@evolith/core-domain 1.0.0

package/dist/application/validators/evaluators/opa-evaluator.js

@@ -0,0 +1,151 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpaEvaluator = void 0;
+const path = __importStar(require("path"));
+const opa_wasm_1 = require("@open-policy-agent/opa-wasm");
+const opa_input_builder_1 = require("./opa-input-builder");
+const ajv_1 = __importDefault(require("ajv"));
+const ajv_formats_1 = __importDefault(require("ajv-formats"));
+class OpaEvaluator {
+    constructor(fs, logger) {
+        this.fs = fs;
+        this.logger = logger;
+        this.policyCache = null;
+        this.schemaCache = new Map();
+        this.inputBuilder = new opa_input_builder_1.OpaInputBuilder(fs);
+        this.ajv = new ajv_1.default({ allErrors: true, strict: false });
+        (0, ajv_formats_1.default)(this.ajv);
+    }
+    async validateInput(category, input, corePath) {
+        const schemaPath = path.join(corePath, 'rulesets', 'opa', 'schemas', `${category}.input.schema.json`);
+        if (!await this.fs.exists(schemaPath)) {
+            return null;
+        }
+        try {
+            let validate = this.schemaCache.get(schemaPath);
+            if (!validate) {
+                const schemaContent = await this.fs.readFile(schemaPath);
+                const schema = JSON.parse(schemaContent);
+                validate = this.ajv.compile(schema);
+                this.schemaCache.set(schemaPath, validate);
+            }
+            const valid = validate(input);
+            if (!valid) {
+                return this.ajv.errorsText(validate.errors, { separator: '; ' });
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return `Failed to compile/run input schema validation: ${msg}`;
+        }
+        return null;
+    }
+    async evaluateAll(rules, ctx) {
+        const wasmPath = path.join(ctx.corePath, 'rulesets', 'opa', 'policy.wasm');
+        if (!await this.fs.exists(wasmPath)) {
+            this.logger.warn(`OPA WebAssembly policy not found at ${wasmPath}. Please compile the .rego rules.`);
+            return rules.map(rule => ({
+                rule,
+                result: 'skipped',
+                message: 'OPA Wasm policy not compiled yet.',
+            }));
+        }
+        try {
+            if (!this.policyCache) {
+                const wasmBuffer = await this.fs.readFileBuffer(wasmPath);
+                this.policyCache = await (0, opa_wasm_1.loadPolicy)(wasmBuffer);
+            }
+            const input = await this.inputBuilder.build(ctx);
+            const categories = Array.from(new Set(rules.map(r => r.category)));
+            const categoryErrors = new Map();
+            for (const cat of categories) {
+                const error = await this.validateInput(cat, input, ctx.corePath);
+                if (error) {
+                    categoryErrors.set(cat, error);
+                }
+            }
+            const passedRules = [];
+            const failedResults = [];
+            for (const rule of rules) {
+                const schemaError = categoryErrors.get(rule.category);
+                if (schemaError) {
+                    failedResults.push({
+                        rule,
+                        result: 'failed',
+                        message: `OPA Input Schema Validation Failed: ${schemaError}`,
+                    });
+                }
+                else {
+                    passedRules.push(rule);
+                }
+            }
+            let opaResults = [];
+            if (passedRules.length > 0) {
+                const resultSet = this.policyCache.evaluate(input);
+                const violations = (resultSet?.[0]?.result) ? resultSet[0].result : [];
+                opaResults = passedRules.map(rule => {
+                    const ruleViolations = violations.filter((v) => v.id === rule.id);
+                    if (ruleViolations.length > 0) {
+                        return {
+                            rule,
+                            result: 'failed',
+                            message: ruleViolations.map((v) => v.message).join('; '),
+                        };
