@claude-flow/cli 3.32.29 → 3.32.32

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-mesh-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wg-mesh-service.js","sourceRoot":"","sources":["../../../src/domain/services/wg-mesh-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAG5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAQpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA8C;IACzE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE;IAC1B,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACrB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;KAC7B;IACD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACrB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5B,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;KAC1C;IACD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACpB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5B,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;QACzC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QAC1B,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE;KACvC;IACD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QACvB,EAAE,KAAK,EAAE,KAAK,EAAE;KACjB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAe,UAAU,CAAC,QAAQ,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,gBAAgB,GAAG,kDAAkD,CAAC;AAC5E,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAQpF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAClC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAWD,MAAM,iBAAiB,GAAG,WAAW,CAAC;AACtC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AA4BlC,MAAM,OAAO,aAAa;IACP,aAAa,CAAS;IACtB,UAAU,CAAS;IACnB,UAAU,CAAS;IAC5B,QAAQ,GAAsB,IAAI,CAAC;IACnC,WAAW,GAAkB,IAAI,CAAC;IAC1C,0GAA0G;IACzF,qBAAqB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC9E,4DAA4D;IAC3C,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,kCAAkC;IACjB,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,YAAY,SAA8B,EAAE;QAC1C,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,iBAAiB,CAAC;QAC/D,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,CAAC;IAED,0EAA0E;IAC1E,gBAAgB,CAAC,GAAe,EAAE,MAAc;QAC9C,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACpB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAAC,KAAgC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC9E,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,GAAG,iBAAiB;gBAAE,SAAS;YAClD,mEAAmE;YACnE,kEAAkE;YAClE,kEAAkE;YAClE,yEAAyE;YACzE,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS;YACjD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAClD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,YAAY,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChJ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,IAAoB,EAAE,MAAc;QACpD,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,2BAA2B,CAAC,IAAoB,EAAE,MAAc,EAAE,MAAc;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,aAAa,EAAE,MAAM;YACrB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,SAAS,EAAE,wBAAwB,IAAI,CAAC,MAAM,aAAa,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;SACjG,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,IAAoB,EAAE,MAAc,EAAE,MAAe;QACpE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,aAAa,EAAE,MAAM;YACrB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,MAAM,iBAAiB,CAAC;YACpD,SAAS,EAAE,WAAW,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,kCAAkC;SACnG,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,IAAoB,EAAE,MAAc,EAAE,MAAc;QACpE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9F,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,aAAa,EAAE,MAAM;YACrB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,SAAS,EAAE,cAAc,IAAI,CAAC,MAAM,yBAAyB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;SAC7E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,IAAoB,EAAE,MAAc,EAAE,MAAe;QAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,aAAa,EAAE,MAAM;YACrB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,MAAM,SAAS,CAAC;YAC5C,SAAS,EAAE,SAAS,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB;SAClF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,SAAS,CAAC,KAAgC;QACxC,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,iBAAiB,CAAC;aAC9C,GAAG,CAAC,IAAI,CAAC,EAAE;YACV,+DAA+D;YAC/D,oEAAoE;YACpE,mEAAmE;YACnE,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YACxC,IAAI,KAAK,GAAuC,QAAQ,CAAC;YACzD,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC;iBACrD,IAAI,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,KAAK,GAAG,WAAW,CAAC;YACnE,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC/C,MAAM;gBACN,QAAQ;gBACR,SAAS,EAAE,MAAM;gBACjB,KAAK;gBACL,UAAU,EAAE,IAAI,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;aAC1F,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACK,SAAS,CAAC,IAAY;QAC5B,6DAA6D;QAC7D,kEAAkE;QAClE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,4DAA4D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,UAAU,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;IAChD,CAAC;CACF"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.d.ts

@@ -0,0 +1,98 @@
+/**
+ * ADR-111 Phase 5 — Witness attestation chain for WG mesh mutations.
+ *
+ * Every coordination change (peer added/suspended/evicted/reactivated,
+ * keypair rotated) appends a signed entry to an append-only log
+ * `.claude-flow/federation/wg-changes.log`. The signature is over a
+ * canonical JSON encoding of the entry's content fields, using the
+ * operator's federation Ed25519 key — the same identity that signs
+ * federation manifests, so anyone who already trusts the manifest chain
+ * automatically trusts the WG change chain.
