@greenarmor/ges-policy-engine 0.1.0

package/dist/packs/nist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nist.js","sourceRoot":"","sources":["../../src/packs/nist.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAc;QAC1B;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,2DAA2D;YACxE,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,oGAAoG;YAC7H,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,iCAAiC,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACnG,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE;aACpF;SACF;QACD;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,mDAAmD;YAChE,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,0EAA0E;YACnG,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,kCAAkC,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACpG,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,kCAAkC,EAAE,MAAM,EAAE,iBAAiB,EAAE;aACrG;SACF;QACD;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,sCAAsC;YACnD,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,oFAAoF;YAC7G,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAC3F,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAC9F,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,iCAAiC,EAAE,MAAM,EAAE,iBAAiB,EAAE;aACpG;SACF;QACD;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,4CAA4C;YACzD,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,8EAA8E;YACvG,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,iCAAiC,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACnG,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,8BAA8B,EAAE,MAAM,EAAE,iBAAiB,EAAE;aACjG;SACF;QACD;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,wDAAwD;YACrE,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,2FAA2F;YACpH,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACrG,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,oCAAoC,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACtG,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,EAAE,iBAAiB,EAAE;aAC7F;SACF;QACD;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,wCAAwC;YACrD,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,wFAAwF;YACjH,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACrG,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACvF,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,EAAE,iBAAiB,EAAE;aAC3F;SACF;KACF,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,0CAA0C;QAChD,WAAW,EAAE,2EAA2E;QACxF,OAAO,EAAE,OAAO;QAChB,aAAa,EAAE;YACb,MAAM,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,mBAAmB;SAC5E;QACD,QAAQ;QACR,UAAU,EAAE,CAAC,MAAM,CAAC;KACrB,CAAC;AACJ,CAAC"}

package/dist/packs/owasp.d.ts

@@ -0,0 +1,2 @@
+import type { PolicyPack } from "@greenarmor/ges-core";
+export declare function createOWASPPolicyPack(): PolicyPack;

package/dist/packs/owasp.js

@@ -0,0 +1,106 @@
+export function createOWASPPolicyPack() {
+    const controls = [
+        {
+            id: "OWASP-ASVS-001",
+            name: "Input Validation",
+            description: "Verify that all input data is validated, filtered, or sanitized.",
+            category: "validation",
+            framework: "OWASP",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Validate all inputs on the server side. Use allowlists over denylists. Implement schema validation (Zod, Joi).",
+            checks: [
+                { id: "OWASP-ASVS-001-C1", description: "Server-side input validation implemented", status: "not-implemented" },
+                { id: "OWASP-ASVS-001-C2", description: "Schema validation library in use", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "OWASP-ASVS-002",
+            name: "Output Encoding",
+            description: "Verify that output encoding prevents XSS and injection attacks.",
+            category: "validation",
+            framework: "OWASP",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Encode output appropriate to context (HTML, JavaScript, URL, CSS). Use framework-provided escaping.",
+            checks: [
+                { id: "OWASP-ASVS-002-C1", description: "Output encoding implemented", status: "not-implemented" },
+                { id: "OWASP-ASVS-002-C2", description: "Content-Security-Policy headers configured", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "OWASP-ASVS-003",
+            name: "Authentication Security",
+            description: "Verify that authentication uses strong mechanisms.",
+            category: "authentication",
+            framework: "OWASP",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement MFA. Use Argon2id for hashing. Implement account lockout. Use rate limiting.",
+            checks: [
+                { id: "OWASP-ASVS-003-C1", description: "MFA implemented", status: "not-implemented" },
+                { id: "OWASP-ASVS-003-C2", description: "Secure password hashing (Argon2id)", status: "not-implemented" },
+                { id: "OWASP-ASVS-003-C3", description: "Account lockout implemented", status: "not-implemented" },
+                { id: "OWASP-ASVS-003-C4", description: "Rate limiting on authentication endpoints", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "OWASP-ASVS-004",
+            name: "Access Control",
+            description: "Verify that access controls enforce least privilege and deny by default.",
+            category: "authorization",
+            framework: "OWASP",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement RBAC. Enforce deny-by-default. Validate authorization on every request.",
+            checks: [
+                { id: "OWASP-ASVS-004-C1", description: "RBAC implemented", status: "not-implemented" },
+                { id: "OWASP-ASVS-004-C2", description: "Deny-by-default enforced", status: "not-implemented" },
+                { id: "OWASP-ASVS-004-C3", description: "Authorization checked on every request", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "OWASP-ASVS-005",
+            name: "Secrets Management",
+            description: "Verify that secrets are properly managed and never stored in source code.",
+            category: "secrets",
+            framework: "OWASP",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Use vault or secret management. Never commit secrets. Use environment variables. Rotate secrets regularly.",
+            checks: [
+                { id: "OWASP-ASVS-005-C1", description: "No secrets in source code", status: "not-implemented" },
+                { id: "OWASP-ASVS-005-C2", description: "Secret management solution in use", status: "not-implemented" },
+                { id: "OWASP-ASVS-005-C3", description: "Secret rotation policy defined", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "OWASP-ASVS-006",
+            name: "Secure Communications",
+            description: "Verify that all communications use TLS 1.2+.",
+            category: "encryption",
+            framework: "OWASP",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Enforce TLS 1.2 minimum. Configure HSTS. Disable insecure protocols.",
+            checks: [
+                { id: "OWASP-ASVS-006-C1", description: "TLS 1.2+ enforced", status: "not-implemented" },
+                { id: "OWASP-ASVS-006-C2", description: "HSTS configured", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "owasp",
+        name: "OWASP ASVS Policy Pack",
+        description: "OWASP Application Security Verification Standard controls.",
+        version: "1.0.0",
+        project_types: [
+            "saas", "ai-application", "healthcare-system", "event-platform",
+            "photo-storage-platform", "vulnerability-scanner",
+            "generic-web-application", "api-backend", "mobile-application",
+        ],
+        controls,
+        frameworks: ["OWASP"],
+    };
+}
+//# sourceMappingURL=owasp.js.map

