@elizaos/plugin-trust 1.2.1 → 2.0.0-alpha.1

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,iDAAoB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWxB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ1B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQhC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW7B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS5B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOxB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO/B,CAAC"}

package/dist/services/ContextualPermissionSystem.d.ts

@@ -0,0 +1,40 @@
+import { type IAgentRuntime, type UUID } from "@elizaos/core";
+import type { AccessDecision, AccessRequest, ElevationRequest, ElevationResult, Permission, PermissionContext, PermissionDelegation } from "../types/permissions";
+import type { SecurityModule } from "./SecurityModule";
+import type { TrustEngine } from "./TrustEngine";
+export declare class ContextualPermissionSystem {
+    private runtime;
+    private trustEngine;
+    private securityModule;
+    private permissionCache;
+    private elevations;
+    private delegations;
+    private static readonly ROLE_PERMISSIONS;
+    private static readonly TRUST_ACTION_THRESHOLDS;
+    private static readonly TRUST_ONLY_ACTIONS;
+    private static readonly ADMIN_ONLY_ACTIONS;
+    initialize(runtime: IAgentRuntime, trustEngine: TrustEngine, securityModule: SecurityModule): Promise<void>;
+    hasPermission(entityId: UUID, permission: Permission, context: PermissionContext): Promise<boolean>;
+    checkAccess(request: AccessRequest): Promise<AccessDecision>;
+    private checkRolePermissions;
+    private checkTrustPermissions;
+    private checkDelegatedPermissions;
+    requestElevation(request: ElevationRequest): Promise<ElevationResult>;
+    /**
+     * Check if the entity has an active (non-expired) elevation grant for the requested action.
+     */
+    private checkActiveElevations;
+    /**
+     * Create a delegation granting another entity specific permissions.
+     */
+    addDelegation(delegation: PermissionDelegation): void;
+    /**
+     * Revoke a delegation by ID.
+     */
+    revokeDelegation(delegationId: UUID, revokedBy: UUID): boolean;
+    private createDecision;
+    private roleHasPermission;
+    private getEntityRoles;
+    private generateDenialReason;
+}
+//# sourceMappingURL=ContextualPermissionSystem.d.ts.map

package/dist/services/ContextualPermissionSystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContextualPermissionSystem.d.ts","sourceRoot":"","sources":["../../src/services/ContextualPermissionSystem.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAIlB,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,eAAe,EAEf,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,qBAAa,0BAA0B;IACrC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,cAAc,CAAkB;IAExC,OAAO,CAAC,eAAe,CAAmE;IAC1F,OAAO,CAAC,UAAU,CAA+D;IACjF,OAAO,CAAC,WAAW,CAA2C;IAE9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAsBtC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAM7C;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAMvC;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAMvC;IAEG,UAAU,CACd,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,IAAI,CAAC;IAMV,aAAa,CACjB,QAAQ,EAAE,IAAI,EACd,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,OAAO,CAAC;IAUb,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;YAsDpD,oBAAoB;YAkBpB,qBAAqB;YAuCrB,yBAAyB;IA2BjC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAkD3E;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI;IAcrD;;OAEG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO;IAa9D,OAAO,CAAC,cAAc;IAsBtB,OAAO,CAAC,iBAAiB;YAMX,cAAc;IAQ5B,OAAO,CAAC,oBAAoB;CAO7B"}