+ *
+ * Append-only via O_APPEND open + entries chained by prevHash (sha256 of
+ * the previous entry's canonical bytes). Tampering with history requires
+ * forging a chain of signatures with the operator's key.
+ *
+ * The periodic ruflo witness regen (plugins/ruflo-core/scripts/witness/)
+ * includes wg-changes.log as one of its watched artifacts (operator wires
+ * this via witness-fixes.json).
+ *
+ * Pure service: emits the canonical bytes and the signature to write.
+ * Caller does the I/O so this stays unit-testable without fs mocks.
+ */
+import type { WgCommand } from './wg-mesh-service.js';
+export type WgWitnessEventType = 'peer-added' | 'peer-removed-suspended' | 'peer-restored' | 'peer-evicted' | 'key-rotated' | 'interface-config-applied';
+/**
+ * Canonical fields of a witness entry. The hash + signature are computed
+ * over these in a stable JSON encoding (sorted keys, no whitespace).
+ */
+export interface WgWitnessContent {
+    readonly version: '1';
+    readonly type: WgWitnessEventType;
+    readonly timestamp: string;
+    readonly nodeId: string;
+    /** Public key of the affected peer, if any. */
+    readonly peerPublicKey?: string;
+    /** Mesh IP affected, if any. */
+    readonly meshIP?: string;
+    /** wg command that was emitted, if any. */
+    readonly wgCommand?: string;
+    /** Human-readable rationale for the audit log. */
+    readonly rationale: string;
+    /** Hash of the previous entry in the chain (sha256 hex), or empty for the genesis entry. */
+    readonly prevHash: string;
+}
+/**
+ * Full witness entry as it appears on disk — content + the operator's
+ * Ed25519 signature over the canonical encoding of content.
+ */
+export interface WgWitnessEntry {
+    readonly content: WgWitnessContent;
+    readonly hash: string;
+    readonly signature: string;
+}
+export interface WgWitnessSigner {
+    /** Returns an Ed25519 signature (base64) over the given canonical bytes. */
+    sign(bytes: Buffer): Promise<string>;
+}
+/**
+ * Stable JSON serialization for hashing/signing. Keys are sorted; no
+ * whitespace; undefined fields omitted. Same shape on every host so
+ * cross-host verifiers produce identical hashes.
+ */
+export declare function canonicalizeContent(content: WgWitnessContent): Buffer;
+export declare function hashContent(content: WgWitnessContent): string;
+export declare class WgWitnessService {
+    private readonly nodeId;
+    private readonly signer;
+    private lastHash;
+    constructor(nodeId: string, signer: WgWitnessSigner);
+    /**
+     * Override the previous-hash pointer (used when resuming from an existing
+     * log on disk). Caller reads the last entry from `wg-changes.log` and
+     * passes its `hash` here before appending more.
+     */
+    setLastHash(hash: string): void;
+    /** Build + sign an entry. Caller is responsible for the actual append-write. */
+    build(type: WgWitnessEventType, fields: Omit<WgWitnessContent, 'version' | 'type' | 'timestamp' | 'nodeId' | 'prevHash'>): Promise<WgWitnessEntry>;
+    /**
+     * Convenience: take a WgCommand emitted by WgMeshService Phase 2/3 and
+     * produce a witness entry of the right type. Maps verb → eventType.
+     */
+    attestWgCommand(cmd: WgCommand, meshIP?: string): Promise<WgWitnessEntry>;
+}
+/**
+ * Verify a single entry's signature + hash. Caller verifies the chain by
+ * iterating entries and confirming each entry's `prevHash` equals the
+ * preceding entry's `hash`.
+ */
+export declare function verifyWitnessEntry(entry: WgWitnessEntry, verify: (bytes: Buffer, signature: string) => Promise<boolean>): Promise<boolean>;
+/**
+ * Verify a full chain — every entry valid + chain link unbroken.
+ */
+export declare function verifyWitnessChain(entries: readonly WgWitnessEntry[], verify: (bytes: Buffer, signature: string) => Promise<boolean>): Promise<{
+    ok: boolean;
+    failedAt?: number;
+    reason?: string;
+}>;
+//# sourceMappingURL=wg-witness-service.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wg-witness-service.d.ts","sourceRoot":"","sources":["../../../src/domain/services/wg-witness-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,wBAAwB,GACxB,eAAe,GACf,cAAc,GACd,aAAa,GACb,0BAA0B,CAAC;AAE/B;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gCAAgC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAOrE;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAE7D;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAc;gBAElB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe;IAKnD;;;;OAIG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI/B,gFAAgF;IAC1E,KAAK,CACT,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC,GACvF,OAAO,CAAC,cAAc,CAAC;IAgB1B;;;OAGG;IACG,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAchF;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAC7D,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAC7D,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAc9D"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.js

@@ -0,0 +1,122 @@
+/**
+ * ADR-111 Phase 5 — Witness attestation chain for WG mesh mutations.
