infraweaver 0.1.0

package/src/mcp/frameworks.ts

@@ -0,0 +1,236 @@
+/**
+ * The unified framework registry (§5.14 step 1).
+ *
+ * One `FrameworkDef` per compliance framework the crosswalk references, shared
+ * by the engine's indicative crosswalk (`crosswalk.ts`) and — by hand-sync,
+ * exactly like the report wire schema — the Cloud pack
+ * (infraweaver-ui `src/features/crosswalk/pack.ts`). Before this registry the
+ * engine used free-text framework names and the Cloud pack used slug ids: two
+ * hand-synced naming systems with nothing enforcing either.
+ *
+ * The `licence` field makes the free-only constraint MACHINE-ENFORCED: we build
+ * only on frameworks whose text is free to access and lawful to use
+ * commercially (we pay for nothing), and for paywalled/no-derivative texts we
+ * ship control IDS + short editorial titles only, never framework text — the
+ * lawful lane NIST OLIR itself uses for its ISO mappings. `crosswalk.test.ts`
+ * fails any crosswalk entry that embeds text against an `ids-only` licence.
+ */
+
+/** What we may lawfully ship for a framework, commercially, at zero cost. */
+export type FrameworkLicence =
+  /** US-government work / CC0 (e.g. NIST OSCAL) — full control text embeddable. */
+  | "public-domain"
+  /** OGL v3 / EUR-Lex (Decision 2011/833/EU) — reproducible with attribution. */
+  | "open-government"
+  /** CC BY 4.0 — reproducible with attribution. */
+  | "cc-by-4.0"
+  /** Paywalled or no-derivatives text (ISO, CIS, AICPA) — control ids + short
+   *  editorial titles ONLY; never reproduce the framework's own text. */
+  | "ids-only";
+
+/** Whether a framework ships free in the OSS engine (`starter`) or is part of the
+ *  maintained subscription pack (`maintained`). NOTE this is the ENGINE view: the
+ *  Cloud `STARTER_FRAMEWORK_IDS` gate is narrower (Cyber Essentials only) because
+ *  most `starter` frameworks here exist solely as the engine`s indicative
+ *  narration and have no Cloud pack rows to gate. */
+export type FrameworkTier = "starter" | "maintained";
+
+export interface FrameworkDef {
+  /** Stable slug id — the Cloud pack / API join key. */
+  id: string;
+  /** Display name — the value the engine's `ControlRef.framework` carries. */
+  name: string;
+  /** Publishing authority, e.g. "NIST", "NCSC". */
+  authority: string;
+  /** Where the framework applies, e.g. "UK", "EU", "US", "International". */
+  jurisdiction: string;
+  /** The pinned upstream revision this crosswalk layer was authored against. */
+  revision: string;
+  /** ISO date this REGISTRY ENTRY (name/revision/licence classification) was
+   *  last reviewed. Mapping-layer review dates live with each layer (the engine
+   *  `CROSSWALK_REVIEWED`, the Cloud pack's per-framework `reviewed`) and
+   *  version independently (§5.14 step 5). */
+  reviewed: string;
+  licence: FrameworkLicence;
+  tier: FrameworkTier;
+  /** Mapped through the themes → NIST 800-53 hub (`THEME_TO_NIST`) rather than
+   *  hand-themed directly — the §5.14 "one mechanical, auditable hop" path. */
+  hubAnchored: boolean;
+}
+
+/** True when the licence permits embedding the framework's own control text. */
+export function canEmbedControlText(licence: FrameworkLicence): boolean {
+  return licence !== "ids-only";
+}
+
+/**
+ * Every framework the crosswalk references. Ordered starter-first, then the
+ * NIST hub, then the remaining maintained layers.
