@dcyfr/ai 2.1.3 → 3.0.0

package/dist/ai/src/plugins/certification/types.js

@@ -0,0 +1,201 @@
+/**
+ * Plugin Certification Program — Type Definitions
+ *
+ * Defines the 3-tier certification program (Bronze / Silver / Gold),
+ * badge system, audit checklist, and paid audit workflow.
+ *
+ * @module plugins/certification/types
+ */
+/** Pricing for each tier in USD cents. */
+export const CERTIFICATION_PRICING_USD_CENTS = {
+    BRONZE: 0, // Free tier — automated only
+    SILVER: 49900, // $499 — human audit
+    GOLD: 249900, // $2,499 — pen test + human audit
+};
+/** Human-readable tier names. */
+export const CERTIFICATION_TIER_LABELS = {
+    BRONZE: 'Bronze',
+    SILVER: 'Silver',
+    GOLD: 'Gold',
+};
+/** Validity period in days for each tier. */
+export const CERTIFICATION_VALIDITY_DAYS = {
+    BRONZE: 90, // 90 days — renew quarterly
+    SILVER: 180, // 6 months
+    GOLD: 365, // 1 year
+};
+/**
+ * Complete audit checklist defining all required checks per tier.
+ */
+export const CERTIFICATION_AUDIT_CHECKLIST = [
+    // --- Automated Scan (Bronze+) ---
+    {
+        item_id: 'AUTO-001',
+        category: 'AUTOMATED_SCAN',
+        description: 'No critical or high CVEs in dependency tree (via npm audit / Trivy scan)',
+        required_for_tiers: ['BRONZE', 'SILVER', 'GOLD'],
+        automated: true,
+    },
+    {
+        item_id: 'AUTO-002',
+        category: 'AUTOMATED_SCAN',
+        description: 'No secrets or credentials detected in plugin bundle (via Gitleaks / TruffleHog)',
+        required_for_tiers: ['BRONZE', 'SILVER', 'GOLD'],
+        automated: true,
+    },
+    {
+        item_id: 'AUTO-003',
+        category: 'AUTOMATED_SCAN',
+        description: 'Static analysis: no code injection patterns (eval, Function constructor, setTimeout with string)',
+        required_for_tiers: ['BRONZE', 'SILVER', 'GOLD'],
+        automated: true,
+    },
+    {
+        item_id: 'AUTO-004',
+        category: 'AUTOMATED_SCAN',
+        description: 'SBOM generated and all dependencies declared with valid SPDX identifiers',
+        required_for_tiers: ['BRONZE', 'SILVER', 'GOLD'],
+        automated: true,
+    },
+    {
+        item_id: 'AUTO-005',
+        category: 'AUTOMATED_SCAN',
+        description: 'Plugin sandbox test passes with Docker isolation (no escape attempts)',
+        required_for_tiers: ['BRONZE', 'SILVER', 'GOLD'],
+        automated: true,
+    },
+    // --- Permission Review (Bronze+) ---
+    {
+        item_id: 'PERM-001',
+        category: 'PERMISSION_REVIEW',
+        description: 'Declared permissions match observed runtime behavior (no undeclared network calls)',
+        required_for_tiers: ['BRONZE', 'SILVER', 'GOLD'],
+        automated: true,
+    },
+    {
+        item_id: 'PERM-002',
+        category: 'PERMISSION_REVIEW',
+        description: 'Principle of least privilege: no excessive permissions requested',
+        required_for_tiers: ['BRONZE', 'SILVER', 'GOLD'],
+        automated: false,
+    },
+    // --- Code Quality (Silver+) ---
+    {
+        item_id: 'CODE-001',
+        category: 'CODE_QUALITY',
+        description: 'Source code review: no obfuscation, no dynamic require(), clean readable logic',
+        required_for_tiers: ['SILVER', 'GOLD'],
+        automated: false,
+    },
+    {
+        item_id: 'CODE-002',
+        category: 'CODE_QUALITY',
+        description: 'Error handling: all failure paths handled gracefully (no unhandled promise rejections)',
+        required_for_tiers: ['SILVER', 'GOLD'],
+        automated: false,
+    },
+    {
+        item_id: 'CODE-003',
+        category: 'CODE_QUALITY',
+        description: 'Test coverage ≥80% with meaningful assertions (no trivial tests to inflate coverage)',
