@claude-flow/cli 3.32.26 → 3.32.30

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-coordinator.d.ts","sourceRoot":"","sources":["../../src/application/federation-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAiC,KAAK,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACxH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAGL,aAAa,EACb,cAAc,EACf,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAA2C;gBAGxE,MAAM,EAAE,2BAA2B,EACnC,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,kBAAkB,EAC/B,cAAc,EAAE,cAAc,EAC9B,YAAY,EAAE,YAAY,EAC1B,YAAY,GAAE,iCAAsC;IAkBtD;;;;;OAKG;YACW,aAAa;IAuBrB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBzB,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,OAAO,CAAC,iBAAiB,CAAC;IAavB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxC,WAAW,CAAC,CAAC,EACjB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,qBAAqB,EAClC,OAAO,EAAE,CAAC,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,aAAa,CAAC;IAqHzB;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM;;;MAAwD;IAExE,gBAAgB,CAAC,CAAC,EACtB,WAAW,EAAE,qBAAqB,EAClC,OAAO,EAAE,CAAC,GACT,OAAO,CAAC,aAAa,EAAE,CAAC;IAK3B,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAqB3C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAkBvC,SAAS,IAAI,gBAAgB;IAgB7B;;;;;;;OAOG;IACH,aAAa,IAAI,SAAS,CAAC,yBAAyB,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE;IAOrF;;;;;OAKG;IACH,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC;;;OAGG;IACH,kBAAkB,IAAI;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAcvG;;;;;;;OAOG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,gBAAiC,EACzC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC;IA+BnB;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BjB;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAuB/C;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B9E,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAI5D,iBAAiB,IAAI,iBAAiB,EAAE;YAI1B,gBAAgB;IA0B9B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,iBAAiB;CAK1B"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.js

@@ -0,0 +1,501 @@
+import { TrustLevel } from '../domain/entities/trust-level.js';
+import { FederationNodeState, } from '../domain/value-objects/federation-node-state.js';
+import { enforceBudget, validateBudget, } from '../domain/value-objects/federation-budget.js';
+export class FederationCoordinator {
+    config;
+    discovery;
+    handshake;
+    routing;
+    audit;
+    piiPipeline;
+    trustEvaluator;
+    policyEngine;
+    sessions;
+    initialized;
+    spendReporter;
+    breakerService;
+    wgMesh;
+    wgCommandSink;
+    constructor(config, discovery, handshake, routing, audit, piiPipeline, trustEvaluator, policyEngine, integrations = {}) {
+        this.config = config;
+        this.discovery = discovery;
+        this.handshake = handshake;
+        this.routing = routing;
+        this.audit = audit;
+        this.piiPipeline = piiPipeline;
+        this.trustEvaluator = trustEvaluator;
+        this.policyEngine = policyEngine;
+        this.sessions = new Map();
+        this.initialized = false;
+        this.spendReporter = integrations.spendReporter;
+        this.breakerService = integrations.breakerService;
+        this.wgMesh = integrations.wgMesh;
+        this.wgCommandSink = integrations.wgCommandSink;
+    }
+    /**
+     * ADR-111 Phase 3 — emit a WG command for an audited peer transition.
+     * No-op if no wgMesh is configured or the peer lacks a `wg` manifest
+     * block. Commands flow to `wgCommandSink` (if any) and always to the
+     * audit log so reactivation is fully traceable.
+     */
+    async emitWgCommand(peer, builder) {
+        if (!this.wgMesh)
+            return;
+        const wgPubkey = peer.metadata.wgPublicKey;
+        const wgMeshIP = peer.metadata.wgMeshIP;
+        if (!wgPubkey || !wgMeshIP)
+            return;
+        const cmd = builder(wgPubkey, wgMeshIP);
+        if (!cmd)
+            return;
+        await this.audit.log('peer_manifest_published', {
+            targetNodeId: peer.nodeId,
+            metadata: {
+                wgCommand: cmd.cmd,
+                wgVerb: cmd.verb,
+                wgRationale: cmd.rationale,
+            },
+        });
+        if (this.wgCommandSink) {
+            await this.wgCommandSink(cmd);
+        }
+    }
+    async initialize(manifest) {
+        // The coordinator's keypair and runtime protocol configuration are
+        // authoritative. CLI/MCP callers may describe agent/compliance capacity,
+        // but cannot replace the identity created by the plugin.
