genai-security-crosswalk 2.0.0

package/data/schema.json

@@ -0,0 +1,134 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "GenAI Security Crosswalk Entry",
+  "description": "Schema for mapping OWASP GenAI vulnerabilities to security frameworks",
+  "type": "object",
+  "required": ["id", "name", "source_list", "severity", "mappings"],
+  "properties": {
+    "id": {
+      "type": "string",
+      "description": "Vulnerability identifier e.g. LLM01, ASI03, DSGAI07",
+      "pattern": "^(LLM\\d{2}|ASI\\d{2}|DSGAI\\d{2})$"
+    },
+    "name": {
+      "type": "string",
+      "description": "Short human-readable name e.g. Prompt Injection"
+    },
+    "source_list": {
+      "type": "string",
+      "enum": ["LLM-Top10-2025", "Agentic-Top10-2026", "DSGAI-2026"],
+      "description": "Which OWASP list this entry belongs to"
+    },
+    "version": {
+      "type": "string",
+      "description": "Mapping version e.g. 2026-Q1"
+    },
+    "severity": {
+      "type": "string",
+      "enum": ["Critical", "High", "Medium", "Low"],
+      "description": "Standardised severity aligned to AIVSS"
+    },
+    "aivss_score": {
+      "type": ["number", "null"],
+      "minimum": 0,
+      "maximum": 10,
+      "description": "OWASP AIVSS score where available"
+    },
+    "audience": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "developer", "security-engineer", "auditor",
+          "ciso", "red-teamer", "data-engineer",
+          "ml-engineer", "ot-engineer", "compliance"
+        ]
+      }
+    },
+    "mappings": {
+      "type": "array",
+      "description": "One entry per framework control",
+      "items": {
+        "type": "object",
+        "required": ["framework", "control_id", "control_name", "tier", "scope"],
+        "properties": {
+          "framework": {
+            "type": "string",
+            "description": "Framework identifier e.g. MITRE-ATLAS, ISO-42001, AIUC-1"
+          },
+          "control_id": {
+            "type": "string",
+            "description": "Control or clause ID within the framework"
+          },
+          "control_name": {
+            "type": "string",
+            "description": "Human-readable control name"
+          },
+          "url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Direct link to the control"
+          },
+          "tier": {
+            "type": "string",
+            "enum": ["Foundational", "Hardening", "Advanced"],
+            "description": "Implementation maturity tier"
+          },
+          "scope": {
+            "type": "string",
+            "enum": ["Buy", "Build", "Both"],
+            "description": "Whether this is addressed by vendor capability, internal engineering, or both"
+          },
+          "notes": {
+            "type": "string",
+            "description": "Optional implementation notes"
+          }
+        }
+      }
+    },
+    "tools": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": { "type": "string" },
+          "url": { "type": "string", "format": "uri" },
+          "type": { "type": "string", "enum": ["open-source", "commercial", "both"] }
+        }
+      }
+    },
+    "incidents": {
+      "type": "array",
+      "description": "Known real-world incidents referencing this vulnerability",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": { "type": "string" },
+          "url": { "type": "string", "format": "uri" },
+          "year": { "type": "integer" }
+        }
+      }
+    },
+    "crossrefs": {
+      "type": "object",
+      "description": "Links to related entries in other OWASP lists",
+      "properties": {
+        "llm_top10": { "type": "array", "items": { "type": "string" } },
+        "agentic_top10": { "type": "array", "items": { "type": "string" } },
+        "dsgai_2026": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "changelog": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "date": { "type": "string", "format": "date" },
+          "version": { "type": "string" },
