@dcyfr/ai 2.1.3 → 3.0.0

package/dist/ai/src/plugins/permissions/plugin-permission-validator.js

@@ -0,0 +1,296 @@
+/**
+ * Plugin Permission Validator
+ *
+ * Validates plugin permission requests against declared capabilities using
+ * glob pattern matching. Implements the capability-based least-privilege model.
+ *
+ * Uses Node.js v22+ built-in `path.matchesGlob()` for filesystem patterns.
+ *
+ * @module plugins/permissions/plugin-permission-validator
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import { matchesGlob } from 'node:path';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function matchesAnyGlob(path, patterns) {
+    return patterns.some((pattern) => {
+        try {
+            return matchesGlob(path, pattern);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function matchesDomain(hostname, allowedDomains) {
+    if (allowedDomains.length === 0)
+        return true; // no restrictions
+    return allowedDomains.some((domain) => {
+        // Support wildcard subdomains: *.github.com matches api.github.com
+        if (domain.startsWith('*.')) {
+            const suffix = domain.slice(1); // .github.com
+            return hostname === domain.slice(2) || hostname.endsWith(suffix);
+        }
+        return hostname === domain;
+    });
+}
+// ---------------------------------------------------------------------------
+// Public validator class
+// ---------------------------------------------------------------------------
+/** Stateless validator — create once and reuse across permission checks */
+export class PluginPermissionValidator {
+    permissions;
+    constructor(permissions) {
+        this.permissions = permissions;
+    }
+    // -------------------------------------------------------------------------
+    // Filesystem
+    // -------------------------------------------------------------------------
+    /** Check if the plugin may read a given file/directory path */
+    checkFileRead(path) {
+        const { read } = this.permissions.filesystem;
+        const violations = [];
+        if (read.length === 0) {
+            violations.push({
+                category: 'filesystem',
+                message: `No read patterns declared — read access denied for "${path}"`,
+                requested: path,
+                blocking: true,
+            });
+            return { granted: false, reason: `Filesystem read not declared`, violations };
+        }
+        if (!matchesAnyGlob(path, read)) {
+            violations.push({
+                category: 'filesystem',
+                message: `Path "${path}" does not match any declared read pattern`,
+                requested: path,
+                blocking: true,
+            });
+            return {
+                granted: false,
+                reason: `Path "${path}" outside declared read patterns`,
+                violations,
+            };
+        }
+        return { granted: true, violations: [] };
+    }
+    /** Check if the plugin may write to a given file/directory path */
+    checkFileWrite(path) {
+        const { write } = this.permissions.filesystem;
+        const violations = [];
+        if (write.length === 0) {
+            violations.push({
+                category: 'filesystem',
+                message: `No write patterns declared — write access denied for "${path}"`,
+                requested: path,
+                blocking: true,
+            });
+            return { granted: false, reason: `Filesystem write not declared`, violations };
+        }
+        if (!matchesAnyGlob(path, write)) {
+            violations.push({
+                category: 'filesystem',
+                message: `Path "${path}" does not match any declared write pattern`,
+                requested: path,
+                blocking: true,
+            });
+            return {
+                granted: false,
+                reason: `Path "${path}" outside declared write patterns`,
+                violations,
+            };
+        }
+        return { granted: true, violations: [] };
+    }
+    /** Check if the plugin may delete a given file/directory path */
+    checkFileDelete(path) {
+        const { delete: del } = this.permissions.filesystem;
+        const violations = [];
+        if (del.length === 0) {
+            violations.push({
+                category: 'filesystem',
+                message: `No delete patterns declared — delete access denied for "${path}"`,
+                requested: path,
+                blocking: true,
+            });
+            return { granted: false, reason: `Filesystem delete not declared`, violations };
+        }
+        if (!matchesAnyGlob(path, del)) {
+            violations.push({
+                category: 'filesystem',
+                message: `Path "${path}" does not match any declared delete pattern`,
+                requested: path,
+                blocking: true,
+            });
+            return {
+                granted: false,
+                reason: `Path "${path}" outside declared delete patterns`,
+                violations,
+            };
+        }
+        return { granted: true, violations: [] };
+    }
+    // -------------------------------------------------------------------------
+    // Network
+    // -------------------------------------------------------------------------
+    /**
+     * Check if the plugin may make a network request to the given hostname.
+     * Pass `url` as a full URL string (e.g. "https://api.github.com/repos/...").
+     */
+    checkNetworkRequest(url) {
+        const net = this.permissions.network;
+        const violations = [];
+        if (!net.allowed) {
+            violations.push({
+                category: 'network',
+                message: `Network access is not permitted`,
+                requested: url,
