0xray 3.1.1 → 3.3.0

package/dist/infrastructure/schemas/cloud-schemas.js

@@ -0,0 +1,488 @@
+/**
+ * Cloud Infrastructure Schemas
+ *
+ * Schema definitions for cloud provider configurations, ensuring
+ * enterprise-grade validation and compliance with Universal Development Codex v1.2.0.
+ *
+ * @since 2026-01-08
+ */
+import { z } from "zod";
+// ============================================================================
+// AWS Schemas
+// ============================================================================
+export const AWSCredentialsSchema = z.object({
+    accessKeyId: z.string(),
+    secretAccessKey: z.string(),
+    sessionToken: z.string().optional(),
+    region: z.string().default("us-east-1"),
+});
+export const AWSVPCConfigSchema = z.object({
+    vpcId: z.string().optional(),
+    subnetIds: z.array(z.string()).optional(),
+    securityGroupIds: z.array(z.string()).optional(),
+    createVpc: z.boolean().default(false),
+    cidrBlock: z.string().default("10.0.0.0/16"),
+    availabilityZones: z.array(z.string()).optional(),
+});
+export const AWSLoadBalancerConfigSchema = z.object({
+    name: z.string(),
+    type: z.enum(["application", "network", "gateway"]).default("application"),
+    scheme: z.enum(["internet-facing", "internal"]).default("internet-facing"),
+    securityGroups: z.array(z.string()).optional(),
+    subnets: z.array(z.string()).optional(),
+    enableDeletionProtection: z.boolean().default(true),
+    idleTimeout: z.number().min(1).max(4000).default(60),
+    // Rate limiting configuration
+    rateLimit: z
+        .object({
+        enabled: z.boolean().default(true),
+        requestsPerSecond: z.number().min(1).max(100000).default(1000),
+        burstLimit: z.number().min(1).max(100000).default(2000),
+        byIp: z.boolean().default(true),
+        byHeader: z
+            .object({
+            enabled: z.boolean().default(false),
+            headerName: z.string().optional(),
+            headerValues: z.array(z.string()).optional(),
+        })
+            .optional(),
+        customRules: z
+            .array(z.object({
+            name: z.string(),
+            priority: z.number(),
+            action: z.enum(["allow", "deny", "count"]),
+            conditions: z.array(z.object({
+                type: z.enum([
+                    "httpMethod",
+                    "path",
+                    "header",
+                    "queryString",
+                    "sourceIp",
+                ]),
+                values: z.array(z.string()),
+            })),
+        }))
+            .optional(),
+    })
+        .optional(),
+});
+export const AWSAPIGatewayConfigSchema = z.object({
+    name: z.string(),
+    description: z.string().optional(),
+    protocolType: z.enum(["HTTP", "WEBSOCKET"]).default("HTTP"),
+    corsConfiguration: z
+        .object({
+        allowCredentials: z.boolean().optional(),
+        allowHeaders: z.array(z.string()).optional(),
+        allowMethods: z.array(z.string()).optional(),
+        allowOrigins: z.array(z.string()).optional(),
+        exposeHeaders: z.array(z.string()).optional(),
+        maxAge: z.number().optional(),
+    })
+        .optional(),
+    // Rate limiting for API Gateway
+    throttling: z
+        .object({
+        burstLimit: z.number().min(1).max(10000).default(5000),
+        rateLimit: z.number().min(0.05).max(10000).default(10000),
+    })
+        .optional(),
+    // Usage plans for rate limiting
+    usagePlans: z
+        .array(z.object({
+        name: z.string(),
+        description: z.string().optional(),
+        throttle: z.object({
+            burstLimit: z.number().min(1).max(10000),
+            rateLimit: z.number().min(0.05).max(10000),
+        }),
+        quota: z
+            .object({
+            limit: z.number().min(1),
+            offset: z.number().optional(),
+            period: z.enum(["DAY", "WEEK", "MONTH"]),
+        })
+            .optional(),
+        apiStages: z
+            .array(z.object({
+            apiId: z.string(),
+            stage: z.string(),
+            throttle: z
+                .record(z.string(), z.object({
+                burstLimit: z.number(),
+                rateLimit: z.number(),
+            }))
+                .optional(),
+        }))
+            .optional(),
