,
+  RiskFactorsSchema,
+  TechnicalSchema,
+  TrustworthinessCharacteristicSchema,
+  TrustworthinessSchema
+};
+//# sourceMappingURL=index.mjs.map

package/dist/schemas/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/index.ts"],"sourcesContent":["import { z } from \"zod\";\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// OWNER SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const OwnerSchema = z.object({\r\n  name: z.string().min(1),\r\n  email: z.string().email(),\r\n  team: z.string().optional(),\r\n});\r\n\r\nexport type Owner = z.infer<typeof OwnerSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// TECHNICAL SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const TechnicalSchema = z.object({\r\n  type: z.enum([\"model\", \"agent\", \"api_client\", \"framework\", \"pipeline\"]),\r\n  framework: z.string().optional(),\r\n  frameworkVersion: z.string().optional(),\r\n  components: z\r\n    .array(\r\n      z.object({\r\n        type: z.string(),\r\n        provider: z.string().optional(),\r\n        model: z.string().optional(),\r\n      })\r\n    )\r\n    .optional(),\r\n  sourceFiles: z.array(z.string()).optional(),\r\n});\r\n\r\nexport type Technical = z.infer<typeof TechnicalSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// RISK FACTORS SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const RiskFactorsSchema = z.object({\r\n  autonomousDecisions: z.boolean().default(false),\r\n  customerFacing: z.boolean().default(false),\r\n  toolExecution: z.boolean().default(false),\r\n  externalDataAccess: z.boolean().default(false),\r\n  piiProcessing: z.enum([\"yes\", \"no\", \"unknown\"]).default(\"unknown\"),\r\n  highStakesDecisions: z.boolean().default(false),\r\n});\r\n\r\nexport type RiskFactors = z.infer<typeof RiskFactorsSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// JURISDICTION CLASSIFICATION SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const ControlStatusSchema = z.object({\r\n  controlId: z.string(),\r\n  status: z.enum([\"implemented\", \"partial\", \"not_implemented\", \"not_applicable\"]),\r\n  evidence: z.string().optional(),\r\n  notes: z.string().optional(),\r\n  lastUpdated: z.string().datetime().optional(),\r\n});\r\n\r\nexport type ControlStatus = z.infer<typeof ControlStatusSchema>;\r\n\r\nexport const JurisdictionClassificationSchema = z.object({\r\n  /** Profile/jurisdiction ID (e.g., \"eu-ai-act\", \"us-omb-m24\") */\r\n  jurisdictionId: z.string(),\r\n  /** Risk level mapped to this jurisdiction's terminology */\r\n  riskLevel: z.string(),\r\n  /** Jurisdiction-specific category (e.g., EU AI Act category) */\r\n  category: z.string().optional(),\r\n  /** Status of controls for this jurisdiction */\r\n  controlStatuses: z.array(ControlStatusSchema).optional(),\r\n  /** Required artifacts for this jurisdiction */\r\n  requiredArtifacts: z\r\n    .array(\r\n      z.object({\r\n        artifactId: z.string(),\r\n        status: z.enum([\"pending\", \"complete\", \"not_applicable\"]),\r\n        path: z.string().optional(),\r\n      })\r\n    )\r\n    .optional(),\r\n  /** Last compliance check date */\r\n  lastChecked: z.string().datetime().optional(),\r\n  /** Compliance percentage for this jurisdiction */\r\n  compliancePercentage: z.number().min(0).max(100).optional(),\r\n});\r\n\r\nexport type JurisdictionClassification = z.infer<typeof JurisdictionClassificationSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// TRUSTWORTHINESS CHARACTERISTICS SCHEMA (NIST AI RMF)\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const TrustworthinessCharacteristicSchema = z.object({\r\n  score: z.number().min(0).max(100).optional(),\r\n  notes: z.string().optional(),\r\n  lastAssessed: z.string().datetime().optional(),\r\n  assessedBy: z.string().optional(),\r\n});\r\n\r\nexport type TrustworthinessCharacteristic = z.infer<typeof TrustworthinessCharacteristicSchema>;\r\n\r\nexport const TrustworthinessSchema = z.object({\r\n  /** Valid and reliable: produces accurate, consistent results */\r\n  valid: TrustworthinessCharacteristicSchema.optional(),\r\n  reliable: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Safe: minimizes harm and risk */\r\n  safe: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Secure: protected against threats */\r\n  secure: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Accountable: clear responsibility and oversight */\r\n  accountable: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Transparent: understandable and open about limitations */\r\n  transparent: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Explainable: decisions can be understood */\r\n  explainable: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Privacy-enhanced: protects personal information */\r\n  privacyEnhanced: TrustworthinessCharacteristicSchema.optional(),\r\n  /** Fair: avoids bias and discrimination */\r\n  fair: