@claude-flow/plugin-agent-federation 1.0.0-alpha.10

package/dist/application/federation-coordinator.js

@@ -0,0 +1,412 @@
+import { TrustLevel } from '../domain/entities/trust-level.js';
+import { FederationNodeState, } from '../domain/value-objects/federation-node-state.js';
+import { enforceBudget, validateBudget, } from '../domain/value-objects/federation-budget.js';
+export class FederationCoordinator {
+    config;
+    discovery;
+    handshake;
+    routing;
+    audit;
+    piiPipeline;
+    trustEvaluator;
+    policyEngine;
+    sessions;
+    initialized;
+    spendReporter;
+    breakerService;
+    constructor(config, discovery, handshake, routing, audit, piiPipeline, trustEvaluator, policyEngine, integrations = {}) {
+        this.config = config;
+        this.discovery = discovery;
+        this.handshake = handshake;
+        this.routing = routing;
+        this.audit = audit;
+        this.piiPipeline = piiPipeline;
+        this.trustEvaluator = trustEvaluator;
+        this.policyEngine = policyEngine;
+        this.sessions = new Map();
+        this.initialized = false;
+        this.spendReporter = integrations.spendReporter;
+        this.breakerService = integrations.breakerService;
+    }
+    async initialize(manifest) {
+        await this.discovery.publishManifest(manifest);
+        this.discovery.startPeriodicDiscovery();
+        this.initialized = true;
+        await this.audit.log('peer_manifest_published', {
+            metadata: { endpoint: this.config.endpoint },
+        });
+    }
+    async shutdown() {
+        this.discovery.stopPeriodicDiscovery();
+        for (const [sessionId, session] of this.sessions) {
+            session.terminate();
+            await this.audit.log('session_terminated', {
+                sessionId,
+                targetNodeId: session.remoteNodeId,
+            });
+        }
+        this.sessions.clear();
+        await this.audit.flush();
+        this.initialized = false;
+    }
+    async joinPeer(endpoint) {
+        this.ensureInitialized();
+        const node = await this.discovery.addStaticPeer(endpoint);
+        await this.audit.log('peer_discovered', {
+            targetNodeId: node.nodeId,
+            metadata: { endpoint },
+        });
+        return this.establishSession(node);
+    }
+    async leavePeer(nodeId) {
+        this.ensureInitialized();
+        const session = this.findSessionByNodeId(nodeId);
+        if (session) {
+            session.terminate();
+            this.sessions.delete(session.sessionId);
+            await this.audit.log('session_terminated', {
+                sessionId: session.sessionId,
+                targetNodeId: nodeId,
+            });
+        }
+        this.discovery.removePeer(nodeId);
+    }
+    async sendMessage(targetNodeId, messageType, payload, options = {}) {
+        this.ensureInitialized();
+        // ADR-097 Phase 2.b: outbound short-circuit on tripped breaker. If the
+        // peer is SUSPENDED or EVICTED we refuse the send before doing any work,
+        // and emit a constant-string error (no remaining-budget echo per the
+        // anti-oracle posture inherited from Phase 1). The check fires *before*
+        // session lookup so an evicted peer cannot consume cycles even on a
+        // dangling session reference.
+        const peer = this.discovery.getPeer(targetNodeId);
+        if (peer && !peer.isActive) {
+            const reason = peer.isEvicted ? 'PEER_EVICTED' : 'PEER_SUSPENDED';
+            await this.audit.log('message_rejected', {
+                targetNodeId,
+                metadata: { reason },
+            });
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: reason,
+            };
+        }
+        const session = this.findSessionByNodeId(targetNodeId);
+        if (!session) {
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: `No active session with node ${targetNodeId}`,
+            };
+        }
+        const policyResult = this.policyEngine.evaluateMessage(messageType, session.trustLevel, JSON.stringify(payload).length, this.config.nodeId);
+        if (!policyResult.allowed) {
+            await this.audit.log('message_rejected', {
+                targetNodeId,
+                sessionId: session.sessionId,
+                metadata: { reason: policyResult.reason },
+            });
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: policyResult.reason,
+            };
+        }
+        // ADR-097 Phase 1: validate caller-supplied budget + enforce hop limit
+        // and cumulative spend BEFORE outbound dispatch. Synchronous & atomic —
+        // no awaits between validate and enforce, so concurrent sends cannot
+        // both pass a single-hop budget. Errors are constant strings so a
+        // malicious caller cannot use the response as a budget oracle.