+    }))
+        .optional(),
+});
+export const AWSCloudFormationTemplateSchema = z.object({
+    AWSTemplateFormatVersion: z.string().optional(),
+    Description: z.string().optional(),
+    Metadata: z.record(z.string(), z.any()).optional(),
+    Parameters: z
+        .record(z.string(), z.object({
+        Type: z.string(),
+        Default: z.any().optional(),
+        AllowedValues: z.array(z.any()).optional(),
+        AllowedPattern: z.string().optional(),
+        ConstraintDescription: z.string().optional(),
+        Description: z.string().optional(),
+        MaxLength: z.number().optional(),
+        MinLength: z.number().optional(),
+        MaxValue: z.number().optional(),
+        MinValue: z.number().optional(),
+        NoEcho: z.boolean().optional(),
+    }))
+        .optional(),
+    Mappings: z
+        .record(z.string(), z.record(z.string(), z.record(z.string(), z.any())))
+        .optional(),
+    Conditions: z.record(z.string(), z.any()).optional(),
+    Transform: z.union([z.string(), z.array(z.string())]).optional(),
+    Resources: z.record(z.string(), z.object({
+        Type: z.string(),
+        Properties: z.record(z.string(), z.any()).optional(),
+        DependsOn: z.union([z.string(), z.array(z.string())]).optional(),
+        Metadata: z.record(z.string(), z.any()).optional(),
+        DeletionPolicy: z.enum(["Delete", "Retain", "Snapshot"]).optional(),
+        UpdateReplacePolicy: z.enum(["Delete", "Retain", "Snapshot"]).optional(),
+        Condition: z.string().optional(),
+    })),
+    Outputs: z
+        .record(z.string(), z.object({
+        Description: z.string().optional(),
+        Value: z.any(),
+        Export: z
+            .object({
+            Name: z.string(),
+        })
+            .optional(),
+        Condition: z.string().optional(),
+    }))
+        .optional(),
+});
+// ============================================================================
+// Azure Schemas
+// ============================================================================
+export const AzureCredentialsSchema = z.object({
+    clientId: z.string(),
+    clientSecret: z.string(),
+    tenantId: z.string(),
+    subscriptionId: z.string(),
+});
+export const AzureLoadBalancerConfigSchema = z.object({
+    name: z.string(),
+    location: z.string(),
+    sku: z.object({
+        name: z.enum(["Basic", "Standard"]).default("Standard"),
+        tier: z.enum(["Regional", "Global"]).default("Regional"),
+    }),
+    frontendIPConfigurations: z.array(z.object({
+        name: z.string(),
+        properties: z.object({
+            privateIPAllocationMethod: z.enum(["Static", "Dynamic"]).optional(),
+            privateIPAddress: z.string().optional(),
+            subnet: z
+                .object({
+                id: z.string(),
+            })
+                .optional(),
+            publicIPAddress: z
+                .object({
+                id: z.string(),
+            })
+                .optional(),
+        }),
+    })),
+    backendAddressPools: z
+        .array(z.object({
+        name: z.string(),
+    }))
+        .optional(),
+    loadBalancingRules: z
+        .array(z.object({
+        name: z.string(),
+        properties: z.object({
+            frontendIPConfiguration: z.object({
+                id: z.string(),
+            }),
+            backendAddressPool: z.object({
+                id: z.string(),
+            }),
+            probe: z.object({
+                id: z.string(),
+            }),
+            protocol: z.enum(["Tcp", "Udp", "All"]),
+            frontendPort: z.number(),
+            backendPort: z.number(),
+            idleTimeoutInMinutes: z.number().optional(),
+            enableFloatingIP: z.boolean().optional(),
+            loadDistribution: z
+                .enum(["Default", "SourceIP", "SourceIPProtocol"])
+                .optional(),
+        }),
+    }))
+        .optional(),
+    // Rate limiting configuration
+    rateLimit: z
+        .object({
+        enabled: z.boolean().default(true),
+        rules: z
+            .array(z.object({
+            name: z.string(),
+            priority: z.number(),
+            matchConditions: z.array(z.object({
+                matchVariables: z.array(z.object({
+                    variableName: z.enum([