+        await this.discovery.publishManifest({
+            ...manifest,
+            nodeId: this.config.nodeId,
+            publicKey: this.config.publicKey,
+            endpoint: this.config.endpoint,
+            capabilities: {
+                ...manifest.capabilities,
+                supportedProtocols: this.config.supportedProtocols ?? manifest.capabilities.supportedProtocols,
+            },
+            version: this.config.version ?? manifest.version,
+        });
+        this.discovery.startPeriodicDiscovery();
+        this.initialized = true;
+        await this.audit.log('peer_manifest_published', {
+            metadata: { endpoint: this.config.endpoint },
+        });
+    }
+    async shutdown() {
+        this.discovery.stopPeriodicDiscovery();
+        for (const [sessionId, session] of this.sessions) {
+            session.terminate();
+            await this.audit.log('session_terminated', {
+                sessionId,
+                targetNodeId: session.remoteNodeId,
+            });
+        }
+        this.sessions.clear();
+        await this.audit.flush();
+        this.initialized = false;
+    }
+    async joinPeer(endpoint, manifest) {
+        this.ensureInitialized();
+        const node = await this.discovery.addStaticPeer(endpoint, manifest);
+        await this.audit.log('peer_discovered', {
+            targetNodeId: node.nodeId,
+            metadata: { endpoint },
+        });
+        return this.establishSession(node, manifest !== undefined);
+    }
+    async leavePeer(nodeId) {
+        this.ensureInitialized();
+        const session = this.findSessionByNodeId(nodeId);
+        if (session) {
+            session.terminate();
+            this.sessions.delete(session.sessionId);
+            await this.audit.log('session_terminated', {
+                sessionId: session.sessionId,
+                targetNodeId: nodeId,
+            });
+        }
+        this.discovery.removePeer(nodeId);
+    }
+    async sendMessage(targetNodeId, messageType, payload, options = {}) {
+        this.ensureInitialized();
+        // ADR-097 Phase 2.b: outbound short-circuit on tripped breaker. If the
+        // peer is SUSPENDED or EVICTED we refuse the send before doing any work,
+        // and emit a constant-string error (no remaining-budget echo per the
+        // anti-oracle posture inherited from Phase 1). The check fires *before*
+        // session lookup so an evicted peer cannot consume cycles even on a
+        // dangling session reference.
+        const peer = this.discovery.getPeer(targetNodeId);
+        if (peer && !peer.isActive) {
+            const reason = peer.isEvicted ? 'PEER_EVICTED' : 'PEER_SUSPENDED';
+            await this.audit.log('message_rejected', {
+                targetNodeId,
+                metadata: { reason },
+            });
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: reason,
+            };
+        }
+        const session = this.findSessionByNodeId(targetNodeId);
+        if (!session) {
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: `No active session with node ${targetNodeId}`,
+            };
+        }
+        const policyResult = this.policyEngine.evaluateMessage(messageType, session.trustLevel, JSON.stringify(payload).length, this.config.nodeId);
+        if (!policyResult.allowed) {
+            await this.audit.log('message_rejected', {
+                targetNodeId,
+                sessionId: session.sessionId,
+                metadata: { reason: policyResult.reason },
+            });
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: policyResult.reason,
+            };
+        }
+        // ADR-097 Phase 1: validate caller-supplied budget + enforce hop limit
+        // and cumulative spend BEFORE outbound dispatch. Synchronous & atomic —
+        // no awaits between validate and enforce, so concurrent sends cannot
+        // both pass a single-hop budget. Errors are constant strings so a
+        // malicious caller cannot use the response as a budget oracle.
