@graychennpm/codebridge 0.0.0-stage → 0.1.0

package/node_modules/@codebridge/policy/dist/index.js

@@ -0,0 +1,317 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+export * from "./capability-runtime.js";
+export { registerDemoCapabilities } from "./demo-capabilities.js";
+export { registerEquityCapabilities } from "./equity-capabilities.js";
+const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+export class CapabilityRegistry {
+    definitions = new Map();
+    database;
+    constructor(definitions = [], options = {}) {
+        const databasePath = options.databasePath ?? ":memory:";
+        if (databasePath !== ":memory:")
+            fs.mkdirSync(path.dirname(databasePath), { recursive: true });
+        this.database = new DatabaseSync(databasePath);
+        this.database.exec(`
+      CREATE TABLE IF NOT EXISTS capabilities (
+        id TEXT PRIMARY KEY,
+        risk TEXT NOT NULL,
+        adapter TEXT NOT NULL,
+        environments TEXT,
+        description TEXT,
+        source_kind TEXT,
+        source_ref TEXT,
+        source_version TEXT,
+        source_revision TEXT,
+        updated_at TEXT NOT NULL
+      );
+    `);
+        for (const statement of [
+            "ALTER TABLE capabilities ADD COLUMN source_kind TEXT",
+            "ALTER TABLE capabilities ADD COLUMN source_ref TEXT",
+            "ALTER TABLE capabilities ADD COLUMN source_version TEXT",
+            "ALTER TABLE capabilities ADD COLUMN source_revision TEXT",
+            "ALTER TABLE capabilities ADD COLUMN side_effects TEXT",
+            "ALTER TABLE capabilities ADD COLUMN idempotency TEXT",
+        ]) {
+            try {
+                this.database.exec(statement);
+            }
+            catch { /* Existing databases already contain the column. */ }
+        }
+        const rows = this.database.prepare("SELECT * FROM capabilities ORDER BY id ASC").all();
+        for (const row of rows)
+            this.definitions.set(String(row.id), toCapability(row));
+        for (const definition of definitions)
+            this.register(definition);
+    }
+    register(definition) {
+        if (!definition.id.trim())
+            throw new Error("capability id must not be empty");
+        this.definitions.set(definition.id, {
+            ...definition,
+            environments: definition.environments ? [...definition.environments] : undefined,
+            source: definition.source ? { ...definition.source } : undefined,
+        });
+        this.database
+            .prepare(`INSERT INTO capabilities (
+           id, risk, adapter, environments, description,
+           source_kind, source_ref, source_version, source_revision, side_effects, idempotency, updated_at
+         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET risk = excluded.risk, adapter = excluded.adapter,
+           environments = excluded.environments, description = excluded.description,
+           source_kind = excluded.source_kind, source_ref = excluded.source_ref,
+           source_version = excluded.source_version, source_revision = excluded.source_revision,
+           side_effects = excluded.side_effects, idempotency = excluded.idempotency,
+           updated_at = excluded.updated_at`)
+            .run(definition.id, definition.risk, definition.adapter, definition.environments ? JSON.stringify(definition.environments) : null, definition.description ?? null, definition.source?.kind ?? null, definition.source?.ref ?? null, definition.source?.version ?? null, definition.source?.revision ?? null, definition.side_effects === undefined ? null : definition.side_effects ? "1" : "0", definition.idempotency ? JSON.stringify(definition.idempotency) : null, new Date().toISOString());
+    }
+    get(id) {
+        const definition = this.definitions.get(id);
+        return definition
+            ? {
+                ...definition,
+                environments: definition.environments ? [...definition.environments] : undefined,
+                source: definition.source ? { ...definition.source } : undefined,
+            }
+            : undefined;
+    }
+    list() {
+        return [...this.definitions.values()].map((definition) => ({
+            ...definition,
+            environments: definition.environments ? [...definition.environments] : undefined,
+            source: definition.source ? { ...definition.source } : undefined,
+        }));
+    }
+    close() {
+        if (this.database.isOpen)
+            this.database.close();
+    }
+}
+function toCapability(row) {
+    const source = row.source_kind === null || row.source_kind === undefined
+        ? undefined
+        : {
+            kind: String(row.source_kind),
+            ref: String(row.source_ref),
+            version: row.source_version === null || row.source_version === undefined ? undefined : String(row.source_version),
+            revision: row.source_revision === null || row.source_revision === undefined ? undefined : String(row.source_revision),
+        };
+    return {
+        id: String(row.id),
+        risk: String(row.risk),
+        adapter: String(row.adapter),
+        environments: row.environments === null ? undefined : JSON.parse(String(row.environments)),
+        description: row.description === null ? undefined : String(row.description),
+        source,
+        side_effects: row.side_effects === null || row.side_effects === undefined ? undefined : String(row.side_effects) === "1",
