@claude-flow/cli 3.32.26 → 3.32.30

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.js

@@ -0,0 +1,100 @@
+/**
+ * Federation peer state machine (ADR-097 Phase 2).
+ *
+ * Phase 1 shipped the budget envelope + enforcer that travels with every
+ * outbound message. Phase 2 adds the per-peer breaker: when a peer crosses a
+ * cost or failure threshold, transition it to SUSPENDED so subsequent
+ * `federation_send` calls short-circuit. After a cooldown the peer can
+ * recover; if it stays bad the breaker escalates to EVICTED.
+ *
+ * This module is the *value object* layer — pure, no I/O. The breaker
+ * service (Phase 2.b, separate file) reads cost-tracker telemetry, evaluates
+ * thresholds, and calls `transition` on the FederationNode entity. Decoupling
+ * the state machine from the policy lets tests pin transitions without
+ * standing up the cost bus.
+ *
+ * Security invariants pinned by the spec:
+ *
+ *   1. EVICTED is terminal under normal flow. The only way out is an
+ *      explicit `reactivate` call (operator-initiated). This prevents a
+ *      misbehaving peer from auto-recovering through the cooldown.
+ *   2. canTransition is the single source of truth for legality. Any path
+ *      that mutates state MUST consult it; direct field writes are not
+ *      permitted (entity getter/setter shape enforces this).
+ *   3. Reasons are constant strings, no remaining-budget echo on failure
+ *      (matches Phase 1's anti-oracle posture).
+ *   4. Default cooldown is conservative (30 min) so a transient spike
+ *      cannot ping-pong a peer ACTIVE↔SUSPENDED at high frequency.
+ */
+/** Lifecycle state of a federation peer. */
+export var FederationNodeState;
+(function (FederationNodeState) {
+    /** Default; healthy. `federation_send` accepts deliveries. */
+    FederationNodeState["ACTIVE"] = "ACTIVE";
+    /** Breaker tripped. Sends short-circuit with PEER_SUSPENDED. */
+    FederationNodeState["SUSPENDED"] = "SUSPENDED";
+    /** Removed from active rotation. Sends short-circuit with PEER_EVICTED. */
+    FederationNodeState["EVICTED"] = "EVICTED";
+})(FederationNodeState || (FederationNodeState = {}));
+/**
+ * Default cooldown a SUSPENDED peer must wait before being eligible for
+ * SUSPENDED → ACTIVE. 30 minutes matches the ADR-097 Part 2 spec and is
+ * intentionally well past the prompt-cache window so a recovery probe is
+ * cheap to amortize.
+ */
+export const DEFAULT_SUSPENSION_COOLDOWN_MS = 30 * 60 * 1000;
+/**
+ * Default age at which a continuously-SUSPENDED peer is auto-escalated to
+ * EVICTED. 24 hours per spec — long enough to ride out a cost-tracker
+ * outage without false eviction, short enough that a genuinely-broken peer
+ * doesn't linger forever.
+ */
+export const DEFAULT_AUTO_EVICTION_AGE_MS = 24 * 60 * 60 * 1000;
+/**
+ * Static legality table for state transitions. Returns true iff the
+ * `from -> to` edge is in the allowed set. Used by the entity to reject
+ * illegal mutations before applying them.
+ *
+ * Allowed edges:
+ *   ACTIVE    → SUSPENDED  (breaker trips)
+ *   SUSPENDED → ACTIVE     (cooldown + probe success)
+ *   SUSPENDED → EVICTED    (grace expired, or manual evict)
+ *   ACTIVE    → EVICTED    (manual evict only — skips suspend)
+ *   EVICTED   → ACTIVE     (manual reactivate only)
+ *
+ * Disallowed (anything else, including self-loops, is a no-op error).