+        const budgetResult = validateBudget(options.budget, options.maxHops);
+        if (!budgetResult.ok) {
+            await this.audit.log('message_rejected', {
+                targetNodeId,
+                sessionId: session.sessionId,
+                metadata: { reason: 'INVALID_BUDGET', detail: budgetResult.error },
+            });
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: 'INVALID_BUDGET',
+            };
+        }
+        const enforcement = enforceBudget(budgetResult.budget, options.hopCount ?? 0, {
+            tokens: options.spent?.tokens ?? 0,
+            usd: options.spent?.usd ?? 0,
+        });
+        if (!enforcement.ok) {
+            await this.audit.log('message_rejected', {
+                targetNodeId,
+                sessionId: session.sessionId,
+                metadata: { reason: enforcement.reason },
+            });
+            return {
+                success: false,
+                mode: 'direct',
+                envelopeId: '',
+                targetNodeIds: [targetNodeId],
+                error: enforcement.reason, // constant string — no oracle leak
+            };
+        }
+        const result = await this.routing.send(session, messageType, payload);
+        await this.audit.log(result.success ? 'message_sent' : 'message_rejected', {
+            targetNodeId,
+            sessionId: session.sessionId,
+            latencyMs: result.latencyMs,
+            metadata: {
+                messageType,
+                mode: result.mode,
+                hopCount: enforcement.nextHopCount,
+            },
+        });
+        return result;
+    }
+    /**
+     * Re-export the budget primitives so external callers (e.g. follow-up
+     * iterations adding receive-side decrement) can reuse them without
+     * dipping into domain/value-objects directly.
+     */
+    static budget = { validate: validateBudget, enforce: enforceBudget };
+    async broadcastMessage(messageType, payload) {
+        this.ensureInitialized();
+        return this.routing.broadcast(messageType, payload);
+    }
+    handleThreatDetection(nodeId) {
+        const exceedsThreshold = this.trustEvaluator.recordThreatDetection(nodeId);
+        const node = this.discovery.getPeer(nodeId);
+        if (node && exceedsThreshold) {
+            this.trustEvaluator.downgrade(node, 'repeated-threat-detection');
+            const session = this.findSessionByNodeId(nodeId);
+            if (session) {
+                session.terminate();
+                this.sessions.delete(session.sessionId);
+            }
+            this.audit.log('threat_blocked', {
+                sourceNodeId: nodeId,
+                trustLevel: TrustLevel.UNTRUSTED,
+                threatDetected: true,
+                metadata: { reason: 'repeated-threat-detection' },
+            });
+        }
+    }
+    handleHmacFailure(nodeId) {
+        const node = this.discovery.getPeer(nodeId);
+        if (node) {
+            this.trustEvaluator.downgrade(node, 'hmac-verification-failure');
+            const session = this.findSessionByNodeId(nodeId);
+            if (session) {
+                session.terminate();
+                this.sessions.delete(session.sessionId);
+            }
+            this.audit.log('threat_blocked', {
+                sourceNodeId: nodeId,
+                trustLevel: TrustLevel.UNTRUSTED,
+                metadata: { reason: 'hmac-verification-failure' },
+            });
+        }
+    }
+    getStatus() {
+        const peers = this.discovery.listPeers();
+        const trustLevels = {};
+        for (const peer of peers) {
+            trustLevels[peer.nodeId] = peer.trustLevel;
+        }
+        return {
+            nodeId: this.config.nodeId,
+            activeSessions: Array.from(this.sessions.values()).filter(s => s.active).length,
+            knownPeers: peers.length,
+            trustLevels,
+            healthy: this.initialized,
+        };
+    }
+    /**
+     * ADR-097 Phase 4: per-peer breaker state snapshot for the doctor
+     * surface and `federation_breaker_status` MCP tool.