TrustworthinessCharacteristicSchema.optional(),\r\n});\r\n\r\nexport type Trustworthiness = z.infer<typeof TrustworthinessSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// CLASSIFICATION SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const ClassificationSchema = z.object({\r\n  /** Primary AIGRC risk level */\r\n  riskLevel: z.enum([\"minimal\", \"limited\", \"high\", \"unacceptable\"]),\r\n  /** Risk factors that influenced the classification */\r\n  riskFactors: RiskFactorsSchema,\r\n  /** EU AI Act specific classification (legacy, prefer jurisdictions) */\r\n  euAiAct: z\r\n    .object({\r\n      category: z.string(),\r\n      transparencyRequired: z.boolean().default(false),\r\n    })\r\n    .optional(),\r\n  /** Required artifacts based on classification */\r\n  requiredArtifacts: z\r\n    .array(\r\n      z.object({\r\n        type: z.string(),\r\n        status: z.enum([\"pending\", \"complete\", \"not_applicable\"]),\r\n        path: z.string().optional(),\r\n      })\r\n    )\r\n    .optional(),\r\n  /** Per-jurisdiction classifications for multi-jurisdiction compliance */\r\n  jurisdictions: z.array(JurisdictionClassificationSchema).optional(),\r\n  /** NIST AI RMF trustworthiness characteristics */\r\n  trustworthiness: TrustworthinessSchema.optional(),\r\n});\r\n\r\nexport type Classification = z.infer<typeof ClassificationSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// INTENT SCHEMA (Golden Thread)\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const IntentSchema = z.object({\r\n  linked: z.boolean().default(false),\r\n  ticketSystem: z.enum([\"jira\", \"ado\", \"github\", \"gitlab\"]).nullable().optional(),\r\n  ticketId: z.string().nullable().optional(),\r\n  ticketUrl: z.string().url().nullable().optional(),\r\n  businessJustification: z.string().nullable().optional(),\r\n  riskTolerance: z.enum([\"low\", \"medium\", \"high\"]).nullable().optional(),\r\n  importedAt: z.string().datetime().nullable().optional(),\r\n});\r\n\r\nexport type Intent = z.infer<typeof IntentSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// GOVERNANCE SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const ApprovalSchema = z.object({\r\n  role: z.string(),\r\n  name: z.string(),\r\n  email: z.string().email().optional(),\r\n  date: z.string(),\r\n  source: z.string().optional(),\r\n});\r\n\r\nexport const GovernanceSchema = z.object({\r\n  status: z.enum([\"draft\", \"linked\", \"approved\", \"production\", \"deprecated\", \"revoked\"]),\r\n  approvals: z.array(ApprovalSchema).default([]),\r\n  deployment: z\r\n    .object({\r\n      environments: z.array(z.string()).default([]),\r\n      lastDeployed: z.string().datetime().nullable().optional(),\r\n    })\r\n    .optional(),\r\n});\r\n\r\nexport type Governance = z.infer<typeof GovernanceSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// CONSTRAINTS SCHEMA\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const ConstraintsSchema = z.object({\r\n  runtime: z\r\n    .object({\r\n      maxIterations: z.number().positive().optional(),\r\n      timeoutSeconds: z.number().positive().optional(),\r\n      maxTokensPerRequest: z.number().positive().optional(),\r\n      maxCostPerRequestUsd: z.number().positive().optional(),\r\n    })\r\n    .optional(),\r\n  humanApprovalRequired: z.array(z.string()).optional(),\r\n  monitoring: z\r\n    .object({\r\n      logAllDecisions: z.boolean().default(true),\r\n      logToolInvocations: z.boolean().default(true),\r\n    })\r\n    .optional(),\r\n});\r\n\r\nexport type Constraints = z.infer<typeof ConstraintsSchema>;\r\n\r\n// ─────────────────────────────────────────────────────────────────\r\n// ASSET CARD SCHEMA (Main Schema)\r\n// ─────────────────────────────────────────────────────────────────\r\n\r\nexport const AssetCardSchema = z.object({\r\n  $schema: z.string().optional(),\r\n  id: z.string().regex(/^aigrc-\\d{4}-[a-f0-9]{8}$/),\r\n  name: z.string().min(1).max(100),\r\n  description: z.string().max(500).optional(),\r\n  version: z.string().default(\"1.0.0\"),\r\n  created: z.string().datetime(),\r\n  updated: z.string().datetime(),\r\n  ownership: z.object({\r\n    owner: OwnerSchema,\r\n    team: z.string().optional(),\r\n  }),\r\n  technical: TechnicalSchema,\r\n  classification: ClassificationSchema,\r\n  intent: IntentSchema,\r\n  governance: GovernanceSchema,\r\n  constraints: ConstraintsSchema.optional(),\r\n});\r\n\r\nexport type AssetCard = z.infer<typeof