package/dist/packs/owasp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp.js","sourceRoot":"","sources":["../../src/packs/owasp.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAc;QAC1B;YACE,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,kEAAkE;YAC/E,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,gHAAgH;YACzI,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,0CAA0C,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAC/G,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,kCAAkC,EAAE,MAAM,EAAE,iBAAiB,EAAE;aACxG;SACF;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,iEAAiE;YAC9E,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,qGAAqG;YAC9H,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,6BAA6B,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAClG,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,4CAA4C,EAAE,MAAM,EAAE,iBAAiB,EAAE;aAClH;SACF;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,wFAAwF;YACjH,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACtF,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,oCAAoC,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACzG,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,6BAA6B,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAClG,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,2CAA2C,EAAE,MAAM,EAAE,iBAAiB,EAAE;aACjH;SACF;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,0EAA0E;YACvF,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,mFAAmF;YAC5G,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACvF,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAC/F,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,wCAAwC,EAAE,MAAM,EAAE,iBAAiB,EAAE;aAC9G;SACF;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,2EAA2E;YACxF,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,4GAA4G;YACrI,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAChG,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACxG,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,gCAAgC,EAAE,MAAM,EAAE,iBAAiB,EAAE;aACtG;SACF;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,8CAA8C;YAC3D,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,UAAU;YACpB,uBAAuB,EAAE,sEAAsE;YAC/F,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBACxF,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE;aACvF;SACF;KACF,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,OAAO;QAChB,aAAa,EAAE;YACb,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB;YAC/D,wBAAwB,EAAE,uBAAuB;YACjD,yBAAyB,EAAE,aAAa,EAAE,oBAAoB;SAC/D;QACD,QAAQ;QACR,UAAU,EAAE,CAAC,OAAO,CAAC;KACtB,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@greenarmor/ges-policy-engine",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "GESF Policy Engine - Policy packs management and enforcement",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@greenarmor/ges-core": "0.1.0",
+    "@greenarmor/ges-compliance-engine": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.0",
+    "@types/node": "^22.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "test": "echo \"no tests yet\""
+  }
+}