+        const budgetResult = validateBudget(options.budget, options.maxHops);
+        if (!budgetResult.ok) {
+            await this.audit.log('message_rejected', {
+                targetNodeId,
+                sessionId: session.sessionId,
+                metadata: { reason: 'INVALID_BUDGET', detail: budgetResult.error },
+            });
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: 'INVALID_BUDGET',
+            };
+        }
+        const enforcement = enforceBudget(budgetResult.budget, options.hopCount ?? 0, {
+            tokens: options.spent?.tokens ?? 0,
+            usd: options.spent?.usd ?? 0,
+        });
+        if (!enforcement.ok) {
+            await this.audit.log('message_rejected', {
+                targetNodeId,
+                sessionId: session.sessionId,
+                metadata: { reason: enforcement.reason },
+            });
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: enforcement.reason, // constant string — no oracle leak
+            };
+        }
+        const result = await this.routing.send(session, messageType, payload);
+        await this.audit.log(result.success ? 'message_sent' : 'message_rejected', {
+            targetNodeId,
+            sessionId: session.sessionId,
+            latencyMs: result.latencyMs,
+            metadata: {
+                messageType,
+                mode: result.mode,
+                hopCount: enforcement.nextHopCount,
+            },
+        });
+        return result;
+    }
+    /**
+     * Re-export the budget primitives so external callers (e.g. follow-up
+     * iterations adding receive-side decrement) can reuse them without
+     * dipping into domain/value-objects directly.
+     */
+    static budget = { validate: validateBudget, enforce: enforceBudget };
+    async broadcastMessage(messageType, payload) {
+        this.ensureInitialized();
+        return this.routing.broadcast(messageType, payload);
+    }
+    handleThreatDetection(nodeId) {
+        const exceedsThreshold = this.trustEvaluator.recordThreatDetection(nodeId);
+        const node = this.discovery.getPeer(nodeId);
+        if (node && exceedsThreshold) {
+            this.trustEvaluator.downgrade(node, 'repeated-threat-detection');
+            const session = this.findSessionByNodeId(nodeId);
+            if (session) {
+                session.terminate();
+                this.sessions.delete(session.sessionId);
+            }
+            this.audit.log('threat_blocked', {
+                sourceNodeId: nodeId,
+                trustLevel: TrustLevel.UNTRUSTED,
+                threatDetected: true,
+                metadata: { reason: 'repeated-threat-detection' },
+            });
+        }
+    }
+    handleHmacFailure(nodeId) {
+        const node = this.discovery.getPeer(nodeId);
+        if (node) {
+            this.trustEvaluator.downgrade(node, 'hmac-verification-failure');
+            const session = this.findSessionByNodeId(nodeId);
+            if (session) {
+                session.terminate();
+                this.sessions.delete(session.sessionId);
+            }
+            this.audit.log('threat_blocked', {
+                sourceNodeId: nodeId,
+                trustLevel: TrustLevel.UNTRUSTED,
+                metadata: { reason: 'hmac-verification-failure' },
+            });
+        }
+    }
+    getStatus() {
+        const peers = this.discovery.listPeers();
+        const trustLevels = {};
+        for (const peer of peers) {
+            trustLevels[peer.nodeId] = peer.trustLevel;
+        }
+        return {
+            nodeId: this.config.nodeId,
+            activeSessions: Array.from(this.sessions.values()).filter(s => s.active).length,
+            knownPeers: peers.length,
+            trustLevels,
+            healthy: this.initialized,
+        };
+    }
+    /**
+     * ADR-097 Phase 4: per-peer breaker state snapshot for the doctor
+     * surface and `federation_breaker_status` MCP tool.
+     *
+     * Returns one entry per known peer with the entity's stateRecord —
+     * what state, when it changed, why, and which caller's correlation
+     * key triggered it. Pure read; does not mutate.
+     */
+    getPeerStates() {
+        return this.discovery.listPeers().map((peer) => ({
+            nodeId: peer.nodeId,
+            ...peer.stateRecord,
+        }));
+    }
+    /**
+     * ADR-111 Phase 6: public read of the discovery peer list. Used by
+     * federation_wg_status MCP tool + WG firewall projection. Returns the
+     * full known-peer set (active + suspended + evicted) — filter via
+     * .isActive / state if you only want the live mesh members.
+     */
+    listPeers() {
+        return this.discovery.listPeers();
+    }
+    /**
+     * Aggregated counts for the doctor surface — `{ active: N, suspended: M,
+     * evicted: K }`. Cheap O(peers) sweep; safe to call from a status line.