+        idempotency: row.idempotency === null || row.idempotency === undefined ? undefined : JSON.parse(String(row.idempotency)),
+    };
+}
+export class PolicyEngine {
+    registry;
+    constructor(registry) {
+        this.registry = registry;
+    }
+    getCapability(capabilityId) {
+        return this.registry.get(capabilityId);
+    }
+    evaluate(capabilityId, context) {
+        const capability = this.registry.get(capabilityId);
+        if (!capability) {
+            return { allowed: false, requiresApproval: false, reason: "unknown_capability" };
+        }
+        if (capability.environments &&
+            !capability.environments.includes(context.environment)) {
+            return { allowed: false, requiresApproval: false, reason: "environment_not_allowed" };
+        }
+        if (capability.risk === "production_write" && !context.approvalGranted) {
+            return {
+                allowed: false,
+                requiresApproval: true,
+                reason: "approval_required",
+                capability,
+            };
+        }
+        return { allowed: true, requiresApproval: false, capability };
+    }
+}
+export class ApprovalService {
+    eventStore;
+    database;
+    constructor(eventStore, databasePath) {
+        this.eventStore = eventStore;
+        if (databasePath !== ":memory:")
+            fs.mkdirSync(path.dirname(databasePath), { recursive: true });
+        this.database = new DatabaseSync(databasePath);
+        this.database.exec(`
+      CREATE TABLE IF NOT EXISTS approvals (
+        id TEXT PRIMARY KEY,
+        work_item_id TEXT NOT NULL,
+        run_id TEXT NOT NULL,
+        step_id TEXT NOT NULL,
+        capability_id TEXT NOT NULL,
+        session_id TEXT NOT NULL DEFAULT '',
+        environment TEXT NOT NULL DEFAULT 'unknown',
+        target_resource TEXT NOT NULL DEFAULT '',
+        input_hash TEXT NOT NULL,
+        status TEXT NOT NULL,
+        requested_by TEXT NOT NULL,
+        granted_by TEXT,
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        granted_at TEXT,
+        consumed_at TEXT
+      );
+      CREATE INDEX IF NOT EXISTS approvals_run ON approvals (run_id, status);
+    `);
+        for (const statement of [
+            "ALTER TABLE approvals ADD COLUMN session_id TEXT NOT NULL DEFAULT ''",
+            "ALTER TABLE approvals ADD COLUMN environment TEXT NOT NULL DEFAULT 'unknown'",
+            "ALTER TABLE approvals ADD COLUMN target_resource TEXT NOT NULL DEFAULT ''",
+        ]) {
+            try {
+                this.database.exec(statement);
+            }
+            catch { /* Existing databases already contain the column. */ }
+        }
+    }
+    request(input) {
+        if (!this.eventStore.getWorkItem(input.workItemId)) {
+            throw new Error(`WorkItem not found: ${input.workItemId}`);
+        }
+        const createdAt = new Date();
+        const record = {
+            id: `apr_${randomUUID().replaceAll("-", "")}`,
+            workItemId: input.workItemId,
+            runId: input.runId,
+            stepId: input.stepId,
+            capabilityId: input.capabilityId,
+            sessionId: input.sessionId ?? "unknown",
+            environment: input.environment ?? "unknown",
+            targetResource: input.targetResource ?? "unknown",
+            inputHash: input.inputHash,
+            status: "requested",
+            requestedBy: input.requestedBy,
+            grantedBy: null,
+            createdAt: createdAt.toISOString(),
+            expiresAt: new Date(createdAt.getTime() + (input.ttlMs ?? 15 * 60_000)).toISOString(),
+            grantedAt: null,
+            consumedAt: null,
+        };
+        this.database
+            .prepare(`INSERT INTO approvals (
+          id, work_item_id, run_id, step_id, capability_id, input_hash, status,
+          session_id, environment, target_resource, requested_by, granted_by,
+          created_at, expires_at, granted_at, consumed_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(record.id, record.workItemId, record.runId, record.stepId, record.capabilityId, record.inputHash, record.status, record.sessionId, record.environment, record.targetResource, record.requestedBy, record.grantedBy, record.createdAt, record.expiresAt, record.grantedAt, record.consumedAt);
+        this.eventStore.appendEvent({
+            workItemId: record.workItemId,
+            runId: record.runId,
+            type: "APPROVAL_REQUESTED",
+            actor: "system",
+            target: record.capabilityId,
+            inputHash: record.inputHash,
+            payload: {
+                approval_id: record.id,
+                step_id: record.stepId,
+                session_id: record.sessionId,
+                environment: record.environment,
+                target_resource: record.targetResource,
+                expires_at: record.expiresAt,
+            },
+        });
+        return record;
+    }
+    grant(id, grantedBy) {
+        const record = this.get(id);
+        if (!record || record.status !== "requested")
+            return record;
+        const now = new Date();
+        if (new Date(record.expiresAt).getTime() <= now.getTime()) {
+            this.database.prepare("UPDATE approvals SET status = 'expired' WHERE id = ?").run(id);
+            return this.get(id);
+        }
+        const grantedAt = now.toISOString();
+        this.database
+            .prepare("UPDATE approvals SET status = 'granted', granted_by = ?, granted_at = ? WHERE id = ?")