+ *
+ * Every coordination change (peer added/suspended/evicted/reactivated,
+ * keypair rotated) appends a signed entry to an append-only log
+ * `.claude-flow/federation/wg-changes.log`. The signature is over a
+ * canonical JSON encoding of the entry's content fields, using the
+ * operator's federation Ed25519 key — the same identity that signs
+ * federation manifests, so anyone who already trusts the manifest chain
+ * automatically trusts the WG change chain.
+ *
+ * Append-only via O_APPEND open + entries chained by prevHash (sha256 of
+ * the previous entry's canonical bytes). Tampering with history requires
+ * forging a chain of signatures with the operator's key.
+ *
+ * The periodic ruflo witness regen (plugins/ruflo-core/scripts/witness/)
+ * includes wg-changes.log as one of its watched artifacts (operator wires
+ * this via witness-fixes.json).
+ *
+ * Pure service: emits the canonical bytes and the signature to write.
+ * Caller does the I/O so this stays unit-testable without fs mocks.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Stable JSON serialization for hashing/signing. Keys are sorted; no
+ * whitespace; undefined fields omitted. Same shape on every host so
+ * cross-host verifiers produce identical hashes.
+ */
+export function canonicalizeContent(content) {
+    const keys = Object.keys(content).sort();
+    const ordered = {};
+    for (const k of keys) {
+        if (content[k] !== undefined)
+            ordered[k] = content[k];
+    }
+    return Buffer.from(JSON.stringify(ordered), 'utf-8');
+}
+export function hashContent(content) {
+    return createHash('sha256').update(canonicalizeContent(content)).digest('hex');
+}
+export class WgWitnessService {
+    nodeId;
+    signer;
+    lastHash = '';
+    constructor(nodeId, signer) {
+        this.nodeId = nodeId;
+        this.signer = signer;
+    }
+    /**
+     * Override the previous-hash pointer (used when resuming from an existing
+     * log on disk). Caller reads the last entry from `wg-changes.log` and
+     * passes its `hash` here before appending more.
+     */
+    setLastHash(hash) {
+        this.lastHash = hash;
+    }
+    /** Build + sign an entry. Caller is responsible for the actual append-write. */
+    async build(type, fields) {
+        const content = {
+            version: '1',
+            type,
+            timestamp: new Date().toISOString(),
+            nodeId: this.nodeId,
+            prevHash: this.lastHash,
+            ...fields,
+        };
+        const canonical = canonicalizeContent(content);
+        const hash = createHash('sha256').update(canonical).digest('hex');
+        const signature = await this.signer.sign(canonical);
+        this.lastHash = hash;
+        return { content, hash, signature };
+    }
+    /**
+     * Convenience: take a WgCommand emitted by WgMeshService Phase 2/3 and
+     * produce a witness entry of the right type. Maps verb → eventType.
+     */
+    async attestWgCommand(cmd, meshIP) {
+        const typeMap = {
+            'add-peer': 'peer-added',
+            'set-allowed-ips': 'peer-restored',
+            'remove-allowed-ips': 'peer-removed-suspended',
+            'remove-peer': 'peer-evicted',
+        };
+        return this.build(typeMap[cmd.verb], {
+            peerPublicKey: cmd.peerPublicKey,
+            meshIP,
+            wgCommand: cmd.cmd,
+            rationale: cmd.rationale,
+        });
+    }
+}
+/**
+ * Verify a single entry's signature + hash. Caller verifies the chain by
+ * iterating entries and confirming each entry's `prevHash` equals the
+ * preceding entry's `hash`.
+ */
+export async function verifyWitnessEntry(entry, verify) {
+    const canonical = canonicalizeContent(entry.content);
+    const expectedHash = createHash('sha256').update(canonical).digest('hex');
+    if (entry.hash !== expectedHash)
+        return false;
+    return verify(canonical, entry.signature);
+}
+/**
+ * Verify a full chain — every entry valid + chain link unbroken.
