wispy-ai 0.1.0

package/dist/mcp/tools-adapter.js

@@ -0,0 +1,133 @@
+/**
+ * Adapts Wispy's internal tools to MCP tool format.
+ */
+export function getWispyMcpTools() {
+    return [
+        {
+            name: "wispy_chat",
+            description: "Send a message to the Wispy AI agent and get a response",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    message: { type: "string", description: "The message to send" },
+                    session: { type: "string", description: "Session key (default: mcp)" },
+                },
+                required: ["message"],
+            },
+        },
+        {
+            name: "wispy_memory_search",
+            description: "Search Wispy's semantic memory",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    query: { type: "string", description: "Search query" },
+                    limit: { type: "number", description: "Max results (default 5)" },
+                },
+                required: ["query"],
+            },
+        },
+        {
+            name: "wispy_memory_save",
+            description: "Save a fact or note to Wispy's memory",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    text: { type: "string", description: "Text to remember" },
+                    source: { type: "string", description: "Source label" },
+                },
+                required: ["text"],
+            },
+        },
+        {
+            name: "wispy_bash",
+            description: "Execute a shell command (with safety checks)",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    command: { type: "string", description: "Shell command to execute" },
+                },
+                required: ["command"],
+            },
+        },
+        {
+            name: "wispy_file_read",
+            description: "Read a file's contents",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    path: { type: "string", description: "File path" },
+                },
+                required: ["path"],
+            },
+        },
+        {
+            name: "wispy_file_write",
+            description: "Write content to a file",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    path: { type: "string", description: "File path" },
+                    content: { type: "string", description: "File content" },
+                },
+                required: ["path", "content"],
+            },
+        },
+        {
+            name: "wispy_web_fetch",
+            description: "Fetch content from a URL",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    url: { type: "string", description: "URL to fetch" },
+                },
+                required: ["url"],
+            },
+        },
+        {
+            name: "wispy_image_generate",
+            description: "Generate an image using Gemini Nano Banana",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    prompt: { type: "string", description: "Image generation prompt" },
+                },
+                required: ["prompt"],
+            },
+        },
+        {
+            name: "wispy_wallet_balance",
+            description: "Check Wispy wallet USDC balance",
+            inputSchema: {
+                type: "object",
+                properties: {},
+            },
+        },
+        {
+            name: "wispy_schedule_task",
+            description: "Schedule a cron task",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    name: { type: "string", description: "Task name" },
+                    cron: { type: "string", description: "Cron expression" },
+                    instruction: { type: "string", description: "What to do" },
+                },
+                required: ["name", "cron", "instruction"],
+            },
+        },
+        {
+            name: "wispy_a2a_delegate",
+            description: "Delegate a task to another AI agent via A2A",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    peerId: { type: "string", description: "Target agent peer ID" },
+                    task: { type: "string", description: "Task description" },
+                },
+                required: ["peerId", "task"],
+            },
+        },
+    ];
+}
+//# sourceMappingURL=tools-adapter.js.map

package/dist/mcp/tools-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-adapter.js","sourceRoot":"","sources":["../../src/mcp/tools-adapter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,yDAAyD;YACtE,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;oBAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;iBACvE;gBACD,QAAQ,EAAE,CAAC,SAAS,CAAC;aACtB;SACF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,gCAAgC;YAC7C,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;oBACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yBAAyB,EAAE;iBAClE;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;aACpB;SACF;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,uCAAuC;YACpD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;oBACzD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;iBACxD;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;SACF;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,8CAA8C;YAC3D,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;iBACrE;gBACD,QAAQ,EAAE,CAAC,SAAS,CAAC;aACtB;SACF;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,wBAAwB;YACrC,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE;iBACnD;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;SACF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,yBAAyB;YACtC,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE;oBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;iBACzD;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;aAC9B;SACF;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,0BAA0B;YACvC,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;iBACrD;gBACD,QAAQ,EAAE,CAAC,KAAK,CAAC;aAClB;SACF;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,4CAA4C;YACzD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yBAAyB,EAAE;iBACnE;gBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;SACF;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,iCAAiC;YAC9C,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;aACf;SACF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,sBAAsB;YACnC,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE;oBAClD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE;oBACxD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;iBAC3D;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC;aAC1C;SACF;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,6CAA6C;YAC1D,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;oBAC/D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;iBAC1D;gBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC7B;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/memory/manager.d.ts

