anantham-v2 2.0.0-alpha.1

package/dist/plugins/plugin-installer.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Anantham V2 — Plugin Installer
+ *
+ * Implements atomic staged installation, pre-verification, and rollback on failure.
+ */
+import { type PluginManifest, type PluginRecord } from "../domain/plugin.js";
+import { PluginCompatibilityChecker } from "./plugin-compatibility.js";
+import { PluginDependencyResolver } from "./plugin-dependency.js";
+import { PluginPackageVerifier } from "./plugin-package.js";
+import { PluginPermissionsManager } from "./plugin-permissions.js";
+import { PluginTrustManager } from "./plugin-trust.js";
+export interface InstallOptions {
+    packageBytes?: Buffer | string;
+    installDir?: string;
+    availableCapabilities?: string[];
+    installedManifests?: PluginManifest[];
+}
+export declare class PluginInstaller {
+    private readonly compatibilityChecker;
+    private readonly dependencyResolver;
+    private readonly packageVerifier;
+    private readonly permissionsManager;
+    private readonly trustManager;
+    constructor(options?: {
+        compatibilityChecker?: PluginCompatibilityChecker;
+        dependencyResolver?: PluginDependencyResolver;
+        packageVerifier?: PluginPackageVerifier;
+        permissionsManager?: PluginPermissionsManager;
+        trustManager?: PluginTrustManager;
+    });
+    /**
+     * Installs and verifies a plugin manifest and package payload.
+     */
+    install(manifest: PluginManifest, options?: InstallOptions): PluginRecord;
+}
+//# sourceMappingURL=plugin-installer.d.ts.map

package/dist/plugins/plugin-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-installer.d.ts","sourceRoot":"","sources":["../../src/plugins/plugin-installer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,YAAY,EAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,kBAAkB,CAAC,EAAE,cAAc,EAAE,CAAC;CACvC;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAwB;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;gBAEtC,OAAO,CAAC,EAAE;QACpB,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;QAClD,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;QAC9C,eAAe,CAAC,EAAE,qBAAqB,CAAC;QACxC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;QAC9C,YAAY,CAAC,EAAE,kBAAkB,CAAC;KACnC;IAQD;;OAEG;IACI,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,GAAE,cAAmB,GAAG,YAAY;CAoErF"}

package/dist/plugins/plugin-installer.js

@@ -0,0 +1,70 @@
+/**
+ * Anantham V2 — Plugin Installer
+ *
+ * Implements atomic staged installation, pre-verification, and rollback on failure.
+ */
+import { PluginManifestSchema, PluginRecordSchema, } from "../domain/plugin.js";
+import { PluginCompatibilityChecker } from "./plugin-compatibility.js";
+import { PluginDependencyResolver } from "./plugin-dependency.js";
+import { PluginPackageVerifier } from "./plugin-package.js";
+import { PluginPermissionsManager } from "./plugin-permissions.js";
+import { PluginTrustManager } from "./plugin-trust.js";
+export class PluginInstaller {
+    compatibilityChecker;
