@dcyfr/ai 1.0.3 → 2.1.0

package/dist/ai/memory/mem0-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mem0-client.js","sourceRoot":"","sources":["../../../packages/ai/memory/mem0-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+GH;;GAEG;AACH,SAAS,yBAAyB,CAAC,MAAiB;IAClD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC;IAE7D,+CAA+C;IAC/C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wCAAwC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAC7B,MAAsB,EACtB,kBAA0B;IAE1B,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,QAAQ;YACX,MAAM,YAAY,GAAQ;gBACxB,cAAc,EAAE,MAAM,CAAC,KAAK,IAAI,gBAAgB;gBAChD,SAAS,EAAE,kBAAkB;aAC9B,CAAC;YAEF,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,2DAA2D;gBAC3D,YAAY,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACtC,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,YAAY;aACrB,CAAC;QAEJ,KAAK,UAAU;YACb,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,cAAc,EAAE,MAAM,CAAC,KAAK,IAAI,gBAAgB;oBAChD,SAAS,EAAE,kBAAkB;iBAC9B;aACF,CAAC;QAEJ,KAAK,UAAU;YACb,MAAM,cAAc,GAAQ;gBAC1B,cAAc,EAAE,MAAM,CAAC,KAAK,IAAI,gBAAgB;gBAChD,SAAS,EAAE,kBAAkB;aAC9B,CAAC;YAEF,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,cAAc,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YAClC,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACxC,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,cAAc;aACvB,CAAC;QAEJ;YACE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,MAAiB;IACvC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE;YACN,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,OAAO;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAiB;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC;IAE7D,yDAAyD;IACzD,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC;IAEb,MAAM,oBAAoB,GAAG,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE;YACN,KAAK,EAAE,MAAM,CAAC,cAAc,IAAI,wBAAwB;YACxD,MAAM,EAAE,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM;YAC/C,GAAG,EAAE,MAAM,CAAC,gBAAgB,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACtG,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,oBAAoB;SAC5D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAoB;IACzD,IAAI,CAAC;QACH,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEjE,+BAA+B;QAC/B,MAAM,UAAU,GAAkB;YAChC,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC;YACzC,WAAW,EAAE,sBAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC;YACxE,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,cAAc,EAAE,IAAI,EAAE,oCAAoC;SAC3D,CAAC;QAEF,uCAAuC;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAE9C,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;QAEtC,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE;gBACnC,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,sCAAsC;YACtC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,iDAAiD;QACnD,CAAC;QAED,OAAO,MAAoB,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,CACb,4GAA4G;gBAC5G,kBAAkB,GAAG,KAAK,CAAC,OAAO,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,kBAAkB,GAAsB,IAAI,CAAC;AACjD,IAAI,2BAA2B,GAAkB,IAAI,CAAC;AAEtD,SAAS,iBAAiB,CAAC,MAAoB;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAqB;IACvD,IAAI,kBAAkB,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,2BAA2B,KAAK,mBAAmB,EAAE,CAAC;YACxD,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,gFAAgF;QAChF,kBAAkB,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACpD,2BAA2B,GAAG,mBAAmB,CAAC;QAClD,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,kBAAkB,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACpD,2BAA2B,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,kBAAkB,GAAG,IAAI,CAAC;IAC1B,2BAA2B,GAAG,IAAI,CAAC;AACrC,CAAC"}

