@nuvlore/extension-bds 0.1.1 → 0.1.2

package/vendor/extension-workday-infra-access/tools/aws_cust_federated_readonly_command_pack.mjs

@@ -1,234 +0,0 @@
-export const description = "Create a local-only AWS CUST federated access read-only CLI command pack based on the approved CCOE guide; does not authenticate, read credentials, or call AWS APIs.";
-
-import { z } from "zod";
-import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
-
-const AWS_FEDERATED_ACCESS_GUIDE_URL = "https://confluence.workday.com/display/CCOE/AWS+-+Federated+Access+to+CUST+Accounts+-+User+Guide";
-const DEFAULT_REGION = "us-west-2";
-const READ_ONLY_SERVICES = new Set([
-  "account",
-  "cloudformation",
-  "cloudtrail",
-  "cloudwatch",
-  "ec2",
-  "eks",
-  "elb",
-  "iam",
-  "kms",
-  "lambda",
-  "logs",
-  "rds",
-  "route53",
-  "s3",
-  "s3api",
-  "secretsmanager",
-  "sts"
-]);
-
-function normalizeText(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-function shellQuote(value) {
-  return `'${String(value).replaceAll("'", "'\\''")}'`;
-}
-
-function normalizeService(value) {
-  const service = normalizeText(value || "sts").toLowerCase();
-  if (!READ_ONLY_SERVICES.has(service)) {
-    throw new Error(`Unsupported AWS read-only service: ${service}. Supported services: ${[...READ_ONLY_SERVICES].sort().join(", ")}.`);
-  }
-  return service;
-}
-
-function normalizeInput(input = {}) {
-  return {
-    accountId: normalizeText(input.accountId),
-    accountAlias: normalizeText(input.accountAlias),
-    roleName: normalizeText(input.roleName),
-    profile: normalizeText(input.profile),
-    region: normalizeText(input.region) || DEFAULT_REGION,
-    service: normalizeService(input.service),
-    resource: normalizeText(input.resource),
-    guideUrl: normalizeText(input.guideUrl) || AWS_FEDERATED_ACCESS_GUIDE_URL
-  };
-}
-
-function baseAws(input) {
-  const profile = input.profile ? ` --profile ${shellQuote(input.profile)}` : "";
-  const region = input.region ? ` --region ${shellQuote(input.region)}` : "";
-  return `aws${profile}${region}`;
-}
-
-function serviceCommands(input) {
-  const aws = baseAws(input);
-  const resource = input.resource;
-  switch (input.service) {
-    case "account":
-      return [
-        `${aws} account get-contact-information`,
-        `${aws} account get-alternate-contact --alternate-contact-type OPERATIONS`,
-        `${aws} account get-region-opt-status --region-name ${shellQuote(input.region)}`
-      ];
-    case "cloudformation":
-      return [
-        `${aws} cloudformation list-stacks --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE UPDATE_ROLLBACK_COMPLETE ROLLBACK_COMPLETE`,
-        resource ? `${aws} cloudformation describe-stacks --stack-name ${shellQuote(resource)}` : `${aws} cloudformation describe-stacks`
-      ];
-    case "cloudtrail":
-      return [
-        `${aws} cloudtrail describe-trails`,
-        `${aws} cloudtrail get-trail-status --name ${shellQuote(resource || "trail-name")}`
-      ];
-    case "cloudwatch":
-      return [
-        `${aws} cloudwatch describe-alarms`,
-        `${aws} cloudwatch list-metrics`
-      ];
-    case "ec2":
-      return [
-        `${aws} ec2 describe-instances`,
-        `${aws} ec2 describe-security-groups`,
-        `${aws} ec2 describe-subnets`,
-        `${aws} ec2 describe-vpcs`
-      ];
-    case "eks":
-      return [
-        `${aws} eks list-clusters`,
