@bluefly/openstandardagents 0.5.1 → 0.5.4

package/dist/services/github-sync/gitlab-client.js

@@ -1,42 +0,0 @@
-import { GitLabMRSchema } from './schemas.js';
-export class GitLabClient {
-    baseUrl = 'https://gitlab.com/api/v4';
-    token;
-    projectId;
-    constructor(token, projectId) {
-        this.token = token;
-        this.projectId = projectId;
-    }
-    async request(endpoint, options) {
-        const response = await fetch(`${this.baseUrl}${endpoint}`, {
-            ...options,
-            headers: {
-                'PRIVATE-TOKEN': this.token,
-                'Content-Type': 'application/json',
-                ...options?.headers,
-            },
-        });
-        if (!response.ok) {
-            throw new Error(`GitLab API error: ${response.statusText}`);
-        }
-        return response.json();
-    }
-    async createMR(params) {
-        const data = await this.request(`/projects/${this.projectId}/merge_requests`, {
-            method: 'POST',
-            body: JSON.stringify({
-                title: params.title,
-                description: params.description,
-                source_branch: params.sourceBranch,
-                target_branch: params.targetBranch,
-                labels: params.labels?.join(','),
-            }),
-        });
-        return GitLabMRSchema.parse(data);
-    }
-    async getMR(iid) {
-        const data = await this.request(`/projects/${this.projectId}/merge_requests/${iid}`);
-        return GitLabMRSchema.parse(data);
-    }
-}
-//# sourceMappingURL=gitlab-client.js.map

package/dist/services/github-sync/schemas.d.ts

@@ -1,46 +0,0 @@
-import { z } from 'zod';
-export declare const GitHubPRSchema: z.ZodObject<{
-    number: z.ZodNumber;
-    title: z.ZodString;
-    body: z.ZodNullable<z.ZodString>;
-    author: z.ZodObject<{
-        login: z.ZodString;
-    }, z.core.$strip>;
-    state: z.ZodEnum<{
-        open: "open";
-        closed: "closed";
-    }>;
-    labels: z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-    }, z.core.$strip>>;
-    created_at: z.ZodString;
-    updated_at: z.ZodString;
-}, z.core.$strip>;
-export declare const GitLabMRSchema: z.ZodObject<{
-    iid: z.ZodNumber;
-    title: z.ZodString;
-    description: z.ZodNullable<z.ZodString>;
-    source_branch: z.ZodString;
-    target_branch: z.ZodString;
-    state: z.ZodEnum<{
-        closed: "closed";
-        opened: "opened";
-        merged: "merged";
-    }>;
-    web_url: z.ZodString;
-}, z.core.$strip>;
-export declare const SyncConfigSchema: z.ZodObject<{
-    github: z.ZodObject<{
-        owner: z.ZodString;
-        repo: z.ZodString;
-        token: z.ZodString;
-    }, z.core.$strip>;
-    gitlab: z.ZodObject<{
-        projectId: z.ZodString;
-        token: z.ZodString;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export type GitHubPR = z.infer<typeof GitHubPRSchema>;
-export type GitLabMR = z.infer<typeof GitLabMRSchema>;
-export type SyncConfig = z.infer<typeof SyncConfigSchema>;
-//# sourceMappingURL=schemas.d.ts.map

package/dist/services/github-sync/schemas.js

@@ -1,36 +0,0 @@
-import { z } from 'zod';
-export const GitHubPRSchema = z.object({
-    number: z.number(),
-    title: z.string(),
-    body: z.string().nullable(),
-    author: z.object({
-        login: z.string(),
-    }),
-    state: z.enum(['open', 'closed']),
-    labels: z.array(z.object({
-        name: z.string(),
-    })),
-    created_at: z.string(),
-    updated_at: z.string(),
-});
-export const GitLabMRSchema = z.object({
-    iid: z.number(),
-    title: z.string(),
-    description: z.string().nullable(),
-    source_branch: z.string(),
-    target_branch: z.string(),
-    state: z.enum(['opened', 'closed', 'merged']),
-    web_url: z.string().url(),
-});
-export const SyncConfigSchema = z.object({
-    github: z.object({
-        owner: z.string(),
-        repo: z.string(),
-        token: z.string(),
-    }),
-    gitlab: z.object({
-        projectId: z.string(),
-        token: z.string(),
-    }),
-});
-//# sourceMappingURL=schemas.js.map