+                blocking: true,
+            });
+            return { granted: false, reason: `Network access disabled`, violations };
+        }
+        // Extract hostname from URL
+        let hostname;
+        try {
+            hostname = new URL(url).hostname;
+        }
+        catch {
+            violations.push({
+                category: 'network',
+                message: `Invalid URL: "${url}"`,
+                requested: url,
+                blocking: true,
+            });
+            return { granted: false, reason: `Invalid URL`, violations };
+        }
+        if (net.allowedDomains.length > 0 && !matchesDomain(hostname, net.allowedDomains)) {
+            violations.push({
+                category: 'network',
+                message: `Domain "${hostname}" is not in the allowed domains list`,
+                requested: url,
+                blocking: true,
+            });
+            return {
+                granted: false,
+                reason: `Domain "${hostname}" not in allowedDomains`,
+                violations,
+            };
+        }
+        return { granted: true, violations: [] };
+    }
+    // -------------------------------------------------------------------------
+    // Execution
+    // -------------------------------------------------------------------------
+    /** Check if the plugin may execute a given command */
+    checkCommandExecution(command) {
+        const exec = this.permissions.execution;
+        const violations = [];
+        if (!exec.allowShellCommands) {
+            // Shell commands entirely disabled
+            violations.push({
+                category: 'execution',
+                message: `Shell commands are not permitted`,
+                requested: command,
+                blocking: true,
+            });
+            return { granted: false, reason: 'Shell commands are not permitted', violations };
+        }
+        // Shell commands enabled — if allowedCommands is empty, allow all.
+        // If non-empty it acts as an explicit allowlist.
+        if (exec.allowedCommands.length === 0) {
+            return { granted: true, violations: [] };
+        }
+        const allowed = exec.allowedCommands.some((c) => {
+            // Match full command or just the executable basename
+            const executable = command.split(/\s+/)[0] ?? command;
+            return c === executable || c === command;
+        });
+        if (!allowed) {
+            violations.push({
+                category: 'execution',
+                message: `Command "${command}" is not in the execution allowlist`,
+                requested: command,
+                blocking: true,
+            });
+            return {
+                granted: false,
+                reason: `Command "${command}" not in allowedCommands`,
+                violations,
+            };
+        }
+        return { granted: true, violations: [] };
+    }
+    // -------------------------------------------------------------------------
+    // MCP
+    // -------------------------------------------------------------------------
+    /** Check if the plugin may call a given MCP server */
+    checkMcpAccess(serverName) {
+        const mcp = this.permissions.mcp;
+        const violations = [];
+        // Deny takes precedence
+        if (mcp.deniedServers.includes(serverName)) {
+            violations.push({
+                category: 'mcp',
+                message: `MCP server "${serverName}" is explicitly denied`,
+                requested: serverName,
+                blocking: true,
+            });
+            return { granted: false, reason: `MCP server "${serverName}" denied`, violations };
+        }
+        // Check allowlist (wildcard '*' allows all non-denied)
+        const granted = mcp.allowedServers.includes('*') || mcp.allowedServers.includes(serverName);
+        if (!granted) {
+            violations.push({
+                category: 'mcp',
+                message: `MCP server "${serverName}" is not in the allowed servers list`,
+                requested: serverName,
+                blocking: true,
+            });
+            return {
+                granted: false,
+                reason: `MCP server "${serverName}" not in allowedServers`,
+                violations,
+            };
+        }
+        return { granted: true, violations: [] };
+    }
+    // -------------------------------------------------------------------------
+    // Data
+    // -------------------------------------------------------------------------
+    /** Check if the plugin may access environment variables */
+    checkEnvAccess() {
+        const violations = [];
+        if (!this.permissions.data.allowEnvironmentVars) {
+            violations.push({
+                category: 'data',
+                message: `Environment variable access is not permitted`,
+                requested: 'process.env',
+                blocking: true,
+            });
+            return {
+                granted: false,
+                reason: `Environment variable access disabled`,
+                violations,
+            };
+        }
+        return { granted: true, violations: [] };
+    }
+    /** Check if the plugin may access secrets */
+    checkSecretAccess() {
+        const violations = [];
+        if (!this.permissions.data.allowSecretAccess) {
+            violations.push({
+                category: 'data',
+                message: `Secret access is not permitted`,
+                requested: 'secrets',
+                blocking: true,
+            });
+            return { granted: false, reason: `Secret access disabled`, violations };
+        }
+        return { granted: true, violations: [] };
+    }
+}
+//# sourceMappingURL=plugin-permission-validator.js.map