+        required_for_tiers: ['SILVER', 'GOLD'],
+        automated: true,
+    },
+    // --- Security Manual (Silver+) ---
+    {
+        item_id: 'SEC-001',
+        category: 'SECURITY_MANUAL',
+        description: 'Human audit: input validation reviewed for injection risks',
+        required_for_tiers: ['SILVER', 'GOLD'],
+        automated: false,
+    },
+    {
+        item_id: 'SEC-002',
+        category: 'SECURITY_MANUAL',
+        description: 'Human audit: data handling reviewed for PII risks and GDPR compliance',
+        required_for_tiers: ['SILVER', 'GOLD'],
+        automated: false,
+    },
+    {
+        item_id: 'SEC-003',
+        category: 'SECURITY_MANUAL',
+        description: 'Human audit: supply chain reviewed (no suspicious fork or dependency substitution)',
+        required_for_tiers: ['SILVER', 'GOLD'],
+        automated: false,
+    },
+    // --- Penetration Test (Gold only) ---
+    {
+        item_id: 'PEN-001',
+        category: 'PENETRATION_TEST',
+        description: 'Third-party penetration test: sandbox escape attempt (documented, no successful escapes)',
+        required_for_tiers: ['GOLD'],
+        automated: false,
+    },
+    {
+        item_id: 'PEN-002',
+        category: 'PENETRATION_TEST',
+        description: 'Third-party penetration test: privilege escalation attempts (all blocked)',
+        required_for_tiers: ['GOLD'],
+        automated: false,
+    },
+    {
+        item_id: 'PEN-003',
+        category: 'PENETRATION_TEST',
+        description: 'Third-party penetration test: formal report submitted and accepted by DCYFR',
+        required_for_tiers: ['GOLD'],
+        automated: false,
+    },
+];
+// ---------------------------------------------------------------------------
+// SQL Schema
+// ---------------------------------------------------------------------------
+export const CERTIFICATION_SCHEMA_SQL = `
+-- Plugin certification badges
+CREATE TABLE IF NOT EXISTS plugin_certification_badges (
+  badge_id        TEXT PRIMARY KEY,
+  plugin_id       TEXT NOT NULL,
+  plugin_version  TEXT NOT NULL,
+  tier            TEXT NOT NULL CHECK (tier IN ('BRONZE', 'SILVER', 'GOLD')),
+  issued_at       TEXT NOT NULL,
+  expires_at      TEXT NOT NULL,
+  issued_by       TEXT NOT NULL,
+  verification_url TEXT NOT NULL,
+  bundle_hash     TEXT NOT NULL
+);
+
+-- Audit requests and their lifecycle
+CREATE TABLE IF NOT EXISTS plugin_audit_requests (
+  request_id              TEXT PRIMARY KEY,
+  plugin_id               TEXT NOT NULL,
+  plugin_version          TEXT NOT NULL,
+  tier                    TEXT NOT NULL CHECK (tier IN ('BRONZE', 'SILVER', 'GOLD')),
+  submitted_by            TEXT NOT NULL,
+  submitted_at            TEXT NOT NULL,
+  status                  TEXT NOT NULL,
+  price_usd_cents         INTEGER NOT NULL,
+  payment_reference_id    TEXT,
+  payment_confirmed_at    TEXT,
+  auditor                 TEXT,
+  audit_started_at        TEXT,
+  audit_completed_at      TEXT,
+  auditor_notes           TEXT,
+  badge_id                TEXT REFERENCES plugin_certification_badges(badge_id),
+  failure_reason          TEXT
+);
+
+-- Per-request checklist results
+CREATE TABLE IF NOT EXISTS audit_checklist_results (
+  id              TEXT PRIMARY KEY,
+  request_id      TEXT NOT NULL REFERENCES plugin_audit_requests(request_id),
+  item_id         TEXT NOT NULL,
+  passed          INTEGER,  -- NULL=pending, 1=pass, 0=fail
+  notes           TEXT,
+  evaluated_at    TEXT,
+  evaluated_by    TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_badge_plugin_id ON plugin_certification_badges(plugin_id);
+CREATE INDEX IF NOT EXISTS idx_audit_plugin_id ON plugin_audit_requests(plugin_id);
+CREATE INDEX IF NOT EXISTS idx_audit_status    ON plugin_audit_requests(status);
+`.trim();