+                        "RemoteAddr",
+                        "RequestMethod",
+                        "QueryString",
+                        "PostArgs",
+                        "RequestUri",
+                        "RequestHeaders",
+                    ]),
+                    selector: z.string().optional(),
+                })),
+                operator: z.enum([
+                    "Any",
+                    "IPMatch",
+                    "GeoMatch",
+                    "Equal",
+                    "Contains",
+                    "LessThan",
+                    "GreaterThan",
+                    "LessThanOrEqual",
+                    "GreaterThanOrEqual",
+                    "BeginsWith",
+                    "EndsWith",
+                    "RegEx",
+                ]),
+                matchValues: z.array(z.string()),
+                transforms: z
+                    .array(z.enum([
+                    "Lowercase",
+                    "Trim",
+                    "UrlDecode",
+                    "UrlEncode",
+                    "RemoveNulls",
+                    "HtmlEntityDecode",
+                ]))
+                    .optional(),
+            })),
+            action: z.enum(["Allow", "Block", "Log", "Redirect"]),
+        }))
+            .optional(),
+    })
+        .optional(),
+});
+export const AzureAPIManagementConfigSchema = z.object({
+    name: z.string(),
+    location: z.string(),
+    sku: z.object({
+        name: z
+            .enum(["Developer", "Basic", "Standard", "Premium", "Consumption"])
+            .default("Developer"),
+        capacity: z.number().min(1).default(1),
+    }),
+    publisherEmail: z.string().email(),
+    publisherName: z.string(),
+    // Rate limiting and throttling
+    policies: z
+        .object({
+        inbound: z
+            .array(z.object({
+            rateLimit: z
+                .object({
+                calls: z.number(),
+                renewalPeriod: z.number(),
+                counterKey: z.string().optional(),
+            })
+                .optional(),
+            rateLimitByKey: z
+                .object({
+                calls: z.number(),
+                renewalPeriod: z.number(),
+                counterKey: z.string(),
+                incrementCondition: z.string().optional(),
+                incrementCount: z.number().optional(),
+            })
+                .optional(),
+        }))
+            .optional(),
+        outbound: z.array(z.any()).optional(),
+        backend: z.array(z.any()).optional(),
+        onError: z.array(z.any()).optional(),
+    })
+        .optional(),
+});
+// ============================================================================
+// GCP Schemas
+// ============================================================================
+export const GCPCredentialsSchema = z.object({
+    type: z.literal("service_account"),
+    project_id: z.string(),
+    private_key_id: z.string(),
+    private_key: z.string(),
+    client_email: z.string(),
+    client_id: z.string(),
+    auth_uri: z.string(),
+    token_uri: z.string(),
+    auth_provider_x509_cert_url: z.string(),
+    client_x509_cert_url: z.string(),
+});
+export const GCPLoadBalancerConfigSchema = z.object({
+    name: z.string(),
+    region: z.string(),
+    backendService: z.object({
+        name: z.string(),
+        backends: z.array(z.object({
+            group: z.string(),
+            balancingMode: z.enum(["UTILIZATION", "RATE"]).default("UTILIZATION"),
+            maxUtilization: z.number().min(0).max(1).default(0.8),
+            maxRatePerInstance: z.number().optional(),
+            capacityScaler: z.number().min(0).max(1).default(1.0),
+        })),
+        healthChecks: z.array(z.string()),
+        loadBalancingScheme: z.enum(["INTERNAL", "EXTERNAL"]).default("EXTERNAL"),
+        protocol: z
+            .enum(["HTTP", "HTTPS", "HTTP2", "TCP", "UDP", "GRPC"])
+            .default("HTTP"),
+    }),
+    // Rate limiting configuration
+    rateLimit: z
+        .object({
+        enabled: z.boolean().default(true),
+        rateLimiter: z
+            .object({
+            enforceOnKey: z
+                .enum(["ALL", "IP", "HTTP_HEADER", "XFF_IP"])
+                .default("IP"),
+            enforceOnKeyName: z.string().optional(),
