clodds 1.1.0

package/dist/security/address-checker.js

@@ -0,0 +1,213 @@
+"use strict";
+// =============================================================================
+// SECURITY SHIELD — Multi-chain Address Checker
+// =============================================================================
+// Checks Solana & EVM addresses via native fetch (no SDK deps).
+// Combines scam DB lookup + on-chain heuristics for risk scoring.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectChain = detectChain;
+exports.checkAddress = checkAddress;
+const scam_db_js_1 = require("./scam-db.js");
+// ── Defaults ─────────────────────────────────────────────────────────────────
+const DEFAULT_SOLANA_RPC = 'https://api.mainnet-beta.solana.com';
+const DEFAULT_EVM_RPC = 'https://eth.llamarpc.com';
+// ── Chain detection (matches token-security pattern) ─────────────────────────
+function detectChain(address) {
+    if (address.startsWith('0x') && address.length === 42)
+        return 'evm';
+    return 'solana';
+}
+// ── Risk level mapping ───────────────────────────────────────────────────────
+function scoreToLevel(score) {
+    if (score <= 10)
+        return 'clean';
+    if (score <= 30)
+        return 'low';
+    if (score <= 60)
+        return 'medium';
+    if (score <= 85)
+        return 'high';
+    return 'critical';
+}
+// ── Solana RPC helper ────────────────────────────────────────────────────────
+async function solanaRpc(rpcUrl, method, params) {
+    const res = await fetch(rpcUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
+    });
+    const json = await res.json();
+    if (json.error)
+        throw new Error(json.error.message || JSON.stringify(json.error));
+    return json.result;
+}
+// ── EVM RPC helper ───────────────────────────────────────────────────────────
+async function evmRpc(rpcUrl, method, params) {
+    const res = await fetch(rpcUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
+    });
+    const json = await res.json();
+    if (json.error)
+        throw new Error(json.error.message || JSON.stringify(json.error));
+    return json.result;
+}
+// ── Solana address check ─────────────────────────────────────────────────────
+async function checkSolana(address, rpcUrl) {
+    let score = 0;
+    const flags = [];
+    const details = { exists: false };
+    // 1. Scam DB
+    const scam = (0, scam_db_js_1.isKnownScam)(address);
+    if (scam) {
+        return {
+            address, chain: 'solana', riskScore: 100, level: 'critical',
+            flags: [`Known scam: ${scam.label} (${scam.type})`],
+            scamMatch: scam,
+            details: { exists: true },
+        };
+    }
+    try {
+        // 2. getAccountInfo
+        const acctInfo = await solanaRpc(rpcUrl, 'getAccountInfo', [address, { encoding: 'base64' }]);
+        if (acctInfo?.value) {
+            details.exists = true;
+            if (acctInfo.value.executable) {
+                details.isContract = true;
+                flags.push('Executable program');
+            }
+            details.balance = (acctInfo.value.lamports || 0) / 1e9;
+        }
+        else {
+            flags.push('Account does not exist on-chain');
+            score += 10;
+        }
+        // 3. Fetch recent signatures (single call for both age + velocity)
+        const sigs = await solanaRpc(rpcUrl, 'getSignaturesForAddress', [address, { limit: 100 }]);
+        // 4. Account age — use OLDEST signature (last in array, since results are newest-first)
+        if (sigs && sigs.length > 0) {
+            const oldestSig = sigs[sigs.length - 1];
+            const oldestTs = oldestSig.blockTime;
+            if (oldestTs) {
+                const ageHours = (Date.now() / 1000 - oldestTs) / 3600;
+                if (ageHours < 1) {
+                    score += 25;
+                    details.ageEstimate = '< 1 hour';
+                    flags.push('Very new account (< 1h)');
+                }
+                else if (ageHours < 24) {
+                    score += 15;
+                    details.ageEstimate = '< 24 hours';
+                    flags.push('New account (< 24h)');
+                }
+                else if (ageHours < 168) {
+                    score += 10;
+                    details.ageEstimate = '< 7 days';
+                    flags.push('Recent account (< 7d)');
+                }
+                else {
+                    details.ageEstimate = `${Math.floor(ageHours / 24)}d`;
+                }
+            }
+            // 5. Transaction velocity
+            if (sigs.length > 1) {
+                const newest = sigs[0].blockTime;
+                const oldest = oldestTs;
+                if (newest && oldest && newest !== oldest) {
+                    const hours = (newest - oldest) / 3600;
+                    const velocity = sigs.length / Math.max(hours, 0.01);