package/dist/ai/src/plugins/permissions/plugin-permission-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-permission-validator.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/permissions/plugin-permission-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAOxC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,cAAc,CAAC,IAAY,EAAE,QAAkB;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,cAAwB;IAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAChE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACpC,mEAAmE;QACnE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc;YAC9C,OAAO,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,QAAQ,KAAK,MAAM,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,WAA8B;QAA9B,gBAAW,GAAX,WAAW,CAAmB;IAAG,CAAC;IAE/D,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E,+DAA+D;IAC/D,aAAa,CAAC,IAAY;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;QAC7C,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,uDAAuD,IAAI,GAAG;gBACvE,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,UAAU,EAAE,CAAC;QAChF,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,SAAS,IAAI,4CAA4C;gBAClE,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,IAAI,kCAAkC;gBACvD,UAAU;aACX,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,mEAAmE;IACnE,cAAc,CAAC,IAAY;QACzB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;QAC9C,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,yDAAyD,IAAI,GAAG;gBACzE,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,UAAU,EAAE,CAAC;QACjF,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,SAAS,IAAI,6CAA6C;gBACnE,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,IAAI,mCAAmC;gBACxD,UAAU;aACX,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,eAAe,CAAC,IAAY;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;QACpD,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,2DAA2D,IAAI,GAAG;gBAC3E,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,UAAU,EAAE,CAAC;QAClF,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,SAAS,IAAI,8CAA8C;gBACpE,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,IAAI,oCAAoC;gBACzD,UAAU;aACX,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E;;;OAGG;IACH,mBAAmB,CAAC,GAAW;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;QACrC,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,iCAAiC;gBAC1C,SAAS,EAAE,GAAG;gBACd,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC;QAC3E,CAAC;QAED,4BAA4B;QAC5B,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,iBAAiB,GAAG,GAAG;gBAChC,SAAS,EAAE,GAAG;gBACd,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;QAC/D,CAAC;QAED,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAClF,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,WAAW,QAAQ,sCAAsC;gBAClE,SAAS,EAAE,GAAG;gBACd,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,WAAW,QAAQ,yBAAyB;gBACpD,UAAU;aACX,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,sDAAsD;IACtD,qBAAqB,CAAC,OAAe;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QACxC,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,mCAAmC;YACnC,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,WAAW;gBACrB,OAAO,EAAE,kCAAkC;gBAC3C,SAAS,EAAE,OAAO;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC;QACpF,CAAC;QAED,mEAAmE;QACnE,iDAAiD;QACjD,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9C,qDAAqD;YACrD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;YACtD,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,OAAO,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,WAAW;gBACrB,OAAO,EAAE,YAAY,OAAO,qCAAqC;gBACjE,SAAS,EAAE,OAAO;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,OAAO,0BAA0B;gBACrD,UAAU;aACX,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,4EAA4E;IAC5E,MAAM;IACN,4EAA4E;IAE5E,sDAAsD;IACtD,cAAc,CAAC,UAAkB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QACjC,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,wBAAwB;QACxB,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,eAAe,UAAU,wBAAwB;gBAC1D,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,UAAU,UAAU,EAAE,UAAU,EAAE,CAAC;QACrF,CAAC;QAED,uDAAuD;QACvD,MAAM,OAAO,GACX,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,eAAe,UAAU,sCAAsC;gBACxE,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,eAAe,UAAU,yBAAyB;gBAC1D,UAAU;aACX,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,4EAA4E;IAC5E,OAAO;IACP,4EAA4E;IAE5E,2DAA2D;IAC3D,cAAc;QACZ,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,8CAA8C;gBACvD,SAAS,EAAE,aAAa;gBACxB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,sCAAsC;gBAC9C,UAAU;aACX,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,6CAA6C;IAC7C,iBAAiB;QACf,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,gCAAgC;gBACzC,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;CACF"}

