@maykonpaulo/maestro-core 0.3.0-next.0 → 0.3.0-next.2

package/dist/index.js

@@ -70,6 +70,52 @@ var ConsoleLogger = class {
   }
 };
 
+// src/logging/ConsoleStructuredLogger.ts
+var ConsoleStructuredLogger = class {
+  constructor(minLevel = "info") {
+    this.minLevel = minLevel;
+  }
+  minLevel;
+  debug(entry) {
+    this.log("debug", entry);
+  }
+  info(entry) {
+    this.log("info", entry);
+  }
+  warn(entry) {
+    this.log("warn", entry);
+  }
+  error(entry) {
+    this.log("error", entry);
+  }
+  log(level, entry) {
+    if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[this.minLevel]) return;
+    const output = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      level
+    };
+    if (entry.correlationId !== void 0) output["correlationId"] = entry.correlationId;
+    if (entry.operation !== void 0) output["operation"] = entry.operation;
+    if (entry.entity !== void 0) output["entity"] = entry.entity;
+    if (entry.entityId !== void 0) output["entityId"] = entry.entityId;
+    if (entry.actor !== void 0) output["actor"] = entry.actor;
+    if (entry.durationMs !== void 0) output["durationMs"] = entry.durationMs;
+    if (entry.status !== void 0) output["status"] = entry.status;
+    if (entry.severity !== void 0) output["severity"] = entry.severity;
+    if (entry.message !== void 0) output["message"] = entry.message;
+    if (entry.metadata !== void 0) output["metadata"] = entry.metadata;
+    if (entry.error !== void 0) output["error"] = this.serializeError(entry.error);
+    const consoleFn = level === "error" ? console.error : level === "warn" ? console.warn : level === "debug" ? console.debug : console.info;
+    consoleFn(JSON.stringify(output));
+  }
+  serializeError(error) {
+    if (error instanceof Error) {
+      return { name: error.name, message: error.message };
+    }
+    return error;
+  }
+};
+
 // src/audit/InMemoryAuditRepository.ts
 var InMemoryAuditRepository = class {
   store = /* @__PURE__ */ new Map();
@@ -85,6 +131,12 @@ var InMemoryAuditRepository = class {
     if (filter.action !== void 0) {
       events = events.filter((e) => e.action === filter.action);
     }
+    if (filter.entity !== void 0) {
+      events = events.filter((e) => e.entity === filter.entity);
+    }
+    if (filter.entityId !== void 0) {
+      events = events.filter((e) => e.entityId === filter.entityId);
+    }
     if (filter.resourceType !== void 0) {
       events = events.filter((e) => e.resource?.type === filter.resourceType);
     }
@@ -107,6 +159,9 @@ var InMemoryAuditRepository = class {
     }
     return events;
   }
+  async query(filter) {
+    return this.list(filter);
+  }
 };
 
 // src/audit/AuditRecorder.ts
@@ -124,6 +179,8 @@ var AuditRecorder = class {
       actor: input.actor,
       level: input.level ?? "info",
       resource: input.resource,
+      entity: input.entity,
+      entityId: input.entityId,
       before: input.before,
       after: input.after,
       metadata: input.metadata,
@@ -2303,25 +2360,471 @@ var IntrospectionRuntime = class {
     return engine.compare(previous.result, current);
   }
 };
+
+// src/correlation/CorrelationId.ts
+import { randomUUID as randomUUID4 } from "crypto";
+function generateCorrelationId() {
+  return randomUUID4();
+}
+
+// src/risk/MetadataRiskClassifier.ts
+var MetadataRiskClassifier = class {
+  constructor(operationRiskMap = {}, defaultRisk = "LOW") {
+    this.operationRiskMap = operationRiskMap;
+    this.defaultRisk = defaultRisk;
+  }
+  operationRiskMap;
+  defaultRisk;
+  classify(input) {
+    const fromMetadata = input.metadata?.["riskLevel"];
+    if (isOperationalRisk(fromMetadata)) return fromMetadata;
+    return this.operationRiskMap[input.operation] ?? this.defaultRisk;
+  }
+};
+var RISK_LEVELS = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+function isOperationalRisk(value) {