+     */
+    getPeerStateCounts() {
+        let active = 0;
+        let suspended = 0;
+        let evicted = 0;
+        for (const peer of this.discovery.listPeers()) {
+            switch (peer.state) {
+                case FederationNodeState.ACTIVE:
+                    active++;
+                    break;
+                case FederationNodeState.SUSPENDED:
+                    suspended++;
+                    break;
+                case FederationNodeState.EVICTED:
+                    evicted++;
+                    break;
+            }
+        }
+        return { active, suspended, evicted };
+    }
+    /**
+     * Operator-initiated evict. Returns true on transition, false if the
+     * peer was already EVICTED or unknown. Logs to audit either way.
+     *
+     * Does NOT remove the peer from the discovery registry — `leavePeer`
+     * is the registry-removal API. Eviction is the breaker layer; the peer
+     * remains queryable so the operator can later reactivate.
+     */
+    async evictPeer(nodeId, reason = 'MANUAL_EVICT', correlationId) {
+        this.ensureInitialized();
+        const peer = this.discovery.getPeer(nodeId);
+        if (!peer)
+            return false;
+        const ok = peer.evict({ reason, correlationId });
+        await this.audit.log('threat_blocked', {
+            targetNodeId: nodeId,
+            metadata: {
+                reason,
+                correlationId: correlationId ?? null,
+                state: peer.state,
+                applied: ok,
+            },
+        });
+        if (ok) {
+            const session = this.findSessionByNodeId(nodeId);
+            if (session) {
+                session.terminate();
+                this.sessions.delete(session.sessionId);
+            }
+            // ADR-111 Phase 3 — propagate eviction to the WG mesh. No-op if the
+            // peer never published a wg block; otherwise drops the peer from the
+            // mesh runtime (config rebuild will also exclude it).
+            await this.emitWgCommand(peer, (pubkey) => this.wgMesh.removePeer(peer, pubkey, reason));
+        }
+        return ok;
+    }
+    /**
+     * ADR-097 Phase 3 upstream: report the actual cost of a federated
+     * call. Federation doesn't own model pricing, so the integrator calls
+     * this after the downstream agent completes.
+     *
+     * Fans out to:
+     *   - spendReporter (if injected) — persists to integrator's backend
+     *   - breakerService.recordOutcome (if injected) — feeds the breaker's
+     *     in-memory rolling buffer for cost/failure-ratio thresholds
+     *
+     * Both are no-ops if the corresponding integration isn't wired, so
+     * callers don't need to branch on configuration. Negative tokens/usd
+     * are clamped to 0 at the breaker layer (anti-credit-inflation); the
+     * spend reporter receives the raw values so backends can audit them.
+     *
+     * Auto-fills `ts` if the caller omits it.
+     */
+    async reportSpend(input) {
+        const event = {
+            peerId: input.peerId,
+            taskId: input.taskId,
+            tokensUsed: input.tokensUsed,
+            usdSpent: input.usdSpent,
+            success: input.success,
+            ts: input.ts ?? new Date().toISOString(),
+        };
+        // Fan out in parallel — neither side blocks the other. Reporter
+        // failures bubble up (integrator's responsibility); breaker is
+        // sync-internally so its branch is fire-and-forget safe.
+        const tasks = [];
+        if (this.spendReporter) {
+            tasks.push(this.spendReporter.reportSpend(event));
+        }
+        if (this.breakerService) {
+            this.breakerService.recordOutcome({
+                nodeId: event.peerId,
+                success: event.success,
+                tokensUsed: event.tokensUsed,
+                usdSpent: event.usdSpent,
+                at: new Date(event.ts),
+            });
+        }
+        if (tasks.length > 0)
+            await Promise.all(tasks);
+    }
+    /**
+     * Founder-bootstrap trust elevation (ADR-164 §3.5.4 — operator escape hatch
+     * used in the autopilot Day-1 scenario where a freshly-joined BBS peer
+     * needs TRUSTED before organic minInteractions thresholds can accrue).
+     *
+     * Refuses if the target node is not a registered federation peer (returns
+     * null). On success, writes a `trust_level_changed` audit entry tagged
+     * `bootstrap_elevation` with the operator-supplied reason, and returns
+     * the audit entry so the CLI / caller can print it to stdout.