+ */
+export async function verifyWitnessChain(entries, verify) {
+    let prevHash = '';
+    for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        if (e.content.prevHash !== prevHash) {
+            return { ok: false, failedAt: i, reason: 'broken-chain-link' };
+        }
+        const validEntry = await verifyWitnessEntry(e, verify);
+        if (!validEntry) {
+            return { ok: false, failedAt: i, reason: 'invalid-signature-or-hash' };
+        }
+        prevHash = e.hash;
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=wg-witness-service.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/wg-witness-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wg-witness-service.js","sourceRoot":"","sources":["../../../src/domain/services/wg-witness-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA+CzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAyB;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAmC,CAAC;IAC1E,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAyB;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,MAAM,CAAS;IACf,MAAM,CAAkB;IACjC,QAAQ,GAAW,EAAE,CAAC;IAE9B,YAAY,MAAc,EAAE,MAAuB;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,KAAK,CACT,IAAwB,EACxB,MAAwF;QAExF,MAAM,OAAO,GAAqB;YAChC,OAAO,EAAE,GAAG;YACZ,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,MAAM;SACV,CAAC;QACF,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,GAAc,EAAE,MAAe;QACnD,MAAM,OAAO,GAAkD;YAC7D,UAAU,EAAE,YAAY;YACxB,iBAAiB,EAAE,eAAe;YAClC,oBAAoB,EAAE,wBAAwB;YAC9C,aAAa,EAAE,cAAc;SAC9B,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACnC,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM;YACN,SAAS,EAAE,GAAG,CAAC,GAAG;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAqB,EACrB,MAA8D;IAE9D,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC,EAClC,MAA8D;IAE9D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACjE,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QACzE,CAAC;QACD,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Federation budget + hop counter (ADR-097 Phase 1).
+ *
+ * Carried in {@link FederationEnvelope} alongside the existing
+ * sourceNodeId/targetNodeId/payload. Sender supplies the original limits;
+ * each outbound hop increments hopCount and decrements remaining budget.
+ *
+ * Phase 1 enforces at the *send* side because there is no inbound
+ * dispatcher today (sendToNode is a stub — see researcher report).
+ * Phase 2 will move the decrement to receive once the inbound path lands.
+ *
+ * Security invariants pinned by the reviewer (audit_1776853149979 follow-up):
+ *
+ *   1. validateBudget rejects NaN, ±Infinity, negative numbers, and
+ *      non-integer hop counts. Returns a discriminated result so callers
+ *      cannot accidentally use a bad budget unchecked.
+ *   2. enforceBudget runs check-then-decrement in a single synchronous
+ *      function with no awaits inside — two concurrent send calls cannot
+ *      both pass the pre-check.
+ *   3. Errors return constant strings ("HOP_LIMIT_EXCEEDED" /
+ *      "BUDGET_EXCEEDED") with no remaining-budget echo so a caller can't
+ *      use the error response as an oracle for the threshold.
+ */
+/** Maximum hops a federation message may travel before the breaker opens. */
+export declare const DEFAULT_MAX_HOPS = 8;
+/**
+ * Caller-supplied budget. All fields are optional; omitted fields are
+ * treated as Infinity for the corresponding axis. Created via validateBudget;
+ * never construct directly.
+ */
+export interface Budget {
+    readonly maxHops: number;
+    readonly maxTokens: number;
+    readonly maxUsd: number;
+}
+/** Discriminated result of validating raw user input into a Budget. */
+export type BudgetValidationResult = {
+    ok: true;
+    budget: Budget;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Validate a raw budget object. Pure, no side effects. Caller obtains either
+ * a guaranteed-safe Budget or a structured error suitable for logging.
+ *
+ * Accepts undefined/null and returns a default unbounded budget (maxHops =
+ * DEFAULT_MAX_HOPS, tokens/usd = Infinity). This preserves backward
+ * compatibility for callers that don't pass a budget at all.
+ */
+export declare function validateBudget(raw: unknown, overrideMaxHops?: unknown): BudgetValidationResult;
+/**
+ * Enforcement decision returned by enforceBudget. Discriminated so the
+ * caller can map directly to a constant-string error — no remaining-budget
+ * echo on the failure side (anti-oracle).
+ */
+export type BudgetEnforcement = {
+    ok: true;
+    nextHopCount: number;
+    remaining: Budget;
+} | {
+    ok: false;
+    reason: 'HOP_LIMIT_EXCEEDED' | 'BUDGET_EXCEEDED';
+};
+/**
+ * Atomic (single synchronous function, no internal awaits) hop check.