package/dist/ai/src/plugins/permissions/types.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Plugin Permission Model Types
+ *
+ * Capability-based permission model for plugin sandboxing. Follows
+ * least-privilege (OWASP ASVS 4.0) and is compatible with the
+ * delegation security framework.
+ *
+ * @module plugins/permissions/types
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+/** Filesystem access permissions — controlled by glob patterns */
+export interface FilesystemPermissions {
+    /** Glob patterns the plugin may read */
+    read: string[];
+    /** Glob patterns the plugin may write to */
+    write: string[];
+    /** Glob patterns the plugin may delete */
+    delete: string[];
+}
+/** Network access permissions */
+export interface NetworkPermissions {
+    /** Whether any outbound network access is allowed */
+    allowed: boolean;
+    /** Allowlist of hostnames/domains (empty = allow all when allowed:true) */
+    allowedDomains: string[];
+    /** Maximum HTTP requests per plugin execution (0 = unlimited when allowed:true) */
+    maxRequests: number;
+}
+/** Shell/process execution permissions */
+export interface ExecutionPermissions {
+    /** Whether arbitrary shell commands can be spawned */
+    allowShellCommands: boolean;
+    /**
+     * Allowlist of executable names the plugin may run.
+     * Only enforced when allowShellCommands:false.
+     */
+    allowedCommands: string[];
+    /** Maximum concurrent child processes (0 = no limit) */
+    maxProcesses: number;
+}
+/** MCP server access permissions */
+export interface McpPermissions {
+    /** Names of MCP servers the plugin is allowed to call */
+    allowedServers: string[];
+    /** Names of MCP servers explicitly denied (takes precedence over allowedServers) */
+    deniedServers: string[];
+}
+/** Data / environment access permissions */
+export interface DataPermissions {
+    /** Whether the plugin may read process.env */
+    allowEnvironmentVars: boolean;
+    /** Whether the plugin may access secrets (e.g. from a vault) */
+    allowSecretAccess: boolean;
+}
+/** Full set of permissions declared by a plugin */
+export interface PluginPermissions {
+    filesystem: FilesystemPermissions;
+    network: NetworkPermissions;
+    execution: ExecutionPermissions;
+    mcp: McpPermissions;
+    data: DataPermissions;
+}
+/** A single permission violation */
+export interface PermissionViolation {
+    /** Permission category that was violated */
+    category: keyof PluginPermissions;
+    /** Human-readable description of the violation */
+    message: string;
+    /** The requested resource/action */
+    requested: string;
+    /** Whether the violation is blocking (true) or a warning (false) */
+    blocking: boolean;
+}
+/** Result of validating a permission request */
+export interface PermissionCheckResult {
+    /** Whether the permission is granted */
+    granted: boolean;
+    /** Reason for denial if granted:false */
+    reason?: string;
+    violations: PermissionViolation[];
+}
+/**
+ * Express that a set of permissions is a strict subset of a parent set.
+ * Used when a plugin delegates to sub-agents — the sub-agent can only receive
+ * permissions the parent already holds.
+ */
+export interface AttenuatedPermissions {
+    /** Original granted permissions */
+    original: PluginPermissions;
+    /** Attenuated (narrowed) permissions to pass to sub-agent */
+    attenuated: PluginPermissions;
+    /** Human-readable description of what was removed */
+    removedCapabilities: string[];
+}
+/** Categories of permission audit events */
+export type PermissionAuditEventType = 'permission_granted' | 'permission_denied' | 'permission_attenuated' | 'enforcement_violation';
+/** Structured audit event for a permission decision */
+export interface PermissionAuditEvent {
+    timestamp: string;
+    eventType: PermissionAuditEventType;
+    pluginId: string;
+    pluginVersion: string;
+    category: keyof PluginPermissions;
+    action: string;
+    resource: string;
+    granted: boolean;
+    reason?: string;
+    executionId?: string;
+}
+/** Create a fully-locked-down permission set (deny everything) */
+export declare function createDenyAllPermissions(): PluginPermissions;
+/** Create a maximally-permissive permission set (allow everything) */
+export declare function createAllowAllPermissions(): PluginPermissions;
+//# sourceMappingURL=types.d.ts.map