+//# sourceMappingURL=types.js.map

package/dist/ai/src/plugins/certification/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/certification/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,0CAA0C;AAC1C,MAAM,CAAC,MAAM,+BAA+B,GAAgD;IAC1F,MAAM,EAAE,CAAC,EAAU,6BAA6B;IAChD,MAAM,EAAE,KAAK,EAAM,qBAAqB;IACxC,IAAI,EAAE,MAAM,EAAO,kCAAkC;CAC7C,CAAC;AAEX,iCAAiC;AACjC,MAAM,CAAC,MAAM,yBAAyB,GAAgD;IACpF,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,6CAA6C;AAC7C,MAAM,CAAC,MAAM,2BAA2B,GAAgD;IACtF,MAAM,EAAE,EAAE,EAAI,4BAA4B;IAC1C,MAAM,EAAE,GAAG,EAAG,WAAW;IACzB,IAAI,EAAE,GAAG,EAAK,SAAS;CACf,CAAC;AAqEX;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,mCAAmC;IACnC;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,0EAA0E;QACvF,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAChD,SAAS,EAAE,IAAI;KAChB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,iFAAiF;QAC9F,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAChD,SAAS,EAAE,IAAI;KAChB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,kGAAkG;QAC/G,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAChD,SAAS,EAAE,IAAI;KAChB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,0EAA0E;QACvF,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAChD,SAAS,EAAE,IAAI;KAChB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,uEAAuE;QACpF,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAChD,SAAS,EAAE,IAAI;KAChB;IACD,sCAAsC;IACtC;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,mBAAmB;QAC7B,WAAW,EAAE,oFAAoF;QACjG,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAChD,SAAS,EAAE,IAAI;KAChB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,mBAAmB;QAC7B,WAAW,EAAE,kEAAkE;QAC/E,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAChD,SAAS,EAAE,KAAK;KACjB;IACD,iCAAiC;IACjC;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,gFAAgF;QAC7F,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QACtC,SAAS,EAAE,KAAK;KACjB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,wFAAwF;QACrG,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QACtC,SAAS,EAAE,KAAK;KACjB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,sFAAsF;QACnG,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QACtC,SAAS,EAAE,IAAI;KAChB;IACD,oCAAoC;IACpC;QACE,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,iBAAiB;QAC3B,WAAW,EAAE,4DAA4D;QACzE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QACtC,SAAS,EAAE,KAAK;KACjB;IACD;QACE,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,iBAAiB;QAC3B,WAAW,EAAE,uEAAuE;QACpF,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QACtC,SAAS,EAAE,KAAK;KACjB;IACD;QACE,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,iBAAiB;QAC3B,WAAW,EAAE,oFAAoF;QACjG,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;QACtC,SAAS,EAAE,KAAK;KACjB;IACD,uCAAuC;IACvC;QACE,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,0FAA0F;QACvG,kBAAkB,EAAE,CAAC,MAAM,CAAC;QAC5B,SAAS,EAAE,KAAK;KACjB;IACD;QACE,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,2EAA2E;QACxF,kBAAkB,EAAE,CAAC,MAAM,CAAC;QAC5B,SAAS,EAAE,KAAK;KACjB;IACD;QACE,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,6EAA6E;QAC1F,kBAAkB,EAAE,CAAC,MAAM,CAAC;QAC5B,SAAS,EAAE,KAAK;KACjB;CACO,CAAC;AA4EX,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDvC,CAAC,IAAI,EAAE,CAAC"}

package/dist/ai/src/plugins/escalation/escalation-trigger.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Community Plugin Escalation Trigger
+ *
+ * Monitors community plugin metrics (downloads + ratings) and automatically
+ * nominates plugins for DCYFR security audit when thresholds are crossed:
+ *
+ *   - downloads ≥ 100  AND
+ *   - average rating ≥ 4.0 stars
+ *
+ * When both thresholds are crossed, an EscalationRecord is created and
+ * stored. Downstream systems (GitHub issue automation, Axiom alerts, etc.)