+     *
+     * Returns one entry per known peer with the entity's stateRecord —
+     * what state, when it changed, why, and which caller's correlation
+     * key triggered it. Pure read; does not mutate.
+     */
+    getPeerStates() {
+        return this.discovery.listPeers().map((peer) => ({
+            nodeId: peer.nodeId,
+            ...peer.stateRecord,
+        }));
+    }
+    /**
+     * Aggregated counts for the doctor surface — `{ active: N, suspended: M,
+     * evicted: K }`. Cheap O(peers) sweep; safe to call from a status line.
+     */
+    getPeerStateCounts() {
+        let active = 0;
+        let suspended = 0;
+        let evicted = 0;
+        for (const peer of this.discovery.listPeers()) {
+            switch (peer.state) {
+                case FederationNodeState.ACTIVE:
+                    active++;
+                    break;
+                case FederationNodeState.SUSPENDED:
+                    suspended++;
+                    break;
+                case FederationNodeState.EVICTED:
+                    evicted++;
+                    break;
+            }
+        }
+        return { active, suspended, evicted };
+    }
+    /**
+     * Operator-initiated evict. Returns true on transition, false if the
+     * peer was already EVICTED or unknown. Logs to audit either way.
+     *
+     * Does NOT remove the peer from the discovery registry — `leavePeer`
+     * is the registry-removal API. Eviction is the breaker layer; the peer
+     * remains queryable so the operator can later reactivate.
+     */
+    async evictPeer(nodeId, reason = 'MANUAL_EVICT', correlationId) {
+        this.ensureInitialized();
+        const peer = this.discovery.getPeer(nodeId);
+        if (!peer)
+            return false;
+        const ok = peer.evict({ reason, correlationId });
+        await this.audit.log('threat_blocked', {
+            targetNodeId: nodeId,
+            metadata: {
+                reason,
+                correlationId: correlationId ?? null,
+                state: peer.state,
+                applied: ok,
+            },
+        });
+        if (ok) {
+            const session = this.findSessionByNodeId(nodeId);
+            if (session) {
+                session.terminate();
+                this.sessions.delete(session.sessionId);
+            }
+        }
+        return ok;
+    }
+    /**
+     * ADR-097 Phase 3 upstream: report the actual cost of a federated
+     * call. Federation doesn't own model pricing, so the integrator calls
+     * this after the downstream agent completes.
+     *
+     * Fans out to:
+     *   - spendReporter (if injected) — persists to integrator's backend
+     *   - breakerService.recordOutcome (if injected) — feeds the breaker's
+     *     in-memory rolling buffer for cost/failure-ratio thresholds
+     *
+     * Both are no-ops if the corresponding integration isn't wired, so
+     * callers don't need to branch on configuration. Negative tokens/usd
+     * are clamped to 0 at the breaker layer (anti-credit-inflation); the
+     * spend reporter receives the raw values so backends can audit them.
+     *
+     * Auto-fills `ts` if the caller omits it.
+     */
+    async reportSpend(input) {
+        const event = {
+            peerId: input.peerId,
+            taskId: input.taskId,
+            tokensUsed: input.tokensUsed,
+            usdSpent: input.usdSpent,
+            success: input.success,
+            ts: input.ts ?? new Date().toISOString(),
+        };
+        // Fan out in parallel — neither side blocks the other. Reporter
+        // failures bubble up (integrator's responsibility); breaker is
+        // sync-internally so its branch is fire-and-forget safe.
