@elizaos/ui 2.0.0-alpha.25 → 2.0.0-alpha.334

package/packages/typescript/src/features/trust/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../../../typescript/src/features/trust/schema.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,WAAW,iDAAoB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWxB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ1B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWjC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW7B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS5B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOxB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO/B,CAAC"}

package/packages/typescript/src/features/trust/schema.js

@@ -0,0 +1,108 @@
+import { sql } from "drizzle-orm";
+import { boolean, integer, jsonb, pgSchema, text, timestamp, uuid, } from "drizzle-orm/pg-core";
+export const trustSchema = pgSchema("trust");
+/**
+ * Stores multi-dimensional trust profiles for entities.
+ */
+export const trustProfiles = trustSchema.table("trust_profiles", {
+    id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+    entityId: uuid("entity_id").notNull(),
+    evaluatorId: uuid("evaluator_id").notNull(),
+    overallTrust: integer("overall_trust").notNull(),
+    confidence: integer("confidence").notNull(),
+    interactionCount: integer("interaction_count").default(0),
+    trendDirection: text("trend_direction").notNull(),
+    trendChangeRate: integer("trend_change_rate").default(0),
+    dimensions: jsonb("dimensions").notNull(),
+    lastCalculated: timestamp("last_calculated").defaultNow().notNull(),
+});
+/**
+ * Stores individual pieces of evidence that contribute to a trust profile.
+ */
+export const trustEvidence = trustSchema.table("trust_evidence", {
+    id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+    targetEntityId: uuid("target_entity_id").notNull(),
+    sourceEntityId: uuid("source_entity_id").notNull(),
+    evaluatorId: uuid("evaluator_id").notNull(),
+    type: text("type").notNull(),
+    timestamp: timestamp("timestamp").defaultNow().notNull(),
+    impact: integer("impact").notNull(),
+    weight: integer("weight").default(1),
+    description: text("description"),
+    verified: boolean("verified").default(false),
+    context: jsonb("context"),
+});
+/**
+ * Stores contextual role assignments for entities.
+ */
+export const contextualRoles = trustSchema.table("contextual_roles", {
+    id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+    entityId: uuid("entity_id").notNull(),
+    role: text("role").notNull(),
+    assignedBy: uuid("assigned_by").notNull(),
+    context: jsonb("context"), // Can store worldId, roomId, platform, etc.
+    expiresAt: timestamp("expires_at"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+});
+/**
+ * Stores permission delegations between entities.
+ */
+export const permissionDelegations = trustSchema.table("permission_delegations", {
+    id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+    delegatorId: uuid("delegator_id").notNull(),
+    delegateeId: uuid("delegatee_id").notNull(),
+    permissions: jsonb("permissions").notNull(), // Array of Permission objects
+    context: jsonb("context"),
+    expiresAt: timestamp("expires_at"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+});
+/**
+ * Stores behavioral profiles for entities to detect anomalies and multi-account abuse.
+ */
+export const behavioralProfiles = trustSchema.table("behavioral_profiles", {
+    id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+    entityId: uuid("entity_id").notNull().unique(),
+    typingSpeed: integer("typing_speed").default(0), // words per minute
+    vocabularyComplexity: integer("vocabulary_complexity").default(0), // 0-100
+    messageLengthMean: integer("message_length_mean").default(0),
+    messageLengthStdDev: integer("message_length_std_dev").default(0),
+    activeHours: jsonb("active_hours").default("[]"), // JSON array of 24 hour counts
+    commonPhrases: jsonb("common_phrases").default("[]"), // JSON array of common phrases
+    interactionPatterns: jsonb("interaction_patterns").default("{}"), // JSON map of interaction types
+    updatedAt: timestamp("updated_at").defaultNow().notNull(),
+});
+/**
+ * Logs significant security incidents for auditing and threat analysis.
+ */
+export const securityIncidents = trustSchema.table("security_incidents", {
+    id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+    entityId: uuid("entity_id").notNull(),
+    type: text("type").notNull(), // e.g., 'prompt_injection', 'phishing_attempt'
+    severity: text("severity").notNull(), // 'low', 'medium', 'high', 'critical'
+    context: jsonb("context"),
+    details: jsonb("details"),
+    timestamp: timestamp("timestamp").defaultNow().notNull(),
+    handled: text("handled").default("pending"), // 'pending', 'resolved', 'ignored'
+});
+/**
+ * Stores hypothesized links between entity identities on different platforms.
+ */
+export const identityLinks = trustSchema.table("identity_links", {
+    id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+    entityIdA: uuid("entity_id_a").notNull(),
+    entityIdB: uuid("entity_id_b").notNull(),
+    confidence: integer("confidence").notNull(), // 0-100
+    evidence: jsonb("evidence").default("[]"), // Array of evidence descriptions
+    updatedAt: timestamp("updated_at").defaultNow().notNull(),
+});
+/**
+ * Securely stores whistleblower reports.
+ */
+export const whistleblowerReports = trustSchema.table("whistleblower_reports", {
+    id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+    reportedEntityId: uuid("reported_entity_id").notNull(),
+    evidence: jsonb("evidence").notNull(),
+    status: text("status").default("pending"), // 'pending', 'investigating', 'resolved'
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    // Reporter ID is intentionally omitted to ensure anonymity
+});

