@bluefly/openstandardagents 0.4.5 → 0.4.6

package/dist/services/governance/governance-generator.service.js

@@ -20,17 +20,29 @@ const FRAMEWORK_REQUIREMENTS = {
         {
             id: 'SOC2-CC6.1',
             description: 'Logical and physical access controls',
-            controls: ['rbac-enforcement', 'least-privilege-access', 'access-review-quarterly'],
+            controls: [
+                'rbac-enforcement',
+                'least-privilege-access',
+                'access-review-quarterly',
+            ],
         },
         {
             id: 'SOC2-CC6.3',
             description: 'Role-based access with segregation of duties',
-            controls: ['role-separation', 'approval-workflows', 'privilege-escalation-monitoring'],
+            controls: [
+                'role-separation',
+                'approval-workflows',
+                'privilege-escalation-monitoring',
+            ],
         },
         {
             id: 'SOC2-CC7.2',
             description: 'System monitoring and anomaly detection',
-            controls: ['audit-logging', 'anomaly-detection', 'incident-response-plan'],
+            controls: [
+                'audit-logging',
+                'anomaly-detection',
+                'incident-response-plan',
+            ],
         },
         {
             id: 'SOC2-CC8.1',
@@ -42,17 +54,29 @@ const FRAMEWORK_REQUIREMENTS = {
         {
             id: 'HIPAA-164.312(a)',
             description: 'Access control -- unique user identification',
-            controls: ['unique-agent-identity', 'emergency-access-procedure', 'automatic-logoff'],
+            controls: [
+                'unique-agent-identity',
+                'emergency-access-procedure',
+                'automatic-logoff',
+            ],
         },
         {
             id: 'HIPAA-164.312(b)',
             description: 'Audit controls -- hardware/software/procedural',
-            controls: ['audit-trail-immutable', 'audit-retention-6-years', 'audit-review-regular'],
+            controls: [
+                'audit-trail-immutable',
+                'audit-retention-6-years',
+                'audit-review-regular',
+            ],
         },
         {
             id: 'HIPAA-164.312(c)',
             description: 'Integrity controls',
-            controls: ['data-integrity-verification', 'tamper-detection', 'checksums'],
+            controls: [
+                'data-integrity-verification',
+                'tamper-detection',
+                'checksums',
+            ],
         },
         {
             id: 'HIPAA-164.312(e)',
@@ -64,22 +88,38 @@ const FRAMEWORK_REQUIREMENTS = {
         {
             id: 'GDPR-Art5',
             description: 'Principles of data processing',
-            controls: ['purpose-limitation', 'data-minimisation', 'storage-limitation'],
+            controls: [
+                'purpose-limitation',
+                'data-minimisation',
+                'storage-limitation',
+            ],
         },
         {
             id: 'GDPR-Art25',
             description: 'Data protection by design and default',
-            controls: ['privacy-by-design', 'default-privacy-settings', 'dpia-required'],
+            controls: [
+                'privacy-by-design',
+                'default-privacy-settings',
+                'dpia-required',
+            ],
         },
         {
             id: 'GDPR-Art30',
             description: 'Records of processing activities',
-            controls: ['processing-records', 'data-flow-mapping', 'controller-documentation'],
+            controls: [
+                'processing-records',
+                'data-flow-mapping',
+                'controller-documentation',
+            ],
         },
         {
             id: 'GDPR-Art33',
             description: 'Notification of data breach',
-            controls: ['breach-detection-72h', 'breach-notification-procedure', 'breach-documentation'],
+            controls: [
+                'breach-detection-72h',
+                'breach-notification-procedure',
+                'breach-documentation',
+            ],
         },
     ],
     'PCI-DSS': [
@@ -91,24 +131,40 @@ const FRAMEWORK_REQUIREMENTS = {
         {
             id: 'PCI-DSS-Req4',
             description: 'Encrypt cardholder data in transit',
-            controls: ['tls-1.2-minimum', 'certificate-management', 'no-plaintext-transmission'],
+            controls: [
+                'tls-1.2-minimum',
+                'certificate-management',
+                'no-plaintext-transmission',
+            ],
         },
         {
             id: 'PCI-DSS-Req10',
             description: 'Track and monitor access',
-            controls: ['audit-trail-all-access', 'log-retention-1-year', 'daily-log-review'],
+            controls: [
