@pellux/goodvibes-sdk 0.18.14 → 0.18.15

package/dist/_internal/platform/runtime/plugins/manifest.js

@@ -0,0 +1,133 @@
+/**
+ * Plugin capability manifest validation and resolution.
+ *
+ * Implements deny-by-default capability enforcement:
+ * 1. Parse raw manifest capabilities (unknown → typed)
+ * 2. Validate that each requested capability is a known capability
+ * 3. Run the runtime's capability policy to grant or deny each capability
+ * 4. Return a resolved PluginCapabilityManifest
+ */
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
+import { ALL_CAPABILITIES, HIGH_RISK_CAPABILITIES, } from './types.js';
+import { filterCapabilitiesByTrust } from './trust.js';
+/**
+ * Default capability policy: grant all valid capabilities.
+ *
+ * Callers can supply a stricter policy via PluginLifecycleManagerOptions.
+ */
+function defaultPolicy(_pluginName, _capability) {
+    return true;
+}
+/**
+ * Returns whether a string value is a known PluginCapability.
+ */
+function isKnownCapability(value) {
+    return ALL_CAPABILITIES.includes(value);
+}
+/**
+ * resolveCapabilityManifest — Parse and resolve the capability manifest for a
+ * plugin, applying the runtime's capability policy and trust-tier constraints.
+ *
+ * Evaluation order:
+ *   1. Unknown capability strings are filtered out (warn + ignore).
+ *   2. Trust-tier constraints are applied — high-risk capabilities blocked
+ *      unless the plugin has the `trusted` tier.
+ *   3. The runtime capability policy callback is applied to the remaining set.
+ *
+ * @param pluginName - Plugin name (for logging).
+ * @param manifest   - The raw plugin manifest (may have `capabilities` array).
+ * @param policy     - Capability grant/deny callback. Defaults to permissive.
+ * @param trustTier  - Effective trust tier for this plugin. Defaults to 'untrusted'.
+ * @returns A fully-resolved PluginCapabilityManifest.
+ */
+export function resolveCapabilityManifest(pluginName, manifest, policy = defaultPolicy, trustTier = 'untrusted') {
+    const rawRequested = manifest.capabilities ?? [];
+    // Validate and filter unknown capability strings.
+    const requested = [];
+    for (const raw of rawRequested) {
+        if (isKnownCapability(raw)) {
+            requested.push(raw);
+        }
+        else {
+            logger.warn(`[plugin-lifecycle:${pluginName}] Unknown capability '${raw}' — ignored`);
+        }
+    }
+    // Apply trust-tier constraints before the policy callback.
+    const trustResult = filterCapabilitiesByTrust(requested, trustTier);
+    if (trustResult.blocked.length > 0) {
+        logger.warn(`[plugin-lifecycle:${pluginName}] Trust tier '${trustTier}' blocks` +
+            ` high-risk capabilities: [${trustResult.blocked.join(', ')}]` +
+            ' — trust escalation required');
+    }
+    // Only the trust-permitted capabilities proceed to policy evaluation.
+    const afterTrust = trustResult.permitted;
+    const granted = [];
+    const denied = [...trustResult.blocked];
+    const denialReasons = { ...trustResult.reasons };
+    for (const cap of afterTrust) {
+        if (policy(pluginName, cap)) {
+            granted.push(cap);
+        }
+        else {
+            denied.push(cap);
+            denialReasons[cap] = `Capability '${cap}' denied by runtime policy`;
+            logger.warn(`[plugin-lifecycle:${pluginName}] Capability '${cap}' denied by policy`);
+        }
+    }
+    logger.debug(`[plugin-lifecycle:${pluginName}] Capabilities resolved (trust=${trustTier})` +
+        ` — granted: [${granted.join(', ')}]` +
+        (denied.length > 0 ? `, denied: [${denied.join(', ')}]` : ''));
+    return {
+        requested: Object.freeze(requested),
+        granted,
+        denied,
+        denialReasons,
+    };
+}
+/**
+ * isHighRiskCapability — Returns whether a capability is classified as high-risk.
+ * High-risk capabilities require the `trusted` tier to be granted.