package/dist/services/CredentialProtector.d.ts

@@ -0,0 +1,62 @@
+import { type IAgentRuntime, Service, type UUID } from "@elizaos/core";
+import { type SecurityContext } from "../types/security";
+import type { SecurityModule } from "./SecurityModule";
+export interface CredentialThreatDetection {
+    detected: boolean;
+    confidence: number;
+    threatType: "credential_request" | "phishing" | "social_engineering" | "prompt_injection" | "none";
+    sensitiveData: string[];
+    recommendation: string;
+}
+export declare class CredentialProtector extends Service {
+    static serviceType: "credential-protector";
+    capabilityDescription: string;
+    private securityModule;
+    private readonly keywordPatternCache;
+    private static normalizeForScan;
+    private static reverseString;
+    private readonly SENSITIVE_PATTERNS;
+    private readonly SENSITIVE_KEYWORDS;
+    private readonly THEFT_REQUEST_PATTERNS;
+    private readonly PROMPT_INJECTION_PATTERNS;
+    private readonly LEGITIMATE_CONTEXTS;
+    initialize(_runtime: IAgentRuntime, securityModule: SecurityModule): Promise<void>;
+    stop(): Promise<void>;
+    static start(runtime: IAgentRuntime): Promise<Service>;
+    /**
+     * Scan message for credential theft attempts
+     */
+    scanForCredentialTheft(message: string, entityId: UUID, context: SecurityContext): Promise<CredentialThreatDetection>;
+    /**
+     * Protect sensitive data by redacting it
+     */
+    protectSensitiveData(content: string): Promise<string>;
+    /**
+     * Alert potential victims of credential theft
+     */
+    alertPotentialVictims(threatActor: UUID, victims: UUID[], threatDetails: CredentialThreatDetection): Promise<void>;
+    /**
+     * Analyze a conversation for credential theft patterns
+     */
+    analyzeConversation(messages: Array<{
+        entityId: UUID;
+        content: string;
+        timestamp: number;
+    }>, context: SecurityContext): Promise<{
+        overallThreat: number;
+        suspiciousEntities: UUID[];
+        recommendations: string[];
+    }>;
+    /**
+     * Private helper methods
+     */
+    private detectSensitiveData;
+    private hasTheftRequest;
+    private hasPromptInjectionPattern;
+    private isLegitimateContext;
+    private hasPhishingIndicators;
+    private getKeywordPattern;
+    private containsKeywordVariant;
+    private logThreatEvent;
+}
+//# sourceMappingURL=CredentialProtector.d.ts.map

package/dist/services/CredentialProtector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialProtector.d.ts","sourceRoot":"","sources":["../../src/services/CredentialProtector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAU,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,KAAK,eAAe,EAAqB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EACN,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,GAClB,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,mBAAoB,SAAQ,OAAO;IAC9C,MAAM,CAAC,WAAW,EAAG,sBAAsB,CAAU;IAErD,qBAAqB,SAA6E;IAElG,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IAEjE,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B,OAAO,CAAC,MAAM,CAAC,aAAa;IAK5B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAwCjC;IAGF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAkCjC;IAGF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAcrC;IAEF,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAWxC;IAGF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAUlC;IAEI,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;WAId,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAa5D;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,yBAAyB,CAAC;IAmErC;;OAEG;IACG,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0B5D;;OAEG;IACG,qBAAqB,CACzB,WAAW,EAAE,IAAI,EACjB,OAAO,EAAE,IAAI,EAAE,EACf,aAAa,EAAE,yBAAyB,GACvC,OAAO,CAAC,IAAI,CAAC;IA2BhB;;OAEG;IACG,mBAAmB,CACvB,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EACvE,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IAgDF;;OAEG;IAEH,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,eAAe;IA+BvB,OAAO,CAAC,yBAAyB;IAwBjC,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,sBAAsB;YA+BhB,cAAc;CAqB7B"}