package/src/index.ts

@@ -0,0 +1,53 @@
+import type { PolicyPack, ProjectType } from "@greenarmor/ges-core";
+import { createGDPRPolicyPack } from "./packs/gdpr.js";
+import { createOWASPPolicyPack } from "./packs/owasp.js";
+import { createAIPolicyPack } from "./packs/ai.js";
+import { createBlockchainPolicyPack } from "./packs/blockchain.js";
+import { createGovernmentPolicyPack } from "./packs/government.js";
+import { createCISPolicyPack } from "./packs/cis.js";
+import { createNISTPolicyPack } from "./packs/nist.js";
+
+const ALL_PACKS: (() => PolicyPack)[] = [
+  createGDPRPolicyPack,
+  createOWASPPolicyPack,
+  createAIPolicyPack,
+  createBlockchainPolicyPack,
+  createGovernmentPolicyPack,
+  createCISPolicyPack,
+  createNISTPolicyPack,
+];
+
+const PACK_MAP: Record<string, () => PolicyPack> = {
+  gdpr: createGDPRPolicyPack,
+  owasp: createOWASPPolicyPack,
+  ai: createAIPolicyPack,
+  blockchain: createBlockchainPolicyPack,
+  government: createGovernmentPolicyPack,
+  cis: createCISPolicyPack,
+  nist: createNISTPolicyPack,
+};
+
+export function getAllPacks(): PolicyPack[] {
+  return ALL_PACKS.map(fn => fn());
+}
+
+export function getPack(id: string): PolicyPack | undefined {
+  const factory = PACK_MAP[id];
+  return factory ? factory() : undefined;
+}
+
+export function getPacksForProjectType(projectType: ProjectType): PolicyPack[] {
+  return getAllPacks().filter(pack => pack.project_types.includes(projectType));
+}
+
+export function listPackIds(): string[] {
+  return Object.keys(PACK_MAP);
+}
+
+export { createGDPRPolicyPack } from "./packs/gdpr.js";
+export { createOWASPPolicyPack } from "./packs/owasp.js";
+export { createAIPolicyPack } from "./packs/ai.js";
+export { createBlockchainPolicyPack } from "./packs/blockchain.js";
+export { createGovernmentPolicyPack } from "./packs/government.js";
+export { createCISPolicyPack } from "./packs/cis.js";
+export { createNISTPolicyPack } from "./packs/nist.js";