package/dist/ai/memory/types.d.ts

@@ -0,0 +1,175 @@
+/**
+ * Memory Layer Type Definitions
+ *
+ * Core interfaces for DCYFR memory abstraction layer.
+ * Provides type safety for user, agent, and session memory operations.
+ *
+ * @module @dcyfr/ai/memory/types
+ */
+/**
+ * Base memory object
+ */
+export interface Memory {
+    /** Unique memory identifier */
+    id: string;
+    /** Memory content (text) */
+    content: string;
+    /** Owner (userId or agentId) */
+    owner: string;
+    /** Owner type */
+    ownerType: 'user' | 'agent' | 'session';
+    /** Importance score (0-1, higher = more important) */
+    importance?: number;
+    /** Topic/category for filtering */
+    topic?: string;
+    /** Timestamp when memory was created */
+    createdAt: Date;
+    /** Additional metadata */
+    metadata?: Record<string, any>;
+}
+/**
+ * Agent-specific memory (extends base Memory)
+ */
+export interface AgentMemory extends Memory {
+    ownerType: 'agent';
+    /** Agent identifier */
+    agentId: string;
+    /** Session identifier */
+    sessionId: string;
+    /** Agent workflow state */
+    state?: Record<string, any>;
+}
+/**
+ * Session-specific memory (temporary context)
+ */
+export interface SessionMemory extends Memory {
+    ownerType: 'session';
+    /** Session identifier */
+    sessionId: string;
+    /** Expiration timestamp (auto-delete after) */
+    expiresAt?: Date;
+}
+/**
+ * Memory search result (includes relevance score)
+ */
+export interface MemorySearchResult extends Memory {
+    /** Relevance score from vector search (0-1) */
+    relevance: number;
+}
+/**
+ * Memory addition context (optional metadata)
+ */
+export interface MemoryContext {
+    /** Topic/category for filtering */
+    topic?: string;
+    /** Importance score (0-1) */
+    importance?: number;
+    /** Additional metadata */
+    metadata?: Record<string, any>;
+}
+/**
+ * DCYFRMemory interface - main API for memory operations
+ *
+ * This abstraction layer wraps mem0 (or other memory providers)
+ * to provide a consistent API for DCYFR applications.
+ */
+export interface DCYFRMemory {
+    /**
+     * Add a user-level memory (persistent across sessions)
+     *
+     * @param userId - Unique user identifier
+     * @param message - Memory content
+     * @param context - Optional metadata (topic, importance)
+     * @returns Memory ID
+     */
+    addUserMemory(userId: string, message: string, context?: MemoryContext): Promise<string>;
+    /**
+     * Search user memories by semantic query
+     *
+     * @param userId - Unique user identifier
+     * @param query - Search query (natural language)
+     * @param limit - Max results to return (default: 3)
+     * @returns Array of relevant memories
+     */
+    searchUserMemories(userId: string, query: string, limit?: number): Promise<MemorySearchResult[]>;
+    /**
+     * Get all memories for a user (optionally filtered by topic)
+     *
+     * @param userId - Unique user identifier
+     * @param topic - Optional topic filter
+     * @returns Array of user memories
+     */
+    getUserMemories(userId: string, topic?: string): Promise<Memory[]>;
+    /**
+     * Add agent workflow state (for multi-step tasks)
+     *
+     * @param agentId - Unique agent identifier
+     * @param sessionId - Current session ID
+     * @param state - Workflow state to persist
+     * @returns Memory ID
+     */
+    addAgentMemory(agentId: string, sessionId: string, state: Record<string, any>): Promise<string>;
+    /**
+     * Search agent memories (retrieve workflow state)
+     *
+     * @param agentId - Unique agent identifier
+     * @param query - Search query
+     * @param limit - Max results to return (default: 3)
+     * @returns Array of agent memories
+     */
+    searchAgentMemories(agentId: string, query: string, limit?: number): Promise<MemorySearchResult[]>;
+    /**
+     * Get full agent state for a session
+     *
+     * @param agentId - Unique agent identifier
+     * @param sessionId - Session identifier
+     * @returns Agent workflow state
+     */
+    getAgentState(agentId: string, sessionId: string): Promise<Record<string, any> | null>;
+    /**
+     * Add temporary session context (auto-expires)
+     *
+     * @param sessionId - Unique session identifier
+     * @param message - Context message
+     * @param ttl - Time-to-live in seconds (default: 3600)
+     * @returns Memory ID
+     */
+    addSessionMemory(sessionId: string, message: string, ttl?: number): Promise<string>;
+    /**
+     * Get full session context (for prompt injection)
+     *
+     * @param sessionId - Unique session identifier
+     * @returns Concatenated session context string
+     */
+    getSessionContext(sessionId: string): Promise<string>;
+    /**
+     * Delete all memories for a user (GDPR compliance)
+     *
+     * @param userId - Unique user identifier
+     */
+    deleteUserMemories(userId: string): Promise<void>;
+    /**
+     * Delete all session memories (cleanup)
+     *
+     * @param sessionId - Session identifier
+     */
+    deleteSessionMemories(sessionId: string): Promise<void>;
+}
+/**
+ * Memory provider interface (for swapping backends)
+ */
+export interface MemoryProvider {
+    /** Provider name (e.g., 'mem0', 'llamaindex') */
+    name: string;
+    /** Initialize provider with configuration */
+    initialize(config: any): Promise<void>;
+    /** Store a memory */
+    store(memory: Omit<Memory, 'id' | 'createdAt'>): Promise<string>;
+    /** Search memories */
+    search(owner: string, query: string, limit: number): Promise<MemorySearchResult[]>;
+    /** Retrieve memories */
+    retrieve(owner: string, filters?: Record<string, any>): Promise<Memory[]>;
+    /** Delete memories */
+    delete(owner: string): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/ai/memory/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../packages/ai/memory/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IAEX,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAEhB,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IAEd,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAExC,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wCAAwC;IACxC,SAAS,EAAE,IAAI,CAAC;IAEhB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,MAAM;IACzC,SAAS,EAAE,OAAO,CAAC;IAEnB,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAEhB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAElB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC3C,SAAS,EAAE,SAAS,CAAC;IAErB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAElB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,MAAM;IAChD,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAG1B;;;;;;;OAOG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;;;;OAOG;IACH,kBAAkB,CAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;;OAMG;IACH,eAAe,CACb,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAIrB;;;;;;;OAOG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;;OAMG;IACH,aAAa,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAIvC;;;;;;;OAOG;IACH,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;;OAKG;IACH,iBAAiB,CACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;IAInB;;;;OAIG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;OAIG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IAEb,6CAA6C;IAC7C,UAAU,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvC,qBAAqB;IACrB,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEjE,sBAAsB;IACtB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEnF,wBAAwB;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1E,sBAAsB;IACtB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC"}