+ *
+ * NB the slug for NCSC Cloud Security Principles is the legacy `ncsc-caf` —
+ * the Cloud pack and persisted `framework_reporting` rows already use it, so a
+ * rename is a data migration. The real CAF therefore ships as `ncsc-caf-v4`
+ * (B.2); when the legacy slug is eventually migrated, THAT is the moment to
+ * consider collapsing the version suffix — not before, because two frameworks
+ * would briefly answer to the same key.
+ */
+export const FRAMEWORKS: readonly FrameworkDef[] = [
+  {
+    id: "cyber-essentials",
+    name: "Cyber Essentials",
+    authority: "NCSC",
+    jurisdiction: "UK",
+    revision: "v3.1 (Montpellier)",
+    reviewed: "2026-07-24",
+    licence: "open-government",
+    tier: "starter",
+    hubAnchored: false,
+  },
+  {
+    id: "nist-800-53",
+    name: "NIST SP 800-53",
+    authority: "NIST",
+    jurisdiction: "International",
+    revision: "rev 5 (5.2.0)",
+    reviewed: "2026-07-24",
+    licence: "public-domain",
+    tier: "maintained",
+    hubAnchored: true,
+  },
+  {
+    id: "nist-csf-2.0",
+    name: "NIST CSF 2.0",
+    authority: "NIST",
+    jurisdiction: "International",
+    revision: "2.0 (Feb 2024)",
+    reviewed: "2026-07-24",
+    licence: "public-domain",
+    tier: "maintained",
+    hubAnchored: true,
+  },
+  {
+    // §5.15. The RTS that gives DORA (Reg. (EU) 2022/2554) Art. 9 "Protection and
+    // prevention" + Art. 10 "Detection" their concrete technical form. Cited as
+    // the RTS throughout — RTS article numbers do NOT track DORA Level-1 ones.
+    id: "dora-rts-2024-1774",
+    name: "DORA RTS (EU) 2024/1774",
+    authority: "European Commission",
+    jurisdiction: "EU",
+    // `revision` is the INSTRUMENT's authored scope — the articles the crosswalk
+    // was mapped against — not the subset this engine happens to emit. The engine
+    // emits Arts. 6-14, 20-21; the pack additionally authors 18-19, 22 and 25 as
+    // org-band honesty rows. Stating the emitted subset here made the same
+    // auditor-facing provenance field read differently on the two sides, so it
+    // now mirrors infraweaver-ui/src/features/crosswalk/pack.ts verbatim. The
+    // hand-synced revision strings are pinned by that repo's crosswalk-pack test.
+    revision: "Delegated Reg. (EU) 2024/1774, Arts. 6-14, 18-22, 25",
+    reviewed: "2026-07-25",
+    // EUR-Lex text is reusable commercially under Commission Decision 2011/833/EU.
+    licence: "open-government",
+    tier: "maintained",
+    hubAnchored: true,
+  },
+  {
+    // B.2. The ACTUAL Cyber Assessment Framework — distinct from the entry
+    // below, whose legacy `ncsc-caf` slug names the Cloud Security Principles.
+    // Until this layer existed, nothing in the product could lawfully be
+    // described as "CAF"; five surfaces once did and were corrected 2026-07-25.
+    id: "ncsc-caf-v4",
+    name: "NCSC Cyber Assessment Framework",
+    authority: "NCSC",
+    jurisdiction: "UK",
+    revision: "v4.0 (2025)",
+    reviewed: "2026-07-26",
+    // Crown copyright, Open Government Licence v3.0.
