@claude-flow/plugin-agent-federation 1.0.0-alpha.2

package/dist/domain/services/audit-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-service.js","sourceRoot":"","sources":["../../../src/domain/services/audit-service.ts"],"names":[],"mappings":"AAiFA,MAAM,oBAAoB,GAAuB;IAC/C,cAAc,EAAE,MAAM;IACtB,aAAa,EAAE,EAAE;IACjB,SAAS,EAAE,GAAG;CACf,CAAC;AAEF,MAAM,sBAAsB,GAAoD;IAC9E,eAAe,EAAE,MAAM;IACvB,uBAAuB,EAAE,MAAM;IAC/B,mBAAmB,EAAE,MAAM;IAC3B,mBAAmB,EAAE,MAAM;IAC3B,gBAAgB,EAAE,MAAM;IACxB,kBAAkB,EAAE,MAAM;IAC1B,eAAe,EAAE,MAAM;IACvB,eAAe,EAAE,MAAM;IACvB,eAAe,EAAE,MAAM;IACvB,kBAAkB,EAAE,MAAM;IAC1B,YAAY,EAAE,MAAM;IACpB,gBAAgB,EAAE,MAAM;IACxB,gBAAgB,EAAE,MAAM;IACxB,eAAe,EAAE,MAAM;IACvB,YAAY,EAAE,MAAM;IACpB,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,MAAM;IACnB,eAAe,EAAE,OAAO;IACxB,cAAc,EAAE,UAAU;IAC1B,cAAc,EAAE,MAAM;IACtB,aAAa,EAAE,MAAM;IACrB,YAAY,EAAE,MAAM;IACpB,mBAAmB,EAAE,MAAM;IAC3B,kBAAkB,EAAE,MAAM;IAC1B,eAAe,EAAE,MAAM;IACvB,iBAAiB,EAAE,MAAM;IACzB,gBAAgB,EAAE,MAAM;CACzB,CAAC;AAEF,MAAM,sBAAsB,GAAoD;IAC9E,eAAe,EAAE,WAAW;IAC5B,uBAAuB,EAAE,WAAW;IACpC,mBAAmB,EAAE,WAAW;IAChC,mBAAmB,EAAE,WAAW;IAChC,gBAAgB,EAAE,WAAW;IAC7B,kBAAkB,EAAE,WAAW;IAC/B,eAAe,EAAE,WAAW;IAC5B,eAAe,EAAE,WAAW;IAC5B,eAAe,EAAE,WAAW;IAC5B,kBAAkB,EAAE,WAAW;IAC/B,YAAY,EAAE,SAAS;IACvB,gBAAgB,EAAE,SAAS;IAC3B,gBAAgB,EAAE,SAAS;IAC3B,eAAe,EAAE,SAAS;IAC1B,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,UAAU;IAC3B,cAAc,EAAE,UAAU;IAC1B,cAAc,EAAE,UAAU;IAC1B,aAAa,EAAE,UAAU;IACzB,YAAY,EAAE,UAAU;IACxB,mBAAmB,EAAE,UAAU;IAC/B,kBAAkB,EAAE,WAAW;IAC/B,eAAe,EAAE,WAAW;IAC5B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;CAC9B,CAAC;AAEF,MAAM,OAAO,YAAY;IACN,IAAI,CAAmB;IACvB,MAAM,CAAqB;IAC3B,MAAM,CAAyB;IAEhD,YAAY,IAAsB,EAAE,MAAoC;QACtE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAG,CACP,SAAmC,EACnC,UAA8I,EAAE;QAEhJ,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAElD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACjF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB,EAAE,MAAyB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACzC,KAAK,QAAQ;gBACX,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAEO,UAAU,CAChB,SAAmC,EACnC,OAA2I;QAE3I,MAAM,KAAK,GAAyB;YAClC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YAClC,SAAS;YACT,QAAQ,EAAE,sBAAsB,CAAC,SAAS,CAAC;YAC3C,QAAQ,EAAE,sBAAsB,CAAC,SAAS,CAAC;YAC3C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,GAAG,OAAO;SACX,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,KAA2B;QACtD,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,iBAAiB,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACvC,OAAO,iBAAiB,CAAC,eAAe,CAAC,CAAC;YAC1C,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,MAA8B;QAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU;YACzD,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW;YACvD,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW;SAC3D,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACd,MAAM,GAAG,GAAG,CAAC,CAAC,CAA+B,CAAC,CAAC;YAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CACb,CAAC;QAEF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;CACF"}