package/dist/services/github-sync/sync.service.d.ts

@@ -1,27 +0,0 @@
-import { SyncConfig, GitHubPR, GitLabMR } from './schemas.js';
-export declare class GitHubSyncService {
-    private github;
-    private gitlab;
-    constructor(config: SyncConfig);
-    /**
-     * Sync a GitHub PR to GitLab MR
-     */
-    syncPR(prNumber: number): Promise<GitLabMR>;
-    /**
-     * Batch sync multiple PRs (e.g., Dependabot)
-     */
-    batchSyncPRs(filters: {
-        author?: string;
-    }): Promise<GitLabMR>;
-    /**
-     * List PRs ready for sync
-     */
-    listSyncablePRs(filters?: {
-        author?: string;
-    }): Promise<GitHubPR[]>;
-    private buildMRDescription;
-    private buildBatchMRDescription;
-    private buildPRComment;
-    private buildBatchPRComment;
-}
-//# sourceMappingURL=sync.service.d.ts.map

package/dist/services/github-sync/sync.service.js

@@ -1,101 +0,0 @@
-import { GitHubClient } from './github-client.js';
-import { GitLabClient } from './gitlab-client.js';
-import { SyncConfigSchema } from './schemas.js';
-export class GitHubSyncService {
-    github;
-    gitlab;
-    constructor(config) {
-        const validated = SyncConfigSchema.parse(config);
-        this.github = new GitHubClient(validated.github.token, validated.github.owner, validated.github.repo);
-        this.gitlab = new GitLabClient(validated.gitlab.token, validated.gitlab.projectId);
-    }
-    /**
-     * Sync a GitHub PR to GitLab MR
-     */
-    async syncPR(prNumber) {
-        const pr = await this.github.getPR(prNumber);
-        const branchName = `github-pr-${prNumber}`;
-        const mr = await this.gitlab.createMR({
-            title: `GitHub PR #${prNumber}: ${pr.title}`,
-            description: this.buildMRDescription(pr),
-            sourceBranch: branchName,
-            targetBranch: 'main',
-            labels: ['github-pr'],
-        });
-        await this.github.createComment(prNumber, this.buildPRComment(mr));
-        return mr;
-    }
-    /**
-     * Batch sync multiple PRs (e.g., Dependabot)
-     */
-    async batchSyncPRs(filters) {
-        const prs = await this.github.listPRs(filters);
-        if (prs.length === 0) {
-            throw new Error('No PRs found matching filters');
-        }
-        const branchName = `batch-${filters.author || 'prs'}-${Date.now()}`;
-        const mr = await this.gitlab.createMR({
-            title: `Batch: ${prs.length} PRs from ${filters.author || 'GitHub'}`,
-            description: this.buildBatchMRDescription(prs),
-            sourceBranch: branchName,
-            targetBranch: 'main',
-            labels: ['batch-sync', filters.author || 'github'].filter(Boolean),
-        });
-        // Comment on all PRs
-        await Promise.all(prs.map((pr) => this.github.createComment(pr.number, this.buildBatchPRComment(mr))));
-        return mr;
-    }
-    /**
-     * List PRs ready for sync
-     */
-    async listSyncablePRs(filters) {
-        return this.github.listPRs(filters);
-    }
-    buildMRDescription(pr) {
-        return `**From GitHub PR**: https://github.com/${this.github['owner']}/${this.github['repo']}/pull/${pr.number}
-**Author**: @${pr.author.login}
-
-${pr.body || ''}
-
----
-
-*This MR was created from a GitHub pull request. Once merged, changes will sync back to GitHub.*`;
-    }
-    buildBatchMRDescription(prs) {
-        const prList = prs
-            .map((pr) => `- #${pr.number}: ${pr.title} (by @${pr.author.login})`)
-            .join('\n');
-        return `Batched ${prs.length} pull requests from GitHub:
-
-${prList}
-
----
-
-*These PRs will auto-close when this MR merges and syncs back to GitHub.*`;
-    }
-    buildPRComment(mr) {
-        return `[PASS] **Synced to GitLab**
-
-This PR has been synced to our internal GitLab for review and testing.
-
-**GitLab MR**: ${mr.web_url}
-
-Once merged on GitLab, changes will automatically sync back here and this PR will close.
-
----
-*Development happens at [gitlab.com](${mr.web_url})*`;
-    }
-    buildBatchPRComment(mr) {
-        return `[BOT] **Batched for Review**
-
-This PR has been batched with other updates for testing on GitLab.
-
-**GitLab MR**: ${mr.web_url}
-
-Once merged, this PR will automatically close.
-
----
-*Development happens at [gitlab.com](${mr.web_url})*`;
-    }
-}
-//# sourceMappingURL=sync.service.js.map

