@claude-flow/cli 3.32.26 → 3.32.30

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.js

@@ -0,0 +1,239 @@
+/**
+ * A2A (Agent2Agent, Linux Foundation) Agent Card adapter — cards only.
+ *
+ * Maps ruflo's bespoke federation identity (`FederationManifest` /
+ * `FederationNode`) to and from a spec-compliant A2A Agent Card so ruflo
+ * nodes are discoverable by A2A peers and A2A peers appear in federation
+ * discovery. This is an ADAPTER over the existing federation schema, not a
+ * rewrite — A2A Tasks/messaging are deliberately out of scope.
+ *
+ * Spec: A2A Protocol 1.0.0 — https://a2a-protocol.org/latest/specification/
+ * (schema source of truth: specification/a2a.proto in a2aproject/A2A).
+ * Required AgentCard fields per spec §4.4.1: name, description,
+ * supportedInterfaces, version, capabilities, defaultInputModes,
+ * defaultOutputModes, skills.
+ */
+import { FederationNode } from '../domain/entities/federation-node.js';
+import { TrustLevel } from '../domain/entities/trust-level.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** A2A protocol version this adapter targets. */
+export const A2A_PROTOCOL_VERSION = '1.0';
+/**
+ * Well-known URI for Agent Card discovery (A2A 1.0 §8.2 + IANA registration
+ * §14). NOTE: earlier drafts used `/.well-known/agent.json`; 0.3.0+ settled
+ * on `agent-card.json`.
+ */
+export const A2A_WELL_KNOWN_PATH = '/.well-known/agent-card.json';
+/**
+ * Open-form protocol binding string advertising ruflo's federation wire
+ * (Ed25519-signed envelopes over WebSocket/QUIC). Spec §4.4.6 explicitly
+ * allows non-core bindings: "This is an open form string, to be easily
+ * extended for other protocol bindings."
+ */
+export const RUFLO_FEDERATION_BINDING = 'RUFLO-FEDERATION';
+/**
+ * Extension URI carrying the bespoke federation identity inside the card
+ * (spec §4.6 AgentExtension). Enables lossless round-trip in fromAgentCard.
+ */
+export const RUFLO_FEDERATION_EXTENSION_URI = 'urn:ruflo:federation:manifest:v1';
+/** Normalize a federation endpoint (ws://host:port, host:port, …) to a URL. */
+function endpointToUrl(endpoint) {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(endpoint))
+        return endpoint;
+    return `ws://${endpoint}`;
+}
+/**
+ * Generate a spec-compliant A2A Agent Card from a ruflo federation manifest.
+ * Every agent type becomes an AgentSkill; the federation endpoint becomes a
+ * `RUFLO-FEDERATION` interface; the bespoke identity (nodeId, publicKey,
+ * complianceModes, manifest signature) rides in a spec §4.6 extension so
+ * `fromAgentCard` can restore it.
+ */
+export function toAgentCard(manifest, options = {}) {
+    const skills = manifest.capabilities.agentTypes.map((agentType) => ({
+        id: `agent-type:${agentType}`,
+        name: agentType,
+        description: `Federated ruflo agent role "${agentType}" — dispatchable via cross-installation federation sessions.`,
+        tags: ['ruflo', 'federation', 'agent-role', agentType],
+    }));
+    const interfaces = [
+        ...(options.additionalInterfaces ?? []),
+        {
+            url: endpointToUrl(manifest.endpoint),
+            protocolBinding: RUFLO_FEDERATION_BINDING,
+            protocolVersion: A2A_PROTOCOL_VERSION,
+        },
+    ];
+    const federationExtension = {
+        uri: RUFLO_FEDERATION_EXTENSION_URI,
+        description: 'ruflo cross-installation federation identity (Ed25519-signed manifest)',
+        required: false,
+        params: {
+            nodeId: manifest.nodeId,
+            publicKey: manifest.publicKey,
+            endpoint: manifest.endpoint,
+            maxConcurrentSessions: manifest.capabilities.maxConcurrentSessions,
+            supportedProtocols: [...manifest.capabilities.supportedProtocols],
+            complianceModes: [...manifest.capabilities.complianceModes],
+            manifestSignature: manifest.signature,
+            manifestTimestamp: manifest.timestamp,
+        },
+    };
+    return {
+        name: options.name ?? `ruflo-federation/${manifest.nodeId}`,
+        description: options.description ??