+                    }
+                    return {
+                        rule,
+                        result: 'passed'
+                    };
+                });
+            }
+            return [...failedResults, ...opaResults];
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            this.logger.error(`Failed to evaluate OPA policy: ${msg}`);
+            return rules.map(rule => ({
+                rule,
+                result: 'skipped',
+                message: `OPA Engine Error: ${msg}`
+            }));
+        }
+    }
+}
+exports.OpaEvaluator = OpaEvaluator;
+//# sourceMappingURL=opa-evaluator.js.map

package/dist/application/validators/evaluators/opa-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-evaluator.js","sourceRoot":"","sources":["../../../../src/application/validators/evaluators/opa-evaluator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAI7B,0DAAyD;AACzD,2DAAsD;AACtD,8CAAsB;AACtB,8DAAqC;AAErC,MAAa,YAAY;IAMvB,YACmB,EAAe,EACf,MAAe;QADf,OAAE,GAAF,EAAE,CAAa;QACf,WAAM,GAAN,MAAM,CAAS;QAP1B,gBAAW,GAAQ,IAAI,CAAC;QAGxB,gBAAW,GAAqB,IAAI,GAAG,EAAE,CAAC;QAMhD,IAAI,CAAC,YAAY,GAAG,IAAI,mCAAe,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,aAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,IAAA,qBAAU,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,KAAU,EAAE,QAAgB;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,oBAAoB,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACzC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,kDAAkD,GAAG,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAuB,EACvB,GAAsB;QAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,QAAQ,mCAAmC,CAAC,CAAC;YACrG,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxB,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAC1D,IAAI,CAAC,WAAW,GAAG,MAAM,IAAA,qBAAU,EAAC,UAAU,CAAC,CAAC;YAClD,CAAC;YAGD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAGjD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;YACjD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjE,IAAI,KAAK,EAAE,CAAC;oBACV,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAqB,EAAE,CAAC;YACzC,MAAM,aAAa,GAA2B,EAAE,CAAC;YAEjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtD,IAAI,WAAW,EAAE,CAAC;oBAChB,aAAa,CAAC,IAAI,CAAC;wBACjB,IAAI;wBACJ,MAAM,EAAE,QAAQ;wBAChB,OAAO,EAAE,uCAAuC,WAAW,EAAE;qBAC9D,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAED,IAAI,UAAU,GAA2B,EAAE,CAAC;YAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAE3B,MAAM,SAAS,GAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACxD,MAAM,UAAU,GAA8B,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE/H,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;oBAClC,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC3F,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9B,OAAO;4BACL,IAAI;4BACJ,MAAM,EAAE,QAAQ;4BAChB,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;yBAClF,CAAC;oBACJ,CAAC;oBACD,OAAO;wBACL,IAAI;wBACJ,MAAM,EAAE,QAAQ;qBACjB,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC;QAE3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxB,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,qBAAqB,GAAG,EAAE;aACpC,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;CACF;AA1HD,oCA0HC"}

package/dist/application/validators/evaluators/opa-evaluator.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/application/validators/evaluators/opa-evaluator.spec.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const opa_evaluator_1 = require("./opa-evaluator");
+const mocks_1 = require("../../../test/mocks");
+const path = __importStar(require("path"));
+jest.mock('@open-policy-agent/opa-wasm', () => {
+    return {
+        loadPolicy: jest.fn().mockResolvedValue({
+            evaluate: jest.fn().mockReturnValue([
+                {
+                    result: [
+                        { id: 'DEP-01', message: 'package.json#dependencies.lodash=^4.17.21 (Caret pinning not allowed)' }
+                    ]
+                }
+            ])
+        })
+    };
+});
+describe('OpaEvaluator', () => {
+    let fs;
+    let logger;
+    let evaluator;
+    beforeEach(() => {