package/dist/services/gitlab-agent.service.d.ts

@@ -1,94 +0,0 @@
-/**
- * GitLab Kubernetes Agent Service
- * Manages GitLab Kubernetes agent registration and installation
- * Follows OpenAPI-first, DRY, CRUD principles
- */
-import { z } from 'zod';
-declare const GitLabAgentConfigSchema: z.ZodObject<{
-    name: z.ZodString;
-    projectPath: z.ZodString;
-    gitlabUrl: z.ZodString;
-    token: z.ZodString;
-}, z.core.$strip>;
-declare const GitLabAgentResponseSchema: z.ZodObject<{
-    id: z.ZodNumber;
-    name: z.ZodString;
-    project_id: z.ZodNumber;
-    created_at: z.ZodString;
-    created_by_user_id: z.ZodNullable<z.ZodNumber>;
-}, z.core.$strip>;
-declare const GitLabAgentTokenResponseSchema: z.ZodObject<{
-    id: z.ZodNumber;
-    name: z.ZodString;
-    token: z.ZodString;
-    created_at: z.ZodString;
-    created_by_user_id: z.ZodNullable<z.ZodNumber>;
-    last_used_at: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-export type GitLabAgentConfig = z.infer<typeof GitLabAgentConfigSchema>;
-export type GitLabAgentResponse = z.infer<typeof GitLabAgentResponseSchema>;
-export type GitLabAgentTokenResponse = z.infer<typeof GitLabAgentTokenResponseSchema>;
-export interface RegisterAgentResult {
-    agentId: number;
-    agentName: string;
-    token: string;
-    tokenId: number;
-    projectId: number;
-}
-export interface AgentInfo {
-    id: number;
-    name: string;
-    projectId: number;
-    createdAt: string;
-}
-/**
- * GitLab Kubernetes Agent Service
- * Provides CRUD operations for GitLab agents
- */
-export declare class GitLabAgentService {
-    private client;
-    private config;
-    constructor(config: GitLabAgentConfig);
-    /**
-     * Get project ID from project path
-     */
-    getProjectId(): Promise<number>;
-    /**
-     * List all agents for a project
-     */
-    listAgents(projectId?: number): Promise<AgentInfo[]>;
-    /**
-     * Get agent by name
-     */
-    getAgent(agentName?: string, projectId?: number): Promise<AgentInfo | null>;
-    /**
-     * Create a new agent (CREATE operation)
-     */
-    createAgent(agentName?: string): Promise<AgentInfo>;
-    /**
-     * Register agent (CREATE if not exists, otherwise returns existing)
-     */
-    registerAgent(agentName?: string): Promise<AgentInfo>;
-    /**
-     * Create agent token (CREATE operation)
-     */
-    createToken(agentId: number, tokenName?: string, projectId?: number): Promise<GitLabAgentTokenResponse>;
-    /**
-     * List agent tokens (READ operation)
-     */
-    listTokens(agentId: number, projectId?: number): Promise<GitLabAgentTokenResponse[]>;
-    /**
-     * Delete agent token (DELETE operation)
-     */
-    deleteToken(agentId: number, tokenId: number, projectId?: number): Promise<void>;
-    /**
-     * Delete agent (DELETE operation)
-     */
-    deleteAgent(agentId: number, projectId?: number): Promise<void>;
-    /**
-     * Register agent and create token (full registration flow)
-     */
-    registerAgentWithToken(agentName?: string): Promise<RegisterAgentResult>;
-}
-export {};
-//# sourceMappingURL=gitlab-agent.service.d.ts.map