@@ -0,0 +1,14 @@
+import type { WispyConfig } from "../config/schema.js";
+export declare class MemoryManager {
+    private store;
+    private config;
+    constructor(runtimeDir: string, config: WispyConfig);
+    addMemory(text: string, source: string, sessionKey?: string): Promise<void>;
+    search(query: string, limit?: number): Promise<Array<{
+        text: string;
+        score: number;
+        source: string;
+    }>>;
+    close(): void;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/memory/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/memory/manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKvD,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,MAAM,CAAc;gBAEhB,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;IAK7C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;IAY3D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAU,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAuB/G,KAAK;CAGN"}

package/dist/memory/manager.js

@@ -0,0 +1,49 @@
+import { VectorStore } from "./vector-store.js";
+import { embedSingle } from "../ai/embeddings.js";
+import { createLogger } from "../infra/logger.js";
+const log = createLogger("memory-manager");
+export class MemoryManager {
+    store;
+    config;
+    constructor(runtimeDir, config) {
+        this.store = new VectorStore(runtimeDir);
+        this.config = config;
+    }
+    async addMemory(text, source, sessionKey) {
+        try {
+            const embedding = await embedSingle(text, this.config);
+            this.store.insert(text, embedding, source, sessionKey);
+            log.debug("Memory added: %s", text.slice(0, 60));
+        }
+        catch (err) {
+            log.error({ err }, "Failed to embed memory");
+            // Fallback: store without embedding
+            this.store.insert(text, [], source, sessionKey);
+        }
+    }
+    async search(query, limit = 5) {
+        try {
+            const queryEmb = await embedSingle(query, this.config);
+            const semantic = this.store.search(queryEmb, limit);
+            const keyword = this.store.keywordSearch(query, limit);
+            // Merge: semantic first, then keyword (deduplicated)
+            const seen = new Set(semantic.map((r) => r.text));
+            const merged = [...semantic];
+            for (const k of keyword) {
+                if (!seen.has(k.text)) {
+                    merged.push({ ...k, score: 0.5 }); // keyword match gets base score
+                    seen.add(k.text);
+                }
+            }
+            return merged.slice(0, limit);
+        }
+        catch (err) {
+            log.error({ err }, "Search failed, falling back to keyword");
+            return this.store.keywordSearch(query, limit).map((r) => ({ ...r, score: 0.5 }));
+        }
+    }
+    close() {
+        this.store.close();
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/memory/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/memory/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE3C,MAAM,OAAO,aAAa;IAChB,KAAK,CAAc;IACnB,MAAM,CAAc;IAE5B,YAAY,UAAkB,EAAE,MAAmB;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,MAAc,EAAE,UAAmB;QAC/D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;YAC7C,oCAAoC;YACpC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAEvD,qDAAqD;YACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,gCAAgC;oBACnE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/memory/vector-store.d.ts

@@ -0,0 +1,17 @@
+export declare class VectorStore {
+    private db;
+    constructor(runtimeDir: string);
+    private init;
+    insert(text: string, embedding: number[], source: string, sessionKey?: string, metadata?: Record<string, unknown>): void;
+    search(queryEmbedding: number[], limit?: number): Array<{
+        text: string;
+        score: number;
+        source: string;
+    }>;
+    keywordSearch(query: string, limit?: number): Array<{
+        text: string;
+        source: string;
+    }>;
+    close(): void;
+}
+//# sourceMappingURL=vector-store.d.ts.map

package/dist/memory/vector-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vector-store.d.ts","sourceRoot":"","sources":["../../src/memory/vector-store.ts"],"names":[],"mappings":"AAOA,qBAAa,WAAW;IACtB,OAAO,CAAC,EAAE,CAAoB;gBAElB,UAAU,EAAE,MAAM;IAO9B,OAAO,CAAC,IAAI;IAiBZ,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAajH,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,KAAK,GAAE,MAAU,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAkB3G,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAU,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOxF,KAAK;CAGN"}