package/dist/services/SecurityModule.d.ts

@@ -0,0 +1,145 @@
+import { type IAgentRuntime, type UUID } from "@elizaos/core";
+import { type Action, type CoordinationDetection, type CredentialTheftDetection, type ImpersonationDetection, type Message, type MultiAccountDetection, type PhishingDetection, type SecurityCheck, type SecurityContext, type SecurityEvent, SecurityEventType, type ThreatAssessment } from "../types/security";
+import type { TrustEngine } from "./TrustEngine";
+export interface RiskScore {
+    score: number;
+    factors: Record<string, number>;
+    recommendation: string;
+}
+export interface SocialEngineeringFactors {
+    urgency: number;
+    authority: number;
+    intimidation: number;
+    liking: number;
+    reciprocity: number;
+    commitment: number;
+    socialProof: number;
+    scarcity: number;
+}
+export declare class SecurityModule {
+    private runtime;
+    private trustEngine;
+    private behavioralProfiles;
+    private messageHistory;
+    private actionHistory;
+    private keywordPatternCache;
+    private readonly INJECTION_PATTERNS;
+    private readonly INJECTION_KEYWORDS;
+    private readonly URGENCY_KEYWORDS;
+    private readonly AUTHORITY_KEYWORDS;
+    private readonly INTIMIDATION_KEYWORDS;
+    private readonly CREDENTIAL_PATTERNS;
+    private readonly SENSITIVE_KEYWORDS;
+    private readonly PHISHING_INDICATORS;
+    /**
+     * Initialize the security module
+     */
+    initialize(runtime: IAgentRuntime, trustEngine: TrustEngine): Promise<void>;
+    /**
+     * Detect prompt injection attempts
+     */
+    detectPromptInjection(message: string, context: SecurityContext): Promise<SecurityCheck>;
+    /**
+     * Detect social engineering attempts
+     */
+    detectSocialEngineering(message: string, context: SecurityContext): Promise<SecurityCheck>;
+    /**
+     * Analyze a message for security threats
+     */
+    analyzeMessage(message: string, entityId: UUID, context: SecurityContext): Promise<SecurityCheck>;
+    /**
+     * Assess overall threat level
+     */
+    assessThreatLevel(context: SecurityContext): Promise<ThreatAssessment>;
+    /**
+     * Get recent security incidents
+     */
+    getRecentSecurityIncidents(_roomId?: UUID, hours?: number): Promise<SecurityEvent[]>;
+    /**
+     * Get security recommendations based on threat level
+     */
+    getSecurityRecommendations(threatLevel: number): string[];
+    /**
+     * Log security event (now public)
+     */
+    logSecurityEvent(event: Omit<SecurityEvent, "id" | "timestamp" | "handled">): Promise<void>;
+    /**
+     * Analyze social engineering factors
+     */
+    private analyzeSocialEngineeringFactors;
+    /**
+     * Calculate keyword score
+     */
+    private calculateKeywordScore;
+    private static readonly SE_FACTOR_PHRASES;
+    private detectFactorScore;
+    /**
+     * Calculate overall social engineering risk
+     */
+    private calculateSocialEngineeringRisk;
+    /**
+     * Analyze semantic patterns
+     */
+    private analyzeSemantics;
+    private normalizeForScan;
+    private reverseString;
+    private getKeywordPattern;
+    private containsObfuscatedKeyword;
+    private detectObfuscatedKeywordMatches;
+    /**
+     * Log trust impact from security events
+     */
+    logTrustImpact(entityId: UUID, event: SecurityEventType, impact: number, context?: {
+        worldId?: UUID;
+    }): Promise<void>;
+    /**
+     * Maps security events to trust evidence types
+     */
+    private mapSecurityEventToTrustEvidence;
+    /**
+     * Enhanced pattern detection capabilities
+     */
+    /**
+     * Detect multi-account manipulation
+     */
+    detectMultiAccountPattern(entities: UUID[], timeWindow?: number): Promise<MultiAccountDetection | null>;
+    /**
+     * Detect credential theft attempts
+     */
+    detectCredentialTheft(message: string, entityId: UUID, context: SecurityContext): Promise<CredentialTheftDetection | null>;
+    /**
+     * Detect phishing campaigns
+     */
+    detectPhishing(messages: Message[], entityId: UUID): Promise<PhishingDetection | null>;
+    /**
+     * Detect impersonation attempts
+     */
+    detectImpersonation(username: string, existingUsers: string[]): Promise<ImpersonationDetection | null>;
+    /**
+     * Detect coordinated activity
+     */
+    detectCoordinatedActivity(entities: UUID[], timeWindow?: number): Promise<CoordinationDetection | null>;
+    /**
+     * Helper methods for pattern detection
+     */
+    private getBehavioralProfiles;
+    private buildBehavioralProfile;
+    private calculateProfileSimilarities;
+    private calculateVariance;
+    private checkSynchronizedActions;
+    private getRecentActions;
+    private detectSuspiciousLinks;
+    private extractLinks;
+    private calculateStringSimilarity;
+    private calculateVisualSimilarity;
+    private levenshteinDistance;
+    /**
+     * Store message for analysis
+     */
+    storeMessage(message: Message): Promise<void>;
+    /**
+     * Store action for analysis
+     */
+    storeAction(action: Action): Promise<void>;
+}
+//# sourceMappingURL=SecurityModule.d.ts.map