+            `Ruflo federation node ${manifest.nodeId} — zero-trust cross-installation agent federation ` +
+                `(${manifest.capabilities.agentTypes.length} agent role(s), PII-gated data flow, compliance-grade audit trail).`,
+        supportedInterfaces: interfaces,
+        version: manifest.version,
+        capabilities: {
+            streaming: false,
+            pushNotifications: false,
+            extendedAgentCard: false,
+            extensions: [federationExtension],
+        },
+        defaultInputModes: ['application/json', 'text/plain'],
+        defaultOutputModes: ['application/json', 'text/plain'],
+        skills,
+        ...(options.provider ? { provider: options.provider } : {}),
+        ...(options.documentationUrl ? { documentationUrl: options.documentationUrl } : {}),
+    };
+}
+/**
+ * Structural validation against the A2A 1.0 AgentCard REQUIRED fields.
+ * Intentionally strict on required shape, lenient on unknown extra fields
+ * (forward compatibility with future spec minors).
+ */
+export function validateAgentCard(value) {
+    const errors = [];
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return { valid: false, errors: ['card must be a JSON object'] };
+    }
+    const card = value;
+    const requireString = (field) => {
+        if (typeof card[field] !== 'string' || card[field].length === 0) {
+            errors.push(`missing or empty required string field: ${field}`);
+        }
+    };
+    requireString('name');
+    requireString('description');
+    requireString('version');
+    const interfaces = card['supportedInterfaces'];
+    if (!Array.isArray(interfaces) || interfaces.length === 0) {
+        errors.push('supportedInterfaces must be a non-empty array (spec 4.4.1)');
+    }
+    else {
+        interfaces.forEach((iface, i) => {
+            if (typeof iface !== 'object' || iface === null) {
+                errors.push(`supportedInterfaces[${i}] must be an object`);
+                return;
+            }
+            for (const f of ['url', 'protocolBinding', 'protocolVersion']) {
+                if (typeof iface[f] !== 'string' || !iface[f]) {
+                    errors.push(`supportedInterfaces[${i}].${f} is required (spec 4.4.6)`);
+                }
+            }
+        });
+    }
+    if (typeof card['capabilities'] !== 'object' || card['capabilities'] === null || Array.isArray(card['capabilities'])) {
+        errors.push('capabilities must be an object (spec 4.4.1)');
+    }
+    for (const field of ['defaultInputModes', 'defaultOutputModes']) {
+        const v = card[field];
+        if (!Array.isArray(v) || v.length === 0 || !v.every((x) => typeof x === 'string')) {
+            errors.push(`${field} must be a non-empty array of media-type strings (spec 4.4.1)`);
+        }
+    }
+    const skills = card['skills'];
+    if (!Array.isArray(skills)) {
+        errors.push('skills must be an array (spec 4.4.1)');
+    }
+    else {
+        skills.forEach((skill, i) => {
+            if (typeof skill !== 'object' || skill === null) {
+                errors.push(`skills[${i}] must be an object`);
+                return;
+            }
+            const s = skill;
+            for (const f of ['id', 'name', 'description']) {
+                if (typeof s[f] !== 'string' || !s[f])
+                    errors.push(`skills[${i}].${f} is required (spec 4.4.5)`);
+            }
+            if (!Array.isArray(s['tags']))
+                errors.push(`skills[${i}].tags is required (spec 4.4.5)`);
+        });
+    }
+    return { valid: errors.length === 0, errors };
+}
+// ---------------------------------------------------------------------------
+// Consumption: A2A Agent Card → bespoke federation registry shape
+// ---------------------------------------------------------------------------
+/** Slugify a card name into a stable nodeId when no extension identity exists. */
+function slugify(name) {
+    // Linear-time dash trim (no /^-+|-+$/ regex — that anchor+quantifier pattern
+    // is polynomial-time on adversarial all-dash input, flagged js/polynomial-redos).