+    licence: "open-government",
+    tier: "maintained",
+    hubAnchored: true,
+  },
+  {
+    id: "ncsc-caf",
+    name: "NCSC Cloud Security Principles",
+    authority: "NCSC",
+    jurisdiction: "UK",
+    revision: "14 principles",
+    reviewed: "2026-07-24",
+    licence: "open-government",
+    tier: "maintained",
+    hubAnchored: false,
+  },
+  {
+    id: "iso-27001",
+    name: "ISO/IEC 27001",
+    authority: "ISO",
+    jurisdiction: "International",
+    revision: "2022 (Annex A)",
+    reviewed: "2026-07-24",
+    licence: "ids-only",
+    tier: "maintained",
+    hubAnchored: false,
+  },
+  {
+    id: "cis-controls-v8",
+    name: "CIS Controls v8",
+    authority: "CIS",
+    jurisdiction: "International",
+    revision: "v8",
+    reviewed: "2026-07-24",
+    licence: "ids-only",
+    tier: "starter",
+    hubAnchored: false,
+  },
+  {
+    id: "nhs-dspt",
+    name: "NHS DSPT",
+    authority: "NHS England",
+    jurisdiction: "UK",
+    revision: "2024-25 standards",
+    reviewed: "2026-07-24",
+    licence: "open-government",
+    tier: "starter",
+    hubAnchored: false,
+  },
+  {
+    id: "secure-by-design",
+    name: "Secure by Design",
+    authority: "UK Government (GDS)",
+    jurisdiction: "UK",
+    revision: "10 principles",
+    reviewed: "2026-07-24",
+    licence: "open-government",
+    tier: "starter",
+    hubAnchored: false,
+  },
+  {
+    id: "gds-service-standard",
+    name: "GDS Service Standard",
+    authority: "UK Government (GDS)",
+    jurisdiction: "UK",
+    revision: "14 points",
+    reviewed: "2026-07-24",
+    licence: "open-government",
+    tier: "starter",
+    hubAnchored: false,
+  },
+  {
+    id: "soc-2",
+    name: "SOC 2",
+    authority: "AICPA",
+    jurisdiction: "International",
+    revision: "2017 TSC (2022 points of focus)",
+    reviewed: "2026-07-24",
+    licence: "ids-only",
+    tier: "starter",
+    hubAnchored: false,
+  },
+];
+
+/** Look up a framework by its display name (the engine `ControlRef.framework`). */
+export function frameworkByName(name: string): FrameworkDef | undefined {
+  return FRAMEWORKS.find((f) => f.name === name);
+}
+
+/** Look up a framework by its slug id (the Cloud pack / API join key). */
+export function frameworkById(id: string): FrameworkDef | undefined {
+  return FRAMEWORKS.find((f) => f.id === id);
+}

package/src/mcp/geminiSanitizer.ts

@@ -0,0 +1,212 @@
+import type { StandardSchemaV1 } from "@standard-schema/spec";
+import type { Tool } from "fastmcp";
+import type { ToolContext } from "#app/mcp/server";
+
+// ── gemini schema sanitizer ────────────────────────────────────────────────────
+//
+// gemini's generateContent API expects an OpenAPI 3.0 Schema subset, not full
+// JSON Schema. arktype 2.x emits constructs that gemini rejects with errors like:
+//   - "parameters.<field>.enum: only allowed for STRING type"
+//   - "functionDeclaration parameters.<field> schema didn't specify the schema type field"
+//   - "anyOf must be the only field in a schema node"
+//
+// transforms applied here:
+//   1. add `type: "string"` to enum-only schemas. arktype emits string literal
+//      unions as `{enum: ["a","b"]}` without a `type` field — gemini requires
+//      the type declaration for any non-object schema.
+//   2. collapse `{anyOf: [{enum:["a"]}, {enum:["b"]}]}` (older arktype form)
+//      into `{type:"string", enum:[...]}`. also handles `{const:"a"}` branches.
+//   3. when `anyOf` / `oneOf` can't be collapsed, strip sibling fields (`type`,
+//      `description`, `items`, etc.) — gemini rejects `anyOf` alongside any
+//      peer keywords. see opencode #14659.
+//   4. drop `$schema` metadata and rename `$defs` → `definitions` (draft-07
+//      compatibility; gemini doesn't understand either).
+//
+// gating: `isGeminiRouted()` detects gemini-targeted traffic so other
+// providers continue to see the original (untransformed) schema.