+ * can poll `getPendingEscalations()` or subscribe via `onEscalation`.
+ *
+ * @module plugins/escalation/escalation-trigger
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+/** Current metrics for a community plugin */
+export interface PluginMetrics {
+    /** Plugin identifier, e.g. "author/plugin-name" */
+    pluginId: string;
+    /** Total all-time download count */
+    downloads: number;
+    /** Average star rating (0.0 – 5.0) */
+    averageRating: number;
+    /** Number of individual ratings */
+    ratingCount: number;
+    /** Current trust score (0–100) */
+    trustScore: number;
+    /** ISO-8601 timestamp of last metrics update */
+    lastUpdated: string;
+}
+/** Configuration for escalation thresholds */
+export interface EscalationThresholds {
+    /** Minimum downloads to trigger (default: 100) */
+    minDownloads: number;
+    /** Minimum average rating to trigger (default: 4.0) */
+    minRating: number;
+    /** Minimum rating count before rating is considered valid (default: 5) */
+    minRatingCount: number;
+    /** Minimum trust score to be eligible (default: 85) */
+    minTrustScore: number;
+}
+/** Status of an escalation record */
+export type EscalationStatus = 'pending' | 'scheduled' | 'in_progress' | 'completed' | 'dismissed';
+/** A single escalation record for a plugin */
+export interface EscalationRecord {
+    /** Unique escalation ID */
+    id: string;
+    /** Plugin identifier */
+    pluginId: string;
+    /** Metrics snapshot that triggered the escalation */
+    metricsSnapshot: PluginMetrics;
+    /** ISO-8601 timestamp when escalation was triggered */
+    triggeredAt: string;
+    /** Current status */
+    status: EscalationStatus;
+    /** Optional notes from security team */
+    notes?: string;
+    /** GitHub issue URL if one was created */
+    githubIssueUrl?: string;
+}
+/** Result of evaluating a plugin against escalation thresholds */
+export interface EscalationEvaluation {
+    /** Whether the plugin meets all thresholds */
+    eligible: boolean;
+    /** Plugin being evaluated */
+    pluginId: string;
+    /** Which checks passed */
+    checks: {
+        downloadsPass: boolean;
+        ratingPass: boolean;
+        ratingCountPass: boolean;
+        trustScorePass: boolean;
+    };
+    /** Whether this plugin is already in the escalation queue */
+    alreadyEscalated: boolean;
+}
+/**
+ * Manages escalation of community plugins to DCYFR security audit.
+ *
+ * @example
+ * ```ts
+ * const trigger = new EscalationTrigger();
+ * const result = trigger.evaluate({
+ *   pluginId: 'alice/my-plugin',
+ *   downloads: 150,
+ *   averageRating: 4.5,
+ *   ratingCount: 20,
+ *   trustScore: 92,
+ *   lastUpdated: new Date().toISOString(),
+ * });
+ * if (result.eligible) {
+ *   const record = trigger.escalate(metrics);
+ *   console.log('Escalated:', record.id);
+ * }
+ * ```
+ */
+export declare class EscalationTrigger {
+    private readonly thresholds;
+    private records;
+    private listeners;
+    private nextId;
+    constructor(thresholds?: Partial<EscalationThresholds>);
+    /**
+     * Evaluates a plugin's metrics against escalation thresholds.
+     * Does NOT create an escalation record — call `escalate()` to do that.
+     */
+    evaluate(metrics: PluginMetrics): EscalationEvaluation;
+    /**
+     * Creates an escalation record for the given plugin metrics.
+     * Emits an `onEscalation` event to all registered listeners.
+     *
+     * @throws {Error} If the plugin already has a pending escalation.
+     */
+    escalate(metrics: PluginMetrics): EscalationRecord;
+    /**
+     * Evaluates and, if eligible and not already escalated, creates an escalation record.
+     * Returns the new record or `null` if ineligible / already escalated.
+     */
+    evaluateAndEscalate(metrics: PluginMetrics): EscalationRecord | null;
+    /**
+     * Updates the status of an escalation record.
+     *
+     * @throws {Error} If the record ID does not exist.