+    const collapsed = name.toLowerCase().replace(/[^a-z0-9]+/g, '-');
+    let start = 0;
+    let end = collapsed.length;
+    while (start < end && collapsed.charCodeAt(start) === 45 /* '-' */)
+        start++;
+    while (end > start && collapsed.charCodeAt(end - 1) === 45 /* '-' */)
+        end--;
+    return collapsed.slice(start, end).slice(0, 64) || 'a2a-peer';
+}
+function findFederationExtension(card) {
+    return card.capabilities.extensions?.find((e) => e.uri === RUFLO_FEDERATION_EXTENSION_URI);
+}
+/**
+ * Map a validated remote A2A Agent Card into the bespoke federation registry
+ * shape (a `FederationNode`) so A2A peers appear in federation discovery.
+ *
+ * Trust posture: A2A cards are self-describing metadata, NOT authenticated
+ * federation manifests — consumed peers always enter at
+ * `TrustLevel.UNTRUSTED` regardless of embedded identity claims. Trust is
+ * earned afterwards through the normal handshake + TrustEvaluator path.
+ */
+export function fromAgentCard(card, sourceUrl) {
+    const ext = findFederationExtension(card);
+    const params = (ext?.params ?? {});
+    const preferred = card.supportedInterfaces[0];
+    const federationIface = card.supportedInterfaces.find((i) => i.protocolBinding === RUFLO_FEDERATION_BINDING);
+    const endpoint = (typeof params['endpoint'] === 'string' && params['endpoint']) ||
+        federationIface?.url ||
+        preferred?.url ||
+        '';
+    const nodeId = (typeof params['nodeId'] === 'string' && params['nodeId']) || `a2a-${slugify(card.name)}`;
+    const agentTypes = card.skills.map((s) => s.id.startsWith('agent-type:') ? s.id.slice('agent-type:'.length) : s.id);
+    const supportedProtocols = Array.isArray(params['supportedProtocols'])
+        ? params['supportedProtocols']
+        : [...new Set(card.supportedInterfaces.map((i) => i.protocolBinding.toLowerCase()))];
+    return FederationNode.create({
+        nodeId,
+        publicKey: typeof params['publicKey'] === 'string' ? params['publicKey'] : '',
+        endpoint,
+        capabilities: {
+            agentTypes,
+            maxConcurrentSessions: typeof params['maxConcurrentSessions'] === 'number'
+                ? params['maxConcurrentSessions']
+                : 1,
+            supportedProtocols,
+            complianceModes: Array.isArray(params['complianceModes'])
+                ? params['complianceModes']
+                : [],
+        },
+        trustLevel: TrustLevel.UNTRUSTED,
+        metadata: {
+            discoveryMechanism: 'a2a-card',
+            version: card.version,
+            a2a: {
+                cardName: card.name,
+                protocolVersion: preferred?.protocolVersion ?? A2A_PROTOCOL_VERSION,
+                sourceUrl: sourceUrl ?? null,
+                skillCount: card.skills.length,
+            },
+        },
+    });
+}
+//# sourceMappingURL=agent-card.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/agent-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-card.js","sourceRoot":"","sources":["../../src/a2a/agent-card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAG/D,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAC;AA+EjF,+EAA+E;AAC/E,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/D,OAAO,QAAQ,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,QAA4B,EAC5B,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAoB,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnF,EAAE,EAAE,cAAc,SAAS,EAAE;QAC7B,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,+BAA+B,SAAS,8DAA8D;QACnH,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,CAAC;KACvD,CAAC,CAAC,CAAC;IAEJ,MAAM,UAAU,GAAwB;QACtC,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;QACvC;YACE,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACrC,eAAe,EAAE,wBAAwB;YACzC,eAAe,EAAE,oBAAoB;SACtC;KACF,CAAC;IAEF,MAAM,mBAAmB,GAAsB;QAC7C,GAAG,EAAE,8BAA8B;QACnC,WAAW,EAAE,wEAAwE;QACrF,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAAC,qBAAqB;YAClE,kBAAkB,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,kBAAkB,CAAC;YACjE,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC;YAC3D,iBAAiB,EAAE,QAAQ,CAAC,SAAS;YACrC,iBAAiB,EAAE,QAAQ,CAAC,SAAS;SACtC;KACF,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,oBAAoB,QAAQ,CAAC,MAAM,EAAE;QAC3D,WAAW,EACT,OAAO,CAAC,WAAW;YACnB,yBAAyB,QAAQ,CAAC,MAAM,oDAAoD;gBAC5F,IAAI,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,qEAAqE;QAClH,mBAAmB,EAAE,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,YAAY,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,KAAK;YACxB,UAAU,EAAE,CAAC,mBAAmB,CAAC;SAClC;QACD,iBAAiB,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC;QACrD,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC;QACtD,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAC;IAE9C,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,EAAE;QACtC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,IAAI,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IACF,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7B,aAAa,CAAC,SAAS,CAAC,CAAC;IAEzB,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAC9D,IAAI,OAAQ,KAAiC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxG,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACrH,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,+DAA+D,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,KAAgC,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC9C,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,kFAAkF;AAClF,SAAS,OAAO,CAAC,IAAY;IAC3B,6EAA6E;IAC7E,kFAAkF;IAClF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;IAC3B,OAAO,KAAK,GAAG,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,KAAK,EAAE,CAAC;IAC5E,OAAO,GAAG,GAAG,KAAK,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAC;IAC5E,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC;AAChE,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAkB;IACjD,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB,EAAE,SAAkB;IAClE,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAA4B,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CACnD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,wBAAwB,CACtD,CAAC;IACF,MAAM,QAAQ,GACZ,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9D,eAAe,EAAE,GAAG;QACpB,SAAS,EAAE,GAAG;QACd,EAAE,CAAC;IAEL,MAAM,MAAM,GACV,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAE5F,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IAEF,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACpE,CAAC,CAAE,MAAM,CAAC,oBAAoB,CAAc;QAC5C,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvF,OAAO,cAAc,CAAC,MAAM,CAAC;QAC3B,MAAM;QACN,SAAS,EAAE,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,EAAE;QACzF,QAAQ;QACR,YAAY,EAAE;YACZ,UAAU;YACV,qBAAqB,EACnB,OAAO,MAAM,CAAC,uBAAuB,CAAC,KAAK,QAAQ;gBACjD,CAAC,CAAE,MAAM,CAAC,uBAAuB,CAAY;gBAC7C,CAAC,CAAC,CAAC;YACP,kBAAkB;YAClB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvD,CAAC,CAAE,MAAM,CAAC,iBAAiB,CAAc;gBACzC,CAAC,CAAC,EAAE;SACP;QACD,UAAU,EAAE,UAAU,CAAC,SAAS;QAChC,QAAQ,EAAE;YACR,kBAAkB,EAAE,UAAU;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE;gBACH,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,eAAe,EAAE,SAAS,EAAE,eAAe,IAAI,oBAAoB;gBACnE,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;aAC/B;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.d.ts

@@ -0,0 +1,34 @@
+/**
+ * A2A Agent Card consumption — fetch + validate a remote card and map it
+ * into the bespoke federation registry so A2A peers appear in federation
+ * discovery. Cards only (no A2A Tasks/messaging in this iteration).