package/dist/domain/services/discovery-service.d.ts

@@ -0,0 +1,51 @@
+import { FederationNode } from '../entities/federation-node.js';
+export type DiscoveryMechanism = 'static' | 'dns-sd' | 'ipfs-registry';
+export interface FederationManifest {
+    readonly nodeId: string;
+    readonly publicKey: string;
+    readonly endpoint: string;
+    readonly capabilities: {
+        readonly agentTypes: readonly string[];
+        readonly maxConcurrentSessions: number;
+        readonly supportedProtocols: readonly string[];
+        readonly complianceModes: readonly string[];
+    };
+    readonly version: string;
+    readonly signature: string;
+    readonly timestamp: string;
+}
+export interface DiscoveryServiceDeps {
+    signManifest: (manifest: Omit<FederationManifest, 'signature'>) => Promise<string>;
+    verifyManifest: (manifest: FederationManifest) => Promise<boolean>;
+    onPeerDiscovered?: (node: FederationNode) => void;
+}
+export interface DiscoveryConfig {
+    readonly staticPeers: readonly string[];
+    readonly enableDnsSd: boolean;
+    readonly enableIpfsRegistry: boolean;
+    readonly ipfsRegistryCid?: string;
+    readonly discoveryIntervalMs: number;
+    readonly staleThresholdMs: number;
+}
+export declare class DiscoveryService {
+    private readonly deps;
+    private readonly config;
+    private readonly knownPeers;
+    private localManifest;
+    private discoveryTimer;
+    constructor(deps: DiscoveryServiceDeps, config?: Partial<DiscoveryConfig>);
+    publishManifest(manifest: Omit<FederationManifest, 'signature'>): Promise<FederationManifest>;
+    getLocalManifest(): FederationManifest | null;
+    discoverPeers(): Promise<FederationNode[]>;
+    addStaticPeer(endpoint: string, manifest?: FederationManifest): Promise<FederationNode>;
+    removePeer(nodeId: string): boolean;
+    getPeer(nodeId: string): FederationNode | undefined;
+    listPeers(): FederationNode[];
+    listActivePeers(): FederationNode[];
+    pruneStale(): string[];
+    startPeriodicDiscovery(): void;
+    stopPeriodicDiscovery(): void;
+    private findByEndpoint;
+    private hashEndpoint;
+}
+//# sourceMappingURL=discovery-service.d.ts.map

package/dist/domain/services/discovery-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-service.d.ts","sourceRoot":"","sources":["../../../src/domain/services/discovery-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA4B,MAAM,gCAAgC,CAAC;AAG1F,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEvE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;QAC/C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnF,cAAc,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAUD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,cAAc,CAAwC;gBAElD,IAAI,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IAQnE,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAMnG,gBAAgB,IAAI,kBAAkB,GAAG,IAAI;IAIvC,aAAa,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IA2B1C,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;IAqC7F,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAInC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAInD,SAAS,IAAI,cAAc,EAAE;IAI7B,eAAe,IAAI,cAAc,EAAE;IAInC,UAAU,IAAI,MAAM,EAAE;IAWtB,sBAAsB,IAAI,IAAI;IAO9B,qBAAqB,IAAI,IAAI;IAO7B,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,YAAY;CASrB"}