+                    details.txVelocity = Math.round(velocity);
+                    if (velocity > 100) {
+                        score += 15;
+                        flags.push(`High tx velocity: ${Math.round(velocity)}/hr`);
+                    }
+                }
+            }
+        }
+        // 6. Zero balance + many txs
+        if (details.balance === 0 && sigs && sigs.length >= 50) {
+            score += 15;
+            flags.push('Zero balance with many transactions');
+        }
+    }
+    catch (err) {
+        flags.push(`RPC check failed: ${err instanceof Error ? err.message : 'unknown'}`);
+    }
+    score = Math.max(0, Math.min(100, score));
+    return { address, chain: 'solana', riskScore: score, level: scoreToLevel(score), flags, details };
+}
+// ── EVM address check ────────────────────────────────────────────────────────
+async function checkEvm(address, rpcUrl) {
+    let score = 0;
+    const flags = [];
+    const details = { exists: false };
+    // 1. Scam DB
+    const scam = (0, scam_db_js_1.isKnownScam)(address);
+    if (scam) {
+        return {
+            address, chain: 'evm', riskScore: 100, level: 'critical',
+            flags: [`Known scam: ${scam.label} (${scam.type})`],
+            scamMatch: scam,
+            details: { exists: true },
+        };
+    }
+    try {
+        // 2. Balance (use BigInt division to avoid Number overflow for large balances)
+        const balHex = await evmRpc(rpcUrl, 'eth_getBalance', [address, 'latest']);
+        const balWei = BigInt(balHex || '0x0');
+        // Convert to ETH: integer part via BigInt division, fractional via remainder
+        const ethWhole = balWei / BigInt(1e18);
+        const ethFrac = Number(balWei % BigInt(1e18)) / 1e18;
+        details.balance = Number(ethWhole) + ethFrac;
+        details.exists = true;
+        // 3. Nonce (proxy for account age / activity)
+        const nonceHex = await evmRpc(rpcUrl, 'eth_getTransactionCount', [address, 'latest']);
+        const nonce = parseInt(nonceHex || '0x0', 16);
+        if (nonce === 0 && details.balance === 0) {
+            score += 15;
+            flags.push('Empty account (no txs, no balance)');
+            details.ageEstimate = 'unknown (no txs)';
+        }
+        else if (nonce < 3) {
+            score += 10;
+            flags.push('Very low nonce (< 3 txs)');
+            details.ageEstimate = 'very new';
+        }
+        else {
+            details.ageEstimate = `${nonce} txs`;
+        }
+        // 4. Contract check
+        const code = await evmRpc(rpcUrl, 'eth_getCode', [address, 'latest']);
+        if (code && code !== '0x') {
+            details.isContract = true;
+            const codeLen = (code.length - 2) / 2;
+            if (codeLen < 100) {
+                score += 10;
+                flags.push(`Very short bytecode (${codeLen} bytes)`);
+            }
+            flags.push(`Contract (${codeLen} bytes)`);
+        }
+        // 5. Zero balance + high nonce = suspicious (drained)
+        if (details.balance === 0 && nonce > 50) {
+            score += 15;
+            flags.push('Zero balance with high nonce (possible drained wallet)');
+        }
+    }
+    catch (err) {
+        flags.push(`RPC check failed: ${err instanceof Error ? err.message : 'unknown'}`);
+    }
+    score = Math.max(0, Math.min(100, score));
+    return { address, chain: 'evm', riskScore: score, level: scoreToLevel(score), flags, details };
+}
+// =============================================================================
+// EXPORTS
+// =============================================================================
+async function checkAddress(address, chain, config) {
+    const resolvedChain = chain || detectChain(address);
+    if (resolvedChain === 'solana') {
+        return checkSolana(address, config?.solanaRpcUrl || DEFAULT_SOLANA_RPC);
+    }
+    return checkEvm(address, config?.evmRpcUrl || DEFAULT_EVM_RPC);
+}
+//# sourceMappingURL=address-checker.js.map

package/dist/security/address-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address-checker.js","sourceRoot":"","sources":["../../src/security/address-checker.