+ *
+ * Returns the hopCount value the OUTBOUND envelope should carry plus the
+ * remaining budget that downstream peers will see. Callers must use the
+ * returned values; mutating the input Budget is forbidden (it's readonly).
+ *
+ * Contract:
+ *   - hopCount represents how many hops the message has already taken.
+ *   - The next outbound hop increments it: nextHopCount = hopCount + 1.
+ *   - The check fires AFTER increment: nextHopCount must be <= maxHops.
+ *   - This means maxHops=0 refuses to forward at all, which matches the
+ *     ADR's "no remote delegation allowed" semantic.
+ *
+ * tokensSpent / usdSpent are caller-reported actuals from the immediately
+ * preceding leg (or 0 on the originator). The check fires on the
+ * *post-spend* totals so a leg that overshoots is caught before the next
+ * outbound dispatch.
+ */
+export declare function enforceBudget(budget: Budget, hopCount: number, spent?: {
+    tokens: number;
+    usd: number;
+}): BudgetEnforcement;
+//# sourceMappingURL=federation-budget.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-budget.d.ts","sourceRoot":"","sources":["../../../src/domain/value-objects/federation-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAQlC;;;;GAIG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,uEAAuE;AACvE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,eAAe,CAAC,EAAE,OAAO,GACxB,sBAAsB,CA6DxB;AAkCD;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,GAAG,iBAAiB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAA0B,GAC7D,iBAAiB,CAuBnB"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.js

@@ -0,0 +1,165 @@
+/**
+ * Federation budget + hop counter (ADR-097 Phase 1).
+ *
+ * Carried in {@link FederationEnvelope} alongside the existing
+ * sourceNodeId/targetNodeId/payload. Sender supplies the original limits;
+ * each outbound hop increments hopCount and decrements remaining budget.
+ *
+ * Phase 1 enforces at the *send* side because there is no inbound
+ * dispatcher today (sendToNode is a stub — see researcher report).
+ * Phase 2 will move the decrement to receive once the inbound path lands.
+ *
+ * Security invariants pinned by the reviewer (audit_1776853149979 follow-up):
+ *
+ *   1. validateBudget rejects NaN, ±Infinity, negative numbers, and
+ *      non-integer hop counts. Returns a discriminated result so callers
+ *      cannot accidentally use a bad budget unchecked.
+ *   2. enforceBudget runs check-then-decrement in a single synchronous
+ *      function with no awaits inside — two concurrent send calls cannot
+ *      both pass the pre-check.
+ *   3. Errors return constant strings ("HOP_LIMIT_EXCEEDED" /
+ *      "BUDGET_EXCEEDED") with no remaining-budget echo so a caller can't
+ *      use the error response as an oracle for the threshold.
+ */
+/** Maximum hops a federation message may travel before the breaker opens. */
+export const DEFAULT_MAX_HOPS = 8;
+/** Hard ceiling on caller-supplied maxUsd to prevent absurd integer math. */
+const MAX_USD_CEILING = 1_000_000;
+/** Hard ceiling on caller-supplied maxTokens. 1B tokens is more than any real session. */
+const MAX_TOKENS_CEILING = 1_000_000_000;
+/** Hard ceiling on hop count. */
+const MAX_HOPS_CEILING = 64;
+/**
+ * Validate a raw budget object. Pure, no side effects. Caller obtains either
+ * a guaranteed-safe Budget or a structured error suitable for logging.
+ *
+ * Accepts undefined/null and returns a default unbounded budget (maxHops =
+ * DEFAULT_MAX_HOPS, tokens/usd = Infinity). This preserves backward
+ * compatibility for callers that don't pass a budget at all.
+ */
+export function validateBudget(raw, overrideMaxHops) {
+    // Default unbounded budget when caller passes nothing.
+    if (raw == null && overrideMaxHops == null) {
+        return {
+            ok: true,
+            budget: {
+                maxHops: DEFAULT_MAX_HOPS,
+                maxTokens: Number.POSITIVE_INFINITY,
+                maxUsd: Number.POSITIVE_INFINITY,
+            },
+        };
+    }
+    // Caller passed a bare maxHops without a budget object — accept it as a
+    // hop-only budget. Useful for "no remote delegation allowed" via
+    // maxHops: 0.