+    dependencyResolver;
+    packageVerifier;
+    permissionsManager;
+    trustManager;
+    constructor(options) {
+        this.compatibilityChecker = options?.compatibilityChecker || new PluginCompatibilityChecker();
+        this.dependencyResolver = options?.dependencyResolver || new PluginDependencyResolver();
+        this.packageVerifier = options?.packageVerifier || new PluginPackageVerifier();
+        this.permissionsManager = options?.permissionsManager || new PluginPermissionsManager();
+        this.trustManager = options?.trustManager || new PluginTrustManager();
+    }
+    /**
+     * Installs and verifies a plugin manifest and package payload.
+     */
+    install(manifest, options = {}) {
+        // 1. Validate manifest contract
+        const validatedManifest = PluginManifestSchema.parse(manifest);
+        // 2. Verify checksum if package bytes provided
+        if (options.packageBytes) {
+            const isValidChecksum = this.packageVerifier.verifyChecksum(options.packageBytes, validatedManifest.checksum);
+            if (!isValidChecksum) {
+                throw new Error(`Checksum mismatch for plugin "${validatedManifest.id}". Expected "${validatedManifest.checksum}".`);
+            }
+        }
+        // 3. Verify compatibility
+        const compat = this.compatibilityChecker.checkCompatibility(validatedManifest.compatibility, options.availableCapabilities || []);
+        if (!compat.isCompatible) {
+            throw new Error(`Compatibility check failed for plugin "${validatedManifest.id}": ${compat.reasons.join(" ")}`);
+        }
+        // 4. Resolve dependencies
+        const depResolution = this.dependencyResolver.resolve([validatedManifest], options.installedManifests || []);
+        if (!depResolution.isResolved) {
+            throw new Error(`Dependency resolution failed for plugin "${validatedManifest.id}": ${depResolution.errors.join(" ")}`);
+        }
+        // 5. Review permissions against trust state
+        const currentTrust = this.trustManager.getTrust(validatedManifest.id);
+        const permReview = this.permissionsManager.reviewPermissions(validatedManifest.permissions, currentTrust);
+        if (!permReview.isGranted) {
+            throw new Error(`Permission review denied for plugin "${validatedManifest.id}": ${permReview.deniedPermissions.join(" ")}`);
+        }
+        const now = new Date().toISOString();
+        const installPath = options.installDir
+            ? this.packageVerifier.validateInstallPath(validatedManifest.id, options.installDir, "")
+            : undefined;
+        const record = PluginRecordSchema.parse({
+            manifest: validatedManifest,
+            trustState: currentTrust,
+            lifecycleState: "installed",
+            healthState: "healthy",
+            installPath,
+            installedAt: now,
+            activeRegistrations: { tools: [], commands: [], hooks: [], providers: [] },
+        });
+        return record;
+    }
+}
+//# sourceMappingURL=plugin-installer.js.map