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAChF,gEAAgE;AAChE,kEAAkE;;AAYlE,kCAGC;AAsMD,oCAUC;AA5ND,6CAA2C;AAE3C,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;AACjE,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,gFAAgF;AAEhF,SAAgB,WAAW,CAAC,OAAe;IACzC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,MAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAS,CAAC;IACrC,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,MAAc,EAAE,MAAiB;IACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAS,CAAC;IACrC,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACxD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAkC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEjE,aAAa;IACb,MAAM,IAAI,GAAG,IAAA,wBAAW,EAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU;YAC3D,KAAK,EAAE,CAAC,eAAe,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC;YACnD,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC1B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,oBAAoB;QACpB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC9B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC9C,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;QAED,mEAAmE;QACnE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE3F,wFAAwF;QACxF,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;YACrC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;gBACvD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBACjB,KAAK,IAAI,EAAE,CAAC;oBACZ,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC;oBACjC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBACxC,CAAC;qBAAM,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;oBACzB,KAAK,IAAI,EAAE,CAAC;oBACZ,OAAO,CAAC,WAAW,GAAG,YAAY,CAAC;oBACnC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACpC,CAAC;qBAAM,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;oBAC1B,KAAK,IAAI,EAAE,CAAC;oBACZ,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC;oBACjC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACtC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,WAAW,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC;gBACxD,CAAC;YACH,CAAC;YAED,0BAA0B;YAC1B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjC,MAAM,MAAM,GAAG,QAAQ,CAAC;gBACxB,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC;oBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACrD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC1C,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;wBACnB,KAAK,IAAI,EAAE,CAAC;wBACZ,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAC7D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACvD,KAAK,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACpG,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,MAAc;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAkC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEjE,aAAa;IACb,MAAM,IAAI,GAAG,IAAA,wBAAW,EAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU;YACxD,KAAK,EAAE,CAAC,eAAe,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC;YACnD,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC1B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;QACvC,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACrD,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;QAC7C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;QAEtB,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzC,KAAK,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACjD,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACvC,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,WAAW,GAAG,GAAG,KAAK,MAAM,CAAC;QACvC,CAAC;QAED,oBAAoB;QACpB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBAClB,KAAK,IAAI,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,sDAAsD;QACtD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;YACxC,KAAK,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACjG,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEzE,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,KAA0B,EAC1B,MAAsD;IAEtD,MAAM,aAAa,GAAe,KAAmB,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,IAAI,kBAAkB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,IAAI,eAAe,CAAC,CAAC;AACjE,CAAC"}

package/dist/security/code-scanner.d.ts

@@ -0,0 +1,3 @@
+import type { CodeScanResult } from './types.js';
+export declare function calculateEntropy(text: string): number;
+export declare function scanCode(code: string): CodeScanResult;

package/dist/security/code-scanner.js

@@ -0,0 +1,190 @@
+"use strict";
+// =============================================================================
+// SECURITY SHIELD — Code / Plugin Scanner (~75 rules, 9 categories)
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.calculateEntropy = calculateEntropy;
+exports.scanCode = scanCode;
+// ── Rules by category ────────────────────────────────────────────────────────
+const RULES = [
+    // ── shell_exec (12) ──────────────────────────────────────────────────────
+    { category: 'shell_exec', pattern: /\brequire\s*\(\s*['"]child_process['"]\s*\)/i, description: 'child_process require', weight: 20 },
+    { category: 'shell_exec', pattern: /\bimport\b.*['"]child_process['"]/i, description: 'child_process import', weight: 20 },
+    { category: 'shell_exec', pattern: /\bexec\s*\(/i, description: 'exec() call', weight: 15 },
+    { category: 'shell_exec', pattern: /\bexecSync\s*\(/i, description: 'execSync() call', weight: 18 },
+    { category: 'shell_exec', pattern: /\bspawn\s*\(/i, description: 'spawn() call', weight: 12 },
+    { category: 'shell_exec', pattern: /\bspawnSync\s*\(/i, description: 'spawnSync() call', weight: 15 },