+ */
+export function isHighRiskCapability(capability) {
+    return HIGH_RISK_CAPABILITIES.includes(capability);
+}
+/**
+ * hasCapability — Returns whether a plugin has been granted a specific
+ * capability after manifest resolution.
+ */
+export function hasCapability(manifest, capability) {
+    return manifest.granted.includes(capability);
+}
+/**
+ * validateManifestV2 — Light validation of the PluginManifestV2 shape.
+ * Returns null on success or an error string on failure.
+ */
+export function validateManifestV2(manifest) {
+    if (!manifest || typeof manifest !== 'object') {
+        return 'manifest must be an object';
+    }
+    const m = manifest;
+    if (typeof m['name'] !== 'string' || !m['name']) {
+        return "manifest.name must be a non-empty string";
+    }
+    if (typeof m['version'] !== 'string' || !m['version']) {
+        return "manifest.version must be a non-empty string";
+    }
+    if (typeof m['description'] !== 'string') {
+        return "manifest.description must be a string";
+    }
+    if (m['capabilities'] !== undefined) {
+        if (!Array.isArray(m['capabilities'])) {
+            return "manifest.capabilities must be an array";
+        }
+        for (const cap of m['capabilities']) {
+            if (typeof cap !== 'string') {
+                return `manifest.capabilities entries must be strings, got: ${typeof cap}`;
+            }
+        }
+    }
+    if (m['minRuntimeVersion'] !== undefined && typeof m['minRuntimeVersion'] !== 'string') {
+        return "manifest.minRuntimeVersion must be a string";
+    }
+    return null;
+}

package/dist/_internal/platform/runtime/plugins/quarantine.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Plugin quarantine engine.
+ *
+ * Quarantine removes a plugin's unsafe contribution effects without fully
+ * unloading it. This allows the operator to isolate a suspicious plugin,
+ * inspect it, then either restore or permanently disable it.
+ *
+ * Quarantine effects:
+ *   - All high-risk capabilities are revoked in the resolved manifest.
+ *   - The plugin is moved to a `quarantined` lifecycle bucket in the store.
+ *   - A quarantine record is created with a timestamp and reason.
+ *
+ * Restore path:
+ *   - `lift()` — Restores previously revoked capabilities (if trust was upgraded).
+ *   - The caller is responsible for reloading the plugin after lifting.
+ */
+import type { PluginCapability, PluginCapabilityManifest } from './types.js';
+/**
+ * A record describing a plugin currently in quarantine.
+ */
+export interface QuarantineRecord {
+    /** Plugin name. */
+    readonly pluginName: string;
+    /** Unix epoch ms when quarantine was applied. */
+    readonly quarantinedAt: number;
+    /** Human-readable reason for quarantine. */
+    readonly reason: string;
+    /** The capabilities that were revoked when quarantine was applied. */
+    readonly revokedCapabilities: ReadonlyArray<PluginCapability>;
+    /** Whether the quarantine has been lifted. */
+    lifted: boolean;
+    /** Unix epoch ms when quarantine was lifted, if applicable. */
+    liftedAt?: number;
+}
+/**
+ * PluginQuarantineEngine — Tracks quarantined plugins and applies/revokes
+ * capability restrictions.
+ *
+ * This is intentionally separate from the PluginLifecycleManager so that
+ * quarantine can be applied without triggering a full state machine transition.
+ * The lifecycle manager delegates to this engine when quarantine is requested.
+ */
+export declare class PluginQuarantineEngine {
+    private readonly records;
+    /**
+     * quarantine — Apply quarantine to a plugin.
+     *
+     * Revokes all high-risk capabilities from the plugin's resolved manifest
+     * and creates a quarantine record. The plugin remains in memory but its
+     * unsafe contributions are neutralised.
+     *
+     * @param pluginName       - Plugin identifier.
+     * @param capabilityManifest - The plugin's live capability manifest (mutated in place).
+     * @param reason           - Human-readable reason for quarantine.
+     * @returns The quarantine record, or null if already quarantined.