+                'audit-trail-all-access',
+                'log-retention-1-year',
+                'daily-log-review',
+            ],
         },
         {
             id: 'PCI-DSS-Req11',
             description: 'Regular security testing',
-            controls: ['quarterly-vulnerability-scan', 'annual-penetration-test', 'ids-ips'],
+            controls: [
+                'quarterly-vulnerability-scan',
+                'annual-penetration-test',
+                'ids-ips',
+            ],
         },
     ],
     FedRAMP: [
         {
             id: 'FedRAMP-AC',
             description: 'Access control family (NIST 800-53)',
-            controls: ['account-management', 'access-enforcement', 'separation-of-duties'],
+            controls: [
+                'account-management',
+                'access-enforcement',
+                'separation-of-duties',
+            ],
         },
         {
             id: 'FedRAMP-AU',
@@ -118,12 +174,20 @@ const FRAMEWORK_REQUIREMENTS = {
         {
             id: 'FedRAMP-SC',
             description: 'System and communications protection',
-            controls: ['fips-140-2-cryptography', 'boundary-protection', 'cryptographic-key-management'],
+            controls: [
+                'fips-140-2-cryptography',
+                'boundary-protection',
+                'cryptographic-key-management',
+            ],
         },
         {
             id: 'FedRAMP-CM',
             description: 'Configuration management',
-            controls: ['baseline-configuration', 'configuration-change-control', 'least-functionality'],
+            controls: [
+                'baseline-configuration',
+                'configuration-change-control',
+                'least-functionality',
+            ],
         },
     ],
 };
@@ -313,7 +377,9 @@ export class GovernanceGeneratorService {
      */
     generateAutonomyPolicy(autonomy, governance, agentName, agentKind) {
         const level = autonomy.level ?? this.inferAutonomyLevel(agentKind);
-        const approvalRequired = autonomy.approval_required ?? autonomy.approvalRequired ?? level !== 'autonomous';
+        const approvalRequired = autonomy.approval_required ??
+            autonomy.approvalRequired ??
+            level !== 'autonomous';
         const allowedActions = autonomy.allowed_actions ?? autonomy.allowedActions ?? [];
         const blockedActions = autonomy.blocked_actions ?? autonomy.blockedActions ?? [];
         // Provide defaults when lists are empty
@@ -479,7 +545,11 @@ export class GovernanceGeneratorService {
                     accessTier: 'tier_2_write_limited',
                     approvalRequired: true,
                     allowedOperations: ['read', 'analyze', 'report'],
-                    blockedOperations: ['delete', 'deploy-production', 'modify-governance'],
+                    blockedOperations: [
+                        'delete',
+                        'deploy-production',
+                        'modify-governance',
+                    ],
                 },
             },
         };
@@ -496,9 +566,7 @@ export class GovernanceGeneratorService {
     generateAuditConfig(governance, agentName, agentVersion) {
         const compliance = governance.compliance ?? {};
         const declaredFrameworks = compliance.frameworks ?? [];
-        const auditRequired = compliance.auditLogging ??
-            compliance.audit_logging_required ??
-            true; // Default: audit is always enabled
+        const auditRequired = compliance.auditLogging ?? compliance.audit_logging_required ?? true; // Default: audit is always enabled
         // Retention based on strictest compliance requirement
         const retentionDays = this.computeRetentionDays(declaredFrameworks);
         const doc = {
@@ -567,9 +635,21 @@ export class GovernanceGeneratorService {
                 redaction: {
                     enabled: true,
                     patterns: [
-                        { type: 'pii', action: 'hash', description: 'Hash personally identifiable information' },
-                        { type: 'secrets', action: 'redact', description: 'Redact API keys, tokens, and credentials' },
-                        { type: 'phi', action: 'hash', description: 'Hash protected health information (HIPAA)' },
+                        {
+                            type: 'pii',
+                            action: 'hash',
+                            description: 'Hash personally identifiable information',
+                        },
+                        {
+                            type: 'secrets',
+                            action: 'redact',
+                            description: 'Redact API keys, tokens, and credentials',
+                        },
+                        {
+                            type: 'phi',