package/dist/memory/vector-store.js

@@ -0,0 +1,65 @@
+import Database from "better-sqlite3";
+import { resolve } from "path";
+import { ensureDir } from "../utils/file.js";
+import { createLogger } from "../infra/logger.js";
+const log = createLogger("vector-store");
+export class VectorStore {
+    db;
+    constructor(runtimeDir) {
+        const dbPath = resolve(runtimeDir, "memory", "embeddings.db");
+        ensureDir(resolve(runtimeDir, "memory"));
+        this.db = new Database(dbPath);
+        this.init();
+    }
+    init() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS embeddings (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        text TEXT NOT NULL,
+        embedding TEXT NOT NULL,
+        source TEXT,
+        session_key TEXT,
+        created_at TEXT DEFAULT (datetime('now')),
+        metadata TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_source ON embeddings(source);
+      CREATE INDEX IF NOT EXISTS idx_session ON embeddings(session_key);
+    `);
+        log.info("Vector store initialized");
+    }
+    insert(text, embedding, source, sessionKey, metadata) {
+        const stmt = this.db.prepare(`INSERT INTO embeddings (text, embedding, source, session_key, metadata) VALUES (?, ?, ?, ?, ?)`);
+        stmt.run(text, JSON.stringify(embedding), source, sessionKey || null, metadata ? JSON.stringify(metadata) : null);
+    }
+    search(queryEmbedding, limit = 5) {
+        // Cosine similarity search (brute force since sqlite-vec may not be available)
+        const rows = this.db.prepare(`SELECT text, embedding, source FROM embeddings`).all();
+        const results = rows.map((row) => {
+            const emb = JSON.parse(row.embedding);
+            const score = cosineSimilarity(queryEmbedding, emb);
+            return { text: row.text, score, source: row.source };
+        });
+        results.sort((a, b) => b.score - a.score);
+        return results.slice(0, limit);
+    }
+    keywordSearch(query, limit = 5) {
+        const stmt = this.db.prepare(`SELECT text, source FROM embeddings WHERE text LIKE ? LIMIT ?`);
+        return stmt.all(`%${query}%`, limit);
+    }
+    close() {
+        this.db.close();
+    }
+}
+function cosineSimilarity(a, b) {
+    if (a.length !== b.length)
+        return 0;
+    let dot = 0, magA = 0, magB = 0;
+    for (let i = 0; i < a.length; i++) {
+        dot += a[i] * b[i];
+        magA += a[i] * a[i];
+        magB += b[i] * b[i];
+    }
+    const denom = Math.sqrt(magA) * Math.sqrt(magB);
+    return denom === 0 ? 0 : dot / denom;
+}
+//# sourceMappingURL=vector-store.js.map

package/dist/memory/vector-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vector-store.js","sourceRoot":"","sources":["../../src/memory/vector-store.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAEzC,MAAM,OAAO,WAAW;IACd,EAAE,CAAoB;IAE9B,YAAY,UAAkB;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC9D,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;KAYZ,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,SAAmB,EAAE,MAAc,EAAE,UAAmB,EAAE,QAAkC;QAC/G,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,GAAG,CACN,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EACzB,MAAM,EACN,UAAU,IAAI,IAAI,EAClB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAwB,EAAE,QAAgB,CAAC;QAChD,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,EAIhF,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAa,CAAC;YAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,QAAgB,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,+DAA+D,CAChE,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,KAAK,CAA4C,CAAC;IAClF,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,CAAW,EAAE,CAAW;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC;AACvC,CAAC"}

package/dist/security/action-guard.d.ts

@@ -0,0 +1,12 @@
+export type ActionCategory = "internal" | "external" | "destructive";
+export declare function categorizeAction(toolName: string): ActionCategory;
+export interface ApprovalRequest {
+    toolName: string;
+    category: ActionCategory;
+    description: string;
+    params: Record<string, unknown>;
+}
+export type ApprovalCallback = (req: ApprovalRequest) => Promise<boolean>;
+export declare function setApprovalHandler(handler: ApprovalCallback): void;
+export declare function requestApproval(toolName: string, description: string, params: Record<string, unknown>): Promise<boolean>;
+//# sourceMappingURL=action-guard.d.ts.map

package/dist/security/action-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-guard.d.ts","sourceRoot":"","sources":["../../src/security/action-guard.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;AAiBrE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAIjE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAI1E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,QAE3D;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/security/action-guard.js