package/dist/services/SecurityModule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityModule.d.ts","sourceRoot":"","sources":["../../src/services/SecurityModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAU,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,KAAK,MAAM,EAEX,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,OAAO,EACZ,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,EACjB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,kBAAkB,CAA2C;IACrE,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,mBAAmB,CAA6B;IAGxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CA0BjC;IAGF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAgBjC;IAGF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAU/B;IAEF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAUjC;IAEF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAUpC;IAGF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAgBlC;IAGF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CA4BjC;IAGF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAUlC;IAEF;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjF;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAoD9F;;OAEG;IACG,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAgDhG;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,aAAa,CAAC;IAgDzB;;OAEG;IACG,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA+B5E;;OAEG;IACG,0BAA0B,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAsBtF;;OAEG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE;IAwBzD;;OAEG;IACG,gBAAgB,CACpB,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,GAAG,SAAS,CAAC,GACzD,OAAO,CAAC,IAAI,CAAC;IAyBhB;;OAEG;IACH,OAAO,CAAC,+BAA+B;IAavC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAM7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAmCvC;IAEF,OAAO,CAAC,iBAAiB;IAKzB;;OAEG;IACH,OAAO,CAAC,8BAA8B;IAwCtC;;OAEG;YACW,gBAAgB;IAsB9B,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,yBAAyB;IA2BjC,OAAO,CAAC,8BAA8B;IAItC;;OAEG;IACG,cAAc,CAClB,QAAQ,EAAE,IAAI,EACd,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,IAAI,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC;IAsBhB;;OAEG;IACH,OAAO,CAAC,+BAA+B;IAmBvC;;OAEG;IAEH;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,IAAI,EAAE,EAChB,UAAU,GAAE,MAAgB,GAC3B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAiDxC;;OAEG;IACG,qBAAqB,CACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAgE3C;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAyC5F;;OAEG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IA+CzC;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,IAAI,EAAE,EAChB,UAAU,GAAE,MAAe,GAC1B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAqDxC;;OAEG;YAEW,qBAAqB;YAerB,sBAAsB;IAqDpC,OAAO,CAAC,4BAA4B;IA2BpC,OAAO,CAAC,iBAAiB;YAKX,wBAAwB;YAkCxB,gBAAgB;IAY9B,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,yBAAyB;IA+DjC,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAanD;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYjD"}