+     */
+    quarantine(pluginName: string, capabilityManifest: PluginCapabilityManifest, reason: string): QuarantineRecord | null;
+    /**
+     * lift — Lift quarantine for a plugin.
+     *
+     * Previously revoked capabilities are NOT automatically restored here;
+     * the caller should trigger a re-resolve of the capability manifest
+     * (e.g. by reloading the plugin) after lifting so that trust-tier
+     * constraints are re-evaluated with the new tier.
+     *
+     * @returns true if quarantine was successfully lifted; false if not found.
+     */
+    lift(pluginName: string): boolean;
+    /** Returns whether a plugin is currently quarantined (and not lifted). */
+    isQuarantined(pluginName: string): boolean;
+    /** Returns the quarantine record for a plugin, or undefined. */
+    getRecord(pluginName: string): Readonly<QuarantineRecord> | undefined;
+    /** Returns all quarantine records (including lifted ones). */
+    getAllRecords(): ReadonlyArray<Readonly<QuarantineRecord>>;
+    /** Returns only active (not-lifted) quarantine records. */
+    getActiveQuarantines(): ReadonlyArray<Readonly<QuarantineRecord>>;
+    /**
+     * applyToNewManifest — Apply quarantine constraints to a freshly-resolved
+     * capability manifest. Used when a plugin is reloaded while under quarantine.
+     *
+     * Unlike `quarantine()`, this does not create a new record — it reuses the
+     * existing one. Call this during manifest re-resolution if `isQuarantined()`
+     * is true.
+     */
+    applyToNewManifest(pluginName: string, capabilityManifest: PluginCapabilityManifest): void;
+}
+//# sourceMappingURL=quarantine.d.ts.map

package/dist/_internal/platform/runtime/plugins/quarantine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/plugins/quarantine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAK7E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC9D,8CAA8C;IAC9C,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAE/D;;;;;;;;;;;OAWG;IACH,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,wBAAwB,EAC5C,MAAM,EAAE,MAAM,GACb,gBAAgB,GAAG,IAAI;IA4C1B;;;;;;;;;OASG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAkBjC,0EAA0E;IAC1E,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAK1C,gEAAgE;IAChE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,SAAS;IAIrE,8DAA8D;IAC9D,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAI1D,2DAA2D;IAC3D,oBAAoB,IAAI,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAIjE;;;;;;;OAOG;IACH,kBAAkB,CAChB,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,wBAAwB,GAC3C,IAAI;CA2BR"}

package/dist/_internal/platform/runtime/plugins/quarantine.js

@@ -0,0 +1,140 @@
+/**
+ * Plugin quarantine engine.
+ *
+ * Quarantine removes a plugin's unsafe contribution effects without fully
+ * unloading it. This allows the operator to isolate a suspicious plugin,
+ * inspect it, then either restore or permanently disable it.
+ *
+ * Quarantine effects:
+ *   - All high-risk capabilities are revoked in the resolved manifest.
+ *   - The plugin is moved to a `quarantined` lifecycle bucket in the store.
+ *   - A quarantine record is created with a timestamp and reason.
+ *
+ * Restore path:
+ *   - `lift()` — Restores previously revoked capabilities (if trust was upgraded).
+ *   - The caller is responsible for reloading the plugin after lifting.
+ */
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
+import { isHighRiskCapability } from './manifest.js';
+// ── Quarantine Engine ─────────────────────────────────────────────────────────
+/**
+ * PluginQuarantineEngine — Tracks quarantined plugins and applies/revokes
+ * capability restrictions.
+ *
+ * This is intentionally separate from the PluginLifecycleManager so that
+ * quarantine can be applied without triggering a full state machine transition.
+ * The lifecycle manager delegates to this engine when quarantine is requested.
+ */
+export class PluginQuarantineEngine {
+    records = new Map();
+    /**
+     * quarantine — Apply quarantine to a plugin.
+     *
+     * Revokes all high-risk capabilities from the plugin's resolved manifest
+     * and creates a quarantine record. The plugin remains in memory but its
+     * unsafe contributions are neutralised.
+     *
+     * @param pluginName       - Plugin identifier.
+     * @param capabilityManifest - The plugin's live capability manifest (mutated in place).