+ */
+export function canTransition(from, to) {
+    if (from === to)
+        return false;
+    if (from === FederationNodeState.ACTIVE) {
+        return to === FederationNodeState.SUSPENDED || to === FederationNodeState.EVICTED;
+    }
+    if (from === FederationNodeState.SUSPENDED) {
+        return to === FederationNodeState.ACTIVE || to === FederationNodeState.EVICTED;
+    }
+    // EVICTED is terminal except for explicit operator reactivate.
+    return to === FederationNodeState.ACTIVE;
+}
+/**
+ * Should a SUSPENDED peer be eligible for SUSPENDED → ACTIVE based purely
+ * on elapsed time? The breaker still has to confirm health via probe before
+ * it actually calls reactivate; this just answers "is the cooldown done?"
+ *
+ * Pure function of (suspendedAt, now, cooldownMs) so it's trivially
+ * deterministic in tests.
+ */
+export function isCooldownElapsed(suspendedAt, now, cooldownMs = DEFAULT_SUSPENSION_COOLDOWN_MS) {
+    return now.getTime() - suspendedAt.getTime() >= cooldownMs;
+}
+/**
+ * Should a SUSPENDED peer be auto-escalated to EVICTED based on the age of
+ * its suspension? Returns true once the peer has been continuously
+ * SUSPENDED past the configured limit (default 24h). The breaker calls
+ * this on each tick and, if true, issues the SUSPENDED → EVICTED
+ * transition with reason GRACE_PERIOD_EXPIRED.
+ */
+export function shouldAutoEvict(suspendedAt, now, ageLimitMs = DEFAULT_AUTO_EVICTION_AGE_MS) {
+    return now.getTime() - suspendedAt.getTime() >= ageLimitMs;
+}
+//# sourceMappingURL=federation-node-state.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-node-state.js","sourceRoot":"","sources":["../../../src/domain/value-objects/federation-node-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,4CAA4C;AAC5C,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,8DAA8D;IAC9D,wCAAiB,CAAA;IACjB,gEAAgE;IAChE,8CAAuB,CAAA;IACvB,2EAA2E;IAC3E,0CAAmB,CAAA;AACrB,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAUD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAShE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAyB,EACzB,EAAuB;IAEvB,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,mBAAmB,CAAC,SAAS,IAAI,EAAE,KAAK,mBAAmB,CAAC,OAAO,CAAC;IACpF,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,mBAAmB,CAAC,MAAM,IAAI,EAAE,KAAK,mBAAmB,CAAC,OAAO,CAAC;IACjF,CAAC;IACD,+DAA+D;IAC/D,OAAO,EAAE,KAAK,mBAAmB,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAiB,EACjB,GAAS,EACT,aAAqB,8BAA8B;IAEnD,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,WAAiB,EACjB,GAAS,EACT,aAAqB,4BAA4B;IAEjD,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC;AAC7D,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.d.ts

@@ -0,0 +1,70 @@
+/**
+ * ADR-111 Phase 1 — WireGuard configuration value objects.
+ *
+ * Pure types + deterministic helpers. No I/O, no shell calls. Used by
+ * WgMeshService (Phase 2) and surfaced in FederationManifest (Phase 1) so
+ * peers can publish their WG identity inside the same Ed25519-signed
+ * manifest that already carries their federation identity.
+ */
+/**
+ * The WG section of a FederationManifest. Optional — present only when
+ * the local node has opted in via `config.wgMesh: true`.
+ *
+ * - publicKey is the X25519 public key in base64 (32-byte raw → 44 chars
+ *   including '=' padding), exactly the format `wg-quick`/`wg setconf`
+ *   accept. Never include the private key in the manifest.
+ * - endpoint is `host:port` reachable on UDP. May be a hostname (resolved
+ *   by the consumer) or an IPv4/v6 literal. The port is WireGuard's, not
+ *   federation's WS port — usually 51820.
+ * - meshIP is the assigned /32 inside the federation mesh subnet
+ *   (10.50.0.0/16 by default). Stored as `a.b.c.d/32`.