package/dist/ai/src/plugins/permissions/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/permissions/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4CAA4C;IAC5C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,iCAAiC;AACjC,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oFAAoF;IACpF,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gEAAgE;IAChE,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAMD,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,qBAAqB,CAAC;IAClC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,SAAS,EAAE,oBAAoB,CAAC;IAChC,GAAG,EAAE,cAAc,CAAC;IACpB,IAAI,EAAE,eAAe,CAAC;CACvB;AAMD,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IAClC,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,iBAAiB,CAAC;IAClC,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAMD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,6DAA6D;IAC7D,UAAU,EAAE,iBAAiB,CAAC;IAC9B,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAMD,4CAA4C;AAC5C,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,mBAAmB,GACnB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,wBAAwB,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,iBAAiB,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,kEAAkE;AAClE,wBAAgB,wBAAwB,IAAI,iBAAiB,CAQ5D;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,IAAI,iBAAiB,CAQ7D"}

package/dist/ai/src/plugins/permissions/types.js

@@ -0,0 +1,36 @@
+/**
+ * Plugin Permission Model Types
+ *
+ * Capability-based permission model for plugin sandboxing. Follows
+ * least-privilege (OWASP ASVS 4.0) and is compatible with the
+ * delegation security framework.
+ *
+ * @module plugins/permissions/types
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+// ---------------------------------------------------------------------------
+// Default / zero-permission factories
+// ---------------------------------------------------------------------------
+/** Create a fully-locked-down permission set (deny everything) */
+export function createDenyAllPermissions() {
+    return {
+        filesystem: { read: [], write: [], delete: [] },
+        network: { allowed: false, allowedDomains: [], maxRequests: 0 },
+        execution: { allowShellCommands: false, allowedCommands: [], maxProcesses: 0 },
+        mcp: { allowedServers: [], deniedServers: [] },
+        data: { allowEnvironmentVars: false, allowSecretAccess: false },
+    };
+}
+/** Create a maximally-permissive permission set (allow everything) */
+export function createAllowAllPermissions() {
+    return {
+        filesystem: { read: ['**'], write: ['**'], delete: ['**'] },
+        network: { allowed: true, allowedDomains: [], maxRequests: 0 },
+        execution: { allowShellCommands: true, allowedCommands: [], maxProcesses: 0 },
+        mcp: { allowedServers: ['*'], deniedServers: [] },
+        data: { allowEnvironmentVars: true, allowSecretAccess: true },
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/ai/src/plugins/permissions/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/permissions/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwIH,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E,kEAAkE;AAClE,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/C,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;QAC/D,SAAS,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE;QAC9E,GAAG,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;QAC9C,IAAI,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE;KAChE,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;QAC3D,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;QAC9D,SAAS,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE;QAC7E,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;QACjD,IAAI,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;KAC9D,CAAC;AACJ,CAAC"}