+     * @param reason           - Human-readable reason for quarantine.
+     * @returns The quarantine record, or null if already quarantined.
+     */
+    quarantine(pluginName, capabilityManifest, reason) {
+        if (this.isQuarantined(pluginName)) {
+            logger.warn(`[plugin-quarantine] ${pluginName}: already quarantined — skipping`);
+            return null;
+        }
+        // Identify which currently-granted capabilities are high-risk.
+        const revokedCapabilities = capabilityManifest.granted.filter((cap) => isHighRiskCapability(cap));
+        // Strip high-risk capabilities from the live manifest.
+        capabilityManifest.granted = capabilityManifest.granted.filter((cap) => !isHighRiskCapability(cap));
+        // Record denied reason for each revoked cap. Collect first, then assign once.
+        const newDenied = [];
+        for (const cap of revokedCapabilities) {
+            newDenied.push(cap);
+            capabilityManifest.denialReasons[cap] = `Capability '${cap}' revoked: plugin quarantined — ${reason}`;
+        }
+        capabilityManifest.denied = [...capabilityManifest.denied, ...newDenied];
+        const record = {
+            pluginName,
+            quarantinedAt: Date.now(),
+            reason,
+            revokedCapabilities: Object.freeze(revokedCapabilities),
+            lifted: false,
+        };
+        this.records.set(pluginName, record);
+        logger.warn(`[plugin-quarantine] ${pluginName}: quarantined — ${reason}` +
+            (revokedCapabilities.length > 0
+                ? ` (revoked: [${revokedCapabilities.join(', ')}])`
+                : ' (no high-risk capabilities were granted)'));
+        return record;
+    }
+    /**
+     * lift — Lift quarantine for a plugin.
+     *
+     * Previously revoked capabilities are NOT automatically restored here;
+     * the caller should trigger a re-resolve of the capability manifest
+     * (e.g. by reloading the plugin) after lifting so that trust-tier
+     * constraints are re-evaluated with the new tier.
+     *
+     * @returns true if quarantine was successfully lifted; false if not found.
+     */
+    lift(pluginName) {
+        const record = this.records.get(pluginName);
+        if (!record) {
+            logger.debug(`[plugin-quarantine] ${pluginName}: no quarantine record found — nothing to lift`);
+            return false;
+        }
+        if (record.lifted) {
+            logger.debug(`[plugin-quarantine] ${pluginName}: quarantine already lifted`);
+            return false;
+        }
+        record.lifted = true;
+        record.liftedAt = Date.now();
+        logger.info(`[plugin-quarantine] ${pluginName}: quarantine lifted`);
+        return true;
+    }
+    /** Returns whether a plugin is currently quarantined (and not lifted). */
+    isQuarantined(pluginName) {
+        const record = this.records.get(pluginName);
+        return record !== undefined && !record.lifted;
+    }
+    /** Returns the quarantine record for a plugin, or undefined. */
+    getRecord(pluginName) {
+        return this.records.get(pluginName);
+    }
+    /** Returns all quarantine records (including lifted ones). */
+    getAllRecords() {
+        return Array.from(this.records.values());
+    }
+    /** Returns only active (not-lifted) quarantine records. */
+    getActiveQuarantines() {
+        return Array.from(this.records.values()).filter((r) => !r.lifted);
+    }
+    /**
+     * applyToNewManifest — Apply quarantine constraints to a freshly-resolved
+     * capability manifest. Used when a plugin is reloaded while under quarantine.
+     *
+     * Unlike `quarantine()`, this does not create a new record — it reuses the
+     * existing one. Call this during manifest re-resolution if `isQuarantined()`
+     * is true.
+     */
+    applyToNewManifest(pluginName, capabilityManifest) {
+        if (!this.isQuarantined(pluginName))
+            return;
+        const toRevoke = capabilityManifest.granted.filter((cap) => isHighRiskCapability(cap));
+        if (toRevoke.length === 0)
+            return;
+        capabilityManifest.granted = capabilityManifest.granted.filter((cap) => !isHighRiskCapability(cap));
+        // Collect all denied caps first, then assign once to avoid quadratic churn.