package/dist/services/gitlab-agent.service.js

@@ -1,164 +0,0 @@
-/**
- * GitLab Kubernetes Agent Service
- * Manages GitLab Kubernetes agent registration and installation
- * Follows OpenAPI-first, DRY, CRUD principles
- */
-import { z } from 'zod';
-import axios from 'axios';
-// Zod schemas for type safety and validation
-const GitLabAgentConfigSchema = z.object({
-    name: z
-        .string()
-        .min(1)
-        .max(63)
-        .regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/),
-    projectPath: z.string().min(1),
-    gitlabUrl: z.string().url().min(1),
-    token: z.string().min(1),
-});
-const GitLabAgentResponseSchema = z.object({
-    id: z.number(),
-    name: z.string(),
-    project_id: z.number(),
-    created_at: z.string(),
-    created_by_user_id: z.number().nullable(),
-});
-const GitLabAgentTokenResponseSchema = z.object({
-    id: z.number(),
-    name: z.string(),
-    token: z.string(),
-    created_at: z.string(),
-    created_by_user_id: z.number().nullable(),
-    last_used_at: z.string().nullable(),
-});
-/**
- * GitLab Kubernetes Agent Service
- * Provides CRUD operations for GitLab agents
- */
-export class GitLabAgentService {
-    client;
-    config;
-    constructor(config) {
-        // Validate config with Zod
-        this.config = GitLabAgentConfigSchema.parse(config);
-        // Create axios client
-        this.client = axios.create({
-            baseURL: this.config.gitlabUrl,
-            headers: {
-                Authorization: `Bearer ${this.config.token}`,
-                'Content-Type': 'application/json',
-            },
-            timeout: 30000,
-        });
-    }
-    /**
-     * Get project ID from project path
-     */
-    async getProjectId() {
-        const encodedPath = encodeURIComponent(this.config.projectPath);
-        const response = await this.client.get(`/api/v4/projects/${encodedPath}`);
-        return response.data.id;
-    }
-    /**
-     * List all agents for a project
-     */
-    async listAgents(projectId) {
-        const pid = projectId || (await this.getProjectId());
-        const response = await this.client.get(`/api/v4/projects/${pid}/cluster_agents`);
-        return response.data.map((agent) => {
-            const parsed = GitLabAgentResponseSchema.parse(agent);
-            return {
-                id: parsed.id,
-                name: parsed.name,
-                projectId: parsed.project_id,
-                createdAt: parsed.created_at,
-            };
-        });
-    }
-    /**
-     * Get agent by name
-     */
-    async getAgent(agentName, projectId) {
-        const name = agentName || this.config.name;
-        const agents = await this.listAgents(projectId);
-        return agents.find((a) => a.name === name) || null;
-    }
-    /**
-     * Create a new agent (CREATE operation)
-     */
-    async createAgent(agentName) {
-        const name = agentName || this.config.name;
-        const projectId = await this.getProjectId();
-        const response = await this.client.post(`/api/v4/projects/${projectId}/cluster_agents`, {
-            name,
-        });
-        const parsed = GitLabAgentResponseSchema.parse(response.data);
-        return {
-            id: parsed.id,
-            name: parsed.name,
-            projectId: parsed.project_id,
-            createdAt: parsed.created_at,
-        };
-    }
-    /**
-     * Register agent (CREATE if not exists, otherwise returns existing)
-     */
-    async registerAgent(agentName) {
-        const name = agentName || this.config.name;
-        const existing = await this.getAgent(name);
-        if (existing) {
-            return existing;
-        }
-        return await this.createAgent(name);
-    }
-    /**
-     * Create agent token (CREATE operation)
-     */
-    async createToken(agentId, tokenName, projectId) {
-        const pid = projectId || (await this.getProjectId());
-        const name = tokenName || `${this.config.name}-token-${Date.now()}`;
-        const response = await this.client.post(`/api/v4/projects/${pid}/cluster_agents/${agentId}/tokens`, {
-            name,
-            description: `Token for ${this.config.name} GitLab agent`,
-        });
-        return GitLabAgentTokenResponseSchema.parse(response.data);
-    }
-    /**
-     * List agent tokens (READ operation)
-     */
-    async listTokens(agentId, projectId) {
-        const pid = projectId || (await this.getProjectId());
-        const response = await this.client.get(`/api/v4/projects/${pid}/cluster_agents/${agentId}/tokens`);
-        return response.data.map((token) => GitLabAgentTokenResponseSchema.parse(token));
-    }
-    /**
-     * Delete agent token (DELETE operation)
-     */
-    async deleteToken(agentId, tokenId, projectId) {
-        const pid = projectId || (await this.getProjectId());
-        await this.client.delete(`/api/v4/projects/${pid}/cluster_agents/${agentId}/tokens/${tokenId}`);
-    }
-    /**
-     * Delete agent (DELETE operation)
-     */
-    async deleteAgent(agentId, projectId) {
-        const pid = projectId || (await this.getProjectId());
-        await this.client.delete(`/api/v4/projects/${pid}/cluster_agents/${agentId}`);
-    }
-    /**
-     * Register agent and create token (full registration flow)
-     */
-    async registerAgentWithToken(agentName) {
-        const agent = await this.registerAgent(agentName);
-        const token = await this.createToken(agent.id);
-        const projectId = await this.getProjectId();
-        return {
-            agentId: agent.id,
-            agentName: agent.name,
-            token: token.token,
-            tokenId: token.id,
-            projectId,
-        };
-    }
-}
-//# sourceMappingURL=gitlab-agent.service.js.map