package/src/packs/ai.ts

@@ -0,0 +1,102 @@
+import type { PolicyPack, Control } from "@greenarmor/ges-core";
+
+export function createAIPolicyPack(): PolicyPack {
+  const controls: Control[] = [
+    {
+      id: "AI-001",
+      name: "Prompt Logging",
+      description: "Log all AI prompts and interactions for audit purposes.",
+      category: "ai-governance",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Implement logging of all prompts sent to AI models. Store prompts securely with access controls. Define retention periods.",
+      checks: [
+        { id: "AI-001-C1", description: "Prompt logging system implemented", status: "not-implemented" },
+        { id: "AI-001-C2", description: "Logs stored securely", status: "not-implemented" },
+        { id: "AI-001-C3", description: "Retention period defined", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "AI-002",
+      name: "Output Validation",
+      description: "Validate AI outputs before presenting to users or taking actions.",
+      category: "ai-governance",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Implement output filtering and validation. Check for PII leakage. Validate against safety guidelines.",
+      checks: [
+        { id: "AI-002-C1", description: "Output validation pipeline implemented", status: "not-implemented" },
+        { id: "AI-002-C2", description: "PII detection on outputs", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "AI-003",
+      name: "PII Detection",
+      description: "Detect and protect personal data in AI inputs and outputs.",
+      category: "ai-governance",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Implement PII detection before sending to external AI providers. Redact or pseudonymise detected PII.",
+      checks: [
+        { id: "AI-003-C1", description: "PII detection on inputs", status: "not-implemented" },
+        { id: "AI-003-C2", description: "PII redaction/pseudonymisation implemented", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "AI-004",
+      name: "AI Rate Limiting",
+      description: "Implement rate limiting on AI endpoints.",
+      category: "ai-governance",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "high",
+      implementation_guidance: "Implement per-user and per-IP rate limiting on AI endpoints. Define usage quotas.",
+      checks: [
+        { id: "AI-004-C1", description: "Rate limiting on AI endpoints", status: "not-implemented" },
+        { id: "AI-004-C2", description: "Usage quotas defined", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "AI-005",
+      name: "Data Classification for AI",
+      description: "Classify data before processing through AI systems.",
+      category: "ai-governance",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Implement data classification checks before AI processing. Restrict restricted/confidential data from external AI providers.",
+      checks: [
+        { id: "AI-005-C1", description: "Data classification before AI processing", status: "not-implemented" },
+        { id: "AI-005-C2", description: "Restricted data blocked from external AI", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "AI-006",
+      name: "Prevent Unauthorized Data Transfer to External AI",
+      description: "Prevent unauthorized transfer of personal data to external AI providers.",
+      category: "ai-governance",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Implement data loss prevention for AI API calls. Review and approve AI providers. Document data processing agreements.",
+      checks: [
+        { id: "AI-006-C1", description: "DLP controls for AI API calls", status: "not-implemented" },
+        { id: "AI-006-C2", description: "AI providers reviewed and approved", status: "not-implemented" },
+        { id: "AI-006-C3", description: "DPAs with AI providers signed", status: "not-implemented" },
+      ],
+    },
+  ];
+
+  return {
+    id: "ai",
+    name: "AI System Policy Pack",
+    description: "Controls for LLMs, Agents, MCP, and RAG systems.",
+    version: "1.0.0",
+    project_types: ["ai-application", "mcp-server"],
+    controls,
+    frameworks: ["GDPR"],
+  };
+}

package/src/packs/blockchain.ts

@@ -0,0 +1,99 @@
+import type { PolicyPack, Control } from "@greenarmor/ges-core";
+
+export function createBlockchainPolicyPack(): PolicyPack {
+  const controls: Control[] = [
+    {
+      id: "BC-001",
+      name: "Cryptographic Signatures",
+      description: "All on-chain operations must use cryptographic signatures.",
+      category: "blockchain",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Implement wallet-based transaction signing. Verify signatures before on-chain operations.",
+      checks: [
+        { id: "BC-001-C1", description: "Cryptographic signing implemented", status: "not-implemented" },
+        { id: "BC-001-C2", description: "Signature verification on all operations", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "BC-002",
+      name: "Validator Identity Verification",
+      description: "Validators must be identity-verified.",
+      category: "blockchain",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "high",
+      implementation_guidance: "Implement KYC for validators. Maintain identity verification records.",
+      checks: [
+        { id: "BC-002-C1", description: "Validator identity verification process", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "BC-003",
+      name: "Key Rotation",
+      description: "Implement regular key rotation for blockchain operations.",
+      category: "blockchain",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Define key rotation schedule. Automate rotation where possible. Maintain key history.",
+      checks: [
+        { id: "BC-003-C1", description: "Key rotation schedule defined", status: "not-implemented" },
+        { id: "BC-003-C2", description: "Rotation automation implemented", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "BC-004",
+      name: "Encrypted Payload Support",
+      description: "Support encrypted payloads for sensitive on-chain data.",
+      category: "blockchain",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Encrypt sensitive data before storing on-chain. Use hybrid encryption schemes.",
+      checks: [
+        { id: "BC-004-C1", description: "Encrypted payload support implemented", status: "not-implemented" },
+        { id: "BC-004-C2", description: "No plaintext personal data on-chain", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "BC-005",
+      name: "Immutable Audit Trails",
+      description: "Maintain immutable audit trails for all blockchain operations.",
+      category: "blockchain",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Use blockchain immutability for audit logs. Store hashes and CIDs. Keep references off-chain.",
+      checks: [
+        { id: "BC-005-C1", description: "Audit trail mechanism implemented", status: "not-implemented" },
+        { id: "BC-005-C2", description: "Hashes stored on-chain, data off-chain", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "BC-006",
+      name: "No Plaintext Personal Data On-Chain",
+      description: "Never store plaintext personal data on-chain. Store only hashes, CIDs, references, and encrypted metadata.",
+      category: "blockchain",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Store only hashes (SHA-256+), CIDs, references, or encrypted metadata on-chain. Keep actual data in encrypted off-chain storage.",
+      checks: [
+        { id: "BC-006-C1", description: "Only hashes/CIDs/references on-chain", status: "not-implemented" },
+        { id: "BC-006-C2", description: "Encrypted metadata for on-chain records", status: "not-implemented" },
+      ],
+    },
+  ];
+
+  return {
+    id: "blockchain",
+    name: "Blockchain Policy Pack",
+    description: "Controls for blockchain, wallets, and government ledgers.",
+    version: "1.0.0",
+    project_types: ["blockchain", "wallet"],
+    controls,
+    frameworks: ["GDPR"],
+  };
+}