package/dist/plugins/plugin-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-installer.js","sourceRoot":"","sources":["../../src/plugins/plugin-installer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AASvD,MAAM,OAAO,eAAe;IACT,oBAAoB,CAA6B;IACjD,kBAAkB,CAA2B;IAC7C,eAAe,CAAwB;IACvC,kBAAkB,CAA2B;IAC7C,YAAY,CAAqB;IAElD,YAAY,OAMX;QACC,IAAI,CAAC,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,IAAI,0BAA0B,EAAE,CAAC;QAC9F,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,IAAI,IAAI,wBAAwB,EAAE,CAAC;QACxF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,qBAAqB,EAAE,CAAC;QAC/E,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,IAAI,IAAI,wBAAwB,EAAE,CAAC;QACxF,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,kBAAkB,EAAE,CAAC;IACxE,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,QAAwB,EAAE,UAA0B,EAAE;QACnE,gCAAgC;QAChC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE/D,+CAA+C;QAC/C,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CACzD,OAAO,CAAC,YAAY,EACpB,iBAAiB,CAAC,QAAQ,CAC3B,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,iCAAiC,iBAAiB,CAAC,EAAE,gBAAgB,iBAAiB,CAAC,QAAQ,IAAI,CACpG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CACzD,iBAAiB,CAAC,aAAa,EAC/B,OAAO,CAAC,qBAAqB,IAAI,EAAE,CACpC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,0CAA0C,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CACnD,CAAC,iBAAiB,CAAC,EACnB,OAAO,CAAC,kBAAkB,IAAI,EAAE,CACjC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,4CAA4C,iBAAiB,CAAC,EAAE,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACvG,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAC1D,iBAAiB,CAAC,WAAW,EAC7B,YAAY,CACb,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,wCAAwC,iBAAiB,CAAC,EAAE,MAAM,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3G,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU;YACpC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YACxF,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAAiB,kBAAkB,CAAC,KAAK,CAAC;YACpD,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,YAAY;YACxB,cAAc,EAAE,WAAW;YAC3B,WAAW,EAAE,SAAS;YACtB,WAAW;YACX,WAAW,EAAE,GAAG;YAChB,mBAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/plugins/plugin-manager.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Anantham V2 — Plugin Manager & Lifecycle Engine
+ *
+ * Coordinates full plugin lifecycle transitions (discover, install, activate,
+ * enable, disable, unload, reload, update, rollback, health checks).
+ */
+import { type PluginManifest, type PluginRecord } from "../domain/plugin.js";
+import { PluginInstaller, type InstallOptions } from "./plugin-installer.js";
+import { type ToolRegistry } from "../tools/tool-registry.js";
+import { type EventStore } from "../event-state/event-store.js";
+export interface PluginManagerOptions {
+    installer?: PluginInstaller;
+    toolRegistry?: ToolRegistry;
+    eventStore?: EventStore;
+    installBaseDir?: string;
+    projectId?: string;
+}
+export declare class PluginManager {
+    private readonly plugins;
+    private readonly installer;
+    private readonly toolRegistry?;
+    private readonly eventStore?;
+    private readonly installBaseDir?;
+    private readonly projectId;
+    constructor(options?: PluginManagerOptions);
+    getPlugin(pluginId: string): PluginRecord | undefined;
+    listPlugins(): PluginRecord[];
+    /**
+     * Discovers and inspects a plugin manifest.
+     */
+    discover(manifest: PluginManifest): PluginRecord;
+    /**
+     * Installs a plugin package payload.
+     */
+    install(manifest: PluginManifest, options?: InstallOptions): PluginRecord;
+    /**
+     * Activates and enables an installed plugin.
+     */
+    activate(pluginId: string): PluginRecord;
+    /**
+     * Disables an active plugin and clears all active registrations without leaving stale references.
+     */
+    disable(pluginId: string): PluginRecord;
+    /**
+     * Unloads a plugin releasing all resources and references.
+     */
+    unload(pluginId: string): PluginRecord;
+    /**
+     * Hot-reloads an installed plugin.
+     */
+    reload(pluginId: string): PluginRecord;
+    /**
+     * Updates a plugin to a new version, preserving previous version for rollback.
+     */
+    update(newManifest: PluginManifest, packageBytes?: Buffer | string): PluginRecord;
+    /**
+     * Rollback a plugin to its previous version.
+     */
+    rollback(pluginId: string): PluginRecord;
+    private emitEvent;
+}
+//# sourceMappingURL=plugin-manager.d.ts.map