+     */
+    updateStatus(escalationId: string, status: EscalationStatus, notes?: string, githubIssueUrl?: string): EscalationRecord;
+    /** Returns all escalation records with status "pending". */
+    getPendingEscalations(): EscalationRecord[];
+    /** Returns all escalation records. */
+    getAllEscalations(): EscalationRecord[];
+    /** Returns a single escalation record by ID, or undefined. */
+    getEscalation(escalationId: string): EscalationRecord | undefined;
+    /** Returns true if the given plugin has any active (non-terminal) escalation. */
+    hasPendingEscalation(pluginId: string): boolean;
+    /** Returns the currently configured thresholds. */
+    getThresholds(): EscalationThresholds;
+    /**
+     * Registers a callback that fires whenever a new escalation is created.
+     * Returns an unsubscribe function.
+     *
+     * @example
+     * ```ts
+     * const unsub = trigger.onEscalation(record => {
+     *   console.log('New escalation:', record.pluginId);
+     * });
+     * // later:
+     * unsub();
+     * ```
+     */
+    onEscalation(listener: (record: EscalationRecord) => void): () => void;
+    private emit;
+}
+//# sourceMappingURL=escalation-trigger.d.ts.map

package/dist/ai/src/plugins/escalation/escalation-trigger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalation-trigger.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/escalation/escalation-trigger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qCAAqC;AACrC,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,GAAG,WAAW,GAAG,WAAW,CAAC;AAEnG,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,eAAe,EAAE,aAAa,CAAC;IAC/B,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,MAAM,EAAE;QACN,aAAa,EAAE,OAAO,CAAC;QACvB,UAAU,EAAE,OAAO,CAAC;QACpB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,6DAA6D;IAC7D,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAiBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,SAAS,CAAiD;IAClE,OAAO,CAAC,MAAM,CAAK;gBAEP,UAAU,GAAE,OAAO,CAAC,oBAAoB,CAAM;IAQ1D;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,oBAAoB;IAkBtD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,gBAAgB;IAqBlD;;;OAGG;IACH,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,gBAAgB,GAAG,IAAI;IAQpE;;;;OAIG;IACH,YAAY,CACV,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,gBAAgB,EACxB,KAAK,CAAC,EAAE,MAAM,EACd,cAAc,CAAC,EAAE,MAAM,GACtB,gBAAgB;IAenB,4DAA4D;IAC5D,qBAAqB,IAAI,gBAAgB,EAAE;IAI3C,sCAAsC;IACtC,iBAAiB,IAAI,gBAAgB,EAAE;IAIvC,8DAA8D;IAC9D,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIjE,iFAAiF;IACjF,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAO/C,mDAAmD;IACnD,aAAa,IAAI,oBAAoB;IAQrC;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG,MAAM,IAAI;IAOtE,OAAO,CAAC,IAAI;CAKb"}

package/dist/ai/src/plugins/escalation/escalation-trigger.js

@@ -0,0 +1,183 @@
+/**
+ * Community Plugin Escalation Trigger
+ *
+ * Monitors community plugin metrics (downloads + ratings) and automatically
+ * nominates plugins for DCYFR security audit when thresholds are crossed:
+ *
+ *   - downloads ≥ 100  AND
+ *   - average rating ≥ 4.0 stars
+ *
+ * When both thresholds are crossed, an EscalationRecord is created and
+ * stored. Downstream systems (GitHub issue automation, Axiom alerts, etc.)
+ * can poll `getPendingEscalations()` or subscribe via `onEscalation`.
+ *
+ * @module plugins/escalation/escalation-trigger
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+// ---------------------------------------------------------------------------
+// Default thresholds
+// ---------------------------------------------------------------------------
+const DEFAULT_THRESHOLDS = {
+    minDownloads: 100,
+    minRating: 4,
+    minRatingCount: 5,
+    minTrustScore: 85,
+};
+// ---------------------------------------------------------------------------
+// EscalationTrigger
+// ---------------------------------------------------------------------------
+/**
+ * Manages escalation of community plugins to DCYFR security audit.