+//
+// delivery: fastmcp (3.x) uses `xsschema.toJsonSchema()` which reads
+// `schema["~standard"].jsonSchema.input({target:"draft-07"})` when present
+// (arktype 2.x exposes this). we proxy the whole `~standard` chain so our
+// transform runs regardless of which path xsschema takes.
+
+function parseStringEnumBranch(item: unknown): { values: string[] } | null {
+  if (!item || typeof item !== "object") return null;
+  const record = item as Record<string, unknown>;
+  if (Array.isArray(record.enum)) {
+    const strings = record.enum.filter((v): v is string => typeof v === "string");
+    return strings.length === record.enum.length && strings.length > 0 ? { values: strings } : null;
+  }
+  if (typeof record.const === "string") {
+    return { values: [record.const] };
+  }
+  return null;
+}
+
+function collapseStringUnion(branches: unknown[]): { type: "string"; enum: string[] } | null {
+  const values: string[] = [];
+  for (const item of branches) {
+    const parsed = parseStringEnumBranch(item);
+    if (!parsed) return null;
+    values.push(...parsed.values);
+  }
+  if (values.length === 0) return null;
+  return { type: "string", enum: [...new Set(values)] };
+}
+
+/**
+ * Recursively transform a JSON schema to gemini's stricter subset.
+ * See module header for the exact transforms applied.
+ */
+export function sanitizeForGemini(schema: unknown): unknown {
+  if (!schema || typeof schema !== "object") return schema;
+  if (Array.isArray(schema)) return schema.map(sanitizeForGemini);
+
+  const source = schema as Record<string, unknown>;
+
+  // case 1: enum-only string union → add `type: "string"`.
+  // arktype emits `type: "'A' | 'B'"` as `{enum: ["A","B"]}` without a type.
+  if (Array.isArray(source.enum) && typeof source.type !== "string") {
+    const allStrings = source.enum.every((v) => typeof v === "string");
+    if (allStrings) {
+      const result: Record<string, unknown> = { type: "string", enum: source.enum };
+      if (typeof source.description === "string") result.description = source.description;
+      return result;
+    }
+  }
+
+  // case 2: collapsible string-enum union (older arktype form)
+  for (const unionKey of ["anyOf", "oneOf"] as const) {
+    const branches = source[unionKey];
+    if (Array.isArray(branches) && branches.length > 0) {
+      const collapsed = collapseStringUnion(branches);
+      if (collapsed) {
+        const result: Record<string, unknown> = { ...collapsed };
+        if (typeof source.description === "string") result.description = source.description;
+        return result;
+      }
+    }
+  }
+
+  // case 3: non-collapsible anyOf/oneOf → strip sibling fields (gemini rule)
+  if (Array.isArray(source.anyOf) || Array.isArray(source.oneOf)) {
+    const result: Record<string, unknown> = {};
+    if (Array.isArray(source.anyOf)) result.anyOf = source.anyOf.map(sanitizeForGemini);
+    if (Array.isArray(source.oneOf)) result.oneOf = source.oneOf.map(sanitizeForGemini);
+    return result;
+  }
+
+  // case 4: generic pass — drop $schema, rename $defs, recurse
+  const sanitized: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (key === "$schema") continue;
+    if (key === "$defs") {
+      sanitized.definitions = sanitizeForGemini(value);
+      continue;
+    }
+    sanitized[key] = sanitizeForGemini(value);
+  }
+  return sanitized;
+}
+
+// ── delivery mechanism ─────────────────────────────────────────────────────────
+//
+// fastmcp 3.x resolves the JSON schema via xsschema, which takes two paths:
+//   path A: `schema["~standard"].jsonSchema.input({target:"draft-07"})` when
+//           the StandardJSONSchemaV1 extension is present (arktype 2.x).
+//   path B: `schema.toJsonSchema()` via a vendor-dispatched function (older
+//           arktype, other vendors).