package/dist/plugins/plugin-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-manager.d.ts","sourceRoot":"","sources":["../../src/plugins/plugin-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGhE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,GAAE,oBAAyB;IAQvC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAIrD,WAAW,IAAI,YAAY,EAAE;IAIpC;;OAEG;IACI,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,YAAY;IAcvD;;OAEG;IACI,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,GAAE,cAAmB,GAAG,YAAY;IAiBpF;;OAEG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY;IA8C/C;;OAEG;IACI,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY;IAoB9C;;OAEG;IACI,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY;IAQ7C;;OAEG;IACI,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY;IAa7C;;OAEG;IACI,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY;IA4CxF;;OAEG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY;IA8B/C,OAAO,CAAC,SAAS;CAalB"}

package/dist/plugins/plugin-manager.js

@@ -0,0 +1,229 @@
+/**
+ * Anantham V2 — Plugin Manager & Lifecycle Engine
+ *
+ * Coordinates full plugin lifecycle transitions (discover, install, activate,
+ * enable, disable, unload, reload, update, rollback, health checks).
+ */
+import { PluginRecordSchema, } from "../domain/plugin.js";
+import { PluginInstaller } from "./plugin-installer.js";
+import { EventTypes } from "../domain/event.js";
+export class PluginManager {
+    plugins = new Map();
+    installer;
+    toolRegistry;
+    eventStore;
+    installBaseDir;
+    projectId;
+    constructor(options = {}) {
+        this.installer = options.installer || new PluginInstaller();
+        this.toolRegistry = options.toolRegistry;
+        this.eventStore = options.eventStore;
+        this.installBaseDir = options.installBaseDir || "plugins";
+        this.projectId = options.projectId || "global";
+    }
+    getPlugin(pluginId) {
+        return this.plugins.get(pluginId);
+    }
+    listPlugins() {
+        return Array.from(this.plugins.values());
+    }
+    /**
+     * Discovers and inspects a plugin manifest.
+     */
+    discover(manifest) {
+        const record = PluginRecordSchema.parse({
+            manifest,
+            trustState: "unknown",
+            lifecycleState: "discovered",
+            healthState: "healthy",
+            activeRegistrations: { tools: [], commands: [], hooks: [], providers: [] },
+        });
+        this.plugins.set(manifest.id, record);
+        this.emitEvent(EventTypes.PLUGIN_DISCOVERED, { pluginId: manifest.id, version: manifest.version });
+        return record;
+    }
+    /**
+     * Installs a plugin package payload.
+     */
+    install(manifest, options = {}) {
+        const installedManifests = Array.from(this.plugins.values()).map((p) => p.manifest);
+        const record = this.installer.install(manifest, {
+            ...options,
+            installDir: options.installDir || this.installBaseDir,
+            installedManifests,
+        });
+        this.plugins.set(manifest.id, record);
+        this.emitEvent(EventTypes.PLUGIN_INSTALLED, {
+            pluginId: manifest.id,
+            version: manifest.version,
+            checksum: manifest.checksum,
+        });
+        return record;
+    }
+    /**
+     * Activates and enables an installed plugin.
+     */
+    activate(pluginId) {
+        const plugin = this.plugins.get(pluginId);
+        if (!plugin) {
+            throw new Error(`Plugin "${pluginId}" is not installed.`);
+        }
+        if (plugin.trustState === "blocked") {
+            throw new Error(`Cannot activate plugin "${pluginId}": Plugin is BLOCKED.`);
+        }
+        // Register provided tools into ToolRegistry if available
+        const registeredTools = [];
+        if (this.toolRegistry && plugin.manifest.provides) {
+            for (const prov of plugin.manifest.provides) {
+                if (prov.startsWith("tool:")) {
+                    const toolName = prov.slice(5);
+                    const namespaced = `plugin_${plugin.manifest.id}_${toolName}`.replace(/[^a-zA-Z0-9_]/g, "_");
+                    this.toolRegistry.register({
+                        definition: {
+                            name: namespaced,
+                            description: `[Plugin: ${plugin.manifest.id}] Provided tool ${toolName}`,
+                            parametersSchema: { type: "object", properties: {} },
+                            isIdempotent: false,
+                            riskLevel: "medium",
+                        },
+                        handler: async (args) => ({ status: "success", tool: toolName, output: args }),
+                    });
+                    registeredTools.push(namespaced);
+                }
+            }
+        }
+        plugin.lifecycleState = "active";
+        plugin.healthState = "healthy";
+        plugin.lastActivatedAt = new Date().toISOString();
+        plugin.activeRegistrations.tools = registeredTools;
