@grc-claw/aims 0.8.0

package/dist/clause-map.d.ts

@@ -0,0 +1,8 @@
+export interface ClauseMapping {
+    clause: string;
+    title: string;
+    implementationAnchor: string;
+}
+export declare const ISO_42001_CLAUSE_MAP: ClauseMapping[];
+export declare function listClauseMap(): ClauseMapping[];
+//# sourceMappingURL=clause-map.d.ts.map

package/dist/clause-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clause-map.d.ts","sourceRoot":"","sources":["../src/clause-map.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,EAAE,aAAa,EAQ/C,CAAC;AAEF,wBAAgB,aAAa,IAAI,aAAa,EAAE,CAE/C"}

package/dist/clause-map.js

@@ -0,0 +1,13 @@
+export const ISO_42001_CLAUSE_MAP = [
+    { clause: '4', title: 'Context of the organization', implementationAnchor: 'AIMS scope doc, interested parties' },
+    { clause: '5', title: 'Leadership', implementationAnchor: 'AI policy, roles, management commitment' },
+    { clause: '6', title: 'Planning', implementationAnchor: 'AI risk register, objectives' },
+    { clause: '7', title: 'Support', implementationAnchor: 'Competence, awareness, documented information' },
+    { clause: '8', title: 'Operation', implementationAnchor: 'Gateway, exec policy, suppliers' },
+    { clause: '9', title: 'Performance evaluation', implementationAnchor: 'KPIs, audit, management review' },
+    { clause: '10', title: 'Improvement', implementationAnchor: 'Nonconformity, corrective action' },
+];
+export function listClauseMap() {
+    return [...ISO_42001_CLAUSE_MAP];
+}
+//# sourceMappingURL=clause-map.js.map

package/dist/clause-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clause-map.js","sourceRoot":"","sources":["../src/clause-map.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACnD,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,oCAAoC,EAAE;IACjH,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,yCAAyC,EAAE;IACrG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,8BAA8B,EAAE;IACxF,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,+CAA+C,EAAE;IACxG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,iCAAiC,EAAE;IAC5F,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,gCAAgC,EAAE;IACxG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,kCAAkC,EAAE;CACjG,CAAC;AAEF,MAAM,UAAU,aAAa;IAC3B,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { listVendorGaps, listVendorGapSummary, VENDOR_GAP_MATRIX, type VendorGapRow, type VendorId, } from './vendor-gaps.js';
+export { listTechnicalControls, AIMS_TECHNICAL_CONTROLS, type AimsTechnicalControl } from './technical-controls.js';
+export { listClauseMap, ISO_42001_CLAUSE_MAP, type ClauseMapping } from './clause-map.js';
+export declare const AIMS_SCOPE_TEMPLATE: {
+    standard: string;
+    product: string;
+    productionSoc: string;
+    inScope: string[];
+    outOfScope: string[];
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,QAAQ,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpH,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE1F,eAAO,MAAM,mBAAmB;;;;;;CAa/B,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+export { listVendorGaps, listVendorGapSummary, VENDOR_GAP_MATRIX, } from './vendor-gaps.js';
+export { listTechnicalControls, AIMS_TECHNICAL_CONTROLS } from './technical-controls.js';
+export { listClauseMap, ISO_42001_CLAUSE_MAP } from './clause-map.js';
+export const AIMS_SCOPE_TEMPLATE = {
+    standard: 'ISO/IEC 42001:2023',
+    product: 'GRC_Claw (OpenClaw for GRC)',
+    productionSoc: 'https://a2zsoc.com',
+    inScope: [
+        'GRC_Claw gateway and agent-runtime',
+        'Framework packs including ISO 42001 AIMS controls',
+        'Customer deployments integrated with a2zsoc.com',
+    ],
+    outOfScope: [
+        'Customer-owned LLM training data',
+        'Third-party model weights (Anthropic, OpenAI, etc.) — documented as suppliers',
+    ],
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAA6B,MAAM,yBAAyB,CAAC;AACpH,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAE1F,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,QAAQ,EAAE,oBAAoB;IAC9B,OAAO,EAAE,6BAA6B;IACtC,aAAa,EAAE,oBAAoB;IACnC,OAAO,EAAE;QACP,oCAAoC;QACpC,mDAAmD;QACnD,iDAAiD;KAClD;IACD,UAAU,EAAE;QACV,kCAAkC;QAClC,+EAA+E;KAChF;CACF,CAAC"}

package/dist/technical-controls.d.ts

@@ -0,0 +1,10 @@
+export interface AimsTechnicalControl {
+    id: string;
+    objective: string;
+    clause: string;
+    grcClawComponent: string;
+    evidenceCommand?: string;
+}
+export declare const AIMS_TECHNICAL_CONTROLS: AimsTechnicalControl[];
+export declare function listTechnicalControls(): AimsTechnicalControl[];
+//# sourceMappingURL=technical-controls.d.ts.map