package/dist/ai/src/plugins/reputation/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Plugin Reputation — barrel export
+ *
+ * @module plugins/reputation
+ */
+export { PluginReputationEngine } from './plugin-reputation-engine.js';
+export { openReputationDb, getSchemaVersion, DEFAULT_DB_PATH } from './plugin-reputation-db.js';
+export type { PluginReputationEngineConfig, PluginReputationRecord, PluginIncidentRecord, PluginAuditRecord, PluginScoreResult, TopPluginResult, UpsertScanInput, PluginTrustScore, AuditEventType, IncidentSeverity, RegistryReputationEntry, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/ai/src/plugins/reputation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/reputation/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChG,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,YAAY,CAAC"}

package/dist/ai/src/plugins/reputation/index.js

@@ -0,0 +1,8 @@
+/**
+ * Plugin Reputation — barrel export
+ *
+ * @module plugins/reputation
+ */
+export { PluginReputationEngine } from './plugin-reputation-engine.js';
+export { openReputationDb, getSchemaVersion, DEFAULT_DB_PATH } from './plugin-reputation-db.js';
+//# sourceMappingURL=index.js.map

package/dist/ai/src/plugins/reputation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/reputation/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/ai/src/plugins/reputation/plugin-reputation-db.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Plugin Reputation Database
+ *
+ * SQLite schema initialisation and low-level helpers.
+ * Uses better-sqlite3 (already a dependency of @dcyfr/ai).
+ *
+ * Schema:
+ *   plugins   — one row per plugin; stores latest trust score + metadata
+ *   incidents — security / compliance incidents (N per plugin)
+ *   audits    — append-only event log (N per plugin)
+ *
+ * @module plugins/reputation/plugin-reputation-db
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import Database from 'better-sqlite3';
+export declare const DEFAULT_DB_PATH: string;
+/**
+ * Open (or create) the plugin reputation SQLite database.
+ * Creates parent directories if they don't exist.
+ */
+export declare function openReputationDb(dbPath?: string): Database.Database;
+/**
+ * Return the schema version recorded in the DB.
+ * Returns 0 if the table is empty (fresh database).
+ */
+export declare function getSchemaVersion(db: Database.Database): number;
+//# sourceMappingURL=plugin-reputation-db.d.ts.map

package/dist/ai/src/plugins/reputation/plugin-reputation-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-reputation-db.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/reputation/plugin-reputation-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAStC,eAAO,MAAM,eAAe,QAAuD,CAAC;AA+EpF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,MAAwB,GAAG,QAAQ,CAAC,QAAQ,CASpF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAK9D"}