+ */
+export interface WgManifestSection {
+    readonly publicKey: string;
+    readonly endpoint: string;
+    readonly meshIP: string;
+}
+/**
+ * A locally-generated WG keypair. Kept entirely off the wire — `publicKey`
+ * is what gets published in the manifest; `privateKey` stays on disk
+ * (mode 0600) and in this in-memory object.
+ */
+export interface WgLocalKey {
+    readonly publicKey: string;
+    readonly privateKey: string;
+    readonly createdAt: string;
+}
+/**
+ * Default federation mesh subnet. RFC1918 private space outside the
+ * common LAN/k8s ranges and Tailscale's 100.64.0.0/10. Documented in
+ * the ADR. Birthday-collision probability stays under 1% up to ~36
+ * peers and under 50% at ~302 peers — within the v1 ≤50-peer target.
+ */
+export declare const DEFAULT_MESH_SUBNET = "10.50.0.0/16";
+/**
+ * Generate an X25519 keypair in the format WireGuard accepts.
+ *
+ * WireGuard keys are 32 raw bytes encoded base64 (44 chars with '='
+ * padding). Node's `generateKeyPairSync('x25519')` returns PKCS8/SPKI
+ * DER envelopes — we extract the trailing 32 bytes which are the raw
+ * key material (the DER prefix is constant for X25519).
+ *
+ * No new dependencies: Node 18+ has X25519 support in core crypto.
+ */
+export declare function generateWgKeyPair(): WgLocalKey;
+/**
+ * Derive a deterministic mesh IP for `nodeId` inside `subnet`.
+ *
+ * Strategy: sha256(nodeId) → top bytes interpreted as host portion of the
+ * subnet, clamped to avoid the network address (.0) and broadcast (.255)
+ * of any /24 inside the subnet. This is collision-resistant in the
+ * birthday-paradox sense — see ADR for thresholds.
+ *
+ * `usedIPs` (when provided) gives previously-assigned IPs in the mesh.
+ * If the derived IP is already taken, the function probes `nodeId + '\x00'`,
+ * `nodeId + '\x01'`, … until a free slot is found. Bounded to 1024 probes;
+ * exceeding that means the subnet is functionally exhausted and the caller
+ * should jump to a larger range (see ADR `10.50.0.0/12` recommendation).
+ */
+export declare function deriveMeshIP(nodeId: string, subnet?: string, usedIPs?: ReadonlySet<string>): string;
+//# sourceMappingURL=wg-config.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wg-config.d.ts","sourceRoot":"","sources":["../../../src/domain/value-objects/wg-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAgB9C;AAuBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAA4B,EACpC,OAAO,GAAE,WAAW,CAAC,MAAM,CAAa,GACvC,MAAM,CAsBR"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.js

@@ -0,0 +1,104 @@
+/**
+ * ADR-111 Phase 1 — WireGuard configuration value objects.
+ *
+ * Pure types + deterministic helpers. No I/O, no shell calls. Used by
+ * WgMeshService (Phase 2) and surfaced in FederationManifest (Phase 1) so
+ * peers can publish their WG identity inside the same Ed25519-signed
+ * manifest that already carries their federation identity.
+ */
+import { createHash, generateKeyPairSync } from 'node:crypto';
+/**
+ * Default federation mesh subnet. RFC1918 private space outside the
+ * common LAN/k8s ranges and Tailscale's 100.64.0.0/10. Documented in
+ * the ADR. Birthday-collision probability stays under 1% up to ~36
+ * peers and under 50% at ~302 peers — within the v1 ≤50-peer target.
+ */
+export const DEFAULT_MESH_SUBNET = '10.50.0.0/16';
+/**
+ * Generate an X25519 keypair in the format WireGuard accepts.
+ *
+ * WireGuard keys are 32 raw bytes encoded base64 (44 chars with '='
+ * padding). Node's `generateKeyPairSync('x25519')` returns PKCS8/SPKI
+ * DER envelopes — we extract the trailing 32 bytes which are the raw
+ * key material (the DER prefix is constant for X25519).