+        const tasks = [];
+        if (this.spendReporter) {
+            tasks.push(this.spendReporter.reportSpend(event));
+        }
+        if (this.breakerService) {
+            this.breakerService.recordOutcome({
+                nodeId: event.peerId,
+                success: event.success,
+                tokensUsed: event.tokensUsed,
+                usdSpent: event.usdSpent,
+                at: new Date(event.ts),
+            });
+        }
+        if (tasks.length > 0)
+            await Promise.all(tasks);
+    }
+    /**
+     * Operator-initiated reactivate. Used after an integrator-supplied
+     * health probe confirms a SUSPENDED peer is healthy, OR as an
+     * operator-override escape from EVICTED. Returns true on transition.
+     */
+    async reactivatePeer(nodeId, correlationId) {
+        this.ensureInitialized();
+        const peer = this.discovery.getPeer(nodeId);
+        if (!peer)
+            return false;
+        const ok = peer.reactivate(correlationId);
+        await this.audit.log('trust_level_changed', {
+            targetNodeId: nodeId,
+            metadata: {
+                action: 'reactivate',
+                correlationId: correlationId ?? null,
+                state: peer.state,
+                applied: ok,
+            },
+        });
+        return ok;
+    }
+    getSession(sessionId) {
+        return this.sessions.get(sessionId);
+    }
+    getActiveSessions() {
+        return Array.from(this.sessions.values()).filter(s => s.active && !s.isExpired());
+    }
+    async establishSession(node) {
+        await this.audit.log('handshake_initiated', { targetNodeId: node.nodeId });
+        const challenge = await this.handshake.initiateHandshake(node);
+        const response = await this.handshake.respondToHandshake(challenge);
+        const result = await this.handshake.verifyChallenge(response, node);
+        if (!result.success || !result.session) {
+            await this.audit.log('handshake_failed', {
+                targetNodeId: node.nodeId,
+                metadata: { error: result.error },
+            });
+            throw new Error(`Handshake failed: ${result.error}`);
+        }
+        this.sessions.set(result.session.sessionId, result.session);
+        await this.audit.log('handshake_completed', {
+            targetNodeId: node.nodeId,
+            sessionId: result.session.sessionId,
+            trustLevel: result.session.trustLevel,
+        });
+        await this.audit.log('session_created', {
+            sessionId: result.session.sessionId,
+            targetNodeId: node.nodeId,
+            trustLevel: result.session.trustLevel,
+        });
+        return result.session;
+    }
+    findSessionByNodeId(nodeId) {
+        for (const session of this.sessions.values()) {
+            if (session.remoteNodeId === nodeId && session.active) {
+                return session;
+            }
+        }
+        return undefined;
+    }
+    ensureInitialized() {
+        if (!this.initialized) {
+            throw new Error('FederationCoordinator is not initialized. Call initialize() first.');
+        }
+    }
+}
+//# sourceMappingURL=federation-coordinator.js.map

package/dist/application/federation-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-coordinator.js","sourceRoot":"","sources":["../../src/application/federation-coordinator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EACL,mBAAmB,GAEpB,MAAM,kDAAkD,CAAC;AAQ1D,OAAO,EAGL,aAAa,EACb,cAAc,GACf,MAAM,8CAA8C,CAAC;AAyDtD,MAAM,OAAO,qBAAqB;IACf,MAAM,CAA8B;IACpC,SAAS,CAAmB;IAC5B,SAAS,CAAmB;IAC5B,OAAO,CAAiB;IACxB,KAAK,CAAe;IACpB,WAAW,CAAqB;IAChC,cAAc,CAAiB;IAC/B,YAAY,CAAe;IAC3B,QAAQ,CAAiC;IAClD,WAAW,CAAU;IACZ,aAAa,CAAiB;IAC9B,cAAc,CAA4B;IAE3D,YACE,MAAmC,EACnC,SAA2B,EAC3B,SAA2B,EAC3B,OAAuB,EACvB,KAAmB,EACnB,WAA+B,EAC/B,cAA8B,EAC9B,YAA0B,EAC1B,eAAkD,EAAE;QAEpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;QAChD,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAA+C;QAC9D,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EAAE;YAC9C,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAEvC,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjD,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBACzC,SAAS;gBACT,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE1D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE;YACtC,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,QAAQ,EAAE,EAAE,QAAQ,EAAE;SACvB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAExC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBACzC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CACf,YAAoB,EACpB,WAAkC,EAClC,OAAU,EACV,UAAuB,EAAE;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