AssetCardSchema>;"],"mappings":";AAAA,SAAS,SAAS;AAMX,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS;AAC5B,CAAC;AAQM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,KAAK,CAAC,SAAS,SAAS,cAAc,aAAa,UAAU,CAAC;AAAA,EACtE,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,MAAM,EAAE,OAAO;AAAA,MACf,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH,EACC,SAAS;AAAA,EACZ,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAC5C,CAAC;AAQM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC9C,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACzC,eAAe,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC7C,eAAe,EAAE,KAAK,CAAC,OAAO,MAAM,SAAS,CAAC,EAAE,QAAQ,SAAS;AAAA,EACjE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAChD,CAAC;AAQM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,KAAK,CAAC,eAAe,WAAW,mBAAmB,gBAAgB,CAAC;AAAA,EAC9E,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC9C,CAAC;AAIM,IAAM,mCAAmC,EAAE,OAAO;AAAA;AAAA,EAEvD,gBAAgB,EAAE,OAAO;AAAA;AAAA,EAEzB,WAAW,EAAE,OAAO;AAAA;AAAA,EAEpB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE9B,iBAAiB,EAAE,MAAM,mBAAmB,EAAE,SAAS;AAAA;AAAA,EAEvD,mBAAmB,EAChB;AAAA,IACC,EAAE,OAAO;AAAA,MACP,YAAY,EAAE,OAAO;AAAA,MACrB,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,gBAAgB,CAAC;AAAA,MACxD,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,CAAC;AAAA,EACH,EACC,SAAS;AAAA;AAAA,EAEZ,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE5C,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5D,CAAC;AAQM,IAAM,sCAAsC,EAAE,OAAO;AAAA,EAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAIM,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,OAAO,oCAAoC,SAAS;AAAA,EACpD,UAAU,oCAAoC,SAAS;AAAA;AAAA,EAEvD,MAAM,oCAAoC,SAAS;AAAA;AAAA,EAEnD,QAAQ,oCAAoC,SAAS;AAAA;AAAA,EAErD,aAAa,oCAAoC,SAAS;AAAA;AAAA,EAE1D,aAAa,oCAAoC,SAAS;AAAA;AAAA,EAE1D,aAAa,oCAAoC,SAAS;AAAA;AAAA,EAE1D,iBAAiB,oCAAoC,SAAS;AAAA;AAAA,EAE9D,MAAM,oCAAoC,SAAS;AACrD,CAAC;AAQM,IAAM,uBAAuB,EAAE,OAAO;AAAA;AAAA,EAE3C,WAAW,EAAE,KAAK,CAAC,WAAW,WAAW,QAAQ,cAAc,CAAC;AAAA;AAAA,EAEhE,aAAa;AAAA;AAAA,EAEb,SAAS,EACN,OAAO;AAAA,IACN,UAAU,EAAE,OAAO;AAAA,IACnB,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjD,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,mBAAmB,EAChB;AAAA,IACC,EAAE,OAAO;AAAA,MACP,MAAM,EAAE,OAAO;AAAA,MACf,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,gBAAgB,CAAC;AAAA,MACxD,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,CAAC;AAAA,EACH,EACC,SAAS;AAAA;AAAA,EAEZ,eAAe,EAAE,MAAM,gCAAgC,EAAE,SAAS;AAAA;AAAA,EAElE,iBAAiB,sBAAsB,SAAS;AAClD,CAAC;AAQM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,cAAc,EAAE,KAAK,CAAC,QAAQ,OAAO,UAAU,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9E,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,eAAe,EAAE,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAQM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAEM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,QAAQ,EAAE,KAAK,CAAC,SAAS,UAAU,YAAY,cAAc,cAAc,SAAS,CAAC;AAAA,EACrF,WAAW,EAAE,MAAM,cAAc,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,YAAY,EACT,OAAO;AAAA,IACN,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,IAC5C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,CAAC,EACA,SAAS;AACd,CAAC;AAQM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,SAAS,EACN,OAAO;AAAA,IACN,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC9C,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC/C,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACpD,sBAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,CAAC,EACA,SAAS;AAAA,EACZ,uBAAuB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACpD,YAAY,EACT,OAAO;AAAA,IACN,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACzC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC9C,CAAC,EACA,SAAS;AACd,CAAC;AAQM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,IAAI,EAAE,OAAO,EAAE,MAAM,2BAA2B;AAAA,EAChD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO;AAAA,IAClB,OAAO;AAAA,IACP,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC;AAAA,EACD,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,aAAa,kBAAkB,SAAS;AAC1C,CAAC;","names":[]}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@aigrc/core",
+  "version": "0.1.0",
+  "description": "Core logic for AIGRC - schemas, validation, risk classification",
+  "license": "Apache-2.0",
+  "author": "AIGRC <contact@aigrc.dev>",
+  "homepage": "https://github.com/aigrc/aigrc#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aigrc/aigrc.git",
+    "directory": "packages/core"
+  },
+  "bugs": {
+    "url": "https://github.com/aigrc/aigrc/issues"
+  },
+  "keywords": [
+    "aigrc",
+    "ai-governance",
+    "risk-management",
+    "compliance",
+    "eu-ai-act",
+    "nist-ai-rmf",
+    "iso-42001",
+    "schemas",
+    "validation",
+    "zod"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./schemas": {
+      "types": "./dist/schemas/index.d.ts",
+      "import": "./dist/schemas/index.mjs",
+      "require": "./dist/schemas/index.js"
+    }
+  },
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rimraf dist"
+  },
+  "dependencies": {
+    "yaml": "^2.3.4",
+    "zod": "^3.22.4",
+    "zod-to-json-schema": "^3.22.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.10.0",
+    "rimraf": "^5.0.0",
+    "tsup": "^8.0.1",
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  }
+}