+ *
+ * No new dependencies: Node 18+ has X25519 support in core crypto.
+ */
+export function generateWgKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync('x25519');
+    const privDer = privateKey.export({ format: 'der', type: 'pkcs8' });
+    const pubDer = publicKey.export({ format: 'der', type: 'spki' });
+    // The PKCS8 prefix for X25519 is 16 bytes, leaving 32 raw bytes.
+    // The SPKI prefix for X25519 is 12 bytes, leaving 32 raw bytes.
+    const privRaw = privDer.subarray(privDer.length - 32);
+    const pubRaw = pubDer.subarray(pubDer.length - 32);
+    if (privRaw.length !== 32 || pubRaw.length !== 32) {
+        throw new Error(`generateWgKeyPair: unexpected DER layout (priv=${privRaw.length}B pub=${pubRaw.length}B)`);
+    }
+    return {
+        publicKey: pubRaw.toString('base64'),
+        privateKey: privRaw.toString('base64'),
+        createdAt: new Date().toISOString(),
+    };
+}
+/**
+ * Parse a `a.b.c.d/M` CIDR into a numeric base + mask-prefix-length.
+ * Limited to IPv4 — v1 of ADR-111 is IPv4-only inside the mesh.
+ */
+function parseCidr(cidr) {
+    const m = cidr.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/);
+    if (!m)
+        throw new Error(`invalid CIDR: ${cidr}`);
+    const [, a, b, c, d, p] = m;
+    const octets = [a, b, c, d].map(Number);
+    const prefix = Number(p);
+    if (octets.some(o => o < 0 || o > 255) || prefix < 0 || prefix > 32) {
+        throw new Error(`out-of-range CIDR: ${cidr}`);
+    }
+    const base = ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
+    return { base, prefix };
+}
+function ipToString(n) {
+    return `${(n >>> 24) & 0xff}.${(n >>> 16) & 0xff}.${(n >>> 8) & 0xff}.${n & 0xff}`;
+}
+/**
+ * Derive a deterministic mesh IP for `nodeId` inside `subnet`.
+ *
+ * Strategy: sha256(nodeId) → top bytes interpreted as host portion of the
+ * subnet, clamped to avoid the network address (.0) and broadcast (.255)
+ * of any /24 inside the subnet. This is collision-resistant in the
+ * birthday-paradox sense — see ADR for thresholds.
+ *
+ * `usedIPs` (when provided) gives previously-assigned IPs in the mesh.
+ * If the derived IP is already taken, the function probes `nodeId + '\x00'`,
+ * `nodeId + '\x01'`, … until a free slot is found. Bounded to 1024 probes;
+ * exceeding that means the subnet is functionally exhausted and the caller
+ * should jump to a larger range (see ADR `10.50.0.0/12` recommendation).
+ */
+export function deriveMeshIP(nodeId, subnet = DEFAULT_MESH_SUBNET, usedIPs = new Set()) {
+    const { base, prefix } = parseCidr(subnet);
+    if (prefix > 30)
+        throw new Error(`subnet ${subnet} too small for mesh IPs`);
+    const hostBits = 32 - prefix;
+    const hostMask = hostBits >= 32 ? 0xffffffff : ((1 << hostBits) - 1) >>> 0;
+    const networkBase = (base & ~hostMask) >>> 0;
+    for (let probe = 0; probe < 1024; probe++) {
+        const input = probe === 0 ? nodeId : `${nodeId}\x00${probe}`;
+        const hash = createHash('sha256').update(input).digest();
+        // Use the first 4 bytes as the host portion.
+        const hashHost = ((hash[0] << 24) | (hash[1] << 16) | (hash[2] << 8) | hash[3]) >>> 0;
+        let candidate = (networkBase | (hashHost & hostMask)) >>> 0;
+        const lastOctet = candidate & 0xff;
+        // Avoid .0 (network) and .255 (broadcast) of each /24 slice. Cheap
+        // clamp: bump to .1 if landing on .0, or .254 if landing on .255.