+    { category: 'shell_exec', pattern: /\bexecFile\s*\(/i, description: 'execFile() call', weight: 15 },
+    { category: 'shell_exec', pattern: /\bprocess\.binding\b/i, description: 'process.binding access', weight: 20 },
+    { category: 'shell_exec', pattern: /\bos\.system\s*\(/i, description: 'os.system() (Python-style)', weight: 18 },
+    { category: 'shell_exec', pattern: /\bsubprocess\.(run|call|Popen)/i, description: 'subprocess (Python-style)', weight: 18 },
+    { category: 'shell_exec', pattern: /\bchild_process\b/i, description: 'child_process reference', weight: 10 },
+    { category: 'shell_exec', pattern: /\bprocess\.dlopen\b/i, description: 'native module loading', weight: 20 },
+    // ── network_exfil (10) ───────────────────────────────────────────────────
+    { category: 'network_exfil', pattern: /\bfetch\s*\(\s*['"`]https?:\/\//i, description: 'fetch to external URL', weight: 12 },
+    { category: 'network_exfil', pattern: /new\s+WebSocket\s*\(/i, description: 'WebSocket connection', weight: 15 },
+    { category: 'network_exfil', pattern: /discord\.com\/api\/webhooks/i, description: 'Discord webhook', weight: 20 },
+    { category: 'network_exfil', pattern: /api\.telegram\.org\/bot/i, description: 'Telegram bot API', weight: 20 },
+    { category: 'network_exfil', pattern: /\bnavigator\.sendBeacon\s*\(/i, description: 'sendBeacon exfiltration', weight: 18 },
+    { category: 'network_exfil', pattern: /\bXMLHttpRequest\b/i, description: 'XMLHttpRequest', weight: 10 },
+    { category: 'network_exfil', pattern: /\.postMessage\s*\(/i, description: 'postMessage cross-origin', weight: 10 },
+    { category: 'network_exfil', pattern: /\bhttp\.request\s*\(/i, description: 'http.request() call', weight: 12 },
+    { category: 'network_exfil', pattern: /\bhttps?\.get\s*\(/i, description: 'http(s).get() call', weight: 10 },
+    { category: 'network_exfil', pattern: /\baxios\b.*\.(post|put|patch)\s*\(/i, description: 'axios data exfil', weight: 12 },
+    // ── wallet_drain (12) ───────────────────────────────────────────────────
+    { category: 'wallet_drain', pattern: /\bprivateKey\b/i, description: 'privateKey access', weight: 18 },
+    { category: 'wallet_drain', pattern: /\bsecretKey\b/i, description: 'secretKey access', weight: 18 },
+    { category: 'wallet_drain', pattern: /\bmnemonic\b/i, description: 'mnemonic/seed phrase', weight: 20 },
+    { category: 'wallet_drain', pattern: /\bseed\s*phrase\b/i, description: 'seed phrase reference', weight: 20 },
+    { category: 'wallet_drain', pattern: /Keypair\.fromSecretKey/i, description: 'Solana Keypair from secret', weight: 20 },
+    { category: 'wallet_drain', pattern: /Keypair\.fromSeed/i, description: 'Solana Keypair from seed', weight: 20 },
+    { category: 'wallet_drain', pattern: /\.transferFrom\s*\(/i, description: 'ERC20 transferFrom', weight: 15 },
+    { category: 'wallet_drain', pattern: /\.approve\s*\(.*(?:MaxUint|0xf+|type\(uint256\)\.max)/i, description: 'unlimited token approval', weight: 20 },
+    { category: 'wallet_drain', pattern: /\.setApprovalForAll\s*\(/i, description: 'NFT setApprovalForAll', weight: 18 },
+    { category: 'wallet_drain', pattern: /signAllTransactions/i, description: 'batch transaction signing', weight: 18 },
+    { category: 'wallet_drain', pattern: /signTransaction/i, description: 'transaction signing', weight: 10 },
+    { category: 'wallet_drain', pattern: /eth_sign|personal_sign/i, description: 'raw message signing', weight: 15 },
+    // ── prompt_injection (8) ────────────────────────────────────────────────
+    { category: 'prompt_injection', pattern: /ignore\s+(all\s+)?previous\s+(instructions?|prompts?)/i, description: 'instruction override', weight: 15 },
+    { category: 'prompt_injection', pattern: /\[INST\]/i, description: '[INST] tag', weight: 15 },
+    { category: 'prompt_injection', pattern: /<\|im_start\|>/i, description: 'ChatML injection', weight: 15 },
+    { category: 'prompt_injection', pattern: /system\s*:\s*(you are|override|new instruction)/i, description: 'system role override', weight: 18 },
+    { category: 'prompt_injection', pattern: /DAN\s+(mode|jailbreak)/i, description: 'DAN jailbreak', weight: 18 },
+    { category: 'prompt_injection', pattern: /do\s+anything\s+now/i, description: 'DAN activation', weight: 15 },
+    { category: 'prompt_injection', pattern: /forget\s+(everything|all|your)\s+(rules|instructions)/i, description: 'memory wipe', weight: 15 },
+    { category: 'prompt_injection', pattern: /bypass\s+(safety|content|filter)/i, description: 'filter bypass', weight: 15 },
+    // ── obfuscation (8) ────────────────────────────────────────────────────
+    { category: 'obfuscation', pattern: /\beval\s*\(/i, description: 'eval() call', weight: 20 },