+        fs = (0, mocks_1.createMockFileSystem)();
+        logger = (0, mocks_1.createMockLogger)();
+        evaluator = new opa_evaluator_1.OpaEvaluator(fs, logger);
+    });
+    afterEach(() => {
+        jest.clearAllMocks();
+    });
+    const mockRule = {
+        id: 'DEP-01',
+        severity: 'MUST',
+        category: 'version-pinning',
+        title: 'Dependency Pinning',
+        description: 'All dependencies must be strictly pinned',
+        blocking: true,
+        sourceFile: 'rules.json',
+    };
+    const ctx = {
+        satellitePath: '/satellite',
+        corePath: '/core',
+    };
+    it('should skip evaluation if policy.wasm is not present', async () => {
+        const results = await evaluator.evaluateAll([mockRule], ctx);
+        expect(results).toHaveLength(1);
+        expect(results[0].result).toBe('skipped');
+        expect(results[0].message).toMatch(/OPA Wasm policy not compiled yet/);
+        const warnLogs = logger.getLogsByLevel('WARN');
+        expect(warnLogs.length).toBeGreaterThan(0);
+        expect(warnLogs[0].message).toMatch(/OPA WebAssembly policy not found/);
+    });
+    it('should evaluate rules using the loaded Wasm policy if present', async () => {
+        const wasmPath = path.join('/core', 'rulesets', 'opa', 'policy.wasm');
+        // Write fake wasm bytes
+        fs.setFile(wasmPath, 'fake-wasm-content');
+        const results = await evaluator.evaluateAll([mockRule], ctx);
+        expect(results).toHaveLength(1);
+        expect(results[0].result).toBe('failed');
+        expect(results[0].message).toContain('Caret pinning not allowed');
+    });
+});
+//# sourceMappingURL=opa-evaluator.spec.js.map

package/dist/application/validators/evaluators/opa-evaluator.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-evaluator.spec.js","sourceRoot":"","sources":["../../../../src/application/validators/evaluators/opa-evaluator.spec.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAA+C;AAC/C,+CAA6E;AAG7E,2CAA6B;AAE7B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC5C,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACtC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC;gBAClC;oBACE,MAAM,EAAE;wBACN,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,uEAAuE,EAAE;qBACnG;iBACF;aACF,CAAC;SACH,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,EAA2C,CAAC;IAChD,IAAI,MAA2C,CAAC;IAChD,IAAI,SAAuB,CAAC;IAE5B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,GAAG,IAAA,4BAAoB,GAAE,CAAC;QAC5B,MAAM,GAAG,IAAA,wBAAgB,GAAE,CAAC;QAC5B,SAAS,GAAG,IAAI,4BAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAmB;QAC/B,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,0CAA0C;QACvD,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,YAAY;KACzB,CAAC;IAEF,MAAM,GAAG,GAAsB;QAC7B,aAAa,EAAE,YAAY;QAC3B,QAAQ,EAAE,OAAO;KAClB,CAAC;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAEtE,wBAAwB;QACxB,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAE7D,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/application/validators/evaluators/opa-input-builder.d.ts

@@ -0,0 +1,27 @@
+import { IFileSystem } from '../../../domain/interfaces';
+import { EvaluationContext } from './evaluator.interface';
+export declare class OpaInputBuilder {
+    private readonly fs;
+    constructor(fs: IFileSystem);
+    build(ctx: EvaluationContext): Promise<unknown>;
+    private safeReadJson;
+    private safeReadFile;
+    private readAgenticAiConfiguration;
+    private readServerlessConfiguration;
+    private readEventDrivenConfiguration;
+    private readDataMeshConfiguration;
+    private readEdgeComputingConfiguration;
+    private asRecord;
+    private asStringArray;
+    private isRestrictedAccess;
+    private isPositiveNumber;
+    private pathsOverlap;
+    private getTopLevelDirs;
+    private readWorkflows;
+    private readEvidence;
+    private listAdrs;
+    private listFilesRecursive;
+    private hasCompiledTests;
+    private readWorkspacePackageJsons;
+    private analyzeSourceFiles;
+}

package/dist/application/validators/evaluators/opa-input-builder.js

@@ -0,0 +1,357 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpaInputBuilder = void 0;