,8BAA8B;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAClE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY;gBACZ,QAAQ,EAAE,EAAE,MAAM,EAAE;aACrB,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,MAAM;aACd,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,+BAA+B,YAAY,EAAE;aACrD,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,CACpD,WAAW,EACX,OAAO,CAAC,UAAU,EAClB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CACnB,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,YAAY,CAAC,MAAM;aAC3B,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE;aACnE,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,gBAAgB;aACxB,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAsB,aAAa,CAClD,YAAY,CAAC,MAAM,EACnB,OAAO,CAAC,QAAQ,IAAI,CAAC,EACrB;YACE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;YAClC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC;SAC7B,CACF,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,aAAa,EAAE,CAAC,YAAY,CAAC;gBAC7B,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,mCAAmC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,EAAE;YACzE,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE;gBACR,WAAW;gBACX,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,WAAW,CAAC,YAAY;aACnC;SACF,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAU,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAE9E,KAAK,CAAC,gBAAgB,CACpB,WAAkC,EAClC,OAAU;QAEV,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,qBAAqB,CAAC,MAAc;QAClC,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE5C,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBAC/B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,cAAc,EAAE,IAAI;gBACpB,QAAQ,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBAC/B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,QAAQ,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,WAAW,GAA+B,EAAE,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAC/E,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,IAAI,CAAC,WAAW;SACpB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9C,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,KAAK,mBAAmB,CAAC,MAAM;oBAAE,MAAM,EAAE,CAAC;oBAAC,MAAM;gBACjD,KAAK,mBAAmB,CAAC,SAAS;oBAAE,SAAS,EAAE,CAAC;oBAAC,MAAM;gBACvD,KAAK,mBAAmB,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;oBAAC,MAAM;YACrD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,MAAc,EACd,SAA2B,cAAc,EACzC,aAAsB;QAEtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YACrC,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE;gBACR,MAAM;gBACN,aAAa,EAAE,aAAa,IAAI,IAAI;gBACpC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,EAAE;aACZ;SACF,CAAC,CAAC;QACH,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CAAC,KAOjB;QACC,MAAM,KAAK,GAAyB;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACzC,CAAC;QAEF,gEAAgE;QAChE,+DAA+D;QAC/D,yDAAyD;QACzD,MAAM,KAAK,GAAoB,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;gBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,aAAsB;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE;YAC1C,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE;gBACR,MAAM,EAAE,YAAY;gBACpB,aAAa,EAAE,aAAa,IAAI,IAAI;gBACpC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,EAAE;aACZ;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,iBAAiB;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAoB;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAE3E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvC,YAAY,EAAE,IAAI,CAAC,MAAM;gBACzB,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;aAClC,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE;YAC1C,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE;YACtC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAEO,mBAAmB,CAAC,MAAc;QACxC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC"}

package/dist/application/inbound-dispatcher.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Inbound message dispatcher (ADR-109).
+ *
+ * The federation plugin's `transport.listen()` accepts inbound bytes
+ * but until this module landed, the bytes had no consumer — they sat
+ * in the transport's per-address message queue with no one polling.
+ *
+ * `dispatchInbound()` is what the plugin registers as the
+ * transport.onMessage handler. For each received message it:
+ *
+ *   1. Resolves the sender via `sourceNodeId` in metadata
+ *   2. Verifies the peer is in the discovery registry (unknown → reject)
+ *   3. Verifies peer is ACTIVE (SUSPENDED/EVICTED → reject defense-in-depth)
+ *   4. Audits success or rejection
+ *   5. Emits a typed event on the eventBus for the integrator to handle
+ *
+ * Anti-coupling: dispatcher does NOT actually execute inbound tasks.