+                            action: 'hash',
+                            description: 'Hash protected health information (HIPAA)',
+                        },
                     ],
                 },
             },
@@ -653,7 +733,12 @@ export class GovernanceGeneratorService {
         switch (agentKind) {
             case 'orchestrator':
             case 'coordinator':
-                return [...base, 'delegate-tasks', 'coordinate-agents', 'monitor-progress'];
+                return [
+                    ...base,
+                    'delegate-tasks',
+                    'coordinate-agents',
+                    'monitor-progress',
+                ];
             case 'executor':
             case 'worker':
                 return [...base, 'execute-tasks', 'write-data', 'call-tools'];
@@ -683,7 +768,12 @@ export class GovernanceGeneratorService {
             case 'reviewer':
             case 'monitor':
             case 'analyst':
-                return [...universal, 'write-data', 'execute-deployments', 'modify-configurations'];
+                return [
+                    ...universal,
+                    'write-data',
+                    'execute-deployments',
+                    'modify-configurations',
+                ];
             case 'assistant':
                 return [...universal, 'execute-deployments', 'modify-infrastructure'];
             default:
@@ -730,7 +820,10 @@ export class GovernanceGeneratorService {
                 policy.timeoutSeconds = 1800;
                 break;
             default:
-                policy.triggerConditions = ['high-risk-action', 'blocked-action-attempted'];
+                policy.triggerConditions = [
+                    'high-risk-action',
+                    'blocked-action-attempted',
+                ];
                 policy.timeoutSeconds = 600;
         }
         return policy;
@@ -740,11 +833,15 @@ export class GovernanceGeneratorService {
      */
     inferKindFromRole(role) {
         const lower = role.toLowerCase();
-        if (lower.includes('lead') || lower.includes('manager') || lower.includes('orchestrat'))
+        if (lower.includes('lead') ||
+            lower.includes('manager') ||
+            lower.includes('orchestrat'))
             return 'team-lead';
         if (lower.includes('review') || lower.includes('approv'))
             return 'reviewer';
-        if (lower.includes('monitor') || lower.includes('watch') || lower.includes('observ'))
+        if (lower.includes('monitor') ||
+            lower.includes('watch') ||
+            lower.includes('observ'))
             return 'monitor';
         if (lower.includes('sub') || lower.includes('helper'))
             return 'subagent';
@@ -767,11 +864,18 @@ export class GovernanceGeneratorService {
                     accessTier: 'tier_3_full_access',
                     approvalRequired: false,
                     allowedOperations: [
-                        'read', 'write', 'execute', 'delegate', 'coordinate',
-                        'approve-member-actions', 'modify-team-config', 'view-audit-logs',
+                        'read',
+                        'write',
+                        'execute',
+                        'delegate',
+                        'coordinate',
+                        'approve-member-actions',
+                        'modify-team-config',
+                        'view-audit-logs',
                     ],
                     blockedOperations: [
-                        'modify-own-governance', 'disable-audit-logging',
+                        'modify-own-governance',
+                        'disable-audit-logging',
                         'access-other-team-credentials',
                     ],
                     canEscalate: true,
@@ -784,12 +888,19 @@ export class GovernanceGeneratorService {
                     accessTier: 'tier_2_write_limited',
                     approvalRequired: false,
                     allowedOperations: [
-                        'read', 'analyze', 'plan', 'coordinate', 'create-issues',
-                        'assign-tasks', 'report',
+                        'read',
+                        'analyze',
+                        'plan',
+                        'coordinate',
+                        'create-issues',
+                        'assign-tasks',
+                        'report',
                     ],
                     blockedOperations: [
-                        'modify-governance', 'deploy-production',
-                        'delete-data', 'modify-infrastructure',
+                        'modify-governance',
+                        'deploy-production',
+                        'delete-data',
+                        'modify-infrastructure',
                     ],
                     canEscalate: true,