+const path = __importStar(require("path"));
+class OpaInputBuilder {
+    constructor(fs) {
+        this.fs = fs;
+    }
+    async build(ctx) {
+        const satelliteWorkflows = await this.readWorkflows(ctx.satellitePath);
+        const coreEvidence = await this.readEvidence(ctx.corePath);
+        const mcpServerContent = await this.safeReadFile(path.join(ctx.corePath, 'sdk', 'cli', 'src', 'core', 'mcp', 'server.ts'));
+        const agenticAi = await this.readAgenticAiConfiguration(ctx.satellitePath);
+        const serverless = await this.readServerlessConfiguration(ctx.satellitePath);
+        const eventDriven = await this.readEventDrivenConfiguration(ctx.satellitePath);
+        const dataMesh = await this.readDataMeshConfiguration(ctx.satellitePath);
+        const edgeComputing = await this.readEdgeComputingConfiguration(ctx.satellitePath);
+        const input = {
+            satellitePath: ctx.satellitePath,
+            corePath: ctx.corePath,
+            satellite: {
+                packageJson: await this.safeReadJson(path.join(ctx.satellitePath, 'package.json')),
+                hasPackageLock: await this.fs.exists(path.join(ctx.satellitePath, 'package-lock.json')),
+                hasDependabot: await this.fs.exists(path.join(ctx.satellitePath, '.github', 'dependabot.yml')),
+                hasRenovate: await this.fs.exists(path.join(ctx.satellitePath, '.renovaterc.json')),
+                directories: await this.getTopLevelDirs(ctx.satellitePath),
+                hasContracts: await this.fs.exists(path.join(ctx.satellitePath, 'contracts')),
+                hasAcl: await this.fs.exists(path.join(ctx.satellitePath, 'acl')),
+                hasEvents: await this.fs.exists(path.join(ctx.satellitePath, 'events')) || await this.fs.exists(path.join(ctx.satellitePath, 'src', 'events')),
+                hasExtractionReadiness: await this.fs.exists(path.join(ctx.satellitePath, 'docs', 'extraction-readiness.md')),
+                hasDockerfile: await this.fs.exists(path.join(ctx.satellitePath, 'Dockerfile')),
+                serverless,
+                eventDriven,
+                dataMesh,
+                edgeComputing,
+                hasAsyncApiConfig: await this.fs.exists(path.join(ctx.satellitePath, 'asyncapi.yaml')) || await this.fs.exists(path.join(ctx.satellitePath, 'asyncapi.json')),
+                agenticAi,
+                hasOtel: await this.fs.exists(path.join(ctx.satellitePath, 'otel.config.js')) || await this.fs.exists(path.join(ctx.satellitePath, 'opentelemetry.config.js')) || await this.fs.exists(path.join(ctx.satellitePath, 'src', 'instrumentation.ts')),
+                workflows: satelliteWorkflows,
+                workspacePackageJsons: await this.readWorkspacePackageJsons(ctx.satellitePath),
+                sourceFiles: await this.analyzeSourceFiles(ctx.satellitePath)
+            },
+            core: {
+                packageJson: await this.safeReadJson(path.join(ctx.corePath, 'package.json')),
+                hasPackageLock: await this.fs.exists(path.join(ctx.corePath, 'package-lock.json')),
+                hasDependabot: await this.fs.exists(path.join(ctx.corePath, '.github', 'dependabot.yml')),
+                directories: await this.getTopLevelDirs(ctx.corePath),
+                adrs: await this.listAdrs(ctx.corePath),
+                evidence: coreEvidence,
+                cli: {
+                    hasMainJs: await this.fs.exists(path.join(ctx.corePath, 'sdk', 'cli', 'dist', 'main.js')),
+                    hasTests: await this.hasCompiledTests(ctx.corePath),
+                    hasReadme: await this.fs.exists(path.join(ctx.corePath, 'sdk', 'cli', 'README.md')),
+                    hasArchitectureMd: await this.fs.exists(path.join(ctx.corePath, 'sdk', 'cli', 'ARCHITECTURE.md')),
+                    hasPackageLock: await this.fs.exists(path.join(ctx.corePath, 'sdk', 'cli', 'package-lock.json')),
+                    mcpServerSource: mcpServerContent
+                }
+            }
+        };
+        return input;
+    }
+    async safeReadJson(filePath) {