package/src/packs/cis.ts

@@ -0,0 +1,89 @@
+import type { PolicyPack, Control } from "@greenarmor/ges-core";
+
+export function createCISPolicyPack(): PolicyPack {
+  const controls: Control[] = [
+    {
+      id: "CIS-001",
+      name: "Inventory of Authorized and Unauthorized Devices",
+      description: "Maintain an inventory of all devices authorized to access organizational data.",
+      category: "asset-management",
+      framework: "CIS",
+      status: "not-implemented",
+      severity: "high",
+      implementation_guidance: "Maintain device inventory. Implement MDM. Monitor for unauthorized devices.",
+      checks: [
+        { id: "CIS-001-C1", description: "Device inventory maintained", status: "not-implemented" },
+        { id: "CIS-001-C2", description: "Unauthorized device detection", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "CIS-002",
+      name: "Inventory of Authorized and Unauthorized Software",
+      description: "Maintain a software inventory.",
+      category: "asset-management",
+      framework: "CIS",
+      status: "not-implemented",
+      severity: "high",
+      implementation_guidance: "Use package managers and lock files. Scan for unauthorized software. Maintain SBOM.",
+      checks: [
+        { id: "CIS-002-C1", description: "Software inventory (SBOM) maintained", status: "not-implemented" },
+        { id: "CIS-002-C2", description: "Dependency scanning implemented", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "CIS-003",
+      name: "Secure Configuration",
+      description: "Establish and maintain secure configuration for all hardware and software.",
+      category: "configuration",
+      framework: "CIS",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Use infrastructure-as-code. Implement configuration management. Regular configuration audits.",
+      checks: [
+        { id: "CIS-003-C1", description: "Secure baseline configurations defined", status: "not-implemented" },
+        { id: "CIS-003-C2", description: "Configuration drift detection", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "CIS-004",
+      name: "Continuous Vulnerability Management",
+      description: "Continuously assess and remediate vulnerabilities.",
+      category: "vulnerability-management",
+      framework: "CIS",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Automated vulnerability scanning in CI/CD. Regular penetration testing. Remediation SLAs defined.",
+      checks: [
+        { id: "CIS-004-C1", description: "Automated vulnerability scanning", status: "not-implemented" },
+        { id: "CIS-004-C2", description: "Remediation SLAs defined", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "CIS-005",
+      name: "Controlled Use of Administrative Privileges",
+      description: "Control and monitor access to administrative privileges.",
+      category: "access-control",
+      framework: "CIS",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Implement RBAC. Use least privilege. Audit all admin actions. Require MFA for admin access.",
+      checks: [
+        { id: "CIS-005-C1", description: "RBAC implemented", status: "not-implemented" },
+        { id: "CIS-005-C2", description: "MFA required for admin access", status: "not-implemented" },
+        { id: "CIS-005-C3", description: "Admin action audit logging", status: "not-implemented" },
+      ],
+    },
+  ];
+
+  return {
+    id: "cis",
+    name: "CIS Controls Policy Pack",
+    description: "Center for Internet Security Controls.",
+    version: "1.0.0",
+    project_types: [
+      "saas", "healthcare-system", "generic-web-application", "government-system",
+    ],
+    controls,
+    frameworks: ["CIS"],
+  };
+}