-        resource ? `${aws} eks describe-cluster --name ${shellQuote(resource)}` : `${aws} eks describe-cluster --name ${shellQuote("cluster-name")}`
-      ];
-    case "elb":
-      return [
-        `${aws} elbv2 describe-load-balancers`,
-        `${aws} elbv2 describe-target-groups`
-      ];
-    case "iam":
-      return [
-        `${aws} iam get-account-summary`,
-        `${aws} iam list-roles`,
-        resource ? `${aws} iam get-role --role-name ${shellQuote(resource)}` : `${aws} iam list-policies --scope Local`
-      ];
-    case "kms":
-      return [
-        `${aws} kms list-keys`,
-        resource ? `${aws} kms describe-key --key-id ${shellQuote(resource)}` : `${aws} kms list-aliases`
-      ];
-    case "lambda":
-      return [
-        `${aws} lambda list-functions`,
-        resource ? `${aws} lambda get-function-configuration --function-name ${shellQuote(resource)}` : `${aws} lambda list-event-source-mappings`
-      ];
-    case "logs":
-      return [
-        `${aws} logs describe-log-groups`,
-        resource ? `${aws} logs describe-log-streams --log-group-name ${shellQuote(resource)} --max-items 25` : `${aws} logs describe-log-groups --max-items 50`
-      ];
-    case "rds":
-      return [
-        `${aws} rds describe-db-instances`,
-        `${aws} rds describe-db-clusters`
-      ];
-    case "route53":
-      return [
-        `${aws} route53 list-hosted-zones`,
-        resource ? `${aws} route53 list-resource-record-sets --hosted-zone-id ${shellQuote(resource)}` : `${aws} route53 list-health-checks`
-      ];
-    case "s3":
-      return [
-        `${aws} s3 ls${resource ? ` ${shellQuote(resource)}` : ""}`,
-        `${aws} s3 ls${resource ? ` ${shellQuote(resource)}` : " s3://<bucket>"} --recursive --summarize --human-readable`
-      ];
-    case "s3api":
-      return [
-        resource ? `${aws} s3api get-bucket-location --bucket ${shellQuote(resource)}` : `${aws} s3api list-buckets`,
-        resource ? `${aws} s3api get-bucket-encryption --bucket ${shellQuote(resource)}` : `${aws} s3api list-buckets`
-      ];
-    case "secretsmanager":
-      return [
-        `${aws} secretsmanager list-secrets`,
-        resource ? `${aws} secretsmanager describe-secret --secret-id ${shellQuote(resource)}` : `${aws} secretsmanager list-secrets --max-results 50`
-      ];
-    case "sts":
-    default:
-      return [
-        `${aws} sts get-caller-identity`
-      ];
-  }
-}
-
-function awsCustFederatedReadonlyPlan(input) {
-  const normalized = normalizeInput(input);
-  return JSON.stringify({
-    mode: "atomic-helper",
-    platform: "aws",
-    accessPattern: "cust-federated-readonly",
-    sourceGuide: {
-      title: "AWS - Federated Access to CUST Accounts - User Guide",
-      url: normalized.guideUrl,
-      status: "referenced; not executed by this tool"
-    },
-    target: {
-      accountId: normalized.accountId,
-      accountAlias: normalized.accountAlias,
-      roleName: normalized.roleName,
-      profile: normalized.profile,
-      region: normalized.region,
-      service: normalized.service,
-      resource: normalized.resource
-    },
-    credentialBoundary: [
-      "Complete AWS CUST federated access outside this tool using the approved CCOE guide.",
-      "This tool never opens a browser login, never stores SAML/OIDC tokens, and never reads AWS credential files.",
-      "After federation, use an explicit AWS_PROFILE or exported session supplied by the operator."