+        if (await this.fs.exists(filePath)) {
+            try {
+                return await this.fs.readJson(filePath);
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
+    }
+    async safeReadFile(filePath) {
+        if (await this.fs.exists(filePath)) {
+            try {
+                return await this.fs.readFile(filePath);
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
+    }
+    async readAgenticAiConfiguration(root) {
+        const config = await this.safeReadJson(path.join(root, 'agent.config.json'));
+        const agent = this.asRecord(config?.agent);
+        const sandbox = this.asRecord(config?.sandbox);
+        const toolPolicy = this.asRecord(config?.toolPolicy);
+        const contextPolicy = this.asRecord(config?.contextPolicy);
+        const audit = this.asRecord(config?.audit);
+        const budgets = this.asRecord(config?.operationalBudgets);
+        const concurrency = this.asRecord(budgets?.mcpToolConcurrency);
+        const credentials = this.asRecord(config?.credentialLifecycle);
+        const revocation = this.asRecord(credentials?.revocation);
+        const promptSources = this.asStringArray(config?.promptSources);
+        const implementationRoots = this.asStringArray(config?.implementationRoots);
+        const runbooksPath = typeof budgets?.runbooksPath === 'string' ? budgets.runbooksPath : '';
+        const runbooksExists = runbooksPath.length > 0 && await this.fs.exists(path.isAbsolute(runbooksPath) ? runbooksPath : path.join(root, runbooksPath));
+        return {
+            hasIdentity: typeof agent?.id === 'string' && agent.id.length > 0 && this.asStringArray(agent.capabilities).length > 0,
+            hasIsolatedSandbox: sandbox?.mode === 'isolated' && this.isRestrictedAccess(sandbox.network) && this.isRestrictedAccess(sandbox.process),
+            hasSeparatedPromptAndImplementation: promptSources.length > 0 && implementationRoots.length > 0 && !this.pathsOverlap(promptSources, implementationRoots),
+            requiresApprovalForMutativeTools: toolPolicy?.mutative === 'approval-required',
+            hasEphemeralSandboxLimits: sandbox?.ephemeral === true && this.isPositiveNumber(sandbox.maxDurationSeconds) && this.isPositiveNumber(sandbox.maxMemoryMb) && this.isPositiveNumber(sandbox.maxCpuCores),
+            hasTrustedContextPolicy: contextPolicy?.untrustedContent === 'data-only' && contextPolicy?.provenanceRequired === true && contextPolicy?.toolOutputSchemaValidation === true,
+            hasAccountableActions: toolPolicy?.capabilityDelegation === 'scoped-and-expiring' && audit?.appendOnly === true && audit?.correlationId === 'required',
+            hasOperationalBudgets: this.isPositiveNumber(budgets?.maxPromptTokens) && this.isPositiveNumber(budgets?.maxCompletionTokens) && this.isPositiveNumber(budgets?.maxContextWindowTokens) && this.isPositiveNumber(concurrency?.maxInFlight) && this.isPositiveNumber(concurrency?.perToolMaxInFlight) && runbooksExists,
+            hasCredentialLifecycle: this.isPositiveNumber(credentials?.delegationMaxTtlSeconds) && this.isPositiveNumber(credentials?.rotationCadenceDays) && (revocation?.onIncident === 'immediate' || revocation?.onIncident === 'scheduled') && this.isPositiveNumber(revocation?.maxPropagationSeconds),
+        };
+    }
+    async readServerlessConfiguration(root) {
+        const config = await this.safeReadJson(path.join(root, 'serverless.config.json'));
+        const pkg = this.asRecord(config?.package);
+        const coldStart = this.asRecord(config?.coldStart);
+        const maxSizeMb = pkg?.maxSizeMb;
+        return {
+            hasContract: Boolean(config),
+            isStateless: config?.stateless === true,
+            hasBoundedPackage: typeof maxSizeMb === 'number' && Number.isFinite(maxSizeMb) && maxSizeMb > 0 && maxSizeMb <= 50,
+            hasColdStartReadiness: typeof coldStart?.maxInitMilliseconds === 'number' && Number.isFinite(coldStart.maxInitMilliseconds) && coldStart.maxInitMilliseconds > 0 && coldStart?.lazyInitialization === true,
+        };
+    }
+    async readEventDrivenConfiguration(root) {