+            .run(grantedBy, grantedAt, id);
+        this.eventStore.appendEvent({
+            workItemId: record.workItemId,
+            runId: record.runId,
+            type: "APPROVAL_GRANTED",
+            actor: "user",
+            target: record.capabilityId,
+            inputHash: record.inputHash,
+            payload: { approval_id: id, step_id: record.stepId, granted_by: grantedBy },
+        });
+        return this.get(id);
+    }
+    revoke(id, rejectedBy) {
+        const record = this.get(id);
+        if (!record || record.status !== "requested")
+            return record;
+        this.database.prepare("UPDATE approvals SET status = 'revoked', granted_by = ? WHERE id = ?")
+            .run(rejectedBy, id);
+        this.eventStore.appendEvent({
+            workItemId: record.workItemId,
+            runId: record.runId,
+            type: "APPROVAL_REJECTED",
+            actor: "user",
+            target: record.capabilityId,
+            inputHash: record.inputHash,
+            payload: { approval_id: id, step_id: record.stepId, rejected_by: rejectedBy },
+        });
+        return this.get(id);
+    }
+    consume(id, runId, stepId, inputHash) {
+        const record = this.get(id);
+        if (!record || record.status !== "granted")
+            return false;
+        if (record.runId !== runId || record.stepId !== stepId || record.inputHash !== inputHash)
+            return false;
+        if (new Date(record.expiresAt).getTime() <= Date.now()) {
+            this.database.prepare("UPDATE approvals SET status = 'expired' WHERE id = ?").run(id);
+            return false;
+        }
+        const result = this.database
+            .prepare("UPDATE approvals SET status = 'consumed', consumed_at = ? WHERE id = ? AND status = 'granted'")
+            .run(new Date().toISOString(), id);
+        return Number(result.changes) === 1;
+    }
+    get(id) {
+        const row = this.database.prepare("SELECT * FROM approvals WHERE id = ?").get(id);
+        return row ? toApproval(row) : undefined;
+    }
+    listForRun(runId) {
+        return this.database.prepare("SELECT * FROM approvals WHERE run_id = ? ORDER BY created_at ASC").all(runId).map(toApproval);
+    }
+    close() {
+        if (this.database.isOpen)
+            this.database.close();
+    }
+}
+function toApproval(row) {
+    return {
+        id: String(row.id),
+        workItemId: String(row.work_item_id),
+        runId: String(row.run_id),
+        stepId: String(row.step_id),
+        capabilityId: String(row.capability_id),
+        sessionId: row.session_id === null ? "unknown" : String(row.session_id),
+        environment: row.environment === null ? "unknown" : String(row.environment),
+        targetResource: row.target_resource === null ? "unknown" : String(row.target_resource),
+        inputHash: String(row.input_hash),
+        status: String(row.status),
+        requestedBy: String(row.requested_by),
+        grantedBy: row.granted_by === null ? null : String(row.granted_by),
+        createdAt: String(row.created_at),
+        expiresAt: String(row.expires_at),
+        grantedAt: row.granted_at === null ? null : String(row.granted_at),
+        consumedAt: row.consumed_at === null ? null : String(row.consumed_at),
+    };
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@codebridge/policy/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@codebridge/policy",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "license": "MIT",
+  "dependencies": {
+    "@codebridge/work-items": "0.1.0"
+  }
+}

package/node_modules/@codebridge/project-catalog/dist/index.d.ts

@@ -0,0 +1,145 @@
+import type { SqliteEventStore } from "@codebridge/work-items";
+export type CandidateStatus = "candidate" | "accepted" | "rejected";
+export type ProjectStatus = "registered" | "deprecated";
+export type DiscoveryConfidence = "low" | "medium" | "high";
+export type DiscoveryTaskStatus = "queued" | "running" | "succeeded" | "failed";
+export type ProjectDriftStatus = "open" | "resolved";
+export interface DiscoveryTask {
+    id: string;
+    status: DiscoveryTaskStatus;
+    workspacePath: string;
+    workItemId: string | null;
+    candidateId: string | null;
+    error: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CreateDiscoveryTaskInput {
+    id?: string;
+    workspacePath: string;
+    workItemId?: string | null;