package/dist/ai/src/plugins/reputation/plugin-reputation-db.js

@@ -0,0 +1,120 @@
+/**
+ * Plugin Reputation Database
+ *
+ * SQLite schema initialisation and low-level helpers.
+ * Uses better-sqlite3 (already a dependency of @dcyfr/ai).
+ *
+ * Schema:
+ *   plugins   — one row per plugin; stores latest trust score + metadata
+ *   incidents — security / compliance incidents (N per plugin)
+ *   audits    — append-only event log (N per plugin)
+ *
+ * @module plugins/reputation/plugin-reputation-db
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import Database from 'better-sqlite3';
+import { mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { homedir } from 'node:os';
+// ---------------------------------------------------------------------------
+// Default path
+// ---------------------------------------------------------------------------
+export const DEFAULT_DB_PATH = resolve(homedir(), '.dcyfr', 'plugin-reputation.db');
+// ---------------------------------------------------------------------------
+// Schema DDL
+// ---------------------------------------------------------------------------
+const SCHEMA_SQL = /* sql */ `
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+
+-- ── plugins ────────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS plugins (
+  plugin_id            TEXT     PRIMARY KEY,
+  name                 TEXT     NOT NULL,
+  version              TEXT     NOT NULL,
+  capabilities_json    TEXT     NOT NULL DEFAULT '[]',
+  trust_score          REAL     NOT NULL DEFAULT 0,
+  trust_dimensions_json TEXT    NOT NULL DEFAULT '{}',
+  last_scanned_at      TEXT     NOT NULL,
+  scan_count           INTEGER  NOT NULL DEFAULT 0,
+  approved_at          TEXT,
+  registry_source      TEXT     NOT NULL DEFAULT 'local'
+                       CHECK (registry_source IN ('local', 'registry')),
+  created_at           TEXT     NOT NULL,
+  updated_at           TEXT     NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_plugins_trust_score
+  ON plugins (trust_score DESC);
+
+CREATE INDEX IF NOT EXISTS idx_plugins_last_scanned
+  ON plugins (last_scanned_at);
+
+-- ── incidents ──────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS incidents (
+  id           INTEGER  PRIMARY KEY AUTOINCREMENT,
+  plugin_id    TEXT     NOT NULL REFERENCES plugins (plugin_id) ON DELETE CASCADE,
+  severity     TEXT     NOT NULL
+               CHECK (severity IN ('critical', 'high', 'medium', 'low', 'info')),
+  description  TEXT     NOT NULL,
+  detected_at  TEXT     NOT NULL,
+  resolved_at  TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_incidents_plugin_id
+  ON incidents (plugin_id);
+
+CREATE INDEX IF NOT EXISTS idx_incidents_severity
+  ON incidents (severity);
+
+-- ── audits ─────────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS audits (
+  id              INTEGER  PRIMARY KEY AUTOINCREMENT,
+  plugin_id       TEXT     NOT NULL,
+  event_type      TEXT     NOT NULL,
+  event_data_json TEXT     NOT NULL DEFAULT '{}',
+  created_at      TEXT     NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_audits_plugin_id
+  ON audits (plugin_id);
+
+CREATE INDEX IF NOT EXISTS idx_audits_event_type
+  ON audits (event_type);
+
+-- ── schema_version ─────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS schema_version (
+  version INTEGER NOT NULL,
+  applied_at TEXT NOT NULL
+);
+
+INSERT OR IGNORE INTO schema_version (version, applied_at)
+  VALUES (1, datetime('now'));
+`;
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Open (or create) the plugin reputation SQLite database.
+ * Creates parent directories if they don't exist.
+ */
+export function openReputationDb(dbPath = DEFAULT_DB_PATH) {
+    if (dbPath !== ':memory:') {
+        const dir = dirname(dbPath);
+        mkdirSync(dir, { recursive: true });
+    }
+    const db = new Database(dbPath);
+    db.exec(SCHEMA_SQL);
+    return db;
+}
+/**
+ * Return the schema version recorded in the DB.
+ * Returns 0 if the table is empty (fresh database).
+ */
+export function getSchemaVersion(db) {
+    const row = db.prepare('SELECT version FROM schema_version ORDER BY version DESC LIMIT 1').get();
+    return row?.version ?? 0;
+}
+//# sourceMappingURL=plugin-reputation-db.js.map

package/dist/ai/src/plugins/reputation/plugin-reputation-db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-reputation-db.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/reputation/plugin-reputation-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;AAEpF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,UAAU,GAAG,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmE5B,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,eAAe;IAC/D,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAqB;IACpD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,kEAAkE,CACnE,CAAC,GAAG,EAAqC,CAAC;IAC3C,OAAO,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;AAC3B,CAAC"}