package/packages/typescript/src/features/trust/services/ContextualPermissionSystem.d.ts

@@ -0,0 +1,40 @@
+import { type IAgentRuntime, type UUID } from "../../../types/index.ts";
+import type { AccessDecision, AccessRequest, ElevationRequest, ElevationResult, Permission, PermissionContext, PermissionDelegation } from "../types/permissions.ts";
+import type { SecurityModule } from "./SecurityModule.ts";
+import type { TrustEngine } from "./TrustEngine.ts";
+export declare class ContextualPermissionSystem {
+    private runtime;
+    private trustEngine;
+    private securityModule;
+    private permissionCache;
+    private elevations;
+    private delegations;
+    private static readonly ROLE_PERMISSIONS;
+    private static readonly TRUST_ACTION_THRESHOLDS;
+    private static readonly TRUST_ONLY_ACTIONS;
+    private static readonly ADMIN_ONLY_ACTIONS;
+    initialize(runtime: IAgentRuntime, trustEngine: TrustEngine, securityModule: SecurityModule): Promise<void>;
+    hasPermission(entityId: UUID, permission: Permission, context: PermissionContext): Promise<boolean>;
+    checkAccess(request: AccessRequest): Promise<AccessDecision>;
+    private checkRolePermissions;
+    private checkTrustPermissions;
+    private checkDelegatedPermissions;
+    requestElevation(request: ElevationRequest): Promise<ElevationResult>;
+    /**
+     * Check if the entity has an active (non-expired) elevation grant for the requested action.
+     */
+    private checkActiveElevations;
+    /**
+     * Create a delegation granting another entity specific permissions.
+     */
+    addDelegation(delegation: PermissionDelegation): void;
+    /**
+     * Revoke a delegation by ID.
+     */
+    revokeDelegation(delegationId: UUID, revokedBy: UUID): boolean;
+    private createDecision;
+    private roleHasPermission;
+    private getEntityRoles;
+    private generateDenialReason;
+}
+//# sourceMappingURL=ContextualPermissionSystem.d.ts.map

package/packages/typescript/src/features/trust/services/ContextualPermissionSystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContextualPermissionSystem.d.ts","sourceRoot":"","sources":["../../../../../../../../typescript/src/features/trust/services/ContextualPermissionSystem.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,aAAa,EAAQ,KAAK,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAE9E,OAAO,KAAK,EACX,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,eAAe,EAEf,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,qBAAa,0BAA0B;IACtC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,cAAc,CAAkB;IAExC,OAAO,CAAC,eAAe,CAGnB;IACJ,OAAO,CAAC,UAAU,CAGd;IACJ,OAAO,CAAC,WAAW,CAA2C;IAE9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAsBtC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAM7C;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAMvC;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAMvC;IAEG,UAAU,CACf,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,GAC5B,OAAO,CAAC,IAAI,CAAC;IAMV,aAAa,CAClB,QAAQ,EAAE,IAAI,EACd,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,iBAAiB,GACxB,OAAO,CAAC,OAAO,CAAC;IAUb,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;YA6DpD,oBAAoB;YAoBpB,qBAAqB;YA6CrB,yBAAyB;IA8BjC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAyD3E;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI;IAcrD;;OAEG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO;IAa9D,OAAO,CAAC,cAAc;IAsBtB,OAAO,CAAC,iBAAiB;YAUX,cAAc;IAe5B,OAAO,CAAC,oBAAoB;CAO5B"}