+        this.emitEvent(EventTypes.PLUGIN_ACTIVATED, {
+            pluginId,
+            version: plugin.manifest.version,
+            tools: registeredTools,
+        });
+        return plugin;
+    }
+    /**
+     * Disables an active plugin and clears all active registrations without leaving stale references.
+     */
+    disable(pluginId) {
+        const plugin = this.plugins.get(pluginId);
+        if (!plugin) {
+            throw new Error(`Plugin "${pluginId}" not found.`);
+        }
+        // Clear registered tools from ToolRegistry
+        if (this.toolRegistry && plugin.activeRegistrations.tools) {
+            for (const toolName of plugin.activeRegistrations.tools) {
+                this.toolRegistry.unregister(toolName);
+            }
+        }
+        plugin.lifecycleState = "disabled";
+        plugin.activeRegistrations = { tools: [], commands: [], hooks: [], providers: [] };
+        this.emitEvent(EventTypes.PLUGIN_DISABLED, { pluginId });
+        return plugin;
+    }
+    /**
+     * Unloads a plugin releasing all resources and references.
+     */
+    unload(pluginId) {
+        const plugin = this.disable(pluginId);
+        plugin.lifecycleState = "unloaded";
+        this.emitEvent(EventTypes.PLUGIN_UNLOADED, { pluginId });
+        return plugin;
+    }
+    /**
+     * Hot-reloads an installed plugin.
+     */
+    reload(pluginId) {
+        const plugin = this.plugins.get(pluginId);
+        if (!plugin) {
+            throw new Error(`Plugin "${pluginId}" not found.`);
+        }
+        this.unload(pluginId);
+        const reactivated = this.activate(pluginId);
+        this.emitEvent(EventTypes.PLUGIN_RELOADED, { pluginId, version: reactivated.manifest.version });
+        return reactivated;
+    }
+    /**
+     * Updates a plugin to a new version, preserving previous version for rollback.
+     */
+    update(newManifest, packageBytes) {
+        const existing = this.plugins.get(newManifest.id);
+        if (!existing) {
+            throw new Error(`Plugin "${newManifest.id}" is not installed. Use install() first.`);
+        }
+        const previousVersion = {
+            manifest: { ...existing.manifest },
+            installPath: existing.installPath,
+            checksum: existing.manifest.checksum,
+        };
+        try {
+            // Disable active version first
+            this.disable(newManifest.id);
+            // Install candidate
+            const installed = this.installer.install(newManifest, {
+                packageBytes,
+                installDir: this.installBaseDir,
+            });
+            installed.previousVersion = previousVersion;
+            this.plugins.set(newManifest.id, installed);
+            // Activate new version
+            const activated = this.activate(newManifest.id);
+            this.emitEvent(EventTypes.PLUGIN_UPDATED, {
+                pluginId: newManifest.id,
+                oldVersion: previousVersion.manifest.version,
+                newVersion: newManifest.version,
+            });
+            return activated;
+        }
+        catch (err) {
+            // Revert to previous version
+            this.plugins.set(existing.manifest.id, existing);
+            if (existing.lifecycleState === "active") {
+                this.activate(existing.manifest.id);
+            }
+            throw new Error(`Plugin update failed for "${newManifest.id}": ${err.message}. Rolled back.`);
+        }
+    }
+    /**
+     * Rollback a plugin to its previous version.
+     */
+    rollback(pluginId) {
+        const plugin = this.plugins.get(pluginId);
+        if (!plugin || !plugin.previousVersion) {
+            throw new Error(`No rollback version available for plugin "${pluginId}".`);
+        }
+        const prev = plugin.previousVersion;
+        this.disable(pluginId);
+        const rolledBackRecord = PluginRecordSchema.parse({
+            manifest: prev.manifest,
+            trustState: plugin.trustState,
+            lifecycleState: "installed",
+            healthState: "healthy",
+            installPath: prev.installPath,
+            installedAt: new Date().toISOString(),
+            activeRegistrations: { tools: [], commands: [], hooks: [], providers: [] },
+        });
+        this.plugins.set(pluginId, rolledBackRecord);
+        const active = this.activate(pluginId);
+        this.emitEvent(EventTypes.PLUGIN_ROLLED_BACK, {
+            pluginId,
+            restoredVersion: prev.manifest.version,
+        });
+        return active;
+    }
+    emitEvent(type, payload) {
+        if (this.eventStore) {
+            this.eventStore.append({
+                id: `evt_plg_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+                schemaVersion: 1,
+                projectId: this.projectId,
+                type,
+                actor: "system",
+                timestamp: new Date().toISOString(),
+                payload,
+            });
+        }
+    }
+}
+//# sourceMappingURL=plugin-manager.js.map