+ *
+ * @example
+ * ```ts
+ * const trigger = new EscalationTrigger();
+ * const result = trigger.evaluate({
+ *   pluginId: 'alice/my-plugin',
+ *   downloads: 150,
+ *   averageRating: 4.5,
+ *   ratingCount: 20,
+ *   trustScore: 92,
+ *   lastUpdated: new Date().toISOString(),
+ * });
+ * if (result.eligible) {
+ *   const record = trigger.escalate(metrics);
+ *   console.log('Escalated:', record.id);
+ * }
+ * ```
+ */
+export class EscalationTrigger {
+    thresholds;
+    records = new Map();
+    listeners = [];
+    nextId = 1;
+    constructor(thresholds = {}) {
+        this.thresholds = { ...DEFAULT_THRESHOLDS, ...thresholds };
+    }
+    // -------------------------------------------------------------------------
+    // Evaluation
+    // -------------------------------------------------------------------------
+    /**
+     * Evaluates a plugin's metrics against escalation thresholds.
+     * Does NOT create an escalation record — call `escalate()` to do that.
+     */
+    evaluate(metrics) {
+        const t = this.thresholds;
+        const checks = {
+            downloadsPass: metrics.downloads >= t.minDownloads,
+            ratingPass: metrics.averageRating >= t.minRating,
+            ratingCountPass: metrics.ratingCount >= t.minRatingCount,
+            trustScorePass: metrics.trustScore >= t.minTrustScore,
+        };
+        const eligible = Object.values(checks).every(Boolean);
+        const alreadyEscalated = this.hasPendingEscalation(metrics.pluginId);
+        return { eligible, pluginId: metrics.pluginId, checks, alreadyEscalated };
+    }
+    // -------------------------------------------------------------------------
+    // Escalation management
+    // -------------------------------------------------------------------------
+    /**
+     * Creates an escalation record for the given plugin metrics.
+     * Emits an `onEscalation` event to all registered listeners.
+     *
+     * @throws {Error} If the plugin already has a pending escalation.
+     */
+    escalate(metrics) {
+        if (this.hasPendingEscalation(metrics.pluginId)) {
+            throw new Error(`Plugin "${metrics.pluginId}" already has a pending escalation. ` +
+                `Call resolveEscalation() first.`);
+        }
+        const record = {
+            id: `esc-${String(this.nextId++).padStart(4, '0')}`,
+            pluginId: metrics.pluginId,
+            metricsSnapshot: { ...metrics },
+            triggeredAt: new Date().toISOString(),
+            status: 'pending',
+        };
+        this.records.set(record.id, record);
+        this.emit(record);
+        return record;
+    }
+    /**
+     * Evaluates and, if eligible and not already escalated, creates an escalation record.
+     * Returns the new record or `null` if ineligible / already escalated.
+     */
+    evaluateAndEscalate(metrics) {
+        const evaluation = this.evaluate(metrics);
+        if (!evaluation.eligible || evaluation.alreadyEscalated) {
+            return null;
+        }
+        return this.escalate(metrics);
+    }
+    /**
+     * Updates the status of an escalation record.
+     *
+     * @throws {Error} If the record ID does not exist.
+     */
+    updateStatus(escalationId, status, notes, githubIssueUrl) {
+        const record = this.records.get(escalationId);
+        if (!record) {
+            throw new Error(`Escalation record "${escalationId}" not found.`);
+        }
+        record.status = status;
+        if (notes !== undefined)
+            record.notes = notes;
+        if (githubIssueUrl !== undefined)
+            record.githubIssueUrl = githubIssueUrl;
+        return record;
+    }
+    // -------------------------------------------------------------------------
+    // Queries
+    // -------------------------------------------------------------------------
+    /** Returns all escalation records with status "pending". */
+    getPendingEscalations() {
+        return [...this.records.values()].filter(r => r.status === 'pending');
+    }
+    /** Returns all escalation records. */
+    getAllEscalations() {
+        return [...this.records.values()];
+    }
+    /** Returns a single escalation record by ID, or undefined. */
+    getEscalation(escalationId) {
+        return this.records.get(escalationId);
+    }
+    /** Returns true if the given plugin has any active (non-terminal) escalation. */
+    hasPendingEscalation(pluginId) {
+        const terminal = ['completed', 'dismissed'];
+        return [...this.records.values()].some(r => r.pluginId === pluginId && !terminal.includes(r.status));
+    }
+    /** Returns the currently configured thresholds. */
+    getThresholds() {
+        return { ...this.thresholds };
+    }
+    // -------------------------------------------------------------------------
+    // Event subscription
+    // -------------------------------------------------------------------------
+    /**
+     * Registers a callback that fires whenever a new escalation is created.