package/packages/typescript/src/features/trust/services/ContextualPermissionSystem.js

@@ -0,0 +1,317 @@
+import { logger } from "../../../logger.js";
+import { getUserServerRole } from "../../../roles.js";
+import { Role } from "../../../types/index.js";
+import { stringToUuid } from "../../../utils.js";
+export class ContextualPermissionSystem {
+    runtime;
+    trustEngine;
+    securityModule;
+    permissionCache = new Map();
+    elevations = new Map();
+    delegations = new Map();
+    static ROLE_PERMISSIONS = {
+        [Role.OWNER]: new Set(["*"]),
+        [Role.ADMIN]: new Set([
+            "manage_roles",
+            "manage_settings",
+            "moderate_content",
+            "timeout_user",
+            "delete_content",
+            "view_audit_log",
+            "evaluate_trust",
+            "record_trust",
+            "view_trust_profiles",
+            "manage_channels",
+            "ban_user",
+        ]),
+        [Role.NONE]: new Set([
+            "send_message",
+            "view_content",
+            "evaluate_trust",
+            "view_trust_profiles",
+            "request_elevation",
+        ]),
+    };
+    static TRUST_ACTION_THRESHOLDS = {
+        view_audit_log: 80,
+        view_trust_profiles: 60,
+        flag_content: 90,
+        report_user: 70,
+        request_elevation: 50,
+    };
+    static TRUST_ONLY_ACTIONS = new Set([
+        "view_audit_log",
+        "view_trust_profiles",
+        "flag_content",
+        "report_user",
+        "request_elevation",
+    ]);
+    static ADMIN_ONLY_ACTIONS = new Set([
+        "manage_roles",
+        "manage_settings",
+        "manage_channels",
+        "ban_user",
+        "delete_content",
+    ]);
+    async initialize(runtime, trustEngine, securityModule) {
+        this.runtime = runtime;
+        this.trustEngine = trustEngine;
+        this.securityModule = securityModule;
+    }
+    async hasPermission(entityId, permission, context) {
+        const decision = await this.checkAccess({
+            entityId,
+            action: permission.action,
+            resource: permission.resource,
+            context,
+        });
+        return decision.allowed;
+    }
+    async checkAccess(request) {
+        const cacheKey = JSON.stringify(request);
+        const cached = this.permissionCache.get(cacheKey);
+        if (cached && cached.expiry > Date.now()) {
+            return cached.decision;
+        }
+        // Security Module Checks
+        const content = `${request.action} on ${request.resource}`;
+        const injectionCheck = await this.securityModule.detectPromptInjection(content, {
+            ...request.context,
+            entityId: request.entityId,
+            requestedAction: content,
+        });
+        if (injectionCheck.detected && injectionCheck.action === "block") {
+            return this.createDecision(request, {
+                allowed: false,
+                method: "denied",
+                reason: `Security block: ${injectionCheck.details}`,
+            });
+        }
+        // Role-based check
+        const roleDecision = await this.checkRolePermissions(request);
+        if (roleDecision.allowed) {
+            return this.createDecision(request, roleDecision);
+        }
+        // Trust-based check
+        const trustDecision = await this.checkTrustPermissions(request);
+        if (trustDecision.allowed) {
+            return this.createDecision(request, trustDecision);
+        }
+        // Elevation check -- active temporary grants
+        const elevationDecision = this.checkActiveElevations(request);
+        if (elevationDecision.allowed) {
+            return this.createDecision(request, elevationDecision);
+        }
+        // Delegation check
+        const delegationDecision = await this.checkDelegatedPermissions(request);
+        if (delegationDecision.allowed) {
+            return this.createDecision(request, delegationDecision);
+        }
+        const reason = this.generateDenialReason(roleDecision, trustDecision, delegationDecision);
+        return this.createDecision(request, {
+            allowed: false,
+            method: "denied",
+            reason,
+        });
+    }
+    async checkRolePermissions(request) {
+        const roles = await this.getEntityRoles(request.entityId, request.context);
+        for (const role of roles) {
+            if (this.roleHasPermission(role, request.action, request.resource)) {
+                return {
+                    allowed: true,
+                    method: "role-based",
+                    reason: `Allowed by role: ${role}`,
+                };
+            }
+        }
+        return {
+            allowed: false,
+            method: "denied",
+            reason: "No matching role permission",
+        };
+    }
+    async checkTrustPermissions(request) {
+        // Trust alone should NEVER grant write/admin actions
+        if (!ContextualPermissionSystem.TRUST_ONLY_ACTIONS.has(request.action)) {
+            return {
+                allowed: false,
+                method: "denied",
+                reason: "Trust alone cannot grant this action",
+            };
+        }
+        const threshold = ContextualPermissionSystem.TRUST_ACTION_THRESHOLDS[request.action];
+        if (threshold === undefined) {
+            return {
+                allowed: false,
+                method: "denied",
+                reason: "No trust threshold defined for this action",
+            };
+        }
+        const trustProfile = await this.trustEngine.calculateTrust(request.entityId, {
+            ...request.context,
+            evaluatorId: this.runtime.agentId,
+        });
+        if (trustProfile.overallTrust >= threshold) {
+            return {
+                allowed: true,
+                method: "trust-based",
+                reason: `Allowed by trust score ${trustProfile.overallTrust.toFixed(2)} (threshold: ${threshold})`,
+            };
+        }
+        return {
+            allowed: false,
+            method: "denied",
+            reason: `Insufficient trust: ${trustProfile.overallTrust.toFixed(2)} < ${threshold}`,
+        };
+    }
+    async checkDelegatedPermissions(request) {
+        const entityDelegations = this.delegations.get(request.entityId) ?? [];
+        for (const delegation of entityDelegations) {
+            if (delegation.revoked)
+                continue;
+            if (delegation.expiresAt && delegation.expiresAt < Date.now())
+                continue;
+            const matchingPermission = delegation.permissions.find((p) => p.action === request.action && p.resource === request.resource);
+            if (matchingPermission) {
+                return {
+                    allowed: true,
+                    method: "delegated",
+                    reason: `Allowed by delegation from ${delegation.delegatorId}`,
+                };
+            }
+        }
+        return {
+            allowed: false,
+            method: "denied",
+            reason: "No valid delegation found",
+        };
+    }
+    async requestElevation(request) {
+        const action = request.requestedPermission.action;
+        // Admin-level actions cannot be granted via elevation
+        if (ContextualPermissionSystem.ADMIN_ONLY_ACTIONS.has(action)) {
+            return {
+                granted: false,
+                reason: `Action "${action}" cannot be granted via elevation`,
+                suggestions: ["Request a role assignment from an administrator"],
+            };
+        }
+        const trustProfile = await this.trustEngine.calculateTrust(request.entityId, {
+            ...request.context,
+            evaluatorId: this.runtime.agentId,
+        });
+        const requiredTrust = 70;
+        if (trustProfile.overallTrust < requiredTrust) {
+            return {
+                granted: false,
+                reason: "Insufficient trust for elevation",
+                trustDeficit: requiredTrust - trustProfile.overallTrust,
+                suggestions: [
+                    "Build trust through positive interactions",
+                    `Current trust: ${trustProfile.overallTrust.toFixed(2)}, required: ${requiredTrust}`,
+                ],