+        if (lastOctet === 0)
+            candidate = (candidate | 1) >>> 0;
+        else if (lastOctet === 255)
+            candidate = (candidate & ~1) >>> 0;
+        const ip = `${ipToString(candidate)}/32`;
+        if (!usedIPs.has(ip))
+            return ip;
+    }
+    throw new Error(`deriveMeshIP: subnet ${subnet} exhausted after 1024 probes for ${nodeId}; jump to a wider range`);
+}
+//# sourceMappingURL=wg-config.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/wg-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wg-config.js","sourceRoot":"","sources":["../../../src/domain/value-objects/wg-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgC9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,iEAAiE;IACjE,gEAAgE;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,kDAAkD,OAAO,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,SAAiB,mBAAmB,EACpC,UAA+B,IAAI,GAAG,EAAE;IAExC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,yBAAyB,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC;IAC7B,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,KAAK,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACzD,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtF,IAAI,SAAS,GAAG,CAAC,WAAW,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;QACnC,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,SAAS,KAAK,CAAC;YAAE,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;aAClD,IAAI,SAAS,KAAK,GAAG;YAAE,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,oCAAoC,MAAM,yBAAyB,CAAC,CAAC;AACrH,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/index.d.ts

@@ -0,0 +1,23 @@
+export { AgentFederationPlugin } from './plugin.js';
+export { FederationNode, type FederationNodeProps, type FederationNodeCapabilities, type FederationNodeMetadata, type FederationNodeStateRecord } from './domain/entities/federation-node.js';
+export { FederationNodeState, type SuspensionReason, type TransitionReason, canTransition, isCooldownElapsed, shouldAutoEvict, DEFAULT_SUSPENSION_COOLDOWN_MS, DEFAULT_AUTO_EVICTION_AGE_MS, } from './domain/value-objects/federation-node-state.js';
+export { FederationBreakerService, evaluatePolicy, DEFAULT_BREAKER_POLICY, DEFAULT_MAX_SAMPLES_PER_PEER, type BreakerPolicy, type BreakerDecision, type SendOutcome, } from './application/federation-breaker-service.js';
+export { InMemorySpendReporter, MemorySpendReporter, DEFAULT_FEDERATION_SPEND_NAMESPACE, DEFAULT_FEDERATION_SPEND_TTL_SECONDS, type SpendReporter, type MemoryStore, type MemorySpendReporterConfig, type FederationSpendEvent, } from './application/spend-reporter.js';
+export { FederationSession, type FederationSessionProps, type SessionMetrics } from './domain/entities/federation-session.js';
+export { FederationEnvelope, type FederationEnvelopeProps, type FederationMessageType, type PIIScanResult, type PIIScanDetection, type PIIScanAction, CONSENSUS_REQUIRED_TYPES, } from './domain/entities/federation-envelope.js';
+export { TrustLevel, TRUST_TRANSITION_THRESHOLDS, CAPABILITY_GATES, isOperationAllowed, getTrustLevelLabel, type TrustTransitionThreshold, } from './domain/entities/trust-level.js';
+export { PIIPipelineService, type PIIType, type PIIAction, type PIIDetection, type PIIPolicyConfig, type PIICalibration, type PIITransformResult, type PIIConfidenceThresholds, type PIIPipelineServiceDeps, } from './domain/services/pii-pipeline-service.js';
+export { DiscoveryService, type DiscoveryMechanism, type FederationManifest, type DiscoveryServiceDeps, type DiscoveryConfig, } from './domain/services/discovery-service.js';
+export { HandshakeService, type HandshakeChallenge, type HandshakeChallengeResponse, type HandshakeResult, type HandshakeServiceDeps, type HandshakeConfig, } from './domain/services/handshake-service.js';
+export { RoutingService, type RoutingMode, type RoutingResult, type ConsensusProposal, type RoutingServiceDeps, } from './domain/services/routing-service.js';
+export { AuditService, type FederationAuditEvent, type FederationAuditEventType, type AuditSeverity, type AuditCategory, type ComplianceMode, type AuditQuery, type AuditExportFormat, type AuditServiceDeps, type AuditServiceConfig, } from './domain/services/audit-service.js';
+export { TrustEvaluator, type TrustScoreComponents, type TrustTransitionResult, type ImmediateDowngradeReason, type TrustEvaluatorDeps, } from './application/trust-evaluator.js';