+ * That's the integrator's job. The dispatcher's contract is "deliver
+ * an envelope to the integrator's handler IFF it passes safety gates."
+ */
+import type { AgentMessage } from 'agentic-flow/transport/loader';
+import type { DiscoveryService } from '../domain/services/discovery-service.js';
+import type { AuditService } from '../domain/services/audit-service.js';
+/** What gets emitted on the event bus per messageType. */
+export declare const FEDERATION_INBOUND_EVENT_PREFIX = "federation:inbound";
+/** Reasons we reject an inbound message — constant strings, no oracle leak. */
+export type InboundRejectionReason = 'PEER_UNKNOWN' | 'PEER_SUSPENDED' | 'PEER_EVICTED' | 'MISSING_METADATA' | 'INVALID_PAYLOAD';
+/** Dispatch dependencies (kept narrow for testability). */
+export interface InboundDispatchDeps {
+    readonly discovery: Pick<DiscoveryService, 'getPeer'>;
+    readonly audit: Pick<AuditService, 'log'>;
+    readonly eventBus: {
+        emit: (event: string, data: unknown) => void;
+    };
+    readonly logger: {
+        debug: (m: string) => void;
+        warn: (m: string) => void;
+    };
+}
+/** Outcome reported to the caller (mostly for tests + observability). */
+export type InboundDispatchOutcome = {
+    readonly accepted: true;
+    readonly sourceNodeId: string;
+    readonly messageType: string;
+} | {
+    readonly accepted: false;
+    readonly reason: InboundRejectionReason;
+};
+/**
+ * Process one received message. Pure-ish: no side effects beyond audit
+ * + event emission, both injected.
+ *
+ * `address` is the wire-level remote (e.g. `192.168.1.42:54321`).
+ * `message.metadata.sourceNodeId` is the cryptographic identity claim.
+ * The two MAY differ (e.g. behind NAT) — we trust `sourceNodeId` for
+ * peer lookup since it's bound to the Ed25519 keypair.
+ */
+export declare function dispatchInbound(address: string, message: AgentMessage, deps: InboundDispatchDeps): Promise<InboundDispatchOutcome>;
+//# sourceMappingURL=inbound-dispatcher.d.ts.map

package/dist/application/inbound-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-dispatcher.d.ts","sourceRoot":"","sources":["../../src/application/inbound-dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAGxE,0DAA0D;AAC1D,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAEpE,+EAA+E;AAC/E,MAAM,MAAM,sBAAsB,GAC9B,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC;AAEtB,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,MAAM,EAAE;QACf,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;KAC3B,CAAC;CACH;AAED,yEAAyE;AACzE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAE1E;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAuEjC"}

package/dist/application/inbound-dispatcher.js

@@ -0,0 +1,96 @@
+/**
+ * Inbound message dispatcher (ADR-109).
+ *
+ * The federation plugin's `transport.listen()` accepts inbound bytes
+ * but until this module landed, the bytes had no consumer — they sat
+ * in the transport's per-address message queue with no one polling.
+ *
+ * `dispatchInbound()` is what the plugin registers as the
+ * transport.onMessage handler. For each received message it:
+ *
+ *   1. Resolves the sender via `sourceNodeId` in metadata
+ *   2. Verifies the peer is in the discovery registry (unknown → reject)
+ *   3. Verifies peer is ACTIVE (SUSPENDED/EVICTED → reject defense-in-depth)
+ *   4. Audits success or rejection
+ *   5. Emits a typed event on the eventBus for the integrator to handle
+ *
+ * Anti-coupling: dispatcher does NOT actually execute inbound tasks.
+ * That's the integrator's job. The dispatcher's contract is "deliver
+ * an envelope to the integrator's handler IFF it passes safety gates."