+    if (raw == null && overrideMaxHops != null) {
+        const hopCheck = checkHops(overrideMaxHops);
+        if (!hopCheck.ok)
+            return hopCheck;
+        return {
+            ok: true,
+            budget: {
+                maxHops: hopCheck.value,
+                maxTokens: Number.POSITIVE_INFINITY,
+                maxUsd: Number.POSITIVE_INFINITY,
+            },
+        };
+    }
+    if (typeof raw !== 'object' || Array.isArray(raw)) {
+        return { ok: false, error: 'budget must be an object' };
+    }
+    const obj = raw;
+    const hopsRaw = overrideMaxHops ?? obj.maxHops;
+    const hopCheck = hopsRaw == null
+        ? { ok: true, value: DEFAULT_MAX_HOPS }
+        : checkHops(hopsRaw);
+    if (!hopCheck.ok)
+        return hopCheck;
+    const tokensCheck = obj.maxTokens == null
+        ? { ok: true, value: Number.POSITIVE_INFINITY }
+        : checkBound(obj.maxTokens, MAX_TOKENS_CEILING, 'maxTokens', true);
+    if (!tokensCheck.ok)
+        return tokensCheck;
+    const usdCheck = obj.maxUsd == null
+        ? { ok: true, value: Number.POSITIVE_INFINITY }
+        : checkBound(obj.maxUsd, MAX_USD_CEILING, 'maxUsd', false);
+    if (!usdCheck.ok)
+        return usdCheck;
+    return {
+        ok: true,
+        budget: {
+            maxHops: hopCheck.value,
+            maxTokens: tokensCheck.value,
+            maxUsd: usdCheck.value,
+        },
+    };
+}
+function checkHops(v) {
+    if (typeof v !== 'number' || !Number.isFinite(v) || !Number.isInteger(v)) {
+        return { ok: false, error: 'maxHops must be a finite integer' };
+    }
+    if (v < 0)
+        return { ok: false, error: 'maxHops must be >= 0' };
+    if (v > MAX_HOPS_CEILING) {
+        return { ok: false, error: `maxHops exceeds ceiling (${MAX_HOPS_CEILING})` };
+    }
+    return { ok: true, value: v };
+}
+function checkBound(v, ceiling, label, requireInteger) {
+    if (typeof v !== 'number' || !Number.isFinite(v)) {
+        return { ok: false, error: `${label} must be a finite number` };
+    }
+    if (requireInteger && !Number.isInteger(v)) {
+        return { ok: false, error: `${label} must be an integer` };
+    }
+    if (v < 0)
+        return { ok: false, error: `${label} must be >= 0` };
+    if (v > ceiling) {
+        return { ok: false, error: `${label} exceeds ceiling (${ceiling})` };
+    }
+    return { ok: true, value: v };
+}
+/**
+ * Atomic (single synchronous function, no internal awaits) hop check.
+ *
+ * Returns the hopCount value the OUTBOUND envelope should carry plus the
+ * remaining budget that downstream peers will see. Callers must use the
+ * returned values; mutating the input Budget is forbidden (it's readonly).
+ *
+ * Contract:
+ *   - hopCount represents how many hops the message has already taken.
+ *   - The next outbound hop increments it: nextHopCount = hopCount + 1.
+ *   - The check fires AFTER increment: nextHopCount must be <= maxHops.
+ *   - This means maxHops=0 refuses to forward at all, which matches the
+ *     ADR's "no remote delegation allowed" semantic.
+ *
+ * tokensSpent / usdSpent are caller-reported actuals from the immediately
+ * preceding leg (or 0 on the originator). The check fires on the
+ * *post-spend* totals so a leg that overshoots is caught before the next
+ * outbound dispatch.
+ */
+export function enforceBudget(budget, hopCount, spent = { tokens: 0, usd: 0 }) {
+    const nextHopCount = hopCount + 1;
+    if (nextHopCount > budget.maxHops) {
+        return { ok: false, reason: 'HOP_LIMIT_EXCEEDED' };
+    }
+    // Negative spend is a programming error; treat as 0 rather than refunding
+    // the budget (which would let a malicious caller inflate remaining).