+            };
+        }
+        const elevationId = stringToUuid(JSON.stringify(request));
+        const durationMs = (request.duration ?? 5 * 60) * 1000;
+        const expiresAt = Date.now() + durationMs;
+        this.elevations.set(elevationId, { ...request, expiresAt });
+        // Log the elevation for audit
+        logger.info({
+            entityId: request.entityId,
+            action,
+            expiresAt: new Date(expiresAt).toISOString(),
+        }, "[ContextualPermissionSystem] Elevation granted");
+        return {
+            granted: true,
+            elevationId,
+            expiresAt,
+            conditions: [`Expires at ${new Date(expiresAt).toISOString()}`],
+            reason: `Elevation granted based on trust score ${trustProfile.overallTrust.toFixed(2)}`,
+        };
+    }
+    /**
+     * Check if the entity has an active (non-expired) elevation grant for the requested action.
+     */
+    checkActiveElevations(request) {
+        for (const [id, elevation] of this.elevations) {
+            // Prune expired elevations
+            if (elevation.expiresAt < Date.now()) {
+                this.elevations.delete(id);
+                continue;
+            }
+            if (elevation.entityId === request.entityId &&
+                elevation.requestedPermission.action === request.action) {
+                return {
+                    allowed: true,
+                    method: "elevated",
+                    reason: `Allowed by active elevation (expires ${new Date(elevation.expiresAt).toISOString()})`,
+                };
+            }
+        }
+        return { allowed: false, method: "denied", reason: "No active elevation" };
+    }
+    /**
+     * Create a delegation granting another entity specific permissions.
+     */
+    addDelegation(delegation) {
+        const existing = this.delegations.get(delegation.delegateeId) ?? [];
+        existing.push(delegation);
+        this.delegations.set(delegation.delegateeId, existing);
+        logger.info({
+            delegatorId: delegation.delegatorId,
+            delegateeId: delegation.delegateeId,
+            permissions: delegation.permissions.length,
+        }, "[ContextualPermissionSystem] Delegation created");
+    }
+    /**
+     * Revoke a delegation by ID.
+     */
+    revokeDelegation(delegationId, revokedBy) {
+        for (const [, delegations] of this.delegations) {
+            const target = delegations.find((d) => d.id === delegationId);
+            if (target) {
+                target.revoked = true;
+                target.revokedAt = Date.now();
+                target.revokedBy = revokedBy;
+                return true;
+            }
+        }
+        return false;
+    }
+    createDecision(request, partialDecision) {
+        const decision = {
+            request,
+            allowed: partialDecision.allowed || false,
+            method: partialDecision.method || "denied",
+            reason: partialDecision.reason || "",
+            evaluatedAt: Date.now(),
+            ...partialDecision,
+        };
+        if (decision.allowed) {
+            const cacheKey = JSON.stringify(request);
+            this.permissionCache.set(cacheKey, {
+                decision,
+                expiry: Date.now() + (decision.ttl || 300000),
+            });
+        }
+        return decision;
+    }
+    roleHasPermission(roleName, action, _resource) {
+        const permissions = ContextualPermissionSystem.ROLE_PERMISSIONS[roleName];
+        if (!permissions)
+            return false;
+        return permissions.has("*") || permissions.has(action);
+    }
+    async getEntityRoles(entityId, context) {
+        if (context.worldId) {
+            const role = await getUserServerRole(this.runtime, entityId, context.worldId);
+            return role ? [role] : [];
+        }
+        return [];
+    }
+    generateDenialReason(roleDecision, trustDecision, delegationDecision) {
+        return `Access denied. Role check: ${roleDecision.reason}. Trust check: ${trustDecision.reason}. Delegation check: ${delegationDecision.reason}.`;
+    }
+}