package/dist/services/SecurityStore.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Data access layer for plugin-trust schema tables.
+ * Thin wrappers around Drizzle queries for security incidents,
+ * trust evidence, behavioral profiles, identity links, and whistleblower reports.
+ */
+import type { UUID } from "@elizaos/core";
+import type { DrizzleDB } from "./db";
+export interface InsertSecurityIncident {
+    entityId: UUID;
+    type: string;
+    severity: string;
+    context?: Record<string, unknown>;
+    details?: Record<string, unknown>;
+}
+export declare function insertSecurityIncident(db: DrizzleDB, incident: InsertSecurityIncident): Promise<void>;
+export declare function getRecentIncidents(db: DrizzleDB, roomId?: UUID, hours?: number): Promise<Array<Record<string, unknown>>>;
+export interface InsertTrustEvidence {
+    targetEntityId: UUID;
+    sourceEntityId: UUID;
+    evaluatorId: UUID;
+    type: string;
+    impact: number;
+    weight?: number;
+    description?: string;
+    verified?: boolean;
+    context?: Record<string, unknown>;
+}
+export declare function insertTrustEvidence(db: DrizzleDB, evidence: InsertTrustEvidence): Promise<void>;
+export declare function getTrustEvidence(db: DrizzleDB, entityId: UUID, evaluatorId?: UUID): Promise<Array<Record<string, unknown>>>;
+export interface UpsertBehavioralProfile {
+    entityId: UUID;
+    typingSpeed?: number;
+    vocabularyComplexity?: number;
+    messageLengthMean?: number;
+    messageLengthStdDev?: number;
+    activeHours?: number[];
+    commonPhrases?: string[];
+    interactionPatterns?: Record<string, number>;
+}
+export declare function upsertBehavioralProfile(db: DrizzleDB, profile: UpsertBehavioralProfile): Promise<void>;
+export declare function getBehavioralProfile(db: DrizzleDB, entityId: UUID): Promise<Record<string, unknown> | null>;
+export declare function insertIdentityLink(db: DrizzleDB, link: {
+    entityIdA: UUID;
+    entityIdB: UUID;
+    confidence: number;
+    evidence?: string[];
+}): Promise<void>;
+export declare function getIdentityLinks(db: DrizzleDB, entityId: UUID): Promise<Array<Record<string, unknown>>>;
+export declare function insertWhistleblowerReport(db: DrizzleDB, report: {
+    reportedEntityId: UUID;
+    evidence: Record<string, unknown>;
+}): Promise<void>;
+//# sourceMappingURL=SecurityStore.d.ts.map

package/dist/services/SecurityStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityStore.d.ts","sourceRoot":"","sources":["../../src/services/SecurityStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAS1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAItC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,MAAM,CAAC,EAAE,IAAI,EACb,KAAK,SAAK,GACT,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAiBzC;AAID,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,IAAI,CAAC;IACrB,cAAc,EAAE,IAAI,CAAC;IACrB,WAAW,EAAE,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,IAAI,EACd,WAAW,CAAC,EAAE,IAAI,GACjB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAazC;AAID,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,IAAI,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,IAAI,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAQzC;AAID,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAClF,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,IAAI,GACb,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAMzC;AAID,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE;IAAE,gBAAgB,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACpE,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/services/TrustEngine.d.ts