+          "change": { "type": "string" },
+          "author": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/dist/index.d.ts

@@ -0,0 +1,97 @@
+/**
+ * @owasp/genai-crosswalk
+ * Machine-readable GenAI security risk mappings across 18 frameworks
+ */
+export interface Mapping {
+    framework: string;
+    control_id: string;
+    control_name: string;
+    tier?: string;
+    notes?: string;
+}
+export interface Tool {
+    name: string;
+    url: string;
+    type?: string;
+}
+export interface IncidentRef {
+    name: string;
+    url: string;
+    year: number;
+    incident_id: string;
+}
+export interface Entry {
+    id: string;
+    name: string;
+    source_list: string;
+    severity: 'Critical' | 'High' | 'Medium' | 'Low';
+    aivss_score?: number;
+    audience: string[];
+    mappings: Mapping[];
+    tools: Tool[];
+    incidents: IncidentRef[];
+    cross_references?: string[];
+}
+export interface MaestroLayer {
+    layer: string;
+    label: string;
+    role: 'origin' | 'propagation' | 'impact' | 'blind-spot';
+    notes: string;
+}
+export interface Reference {
+    title: string;
+    url: string;
+    type: string;
+}
+export interface Incident {
+    id: string;
+    title: string;
+    date: string;
+    year: number;
+    category: 'real-world' | 'research-demonstrated' | 'red-team';
+    description: string;
+    owasp_entries: string[];
+    maestro_layers: MaestroLayer[];
+    attack_vector: string;
+    affected: string;
+    impact: string;
+    severity: 'Critical' | 'High' | 'Medium' | 'Low';
+    mitigations: string[];
+    references: Reference[];
+    tags: string[];
+}
+export interface CrosswalkDB {
+    entries: Entry[];
+    incidents: Incident[];
+    frameworks: string[];
+    version: string;
+}
+/** All 41 OWASP GenAI entries */
+export declare const entries: Entry[];
+/** All documented incidents */
+export declare const incidents: Incident[];
+/** All framework names found in mappings */
+export declare const frameworks: string[];
+/** Package version */
+export declare const version = "1.6.0";
+/** Get a single entry by ID (e.g. 'LLM01', 'ASI01', 'DSGAI04') */
+export declare function getEntry(id: string): Entry | undefined;
+/** Get all entries mapped to a specific framework */
+export declare function getFramework(framework: string): {
+    framework: string;
+    entries: Entry[];
+    controls: Mapping[];
+};
+/** Search entries by keyword in name, mappings, or tools */
+export declare function searchEntries(query: string): Entry[];
+/** Get entries by severity */
+export declare function getBySeverity(severity: 'Critical' | 'High' | 'Medium' | 'Low'): Entry[];
+/** Get entries by source list */
+export declare function getBySourceList(sourceList: string): Entry[];
+/** Get incidents for a specific OWASP entry */
+export declare function getIncidentsForEntry(id: string): Incident[];
+/** Get incidents by MAESTRO layer */
+export declare function getIncidentsByLayer(layer: string): Incident[];
+/** Full database export */
+export declare function getDatabase(): CrosswalkDB;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,aAAa,GAAG,QAAQ,GAAG,YAAY,CAAC;IACzD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,GAAG,uBAAuB,GAAG,UAAU,CAAC;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAgCD,iCAAiC;AACjC,eAAO,MAAM,OAAO,EAAE,KAAK,EAAkB,CAAC;AAE9C,+BAA+B;AAC/B,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAoB,CAAC;AAErD,4CAA4C;AAC5C,eAAO,MAAM,UAAU,EAAE,MAAM,EAEtB,CAAC;AAEV,sBAAsB;AACtB,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAEtD;AAED,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAU5G;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,CAQpD;AAED,8BAA8B;AAC9B,wBAAgB,aAAa,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,EAAE,CAEvF;AAED,iCAAiC;AACjC,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,EAAE,CAG3D;AAED,+CAA+C;AAC/C,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,EAAE,CAG3D;AAED,qCAAqC;AACrC,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,EAAE,CAE7D;AAED,2BAA2B;AAC3B,wBAAgB,WAAW,IAAI,WAAW,CAEzC"}