                     canDelegate: true,
@@ -802,12 +913,18 @@ export class GovernanceGeneratorService {
                     accessTier: 'tier_2_write_limited',
                     approvalRequired: true,
                     allowedOperations: [
-                        'read', 'write', 'execute-assigned-tasks', 'call-tools',
+                        'read',
+                        'write',
+                        'execute-assigned-tasks',
+                        'call-tools',
                         'report-progress',
                     ],
                     blockedOperations: [
-                        'modify-governance', 'deploy-production', 'approve-changes',
-                        'delete-data', 'modify-team-config',
+                        'modify-governance',
+                        'deploy-production',
+                        'approve-changes',
+                        'delete-data',
+                        'modify-team-config',
                     ],
                     canEscalate: true,
                     canDelegate: false,
@@ -818,12 +935,19 @@ export class GovernanceGeneratorService {
                     accessTier: 'tier_1_read',
                     approvalRequired: false,
                     allowedOperations: [
-                        'read', 'analyze', 'review', 'approve-changes', 'add-comments',
+                        'read',
+                        'analyze',
+                        'review',
+                        'approve-changes',
+                        'add-comments',
                         'request-changes',
                     ],
                     blockedOperations: [
-                        'write-code', 'execute-deployments', 'modify-governance',
-                        'delete-data', 'modify-infrastructure',
+                        'write-code',
+                        'execute-deployments',
+                        'modify-governance',
+                        'delete-data',
+                        'modify-infrastructure',
                     ],
                     canEscalate: true,
                     canDelegate: false,
@@ -834,12 +958,18 @@ export class GovernanceGeneratorService {
                     accessTier: 'tier_1_read',
                     approvalRequired: true,
                     allowedOperations: [
-                        'read-assigned-scope', 'execute-specific-task', 'report-to-parent',
+                        'read-assigned-scope',
+                        'execute-specific-task',
+                        'report-to-parent',
                     ],
                     blockedOperations: [
-                        'write-outside-scope', 'communicate-external',
-                        'modify-governance', 'deploy', 'delete-data',
-                        'access-other-agent-data', 'modify-team-config',
+                        'write-outside-scope',
+                        'communicate-external',
+                        'modify-governance',
+                        'deploy',
+                        'delete-data',
+                        'access-other-agent-data',
+                        'modify-team-config',
                     ],
                     canEscalate: false,
                     canDelegate: false,
@@ -851,12 +981,18 @@ export class GovernanceGeneratorService {
                     accessTier: 'tier_1_read',
                     approvalRequired: false,
                     allowedOperations: [
-                        'read', 'observe-metrics', 'analyze-data', 'generate-reports',
+                        'read',
+                        'observe-metrics',
+                        'analyze-data',
+                        'generate-reports',
                         'trigger-alerts',
                     ],
                     blockedOperations: [
-                        'write-data', 'execute-tasks', 'modify-governance',
-                        'deploy', 'delete-data',
+                        'write-data',
+                        'execute-tasks',
+                        'modify-governance',
+                        'deploy',
+                        'delete-data',
                     ],
                     canEscalate: true,
                     canDelegate: false,
@@ -867,9 +1003,7 @@ export class GovernanceGeneratorService {
                     accessTier: 'tier_1_read',
                     approvalRequired: true,
                     allowedOperations: ['read', 'analyze', 'report'],
-                    blockedOperations: [
-                        'write', 'delete', 'deploy', 'modify-governance',
-                    ],
+                    blockedOperations: ['write', 'delete', 'deploy', 'modify-governance'],
                     canEscalate: false,
                     canDelegate: false,
                 };