@@ -0,0 +1,37 @@
+import { createLogger } from "../infra/logger.js";
+const log = createLogger("action-guard");
+const EXTERNAL_ACTIONS = new Set([
+    "send_message",
+    "post_content",
+    "wallet_pay",
+    "send_email",
+    "tweet",
+]);
+const DESTRUCTIVE_ACTIONS = new Set([
+    "file_delete",
+    "rm",
+    "drop_table",
+    "wallet_transfer_all",
+]);
+export function categorizeAction(toolName) {
+    if (DESTRUCTIVE_ACTIONS.has(toolName))
+        return "destructive";
+    if (EXTERNAL_ACTIONS.has(toolName))
+        return "external";
+    return "internal";
+}
+let approvalHandler = null;
+export function setApprovalHandler(handler) {
+    approvalHandler = handler;
+}
+export async function requestApproval(toolName, description, params) {
+    const category = categorizeAction(toolName);
+    if (category === "internal")
+        return true;
+    if (!approvalHandler) {
+        log.warn("No approval handler set, blocking %s action: %s", category, toolName);
+        return false;
+    }
+    return approvalHandler({ toolName, category, description, params });
+}
+//# sourceMappingURL=action-guard.js.map

package/dist/security/action-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-guard.js","sourceRoot":"","sources":["../../src/security/action-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAIzC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,cAAc;IACd,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,aAAa;IACb,IAAI;IACJ,YAAY;IACZ,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,aAAa,CAAC;IAC5D,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACtD,OAAO,UAAU,CAAC;AACpB,CAAC;AAWD,IAAI,eAAe,GAA4B,IAAI,CAAC;AAEpD,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,eAAe,GAAG,OAAO,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,WAAmB,EACnB,MAA+B;IAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/security/api-key-guard.d.ts

@@ -0,0 +1,3 @@
+export declare function scanForLeakedKeys(text: string): string[];
+export declare function sanitizeOutput(text: string): string;
+//# sourceMappingURL=api-key-guard.d.ts.map

package/dist/security/api-key-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-guard.d.ts","sourceRoot":"","sources":["../../src/security/api-key-guard.ts"],"names":[],"mappings":"AAiBA,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CASxD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAanD"}

package/dist/security/api-key-guard.js

@@ -0,0 +1,36 @@
+import { createLogger } from "../infra/logger.js";
+const log = createLogger("api-key-guard");
+// Patterns that match common API key formats
+const KEY_PATTERNS = [
+    /AIza[0-9A-Za-z\-_]{35}/, // Google API keys
+    /sk-[a-zA-Z0-9]{20,}/, // OpenAI-style keys
+    /xai-[a-zA-Z0-9]{20,}/, // xAI keys
+    /ghp_[a-zA-Z0-9]{36}/, // GitHub PATs
+    /glpat-[a-zA-Z0-9\-_]{20,}/, // GitLab PATs
+    /sk_live_[a-zA-Z0-9]{20,}/, // Stripe live keys
+    /sk_test_[a-zA-Z0-9]{20,}/, // Stripe test keys
+    /0x[a-fA-F0-9]{64}/, // Private keys (Ethereum)
+    /-----BEGIN (RSA |EC )?PRIVATE KEY-----/, // PEM private keys
+];
+export function scanForLeakedKeys(text) {
+    const leaked = [];
+    for (const pattern of KEY_PATTERNS) {
+        const match = text.match(pattern);
+        if (match) {
+            leaked.push(match[0].slice(0, 8) + "...");
+        }
+    }
+    return leaked;
+}
+export function sanitizeOutput(text) {
+    const leaks = scanForLeakedKeys(text);
+    if (leaks.length === 0)
+        return text;
+    log.warn("Blocked output containing %d potential API key(s)", leaks.length);
+    let sanitized = text;
+    for (const pattern of KEY_PATTERNS) {
+        sanitized = sanitized.replace(new RegExp(pattern.source, "g"), "[REDACTED]");
+    }
+    return sanitized;
+}
+//# sourceMappingURL=api-key-guard.js.map

package/dist/security/api-key-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-guard.js","sourceRoot":"","sources":["../../src/security/api-key-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE1C,6CAA6C;AAC7C,MAAM,YAAY,GAAG;IACnB,wBAAwB,EAAQ,kBAAkB;IAClD,qBAAqB,EAAY,oBAAoB;IACrD,sBAAsB,EAAW,WAAW;IAC5C,qBAAqB,EAAY,cAAc;IAC/C,2BAA2B,EAAM,cAAc;IAC/C,0BAA0B,EAAO,mBAAmB;IACpD,0BAA0B,EAAO,mBAAmB;IACpD,mBAAmB,EAAc,0BAA0B;IAC3D,wCAAwC,EAAE,mBAAmB;CAC9D,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,YAAY,CACb,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/security/auth.d.ts