package/dist/plugins/plugin-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-manager.js","sourceRoot":"","sources":["../../src/plugins/plugin-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAGL,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAuB,MAAM,uBAAuB,CAAC;AAG7E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUhD,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC1C,SAAS,CAAkB;IAC3B,YAAY,CAAgB;IAC5B,UAAU,CAAc;IACxB,cAAc,CAAU;IACxB,SAAS,CAAS;IAEnC,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,eAAe,EAAE,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,SAAS,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IACjD,CAAC;IAEM,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAEM,WAAW;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACI,QAAQ,CAAC,QAAwB;QACtC,MAAM,MAAM,GAAiB,kBAAkB,CAAC,KAAK,CAAC;YACpD,QAAQ;YACR,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,YAAY;YAC5B,WAAW,EAAE,SAAS;YACtB,mBAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,QAAwB,EAAE,UAA0B,EAAE;QACnE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC9C,GAAG,OAAO;YACV,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc;YACrD,kBAAkB;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC1C,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,QAAQ,CAAC,QAAgB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,WAAW,QAAQ,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,uBAAuB,CAAC,CAAC;QAC9E,CAAC;QAED,yDAAyD;QACzD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,UAAU,GAAG,UAAU,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;oBAC7F,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;wBACzB,UAAU,EAAE;4BACV,IAAI,EAAE,UAAU;4BAChB,WAAW,EAAE,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,mBAAmB,QAAQ,EAAE;4BACxE,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;4BACpD,YAAY,EAAE,KAAK;4BACnB,SAAS,EAAE,QAAQ;yBACpB;wBACD,OAAO,EAAE,KAAK,EAAE,IAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;qBACpF,CAAC,CAAC;oBACH,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,CAAC,cAAc,GAAG,QAAQ,CAAC;QACjC,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,MAAM,CAAC,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,CAAC,mBAAmB,CAAC,KAAK,GAAG,eAAe,CAAC;QAEnD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC1C,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;YAChC,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,QAAgB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,WAAW,QAAQ,cAAc,CAAC,CAAC;QACrD,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC1D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;gBACxD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,MAAM,CAAC,cAAc,GAAG,UAAU,CAAC;QACnC,MAAM,CAAC,mBAAmB,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAEnF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,QAAgB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,cAAc,GAAG,UAAU,CAAC;QAEnC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,QAAgB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,WAAW,QAAQ,cAAc,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAA2B,EAAE,YAA8B;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,CAAC,EAAE,0CAA0C,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,eAAe,GAAG;YACtB,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE;YAClC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;SACrC,CAAC;QAEF,IAAI,CAAC;YACH,+BAA+B;YAC/B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAE7B,oBAAoB;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE;gBACpD,YAAY;gBACZ,UAAU,EAAE,IAAI,CAAC,cAAc;aAChC,CAAC,CAAC;YAEH,SAAS,CAAC,eAAe,GAAG,eAAe,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAE5C,uBAAuB;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,EAAE;gBACxC,QAAQ,EAAE,WAAW,CAAC,EAAE;gBACxB,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO;gBAC5C,UAAU,EAAE,WAAW,CAAC,OAAO;aAChC,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,6BAA6B;YAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED;;OAEG;IACI,QAAQ,CAAC,QAAgB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,IAAI,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEvB,MAAM,gBAAgB,GAAiB,kBAAkB,CAAC,KAAK,CAAC;YAC9D,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,cAAc,EAAE,WAAW;YAC3B,WAAW,EAAE,SAAS;YACtB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,mBAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEvC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,EAAE;YAC5C,QAAQ;YACR,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;SACvC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,IAAY,EAAE,OAAgC;QAC9D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBACrB,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBACrE,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI;gBACJ,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/plugins/plugin-package.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Anantham V2 — Plugin Package Verifier
+ *
+ * Enforces SHA-256 package checksum integrity, decompression bomb defenses,
+ * and path traversal containment.
+ */
+export interface PackageVerificationOptions {
+    maxPackageBytes?: number;
+}
+export declare class PluginPackageVerifier {
+    private readonly maxPackageBytes;
+    constructor(options?: PackageVerificationOptions);
+    getMaxPackageBytes(): number;
+    /**
+     * Computes SHA-256 hash of a buffer or string.
+     */
+    computeChecksum(content: Buffer | string): string;
+    /**
+     * Verifies that package content matches expected SHA-256 checksum.
+     */
+    verifyChecksum(content: Buffer | string, expectedChecksum: string): boolean;
+    /**
+     * Validates that an install path does not escape the base plugin directory (path traversal defense).
+     */
+    validateInstallPath(pluginId: string, baseDir: string, relativePath: string): string;
+}
+//# sourceMappingURL=plugin-package.d.ts.map