package/dist/index.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * @owasp/genai-crosswalk
+ * Machine-readable GenAI security risk mappings across 18 frameworks
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.version = exports.frameworks = exports.incidents = exports.entries = void 0;
+exports.getEntry = getEntry;
+exports.getFramework = getFramework;
+exports.searchEntries = searchEntries;
+exports.getBySeverity = getBySeverity;
+exports.getBySourceList = getBySourceList;
+exports.getIncidentsForEntry = getIncidentsForEntry;
+exports.getIncidentsByLayer = getIncidentsByLayer;
+exports.getDatabase = getDatabase;
+// ── Data loading ────────────────────────────────────────────────────────────
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const DATA_DIR = path.join(__dirname, '..', 'data');
+let _entries;
+let _incidents;
+function loadEntries() {
+    if (_entries)
+        return _entries;
+    const dir = path.join(DATA_DIR, 'entries');
+    _entries = fs.readdirSync(dir)
+        .filter((f) => f.endsWith('.json'))
+        .map((f) => JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8')))
+        .sort((a, b) => a.id.localeCompare(b.id));
+    return _entries;
+}
+function loadIncidents() {
+    if (_incidents)
+        return _incidents;
+    const file = path.join(DATA_DIR, 'incidents.json');
+    const db = JSON.parse(fs.readFileSync(file, 'utf8'));
+    _incidents = db.incidents;
+    return _incidents;
+}
+// ── Public API ──────────────────────────────────────────────────────────────
+/** All 41 OWASP GenAI entries */
+exports.entries = loadEntries();
+/** All documented incidents */
+exports.incidents = loadIncidents();
+/** All framework names found in mappings */
+exports.frameworks = [...new Set(exports.entries.flatMap(e => e.mappings.map(m => m.framework)))].sort();
+/** Package version */
+exports.version = '1.6.0';
+/** Get a single entry by ID (e.g. 'LLM01', 'ASI01', 'DSGAI04') */
+function getEntry(id) {
+    return exports.entries.find(e => e.id === id.toUpperCase());
+}
+/** Get all entries mapped to a specific framework */
+function getFramework(framework) {
+    const query = framework.toLowerCase();
+    const matched = exports.entries.filter(e => e.mappings.some(m => m.framework.toLowerCase().includes(query)));
+    const controls = matched.flatMap(e => e.mappings.filter(m => m.framework.toLowerCase().includes(query)));
+    const fwName = controls[0]?.framework || framework;
+    return { framework: fwName, entries: matched, controls };
+}
+/** Search entries by keyword in name, mappings, or tools */
+function searchEntries(query) {
+    const q = query.toLowerCase();
+    return exports.entries.filter(e => e.id.toLowerCase().includes(q) ||
+        e.name.toLowerCase().includes(q) ||
+        e.mappings.some(m => m.control_id?.toLowerCase().includes(q) || m.control_name?.toLowerCase().includes(q)) ||
+        e.tools.some(t => t.name.toLowerCase().includes(q)));
+}
+/** Get entries by severity */
+function getBySeverity(severity) {
+    return exports.entries.filter(e => e.severity === severity);
+}
+/** Get entries by source list */
+function getBySourceList(sourceList) {
+    const q = sourceList.toLowerCase();
+    return exports.entries.filter(e => e.source_list.toLowerCase().includes(q));
+}
+/** Get incidents for a specific OWASP entry */
+function getIncidentsForEntry(id) {
+    const uid = id.toUpperCase();
+    return exports.incidents.filter(i => i.owasp_entries.includes(uid));
+}
+/** Get incidents by MAESTRO layer */
+function getIncidentsByLayer(layer) {
+    return exports.incidents.filter(i => i.maestro_layers.some(l => l.layer === layer));
+}
+/** Full database export */
+function getDatabase() {