@@ -0,0 +1,17 @@
+interface PairingState {
+    paired: Record<string, {
+        peerId: string;
+        pairedAt: string;
+    }>;
+}
+interface AllowList {
+    groups: string[];
+}
+export declare function loadPairing(runtimeDir: string, channel: string): PairingState;
+export declare function savePairing(runtimeDir: string, channel: string, state: PairingState): void;
+export declare function isPaired(runtimeDir: string, channel: string, peerId: string): boolean;
+export declare function pairUser(runtimeDir: string, channel: string, peerId: string): void;
+export declare function loadAllowList(runtimeDir: string, channel: string): AllowList;
+export declare function isGroupAllowed(runtimeDir: string, channel: string, groupId: string): boolean;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/security/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/security/auth.ts"],"names":[],"mappings":"AAMA,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,UAAU,SAAS;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAG7E;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,QAGnF;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGrF;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAK3E;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAG5E;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG5F"}

package/dist/security/auth.js

@@ -0,0 +1,31 @@
+import { resolve } from "path";
+import { readJSON, writeJSON } from "../utils/file.js";
+import { createLogger } from "../infra/logger.js";
+const log = createLogger("auth");
+export function loadPairing(runtimeDir, channel) {
+    const path = resolve(runtimeDir, "credentials", `${channel}-pairing.json`);
+    return readJSON(path) || { paired: {} };
+}
+export function savePairing(runtimeDir, channel, state) {
+    const path = resolve(runtimeDir, "credentials", `${channel}-pairing.json`);
+    writeJSON(path, state);
+}
+export function isPaired(runtimeDir, channel, peerId) {
+    const state = loadPairing(runtimeDir, channel);
+    return peerId in state.paired;
+}
+export function pairUser(runtimeDir, channel, peerId) {
+    const state = loadPairing(runtimeDir, channel);
+    state.paired[peerId] = { peerId, pairedAt: new Date().toISOString() };
+    savePairing(runtimeDir, channel, state);
+    log.info("Paired user %s on %s", peerId, channel);
+}
+export function loadAllowList(runtimeDir, channel) {
+    const path = resolve(runtimeDir, "credentials", `${channel}-allowFrom.json`);
+    return readJSON(path) || { groups: [] };
+}
+export function isGroupAllowed(runtimeDir, channel, groupId) {
+    const list = loadAllowList(runtimeDir, channel);
+    return list.groups.includes(groupId);
+}
+//# sourceMappingURL=auth.js.map

package/dist/security/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/security/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAUjC,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAE,OAAe;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,OAAO,eAAe,CAAC,CAAC;IAC3E,OAAO,QAAQ,CAAe,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAE,OAAe,EAAE,KAAmB;IAClF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,OAAO,eAAe,CAAC,CAAC;IAC3E,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,OAAe,EAAE,MAAc;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,OAAe,EAAE,MAAc;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACtE,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,OAAe;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,OAAO,iBAAiB,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAY,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,OAAe,EAAE,OAAe;IACjF,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}

package/dist/security/device-identity.d.ts

@@ -0,0 +1,11 @@
+export interface DeviceIdentity {
+    publicKey: string;
+    privateKey: string;
+    deviceId: string;
+    createdAt: string;
+}
+export declare function getIdentityPath(runtimeDir: string): string;
+export declare function loadOrCreateIdentity(runtimeDir: string): DeviceIdentity;
+export declare function signPayload(identity: DeviceIdentity, payload: string): string;
+export declare function verifySignature(publicKeyBase64: string, payload: string, signatureBase64: string): boolean;
+//# sourceMappingURL=device-identity.d.ts.map

package/dist/security/device-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-identity.d.ts","sourceRoot":"","sources":["../../src/security/device-identity.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAuCvE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAS7E;AAED,wBAAgB,eAAe,CAC7B,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,OAAO,CAaT"}