+    { category: 'obfuscation', pattern: /new\s+Function\s*\(/i, description: 'new Function() constructor', weight: 20 },
+    { category: 'obfuscation', pattern: /\\x[0-9a-fA-F]{2}(?:\\x[0-9a-fA-F]{2}){3,}/i, description: 'hex escape sequence', weight: 15 },
+    { category: 'obfuscation', pattern: /\\u[0-9a-fA-F]{4}(?:\\u[0-9a-fA-F]{4}){3,}/i, description: 'unicode escape sequence', weight: 15 },
+    { category: 'obfuscation', pattern: /String\.fromCharCode\s*\(/i, description: 'String.fromCharCode', weight: 15 },
+    { category: 'obfuscation', pattern: /\batob\s*\(/i, description: 'base64 decode (atob)', weight: 12 },
+    { category: 'obfuscation', pattern: /\bbtoa\s*\(/i, description: 'base64 encode (btoa)', weight: 8 },
+    { category: 'obfuscation', pattern: /(?:_0x[0-9a-f]{4,}|_0x[0-9a-f]{2,}\[)/i, description: 'packed/obfuscated JS variable', weight: 20 },
+    // ── hidden_chars (6) ───────────────────────────────────────────────────
+    { category: 'hidden_chars', pattern: /[\u200B\u200C\u200D]/, description: 'zero-width characters', weight: 12 },
+    { category: 'hidden_chars', pattern: /[\u2060\uFEFF]/, description: 'invisible format chars', weight: 12 },
+    { category: 'hidden_chars', pattern: /[\u202A-\u202E]/, description: 'RTL override characters', weight: 15 },
+    { category: 'hidden_chars', pattern: /[\u2066-\u2069]/, description: 'directional isolates', weight: 12 },
+    { category: 'hidden_chars', pattern: /[\u2800-\u28FF]/, description: 'Braille pattern chars', weight: 10 },
+    { category: 'hidden_chars', pattern: /\u180E/, description: 'Mongolian vowel separator', weight: 10 },
+    // ── data_access (7) ────────────────────────────────────────────────────
+    { category: 'data_access', pattern: /fs\.(readFile|readFileSync)\s*\(.*\/(etc\/passwd|\.ssh|\.env|\.aws)/i, description: 'sensitive file read', weight: 20 },
+    { category: 'data_access', pattern: /process\.env\b/i, description: 'environment variable access', weight: 8 },
+    { category: 'data_access', pattern: /JSON\.stringify\s*\(\s*process\.env\s*\)/i, description: 'full env dump', weight: 20 },
+    { category: 'data_access', pattern: /document\.cookie/i, description: 'cookie access', weight: 15 },
+    { category: 'data_access', pattern: /chrome\.storage/i, description: 'browser extension storage', weight: 15 },
+    { category: 'data_access', pattern: /localStorage\.(getItem|setItem)/i, description: 'localStorage access', weight: 8 },
+    { category: 'data_access', pattern: /indexedDB/i, description: 'IndexedDB access', weight: 8 },
+    // ── crypto_theft (8) ───────────────────────────────────────────────────
+    { category: 'crypto_theft', pattern: /\.solana\/id\.json/i, description: 'Solana key file path', weight: 20 },
+    { category: 'crypto_theft', pattern: /phantom|solflare|backpack|slope/i, description: 'wallet extension reference', weight: 12 },
+    { category: 'crypto_theft', pattern: /chrome-extension:\/\//i, description: 'extension URL access', weight: 15 },
+    { category: 'crypto_theft', pattern: /ethers\.Wallet\.fromMnemonic/i, description: 'ethers wallet from mnemonic', weight: 20 },
+    { category: 'crypto_theft', pattern: /ethers\.Wallet\s*\(\s*['"`]/i, description: 'ethers wallet from private key', weight: 20 },
+    { category: 'crypto_theft', pattern: /bs58\.decode/i, description: 'base58 decode (key context)', weight: 12 },
+    { category: 'crypto_theft', pattern: /keytar|keychain|credential\s*store/i, description: 'system keychain access', weight: 15 },
+    { category: 'crypto_theft', pattern: /\.ethereum\.request.*eth_accounts/i, description: 'MetaMask account enumeration', weight: 12 },
+    // ── privilege_escalation (4) ────────────────────────────────────────────
+    { category: 'privilege_escalation', pattern: /\bsudo\b/i, description: 'sudo command', weight: 15 },
+    { category: 'privilege_escalation', pattern: /chmod\s+777/i, description: 'chmod 777 (world writable)', weight: 15 },
+    { category: 'privilege_escalation', pattern: /\bsetuid\b/i, description: 'setuid flag', weight: 18 },
+    { category: 'privilege_escalation', pattern: /process\.setuid\s*\(/i, description: 'process.setuid()', weight: 18 },
+];
+const COMBO_BOOSTS = [
+    { categories: ['network_exfil', 'wallet_drain'], boost: 15 },
+    { categories: ['obfuscation', 'wallet_drain'], boost: 10 },
+    { categories: ['obfuscation', 'crypto_theft'], boost: 10 },
+    { categories: ['network_exfil', 'crypto_theft'], boost: 12 },
+    { categories: ['shell_exec', 'data_access'], boost: 10 },
+    { categories: ['hidden_chars', 'wallet_drain'], boost: 10 },
+];
+// ── Shannon entropy ──────────────────────────────────────────────────────────
+function calculateEntropy(text) {
+    if (text.length === 0)
+        return 0;
+    const freq = new Map();
+    for (const ch of text) {
+        freq.set(ch, (freq.get(ch) || 0) + 1);
+    }