package/dist/technical-controls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"technical-controls.d.ts","sourceRoot":"","sources":["../src/technical-controls.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,uBAAuB,EAAE,oBAAoB,EAwCzD,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAE9D"}

package/dist/technical-controls.js

@@ -0,0 +1,45 @@
+export const AIMS_TECHNICAL_CONTROLS = [
+    {
+        id: 'TC-01',
+        objective: 'Human oversight of agent actions',
+        clause: '8 / A.14',
+        grcClawComponent: '@grc-claw/agent-runtime',
+        evidenceCommand: 'POST /api/agent/invoke (destructive without approval → 403)',
+    },
+    {
+        id: 'TC-02',
+        objective: 'Traceability of agent decisions',
+        clause: '9 / A.10',
+        grcClawComponent: 'AgentSession.getAuditLog()',
+    },
+    {
+        id: 'TC-03',
+        objective: 'Access control to control plane',
+        clause: '8 / A.12',
+        grcClawComponent: '@grc-claw/gateway',
+        evidenceCommand: 'WS connect + X-GRC-Claw-Token',
+    },
+    {
+        id: 'TC-04',
+        objective: 'Integrity of compliance evidence',
+        clause: '7 / A.6',
+        grcClawComponent: '@grc-claw/evidence',
+    },
+    {
+        id: 'TC-05',
+        objective: 'Monitoring AI-related security events',
+        clause: '9 / A.10',
+        grcClawComponent: '@grc-claw/ingest + a2zsoc.com',
+        evidenceCommand: 'POST /api/ingest/normalize',
+    },
+    {
+        id: 'TC-06',
+        objective: 'Supplier API key hygiene',
+        clause: '8 / A.9',
+        grcClawComponent: 'npm run doctor',
+    },
+];
+export function listTechnicalControls() {
+    return [...AIMS_TECHNICAL_CONTROLS];
+}
+//# sourceMappingURL=technical-controls.js.map

package/dist/technical-controls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"technical-controls.js","sourceRoot":"","sources":["../src/technical-controls.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,kCAAkC;QAC7C,MAAM,EAAE,UAAU;QAClB,gBAAgB,EAAE,yBAAyB;QAC3C,eAAe,EAAE,6DAA6D;KAC/E;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,iCAAiC;QAC5C,MAAM,EAAE,UAAU;QAClB,gBAAgB,EAAE,4BAA4B;KAC/C;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,iCAAiC;QAC5C,MAAM,EAAE,UAAU;QAClB,gBAAgB,EAAE,mBAAmB;QACrC,eAAe,EAAE,+BAA+B;KACjD;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,kCAAkC;QAC7C,MAAM,EAAE,SAAS;QACjB,gBAAgB,EAAE,oBAAoB;KACvC;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,uCAAuC;QAClD,MAAM,EAAE,UAAU;QAClB,gBAAgB,EAAE,+BAA+B;QACjD,eAAe,EAAE,4BAA4B;KAC9C;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,0BAA0B;QACrC,MAAM,EAAE,SAAS;QACjB,gBAAgB,EAAE,gBAAgB;KACnC;CACF,CAAC;AAEF,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,uBAAuB,CAAC,CAAC;AACtC,CAAC"}

package/dist/vendor-gaps.d.ts

@@ -0,0 +1,17 @@
+export type VendorId = 'anthropic' | 'openai' | 'cursor' | 'openclaw';
+export interface VendorGapRow {
+    vendor: VendorId;
+    area: string;
+    strength: string;
+    gapTheme: string;
+    mitigation: string;
+    grcClawControlIds?: string[];
+}
+export declare const VENDOR_GAP_MATRIX: VendorGapRow[];
+export declare function listVendorGaps(vendor?: VendorId): VendorGapRow[];
+export declare function listVendorGapSummary(): {
+    vendor: VendorId;
+    strength: string;
+    gapTheme: string;
+}[];
+//# sourceMappingURL=vendor-gaps.d.ts.map

package/dist/vendor-gaps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-gaps.d.ts","sourceRoot":"","sources":["../src/vendor-gaps.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEtE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,eAAO,MAAM,iBAAiB,EAAE,YAAY,EAiE3C,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,YAAY,EAAE,CAGhE;AAED,wBAAgB,oBAAoB,IAAI;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,CAUjG"}