package/dist/security/device-identity.js

@@ -0,0 +1,64 @@
+import { generateKeyPairSync, createHash, sign, verify } from "crypto";
+import { chmodSync } from "fs";
+import { resolve } from "path";
+import { readJSON, writeJSON, ensureDir } from "../utils/file.js";
+import { createLogger } from "../infra/logger.js";
+const log = createLogger("device-identity");
+const IDENTITY_FILE = "identity/device.json";
+export function getIdentityPath(runtimeDir) {
+    return resolve(runtimeDir, IDENTITY_FILE);
+}
+export function loadOrCreateIdentity(runtimeDir) {
+    const path = getIdentityPath(runtimeDir);
+    ensureDir(resolve(runtimeDir, "identity"));
+    const existing = readJSON(path);
+    if (existing) {
+        log.info("Device identity loaded: %s", existing.deviceId.slice(0, 12));
+        return existing;
+    }
+    log.info("Generating new Ed25519 device identity...");
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
+        publicKeyEncoding: { type: "spki", format: "der" },
+        privateKeyEncoding: { type: "pkcs8", format: "der" },
+    });
+    const deviceId = createHash("sha256")
+        .update(publicKey)
+        .digest("hex");
+    const identity = {
+        publicKey: publicKey.toString("base64"),
+        privateKey: privateKey.toString("base64"),
+        deviceId,
+        createdAt: new Date().toISOString(),
+    };
+    writeJSON(path, identity);
+    // Restrict file permissions (owner-only)
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Windows doesn't support chmod well — log warning
+        log.warn("Could not set 0600 permissions on identity file (expected on Windows)");
+    }
+    log.info("Device identity created: %s", deviceId.slice(0, 12));
+    return identity;
+}
+export function signPayload(identity, payload) {
+    const privateKeyDer = Buffer.from(identity.privateKey, "base64");
+    const privateKey = {
+        key: privateKeyDer,
+        format: "der",
+        type: "pkcs8",
+    };
+    const signature = sign(null, Buffer.from(payload), privateKey);
+    return signature.toString("base64");
+}
+export function verifySignature(publicKeyBase64, payload, signatureBase64) {
+    const publicKeyDer = Buffer.from(publicKeyBase64, "base64");
+    const publicKey = {
+        key: publicKeyDer,
+        format: "der",
+        type: "spki",
+    };
+    return verify(null, Buffer.from(payload), publicKey, Buffer.from(signatureBase64, "base64"));
+}
+//# sourceMappingURL=device-identity.js.map

package/dist/security/device-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-identity.js","sourceRoot":"","sources":["../../src/security/device-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAc,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAS5C,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAE7C,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACtD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE;QAC/D,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAmB;QAC/B,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,QAAQ;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1B,yCAAyC;IACzC,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,GAAG,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACpF,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAwB,EAAE,OAAe;IACnE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG;QACjB,GAAG,EAAE,aAAa;QAClB,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,OAAgB;KACvB,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,eAAuB,EACvB,OAAe,EACf,eAAuB;IAEvB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG;QAChB,GAAG,EAAE,YAAY;QACjB,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,MAAe;KACtB,CAAC;IACF,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EACpB,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CACvC,CAAC;AACJ,CAAC"}

package/dist/security/encryption.d.ts

@@ -0,0 +1,5 @@
+import type { DeviceIdentity } from "./device-identity.js";
+export declare function getEncryptionKey(identity: DeviceIdentity): Buffer;
+export declare function encryptCredential(identity: DeviceIdentity, plaintext: string): string;
+export declare function decryptCredential(identity: DeviceIdentity, encrypted: string): string;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/security/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/security/encryption.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAEjE;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,MAAM,GAChB,MAAM,CAGR;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,MAAM,GAChB,MAAM,CAGR"}

package/dist/security/encryption.js

@@ -0,0 +1,13 @@
+import { encrypt, decrypt, deriveKey } from "../utils/crypto.js";
+export function getEncryptionKey(identity) {
+    return deriveKey(Buffer.from(identity.privateKey, "base64"));
+}
+export function encryptCredential(identity, plaintext) {
+    const key = getEncryptionKey(identity);
+    return encrypt(plaintext, key);
+}
+export function decryptCredential(identity, encrypted) {
+    const key = getEncryptionKey(identity);
+    return decrypt(encrypted, key);
+}
+//# sourceMappingURL=encryption.js.map

package/dist/security/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/security/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGjE,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAwB,EACxB,SAAiB;IAEjB,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAwB,EACxB,SAAiB;IAEjB,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/dist/security/isolation.d.ts

@@ -0,0 +1,11 @@
+export type SessionType = "main" | "cron" | "group" | "sub";
+export interface SessionPermissions {
+    canAccessMemory: boolean;
+    canAccessMainHistory: boolean;
+    canUseWallet: boolean;
+    canSendExternal: boolean;
+    canAccessPersonalInfo: boolean;
+}
+export declare function getPermissions(sessionType: SessionType): SessionPermissions;
+export declare function buildSessionKey(agentId: string, sessionType: SessionType, peerId: string): string;
+//# sourceMappingURL=isolation.d.ts.map

package/dist/security/isolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.d.ts","sourceRoot":"","sources":["../../src/security/isolation.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,OAAO,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAiCD,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAE3E;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,GACb,MAAM,CAER"}