package/dist/ai/memory/types.js

@@ -0,0 +1,10 @@
+/**
+ * Memory Layer Type Definitions
+ *
+ * Core interfaces for DCYFR memory abstraction layer.
+ * Provides type safety for user, agent, and session memory operations.
+ *
+ * @module @dcyfr/ai/memory/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/ai/memory/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../packages/ai/memory/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/ai/permissions/attenuation-engine.d.ts

@@ -0,0 +1,159 @@
+/**
+ * DCYFR Permission Attenuation Engine
+ * TLP:AMBER - Internal Use Only
+ *
+ * Implements hierarchical permission token attenuation with least-privilege enforcement.
+ * Ensures delegated permissions are always a proper subset of parent permissions.
+ *
+ * @module permissions/attenuation-engine
+ * @version 1.0.0
+ * @date 2026-02-13
+ */
+import type { PermissionToken, AttenuatePermissionRequest, PermissionScope, PermissionAction, PermissionConstraint } from '../types/permission-tokens';
+/**
+ * Attenuation validation result
+ */
+export interface AttenuationValidationResult {
+    /** Whether attenuation is valid */
+    valid: boolean;
+    /** Validation errors */
+    errors: string[];
+    /** Validation warnings */
+    warnings: string[];
+    /** Detailed validation results per field */
+    field_validations: {
+        scopes: boolean;
+        actions: boolean;
+        resources: boolean;
+        constraints: boolean;
+        delegation_depth: boolean;
+        expiration: boolean;
+    };
+}
+/**
+ * Permission Attenuation Engine
+ *
+ * Enforces least-privilege principle by ensuring delegated permissions
+ * are always strictly reduced from parent permissions.
+ */
+export declare class PermissionAttenuationEngine {
+    private debugMode;
+    constructor(options?: {
+        debug?: boolean;
+    });
+    /**
+     * Attenuate a permission token to create a child token with reduced permissions
+     *
+     * @param parentToken - The parent token to attenuate
+     * @param request - Attenuation request parameters
+     * @returns Attenuated child token
+     * @throws Error if attenuation violates least-privilege constraints
+     */
+    attenuate(parentToken: PermissionToken, request: AttenuatePermissionRequest): Promise<PermissionToken>;
+    /**
+     * Validate parent token is suitable for attenuation
+     */
+    private validateParentToken;
+    /**
+     * Validate attenuation request follows least-privilege principles
+     */
+    validateAttenuation(parentToken: PermissionToken, request: AttenuatePermissionRequest): AttenuationValidationResult;
+    /**
+     * Validate scope attenuation (hierarchical)
+     *
+     * Child scopes must be equal to or more specific than parent scopes.
+     * Examples:
+     * - "workspace.read" → "workspace.read.code" ✓
+     * - "workspace.read.code" → "workspace.read" ✗
+     * - "workspace.read" → "workspace.write" ✗
+     */
+    private validateScopeAttenuation;
+    /**
+     * Check if childScope is a valid attenuation of parentScope
+     *
+     * Valid attenuations:
+     * - Exact match: "workspace.read" === "workspace.read"
+     * - More specific: "workspace.read.code" extends "workspace.read"
+     */
+    private isScopeAttenuation;
+    /**
+     * Validate action attenuation
+     *
+     * Child actions must be a subset of parent actions.
+     * Action hierarchy: manage > create/delete > write > read/execute
+     */
+    private validateActionAttenuation;
+    /**
+     * Check if an action is implied by higher-level actions
+     *
+     * Example: 'manage' implies all actions EXCEPT 'delegate'
+     * 'delegate' requires explicit granting for security
+     */
+    private actionImpliedBy;
+    /**
+     * Validate resource attenuation
+     *
+     * Child resources must be a subset of parent resources or match patterns.
+     */
+    private validateResourceAttenuation;
+    /**
+     * Check if a resource matches any of the given patterns
+     *
+     * Supports glob-style patterns: *, **, ?
+     * Also supports hierarchical path matching (e.g., /src/** matches /src/utils/**)
+     */
+    private matchesPatterns;
+    /**
+     * Validate constraint attenuation
+     *
+     * Additional constraints can only make permissions MORE restrictive.
+     */
+    private validateConstraintAttenuation;
+    /**
+     * Check if new constraint is more restrictive than existing
+     */
+    private isMoreRestrictive;
+    /**
+     * Validate delegation depth
+     */
+    private validateDelegationDepth;
+    /**
+     * Validate expiration time
+     */
+    private validateExpiration;
+    /**
+     * Create child token from parent and request
+     */
+    private createChildToken;
+    /**
+     * Check if a permission hierarchy is valid (all tokens properly attenuated)
+     *
+     * @param tokens - Array of tokens from root to leaf
+     * @returns Validation result with any violations
+     */
+    validateHierarchy(tokens: PermissionToken[]): {
+        valid: boolean;
+        violations: Array<{
+            tokenIndex: number;
+            error: string;
+        }>;
+    };
+    /**
+     * Calculate effective permissions for a token (considering all parent constraints)
+     *
+     * @param token - Token to analyze
+     * @param parentTokens - Array of parent tokens (from root to immediate parent)
+     * @returns Effective permissions merging all hierarchical constraints
+     */
+    calculateEffectivePermissions(token: PermissionToken, parentTokens: PermissionToken[]): {
+        effectiveScopes: PermissionScope[];
+        effectiveActions: PermissionAction[];
+        effectiveResources: string[];
+        effectiveConstraints: PermissionConstraint[];
+    };
+    /**
+     * Log debug messages
+     */
+    private log;
+}
+//# sourceMappingURL=attenuation-engine.d.ts.map

package/dist/ai/permissions/attenuation-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attenuation-engine.d.ts","sourceRoot":"","sources":["../../../packages/ai/permissions/attenuation-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EACV,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EAErB,MAAM,4BAA4B,CAAC;AAEpC;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mCAAmC;IACnC,KAAK,EAAE,OAAO,CAAC;IAEf,wBAAwB;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IAEnB,4CAA4C;IAC5C,iBAAiB,EAAE;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC;QACnB,WAAW,EAAE,OAAO,CAAC;QACrB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED;;;;;GAKG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,SAAS,CAAU;gBAEf,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;IAI7C;;;;;;;OAOG;IACG,SAAS,CACb,WAAW,EAAE,eAAe,EAC5B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,eAAe,CAAC;IAwB3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;IACH,mBAAmB,CACjB,WAAW,EAAE,eAAe,EAC5B,OAAO,EAAE,0BAA0B,GAClC,2BAA2B;IAsE9B;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IA+BhC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAqB1B;;;;;OAKG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA6BvB;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAgCnC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAqBvB;;;;OAIG;IACH,OAAO,CAAC,6BAA6B;IAgCrC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwCzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAI/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAoC1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAmDxB;;;;;OAKG;IACH,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG;QAC5C,KAAK,EAAE,OAAO,CAAC;QACf,UAAU,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC1D;IAuCD;;;;;;OAMG;IACH,6BAA6B,CAC3B,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,eAAe,EAAE,GAC9B;QACD,eAAe,EAAE,eAAe,EAAE,CAAC;QACnC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;QACrC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;KAC9C;IAsDD;;OAEG;IACH,OAAO,CAAC,GAAG;CAKZ"}