+export { FederationCoordinator, type FederationCoordinatorConfig, type FederationStatus, } from './application/federation-coordinator.js';
+export { PolicyEngine, type FederationClaimType, type SecurityPolicy, type PolicyEvaluationResult, type PolicyEngineDeps, } from './application/policy-engine.js';
+export { createFederationClaimChecker, type FederationAuthorizationMode, type FederationClaimChecker, type FederationClaimCheckerConfig, } from './application/claim-checker.js';
+export { DEFAULT_ENVELOPE_SIGNATURE_MODE, JCS_SIGNATURE_PROTOCOL, canonicalizeEnvelopeForVerify, isLegacyEnvelopeTypeAllowed, selectEnvelopeSignatureVersion, type EnvelopeSignatureMode, type EnvelopeSignatureVersion, } from './application/inbound-dispatcher.js';
+export { FEDERATION_PLUGIN_VERSION } from './version.js';
+export { A2A_PROTOCOL_VERSION, A2A_WELL_KNOWN_PATH, RUFLO_FEDERATION_BINDING, RUFLO_FEDERATION_EXTENSION_URI, toAgentCard, fromAgentCard, validateAgentCard, type A2AAgentCard, type A2AAgentInterface, type A2AAgentSkill, type A2AAgentCapabilities, type A2AAgentExtension, type A2AAgentProvider, type ToAgentCardOptions, type AgentCardValidation, } from './a2a/agent-card.js';
+export { startAgentCardServer, isLoopbackHost, type AgentCardServerOptions, type AgentCardServerHandle, } from './a2a/well-known.js';
+export { fetchAgentCard, consumeAgentCard, resolveAgentCardUrl, type FetchAgentCardOptions, type FetchAgentCardResult, } from './a2a/consume.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,KAAK,sBAAsB,EAAE,KAAK,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAC9L,OAAO,EACL,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,kCAAkC,EAClC,oCAAoC,EACpC,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAC9H,OAAO,EACL,kBAAkB,EAClB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,UAAU,EACV,2BAA2B,EAC3B,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,wBAAwB,GAC9B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,GACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,4BAA4B,EAC5B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,GAClC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,EAC9B,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/index.js

@@ -0,0 +1,24 @@
+export { AgentFederationPlugin } from './plugin.js';
+export { FederationNode } from './domain/entities/federation-node.js';
+export { FederationNodeState, canTransition, isCooldownElapsed, shouldAutoEvict, DEFAULT_SUSPENSION_COOLDOWN_MS, DEFAULT_AUTO_EVICTION_AGE_MS, } from './domain/value-objects/federation-node-state.js';
+export { FederationBreakerService, evaluatePolicy, DEFAULT_BREAKER_POLICY, DEFAULT_MAX_SAMPLES_PER_PEER, } from './application/federation-breaker-service.js';
+export { InMemorySpendReporter, MemorySpendReporter, DEFAULT_FEDERATION_SPEND_NAMESPACE, DEFAULT_FEDERATION_SPEND_TTL_SECONDS, } from './application/spend-reporter.js';
+export { FederationSession } from './domain/entities/federation-session.js';
+export { FederationEnvelope, CONSENSUS_REQUIRED_TYPES, } from './domain/entities/federation-envelope.js';
+export { TrustLevel, TRUST_TRANSITION_THRESHOLDS, CAPABILITY_GATES, isOperationAllowed, getTrustLevelLabel, } from './domain/entities/trust-level.js';
+export { PIIPipelineService, } from './domain/services/pii-pipeline-service.js';
+export { DiscoveryService, } from './domain/services/discovery-service.js';
+export { HandshakeService, } from './domain/services/handshake-service.js';
+export { RoutingService, } from './domain/services/routing-service.js';
+export { AuditService, } from './domain/services/audit-service.js';
+export { TrustEvaluator, } from './application/trust-evaluator.js';
+export { FederationCoordinator, } from './application/federation-coordinator.js';
+export { PolicyEngine, } from './application/policy-engine.js';
+export { createFederationClaimChecker, } from './application/claim-checker.js';
+export { DEFAULT_ENVELOPE_SIGNATURE_MODE, JCS_SIGNATURE_PROTOCOL, canonicalizeEnvelopeForVerify, isLegacyEnvelopeTypeAllowed, selectEnvelopeSignatureVersion, } from './application/inbound-dispatcher.js';
+export { FEDERATION_PLUGIN_VERSION } from './version.js';
+// A2A (Agent2Agent, Linux Foundation) Agent Card adapter — cards only.