+ */
+import type { DiscoveryService } from '../domain/services/discovery-service.js';
+import type { FederationNode } from '../domain/entities/federation-node.js';
+import { type A2AAgentCard } from './agent-card.js';
+export interface FetchAgentCardOptions {
+    /** Injectable fetch for tests / restricted environments. Default: globalThis.fetch. */
+    readonly fetchImpl?: typeof fetch;
+    readonly timeoutMs?: number;
+    /** Response size cap in bytes (defense against decompression floods). Default 256 KiB. */
+    readonly maxBytes?: number;
+}
+export interface FetchAgentCardResult {
+    readonly card: A2AAgentCard;
+    readonly sourceUrl: string;
+}
+/**
+ * Resolve the card URL: a bare base URL (`https://host[:port]` or a path-less
+ * URL) gets the A2A well-known path appended; anything already pointing at a
+ * JSON document is used as-is.
+ */
+export declare function resolveAgentCardUrl(baseOrCardUrl: string): string;
+/** Fetch and structurally validate a remote A2A Agent Card. */
+export declare function fetchAgentCard(baseOrCardUrl: string, options?: FetchAgentCardOptions): Promise<FetchAgentCardResult>;
+/**
+ * Fetch a remote Agent Card and register the peer in federation discovery.
+ * The peer enters at TrustLevel.UNTRUSTED (see fromAgentCard) — the card is
+ * self-asserted metadata, and trust is earned through the normal handshake.
+ */
+export declare function consumeAgentCard(discovery: DiscoveryService, baseOrCardUrl: string, options?: FetchAgentCardOptions): Promise<FederationNode>;
+//# sourceMappingURL=consume.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consume.d.ts","sourceRoot":"","sources":["../../src/a2a/consume.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,qBAAqB;IACpC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAMjE;AAED,+DAA+D;AAC/D,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAyC/B;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,gBAAgB,EAC3B,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,cAAc,CAAC,CAIzB"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.js

@@ -0,0 +1,69 @@
+/**
+ * A2A Agent Card consumption — fetch + validate a remote card and map it
+ * into the bespoke federation registry so A2A peers appear in federation
+ * discovery. Cards only (no A2A Tasks/messaging in this iteration).
+ */
+import { A2A_WELL_KNOWN_PATH, fromAgentCard, validateAgentCard, } from './agent-card.js';
+/**
+ * Resolve the card URL: a bare base URL (`https://host[:port]` or a path-less
+ * URL) gets the A2A well-known path appended; anything already pointing at a
+ * JSON document is used as-is.
+ */
+export function resolveAgentCardUrl(baseOrCardUrl) {
+    const url = new URL(baseOrCardUrl);
+    if (url.pathname === '/' || url.pathname === '') {
+        url.pathname = A2A_WELL_KNOWN_PATH;
+    }
+    return url.toString();
+}
+/** Fetch and structurally validate a remote A2A Agent Card. */
+export async function fetchAgentCard(baseOrCardUrl, options = {}) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function') {
+        throw new Error('fetchAgentCard: no fetch implementation available');
+    }
+    const sourceUrl = resolveAgentCardUrl(baseOrCardUrl);
+    const maxBytes = options.maxBytes ?? 256 * 1024;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 10_000);
+    let text;
+    try {
+        const res = await fetchImpl(sourceUrl, {
+            signal: controller.signal,
+            headers: { accept: 'application/json' },
+        });
+        if (!res.ok) {
+            throw new Error(`fetchAgentCard: ${sourceUrl} returned HTTP ${res.status}`);
+        }
+        text = await res.text();
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (text.length > maxBytes) {
+        throw new Error(`fetchAgentCard: card exceeds ${maxBytes} bytes`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`fetchAgentCard: ${sourceUrl} did not return valid JSON`);
+    }
+    const validation = validateAgentCard(parsed);
+    if (!validation.valid) {
+        throw new Error(`fetchAgentCard: invalid A2A agent card from ${sourceUrl}: ${validation.errors.join('; ')}`);
+    }
+    return { card: parsed, sourceUrl };
+}
+/**
+ * Fetch a remote Agent Card and register the peer in federation discovery.