+        const config = await this.safeReadJson(path.join(root, 'event-driven.config.json'));
+        return {
+            hasStrictAsyncApi: config?.strictAsyncApi === true,
+            hasOutbox: config?.transactionalOutbox === true,
+            hasDlq: config?.deadLetterQueue === true,
+        };
+    }
+    async readDataMeshConfiguration(root) {
+        const config = await this.safeReadJson(path.join(root, 'data-mesh.config.json'));
+        return {
+            isDataProduct: config?.isDataProduct === true,
+            hasDataContracts: config?.hasDataContracts === true,
+            federatedGovernance: config?.federatedGovernance === true,
+        };
+    }
+    async readEdgeComputingConfiguration(root) {
+        const config = await this.safeReadJson(path.join(root, 'edge-computing.config.json'));
+        return {
+            syncStrategy: typeof config?.syncStrategy === 'string' ? config.syncStrategy : '',
+            edgeIsolation: config?.edgeIsolation === true,
+            conflictResolution: typeof config?.conflictResolution === 'string' ? config.conflictResolution : '',
+        };
+    }
+    asRecord(value) {
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+    }
+    asStringArray(value) {
+        return Array.isArray(value) ? value.filter((item) => typeof item === 'string' && item.length > 0) : [];
+    }
+    isRestrictedAccess(value) {
+        return value === 'deny' || value === 'allowlist';
+    }
+    isPositiveNumber(value) {
+        return typeof value === 'number' && Number.isFinite(value) && value > 0;
+    }
+    pathsOverlap(left, right) {
+        return left.some(leftPath => right.some(rightPath => {
+            const normalizedLeft = leftPath.replace(/\\+|\/+/g, '/').replace(/\/$/, '');
+            const normalizedRight = rightPath.replace(/\\+|\/+/g, '/').replace(/\/$/, '');
+            return normalizedLeft === normalizedRight || normalizedLeft.startsWith(`${normalizedRight}/`) || normalizedRight.startsWith(`${normalizedLeft}/`);
+        }));
+    }
+    async getTopLevelDirs(dir) {
+        if (!await this.fs.exists(dir))
+            return [];
+        const entries = await this.fs.readdirNames(dir);
+        const dirs = [];
+        for (const entry of entries) {
+            if (entry === '.' || entry === '..')
+                continue;
+            const stat = await this.fs.stat(path.join(dir, entry));
+            if (stat.isDirectory())
+                dirs.push(entry);
+        }
+        return dirs;
+    }
+    async readWorkflows(root) {
+        const workflowsDir = path.join(root, '.github', 'workflows');
+        const result = {};
+        if (!await this.fs.exists(workflowsDir))
+            return result;
+        const entries = await this.fs.readdirNames(workflowsDir);
+        for (const entry of entries) {
+            if (entry.endsWith('.yml') || entry.endsWith('.yaml')) {
+                const content = await this.safeReadFile(path.join(workflowsDir, entry));
+                if (content)
+                    result[entry] = content;
+            }
+        }
+        return result;
+    }
+    async readEvidence(root) {
+        const evidenceDir = path.join(root, '.harness', 'evidence');
+        const result = {};
+        if (!await this.fs.exists(evidenceDir))
+            return result;
+        const entries = await this.fs.readdirNames(evidenceDir);
+        for (const entry of entries) {
+            if (entry.endsWith('.json')) {
+                const content = await this.safeReadJson(path.join(evidenceDir, entry));
+                if (content)
+                    result[entry] = content;
+            }
+        }
+        return result;
+    }
+    async listAdrs(root) {
+        const adrDir = path.join(root, 'reference', 'architecture', 'adrs');
+        if (!await this.fs.exists(adrDir))
+            return [];
+        return this.listFilesRecursive(adrDir);
+    }
+    async listFilesRecursive(dir) {
+        const files = [];
+        const entries = await this.fs.readdirNames(dir);
+        for (const entry of entries) {
+            if (entry === '.' || entry === '..')