package/packages/typescript/src/features/trust/services/CredentialProtector.d.ts

@@ -0,0 +1,62 @@
+import { type IAgentRuntime, Service, type UUID } from "../../../types/index.ts";
+import { type SecurityContext } from "../types/security.ts";
+import type { SecurityModule } from "./SecurityModule.ts";
+export interface CredentialThreatDetection {
+    detected: boolean;
+    confidence: number;
+    threatType: "credential_request" | "phishing" | "social_engineering" | "prompt_injection" | "none";
+    sensitiveData: string[];
+    recommendation: string;
+}
+export declare class CredentialProtector extends Service {
+    static serviceType: "credential-protector";
+    capabilityDescription: string;
+    private securityModule;
+    private readonly keywordPatternCache;
+    private static normalizeForScan;
+    private static reverseString;
+    private readonly SENSITIVE_PATTERNS;
+    private readonly SENSITIVE_KEYWORDS;
+    private readonly THEFT_REQUEST_PATTERNS;
+    private readonly PROMPT_INJECTION_PATTERNS;
+    private readonly LEGITIMATE_CONTEXTS;
+    initialize(_runtime: IAgentRuntime, securityModule: SecurityModule): Promise<void>;
+    stop(): Promise<void>;
+    static start(runtime: IAgentRuntime): Promise<Service>;
+    /**
+     * Scan message for credential theft attempts
+     */
+    scanForCredentialTheft(message: string, entityId: UUID, context: SecurityContext): Promise<CredentialThreatDetection>;
+    /**
+     * Protect sensitive data by redacting it
+     */
+    protectSensitiveData(content: string): Promise<string>;
+    /**
+     * Alert potential victims of credential theft
+     */
+    alertPotentialVictims(threatActor: UUID, victims: UUID[], threatDetails: CredentialThreatDetection): Promise<void>;
+    /**
+     * Analyze a conversation for credential theft patterns
+     */
+    analyzeConversation(messages: Array<{
+        entityId: UUID;
+        content: string;
+        timestamp: number;
+    }>, context: SecurityContext): Promise<{
+        overallThreat: number;
+        suspiciousEntities: UUID[];
+        recommendations: string[];
+    }>;
+    /**
+     * Private helper methods
+     */
+    private detectSensitiveData;
+    private hasTheftRequest;
+    private hasPromptInjectionPattern;
+    private isLegitimateContext;
+    private hasPhishingIndicators;
+    private getKeywordPattern;
+    private containsKeywordVariant;
+    private logThreatEvent;
+}
+//# sourceMappingURL=CredentialProtector.d.ts.map

package/packages/typescript/src/features/trust/services/CredentialProtector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialProtector.d.ts","sourceRoot":"","sources":["../../../../../../../../typescript/src/features/trust/services/CredentialProtector.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,aAAa,EAClB,OAAO,EACP,KAAK,IAAI,EACT,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,KAAK,eAAe,EAAqB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,WAAW,yBAAyB;IACzC,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EACP,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,GAClB,MAAM,CAAC;IACV,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,OAAO;IAC/C,MAAM,CAAC,WAAW,EAAG,sBAAsB,CAAU;IAErD,qBAAqB,SACsD;IAE3E,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IAEjE,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B,OAAO,CAAC,MAAM,CAAC,aAAa;IAK5B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAwCjC;IAGF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAqCjC;IAGF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAcrC;IAEF,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAWxC;IAGF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAUlC;IAEI,UAAU,CACf,QAAQ,EAAE,aAAa,EACvB,cAAc,EAAE,cAAc,GAC5B,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;WAId,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAe5D;;OAEG;IACG,sBAAsB,CAC3B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,eAAe,GACtB,OAAO,CAAC,yBAAyB,CAAC;IA4ErC;;OAEG;IACG,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgC5D;;OAEG;IACG,qBAAqB,CAC1B,WAAW,EAAE,IAAI,EACjB,OAAO,EAAE,IAAI,EAAE,EACf,aAAa,EAAE,yBAAyB,GACtC,OAAO,CAAC,IAAI,CAAC;IA2BhB;;OAEG;IACG,mBAAmB,CACxB,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EACvE,OAAO,EAAE,eAAe,GACtB,OAAO,CAAC;QACV,aAAa,EAAE,MAAM,CAAC;QACtB,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;IA0DF;;OAEG;IAEH,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,eAAe;IAmCvB,OAAO,CAAC,yBAAyB;IA4BjC,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,sBAAsB;YAgChB,cAAc;CAqB5B"}