@@ -0,0 +1,81 @@
+import { type IAgentRuntime, Service, type UUID } from "@elizaos/core";
+import { type TrustCalculationConfig, type TrustContext, type TrustDecision, type TrustInteraction, type TrustProfile, type TrustRequirements } from "../types/trust";
+export declare class TrustEngine extends Service {
+    static serviceType: "trust-engine";
+    capabilityDescription: string;
+    private static readonly ACTION_CONTEXT_WEIGHTS;
+    private trustConfig;
+    private profileCache;
+    private readonly cacheTimeout;
+    private readonly maxInteractionsInMemory;
+    private interactions;
+    private rateLimits;
+    private readonly maxEvidencePerHour;
+    constructor(config?: Partial<TrustCalculationConfig>);
+    initialize(runtime: IAgentRuntime): Promise<void>;
+    stop(): Promise<void>;
+    static start(runtime: IAgentRuntime): Promise<Service>;
+    /**
+     * Calculate trust profile for an entity
+     */
+    calculateTrust(subjectId: UUID, context: TrustContext): Promise<TrustProfile>;
+    /**
+     * Records a trust interaction
+     */
+    recordInteraction(interaction: TrustInteraction): Promise<void>;
+    /**
+     * Evaluate if an action is allowed based on trust
+     */
+    evaluateTrustDecision(entityId: UUID, requirements: TrustRequirements, context: TrustContext): Promise<TrustDecision>;
+    /**
+     * Check rate limiting for evidence recording
+     */
+    private static readonly DIMINISHING_WEIGHTS;
+    private checkRateLimit;
+    /**
+     * Calculate trust dimensions from evidence
+     */
+    private calculateDimensions;
+    /**
+     * Calculate overall trust score from dimensions
+     */
+    private calculateOverallTrust;
+    /**
+     * Calculate confidence based on evidence quantity and consistency
+     */
+    private calculateConfidence;
+    /**
+     * Calculate age weight for evidence based on recency
+     */
+    private calculateAgeWeight;
+    /**
+     * Analyze trust trend over time
+     */
+    private analyzeTrend;
+    /**
+     * Load evidence from storage
+     */
+    private loadEvidence;
+    /**
+     * Save trust profile to storage
+     */
+    private saveTrustProfile;
+    /**
+     * Generate suggestions for building trust
+     */
+    private generateTrustBuildingSuggestions;
+    /**
+     * Generate suggestions for improving specific dimensions
+     */
+    private generateDimensionSuggestions;
+    /**
+     * Evaluates trust for an entity (simplified API for actions)
+     */
+    evaluateTrust(entityId: UUID, evaluatorId: UUID, context?: Partial<TrustContext>): Promise<TrustProfile>;
+    /**
+     * Get recent trust interactions for an entity
+     * @param daysBack Number of days to look back (default: 10)
+     */
+    getRecentInteractions(entityId: UUID, daysBack?: number): Promise<TrustInteraction[]>;
+}
+//# sourceMappingURL=TrustEngine.d.ts.map

package/dist/services/TrustEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustEngine.d.ts","sourceRoot":"","sources":["../../src/services/TrustEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAGlB,OAAO,EAEP,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,aAAa,EAIlB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AAoGxB,qBAAa,WAAY,SAAQ,OAAO;IACtC,MAAM,CAAC,WAAW,EAAG,cAAc,CAAU;IAE7C,qBAAqB,SAA2D;IAEhF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAyB5C;IAEF,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,YAAY,CAAwC;IAC5D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAO;IAC/C,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,UAAU,CAGJ;IACd,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAM;gBAE7B,MAAM,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC;IAK9C,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;WAKd,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAM5D;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IA2DnF;;OAEG;IACG,iBAAiB,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0DrE;;OAEG;IACG,qBAAqB,CACzB,QAAQ,EAAE,IAAI,EACd,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAoEzB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAmC;IAE9E,OAAO,CAAC,cAAc;IAyCtB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgC3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgB7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;OAEG;YACW,YAAY;IAiD1B;;OAEG;YACW,YAAY;IAwD1B;;OAEG;YACW,gBAAgB;IAyC9B;;OAEG;IACH,OAAO,CAAC,gCAAgC;IA2BxC;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAgCpC;;OAEG;IACG,aAAa,CACjB,QAAQ,EAAE,IAAI,EACd,WAAW,EAAE,IAAI,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC9B,OAAO,CAAC,YAAY,CAAC;IAQxB;;;OAGG;IACG,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,SAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAOxF"}

package/dist/services/db.d.ts

@@ -0,0 +1,12 @@
+import type { IAgentRuntime } from "@elizaos/core";
+/**
+ * Minimal Drizzle-compatible DB interface.
+ * Uses a chainable query builder pattern matching drizzle-orm.
+ */
+export type DrizzleDB = Record<string, (...args: any[]) => any>;
+/**
+ * Get the Drizzle database instance from the runtime.
+ * @throws if the database is unavailable.
+ */
+export declare function getDb(runtime: IAgentRuntime): DrizzleDB;
+//# sourceMappingURL=db.d.ts.map