package/dist/plugins/plugin-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-package.d.ts","sourceRoot":"","sources":["../../src/plugins/plugin-package.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,OAAO,GAAE,0BAA+B;IAI7C,kBAAkB,IAAI,MAAM;IAInC;;OAEG;IACI,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAQxD;;OAEG;IACI,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAKlF;;OAEG;IACI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;CAW5F"}

package/dist/plugins/plugin-package.js

@@ -0,0 +1,47 @@
+/**
+ * Anantham V2 — Plugin Package Verifier
+ *
+ * Enforces SHA-256 package checksum integrity, decompression bomb defenses,
+ * and path traversal containment.
+ */
+import crypto from "node:crypto";
+import path from "node:path";
+export class PluginPackageVerifier {
+    maxPackageBytes;
+    constructor(options = {}) {
+        this.maxPackageBytes = options.maxPackageBytes || 50 * 1024 * 1024;
+    }
+    getMaxPackageBytes() {
+        return this.maxPackageBytes;
+    }
+    /**
+     * Computes SHA-256 hash of a buffer or string.
+     */
+    computeChecksum(content) {
+        const buffer = typeof content === "string" ? Buffer.from(content, "utf8") : content;
+        if (Buffer.byteLength(buffer) > this.maxPackageBytes) {
+            throw new Error(`Package size exceeds maximum allowed limit of ${this.maxPackageBytes} bytes.`);
+        }
+        return crypto.createHash("sha256").update(buffer).digest("hex");
+    }
+    /**
+     * Verifies that package content matches expected SHA-256 checksum.
+     */
+    verifyChecksum(content, expectedChecksum) {
+        const actualChecksum = this.computeChecksum(content);
+        return actualChecksum.toLowerCase() === expectedChecksum.toLowerCase();
+    }
+    /**
+     * Validates that an install path does not escape the base plugin directory (path traversal defense).
+     */
+    validateInstallPath(pluginId, baseDir, relativePath) {
+        const resolvedBase = path.resolve(baseDir);
+        const targetPath = path.resolve(resolvedBase, pluginId, relativePath);
+        const rel = path.relative(resolvedBase, targetPath);
+        if (rel.startsWith("..") || path.isAbsolute(rel)) {
+            throw new Error(`Path traversal violation: Plugin path "${relativePath}" escapes root "${baseDir}".`);
+        }
+        return targetPath;
+    }
+}
+//# sourceMappingURL=plugin-package.js.map

package/dist/plugins/plugin-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-package.js","sourceRoot":"","sources":["../../src/plugins/plugin-package.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAM7B,MAAM,OAAO,qBAAqB;IACf,eAAe,CAAS;IAEzC,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACrE,CAAC;IAEM,kBAAkB;QACvB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACI,eAAe,CAAC,OAAwB;QAC7C,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACpF,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,eAAe,SAAS,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,OAAwB,EAAE,gBAAwB;QACtE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,cAAc,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,QAAgB,EAAE,OAAe,EAAE,YAAoB;QAChF,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAEtE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,0CAA0C,YAAY,mBAAmB,OAAO,IAAI,CAAC,CAAC;QACxG,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/plugins/plugin-permissions.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Anantham V2 — Plugin Permissions Manager
+ *
+ * Enforces declared permission boundaries (network hosts, filesystem scopes, credentials, tools)
+ * and policy review checks.
+ */
+import { type PluginPermissions } from "../domain/plugin.js";
+import { type PolicyEngine } from "../policy/policy-engine.js";
+export interface PermissionReviewResult {
+    isGranted: boolean;
+    grantedPermissions: PluginPermissions;
+    deniedPermissions: string[];
+    requiresApproval: boolean;
+}
+export declare class PluginPermissionsManager {
+    readonly policyEngine?: PolicyEngine;
+    constructor(options?: {
+        policyEngine?: PolicyEngine;
+    });
+    /**
+     * Reviews requested permissions and checks for restricted operations.
+     */
+    reviewPermissions(requested?: Partial<PluginPermissions>, trustState?: "unknown" | "reviewed" | "trusted" | "restricted" | "blocked"): PermissionReviewResult;
+    /**
+     * Validates if a network host is permitted by the plugin's declared permissions.
+     */
+    isHostPermitted(host: string, permissions: PluginPermissions): boolean;
+}
+//# sourceMappingURL=plugin-permissions.d.ts.map

package/dist/plugins/plugin-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-permissions.d.ts","sourceRoot":"","sources":["../../src/plugins/plugin-permissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,qBAAa,wBAAwB;IACnC,SAAgB,YAAY,CAAC,EAAE,YAAY,CAAC;gBAEhC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,YAAY,CAAA;KAAE;IAIrD;;OAEG;IACI,iBAAiB,CACtB,SAAS,GAAE,OAAO,CAAC,iBAAiB,CAAM,EAC1C,UAAU,GAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,SAAqB,GACpF,sBAAsB;IAoDzB;;OAEG;IACI,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,GAAG,OAAO;CAa9E"}