package/dist/vendor-gaps.js

@@ -0,0 +1,83 @@
+export const VENDOR_GAP_MATRIX = [
+    {
+        vendor: 'anthropic',
+        area: 'Safety research',
+        strength: 'RSP, model evaluations',
+        gapTheme: 'Customer-operated AIMS boundary unclear',
+        mitigation: 'Contractual scope + customer-side logging via gateway',
+        grcClawControlIds: ['aims-a.10.1', 'aims-a.12.1'],
+    },
+    {
+        vendor: 'anthropic',
+        area: 'API usage',
+        strength: 'Policies, rate limits',
+        gapTheme: 'Agent tool chains not visible to customer AIMS',
+        mitigation: 'Gateway mediates all tool calls',
+        grcClawControlIds: ['aims-a.12.2'],
+    },
+    {
+        vendor: 'openai',
+        area: 'Policies',
+        strength: 'Usage policies, preparedness',
+        gapTheme: 'Autonomous agent loops without per-action approval',
+        mitigation: 'Exec policy + max calls per turn',
+        grcClawControlIds: ['aims-a.12.3', 'aims-a.14.1'],
+    },
+    {
+        vendor: 'openai',
+        area: 'Tools',
+        strength: 'Function calling, assistants',
+        gapTheme: 'Destructive partner actions in composite apps',
+        mitigation: 'Tier destructive tools + idempotency',
+        grcClawControlIds: ['aims-a.12.3'],
+    },
+    {
+        vendor: 'cursor',
+        area: 'Product',
+        strength: 'IDE-integrated agents',
+        gapTheme: 'AIMS scope: local index vs cloud model routing',
+        mitigation: 'Document processing locations in SoA',
+        grcClawControlIds: ['aims-a.7.1', 'aims-a.13.1'],
+    },
+    {
+        vendor: 'cursor',
+        area: 'Extensibility',
+        strength: 'Skills, MCP, rules',
+        gapTheme: 'Supply chain: third-party MCP servers',
+        mitigation: 'Curated MCP registry + signing (customer policy)',
+        grcClawControlIds: ['aims-a.9.1'],
+    },
+    {
+        vendor: 'openclaw',
+        area: 'Architecture',
+        strength: 'Gateway daemon, pairing, skills',
+        gapTheme: 'Deployer accountable for operator AIMS',
+        mitigation: 'Hardening guide + npm run doctor',
+        grcClawControlIds: ['aims-a.12.1'],
+    },
+    {
+        vendor: 'openclaw',
+        area: 'Security',
+        strength: 'Public vulnerability research',
+        gapTheme: 'Default localhost-trust configurations',
+        mitigation: 'TLS, token auth, pairing for non-local',
+        grcClawControlIds: ['aims-a.12.1', 'aims-a.12.2'],
+    },
+];
+export function listVendorGaps(vendor) {
+    if (!vendor)
+        return [...VENDOR_GAP_MATRIX];
+    return VENDOR_GAP_MATRIX.filter((r) => r.vendor === vendor);
+}
+export function listVendorGapSummary() {
+    const vendors = ['anthropic', 'openai', 'cursor', 'openclaw'];
+    return vendors.map((vendor) => {
+        const rows = listVendorGaps(vendor);
+        return {
+            vendor,
+            strength: rows.map((r) => r.area).join('; '),
+            gapTheme: rows[0]?.gapTheme ?? '',
+        };
+    });
+}
+//# sourceMappingURL=vendor-gaps.js.map

package/dist/vendor-gaps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-gaps.js","sourceRoot":"","sources":["../src/vendor-gaps.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,iBAAiB,GAAmB;IAC/C;QACE,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,wBAAwB;QAClC,QAAQ,EAAE,yCAAyC;QACnD,UAAU,EAAE,uDAAuD;QACnE,iBAAiB,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;KAClD;IACD;QACE,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,gDAAgD;QAC1D,UAAU,EAAE,iCAAiC;QAC7C,iBAAiB,EAAE,CAAC,aAAa,CAAC;KACnC;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,8BAA8B;QACxC,QAAQ,EAAE,oDAAoD;QAC9D,UAAU,EAAE,kCAAkC;QAC9C,iBAAiB,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;KAClD;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,8BAA8B;QACxC,QAAQ,EAAE,+CAA+C;QACzD,UAAU,EAAE,sCAAsC;QAClD,iBAAiB,EAAE,CAAC,aAAa,CAAC;KACnC;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,gDAAgD;QAC1D,UAAU,EAAE,sCAAsC;QAClD,iBAAiB,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;KACjD;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,uCAAuC;QACjD,UAAU,EAAE,kDAAkD;QAC9D,iBAAiB,EAAE,CAAC,YAAY,CAAC;KAClC;IACD;QACE,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,wCAAwC;QAClD,UAAU,EAAE,kCAAkC;QAC9C,iBAAiB,EAAE,CAAC,aAAa,CAAC;KACnC;IACD;QACE,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,+BAA+B;QACzC,QAAQ,EAAE,wCAAwC;QAClD,UAAU,EAAE,wCAAwC;QACpD,iBAAiB,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;KAClD;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,MAAiB;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAC3C,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE;SAClC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@grc-claw/aims",
+  "version": "0.8.0",
+  "description": "ISO/IEC 42001 AIMS \u2014 vendor gaps, clause map, technical controls for GRC_Claw",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && tsc -p tsconfig.test.json && node --test dist-test/test/iso42001.test.js"
+  },
+  "dependencies": {
+    "@grc-claw/core": "*"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AAH20/GRC_Claw"
+  }
+}