+    const ts = Math.max(0, spent.tokens);
+    const us = Math.max(0, spent.usd);
+    const remainingTokens = budget.maxTokens - ts;
+    const remainingUsd = budget.maxUsd - us;
+    if (remainingTokens < 0 || remainingUsd < 0) {
+        return { ok: false, reason: 'BUDGET_EXCEEDED' };
+    }
+    return {
+        ok: true,
+        nextHopCount,
+        remaining: {
+            maxHops: budget.maxHops,
+            maxTokens: remainingTokens,
+            maxUsd: remainingUsd,
+        },
+    };
+}
+//# sourceMappingURL=federation-budget.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-budget.js","sourceRoot":"","sources":["../../../src/domain/value-objects/federation-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,6EAA6E;AAC7E,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,aAAa,CAAC;AACzC,iCAAiC;AACjC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAkB5B;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,eAAyB;IAEzB,uDAAuD;IACvD,IAAI,GAAG,IAAI,IAAI,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,OAAO,EAAE,gBAAgB;gBACzB,SAAS,EAAE,MAAM,CAAC,iBAAiB;gBACnC,MAAM,EAAE,MAAM,CAAC,iBAAiB;aACjC;SACF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,cAAc;IACd,IAAI,GAAG,IAAI,IAAI,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,OAAO,EAAE,QAAQ,CAAC,KAAK;gBACvB,SAAS,EAAE,MAAM,CAAC,iBAAiB;gBACnC,MAAM,EAAE,MAAM,CAAC,iBAAiB;aACjC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,MAAM,OAAO,GAAG,eAAe,IAAI,GAAG,CAAC,OAAO,CAAC;IAC/C,MAAM,QAAQ,GACZ,OAAO,IAAI,IAAI;QACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE;QAChD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,WAAW,GACf,GAAG,CAAC,SAAS,IAAI,IAAI;QACnB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE;QACxD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IAExC,MAAM,QAAQ,GACZ,GAAG,CAAC,MAAM,IAAI,IAAI;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE;QACxD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,SAAS,EAAE,WAAW,CAAC,KAAK;YAC5B,MAAM,EAAE,QAAQ,CAAC,KAAK;SACvB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,CAAU;IAEV,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC/D,IAAI,CAAC,GAAG,gBAAgB,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,gBAAgB,GAAG,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,UAAU,CACjB,CAAU,EACV,OAAe,EACf,KAAa,EACb,cAAuB;IAEvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,qBAAqB,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,eAAe,EAAE,CAAC;IAChE,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,qBAAqB,OAAO,GAAG,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChC,CAAC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,QAAgB,EAChB,QAAyC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;IAE9D,MAAM,YAAY,GAAG,QAAQ,GAAG,CAAC,CAAC;IAClC,IAAI,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACxC,IAAI,eAAe,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY;QACZ,SAAS,EAAE;YACT,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,eAAe;YAC1B,MAAM,EAAE,YAAY;SACrB;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Federation peer state machine (ADR-097 Phase 2).
+ *
+ * Phase 1 shipped the budget envelope + enforcer that travels with every
+ * outbound message. Phase 2 adds the per-peer breaker: when a peer crosses a
+ * cost or failure threshold, transition it to SUSPENDED so subsequent
+ * `federation_send` calls short-circuit. After a cooldown the peer can
+ * recover; if it stays bad the breaker escalates to EVICTED.
+ *
+ * This module is the *value object* layer — pure, no I/O. The breaker
+ * service (Phase 2.b, separate file) reads cost-tracker telemetry, evaluates
+ * thresholds, and calls `transition` on the FederationNode entity. Decoupling
+ * the state machine from the policy lets tests pin transitions without
+ * standing up the cost bus.
+ *
+ * Security invariants pinned by the spec:
+ *
+ *   1. EVICTED is terminal under normal flow. The only way out is an
+ *      explicit `reactivate` call (operator-initiated). This prevents a
+ *      misbehaving peer from auto-recovering through the cooldown.
+ *   2. canTransition is the single source of truth for legality. Any path
+ *      that mutates state MUST consult it; direct field writes are not
+ *      permitted (entity getter/setter shape enforces this).
+ *   3. Reasons are constant strings, no remaining-budget echo on failure
+ *      (matches Phase 1's anti-oracle posture).
+ *   4. Default cooldown is conservative (30 min) so a transient spike
+ *      cannot ping-pong a peer ACTIVE↔SUSPENDED at high frequency.