+ */
+import { FederationNodeState } from '../domain/value-objects/federation-node-state.js';
+/** What gets emitted on the event bus per messageType. */
+export const FEDERATION_INBOUND_EVENT_PREFIX = 'federation:inbound';
+/**
+ * Process one received message. Pure-ish: no side effects beyond audit
+ * + event emission, both injected.
+ *
+ * `address` is the wire-level remote (e.g. `192.168.1.42:54321`).
+ * `message.metadata.sourceNodeId` is the cryptographic identity claim.
+ * The two MAY differ (e.g. behind NAT) — we trust `sourceNodeId` for
+ * peer lookup since it's bound to the Ed25519 keypair.
+ */
+export async function dispatchInbound(address, message, deps) {
+    const meta = (message.metadata ?? {});
+    const sourceNodeId = typeof meta.sourceNodeId === 'string' ? meta.sourceNodeId : null;
+    if (!sourceNodeId) {
+        await deps.audit.log('message_rejected', {
+            sourceNodeId: undefined,
+            metadata: { address, reason: 'MISSING_METADATA' },
+        });
+        deps.logger.warn(`Inbound rejected: no sourceNodeId in metadata (from ${address})`);
+        return { accepted: false, reason: 'MISSING_METADATA' };
+    }
+    const peer = deps.discovery.getPeer(sourceNodeId);
+    if (!peer) {
+        await deps.audit.log('message_rejected', {
+            sourceNodeId,
+            metadata: { address, reason: 'PEER_UNKNOWN' },
+        });
+        deps.logger.warn(`Inbound rejected: ${sourceNodeId} not in discovery (from ${address})`);
+        return { accepted: false, reason: 'PEER_UNKNOWN' };
+    }
+    if (peer.state === FederationNodeState.SUSPENDED) {
+        await deps.audit.log('message_rejected', {
+            sourceNodeId,
+            metadata: { address, reason: 'PEER_SUSPENDED' },
+        });
+        return { accepted: false, reason: 'PEER_SUSPENDED' };
+    }
+    if (peer.state === FederationNodeState.EVICTED) {
+        await deps.audit.log('message_rejected', {
+            sourceNodeId,
+            metadata: { address, reason: 'PEER_EVICTED' },
+        });
+        return { accepted: false, reason: 'PEER_EVICTED' };
+    }
+    // Touch lastSeen on every successful inbound — drives the
+    // discovery service's stale-peer detection.
+    peer.markSeen();
+    // Audit accepted delivery
+    await deps.audit.log('message_received', {
+        sourceNodeId,
+        metadata: {
+            address,
+            messageType: message.type,
+            messageId: message.id,
+        },
+    });
+    // Emit typed event for the integrator
+    // Examples: federation:inbound:task, federation:inbound:memory-query
+    const eventName = `${FEDERATION_INBOUND_EVENT_PREFIX}:${message.type}`;
+    try {
+        deps.eventBus.emit(eventName, {
+            address,
+            sourceNodeId,
+            message,
+            peer,
+        });
+    }
+    catch (err) {
+        // EventBus throw should not crash the receive loop.