+    let entropy = 0;
+    const len = text.length;
+    for (const count of freq.values()) {
+        const p = count / len;
+        if (p > 0)
+            entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+// ── Risk level mapping ───────────────────────────────────────────────────────
+function scoreToLevel(score) {
+    if (score <= 10)
+        return 'clean';
+    if (score <= 30)
+        return 'low';
+    if (score <= 60)
+        return 'medium';
+    if (score <= 85)
+        return 'high';
+    return 'critical';
+}
+// =============================================================================
+// EXPORTS
+// =============================================================================
+function scanCode(code) {
+    const detections = [];
+    const seenCategories = new Set();
+    // Run all rules
+    for (const rule of RULES) {
+        // Reset regex lastIndex for global patterns
+        rule.pattern.lastIndex = 0;
+        const match = rule.pattern.exec(code);
+        if (match) {
+            // Find line number
+            const beforeMatch = code.substring(0, match.index);
+            const line = (beforeMatch.match(/\n/g) || []).length + 1;
+            detections.push({
+                category: rule.category,
+                pattern: rule.pattern.source,
+                description: rule.description,
+                weight: rule.weight,
+                line,
+            });
+        }
+    }
+    // Score with diminishing returns per category
+    let score = 0;
+    for (const det of detections) {
+        if (seenCategories.has(det.category)) {
+            score += det.weight * 0.3;
+        }
+        else {
+            score += det.weight;
+            seenCategories.add(det.category);
+        }
+    }
+    // Combo boosts
+    for (const combo of COMBO_BOOSTS) {
+        if (seenCategories.has(combo.categories[0]) && seenCategories.has(combo.categories[1])) {
+            score += combo.boost;
+        }
+    }
+    // Entropy check for code > 500 chars
+    let entropy;
+    if (code.length > 500) {
+        entropy = calculateEntropy(code);
+        if (entropy > 5.5) {
+            score += 10;
+        }
+    }
+    // Clamp 0-100
+    score = Math.max(0, Math.min(100, Math.round(score)));
+    return {
+        score,
+        level: scoreToLevel(score),
+        detections,
+        entropy,
+    };
+}
+//# sourceMappingURL=code-scanner.js.map

package/dist/security/code-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-scanner.js","sourceRoot":"","sources":["../../src/security/code-scanner.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oEAAoE;AACpE,gFAAgF;;AAgIhF,4CAaC;AAgBD,4BA4DC;AA5MD,gFAAgF;AAEhF,MAAM,KAAK,GAAW;IACpB,4EAA4E;IAC5E,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,EAAE;IACrI,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,oCAAoC,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC1H,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE;IAC3F,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,EAAE;IACnG,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7F,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE;IACrG,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,EAAE;IACnG,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/G,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,EAAE,EAAE,EAAE;IAChH,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,iCAAiC,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5H,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7G,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,EAAE;IAE7G,4EAA4E;IAC5E,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5H,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IAChH,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,EAAE;IAClH,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/G,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC3H,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE;IACxG,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;IAClH,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/G,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5G,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE;IAE1H,2EAA2E;IAC3E,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,EAAE;IACtG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE;IACpG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IACvG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7G,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,EAAE,EAAE,EAAE;IACvH,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;IAChH,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5G,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,wDAAwD,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;IACpJ,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,EAAE;IACpH,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE;IACnH,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE;IACzG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE;IAEhH,2EAA2E;IAC3E,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,wDAAwD,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IACpJ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7F,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE;IACzG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,kDAAkD,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9I,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9G,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5G,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,wDAAwD,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE;IAC3I,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE;IAExH,0EAA0E;IAC1E,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5F,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,EAAE,EAAE,EAAE;IACnH,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE;IACnI,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE;IACvI,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE;IAClH,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IACrG,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,EAAE;IACpG,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,+BAA+B,EAAE,MAAM,EAAE,EAAE,EAAE;IAExI,0EAA0E;IAC1E,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/G,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC1G,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5G,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IACzG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC1G,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE;IAErG,0EAA0E;IAC1E,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,sEAAsE,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5J,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,EAAE;IAC9G,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE;IAC3H,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE;IACnG,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9G,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,EAAE;IACvH,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,EAAE;IAE9F,0EAA0E;IAC1E,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7G,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,EAAE,EAAE,EAAE;IAChI,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE;IAChH,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,6BAA6B,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9H,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,gCAAgC,EAAE,MAAM,EAAE,EAAE,EAAE;IAChI,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,6BAA6B,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9G,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/H,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,oCAAoC,EAAE,WAAW,EAAE,8BAA8B,EAAE,MAAM,EAAE,EAAE,EAAE;IAEpI,2EAA2E;IAC3E,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE;IACnG,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,EAAE,EAAE,EAAE;IACpH,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE;IACpG,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE;CACpH,CAAC;AASF,MAAM,YAAY,GAAiB;IACjC,EAAE,UAAU,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IAC5D,EAAE,UAAU,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IAC1D,EAAE,UAAU,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IAC1D,EAAE,UAAU,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IAC5D,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IACxD,EAAE,UAAU,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;CAC5D,CAAC;AAEF,gFAAgF;AAEhF,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEnD,gBAAgB;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,4CAA4C;QAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC;YACV,mBAAmB;YACnB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAEzD,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,KAAK,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;YACpB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,eAAe;IACf,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,OAA2B,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;YAClB,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,cAAc;IACd,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;QAC1B,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Security Module - Clawdbot-style security and access control
+ *
+ * Features:
+ * - DM pairing for authentication
+ * - User allowlists and blocklists
+ * - Sandbox mode for untrusted input
+ * - Rate limiting
+ * - Input sanitization
+ * - Token/secret management
+ */
+export interface SecurityConfig {
+    /** Enable DM pairing requirement */
+    requireDmPairing?: boolean;
+    /** Allowed user IDs */
+    allowlist?: string[];
+    /** Blocked user IDs */
+    blocklist?: string[];
+    /** Enable sandbox mode */