package/dist/services/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;GAGG;AAGH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,CAIvD"}

package/dist/services/index.d.ts

@@ -0,0 +1,5 @@
+export { ContextualPermissionSystem } from "./ContextualPermissionSystem";
+export { CredentialProtector } from "./CredentialProtector";
+export { SecurityModule } from "./SecurityModule";
+export { TrustEngine } from "./TrustEngine";
+//# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC"}

package/dist/tests.d.ts

@@ -0,0 +1,3 @@
+import type { TestCase } from "@elizaos/core";
+export declare const tests: TestCase[];
+//# sourceMappingURL=tests.d.ts.map

package/dist/tests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests.d.ts","sourceRoot":"","sources":["../src/tests.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiC,QAAQ,EAAQ,MAAM,eAAe,CAAC;AAqFnF,eAAO,MAAM,KAAK,EAAE,QAAQ,EAozB3B,CAAC"}

package/dist/types/permissions.d.ts

@@ -0,0 +1,185 @@
+import type { Role, UUID } from "@elizaos/core";
+import type { TrustRequirements } from "./trust";
+/**
+ * Context for permission evaluation
+ */
+export interface PermissionContext {
+    worldId?: UUID;
+    roomId?: UUID;
+    platform?: string;
+    serverId?: string;
+    channelId?: string;
+    timestamp?: number;
+}
+/**
+ * A contextual role that applies in specific contexts
+ */
+export interface ContextualRole {
+    id: UUID;
+    role: Role;
+    entityId: UUID;
+    context: PermissionContext;
+    /** When this role assignment expires */
+    expiresAt?: number;
+    /** Who assigned this role */
+    assignedBy: UUID;
+    /** When this role was assigned */
+    assignedAt: number;
+    /** Trust requirements for this role */
+    trustRequirements?: TrustRequirements;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Permission that can be granted
+ */
+export interface Permission {
+    action: string;
+    resource: string;
+    context?: PermissionContext;
+    constraints?: PermissionConstraint[];
+}
+/**
+ * Constraint on a permission
+ */
+export interface PermissionConstraint {
+    type: "time_window" | "usage_limit" | "trust_required" | "role_required" | "custom";
+    value: string | number | boolean | Record<string, unknown>;
+    description?: string;
+}
+/**
+ * Result of a permission check
+ */
+export interface PermissionDecision {
+    allowed: boolean;
+    /** How the decision was made */
+    method: "role-based" | "trust-based" | "delegated" | "elevated" | "denied";
+    /** Which role or trust level granted access */
+    grantedBy?: {
+        type: "role" | "trust";
+        value: Role | number;
+        context?: PermissionContext;
+    };
+    /** Reason for the decision */
+    reason: string;
+    /** Suggestions if denied */
+    suggestions?: string[];
+    /** Conditions that must be met */
+    conditions?: string[];
+    /** Audit trail */
+    auditInfo?: {
+        decidedAt: number;
+        evaluatorId: UUID;
+        evidence?: Record<string, unknown>[];
+    };
+}
+/**
+ * Request for elevated permissions
+ */
+export interface ElevationRequest {
+    entityId: UUID;
+    requestedPermission: Permission;
+    justification: string;
+    duration?: number;
+    context: PermissionContext;
+}
+/**
+ * Result of an elevation request
+ */
+export interface ElevationResult {
+    granted: boolean;
+    elevationId?: UUID;
+    expiresAt?: number;
+    conditions?: string[];
+    reason?: string;
+    trustDeficit?: number;
+    suggestions?: string[];
+}
+/**
+ * Represents a delegation of permissions
+ */
+export interface PermissionDelegation {
+    id: UUID;
+    delegatorId: UUID;
+    delegateeId: UUID;
+    permissions: Permission[];
+    context: PermissionContext;
+    expiresAt?: number;
+    createdAt: number;
+    conditions?: string[];
+    revoked?: boolean;
+    revokedAt?: number;
+    revokedBy?: UUID;
+}
+/**
+ * Access request for evaluation
+ */
+export interface AccessRequest {
+    entityId: UUID;
+    action: string;
+    resource: string;
+    context: PermissionContext;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Complete access decision with all details
+ */
+export interface AccessDecision extends PermissionDecision {
+    request: AccessRequest;
+    evaluatedAt: number;
+    ttl?: number;
+    securityChecks?: {
+        promptInjection: boolean;
+        socialEngineering: boolean;
+        anomalyDetection: boolean;
+    };
+}
+/**
+ * Unix-style permission system for autonomous agents
+ * Format: XYYY where:
+ * X = Special permissions (setuid, setgid, sticky)
+ * First Y = Owner (self) permissions
+ * Second Y = Group (admin/trusted) permissions
+ * Third Y = Others (user/anon) permissions
+ *
+ * Each digit is sum of: 4 (read), 2 (write), 1 (execute)
+ *
+ * Examples:
+ * 0700 = Only self can read/write/execute
+ * 0755 = Self has full, others can read/execute
+ * 0644 = Self read/write, others read only
+ * 4755 = Setuid + self full, others read/execute
+ */
+export interface UnixPermission {
+    mode: number;
+    owner: "self" | "system" | string;
+    group: "admin" | "trusted" | "user" | string;
+    setuid?: boolean;
+    setgid?: boolean;
+    sticky?: boolean;
+}
+export interface ActionPermission {
+    action: string;
+    unix: UnixPermission;
+    trustRequired?: number;
+    roleRequired?: string[];
+    contextRequired?: string[];
+    selfCallable?: boolean;
+    delegatable?: boolean;
+    auditable?: boolean;
+}
+export interface PermissionEvaluationContext {
+    caller: "self" | "admin" | "user" | "anon" | string;
+    action: string;
+    target?: string;
+    trust?: number;
+    roles?: string[];
+    context?: Record<string, unknown>;
+}
+export declare const PermissionUtils: {
+    fromOctal: (octal: string) => number;
+    canExecute: (permission: UnixPermission, caller: PermissionEvaluationContext) => boolean;
+    canRead: (permission: UnixPermission, caller: PermissionEvaluationContext) => boolean;
+    canWrite: (permission: UnixPermission, caller: PermissionEvaluationContext) => boolean;
+};
+//# sourceMappingURL=permissions.d.ts.map