+ * The peer enters at TrustLevel.UNTRUSTED (see fromAgentCard) — the card is
+ * self-asserted metadata, and trust is earned through the normal handshake.
+ */
+export async function consumeAgentCard(discovery, baseOrCardUrl, options = {}) {
+    const { card, sourceUrl } = await fetchAgentCard(baseOrCardUrl, options);
+    const node = fromAgentCard(card, sourceUrl);
+    return discovery.registerExternalPeer(node);
+}
+//# sourceMappingURL=consume.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/consume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consume.js","sourceRoot":"","sources":["../../src/a2a/consume.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AAezB;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,GAAG,mBAAmB,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,EACrB,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC;IAEhD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAChF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;YACrC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,kBAAkB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,4BAA4B,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,+CAA+C,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAsB,EAAE,SAAS,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAA2B,EAC3B,aAAqB,EACrB,UAAiC,EAAE;IAEnC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.d.ts

@@ -0,0 +1,46 @@
+/**
+ * A2A well-known Agent Card endpoint (A2A 1.0 §8.2 discovery + §8.6 caching).
+ *
+ * Serves `GET /.well-known/agent-card.json` from a minimal `node:http`
+ * server. Security posture follows ADR-166 (mcp-bridge unauthenticated-RCE
+ * remediation): binds 127.0.0.1 by default and REFUSES a non-loopback bind
+ * unless the caller passes `allowNonLoopback: true` explicitly. The endpoint
+ * is read-only (GET/HEAD on one exact path), exposes only the public card,
+ * and is entirely opt-in — nothing here weakens the federation transport's
+ * existing bind or auth behavior.
+ */
+import { type A2AAgentCard } from './agent-card.js';
+export interface AgentCardServerOptions {
+    /** Card supplier — re-invoked per request so a late-published manifest is picked up. */
+    readonly getCard: () => A2AAgentCard | null;
+    readonly port: number;
+    /** Bind host. Default 127.0.0.1 (ADR-166 posture). */
+    readonly host?: string;
+    /** Serve path. Default A2A_WELL_KNOWN_PATH. */
+    readonly path?: string;
+    /**
+     * Explicit opt-in required to bind anything other than loopback. Without
+     * it a non-loopback host is rejected at start (fail-closed).
+     */
+    readonly allowNonLoopback?: boolean;
+    /** Cache-Control max-age seconds (spec §8.6.1). Default 300. */
+    readonly cacheMaxAgeSeconds?: number;
+}
+export interface AgentCardServerHandle {
+    readonly url: string;
+    readonly host: string;
+    readonly port: number;
+    close(): Promise<void>;
+}
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Start the well-known Agent Card HTTP endpoint.
+ *
+ * Responses:
+ *   GET/HEAD <path>  → 200 application/json (+ Cache-Control, ETag per §8.6)
+ *                      or 503 when no card is available yet
+ *   other method     → 405
+ *   other path       → 404
+ */
+export declare function startAgentCardServer(options: AgentCardServerOptions): Promise<AgentCardServerHandle>;
+//# sourceMappingURL=well-known.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/a2a/well-known.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEzE,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,YAAY,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA6DhC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.js

@@ -0,0 +1,84 @@
+/**
+ * A2A well-known Agent Card endpoint (A2A 1.0 §8.2 discovery + §8.6 caching).