+ */
+/** Lifecycle state of a federation peer. */
+export declare enum FederationNodeState {
+    /** Default; healthy. `federation_send` accepts deliveries. */
+    ACTIVE = "ACTIVE",
+    /** Breaker tripped. Sends short-circuit with PEER_SUSPENDED. */
+    SUSPENDED = "SUSPENDED",
+    /** Removed from active rotation. Sends short-circuit with PEER_EVICTED. */
+    EVICTED = "EVICTED"
+}
+/** Reason a peer was suspended/evicted. Constant strings — no echo of caps. */
+export type SuspensionReason = 'COST_THRESHOLD_EXCEEDED' | 'FAILURE_RATIO_EXCEEDED' | 'MANUAL_SUSPEND' | 'GRACE_PERIOD_EXPIRED' | 'MANUAL_EVICT';
+/**
+ * Default cooldown a SUSPENDED peer must wait before being eligible for
+ * SUSPENDED → ACTIVE. 30 minutes matches the ADR-097 Part 2 spec and is
+ * intentionally well past the prompt-cache window so a recovery probe is
+ * cheap to amortize.
+ */
+export declare const DEFAULT_SUSPENSION_COOLDOWN_MS: number;
+/**
+ * Default age at which a continuously-SUSPENDED peer is auto-escalated to
+ * EVICTED. 24 hours per spec — long enough to ride out a cost-tracker
+ * outage without false eviction, short enough that a genuinely-broken peer
+ * doesn't linger forever.
+ */
+export declare const DEFAULT_AUTO_EVICTION_AGE_MS: number;
+/** A successful transition's reason payload (for the audit trail). */
+export interface TransitionReason {
+    readonly reason: SuspensionReason;
+    /** Optional opaque correlation key — task ID, breaker run ID, etc. */
+    readonly correlationId?: string;
+}
+/**
+ * Static legality table for state transitions. Returns true iff the
+ * `from -> to` edge is in the allowed set. Used by the entity to reject
+ * illegal mutations before applying them.
+ *
+ * Allowed edges:
+ *   ACTIVE    → SUSPENDED  (breaker trips)
+ *   SUSPENDED → ACTIVE     (cooldown + probe success)
+ *   SUSPENDED → EVICTED    (grace expired, or manual evict)
+ *   ACTIVE    → EVICTED    (manual evict only — skips suspend)
+ *   EVICTED   → ACTIVE     (manual reactivate only)
+ *
+ * Disallowed (anything else, including self-loops, is a no-op error).
+ */
+export declare function canTransition(from: FederationNodeState, to: FederationNodeState): boolean;
+/**
+ * Should a SUSPENDED peer be eligible for SUSPENDED → ACTIVE based purely
+ * on elapsed time? The breaker still has to confirm health via probe before
+ * it actually calls reactivate; this just answers "is the cooldown done?"
+ *
+ * Pure function of (suspendedAt, now, cooldownMs) so it's trivially
+ * deterministic in tests.
+ */
+export declare function isCooldownElapsed(suspendedAt: Date, now: Date, cooldownMs?: number): boolean;
+/**
+ * Should a SUSPENDED peer be auto-escalated to EVICTED based on the age of
+ * its suspension? Returns true once the peer has been continuously
+ * SUSPENDED past the configured limit (default 24h). The breaker calls
+ * this on each tick and, if true, issues the SUSPENDED → EVICTED
+ * transition with reason GRACE_PERIOD_EXPIRED.
+ */
+export declare function shouldAutoEvict(suspendedAt: Date, now: Date, ageLimitMs?: number): boolean;
+//# sourceMappingURL=federation-node-state.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/value-objects/federation-node-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-node-state.d.ts","sourceRoot":"","sources":["../../../src/domain/value-objects/federation-node-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,4CAA4C;AAC5C,oBAAY,mBAAmB;IAC7B,8DAA8D;IAC9D,MAAM,WAAW;IACjB,gEAAgE;IAChE,SAAS,cAAc;IACvB,2EAA2E;IAC3E,OAAO,YAAY;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GACxB,yBAAyB,GACzB,wBAAwB,GACxB,gBAAgB,GAChB,sBAAsB,GACtB,cAAc,CAAC;AAEnB;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAiB,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,QAAsB,CAAC;AAEhE,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,mBAAmB,EACzB,EAAE,EAAE,mBAAmB,GACtB,OAAO,CAUT;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,IAAI,EACjB,GAAG,EAAE,IAAI,EACT,UAAU,GAAE,MAAuC,GAClD,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,IAAI,EACjB,GAAG,EAAE,IAAI,EACT,UAAU,GAAE,MAAqC,GAChD,OAAO,CAET"}