+    sandbox?: boolean;
+    /** Rate limit config */
+    rateLimit?: RateLimitConfig;
+    /** Secret encryption key (from env) */
+    encryptionKey?: string;
+}
+export interface RateLimitConfig {
+    /** Max requests per window */
+    maxRequests: number;
+    /** Window size in milliseconds */
+    windowMs: number;
+    /** Per-user limits */
+    perUser?: boolean;
+}
+export interface PairingCode {
+    code: string;
+    userId: string;
+    expiresAt: Date;
+    used: boolean;
+}
+export interface AuthResult {
+    allowed: boolean;
+    reason?: string;
+    userId?: string;
+}
+export interface SanitizeOptions {
+    maxLength?: number;
+    allowHtml?: boolean;
+    allowUrls?: boolean;
+    allowCode?: boolean;
+}
+export declare class PairingManager {
+    private codes;
+    private pairedUsers;
+    private storePath;
+    constructor(storePath?: string);
+    private loadPairedUsers;
+    private savePairedUsers;
+    /** Generate a pairing code for a user */
+    generateCode(userId: string): string;
+    /** Verify a pairing code */
+    verifyCode(code: string, userId: string): {
+        valid: boolean;
+        reason?: string;
+    };
+    /** Check if a user is paired */
+    isPaired(userId: string): boolean;
+    /** Unpair a user */
+    unpair(userId: string): void;
+    /** Get all paired users */
+    getPairedUsers(): string[];
+    private cleanupExpired;
+}
+export declare class AccessControl {
+    private allowlist;
+    private blocklist;
+    private pairingManager;
+    private requirePairing;
+    constructor(config?: SecurityConfig);
+    /** Check if a user is allowed */
+    checkAccess(userId: string): AuthResult;
+    /** Add user to allowlist */
+    allow(userId: string): void;
+    /** Add user to blocklist */
+    block(userId: string): void;
+    /** Remove user from all lists */
+    reset(userId: string): void;
+    /** Get pairing manager */
+    getPairingManager(): PairingManager;
+}
+export declare class RateLimiter {
+    private limits;
+    private config;
+    constructor(config: RateLimitConfig);
+    /** Check if request is allowed */
+    check(key: string): {
+        allowed: boolean;
+        remaining: number;
+        resetIn: number;
+    };
+    /** Reset rate limit for a key */
+    reset(key: string): void;
+    /** Cleanup expired entries */
+    cleanup(): void;
+}
+/** Sanitize user input */
+export declare function sanitize(input: string, options?: SanitizeOptions): string;
+/** Check for potential injection attacks */
+export declare function detectInjection(input: string): {
+    safe: boolean;
+    threats: string[];
+};
+export declare class SecretStore {
+    private secrets;
+    private encryptionKey;
+    private storePath;
+    constructor(encryptionKey?: string, storePath?: string);
+    private initEncryption;
+    private encrypt;
+    private decrypt;
+    private load;
+    private save;
+    /** Store a secret */
+    set(key: string, value: string): void;
+    /** Get a secret */
+    get(key: string): string | undefined;
+    /** Delete a secret */
+    delete(key: string): void;
+    /** List all secret keys */
+    keys(): string[];
+}
+export interface SandboxOptions {
+    allowNetwork?: boolean;
+    allowFileSystem?: boolean;
+    allowedModules?: string[];
+    timeout?: number;
+    memoryLimit?: number;
+}
+/**
+ * Create a sandboxed execution context (LIMITED IMPLEMENTATION)
+ *
+ * ⚠️  SECURITY WARNING: This sandbox is NOT secure against malicious code!
+ * It only provides basic isolation and can be escaped.
+ *
+ * For production use with untrusted code, use:
+ * - `isolated-vm` package (V8 isolates)
+ * - `vm2` package (more secure VM)
+ * - Docker containers
+ *
+ * This implementation is suitable for:
+ * - Running trusted code with limited scope
+ * - Development/testing environments
+ * - Code that has already been validated
+ */
+/**
+ * SECURITY: Sandbox is DISABLED by default
+ *
+ * The previous implementation using new Function() was NOT secure and could be
+ * trivially escaped. Dynamic code execution is inherently dangerous.
+ *
+ * To enable (NOT RECOMMENDED), set ALLOW_UNSAFE_SANDBOX=true
+ * Only enable for trusted code in development/testing environments.
+ */
+export declare function createSandbox(options?: SandboxOptions): {
+    eval: (code: string) => unknown;
+    require: (module: string) => unknown;
+};
+/** Hash a string with SHA-256 */
+export declare function hash(input: string): string;
+/** Hash a password with salt */
+export declare function hashPassword(password: string): Promise<string>;
+/** Verify a password hash */
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+/** Generate a secure random token */
+export declare function generateToken(length?: number): string;
+export declare const pairing: PairingManager;
+export declare const access: AccessControl;