+ *
+ * Serves `GET /.well-known/agent-card.json` from a minimal `node:http`
+ * server. Security posture follows ADR-166 (mcp-bridge unauthenticated-RCE
+ * remediation): binds 127.0.0.1 by default and REFUSES a non-loopback bind
+ * unless the caller passes `allowNonLoopback: true` explicitly. The endpoint
+ * is read-only (GET/HEAD on one exact path), exposes only the public card,
+ * and is entirely opt-in — nothing here weakens the federation transport's
+ * existing bind or auth behavior.
+ */
+import { createServer } from 'node:http';
+import { createHash } from 'node:crypto';
+import { A2A_WELL_KNOWN_PATH } from './agent-card.js';
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
+export function isLoopbackHost(host) {
+    return LOOPBACK_HOSTS.has(host) || host.startsWith('127.');
+}
+/**
+ * Start the well-known Agent Card HTTP endpoint.
+ *
+ * Responses:
+ *   GET/HEAD <path>  → 200 application/json (+ Cache-Control, ETag per §8.6)
+ *                      or 503 when no card is available yet
+ *   other method     → 405
+ *   other path       → 404
+ */
+export function startAgentCardServer(options) {
+    const host = options.host ?? '127.0.0.1';
+    const path = options.path ?? A2A_WELL_KNOWN_PATH;
+    const maxAge = options.cacheMaxAgeSeconds ?? 300;
+    if (!isLoopbackHost(host) && options.allowNonLoopback !== true) {
+        return Promise.reject(new Error(`A2A agent-card server: refusing non-loopback bind ${host} without allowNonLoopback: true (ADR-166)`));
+    }
+    const server = createServer((req, res) => {
+        const reqPath = (req.url ?? '').split('?')[0];
+        if (reqPath !== path) {
+            res.writeHead(404, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: 'not_found', agentCardPath: path }));
+            return;
+        }
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            res.writeHead(405, { allow: 'GET, HEAD', 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: 'method_not_allowed' }));
+            return;
+        }
+        const card = options.getCard();
+        if (!card) {
+            res.writeHead(503, { 'content-type': 'application/json', 'retry-after': '5' });
+            res.end(JSON.stringify({ error: 'agent_card_not_ready' }));
+            return;
+        }
+        const body = JSON.stringify(card, null, 2);
+        const etag = `"${createHash('sha256').update(body).digest('hex').slice(0, 32)}"`;
+        if (req.headers['if-none-match'] === etag) {
+            res.writeHead(304, { etag });
+            res.end();
+            return;
+        }
+        res.writeHead(200, {
+            'content-type': 'application/json',
+            'cache-control': `public, max-age=${maxAge}`,
+            etag,
+        });
+        res.end(req.method === 'HEAD' ? undefined : body);
+    });
+    return new Promise((resolvePromise, rejectPromise) => {
+        server.once('error', rejectPromise);
+        server.listen(options.port, host, () => {
+            server.removeListener('error', rejectPromise);
+            const addr = server.address();
+            const boundPort = typeof addr === 'object' && addr !== null ? addr.port : options.port;
+            resolvePromise({
+                url: `http://${host}:${boundPort}${path}`,
+                host,
+                port: boundPort,
+                close: () => new Promise((res2, rej2) => {
+                    server.close((err) => (err ? rej2(err) : res2()));
+                }),
+            });
+        });
+    });
+}
+//# sourceMappingURL=well-known.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/a2a/well-known.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/a2a/well-known.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAqB,MAAM,iBAAiB,CAAC;AA0BzE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC;IAEjD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAC7B,qDAAqD,IAAI,2CAA2C,CACrG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QACjF,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7B,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,mBAAmB,MAAM,EAAE;YAC5C,IAAI;SACL,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YACvF,cAAc,CAAC;gBACb,GAAG,EAAE,UAAU,IAAI,IAAI,SAAS,GAAG,IAAI,EAAE;gBACzC,IAAI;gBACJ,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;oBAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACpD,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.d.ts

@@ -0,0 +1,27 @@
+import type { FederationClaimType, PolicyEngineDeps } from './policy-engine.js';
+export type FederationAuthorizationMode = 'legacy' | 'observe' | 'enforce';
+export interface FederationClaimCheckerConfig {
+    mode?: FederationAuthorizationMode;
+    grantedClaims?: readonly string[];
+    onObservation?: (claim: FederationClaimType, granted: boolean) => void;
+}
+export interface FederationClaimChecker {
+    mode: FederationAuthorizationMode;
+    grantedClaims: ReadonlySet<FederationClaimType>;
+    checkClaim: PolicyEngineDeps['checkClaim'];
+}
+/**
+ * Compatibility bridge for the legacy federation policy engine.