package/dist/domain/services/discovery-service.js

@@ -0,0 +1,140 @@
+import { FederationNode } from '../entities/federation-node.js';
+import { TrustLevel } from '../entities/trust-level.js';
+const DEFAULT_DISCOVERY_CONFIG = {
+    staticPeers: [],
+    enableDnsSd: false,
+    enableIpfsRegistry: false,
+    discoveryIntervalMs: 60_000,
+    staleThresholdMs: 300_000,
+};
+export class DiscoveryService {
+    deps;
+    config;
+    knownPeers;
+    localManifest;
+    discoveryTimer;
+    constructor(deps, config) {
+        this.deps = deps;
+        this.config = { ...DEFAULT_DISCOVERY_CONFIG, ...config };
+        this.knownPeers = new Map();
+        this.localManifest = null;
+        this.discoveryTimer = null;
+    }
+    async publishManifest(manifest) {
+        const signature = await this.deps.signManifest(manifest);
+        this.localManifest = { ...manifest, signature };
+        return this.localManifest;
+    }
+    getLocalManifest() {
+        return this.localManifest;
+    }
+    async discoverPeers() {
+        const discovered = [];
+        for (const endpoint of this.config.staticPeers) {
+            const existing = this.findByEndpoint(endpoint);
+            if (!existing) {
+                const node = FederationNode.create({
+                    nodeId: `static-${this.hashEndpoint(endpoint)}`,
+                    publicKey: '',
+                    endpoint,
+                    capabilities: {
+                        agentTypes: [],
+                        maxConcurrentSessions: 1,
+                        supportedProtocols: ['websocket', 'http'],
+                        complianceModes: [],
+                    },
+                    metadata: { discoveryMechanism: 'static' },
+                });
+                this.knownPeers.set(node.nodeId, node);
+                discovered.push(node);
+                this.deps.onPeerDiscovered?.(node);
+            }
+        }
+        return discovered;
+    }
+    async addStaticPeer(endpoint, manifest) {
+        if (manifest) {
+            const valid = await this.deps.verifyManifest(manifest);
+            if (!valid) {
+                throw new Error(`Invalid manifest signature for endpoint: ${endpoint}`);
+            }
+        }
+        const nodeId = manifest?.nodeId ?? `static-${this.hashEndpoint(endpoint)}`;
+        const existing = this.knownPeers.get(nodeId);
+        if (existing) {
+            existing.markSeen();
+            return existing;
+        }
+        const node = FederationNode.create({
+            nodeId,
+            publicKey: manifest?.publicKey ?? '',
+            endpoint,
+            capabilities: manifest?.capabilities ?? {
+                agentTypes: [],
+                maxConcurrentSessions: 1,
+                supportedProtocols: ['websocket', 'http'],
+                complianceModes: [],
+            },
+            trustLevel: manifest ? TrustLevel.VERIFIED : TrustLevel.UNTRUSTED,
+            metadata: {
+                discoveryMechanism: 'static',
+                version: manifest?.version,
+            },
+        });
+        this.knownPeers.set(nodeId, node);
+        this.deps.onPeerDiscovered?.(node);
+        return node;
+    }
+    removePeer(nodeId) {
+        return this.knownPeers.delete(nodeId);
+    }
+    getPeer(nodeId) {
+        return this.knownPeers.get(nodeId);
+    }
+    listPeers() {
+        return Array.from(this.knownPeers.values());
+    }
+    listActivePeers() {
+        return this.listPeers().filter(p => !p.isStale(this.config.staleThresholdMs));
+    }
+    pruneStale() {
+        const pruned = [];
+        for (const [nodeId, node] of this.knownPeers) {
+            if (node.isStale(this.config.staleThresholdMs)) {
+                this.knownPeers.delete(nodeId);
+                pruned.push(nodeId);
+            }
+        }
+        return pruned;
+    }
+    startPeriodicDiscovery() {
+        if (this.discoveryTimer)
+            return;
+        this.discoveryTimer = setInterval(() => {
+            this.discoverPeers().catch(() => { });
+        }, this.config.discoveryIntervalMs);
+    }
+    stopPeriodicDiscovery() {
+        if (this.discoveryTimer) {
+            clearInterval(this.discoveryTimer);
+            this.discoveryTimer = null;
+        }
+    }
+    findByEndpoint(endpoint) {
+        for (const node of this.knownPeers.values()) {
+            if (node.endpoint === endpoint)
+                return node;
+        }
+        return undefined;
+    }
+    hashEndpoint(endpoint) {
+        let hash = 0;
+        for (let i = 0; i < endpoint.length; i++) {
+            const char = endpoint.charCodeAt(i);
+            hash = ((hash << 5) - hash) + char;
+            hash |= 0;
+        }
+        return Math.abs(hash).toString(36);
+    }
+}
+//# sourceMappingURL=discovery-service.js.map