package/dist/services/id-card.service.js

@@ -10,6 +10,7 @@
  * SOLID: Single Responsibility — Agent ID Card lifecycle management only
  */
 import * as crypto from 'crypto';
+import { SPEC_VERSION } from '../version.js';
 export class IdCardService {
     /**
      * Compute a hash of content with the given algorithm, prefixed with algorithm name.
@@ -42,7 +43,7 @@ export class IdCardService {
         const provenance = {
             createdBy: options.createdBy,
             createdAt: now,
-            createdWith: options.createdWith || `ossa-cli/0.4.5`,
+            createdWith: options.createdWith || `ossa-cli/${SPEC_VERSION}`,
         };
         if (options.lineage && options.lineage.length > 0) {
             provenance.lineage = options.lineage.map((l) => ({

package/dist/services/identity/identity.service.d.ts

@@ -0,0 +1,21 @@
+export interface IdentityResult {
+    publicKey: string;
+    algorithm: string;
+    privateKeyPath: string;
+}
+export declare class IdentityService {
+    /**
+     * Generates a secure Ed25519 cryptographic keypair
+     */
+    static generateIdentity(): {
+        privateKey: string;
+        publicKey: string;
+        algorithm: string;
+    };
+    /**
+     * Provisions a new identity explicitly for a scaffolded agent environment,
+     * storing the private counterpart securely.
+     */
+    static provisionIdentityForAgent(agentDir: string): IdentityResult;
+}
+//# sourceMappingURL=identity.service.d.ts.map

package/dist/services/identity/identity.service.js

@@ -0,0 +1,36 @@
+import { generateKeyPairSync } from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+export class IdentityService {
+    /**
+     * Generates a secure Ed25519 cryptographic keypair
+     */
+    static generateIdentity() {
+        const { privateKey, publicKey } = generateKeyPairSync('ed25519', {
+            publicKeyEncoding: { type: 'spki', format: 'pem' },
+            privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+        });
+        return { privateKey, publicKey, algorithm: 'ed25519' };
+    }
+    /**
+     * Provisions a new identity explicitly for a scaffolded agent environment,
+     * storing the private counterpart securely.
+     */
+    static provisionIdentityForAgent(agentDir) {
+        const keysDir = path.join(agentDir, '.keys');
+        if (!fs.existsSync(keysDir)) {
+            fs.mkdirSync(keysDir, { recursive: true });
+        }
+        const { privateKey, publicKey, algorithm } = this.generateIdentity();
+        const privateKeyPath = path.join(keysDir, 'private.pem');
+        // Write private key with secure file permissions
+        fs.writeFileSync(privateKeyPath, privateKey, { mode: 0o600 });
+        // Ensure the folder ignores all contents (protecting private keys from git leakage)
+        const gitignorePath = path.join(keysDir, '.gitignore');
+        if (!fs.existsSync(gitignorePath)) {
+            fs.writeFileSync(gitignorePath, '*\n!.gitignore\n');
+        }
+        return { publicKey, algorithm, privateKeyPath };
+    }
+}
+//# sourceMappingURL=identity.service.js.map

package/dist/services/import/framework-to-ossa.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Framework-to-OSSA conversion (LangFlow, LangChain, CrewAI, AutoGen).
+ * Uses official flow/config shapes; no custom runtime. Single source for import CLI.
+ */
+import type { OssaAgent } from '../../types/index.js';
+export type FrameworkImportPlatform = 'langflow' | 'langchain' | 'crewai' | 'autogen';
+export interface FrameworkImportResult {
+    manifest: OssaAgent;
+    warnings: string[];
+}
+/** LangFlow flow JSON (nodes + edges). Official: langflow package, flow export. */
+export declare function convertLangFlowToOSSA(data: unknown): FrameworkImportResult;
+/** LangChain agent config (agent.llm, agent.tools, etc.). Official: langchain package. */
+export declare function convertLangChainToOSSA(data: unknown): FrameworkImportResult;
+/** CrewAI agent/crew config. Official: crewai, crewai-tools. */
+export declare function convertCrewAIToOSSA(data: unknown): FrameworkImportResult;
+/** AutoGen config. Official: pyautogen / autogen. */
+export declare function convertAutoGenToOSSA(data: unknown): FrameworkImportResult;
+export declare function convertFromFramework(platform: FrameworkImportPlatform, data: unknown): FrameworkImportResult;
+export declare function isSupportedFrameworkImport(platform: string): platform is FrameworkImportPlatform;
+//# sourceMappingURL=framework-to-ossa.d.ts.map