+     * Returns an unsubscribe function.
+     *
+     * @example
+     * ```ts
+     * const unsub = trigger.onEscalation(record => {
+     *   console.log('New escalation:', record.pluginId);
+     * });
+     * // later:
+     * unsub();
+     * ```
+     */
+    onEscalation(listener) {
+        this.listeners.push(listener);
+        return () => {
+            this.listeners = this.listeners.filter(l => l !== listener);
+        };
+    }
+    emit(record) {
+        for (const listener of this.listeners) {
+            listener(record);
+        }
+    }
+}
+//# sourceMappingURL=escalation-trigger.js.map

package/dist/ai/src/plugins/escalation/escalation-trigger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalation-trigger.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/escalation/escalation-trigger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAwEH,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,kBAAkB,GAAyB;IAC/C,YAAY,EAAI,GAAG;IACnB,SAAS,EAAO,CAAC;IACjB,cAAc,EAAE,CAAC;IACjB,aAAa,EAAG,EAAE;CACnB,CAAC;AAEF,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAC1C,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC9C,SAAS,GAA8C,EAAE,CAAC;IAC1D,MAAM,GAAG,CAAC,CAAC;IAEnB,YAAY,aAA4C,EAAE;QACxD,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,UAAU,EAAE,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;OAGG;IACH,QAAQ,CAAC,OAAsB;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1B,MAAM,MAAM,GAAG;YACb,aAAa,EAAI,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY;YACpD,UAAU,EAAO,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,SAAS;YACrD,eAAe,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,cAAc;YACxD,cAAc,EAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,aAAa;SACvD,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAErE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5E,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E;;;;;OAKG;IACH,QAAQ,CAAC,OAAsB;QAC7B,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,WAAW,OAAO,CAAC,QAAQ,sCAAsC;gBACjE,iCAAiC,CAClC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAqB;YAC/B,EAAE,EAAe,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAChE,QAAQ,EAAS,OAAO,CAAC,QAAQ;YACjC,eAAe,EAAE,EAAE,GAAG,OAAO,EAAE;YAC/B,WAAW,EAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACzC,MAAM,EAAW,SAAS;SAC3B,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,OAAsB;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,YAAY,CACV,YAAoB,EACpB,MAAwB,EACxB,KAAc,EACd,cAAuB;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,YAAY,cAAc,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS;YAAW,MAAM,CAAC,KAAK,GAAY,KAAK,CAAC;QAChE,IAAI,cAAc,KAAK,SAAS;YAAE,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E,4DAA4D;IAC5D,qBAAqB;QACnB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,sCAAsC;IACtC,iBAAiB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,8DAA8D;IAC9D,aAAa,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED,iFAAiF;IACjF,oBAAoB,CAAC,QAAgB;QACnC,MAAM,QAAQ,GAAuB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,aAAa;QACX,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,qBAAqB;IACrB,4EAA4E;IAE5E;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,QAA4C;QACvD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC9D,CAAC,CAAC;IACJ,CAAC;IAEO,IAAI,CAAC,MAAwB;QACnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/ai/src/plugins/escalation/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Community Plugin Escalation Trigger
+ *
+ * @module plugins/escalation
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+export { EscalationTrigger, } from './escalation-trigger.js';
+export type { PluginMetrics, EscalationThresholds, EscalationStatus, EscalationRecord, EscalationEvaluation, } from './escalation-trigger.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/ai/src/plugins/escalation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/escalation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC"}

package/dist/ai/src/plugins/escalation/index.js

@@ -0,0 +1,10 @@
+/**
+ * Community Plugin Escalation Trigger
+ *
+ * @module plugins/escalation
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+export { EscalationTrigger, } from './escalation-trigger.js';
+//# sourceMappingURL=index.js.map

package/dist/ai/src/plugins/escalation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/escalation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,iBAAiB,GAClB,MAAM,yBAAyB,CAAC"}