package/dist/domain/services/discovery-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-service.js","sourceRoot":"","sources":["../../../src/domain/services/discovery-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA4B,MAAM,gCAAgC,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAkCxD,MAAM,wBAAwB,GAAoB;IAChD,WAAW,EAAE,EAAE;IACf,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,KAAK;IACzB,mBAAmB,EAAE,MAAM;IAC3B,gBAAgB,EAAE,OAAO;CAC1B,CAAC;AAEF,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAuB;IAC3B,MAAM,CAAkB;IACxB,UAAU,CAA8B;IACjD,aAAa,CAA4B;IACzC,cAAc,CAAwC;IAE9D,YAAY,IAA0B,EAAE,MAAiC;QACvE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,wBAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAA+C;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC;oBACjC,MAAM,EAAE,UAAU,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;oBAC/C,SAAS,EAAE,EAAE;oBACb,QAAQ;oBACR,YAAY,EAAE;wBACZ,UAAU,EAAE,EAAE;wBACd,qBAAqB,EAAE,CAAC;wBACxB,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;wBACzC,eAAe,EAAE,EAAE;qBACpB;oBACD,QAAQ,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE;iBAC3C,CAAC,CAAC;gBACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAA6B;QACjE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,UAAU,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC;YACjC,MAAM;YACN,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE;YACpC,QAAQ;YACR,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI;gBACtC,UAAU,EAAE,EAAE;gBACd,qBAAqB,EAAE,CAAC;gBACxB,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;gBACzC,eAAe,EAAE,EAAE;aACpB;YACD,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS;YACjE,QAAQ,EAAE;gBACR,kBAAkB,EAAE,QAA8B;gBAClD,OAAO,EAAE,QAAQ,EAAE,OAAO;aAC3B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,SAAS;QACP,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,UAAU;QACR,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sBAAsB;QACpB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;YACrC,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IAED,qBAAqB;QACnB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACnC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/domain/services/handshake-service.d.ts

@@ -0,0 +1,48 @@
+import { FederationNode } from '../entities/federation-node.js';
+import { FederationSession } from '../entities/federation-session.js';
+export interface HandshakeChallenge {
+    readonly challengeId: string;
+    readonly nonce: string;
+    readonly timestamp: string;
+    readonly sourceNodeId: string;
+    readonly targetNodeId: string;
+}
+export interface HandshakeChallengeResponse {
+    readonly challengeId: string;
+    readonly signedNonce: string;
+    readonly publicKey: string;
+    readonly capabilities: readonly string[];
+}
+export interface HandshakeResult {
+    readonly success: boolean;
+    readonly session?: FederationSession;
+    readonly error?: string;
+}
+export interface HandshakeServiceDeps {
+    generateSessionId: () => string;
+    generateSessionToken: () => string;
+    generateNonce: () => string;
+    signChallenge: (nonce: string) => Promise<string>;
+    verifySignature: (nonce: string, signature: string, publicKey: string) => Promise<boolean>;
+    getLocalNodeId: () => string;
+    getLocalPublicKey: () => string;
+    getLocalCapabilities: () => readonly string[];
+}
+export interface HandshakeConfig {
+    readonly sessionTtlMs: number;
+    readonly maxSessionTtlMs: number;
+    readonly heartbeatIntervalMs: number;
+    readonly challengeTimeoutMs: number;
+}
+export declare class HandshakeService {
+    private readonly deps;
+    private readonly config;
+    private readonly pendingChallenges;
+    constructor(deps: HandshakeServiceDeps, config?: Partial<HandshakeConfig>);
+    initiateHandshake(remoteNode: FederationNode): Promise<HandshakeChallenge>;
+    respondToHandshake(challenge: HandshakeChallenge): Promise<HandshakeChallengeResponse>;
+    verifyChallenge(response: HandshakeChallengeResponse, remoteNode: FederationNode): Promise<HandshakeResult>;
+    renewSession(session: FederationSession): FederationSession;
+    private cleanExpiredChallenges;
+}
+//# sourceMappingURL=handshake-service.d.ts.map