package/dist/services/governance/cedar-provider.d.ts

@@ -1,27 +0,0 @@
-import { GovernanceProvider, GovernanceConfig, ComplianceResult, AuthorizationRequest, AuthorizationResult, QualityGateRequest, QualityGateResult } from '../interfaces/governance-provider.interface.js';
-/**
- * Cedar Governance Provider
- *
- * Implements the GovernanceProvider interface using Amazon's Cedar Policy Language
- * principles for pre-execution authorization. This enables OSSA agents to have
- * formally verified authorization policies evaluated against agent manifests and contexts.
- */
-export declare class CedarGovernanceProvider implements GovernanceProvider {
-    name: string;
-    version: string;
-    /**
-     * Checks if the agent's governance config satisfies basic Cedar alignment.
-     * e.g., missing clearance levels when policies require them.
-     */
-    checkCompliance(config: GovernanceConfig): Promise<ComplianceResult>;
-    /**
-     * Authorize an agent action.
-     * Simulates Cedar policy evaluation (principal, action, resource, context).
-     */
-    authorize(request: AuthorizationRequest): Promise<AuthorizationResult>;
-    /**
-     * Evaluate if a pipeline execution passes the security/confidence gate
-     */
-    evaluateQualityGate(request: QualityGateRequest): Promise<QualityGateResult>;
-}
-//# sourceMappingURL=cedar-provider.d.ts.map