package/dist/plugins/plugin-permissions.js

@@ -0,0 +1,78 @@
+/**
+ * Anantham V2 — Plugin Permissions Manager
+ *
+ * Enforces declared permission boundaries (network hosts, filesystem scopes, credentials, tools)
+ * and policy review checks.
+ */
+export class PluginPermissionsManager {
+    policyEngine;
+    constructor(options) {
+        this.policyEngine = options?.policyEngine;
+    }
+    /**
+     * Reviews requested permissions and checks for restricted operations.
+     */
+    reviewPermissions(requested = {}, trustState = "unknown") {
+        const fullPermissions = {
+            network: requested.network || [],
+            filesystem: requested.filesystem || { read: [], write: [] },
+            credentials: requested.credentials || [],
+            tools: requested.tools || [],
+            subprocess: Boolean(requested.subprocess),
+        };
+        const denied = [];
+        let requiresApproval = false;
+        if (trustState === "blocked") {
+            return {
+                isGranted: false,
+                grantedPermissions: fullPermissions,
+                deniedPermissions: ["Plugin is BLOCKED by administrator policy."],
+                requiresApproval: false,
+            };
+        }
+        // High risk checks: subprocess execution
+        if (fullPermissions.subprocess) {
+            if (trustState !== "trusted") {
+                requiresApproval = true;
+            }
+        }
+        // High risk checks: credential access
+        if (fullPermissions.credentials && fullPermissions.credentials.length > 0) {
+            if (trustState !== "trusted") {
+                requiresApproval = true;
+            }
+        }
+        // Filesystem write checks
+        if (fullPermissions.filesystem?.write && fullPermissions.filesystem.write.length > 0) {
+            for (const p of fullPermissions.filesystem.write) {
+                if (p.startsWith("/") || p.startsWith("C:\\") || p.includes("..")) {
+                    denied.push(`Root or traversing filesystem write path "${p}" is forbidden.`);
+                }
+            }
+        }
+        return {
+            isGranted: denied.length === 0,
+            grantedPermissions: fullPermissions,
+            deniedPermissions: denied,
+            requiresApproval,
+        };
+    }
+    /**
+     * Validates if a network host is permitted by the plugin's declared permissions.
+     */
+    isHostPermitted(host, permissions) {
+        if (!permissions.network || permissions.network.length === 0) {
+            return false;
+        }
+        const cleanHost = (host.toLowerCase().split(":")[0] || "").trim();
+        if (!cleanHost)
+            return false;
+        return permissions.network.some((allowed) => {
+            if (allowed === "*")
+                return true;
+            const cleanAllowed = (allowed.toLowerCase().split(":")[0] || "").trim();
+            return cleanAllowed === cleanHost || cleanHost.endsWith(`.${cleanAllowed}`);
+        });
+    }
+}
+//# sourceMappingURL=plugin-permissions.js.map

package/dist/plugins/plugin-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-permissions.js","sourceRoot":"","sources":["../../src/plugins/plugin-permissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,MAAM,OAAO,wBAAwB;IACnB,YAAY,CAAgB;IAE5C,YAAY,OAAyC;QACnD,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;IAED;;OAEG;IACI,iBAAiB,CACtB,YAAwC,EAAE,EAC1C,aAA4E,SAAS;QAErF,MAAM,eAAe,GAAsB;YACzC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,EAAE;YAChC,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3D,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,EAAE;YACxC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;SAC1C,CAAC;QAEF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAE7B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,kBAAkB,EAAE,eAAe;gBACnC,iBAAiB,EAAE,CAAC,4CAA4C,CAAC;gBACjE,gBAAgB,EAAE,KAAK;aACxB,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,IAAI,eAAe,CAAC,UAAU,EAAE,CAAC;YAC/B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,gBAAgB,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,eAAe,CAAC,WAAW,IAAI,eAAe,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,gBAAgB,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,IAAI,eAAe,CAAC,UAAU,EAAE,KAAK,IAAI,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACjD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,iBAAiB,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC9B,kBAAkB,EAAE,eAAe;YACnC,iBAAiB,EAAE,MAAM;YACzB,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,eAAe,CAAC,IAAY,EAAE,WAA8B;QACjE,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAE7B,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1C,IAAI,OAAO,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACxE,OAAO,YAAY,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}