+        deps.logger.warn(`EventBus emit failed for ${eventName}: ${err instanceof Error ? err.message : err}`);
+    }
+    return { accepted: true, sourceNodeId, messageType: message.type };
+}
+//# sourceMappingURL=inbound-dispatcher.js.map

package/dist/application/inbound-dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-dispatcher.js","sourceRoot":"","sources":["../../src/application/inbound-dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAEvF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AA0BpE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,OAAqB,EACrB,IAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACjE,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;YACvC,YAAY,EAAE,SAAS;YACvB,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,OAAO,GAAG,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;YACvC,YAAY;YACZ,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,YAAY,2BAA2B,OAAO,GAAG,CAAC,CAAC;QACzF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;YACvC,YAAY;YACZ,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE;SAChD,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;YACvC,YAAY;YACZ,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE;SAC9C,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACrD,CAAC;IAED,0DAA0D;IAC1D,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;IAEhB,0BAA0B;IAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;QACvC,YAAY;QACZ,QAAQ,EAAE;YACR,OAAO;YACP,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB;KACF,CAAC,CAAC;IAEH,sCAAsC;IACtC,qEAAqE;IACrE,MAAM,SAAS,GAAG,GAAG,+BAA+B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;YAC5B,OAAO;YACP,YAAY;YACZ,OAAO;YACP,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oDAAoD;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACrF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC"}

package/dist/application/policy-engine.d.ts

@@ -0,0 +1,41 @@
+import { TrustLevel } from '../domain/entities/trust-level.js';
+import { type PIIAction, type PIIDetection, type PIIPolicyConfig } from '../domain/services/pii-pipeline-service.js';
+import { type FederationMessageType } from '../domain/entities/federation-envelope.js';
+export type FederationClaimType = 'federation:discover' | 'federation:connect' | 'federation:read' | 'federation:write' | 'federation:admin' | 'federation:memory' | 'federation:spawn';
+export interface SecurityPolicy {
+    readonly maxMessageSizeBytes: number;
+    readonly maxMessagesPerMinute: number;
+    readonly allowedMessageTypes: readonly FederationMessageType[];
+    readonly requirePiiScan: boolean;
+    readonly requireAiDefenceScan: boolean;
+    readonly minTrustLevelForWrite: TrustLevel;
+    readonly minTrustLevelForMemory: TrustLevel;
+    readonly minTrustLevelForSpawn: TrustLevel;
+}
+export interface PolicyEvaluationResult {
+    readonly allowed: boolean;
+    readonly reason: string;
+    readonly requiredClaims: readonly FederationClaimType[];
+    readonly trustLevelSufficient: boolean;
+    readonly piiAction?: PIIAction;
+}
+export interface PolicyEngineDeps {
+    checkClaim: (claim: FederationClaimType) => boolean;
+}
+export declare class PolicyEngine {
+    private readonly deps;
+    private readonly securityPolicy;
+    private readonly piiPolicy;
+    private readonly rateLimitCounters;
+    constructor(deps: PolicyEngineDeps, securityPolicy?: Partial<SecurityPolicy>, piiPolicy?: PIIPolicyConfig);
+    evaluateMessage(messageType: FederationMessageType, trustLevel: TrustLevel, messageSizeBytes: number, sourceNodeId: string): PolicyEvaluationResult;
+    evaluatePiiDetection(detection: PIIDetection, trustLevel: TrustLevel): PIIAction;
+    evaluateTrustChange(currentLevel: TrustLevel, proposedLevel: TrustLevel): {
+        allowed: boolean;
+        requiresHumanApproval: boolean;
+        reason: string;
+    };
+    private checkRateLimit;
+    private getOperationForMessageType;
+}
+//# sourceMappingURL=policy-engine.d.ts.map

package/dist/application/policy-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.d.ts","sourceRoot":"","sources":["../../src/application/policy-engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAsB,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,KAAK,SAAS,EAAgB,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,4CAA4C,CAAC;AACnI,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAEvF,MAAM,MAAM,mBAAmB,GAC3B,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC/D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,qBAAqB,EAAE,UAAU,CAAC;IAC3C,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC;IAC5C,QAAQ,CAAC,qBAAqB,EAAE,UAAU,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AA4CD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;CACrD;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsD;gBAGtF,IAAI,EAAE,gBAAgB,EACtB,cAAc,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EACxC,SAAS,CAAC,EAAE,eAAe;IAc7B,eAAe,CACb,WAAW,EAAE,qBAAqB,EAClC,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,GACnB,sBAAsB;IAyDzB,oBAAoB,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS;IAWhF,mBAAmB,CACjB,YAAY,EAAE,UAAU,EACxB,aAAa,EAAE,UAAU,GACxB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,qBAAqB,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAgCvE,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,0BAA0B;CAyBnC"}