+ *
+ * This removes the anonymous `() => true` production stub and makes
+ * compatibility behavior explicit:
+ * - legacy: preserve pre-ADR-325 behavior;
+ * - observe: calculate and report missing grants without blocking;
+ * - enforce: default deny unless the exact claim is configured.
+ *
+ * ADR-324 policy adapters can supply the `grantedClaims` set after evaluating
+ * the request; ownership-changing federation messages remain disabled in the
+ * default message policy until the full ingress PEP is composed.
+ */
+export declare function createFederationClaimChecker(config?: FederationClaimCheckerConfig): FederationClaimChecker;
+//# sourceMappingURL=claim-checker.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-checker.d.ts","sourceRoot":"","sources":["../../src/application/claim-checker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,MAAM,2BAA2B,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAY3E,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,EAAE,2BAA2B,CAAC;IACnC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACxE;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,2BAA2B,CAAC;IAClC,aAAa,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAChD,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,GAAE,4BAAiC,GACxC,sBAAsB,CAuBxB"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.js

@@ -0,0 +1,46 @@
+const FEDERATION_CLAIMS = new Set([
+    'federation:discover',
+    'federation:connect',
+    'federation:read',
+    'federation:write',
+    'federation:admin',
+    'federation:memory',
+    'federation:spawn',
+]);
+/**
+ * Compatibility bridge for the legacy federation policy engine.
+ *
+ * This removes the anonymous `() => true` production stub and makes
+ * compatibility behavior explicit:
+ * - legacy: preserve pre-ADR-325 behavior;
+ * - observe: calculate and report missing grants without blocking;
+ * - enforce: default deny unless the exact claim is configured.
+ *
+ * ADR-324 policy adapters can supply the `grantedClaims` set after evaluating
+ * the request; ownership-changing federation messages remain disabled in the
+ * default message policy until the full ingress PEP is composed.
+ */
+export function createFederationClaimChecker(config = {}) {
+    const mode = config.mode ?? 'legacy';
+    if (mode !== 'legacy' && mode !== 'observe' && mode !== 'enforce') {
+        throw new TypeError(`Unsupported federation authorization mode: ${String(mode)}`);
+    }
+    const grantedClaims = new Set();
+    for (const claim of config.grantedClaims ?? []) {
+        if (!FEDERATION_CLAIMS.has(claim)) {
+            throw new TypeError(`Unknown federation claim: ${claim}`);
+        }
+        grantedClaims.add(claim);
+    }
+    return {
+        mode,
+        grantedClaims,
+        checkClaim: (claim) => {
+            const granted = grantedClaims.has(claim);
+            if (mode === 'observe')
+                config.onObservation?.(claim, granted);
+            return mode !== 'enforce' || granted;
+        },
+    };
+}
+//# sourceMappingURL=claim-checker.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/claim-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-checker.js","sourceRoot":"","sources":["../../src/application/claim-checker.ts"],"names":[],"mappings":"AAIA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAsB;IACrD,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC,CAAC;AAcH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAuC,EAAE;IAEzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC;IACrC,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,8CAA8C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAA4B,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,KAA4B,CAAC,CAAC;IAClD,CAAC;IAED,OAAO;QACL,IAAI;QACJ,aAAa;QACb,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/D,OAAO,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC"}