+  return typeof value === "string" && RISK_LEVELS.includes(value);
+}
+
+// src/authorization/ContextualAuthorizationEngine.ts
+var ContextualAuthorizationEngine = class {
+  constructor(policy, criticalOperations = /* @__PURE__ */ new Set()) {
+    this.criticalOperations = criticalOperations;
+    this.rbac = new RbacEngine(policy);
+  }
+  criticalOperations;
+  rbac;
+  async evaluate(context) {
+    if (!this.rbac.can(context.actor, context.operation)) {
+      return { decision: "DENY", reason: `Actor lacks permission for operation: ${context.operation}` };
+    }
+    const risk = context.riskLevel ?? "LOW";
+    if (risk === "CRITICAL" || this.criticalOperations.has(context.operation)) {
+      return { decision: "REQUIRES_CONFIRMATION", reason: `Operation requires confirmation due to risk level: ${risk}` };
+    }
+    return { decision: "ALLOW" };
+  }
+};
+
+// src/policy/PolicyEngine.ts
+var DECISION_PRIORITY = {
+  ALLOW: 0,
+  REQUIRES_CONFIRMATION: 1,
+  DENY: 2
+};
+var PolicyEngine = class {
+  constructor(provider) {
+    this.provider = provider;
+  }
+  provider;
+  evaluate(context) {
+    const violations = [];
+    let decision = "ALLOW";
+    let reason;
+    for (const rule of this.provider.rules()) {
+      const result = rule.evaluate(context);
+      if (result === null) continue;
+      if (DECISION_PRIORITY[result.decision] > DECISION_PRIORITY[decision]) {
+        decision = result.decision;
+        reason = result.reason;
+      }
+      if (result.decision === "DENY" || result.decision === "REQUIRES_CONFIRMATION") {
+        violations.push({
+          ruleId: rule.id,
+          reason: result.reason,
+          context,
+          occurredAt: /* @__PURE__ */ new Date()
+        });
+      }
+    }
+    return { decision, violations, reason };
+  }
+};
+
+// src/policy/InMemoryPolicyProvider.ts
+var InMemoryPolicyProvider = class {
+  _rules;
+  constructor(rules = []) {
+    this._rules = rules;
+  }
+  rules() {
+    return this._rules;
+  }
+};
+
+// src/confirmation/ConfirmationEngine.ts
+import { randomUUID as randomUUID5 } from "crypto";
+var ConfirmationEngine = class {
+  constructor(repository) {
+    this.repository = repository;
+  }
+  repository;
+  async request(input) {
+    const requiredApprovals = input.requiredApprovals ?? 1;
+    const request = {
+      id: randomUUID5(),
+      operation: input.operation,
+      actor: input.actor,
+      resource: input.resource,
+      status: requiredApprovals > 1 ? "AWAITING_CONFIRMATION" : "REQUESTED",
+      requiredApprovals,
+      approvals: [],
+      rejections: [],
+      requestedAt: /* @__PURE__ */ new Date(),
+      expiresAt: input.expiresAt,
+      metadata: input.metadata,
+      correlationId: input.correlationId
+    };
+    await this.repository.save(request);
+    return request;
+  }
+  async approve(requestId, approver, comment) {
+    const request = await this.findOrThrow(requestId);
+    this.assertActive(request);
+    const updated = {
+      ...request,
+      approvals: [...request.approvals, { approver, approvedAt: /* @__PURE__ */ new Date(), comment }]
+    };
+    const fullyApproved = updated.approvals.length >= updated.requiredApprovals;
+    updated.status = fullyApproved ? "APPROVED" : "AWAITING_CONFIRMATION";
+    await this.repository.save(updated);
+    return updated;
+  }
+  async reject(requestId, approver, comment) {
+    const request = await this.findOrThrow(requestId);
+    this.assertActive(request);
+    const updated = {
+      ...request,
+      status: "REJECTED",
+      rejections: [...request.rejections, { approver, approvedAt: /* @__PURE__ */ new Date(), comment }]
+    };
+    await this.repository.save(updated);
+    return updated;
+  }
+  async execute(requestId) {
+    const request = await this.findOrThrow(requestId);
+    if (request.status !== "APPROVED") {