package/dist/domain/services/handshake-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake-service.d.ts","sourceRoot":"","sources":["../../../src/domain/services/handshake-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAuB,MAAM,mCAAmC,CAAC;AAG3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,MAAM,CAAC;IACnC,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3F,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AASD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoE;gBAE1F,IAAI,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IAMnE,iBAAiB,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmB1E,kBAAkB,CAAC,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAWtF,eAAe,CACnB,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,eAAe,CAAC;IAiD3B,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB;IAY3D,OAAO,CAAC,sBAAsB;CAQ/B"}

package/dist/domain/services/handshake-service.js

@@ -0,0 +1,94 @@
+import { FederationSession } from '../entities/federation-session.js';
+import { TrustLevel } from '../entities/trust-level.js';
+const DEFAULT_HANDSHAKE_CONFIG = {
+    sessionTtlMs: 3_600_000,
+    maxSessionTtlMs: 86_400_000,
+    heartbeatIntervalMs: 30_000,
+    challengeTimeoutMs: 10_000,
+};
+export class HandshakeService {
+    deps;
+    config;
+    pendingChallenges;
+    constructor(deps, config) {
+        this.deps = deps;
+        this.config = { ...DEFAULT_HANDSHAKE_CONFIG, ...config };
+        this.pendingChallenges = new Map();
+    }
+    async initiateHandshake(remoteNode) {
+        const nonce = this.deps.generateNonce();
+        const challenge = {
+            challengeId: this.deps.generateSessionId(),
+            nonce,
+            timestamp: new Date().toISOString(),
+            sourceNodeId: this.deps.getLocalNodeId(),
+            targetNodeId: remoteNode.nodeId,
+        };
+        this.pendingChallenges.set(challenge.challengeId, {
+            challenge,
+            expiresAt: Date.now() + this.config.challengeTimeoutMs,
+        });
+        this.cleanExpiredChallenges();
+        return challenge;
+    }
+    async respondToHandshake(challenge) {
+        const signedNonce = await this.deps.signChallenge(challenge.nonce);
+        return {
+            challengeId: challenge.challengeId,
+            signedNonce,
+            publicKey: this.deps.getLocalPublicKey(),
+            capabilities: this.deps.getLocalCapabilities(),
+        };
+    }
+    async verifyChallenge(response, remoteNode) {
+        const pending = this.pendingChallenges.get(response.challengeId);
+        if (!pending) {
+            return { success: false, error: 'Unknown or expired challenge' };
+        }
+        if (Date.now() > pending.expiresAt) {
+            this.pendingChallenges.delete(response.challengeId);
+            return { success: false, error: 'Challenge expired' };
+        }
+        const isValid = await this.deps.verifySignature(pending.challenge.nonce, response.signedNonce, response.publicKey);
+        this.pendingChallenges.delete(response.challengeId);
+        if (!isValid) {
+            return { success: false, error: 'Invalid challenge signature' };
+        }
+        const localCapabilities = this.deps.getLocalCapabilities();
+        const negotiatedCapabilities = localCapabilities.filter(cap => response.capabilities.includes(cap));
+        const now = new Date();
+        const session = new FederationSession({
+            sessionId: this.deps.generateSessionId(),
+            localNodeId: this.deps.getLocalNodeId(),
+            remoteNodeId: remoteNode.nodeId,
+            trustLevel: TrustLevel.ATTESTED,
+            negotiatedCapabilities,
+            createdAt: now,
+            expiresAt: new Date(now.getTime() + this.config.sessionTtlMs),
+            heartbeatInterval: this.config.heartbeatIntervalMs,
+            sessionToken: this.deps.generateSessionToken(),
+            metrics: FederationSession.createMetrics(),
+        });
+        remoteNode.updateTrustLevel(TrustLevel.ATTESTED);
+        remoteNode.markSeen();
+        return { success: true, session };
+    }
+    renewSession(session) {
+        const remainingTtl = this.config.maxSessionTtlMs - (Date.now() - session.createdAt.getTime());
+        const renewalTtl = Math.min(this.config.sessionTtlMs, remainingTtl);
+        if (renewalTtl <= 0) {
+            throw new Error('Session has exceeded maximum TTL and cannot be renewed');
+        }
+        session.renew(new Date(Date.now() + renewalTtl));
+        return session;
+    }
+    cleanExpiredChallenges() {
+        const now = Date.now();
+        for (const [id, pending] of this.pendingChallenges) {
+            if (now > pending.expiresAt) {
+                this.pendingChallenges.delete(id);
+            }
+        }
+    }
+}
+//# sourceMappingURL=handshake-service.js.map