+        const reason = this.records.get(pluginName)?.reason ?? 'quarantined';
+        const newDenied = [];
+        for (const cap of toRevoke) {
+            newDenied.push(cap);
+            capabilityManifest.denialReasons[cap] = `Capability '${cap}' blocked: plugin is quarantined — ${reason}`;
+        }
+        capabilityManifest.denied = [...capabilityManifest.denied, ...newDenied];
+        logger.debug(`[plugin-quarantine] ${pluginName}: quarantine re-applied to reloaded manifest` +
+            ` (blocked: [${toRevoke.join(', ')}])`);
+    }
+}

package/dist/_internal/platform/runtime/plugins/trust.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Plugin extension trust framework.
+ *
+ * Defines trust tiers (untrusted, limited, trusted), signed manifest
+ * validation for the trusted tier, and the PluginTrustStore that manages
+ * trust records with persistence support.
+ *
+ * Trust tiers gate access to high-risk capabilities:
+ *   - untrusted — only safe, read-only capabilities allowed
+ *   - limited   — moderate capabilities; high-risk capabilities blocked
+ *   - trusted   — full capability set; requires signed manifest validation
+ */
+import type { PluginCapability } from './types.js';
+/**
+ * The three trust tiers available to a plugin.
+ *
+ * - `untrusted` — Default for newly discovered plugins. Only safe capabilities
+ *   are accessible. The plugin may not have been reviewed.
+ * - `limited`   — Operator-reviewed plugin. Moderate capabilities granted.
+ *   High-risk capabilities (shell.exec, filesystem.write, network.outbound)
+ *   remain blocked without explicit trust escalation.
+ * - `trusted`   — Fully trusted plugin. Requires a valid signed manifest.
+ *   All declared capabilities may be granted (subject to runtime policy).
+ */
+export type PluginTrustTier = 'untrusted' | 'limited' | 'trusted';
+/**
+ * A persisted trust record for a single plugin.
+ */
+export interface PluginTrustRecord {
+    /** Plugin identifier (manifest name). */
+    readonly pluginName: string;
+    /** Current trust tier. */
+    tier: PluginTrustTier;
+    /** Unix epoch ms when the trust record was last updated. */
+    updatedAt: number;
+    /** Who or what granted this trust level. */
+    grantedBy: 'operator' | 'signed-manifest';
+    /**
+     * Fingerprint of the verified signature for trusted-tier plugins.
+     * Undefined for untrusted/limited plugins.
+     */
+    signatureFingerprint?: string;
+    /** Optional human-readable note attached by the operator. */
+    note?: string;
+}
+/**
+ * Result of validating a plugin's signed manifest.
+ */
+export interface SignatureValidationResult {
+    /** Whether the signature is valid. */
+    valid: boolean;
+    /** A stable fingerprint derived from the signature (e.g. hex digest prefix). */
+    fingerprint?: string;
+    /** Human-readable failure reason. Only set when `valid` is false. */
+    reason?: string;
+}
+/**
+ * validatePluginSignature — Validates the manifest signature for a plugin
+ * seeking the `trusted` tier.
+ *
+ * The signature field in PluginManifestV2 is expected to be a base64-encoded
+ * HMAC-SHA256 of the canonical manifest JSON (name + version + capabilities
+ * sorted and serialised). For production use, callers should supply a real
+ * key; this implementation uses a structural check so external tooling can
+ * provide real crypto without requiring Node.js crypto APIs at import time.
+ *
+ * @param manifest  - The raw manifest object containing the `signature` field.
+ * @param publicKey - Optional verification key. When omitted, structural
+ *                    validity only is checked (suitable for CI/test).
+ */
+export declare function validatePluginSignature(manifest: {
+    name: string;
+    version: string;
+    capabilities?: string[];
+    signature?: string;
+}, publicKey?: string): SignatureValidationResult;
+/**
+ * Capabilities that are safe for any trust tier (including untrusted).
+ */
+export declare const SAFE_CAPABILITIES: ReadonlyArray<PluginCapability>;
+/**
+ * filterCapabilitiesByTrust — Returns the subset of `requested` capabilities
+ * that are permitted for the given trust tier.