+      throw new MaestroError(
+        "VALIDATION_ERROR" /* VALIDATION_ERROR */,
+        `Cannot execute confirmation request in status: ${request.status}`
+      );
+    }
+    const updated = {
+      ...request,
+      status: "EXECUTED",
+      executedAt: /* @__PURE__ */ new Date()
+    };
+    await this.repository.save(updated);
+    return updated;
+  }
+  async getPending() {
+    return this.repository.listPending();
+  }
+  async findOrThrow(requestId) {
+    const request = await this.repository.findById(requestId);
+    if (!request) {
+      throw new MaestroError(
+        "NOT_FOUND" /* NOT_FOUND */,
+        `Confirmation request not found: ${requestId}`
+      );
+    }
+    return request;
+  }
+  assertActive(request) {
+    const terminal = ["APPROVED", "REJECTED", "EXECUTED", "EXPIRED"];
+    if (terminal.includes(request.status)) {
+      throw new MaestroError(
+        "VALIDATION_ERROR" /* VALIDATION_ERROR */,
+        `Confirmation request is already in terminal status: ${request.status}`
+      );
+    }
+  }
+};
+
+// src/confirmation/InMemoryConfirmationRepository.ts
+var InMemoryConfirmationRepository = class {
+  store = /* @__PURE__ */ new Map();
+  async save(request) {
+    this.store.set(request.id, request);
+  }
+  async findById(id) {
+    return this.store.get(id);
+  }
+  async listPending() {
+    return Array.from(this.store.values()).filter(
+      (r) => r.status === "REQUESTED" || r.status === "AWAITING_CONFIRMATION"
+    );
+  }
+};
+
+// src/declarative/DeclarativeValidator.ts
+var SUPPORTED_FIELD_TYPES = [
+  "string",
+  "text",
+  "number",
+  "integer",
+  "decimal",
+  "currency",
+  "boolean",
+  "date",
+  "datetime",
+  "time",
+  "email",
+  "phone",
+  "url",
+  "document",
+  "uuid",
+  "enum",
+  "json",
+  "relation",
+  "array"
+];
+var SUPPORTED_OPERATIONAL_RISKS = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+var SUPPORTED_OPERATION_SCOPES = ["global", "entity", "record", "bulk"];
+function validateEntityDeclaration(input) {
+  const errors = [];
+  if (!input || typeof input !== "object") {
+    return { valid: false, errors: [{ path: "", message: "Entity declaration must be an object." }] };
+  }
+  const decl = input;
+  if (!decl["entity"] || typeof decl["entity"] !== "string" || decl["entity"].trim() === "") {
+    errors.push({ path: "entity", message: "Entity name is required." });
+  }
+  const fields = decl["fields"];
+  if (!fields || typeof fields !== "object" || Array.isArray(fields)) {
+    errors.push({ path: "fields", message: "Entity must declare at least one field." });
+  } else {
+    const fieldMap = fields;
+    if (Object.keys(fieldMap).length === 0) {
+      errors.push({ path: "fields", message: "Entity must declare at least one field." });
+    } else {
+      for (const [name, rawField] of Object.entries(fieldMap)) {
+        validateFieldDeclaration(name, rawField, errors);
+      }
+    }
+  }
+  const operations = decl["operations"];
+  if (operations !== void 0) {
+    if (typeof operations !== "object" || Array.isArray(operations)) {
+      errors.push({ path: "operations", message: "Operations must be an object." });
+    } else {
+      const opMap = operations;
+      for (const [id, rawOp] of Object.entries(opMap)) {
+        validateOperationDeclaration(id, rawOp, errors);
+      }
+    }
+  }
+  return { valid: errors.length === 0, errors };
+}
+function validateFieldDeclaration(name, rawField, errors) {
+  const prefix = `fields[${name}]`;
+  if (!rawField || typeof rawField !== "object") {
+    errors.push({ path: prefix, message: `Field '${name}' must be an object.` });
+    return;
+  }
+  const field = rawField;
+  if (!field.type) {
+    errors.push({ path: `${prefix}.type`, message: "Field type is required." });
+  } else if (!SUPPORTED_FIELD_TYPES.includes(field.type)) {
+    errors.push({