+     */
+    async bootstrapElevatePeer(nodeId, newLevel, reason) {
+        this.ensureInitialized();
+        const peer = this.discovery.getPeer(nodeId);
+        if (!peer)
+            return null;
+        const entry = this.trustEvaluator.bootstrapElevate(peer, newLevel, reason);
+        await this.audit.log('trust_level_changed', {
+            targetNodeId: nodeId,
+            trustLevel: newLevel,
+            metadata: {
+                tag: 'bootstrap_elevation',
+                previousLevel: entry.previousLevel,
+                newLevel: entry.newLevel,
+                reason: entry.reason,
+                operatorBypass: true,
+                timestamp: entry.timestamp,
+            },
+        });
+        return entry;
+    }
+    /**
+     * Operator-initiated reactivate. Used after an integrator-supplied
+     * health probe confirms a SUSPENDED peer is healthy, OR as an
+     * operator-override escape from EVICTED. Returns true on transition.
+     */
+    async reactivatePeer(nodeId, correlationId) {
+        this.ensureInitialized();
+        const peer = this.discovery.getPeer(nodeId);
+        if (!peer)
+            return false;
+        const ok = peer.reactivate(correlationId);
+        await this.audit.log('trust_level_changed', {
+            targetNodeId: nodeId,
+            metadata: {
+                action: 'reactivate',
+                correlationId: correlationId ?? null,
+                state: peer.state,
+                applied: ok,
+            },
+        });
+        if (ok) {
+            // ADR-111 Phase 3 — restore the WG AllowedIPs slice the peer had
+            // before suspension. removePeer-then-reactivate stays evicted at the
+            // mesh layer because removePeer marks the peer terminally evicted;
+            // the operator must reconfigure manually for an evicted peer to rejoin.
+            await this.emitWgCommand(peer, (pubkey, meshIP) => this.wgMesh.restoreAllowedIPs(peer, meshIP, pubkey));
+        }
+        return ok;
+    }
+    getSession(sessionId) {
+        return this.sessions.get(sessionId);
+    }
+    getActiveSessions() {
+        return Array.from(this.sessions.values()).filter(s => s.active && !s.isExpired());
+    }
+    async establishSession(node, verifiedManifest) {
+        const session = this.handshake.establishDiscoverySession(node, verifiedManifest);
+        this.sessions.set(session.sessionId, session);
+        await this.audit.log('handshake_completed', {
+            targetNodeId: node.nodeId,
+            sessionId: session.sessionId,
+            trustLevel: session.trustLevel,
+            metadata: {
+                mode: verifiedManifest ? 'verified-manifest' : 'endpoint-only',
+                liveChallengeAuthenticated: false,
+            },
+        });
+        await this.audit.log('session_created', {
+            sessionId: session.sessionId,
+            targetNodeId: node.nodeId,
+            trustLevel: session.trustLevel,
+        });
+        return session;
+    }
+    findSessionByNodeId(nodeId) {
+        for (const session of this.sessions.values()) {
+            if (session.remoteNodeId === nodeId && session.active) {
+                return session;
+            }
+        }
+        return undefined;
+    }
+    ensureInitialized() {
+        if (!this.initialized) {
+            throw new Error('FederationCoordinator is not initialized. Call initialize() first.');
+        }
+    }
+}
+//# sourceMappingURL=federation-coordinator.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-coordinator.js","sourceRoot":"","sources":["../../src/application/federation-coordinator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EACL,mBAAmB,GAEpB,MAAM,kDAAkD,CAAC;AAQ1D,OAAO,EAGL,aAAa,EACb,cAAc,GACf,MAAM,8CAA8C,CAAC;AA2EtD,MAAM,OAAO,qBAAqB;IACf,MAAM,CAA8B;IACpC,SAAS,CAAmB;IAC5B,SAAS,CAAmB;IAC5B,OAAO,CAAiB;IACxB,KAAK,CAAe;IACpB,WAAW,CAAqB;IAChC,cAAc,CAAiB;IAC/B,YAAY,CAAe;IAC3B,QAAQ,CAAiC;IAClD,WAAW,CAAU;IACZ,aAAa,CAAiB;IAC9B,cAAc,CAA4B;IAC1C,MAAM,CAAiB;IACvB,aAAa,CAA4C;IAE1E,YACE,MAAmC,EACnC,SAA2B,EAC3B,SAA2B,EAC3B,OAAuB,EACvB,KAAmB,EACnB,WAA+B,EAC/B,cAA8B,EAC9B,YAA0B,EAC1B,eAAkD,EAAE;QAEpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;QAChD,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CACzB,IAAoB,EACpB,OAA6D;QAE7D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAiC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAA8B,CAAC;QAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EAAE;YAC9C,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,QAAQ,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,GAAG;gBAClB,MAAM,EAAE,GAAG,CAAC,IAAI;gBAChB,WAAW,EAAE,GAAG,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAA+C;QAC9D,mEAAmE;QACnE,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;YACnC,GAAG,QAAQ;YACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,YAAY,EAAE;gBACZ,GAAG,QAAQ,CAAC,YAAY;gBACxB,kBAAkB,EAChB,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,QAAQ,CAAC,YAAY,CAAC,kBAAkB;aAC7E;YACD,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EAAE;YAC9C,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAEvC,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjD,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBACzC,SAAS;gBACT,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,QAA6B;QAE7B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEpE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE;YACtC,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,QAAQ,EAAE,EAAE,QAAQ,EAAE;SACvB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAExC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBACzC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CACf,YAAoB,EACpB,WAAkC,EAClC,OAAU,EACV,UAAuB,EAAE;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,8BAA8B;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAClE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY;gBACZ,QAAQ,EAAE,EAAE,MAAM,EAAE;aACrB,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,MAAM;aACd,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,+BAA+B,YAAY,EAAE;aACrD,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,CACpD,WAAW,EACX,OAAO,CAAC,UAAU,EAClB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CACnB,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,YAAY,CAAC,MAAM;aAC3B,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE;aACnE,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,gBAAgB;aACxB,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAsB,aAAa,CAClD,YAAY,CAAC,MAAM,EACnB,OAAO,CAAC,QAAQ,IAAI,CAAC,EACrB;YACE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;YAClC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC;SAC7B,CACF,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,mCAAmC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,EAAE;YACzE,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE;gBACR,WAAW;gBACX,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,WAAW,CAAC,YAAY;aACnC;SACF,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAU,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAE9E,KAAK,CAAC,gBAAgB,CACpB,WAAkC,EAClC,OAAU;QAEV,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,qBAAqB,CAAC,MAAc;QAClC,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE5C,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBAC/B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,cAAc,EAAE,IAAI;gBACpB,QAAQ,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBAC/B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,QAAQ,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,WAAW,GAA+B,EAAE,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAC/E,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,IAAI,CAAC,WAAW;SACpB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9C,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,KAAK,mBAAmB,CAAC,MAAM;oBAAE,MAAM,EAAE,CAAC;oBAAC,MAAM;gBACjD,KAAK,mBAAmB,CAAC,SAAS;oBAAE,SAAS,EAAE,CAAC;oBAAC,MAAM;gBACvD,KAAK,mBAAmB,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;oBAAC,MAAM;YACrD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,MAAc,EACd,SAA2B,cAAc,EACzC,aAAsB;QAEtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YACrC,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE;gBACR,MAAM;gBACN,aAAa,EAAE,aAAa,IAAI,IAAI;gBACpC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,EAAE;aACZ;SACF,CAAC,CAAC;QACH,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;YACD,oEAAoE;YACpE,qEAAqE;YACrE,sDAAsD;YACtD,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACxC,IAAI,CAAC,MAAO,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAC9C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CAAC,KAOjB;QACC,MAAM,KAAK,GAAyB;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACzC,CAAC;QAEF,gEAAgE;QAChE,+DAA+D;QAC/D,yDAAyD;QACzD,MAAM,KAAK,GAAoB,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;gBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,QAAoB,EACpB,MAAc;QAEd,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE;YAC1C,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE;gBACR,GAAG,EAAE,qBAAqB;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,aAAsB;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE;YAC1C,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE;gBACR,MAAM,EAAE,YAAY;gBACpB,aAAa,EAAE,aAAa,IAAI,IAAI;gBACpC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,EAAE;aACZ;SACF,CAAC,CAAC;QACH,IAAI,EAAE,EAAE,CAAC;YACP,iEAAiE;YACjE,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAChD,IAAI,CAAC,MAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,iBAAiB;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,IAAoB,EACpB,gBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE;YAC1C,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE;gBACR,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe;gBAC9D,0BAA0B,EAAE,KAAK;aAClC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,mBAAmB,CAAC,MAAc;QACxC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Inbound message dispatcher (ADR-109).