+export { A2A_PROTOCOL_VERSION, A2A_WELL_KNOWN_PATH, RUFLO_FEDERATION_BINDING, RUFLO_FEDERATION_EXTENSION_URI, toAgentCard, fromAgentCard, validateAgentCard, } from './a2a/agent-card.js';
+export { startAgentCardServer, isLoopbackHost, } from './a2a/well-known.js';
+export { fetchAgentCard, consumeAgentCard, resolveAgentCardUrl, } from './a2a/consume.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,cAAc,EAA0H,MAAM,sCAAsC,CAAC;AAC9L,OAAO,EACL,mBAAmB,EAGnB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,sBAAsB,EACtB,4BAA4B,GAI7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,kCAAkC,EAClC,oCAAoC,GAKrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAoD,MAAM,yCAAyC,CAAC;AAC9H,OAAO,EACL,kBAAkB,EAMlB,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,UAAU,EACV,2BAA2B,EAC3B,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,kBAAkB,GASnB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,gBAAgB,GAKjB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,gBAAgB,GAMjB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,cAAc,GAKf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,YAAY,GAUb,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,cAAc,GAKf,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,qBAAqB,GAGtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,YAAY,GAKb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,4BAA4B,GAI7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,GAG/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,uEAAuE;AACvE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,EAC9B,WAAW,EACX,aAAa,EACb,iBAAiB,GASlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,cAAc,GAGf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,kBAAkB,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.d.ts

@@ -0,0 +1,10 @@
+import type { MCPToolDefinition } from '@claude-flow/shared/src/plugin-interface.js';
+import type { PluginContext } from '@claude-flow/shared/src/plugin-interface.js';
+import type { FederationCoordinator } from './application/federation-coordinator.js';
+import type { WgMeshService } from './domain/services/wg-mesh-service.js';
+type CoordinatorGetter = () => FederationCoordinator | null;
+type ContextGetter = () => PluginContext | null;
+type WgMeshGetter = () => WgMeshService | null;
+export declare function createMcpTools(getCoordinator: CoordinatorGetter, getContext: ContextGetter, getWgMesh?: WgMeshGetter): MCPToolDefinition[];
+export {};
+//# sourceMappingURL=mcp-tools.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/mcp-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tools.d.ts","sourceRoot":"","sources":["../src/mcp-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAGrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAK1E,KAAK,iBAAiB,GAAG,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC5D,KAAK,aAAa,GAAG,MAAM,aAAa,GAAG,IAAI,CAAC;AAChD,KAAK,YAAY,GAAG,MAAM,aAAa,GAAG,IAAI,CAAC;AAM/C,wBAAgB,cAAc,CAC5B,cAAc,EAAE,iBAAiB,EACjC,UAAU,EAAE,aAAa,EACzB,SAAS,GAAE,YAAyB,GACnC,iBAAiB,EAAE,CAscrB"}