+ *
+ * - `untrusted`: only SAFE_CAPABILITIES
+ * - `limited`:   all capabilities except HIGH_RISK_CAPABILITIES
+ * - `trusted`:   all capabilities (HIGH_RISK_CAPABILITIES included)
+ */
+export declare function filterCapabilitiesByTrust(requested: ReadonlyArray<PluginCapability>, tier: PluginTrustTier): {
+    permitted: PluginCapability[];
+    blocked: PluginCapability[];
+    reasons: Partial<Record<PluginCapability, string>>;
+};
+/**
+ * PluginTrustStore — In-memory trust registry for all plugins.
+ *
+ * Callers are responsible for persistence (serialise/deserialise via
+ * `exportRecords` / `importRecords`). The PluginManager bridges this to
+ * the plugins.json state file.
+ */
+export declare class PluginTrustStore {
+    private readonly records;
+    /**
+     * Returns the trust record for a plugin, or `undefined` if not yet assessed.
+     * Callers should treat `undefined` as implicitly `untrusted`.
+     */
+    getRecord(pluginName: string): Readonly<PluginTrustRecord> | undefined;
+    /**
+     * Returns the trust tier for a plugin.
+     * Plugins without an explicit record are treated as `untrusted`.
+     */
+    getTier(pluginName: string): PluginTrustTier;
+    /**
+     * setTier — Explicitly assign a trust tier to a plugin.
+     *
+     * Intended for operator use via `/plugin trust`.
+     * For the `trusted` tier, prefer `trustSigned()` which also validates the signature.
+     */
+    setTier(pluginName: string, tier: PluginTrustTier, options?: {
+        note?: string;
+    }): PluginTrustRecord;
+    /**
+     * trustSigned — Elevate a plugin to the `trusted` tier after verifying its
+     * signed manifest. Returns `{ ok: false, reason }` if validation fails.
+     */
+    trustSigned(pluginName: string, manifest: {
+        name: string;
+        version: string;
+        capabilities?: string[];
+        signature?: string;
+    }, publicKey?: string): {
+        ok: true;
+        record: PluginTrustRecord;
+    } | {
+        ok: false;
+        reason: string;
+    };
+    /**
+     * verify — Verify the current signature on a plugin manifest without
+     * changing its tier. Useful for `/plugin verify` inspection.
+     */
+    verify(manifest: {
+        name: string;
+        version: string;
+        capabilities?: string[];
+        signature?: string;
+    }, publicKey?: string): SignatureValidationResult;
+    /** Returns all trust records as an array. */
+    getAllRecords(): ReadonlyArray<Readonly<PluginTrustRecord>>;
+    /** Export all records for persistence. */
+    exportRecords(): Record<string, PluginTrustRecord>;
+    /** Import records from persisted state. Merges into existing records. */
+    importRecords(records: Record<string, PluginTrustRecord>): void;
+}
+//# sourceMappingURL=trust.d.ts.map

package/dist/_internal/platform/runtime/plugins/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/plugins/trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAIlE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0BAA0B;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,SAAS,EAAE,UAAU,GAAG,iBAAiB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,sCAAsC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACxF,SAAS,CAAC,EAAE,MAAM,GACjB,yBAAyB,CAsC3B;AAID;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAMpD,CAAC;AAEX;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC1C,IAAI,EAAE,eAAe,GACpB;IAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,CA2BpH;AAID;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAEhE;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,SAAS;IAItE;;;OAGG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe;IAI5C;;;;;OAKG;IACH,OAAO,CACL,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,iBAAiB;IAapB;;;OAGG;IACH,WAAW,CACT,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACxF,SAAS,CAAC,EAAE,MAAM,GACjB;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,iBAAiB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAmB1E;;;OAGG;IACH,MAAM,CACJ,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACxF,SAAS,CAAC,EAAE,MAAM,GACjB,yBAAyB;IAI5B,6CAA6C;IAC7C,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAI3D,0CAA0C;IAC1C,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAQlD,yEAAyE;IACzE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI;CAMhE"}