+                continue;
+            const full = path.join(dir, entry);
+            const stat = await this.fs.stat(full);
+            if (stat.isDirectory()) {
+                files.push(...await this.listFilesRecursive(full));
+            }
+            else {
+                files.push(full);
+            }
+        }
+        return files;
+    }
+    async hasCompiledTests(root) {
+        const distDir = path.join(root, 'sdk', 'cli', 'dist');
+        if (!await this.fs.exists(distDir))
+            return false;
+        const files = await this.listFilesRecursive(distDir);
+        return files.some(f => f.includes('.spec.') || f.includes('.test.'));
+    }
+    async readWorkspacePackageJsons(rootPath) {
+        const rootPkgPath = path.join(rootPath, 'package.json');
+        const files = [];
+        const rootPkg = await this.safeReadJson(rootPkgPath);
+        if (!rootPkg)
+            return files;
+        files.push({ path: rootPkgPath, content: rootPkg });
+        const workspaces = rootPkg["workspaces"];
+        const patterns = Array.isArray(workspaces)
+            ? workspaces
+            : (workspaces?.packages ?? []);
+        for (const pattern of patterns) {
+            const base = pattern.replace(/\/\*.*$/, '');
+            const wsBase = path.join(rootPath, base);
+            if (await this.fs.exists(wsBase)) {
+                const entries = await this.fs.readdirNames(wsBase);
+                for (const entry of entries) {
+                    if (entry === '.' || entry === '..')
+                        continue;
+                    const pkgPath = path.join(wsBase, entry, 'package.json');
+                    const pkg = await this.safeReadJson(pkgPath);
+                    if (pkg)
+                        files.push({ path: pkgPath, content: pkg });
+                }
+            }
+        }
+        return files;
+    }
+    async analyzeSourceFiles(rootPath) {
+        const srcPath = path.join(rootPath, 'src');
+        if (!await this.fs.exists(srcPath))
+            return [];
+        const allFiles = await this.listFilesRecursive(srcPath);
+        const tsFiles = allFiles.filter(f => f.endsWith('.ts'));
+        const sourceFilesInfo = [];
+        let ts;
+        try {
+            ts = await Promise.resolve().then(() => __importStar(require('typescript')));
+        }
+        catch {
+            for (const file of tsFiles) {
+                const content = await this.safeReadFile(file);
+                sourceFilesInfo.push({ path: file, content: content || '' });
+            }
+            return sourceFilesInfo;
+        }
+        for (const file of tsFiles) {
+            const content = await this.safeReadFile(file) || '';
+            const info = {
+                path: file.replace(rootPath, ''),
+                content: content,
+                hasAstImport: false,
+                hasManualInstantiation: false,
+                hasUiImport: false,
+                usesRegexForCode: content.includes('RegExp') || content.includes('.match(')
+            };
+            if (!file.endsWith('.spec.ts') && !file.endsWith('.test.ts')) {
+                const sourceFile = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true);
+                const checkNode = (node) => {
+                    if (ts.isImportDeclaration(node)) {
+                        const importPath = node.moduleSpecifier.getText().replace(/['"]/g, '');
+                        if (importPath === 'typescript' || importPath === '@babel/parser') {
+                            info.hasAstImport = true;
+                        }
+                        if (['@clack/prompts', 'inquirer', 'commander', 'express'].includes(importPath)) {
+                            info.hasUiImport = true;
+                        }
+                    }
+                    if (ts.isNewExpression(node)) {
+                        const className = node.expression.getText();
+                        if (/(Service|UseCase|Repository|Adapter)$/.test(className)) {
+                            info.hasManualInstantiation = true;
+                        }
+                    }
+                    ts.forEachChild(node, checkNode);
+                };
+                checkNode(sourceFile);
+            }
+            sourceFilesInfo.push(info);
+        }
+        return sourceFilesInfo;
+    }
+}
+exports.OpaInputBuilder = OpaInputBuilder;
+//# sourceMappingURL=opa-input-builder.js.map