+      path: `${prefix}.type`,
+      message: `Field type '${field.type}' is not supported. Supported types: ${SUPPORTED_FIELD_TYPES.join(", ")}.`
+    });
+  }
+  if (field.sensitive === true && field.exportable === true) {
+    errors.push({
+      path: prefix,
+      message: `Field '${name}' cannot be both sensitive and exportable.`
+    });
+  }
+}
+function validateOperationDeclaration(id, rawOp, errors) {
+  const prefix = `operations[${id}]`;
+  if (!rawOp || typeof rawOp !== "object") {
+    errors.push({ path: prefix, message: `Operation '${id}' must be an object.` });
+    return;
+  }
+  const op = rawOp;
+  if (!op.label || typeof op.label !== "string" || op.label.trim() === "") {
+    errors.push({ path: `${prefix}.label`, message: "Operation label is required." });
+  }
+  if (op.risk !== void 0 && !SUPPORTED_OPERATIONAL_RISKS.includes(op.risk)) {
+    errors.push({
+      path: `${prefix}.risk`,
+      message: `Operation risk '${op.risk}' is not valid. Valid values: ${SUPPORTED_OPERATIONAL_RISKS.join(", ")}.`
+    });
+  }
+  if (op.scope !== void 0 && !SUPPORTED_OPERATION_SCOPES.includes(op.scope)) {
+    errors.push({
+      path: `${prefix}.scope`,
+      message: `Operation scope '${op.scope}' is not valid. Valid values: ${SUPPORTED_OPERATION_SCOPES.join(", ")}.`
+    });
+  }
+  if (op.confirmation !== void 0) {
+    const conf = op.confirmation;
+    if (conf.approvers !== void 0 && (typeof conf.approvers !== "number" || conf.approvers < 1)) {
+      errors.push({
+        path: `${prefix}.confirmation.approvers`,
+        message: "Confirmation approvers must be at least 1."
+      });
+    }
+  }
+}
+function validateConsumerDeclaration(input, entity) {
+  const errors = [];
+  if (!input || typeof input !== "object") {
+    return { valid: false, errors: [{ path: "", message: "Consumer declaration must be an object." }] };
+  }
+  const decl = input;
+  if (!decl["consumer"] || typeof decl["consumer"] !== "string" || decl["consumer"].trim() === "") {
+    errors.push({ path: "consumer", message: "Consumer name is required." });
+  }
+  if (!decl["entity"] || typeof decl["entity"] !== "string" || decl["entity"].trim() === "") {
+    errors.push({ path: "entity", message: "Entity name is required." });
+  }
+  if (entity) {
+    const knownFields = new Set(Object.keys(entity.fields));
+    const knownOps = new Set(Object.keys(entity.operations ?? {}));
+    const entityName = entity.entity;
+    validateFieldRefs("list.fields", decl["list"], knownFields, entityName, errors);
+    validateFieldRefs("detail.fields", decl["detail"], knownFields, entityName, errors);
+    const forms = decl["forms"];
+    if (forms && typeof forms === "object") {
+      validateFieldRefs("forms.create.fields", forms["create"], knownFields, entityName, errors);
+      validateFieldRefs("forms.update.fields", forms["update"], knownFields, entityName, errors);
+      validateFieldRefs("forms.clone.fields", forms["clone"], knownFields, entityName, errors);
+    }
+    const actions = decl["actions"];
+    if (actions && typeof actions === "object") {
+      validateOperationRefs("actions.row", actions["row"], knownOps, entityName, errors);
+      validateOperationRefs("actions.bulk", actions["bulk"], knownOps, entityName, errors);
+      validateOperationRefs("actions.global", actions["global"], knownOps, entityName, errors);
+    }
+  }
+  return { valid: errors.length === 0, errors };
+}
+function validateFieldRefs(path, container, knownFields, entityName, errors) {
+  if (!container || typeof container !== "object") return;
+  const obj = container;
+  const fields = obj["fields"];
+  if (!Array.isArray(fields)) return;
+  for (let i = 0; i < fields.length; i++) {
+    const name = fields[i];
+    if (!knownFields.has(name)) {
+      errors.push({
+        path: `${path}[${i}]`,