+            rateLimitThreshold: z.object({
+                count: z.number(),
+                intervalSec: z.number(),
+            }),
+        })
+            .optional(),
+    })
+        .optional(),
+});
+export const GCPAPIGatewayConfigSchema = z.object({
+    name: z.string(),
+    displayName: z.string(),
+    description: z.string().optional(),
+    apiConfig: z.object({
+        name: z.string(),
+        displayName: z.string(),
+        description: z.string().optional(),
+        openapiDocuments: z.array(z.object({
+            document: z.object({
+                path: z.string(),
+                contents: z.string(),
+            }),
+        })),
+        gatewayConfig: z
+            .object({
+            backendConfig: z
+                .object({
+                googleServiceAccount: z.string().optional(),
+            })
+                .optional(),
+        })
+            .optional(),
+        // Rate limiting
+        quota: z
+            .object({
+            limits: z
+                .array(z.object({
+                name: z.string(),
+                metric: z.string(),
+                unit: z.enum(["MINUTE", "HOUR", "DAY"]),
+                values: z.record(z.string(), z.string()),
+            }))
+                .optional(),
+        })
+            .optional(),
+    }),
+});
+// ============================================================================
+// Common Infrastructure Validation
+// ============================================================================
+export const InfrastructureConfigSchema = z.object({
+    provider: z.enum(["aws", "azure", "gcp"]),
+    region: z.string(),
+    environment: z.enum(["dev", "staging", "prod"]).default("dev"),
+    tags: z.record(z.string(), z.string()).optional(),
+    // Security configurations
+    security: z
+        .object({
+        enableEncryption: z.boolean().default(true),
+        enableLogging: z.boolean().default(true),
+        enableMonitoring: z.boolean().default(true),
+        complianceFrameworks: z
+            .array(z.enum(["SOC2", "HIPAA", "PCI-DSS", "GDPR"]))
+            .optional(),
+    })
+        .optional(),
+    // Networking
+    networking: z
+        .object({
+        vpc: z.any().optional(), // Provider-specific VPC config
+        loadBalancers: z.array(z.any()).optional(), // Provider-specific LB config
+        apiGateways: z.array(z.any()).optional(), // Provider-specific API Gateway config
+        firewalls: z
+            .array(z.object({
+            name: z.string(),
+            direction: z.enum(["INGRESS", "EGRESS"]),
+            priority: z.number(),
+            allowed: z
+                .array(z.object({
+                ipProtocol: z.string(),
+                ports: z.array(z.string()).optional(),
+            }))
+                .optional(),
+            denied: z
+                .array(z.object({
+                ipProtocol: z.string(),
+                ports: z.array(z.string()).optional(),
+            }))
+                .optional(),
+            sourceRanges: z.array(z.string()).optional(),
+            destinationRanges: z.array(z.string()).optional(),
+            targetTags: z.array(z.string()).optional(),
+            sourceTags: z.array(z.string()).optional(),
+        }))
+            .optional(),
+    })
+        .optional(),
+    // Rate limiting (global)
+    rateLimiting: z
+        .object({
+        enabled: z.boolean().default(true),
+        globalLimits: z
+            .object({
+            requestsPerSecond: z.number().min(1).default(1000),
+            requestsPerMinute: z.number().min(1).default(60000),
+            requestsPerHour: z.number().min(1).default(3600000),
+            burstMultiplier: z.number().min(1).max(10).default(2),
+        })
+            .optional(),
+        ipBasedLimits: z
+            .object({
+            enabled: z.boolean().default(true),
+            whitelist: z.array(z.string()).optional(),
+            blacklist: z.array(z.string()).optional(),
+        })
+            .optional(),
+        endpointLimits: z
+            .record(z.string(), z.object({
+            requestsPerSecond: z.number(),
+            requestsPerMinute: z.number().optional(),
+        }))
+            .optional(),
+    })
+        .optional(),
+});