package/dist/services/governance/cedar-provider.js

@@ -1,109 +0,0 @@
-import { SPEC_VERSION } from '../../version.js';
-/**
- * Cedar Governance Provider
- *
- * Implements the GovernanceProvider interface using Amazon's Cedar Policy Language
- * principles for pre-execution authorization. This enables OSSA agents to have
- * formally verified authorization policies evaluated against agent manifests and contexts.
- */
-export class CedarGovernanceProvider {
-    name = 'cedar';
-    version = `v${SPEC_VERSION}`;
-    /**
-     * Checks if the agent's governance config satisfies basic Cedar alignment.
-     * e.g., missing clearance levels when policies require them.
-     */
-    async checkCompliance(config) {
-        const issues = [];
-        const warnings = [];
-        if (!config) {
-            warnings.push('No governance configuration provided. Proceeding with default deny policy.');
-            return { compliant: true, issues, warnings };
-        }
-        if (config.authorization?.clearance_level === undefined) {
-            warnings.push('No clearance level defined. Defaulting to lowest trust tier.');
-        }
-        if (config.authorization?.tool_permissions) {
-            for (const perm of config.authorization.tool_permissions) {
-                if (!perm.tool) {
-                    issues.push('Tool permission defined without a specific tool name.');
-                }
-                if (!perm.risk_level) {
-                    warnings.push(`Tool ${perm.tool || 'unknown'} has no risk level classified.`);
-                }
-            }
-        }
-        return {
-            compliant: issues.length === 0,
-            issues,
-            warnings,
-        };
-    }
-    /**
-     * Authorize an agent action.
-     * Simulates Cedar policy evaluation (principal, action, resource, context).
-     */
-    async authorize(request) {
-        const { agent, action, resource, context } = request;
-        // Default Deny (Cedar standard)
-        let decision = 'DENY';
-        let reason = 'Implicit deny. No allowing policy matched.';
-        const policies_evaluated = [];
-        // Simulate Policy Evaluation Context
-        const principalTier = context?.tier || 'tier_1_read';
-        const isDestructive = action.toLowerCase().includes('delete') ||
-            action.toLowerCase().includes('write');
-        policies_evaluated.push('policy_tier_bounds');
-        // Sample Cedar constraint translation
-        if (principalTier === 'tier_1_read' && isDestructive) {
-            decision = 'DENY';
-            reason = `Principal tier '${principalTier}' lacks permissions for destructive action '${action}'.`;
-        }
-        else {
-            // In a real integration, this would call the Cedar C++ binding or WASM module:
-            // const cedarEval = await cedar.isAuthorized({ principal, action, resource, context });
-            decision = 'ALLOW';
-            reason =
-                'Allowed by default test policy matching principal and action scope.';
-        }
-        return {
-            decision,
-            reason,
-            diagnostics: {
-                policies_evaluated,
-            },
-        };
-    }
-    /**
-     * Evaluate if a pipeline execution passes the security/confidence gate
-     */
-    async evaluateQualityGate(request) {
-        const blocked_by = [];
-        if (request.environment === 'production') {
-            if (request.metrics.confidence_score < 0.9) {
-                blocked_by.push('Confidence score below production threshold (90%)');
-            }
-            if (request.metrics.vulnerability_count > 0) {
-                blocked_by.push('Vulnerabilities found. Production allows 0.');
-            }
-        }
-        else {
-            // lower environments
-            if (request.metrics.confidence_score < 0.7) {
-                blocked_by.push('Confidence score below development threshold (70%)');
-            }
-        }
-        const decision = blocked_by.length === 0 ? 'PASS' : 'FAIL';
-        return {
-            decision,
-            blocked_by,
-            policy_decision: {
-                decision: decision === 'PASS' ? 'ALLOW' : 'DENY',
-                reason: decision === 'PASS'
-                    ? 'Quality gate matched constraints.'
-                    : 'Metrics failed quality requirements.',
-            },
-        };
-    }
-}
-//# sourceMappingURL=cedar-provider.js.map

package/dist/services/governance/cedar-validator.service.d.ts

@@ -1,32 +0,0 @@
-/**
- * Cedar Policy Validator Service
- *
- * Uses @cedar-policy/cedar-wasm to validate Cedar policies embedded in OSSA manifests.
- * This is OSSA's responsibility: schema definition + offline validation.
- * Runtime enforcement belongs to DUADP.
- */
-export interface CedarValidationResult {
-    valid: boolean;
-    policyId?: string;
-    errors: string[];
-    warnings: string[];
-}
-export interface CedarManifestValidationResult {
-    valid: boolean;
-    policyCount: number;
-    results: CedarValidationResult[];
-    hasSchema: boolean;
-}
-/**
- * Validate a single Cedar policy text for syntax correctness.
- */
-export declare function validatePolicyText(policyText: string, policyId?: string): CedarValidationResult;
-/**
- * Validate a Cedar policy against a Cedar schema.
- */
-export declare function validatePolicyWithSchema(policyText: string, schemaText: string, policyId?: string): CedarValidationResult;
-/**
- * Extract and validate all Cedar policies from an OSSA manifest.
- */
-export declare function validateManifestCedarPolicies(manifest: Record<string, unknown>): CedarManifestValidationResult;
-//# sourceMappingURL=cedar-validator.service.d.ts.map