+        message: `Field '${name}' does not exist in entity '${entityName}'.`
+      });
+    }
+  }
+}
+function validateOperationRefs(path, refs, knownOps, entityName, errors) {
+  if (!Array.isArray(refs)) return;
+  for (let i = 0; i < refs.length; i++) {
+    const id = refs[i];
+    if (!knownOps.has(id)) {
+      errors.push({
+        path: `${path}[${i}]`,
+        message: `Operation '${id}' does not exist in entity '${entityName}'.`
+      });
+    }
+  }
+}
+
+// src/governance/GovernanceEventType.ts
+var GOVERNANCE_EVENT_TYPES = {
+  OPERATION_EXECUTED: "governance.operation.executed",
+  AUTHORIZATION_DENIED: "governance.authorization.denied",
+  POLICY_TRIGGERED: "governance.policy.triggered",
+  CONFIRMATION_REQUESTED: "governance.confirmation.requested",
+  CONFIRMATION_APPROVED: "governance.confirmation.approved",
+  CONFIRMATION_REJECTED: "governance.confirmation.rejected",
+  AUDIT_RECORDED: "governance.audit.recorded"
+};
+
+// src/governance/InMemoryGovernanceEventBus.ts
+import { randomUUID as randomUUID6 } from "crypto";
+var InMemoryGovernanceEventBus = class extends InMemoryEventBus {
+  async publishGovernance(type, payload, correlationId) {
+    const event = {
+      id: randomUUID6(),
+      type,
+      occurredAt: /* @__PURE__ */ new Date(),
+      payload,
+      correlationId
+    };
+    await this.publish(event);
+    return event;
+  }
+};
+
+// src/governance/DefaultGovernanceApi.ts
+var DefaultGovernanceApi = class {
+  constructor(auditRepository, confirmationRepository, violationLog = []) {
+    this.auditRepository = auditRepository;
+    this.confirmationRepository = confirmationRepository;
+    this.violationLog = violationLog;
+  }
+  auditRepository;
+  confirmationRepository;
+  violationLog;
+  async getAuditTimeline(filter) {
+    return this.auditRepository.list(filter);
+  }
+  async getCorrelationTrace(correlationId) {
+    return this.auditRepository.list({ correlationId });
+  }
+  async getPendingConfirmations() {
+    return this.confirmationRepository.listPending();
+  }
+  async getPolicyViolations(filter) {
+    let violations = [...this.violationLog];
+    if (filter?.ruleId !== void 0) {
+      violations = violations.filter((v) => v.ruleId === filter.ruleId);
+    }
+    if (filter?.correlationId !== void 0) {
+      violations = violations.filter((v) => v.context.correlationId === filter.correlationId);
+    }
+    if (filter?.from !== void 0) {
+      const from = filter.from;
+      violations = violations.filter((v) => v.occurredAt >= from);
+    }
+    if (filter?.to !== void 0) {
+      const to = filter.to;
+      violations = violations.filter((v) => v.occurredAt <= to);
+    }
+    return violations;
+  }
+};
 export {
   AuditRecorder,
+  ConfirmationEngine,
   ConsoleLogger,
+  ConsoleStructuredLogger,
+  ContextualAuthorizationEngine,
   CsvExportProvider,
   DEFAULT_CAPABILITIES,
   DatasourceRegistry,
+  DefaultGovernanceApi,
   DiffEngine,
   ErrorCode,
+  GOVERNANCE_EVENT_TYPES,
   InMemoryAuditRepository,
   InMemoryConfigProvider,
+  InMemoryConfirmationRepository,
   InMemoryDatasourceProvider,
   InMemoryEventBus,
   InMemoryFeatureFlagProvider,
+  InMemoryGovernanceEventBus,
+  InMemoryPolicyProvider,
   InMemorySnapshotRepository,
   IntrospectionRuntime,
   MaestroEngine,
   MaestroError,
   MetadataEngine,
+  MetadataRiskClassifier,
   OperationRegistry,
+  PolicyEngine,
   RbacEngine,
   ReportGenerator,
   createMaestro,
@@ -2329,6 +2832,7 @@ export {
   createMaestroHttpHandlers,
   detectDisplayField,
   generateAllConfigs,
+  generateCorrelationId,
   generateEntityConfig,
   generateRelationConfig,
   humanizeFieldName,
@@ -2341,6 +2845,8 @@ export {
   parseQueryInput,
   tableNameToEntityId,
   tableNameToLabel,
+  validateConsumerDeclaration,
+  validateEntityDeclaration,
   validateMaestroConfig
 };
 //# sourceMappingURL=index.js.map