package/dist/integrations/base/ExampleIntegration.js

@@ -4,7 +4,6 @@
  * This is a simple example showing how to create a custom integration
  * that extends the BaseIntegration class.
  *
- * @version 1.0.0
  * @since 2026-03-15
  */
 import { BaseIntegration, createSimpleIntegration, } from "./index.js";

package/dist/integrations/base/Integration.js

@@ -4,7 +4,6 @@
  * Abstract base class providing common lifecycle management, event emission,
  * configuration handling, and logging for all 0xRay integrations.
  *
- * @version 1.0.0
  * @since 2026-03-15
  */
 import { EventEmitter } from "events";

package/dist/integrations/base/index.js

@@ -3,7 +3,6 @@
  *
  * Common interfaces and base class for 0xRay integrations.
  *
- * @version 1.0.0
  * @since 2026-03-15
  */
 // Re-export types

package/dist/integrations/base/registry.js

@@ -4,7 +4,6 @@
  * Central registry for managing 0xRay integrations.
  * Provides registration, loading, unloading, health checking, and stats retrieval.
  *
- * @version 1.0.0
  * @since 2026-03-15
  */
 import { EventEmitter } from "events";

package/dist/integrations/base/types.js

@@ -4,7 +4,6 @@
  * Common TypeScript interfaces for 0xRay integrations.
  * Provides a standardized foundation for all integration types.
  *
- * @version 1.0.0
  * @since 2026-03-15
  */
 /**

package/dist/integrations/enforcement-gate.js

@@ -25,7 +25,7 @@ async function loadRegistry() {
         return cached;
     const candidatePaths = [
         () => import("../enforcement/validators/validator-registry.js"),
-        () => import("../../node_modules/0xray/dist/enforcement/validators/validator-registry.js"),
+        () => import(/* skip-ts */ "../../node_modules/0xray/dist/enforcement/validators/validator-registry.js"),
     ];
     for (const load of candidatePaths) {
         try {
@@ -305,7 +305,7 @@ async function loadStateManager() {
     // xrayStateManager fallback removed in v2.2
     const candidatePaths = [
         () => import("../state/state-manager.js"),
-        () => import("../../node_modules/0xray/dist/state/state-manager.js"),
+        () => import(/* skip-ts */ "../../node_modules/0xray/dist/state/state-manager.js"),
     ];
     for (const load of candidatePaths) {
         try {
@@ -323,7 +323,7 @@ async function loadStateManager() {
 async function loadProcessorManager() {
     const candidatePaths = [
         () => import("../processors/processor-manager.js"),
-        () => import("../../node_modules/0xray/dist/processors/processor-manager.js"),
+        () => import(/* skip-ts */ "../../node_modules/0xray/dist/processors/processor-manager.js"),
     ];
     for (const load of candidatePaths) {
         try {

package/dist/integrations/governance/governance-client.js

@@ -4,7 +4,6 @@
  * Client for calling the chrono-warp-drive Dynamo governance endpoint.
  * Handles HTTP requests, retries, and response validation.
  *
- * @version 1.0.0
  * @since 2026-05-11
  */
 import { GovernanceError, GovernanceErrorCode, GovernanceTimeoutError, GovernanceNetworkError, } from './types.js';