+    return { entries: exports.entries, incidents: exports.incidents, frameworks: exports.frameworks, version: exports.version };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyHH,4BAEC;AAGD,oCAUC;AAGD,sCAQC;AAGD,sCAEC;AAGD,0CAGC;AAGD,oDAGC;AAGD,kDAEC;AAGD,kCAEC;AAlGD,+EAA+E;AAE/E,uCAAyB;AACzB,2CAA6B;AAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAEpD,IAAI,QAA6B,CAAC;AAClC,IAAI,UAAkC,CAAC;AAEvC,SAAS,WAAW;IAClB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3C,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAU,CAAC;SACnF,IAAI,CAAC,CAAC,CAAQ,EAAE,CAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,GAAG,EAAE,CAAC,SAAuB,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E,iCAAiC;AACpB,QAAA,OAAO,GAAY,WAAW,EAAE,CAAC;AAE9C,+BAA+B;AAClB,QAAA,SAAS,GAAe,aAAa,EAAE,CAAC;AAErD,4CAA4C;AAC/B,QAAA,UAAU,GAAa,CAAC,GAAG,IAAI,GAAG,CAC7C,eAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CACvD,CAAC,CAAC,IAAI,EAAE,CAAC;AAEV,sBAAsB;AACT,QAAA,OAAO,GAAG,OAAO,CAAC;AAE/B,kEAAkE;AAClE,SAAgB,QAAQ,CAAC,EAAU;IACjC,OAAO,eAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,qDAAqD;AACrD,SAAgB,YAAY,CAAC,SAAiB;IAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,eAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACjC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAClE,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,SAAS,CAAC;IACnD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,4DAA4D;AAC5D,SAAgB,aAAa,CAAC,KAAa;IACzC,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,eAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACxB,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1G,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,8BAA8B;AAC9B,SAAgB,aAAa,CAAC,QAAgD;IAC5E,OAAO,eAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,iCAAiC;AACjC,SAAgB,eAAe,CAAC,UAAkB;IAChD,MAAM,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,eAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,+CAA+C;AAC/C,SAAgB,oBAAoB,CAAC,EAAU;IAC7C,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,iBAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,qCAAqC;AACrC,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,OAAO,iBAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,2BAA2B;AAC3B,SAAgB,WAAW;IACzB,OAAO,EAAE,OAAO,EAAP,eAAO,EAAE,SAAS,EAAT,iBAAS,EAAE,UAAU,EAAV,kBAAU,EAAE,OAAO,EAAP,eAAO,EAAE,CAAC;AACrD,CAAC"}

package/dist/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":""}

package/dist/index.test.js

@@ -0,0 +1,97 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const assert = __importStar(require("node:assert/strict"));
+const index_1 = require("./index");
+(0, node_test_1.describe)('@owasp/genai-crosswalk', () => {
+    (0, node_test_1.it)('loads all 41 entries', () => {
+        assert.equal(index_1.entries.length, 41);
+    });
+    (0, node_test_1.it)('loads 31 incidents', () => {
+        assert.ok(index_1.incidents.length >= 31);
+    });
+    (0, node_test_1.it)('getEntry returns LLM01', () => {
+        const e = (0, index_1.getEntry)('LLM01');
+        assert.ok(e);
+        assert.equal(e.id, 'LLM01');
+        assert.equal(e.severity, 'Critical');
+    });
+    (0, node_test_1.it)('getEntry is case-insensitive', () => {
+        assert.ok((0, index_1.getEntry)('llm01'));
+        assert.ok((0, index_1.getEntry)('asi01'));
+    });
+    (0, node_test_1.it)('getEntry returns undefined for unknown ID', () => {
+        assert.equal((0, index_1.getEntry)('FAKE99'), undefined);
+    });
+    (0, node_test_1.it)('frameworks includes all 18', () => {
+        assert.ok(index_1.frameworks.length >= 18);
+        assert.ok(index_1.frameworks.includes('EU AI Act'));
+        assert.ok(index_1.frameworks.includes('NIST SP 800-218A'));
+    });
+    (0, node_test_1.it)('getFramework returns entries for EU AI Act', () => {
+        const r = (0, index_1.getFramework)('EU AI Act');
+        assert.ok(r.entries.length > 0);
+        assert.ok(r.controls.length > 0);
+    });
+    (0, node_test_1.it)('searchEntries finds prompt injection', () => {
+        const r = (0, index_1.searchEntries)('prompt injection');
+        assert.ok(r.length > 0);