package/src/packs/gdpr.ts

@@ -0,0 +1,19 @@
+import type { PolicyPack, Control, ProjectType } from "@greenarmor/ges-core";
+import { createGDPRControls } from "@greenarmor/ges-compliance-engine";
+
+export function createGDPRPolicyPack(): PolicyPack {
+  return {
+    id: "gdpr",
+    name: "GDPR Compliance Pack",
+    description: "General Data Protection Regulation controls covering Articles 5, 25, 30, 32, 33, and 34.",
+    version: "1.0.0",
+    project_types: [
+      "saas", "ai-application", "mcp-server", "blockchain", "wallet",
+      "government-system", "healthcare-system", "event-platform",
+      "photo-storage-platform", "vulnerability-scanner",
+      "generic-web-application", "api-backend", "mobile-application",
+    ],
+    controls: createGDPRControls(),
+    frameworks: ["GDPR"],
+  };
+}

package/src/packs/government.ts

@@ -0,0 +1,89 @@
+import type { PolicyPack, Control } from "@greenarmor/ges-core";
+
+export function createGovernmentPolicyPack(): PolicyPack {
+  const controls: Control[] = [
+    {
+      id: "GOV-001",
+      name: "Data Sovereignty",
+      description: "Ensure all data processing occurs within designated jurisdictions.",
+      category: "government",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Deploy infrastructure in required jurisdictions. Implement geo-fencing for data storage. Verify cloud provider compliance.",
+      checks: [
+        { id: "GOV-001-C1", description: "Infrastructure in required jurisdictions", status: "not-implemented" },
+        { id: "GOV-001-C2", description: "Geo-fencing implemented", status: "not-implemented" },
+        { id: "GOV-001-C3", description: "Cloud provider compliance verified", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "GOV-002",
+      name: "Chain of Custody",
+      description: "Maintain complete chain of custody for all data processing.",
+      category: "government",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Log all data access and transfers. Maintain custody records. Implement digital signatures on records.",
+      checks: [
+        { id: "GOV-002-C1", description: "Chain of custody logging implemented", status: "not-implemented" },
+        { id: "GOV-002-C2", description: "Digital signatures on custody records", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "GOV-003",
+      name: "Tamper Evidence",
+      description: "Implement tamper detection for all records and data.",
+      category: "government",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Use cryptographic hashing for integrity verification. Implement merkle trees for batch verification. Use write-once storage.",
+      checks: [
+        { id: "GOV-003-C1", description: "Tamper detection implemented", status: "not-implemented" },
+        { id: "GOV-003-C2", description: "Integrity verification on read", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "GOV-004",
+      name: "Record Integrity Verification",
+      description: "Enable verification of record integrity at any point.",
+      category: "government",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Store integrity hashes with records. Provide verification APIs. Schedule regular integrity checks.",
+      checks: [
+        { id: "GOV-004-C1", description: "Integrity hashes stored with records", status: "not-implemented" },
+        { id: "GOV-004-C2", description: "Verification API available", status: "not-implemented" },
+        { id: "GOV-004-C3", description: "Regular integrity checks scheduled", status: "not-implemented" },
+      ],
+    },
+    {
+      id: "GOV-005",
+      name: "Auditability",
+      description: "Ensure all actions are fully auditable.",
+      category: "government",
+      framework: "GDPR",
+      status: "not-implemented",
+      severity: "critical",
+      implementation_guidance: "Implement comprehensive audit logging. Ensure logs are immutable. Provide audit trail export capabilities.",
+      checks: [
+        { id: "GOV-005-C1", description: "Comprehensive audit logging", status: "not-implemented" },
+        { id: "GOV-005-C2", description: "Immutable log storage", status: "not-implemented" },
+        { id: "GOV-005-C3", description: "Audit trail export capability", status: "not-implemented" },
+      ],
+    },
+  ];
+
+  return {
+    id: "government",
+    name: "Government Policy Pack",
+    description: "Additional controls for government systems including data sovereignty and chain of custody.",
+    version: "1.0.0",
+    project_types: ["government-system"],
+    controls,
+    frameworks: ["GDPR"],
+  };
+}