package/dist/domain/services/handshake-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake-service.js","sourceRoot":"","sources":["../../../src/domain/services/handshake-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAuB,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAyCxD,MAAM,wBAAwB,GAAoB;IAChD,YAAY,EAAE,SAAS;IACvB,eAAe,EAAE,UAAU;IAC3B,mBAAmB,EAAE,MAAM;IAC3B,kBAAkB,EAAE,MAAM;CAC3B,CAAC;AAEF,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAuB;IAC3B,MAAM,CAAkB;IACxB,iBAAiB,CAAoE;IAEtG,YAAY,IAA0B,EAAE,MAAiC;QACvE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,wBAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAA0B;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,SAAS,GAAuB;YACpC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC1C,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YACxC,YAAY,EAAE,UAAU,CAAC,MAAM;SAChC,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YAChD,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAA6B;QACpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEnE,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YACxC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,QAAoC,EACpC,UAA0B;QAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAC7C,OAAO,CAAC,SAAS,CAAC,KAAK,EACvB,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,SAAS,CACnB,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClE,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,MAAM,CACrD,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC3C,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YACxC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YACvC,YAAY,EAAE,UAAU,CAAC,MAAM;YAC/B,UAAU,EAAE,UAAU,CAAC,QAAQ;YAC/B,sBAAsB;YACtB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7D,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAClD,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE;YAC9C,OAAO,EAAE,iBAAiB,CAAC,aAAa,EAAE;SAC3C,CAAC,CAAC;QAEH,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjD,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,YAAY,CAAC,OAA0B;QACrC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAEpE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,sBAAsB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACnD,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/domain/services/pii-pipeline-service.d.ts

@@ -0,0 +1,65 @@
+import { TrustLevel } from '../entities/trust-level.js';
+export type PIIType = 'email' | 'ssn' | 'credit_card' | 'api_key' | 'password' | 'name' | 'address' | 'phone' | 'ip_address' | 'jwt' | 'aws_key' | 'private_key' | 'database_url' | 'github_token';
+export type PIIAction = 'block' | 'redact' | 'hash' | 'pass';
+export interface PIIDetection {
+    readonly type: PIIType;
+    readonly value: string;
+    readonly confidence: number;
+    readonly offset: number;
+    readonly context: string;
+}
+export interface PIIPolicyConfig {
+    defaultAction: PIIAction;
+    overrides: Partial<Record<PIIType, {
+        action: PIIAction;
+        trustLevelOverride?: Partial<Record<TrustLevel, PIIAction>>;
+    }>>;
+    hashAlgorithm: 'sha256' | 'blake3';
+    hashSalt: string;
+    redactionPlaceholder: string;
+}
+export interface PIICalibration {
+    type: PIIType;
+    falsePositiveRate: number;
+    falseNegativeRate: number;
+    adjustedThreshold: number;
+    totalOverrides: number;
+    lastCalibrated: string;
+}
+export interface PIITransformResult {
+    readonly originalText: string;
+    readonly transformedText: string;
+    readonly detections: readonly PIIDetection[];
+    readonly actionsApplied: readonly {
+        type: PIIType;
+        action: PIIAction;
+    }[];
+    readonly blocked: boolean;
+}
+export interface PIIConfidenceThresholds {
+    autoBlock: number;
+    autoRedact: number;
+    flagForReview: number;
+    ignore: number;
+}
+export interface PIIPipelineServiceDeps {
+    hashFunction: (value: string, salt: string) => string;
+}
+export declare class PIIPipelineService {
+    private readonly deps;
+    private readonly policy;
+    private readonly calibrations;
+    private readonly confidenceThresholds;
+    constructor(deps: PIIPipelineServiceDeps, policy?: Partial<PIIPolicyConfig>, confidenceThresholds?: Partial<PIIConfidenceThresholds>);
+    detect(text: string): PIIDetection[];
+    classify(detections: PIIDetection[]): Map<PIIType, PIIDetection[]>;
+    evaluate(detection: PIIDetection, trustLevel: TrustLevel): PIIAction;
+    transform(text: string, trustLevel: TrustLevel): PIITransformResult;
+    updateCalibration(type: PIIType, calibration: PIICalibration): void;
+    getCalibration(type: PIIType): PIICalibration | undefined;
+    private computeConfidence;
+    private getEffectiveThreshold;
+    static defaultPolicy(): PIIPolicyConfig;
+    static defaultPolicyMatrix(): Record<PIIType, Record<TrustLevel, PIIAction>>;
+}
+//# sourceMappingURL=pii-pipeline-service.d.ts.map