+        assert.ok(r.some(e => e.id === 'LLM01'));
+    });
+    (0, node_test_1.it)('getBySeverity returns Critical entries', () => {
+        const r = (0, index_1.getBySeverity)('Critical');
+        assert.ok(r.length > 0);
+        assert.ok(r.every(e => e.severity === 'Critical'));
+    });
+    (0, node_test_1.it)('getIncidentsForEntry returns incidents for LLM01', () => {
+        const r = (0, index_1.getIncidentsForEntry)('LLM01');
+        assert.ok(r.length > 0);
+    });
+    (0, node_test_1.it)('every entry has mappings array', () => {
+        for (const e of index_1.entries) {
+            assert.ok(Array.isArray(e.mappings), `${e.id} missing mappings`);
+        }
+    });
+    (0, node_test_1.it)('every incident has required fields', () => {
+        for (const i of index_1.incidents) {
+            assert.ok(i.id, 'missing id');
+            assert.ok(i.title, 'missing title');
+            assert.ok(i.owasp_entries.length > 0, `${i.id} missing owasp_entries`);
+            assert.ok(i.maestro_layers.length > 0, `${i.id} missing maestro_layers`);
+        }
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAyC;AACzC,2DAA6C;AAC7C,mCAAqI;AAErI,IAAA,oBAAQ,EAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAA,cAAE,EAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,eAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,EAAE,CAAC,iBAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,GAAG,IAAA,gBAAQ,EAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,EAAE,CAAC,IAAA,gBAAQ,EAAC,OAAO,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,IAAA,gBAAQ,EAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,KAAK,CAAC,IAAA,gBAAQ,EAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,EAAE,CAAC,kBAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,kBAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,kBAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,IAAA,qBAAa,EAAC,kBAAkB,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,IAAA,qBAAa,EAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,KAAK,MAAM,CAAC,IAAI,eAAO,EAAE,CAAC;YACxB,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,KAAK,MAAM,CAAC,IAAI,iBAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAC9B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;YACvE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "genai-security-crosswalk",
+  "version": "2.0.0",
+  "description": "OWASP GenAI Security Crosswalk — mapping LLM Top 10, Agentic Top 10, and DSGAI 2026 to 17 industry frameworks",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/",
+    "data/entries/",
+    "data/incidents.json",
+    "data/schema.json",
+    "data/incidents-schema.json"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "generate": "node scripts/generate.js",
+    "validate": "node scripts/validate.js",
+    "compliance": "node scripts/compliance-report.js",
+    "incidents": "node scripts/incidents-report.js",
+    "query": "node scripts/query.js",
+    "watch": "node scripts/watch.js",
+    "build": "npm run generate && npm run validate",
+    "build:reports": "npm run compliance && npm run incidents",
+    "ci": "npm run build && npm run build:reports",
+    "compile": "tsc",
+    "prepublishOnly": "npm run compile"
+  },
+  "license": "CC-BY-SA-4.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk.git"
+  },
+  "bugs": {
+    "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/issues"
+  },
+  "homepage": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk#readme",
+  "keywords": [
+    "owasp",
+    "llm-security",
+    "ai-security",
+    "genai",
+    "crosswalk",
+    "compliance",
+    "nist",
+    "eu-ai-act",
+    "prompt-injection",
+    "agentic-ai"
+  ],
+  "author": {
+    "name": "Emmanuel Guilherme Junior",
+    "url": "https://github.com/emmanuelgjr"
+  },
+  "contributors": [
+    "OWASP GenAI Data Security Initiative contributors"
+  ],
+  "devDependencies": {
+    "@types/node": "^25.5.0",
+    "typescript": "^5.4.0"
+  }
+}