-    ],
-    commands: {
-      identity: `${baseAws(normalized)} sts get-caller-identity`,
-      serviceReads: serviceCommands(normalized)
-    },
-    forbiddenActions: [
-      "aws s3 cp",
-      "aws s3 mv",
-      "aws s3 rm",
-      "aws s3 sync",
-      "aws s3api put-object",
-      "aws s3api delete-object",
-      "aws ec2 start-instances",
-      "aws ec2 stop-instances",
-      "aws eks update-*",
-      "aws iam create-*",
-      "aws iam put-*",
-      "aws secretsmanager get-secret-value"
-    ],
-    remoteWrite: "not_executed"
-  }, null, 2);
-}
-
-export default defineReadOnlyTool({
-  name: "aws_cust_federated_readonly_command_pack",
-  description: "Create a local-only AWS CUST federated access read-only CLI command pack based on the approved CCOE guide; does not authenticate, read credentials, or call AWS APIs.",
-  inputSchema: {
-    accountId: z.string().trim().max(64).default(""),
-    accountAlias: z.string().trim().max(256).default(""),
-    roleName: z.string().trim().max(256).default(""),
-    profile: z.string().trim().max(256).default(""),
-    region: z.string().trim().max(64).default(DEFAULT_REGION),
-    service: z.string().trim().max(64).default("sts"),
-    resource: z.string().trim().max(2048).default(""),
-    guideUrl: z.string().trim().url().max(2048).default(AWS_FEDERATED_ACCESS_GUIDE_URL)
-  },
-  async handler(input) {
-    try {
-      return ok(awsCustFederatedReadonlyPlan(input));
-    } catch (error) {
-      return fail(error);
-    }
-  }
-});
-
-export const __test = {
-  AWS_FEDERATED_ACCESS_GUIDE_URL,
-  READ_ONLY_SERVICES,
-  normalizeInput,
-  serviceCommands,
-  awsCustFederatedReadonlyPlan
-};

package/vendor/extension-workday-infra-access/tools/gcp_readonly_command_pack.mjs

@@ -1,167 +0,0 @@
-export const description = "Create a local-only GCP read-only CLI command pack; does not authenticate, read credentials, or call GCP APIs.";
-
-import { z } from "zod";
-import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
-
-const DEFAULT_REGION = "us-west1";
-const READ_ONLY_SERVICES = new Set([
-  "billing",
-  "compute",
-  "gke",
-  "iam",
-  "logging",
-  "monitoring",
-  "projects",
-  "storage"
-]);
-
-function normalizeText(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-function shellQuote(value) {
-  return `'${String(value).replaceAll("'", "'\\''")}'`;
-}
-
-function normalizeService(value) {
-  const service = normalizeText(value || "projects").toLowerCase();
-  if (!READ_ONLY_SERVICES.has(service)) {
-    throw new Error(`Unsupported GCP read-only service: ${service}. Supported services: ${[...READ_ONLY_SERVICES].sort().join(", ")}.`);
-  }
-  return service;
-}
-
-function normalizeInput(input = {}) {
-  return {
-    projectId: normalizeText(input.projectId),
-    account: normalizeText(input.account),
-    region: normalizeText(input.region) || DEFAULT_REGION,
-    zone: normalizeText(input.zone),
-    service: normalizeService(input.service),
-    resource: normalizeText(input.resource)
-  };
-}
-
-function baseGcloud(input) {
-  const project = input.projectId ? ` --project=${shellQuote(input.projectId)}` : "";
-  const account = input.account ? ` --account=${shellQuote(input.account)}` : "";
-  return `gcloud${project}${account}`;
-}
-
-function serviceCommands(input) {
-  const gcloud = baseGcloud(input);
-  const resource = input.resource;
-  switch (input.service) {
-    case "billing":
-      return [
-        `${gcloud} billing projects describe ${shellQuote(input.projectId || "PROJECT_ID")}`
-      ];
-    case "compute":
-      return [
-        `${gcloud} compute instances list`,
-        resource ? `${gcloud} compute instances describe ${shellQuote(resource)}${input.zone ? ` --zone=${shellQuote(input.zone)}` : ""}` : `${gcloud} compute networks list`,
-        `${gcloud} compute firewall-rules list`
-      ];
-    case "gke":
-      return [
-        `${gcloud} container clusters list`,
-        resource ? `${gcloud} container clusters describe ${shellQuote(resource)}${input.region ? ` --region=${shellQuote(input.region)}` : ""}` : `${gcloud} container clusters list`
-      ];
-    case "iam":
-      return [
-        `${gcloud} projects get-iam-policy ${shellQuote(input.projectId || "PROJECT_ID")}`,
-        `${gcloud} iam service-accounts list`
-      ];
-    case "logging":
-      return [
-        `${gcloud} logging sinks list`,
-        `${gcloud} logging read ${shellQuote(resource || "timestamp >= \"$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ)\"")} --limit=50`
-      ];
-    case "monitoring":
-      return [
-        `${gcloud} monitoring policies list`,
-        `${gcloud} monitoring uptime list-configs`
-      ];
-    case "storage":
-      return [
-        `gcloud storage buckets list${input.projectId ? ` --project=${shellQuote(input.projectId)}` : ""}`,
-        resource ? `gcloud storage objects list ${shellQuote(resource)}` : "gcloud storage objects list gs://<bucket>"
-      ];
-    case "projects":
-    default:
-      return [
-        `${gcloud} auth list`,
-        `${gcloud} config list`,
-        `${gcloud} projects describe ${shellQuote(input.projectId || "PROJECT_ID")}`
-      ];
-  }
-}
-
-function gcpReadonlyAccessPlan(input) {
-  const normalized = normalizeInput(input);
-  return JSON.stringify({
-    mode: "atomic-helper",
-    platform: "gcp",
-    accessPattern: "readonly-cli",
-    target: {
-      projectId: normalized.projectId,
-      account: normalized.account,
-      region: normalized.region,
-      zone: normalized.zone,
-      service: normalized.service,
-      resource: normalized.resource
-    },
-    credentialBoundary: [
-      "Use an already-approved local gcloud identity; this tool does not run gcloud auth login or read credential files.",
-      "Run auth list/config list first and verify the active account and project match incident evidence.",
-      "Do not change active config, impersonation, IAM policy, project settings, buckets, clusters, instances, or logs."