package/dist/types/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/types/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,IAAI,CAAC;IACf,OAAO,EAAE,iBAAiB,CAAC;IAE3B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,6BAA6B;IAC7B,UAAU,EAAE,IAAI,CAAC;IAEjB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IAEnB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAEtC,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,gBAAgB,GAAG,eAAe,GAAG,QAAQ,CAAC;IACpF,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IAEjB,gCAAgC;IAChC,MAAM,EAAE,YAAY,GAAG,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAC;IAE3E,+CAA+C;IAC/C,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACvB,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,iBAAiB,CAAC;KAC7B,CAAC;IAEF,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IAEf,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kBAAkB;IAClB,SAAS,CAAC,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,IAAI,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;KACtC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,IAAI,CAAC;IACf,mBAAmB,EAAE,UAAU,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,kBAAkB;IACxD,OAAO,EAAE,aAAa,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE;QACf,eAAe,EAAE,OAAO,CAAC;QACzB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAClC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAG7C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IAGrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAG3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAGD,eAAO,MAAM,eAAe;uBAEP,MAAM,KAAG,MAAM;6BAKT,cAAc,UAAU,2BAA2B,KAAG,OAAO;0BAyBhE,cAAc,UAAU,2BAA2B,KAAG,OAAO;2BAsB5D,cAAc,UAAU,2BAA2B,KAAG,OAAO;CAoBrF,CAAC"}