package/dist/integrations/governance/index.js

@@ -4,15 +4,13 @@
  * Integrates chrono-warp-drive Dynamo governance endpoint for external
  * inference checking in governance decision-making.
  *
- * @version 1.0.0
  * @since 2026-05-11
  */
 import { BaseIntegration } from '../base/index.js';
 import { DEFAULT_GOVERNANCE_CONFIG } from './types.js';
 import { GovernanceClient } from './governance-client.js';
 import { frameworkLogger } from '../../core/framework-logger.js';
-import * as fs from 'fs';
-import * as path from 'path';
+import { featuresConfigLoader } from '../../core/features-config.js';
 /**
  * Main Governance Integration class
  *
@@ -283,24 +281,19 @@ export class InferenceGovernanceIntegration extends BaseIntegration {
      */
     async loadConfig() {
         try {
-            const configPath = path.join(process.cwd(), '.xray', 'features.json');
-            if (!fs.existsSync(configPath)) {
-                await this.log('warning', 'features.json not found, using defaults');
-                return;
-            }
-            const content = fs.readFileSync(configPath, 'utf-8');
-            const features = JSON.parse(content);
-            if (features.inference_governance) {
+            const features = featuresConfigLoader.loadConfig();
+            const inferenceGovernance = features.inference_governance;
+            if (inferenceGovernance) {
                 this.configData = {
                     ...DEFAULT_GOVERNANCE_CONFIG,
-                    enabled: features.inference_governance.enabled ?? false,
-                    endpointUrl: features.inference_governance.endpoint_url ?? DEFAULT_GOVERNANCE_CONFIG.endpointUrl,
-                    requestTimeoutMs: features.inference_governance.request_timeout_ms ?? DEFAULT_GOVERNANCE_CONFIG.requestTimeoutMs,
-                    minConfidenceThreshold: features.inference_governance.min_confidence_threshold ?? DEFAULT_GOVERNANCE_CONFIG.minConfidenceThreshold,
+                    enabled: inferenceGovernance.enabled ?? false,
+                    endpointUrl: inferenceGovernance.endpoint_url ?? DEFAULT_GOVERNANCE_CONFIG.endpointUrl,
+                    requestTimeoutMs: inferenceGovernance.request_timeout_ms ?? DEFAULT_GOVERNANCE_CONFIG.requestTimeoutMs,
+                    minConfidenceThreshold: inferenceGovernance.min_confidence_threshold ?? DEFAULT_GOVERNANCE_CONFIG.minConfidenceThreshold,
                     decisionLogic: {
-                        passConfidenceMin: features.inference_governance.decision_logic?.pass_confidence_min ?? DEFAULT_GOVERNANCE_CONFIG.decisionLogic.passConfidenceMin,
-                        revisionConfidenceMax: features.inference_governance.decision_logic?.revision_confidence_max ?? DEFAULT_GOVERNANCE_CONFIG.decisionLogic.revisionConfidenceMax,
-                        voteWeightMultiplier: features.inference_governance.decision_logic?.vote_weight_multiplier ?? DEFAULT_GOVERNANCE_CONFIG.decisionLogic.voteWeightMultiplier,
+                        passConfidenceMin: inferenceGovernance.decision_logic?.pass_confidence_min ?? DEFAULT_GOVERNANCE_CONFIG.decisionLogic.passConfidenceMin,
+                        revisionConfidenceMax: inferenceGovernance.decision_logic?.revision_confidence_max ?? DEFAULT_GOVERNANCE_CONFIG.decisionLogic.revisionConfidenceMax,
+                        voteWeightMultiplier: inferenceGovernance.decision_logic?.vote_weight_multiplier ?? DEFAULT_GOVERNANCE_CONFIG.decisionLogic.voteWeightMultiplier,
                     },
                 };
             }
@@ -313,7 +306,6 @@ export class InferenceGovernanceIntegration extends BaseIntegration {
             await this.log('error', 'Failed to load configuration', {
                 error: error instanceof Error ? error.message : String(error),
             });
-            // Use defaults on error
             this.configData = DEFAULT_GOVERNANCE_CONFIG;
         }
     }

package/dist/integrations/governance/types.js

@@ -4,7 +4,6 @@
  * Type definitions for the chrono-warp-drive Dynamo governance endpoint integration.
  * Provides external governance checking for inference-driven proposals.
  *
- * @version 1.0.0
  * @since 2026-05-11
  */
 /**

package/dist/integrations/hermes-agent/__init__.py

@@ -722,6 +722,10 @@ def register(ctx):
         f"[plugin-loaded] Xray Hermes Plugin v2.2 — "
         f"6 tools, 2 hooks, subagent enforcement, bridge={BRIDGE_PATH.exists()}")
 
+    # Log session-start since on_session_start may not fire in oneshot mode
+    _log_to_file("activity.log",
+        f"[session-start] session={session_id}")
+
     logger.info(
         "[xray] Plugin v2.2 loaded: 6 tools, 2 hooks, "
         "subagent enforcement active, bridge=%s",