+//
+// we proxy both entry points so the transform runs regardless of which path
+// xsschema picks.
+
+function wrapJsonSchemaProducer<T extends object>(producer: T): T {
+  return new Proxy(producer, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if ((prop === "input" || prop === "output") && typeof value === "function") {
+        const fn = value as (...args: unknown[]) => unknown;
+        return (...args: unknown[]) => sanitizeForGemini(fn.apply(target, args));
+      }
+      return value;
+    },
+  });
+}
+
+function wrapStandard<T extends object>(standard: T): T {
+  return new Proxy(standard, {
+    get(target, prop, receiver) {
+      if (prop === "jsonSchema") {
+        const value = Reflect.get(target, prop, receiver);
+        if (value && typeof value === "object") {
+          return wrapJsonSchemaProducer(value as object);
+        }
+        return value;
+      }
+      return Reflect.get(target, prop, receiver);
+    },
+  });
+}
+
+// thread the schema's own type `S` through instead of collapsing to
+// `StandardSchemaV1<any>`, so callers keep their exact schema type. The Proxy is a
+// transparent sanitizer — it only rewrites the JSON schema emitted for Gemini, leaving
+// the value's shape identical — so the single `as S` cast just re-asserts that shape
+// across the Proxy boundary (TS types `new Proxy` loosely through the handler).
+export function wrapSchemaForGemini<S extends StandardSchemaV1<any>>(schema: S): S {
+  return new Proxy(schema, {
+    get(target, prop, receiver) {
+      if (prop === "~standard") {
+        const value = Reflect.get(target, prop, receiver);
+        if (value && typeof value === "object") {
+          return wrapStandard(value as object);
+        }
+        return value;
+      }
+      if (prop === "toJsonSchema") {
+        const method = Reflect.get(target, prop, receiver);
+        if (typeof method === "function") {
+          return () => sanitizeForGemini((method as (...args: unknown[]) => unknown).call(target));
+        }
+        return method;
+      }
+      return Reflect.get(target, prop, receiver);
+    },
+  }) as S;
+}
+
+export function sanitizeToolForGemini<T extends Tool<any, any>>(tool: T): T {
+  if (!tool.parameters) return tool;
+  return { ...tool, parameters: wrapSchemaForGemini(tool.parameters) } as T;
+}
+
+/**
+ * true when the effective upstream model is — or might become — google
+ * generative language API traffic. matches:
+ *   - direct `google/*`, opencode `opencode/gemini-*`, openrouter
+ *     `openrouter/google/gemini-*` (slug substring "gemini" wins).
+ *   - any unresolved specifier: `undefined`, `"auto"`, or a slug that
+ *     didn't map through the alias registry (no `provider/` prefix).
+ *     these flow through the agent's own auto-select, which may land
+ *     on gemini *after* the MCP server has already registered tools —
+ *     at which point sanitization is too late to apply. erring on the
+ *     side of sanitizing is safe: cases 1 + 2 are universally
+ *     compatible JSON-Schema normalizations (enum-only → typed string,
+ *     collapsible const-unions → string enum); case 3 is gemini-
+ *     specific but only fires on non-collapsible unions, which arktype
+ *     does not emit for our current tool schemas. see issue #676 for
+ *     the prod failure that motivated this widening.
+ */
+export function isGeminiRouted(ctx: ToolContext): boolean {
+  const effective = ctx.resolvedModel ?? ctx.payload.model;
+  if (!effective) return true;
+  const normalized = effective.toLowerCase();
+  if (normalized.includes("gemini")) return true;
+  // every concrete model resolved through the registry carries a
+  // `provider/` prefix (e.g. "anthropic/claude-opus-4-7"). anything
+  // without a slash is either the literal `"auto"` alias or an
+  // unrecognized slug that resolveModel logged a warning for — both
+  // route through the agent's late auto-select, which may pick gemini.
+  if (!normalized.includes("/")) return true;
+  return false;
+}