+}
+export interface UpdateDiscoveryTaskInput {
+    status?: DiscoveryTaskStatus;
+    candidateId?: string | null;
+    error?: string | null;
+}
+export interface ProjectEvidence {
+    kind: string;
+    ref: string;
+    value?: string;
+}
+export interface ProjectCandidateInput {
+    projectId: string;
+    displayName?: string;
+    repositoryRemote?: string;
+    language?: string;
+    deployService?: string;
+    logService?: string;
+    apmService?: string;
+    dependencies?: string[];
+    confidence: DiscoveryConfidence;
+    evidence: ProjectEvidence[];
+}
+export interface ProjectCandidate extends ProjectCandidateInput {
+    id: string;
+    status: CandidateStatus;
+    observedAt: string;
+}
+export interface ProjectRecord extends ProjectCandidateInput {
+    id: string;
+    status: ProjectStatus;
+    registeredAt: string;
+}
+export interface ProjectCatalogGitOptions {
+    repositoryPath: string;
+    baseRef: string;
+    catalogPath?: string;
+}
+export interface CreateProjectCatalogProposalInput {
+    branch: string;
+    message?: string;
+}
+export interface ProjectCatalogProposal {
+    branch: string;
+    baseRef: string;
+    baseCommit: string;
+    commit: string;
+    path: string;
+}
+export interface ProjectFieldDrift {
+    field: "repositoryRemote" | "language" | "deployService" | "logService" | "apmService" | "dependencies";
+    registered: string | string[] | null;
+    observed: string | string[] | null;
+}
+export interface ProjectDrift {
+    id: string;
+    projectId: string;
+    candidateId: string;
+    changes: ProjectFieldDrift[];
+    evidence: ProjectEvidence[];
+    status: ProjectDriftStatus;
+    observedAt: string;
+    resolvedAt: string | null;
+}
+export interface DiscoveryObservation {
+    remote?: string;
+    language?: string;
+    deployService?: string;
+    logService?: string;
+    apmService?: string;
+    dependencies?: string[];
+    evidence: ProjectEvidence[];
+}
+export type DiscoveryEvidenceReader = (workspacePath: string) => Promise<DiscoveryObservation> | DiscoveryObservation;
+export declare class ProjectCatalogStore {
+    private readonly database;
+    constructor(databasePath: string);
+    saveCandidate(input: ProjectCandidateInput): ProjectCandidate;
+    listCandidates(): ProjectCandidate[];
+    getCandidate(id: string): ProjectCandidate | undefined;
+    getCandidateByProjectId(projectId: string): ProjectCandidate | undefined;
+    acceptCandidate(id: string): ProjectRecord;
+    getProject(id: string): ProjectRecord | undefined;
+    listProjects(): ProjectRecord[];
+    projectsForCandidate(id: string): ProjectRecord[];
+    syncProjects(projects: ProjectRecord[], revision: string): ProjectRecord[];
+    listDrifts(projectId?: string, status?: ProjectDriftStatus): ProjectDrift[];
+    resolveDrift(id: string): ProjectDrift | undefined;
+    applyDrift(id: string): ProjectRecord | undefined;
+    previewCandidate(id: string): {
+        path: string;
+        before: string;
+        after: string;
+        unified: string;
+    };
+    private recordDrift;
+    createDiscoveryTask(input: CreateDiscoveryTaskInput): DiscoveryTask;
+    getDiscoveryTask(id: string): DiscoveryTask | undefined;
+    listDiscoveryTasks(statuses?: DiscoveryTaskStatus[]): DiscoveryTask[];
+    updateDiscoveryTask(id: string, input: UpdateDiscoveryTaskInput): DiscoveryTask;
+    close(): void;
+}
+export declare class ProjectCatalogGitRepository {
+    private readonly options;
+    private readonly repositoryPath;
+    private readonly catalogPath;
+    constructor(options: ProjectCatalogGitOptions);
+    get baseRef(): string;
+    createProposal(projects: ProjectRecord[], input: CreateProjectCatalogProposalInput): ProjectCatalogProposal;
+    readProjects(ref?: string): ProjectRecord[];
+}
+export interface ProjectDiscoveryOptions {
+    reader?: DiscoveryEvidenceReader;
+    events?: SqliteEventStore;
+}
+export declare class ProjectDiscovery {
+    private readonly catalog;
+    private readonly options;
+    private readonly reader;
+    constructor(catalog: ProjectCatalogStore, options?: ProjectDiscoveryOptions);
+    observe(workspacePath: string, workItemId?: string): Promise<ProjectCandidate>;
+    close(): void;
+}
+export declare function renderProjectsYaml(projects: ProjectRecord[]): string;
+//# sourceMappingURL=index.d.ts.map