+ *
+ * The federation plugin's `transport.listen()` accepts inbound bytes
+ * but until this module landed, the bytes had no consumer — they sat
+ * in the transport's per-address message queue with no one polling.
+ *
+ * `dispatchInbound()` is what the plugin registers as the
+ * transport.onMessage handler. For each received message it:
+ *
+ *   1. Resolves the sender via `sourceNodeId` in metadata
+ *   2. Verifies the peer is in the discovery registry (unknown → reject)
+ *   3. Verifies peer is ACTIVE (SUSPENDED/EVICTED → reject defense-in-depth)
+ *   4. Audits success or rejection
+ *   5. Emits a typed event on the eventBus for the integrator to handle
+ *
+ * Anti-coupling: dispatcher does NOT actually execute inbound tasks.
+ * That's the integrator's job. The dispatcher's contract is "deliver
+ * an envelope to the integrator's handler IFF it passes safety gates."
+ */
+import type { AgentMessage } from '../transport/midstream-aware-loader.js';
+import type { DiscoveryService } from '../domain/services/discovery-service.js';
+import type { AuditService } from '../domain/services/audit-service.js';
+import type { FederationNode } from '../domain/entities/federation-node.js';
+/** What gets emitted on the event bus per messageType. */
+export declare const FEDERATION_INBOUND_EVENT_PREFIX = "federation:inbound";
+/** Reasons we reject an inbound message — constant strings, no oracle leak. */
+export type InboundRejectionReason = 'PEER_UNKNOWN' | 'PEER_SUSPENDED' | 'PEER_EVICTED' | 'MISSING_METADATA' | 'INVALID_PAYLOAD' | 'INVALID_SIGNATURE' | 'LEGACY_SIGNATURE_TYPE_REJECTED' | 'AUTHORIZATION_DENIED' | 'AUTHORIZATION_ERROR';
+/**
+ * Verifier function for inbound envelopes. Given the canonical bytes of
+ * the message + the claimed signature + the peer's published public
+ * key, returns true iff the signature is valid. Plugin wires this with
+ * `@noble/ed25519`; tests inject a mock.
+ *
+ * Returning `null` means "no signature provided" — handled by the
+ * dispatcher as INVALID_SIGNATURE (defense: unsigned messages from
+ * known peers are still rejected).
+ */
+export type EnvelopeVerifier = (canonicalBytes: string, signatureHex: string | null, peerPublicKeyHex: string) => boolean;
+export declare const JCS_SIGNATURE_PROTOCOL: "ruflo-signature-jcs-v1";
+export type EnvelopeSignatureVersion = 'legacy-v1' | 'jcs-v1';
+export type EnvelopeSignatureMode = 'legacy' | 'prefer-jcs' | 'require-jcs';
+/**
+ * Updated peers advertise and negotiate recursively complete JCS signatures
+ * without operator configuration. Legacy mode remains explicit for low-risk
+ * heartbeat/status interoperability only.