-    ],
-    commands: {
-      identity: [
-        `${baseGcloud(normalized)} auth list`,
-        `${baseGcloud(normalized)} config list`
-      ],
-      serviceReads: serviceCommands(normalized)
-    },
-    forbiddenActions: [
-      "gcloud auth login",
-      "gcloud config set",
-      "gcloud projects set-iam-policy",
-      "gcloud iam service-accounts keys create",
-      "gcloud compute instances start",
-      "gcloud compute instances stop",
-      "gcloud container clusters update",
-      "gcloud storage cp",
-      "gcloud storage rm",
-      "gcloud storage mv"
-    ],
-    remoteWrite: "not_executed"
-  }, null, 2);
-}
-
-export default defineReadOnlyTool({
-  name: "gcp_readonly_command_pack",
-  description: "Create a local-only GCP read-only CLI command pack; does not authenticate, read credentials, or call GCP APIs.",
-  inputSchema: {
-    projectId: z.string().trim().max(256).default(""),
-    account: z.string().trim().max(256).default(""),
-    region: z.string().trim().max(64).default(DEFAULT_REGION),
-    zone: z.string().trim().max(64).default(""),
-    service: z.string().trim().max(64).default("projects"),
-    resource: z.string().trim().max(2048).default("")
-  },
-  async handler(input) {
-    try {
-      return ok(gcpReadonlyAccessPlan(input));
-    } catch (error) {
-      return fail(error);
-    }
-  }
-});
-
-export const __test = {
-  READ_ONLY_SERVICES,
-  normalizeInput,
-  serviceCommands,
-  gcpReadonlyAccessPlan
-};

package/vendor/extension-workday-infra-access/tools/public_cloud_access_status.mjs

@@ -1,48 +0,0 @@
-export const description = "Return local public-cloud connection readiness status; does not authenticate or call cloud APIs.";
-
-import { z } from "zod";
-import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
-
-function normalizeText(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-export class PublicCloudConnectPlanService {
-  invoke(input) {
-    const platform = normalizeText(input.platform) || "unknown";
-    return JSON.stringify({
-      mode: "atomic-helper",
-      platform,
-      environment: normalizeText(input.environment),
-      target: normalizeText(input.target),
-      status: "connection_procedure_lives_in_skill",
-      nextAtomicTool: platform === "aws" ? "aws_cust_federated_readonly_command_pack" : platform === "gcp" ? "gcp_readonly_command_pack" : "",
-      remoteWrite: "not_executed"
-    }, null, 2);
-  }
-}
-
-const defaultService = new PublicCloudConnectPlanService();
-
-function publicCloudConnectPlan(input) {
-  return defaultService.invoke(input);
-}
-
-export default defineReadOnlyTool({
-  name: "public_cloud_access_status",
-  description: "Return local public-cloud connection readiness status; does not authenticate or call cloud APIs.",
-  inputSchema: {
-    platform: z.string().trim().max(128).default(""),
-    environment: z.string().trim().max(256).default(""),
-    target: z.string().trim().max(1024).default("")
-  },
-  async handler(input) {
-    try {
-      return ok(publicCloudConnectPlan(input));
-    } catch (error) {
-      return fail(error);
-    }
-  }
-});
-
-export const __test = { PublicCloudConnectPlanService, publicCloudConnectPlan };