+ */
+export declare const DEFAULT_ENVELOPE_SIGNATURE_MODE: EnvelopeSignatureMode;
+export type InboundAuthorizationMode = 'legacy' | 'observe' | 'enforce';
+export declare function isLegacyEnvelopeTypeAllowed(messageType: string): boolean;
+export interface InboundAuthorizationRequest {
+    readonly address: string;
+    readonly sourceNodeId: string;
+    readonly messageType: string;
+    readonly message: AgentMessage;
+    readonly peer: FederationNode;
+    readonly signatureVersion: EnvelopeSignatureVersion;
+    readonly messageSizeBytes: number;
+}
+export interface InboundAuthorizationDecision {
+    readonly allowed: boolean;
+    readonly reason?: string;
+}
+export type InboundAuthorizationEvaluator = (request: InboundAuthorizationRequest) => InboundAuthorizationDecision | Promise<InboundAuthorizationDecision>;
+/** Dispatch dependencies (kept narrow for testability). */
+export interface InboundDispatchDeps {
+    readonly discovery: Pick<DiscoveryService, 'getPeer'>;
+    readonly audit: Pick<AuditService, 'log'>;
+    readonly eventBus: {
+        emit: (event: string, data: unknown) => void;
+    };
+    readonly logger: {
+        debug: (m: string) => void;
+        warn: (m: string) => void;
+    };
+    /**
+     * Optional Ed25519 envelope verifier. When PROVIDED, every accepted
+     * message MUST pass verification — `null` signature or false-returning
+     * verifier rejects the message as INVALID_SIGNATURE.
+     *
+     * When OMITTED, the dispatcher operates in legacy "trust the metadata"
+     * mode (backward compat for tests that inject minimal deps). Production
+     * MUST inject this — see the plugin.ts wiring.
+    */
+    readonly verifyEnvelope?: EnvelopeVerifier;
+    /** Defaults to both versions; enforce-only deployments pass `['jcs-v1']`. */
+    readonly acceptedSignatureVersions?: readonly EnvelopeSignatureVersion[];
+    /** Compatibility mode defaults to legacy; enforce is fail-closed. */
+    readonly authorizationMode?: InboundAuthorizationMode;
+    /** Injected policy decision point. It is always called before event emission. */
+    readonly authorizeInbound?: InboundAuthorizationEvaluator;
+}
+export declare function selectEnvelopeSignatureVersion(mode: EnvelopeSignatureMode, peerProtocols: readonly string[], messageType?: string): EnvelopeSignatureVersion;
+export declare function canonicalizeEnvelopeForVerify(message: AgentMessage, requestedVersion?: EnvelopeSignatureVersion): string;
+/** Outcome reported to the caller (mostly for tests + observability). */
+export type InboundDispatchOutcome = {
+    readonly accepted: true;
+    readonly sourceNodeId: string;
+    readonly messageType: string;
+} | {
+    readonly accepted: false;
+    readonly reason: InboundRejectionReason;
+};
+/**
+ * Process one received message. Pure-ish: no side effects beyond audit
+ * + event emission, both injected.
+ *
+ * `address` is the wire-level remote (e.g. `192.168.1.42:54321`).
+ * `message.metadata.sourceNodeId` is the cryptographic identity claim.
+ * The two MAY differ (e.g. behind NAT) — we trust `sourceNodeId` for
+ * peer lookup since it's bound to the Ed25519 keypair.
+ */
+export declare function dispatchInbound(address: string, message: AgentMessage, deps: InboundDispatchDeps): Promise<InboundDispatchOutcome>;
+//# sourceMappingURL=inbound-dispatcher.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/application/inbound-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-dispatcher.d.ts","sourceRoot":"","sources":["../../src/application/inbound-dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAG5E,0DAA0D;AAC1D,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAEpE,+EAA+E;AAC/E,MAAM,MAAM,sBAAsB,GAC9B,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,GACjB,mBAAmB,GACnB,gCAAgC,GAChC,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,gBAAgB,EAAE,MAAM,KACrB,OAAO,CAAC;AAEb,eAAO,MAAM,sBAAsB,EAAG,wBAAiC,CAAC;AACxE,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAC9D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;AAC5E;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAE,qBAAoC,CAAC;AACnF,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAYxE,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,6BAA6B,GAAG,CAC1C,OAAO,EAAE,2BAA2B,KACjC,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAE1E,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,MAAM,EAAE;QACf,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;KAC3B,CAAC;IACF;;;;;;;;MAQE;IACF,QAAQ,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAC3C,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACzE,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;CAC3D;AAiFD,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,qBAAqB,EAC3B,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,WAAW,CAAC,EAAE,MAAM,GACnB,wBAAwB,CAmB1B;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,YAAY,EACrB,gBAAgB,CAAC,EAAE,wBAAwB,GAC1C,MAAM,CAkBR;AAED,yEAAyE;AACzE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAE1E;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAmNjC"}