package/dist/domain/services/pii-pipeline-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-pipeline-service.d.ts","sourceRoot":"","sources":["../../../src/domain/services/pii-pipeline-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,UAAU,GAC1E,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,GAAG,KAAK,GACnD,SAAS,GAAG,aAAa,GAAG,cAAc,GAAG,cAAc,CAAC;AAEhE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,SAAS,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE;QACjC,MAAM,EAAE,SAAS,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC,CAAC;IACJ,aAAa,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,SAAS;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AA2CD,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvD;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA0B;gBAG7D,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,EACjC,oBAAoB,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC;IAczD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE;IAyBpC,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;IAYlE,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS;IAkBpE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,kBAAkB;IA+CnE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,GAAG,IAAI;IAInE,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS;IAIzD,OAAO,CAAC,iBAAiB;IA6CzB,OAAO,CAAC,qBAAqB;IAQ7B,MAAM,CAAC,aAAa,IAAI,eAAe;IAUvC,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;CAG7E"}

package/dist/domain/services/pii-pipeline-service.js

@@ -0,0 +1,208 @@
+import { TrustLevel } from '../entities/trust-level.js';
+const DEFAULT_CONFIDENCE_THRESHOLDS = {
+    autoBlock: 0.95,
+    autoRedact: 0.85,
+    flagForReview: 0.6,
+    ignore: 0.6,
+};
+const PII_PATTERNS = {
+    email: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
+    ssn: /\b\d{3}-\d{2}-\d{4}\b/g,
+    credit_card: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
+    api_key: /\b(?:sk-[a-zA-Z0-9]{20,}|key-[a-zA-Z0-9]{20,})\b/g,
+    password: /(?:password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
+    name: /\b(?:Mr\.|Mrs\.|Ms\.|Dr\.)\s+[A-Z][a-z]+(?:\s+[A-Z][a-z]+)+\b/g,
+    address: /\b\d{1,5}\s+(?:[A-Z][a-z]+\s+){1,3}(?:St|Ave|Blvd|Dr|Ln|Rd|Way|Ct)\b/g,
+    phone: /(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g,
+    ip_address: /\b(?:\d{1,3}\.){3}\d{1,3}\b|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/g,
+    jwt: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
+    aws_key: /\bAKIA[0-9A-Z]{16}\b/g,
+    private_key: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+)?PRIVATE\s+KEY-----/g,
+    database_url: /(?:postgres|mysql|mongodb|redis):\/\/[^\s]+/g,
+    github_token: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}\b/g,
+};
+const DEFAULT_POLICY_MATRIX = {
+    ssn: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'block' },
+    credit_card: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'block' },
+    api_key: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'redact' },
+    password: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'block' },
+    email: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'redact', [TrustLevel.TRUSTED]: 'hash', [TrustLevel.PRIVILEGED]: 'pass' },
+    phone: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'redact', [TrustLevel.TRUSTED]: 'hash', [TrustLevel.PRIVILEGED]: 'pass' },
+    name: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'redact', [TrustLevel.TRUSTED]: 'redact', [TrustLevel.PRIVILEGED]: 'pass' },
+    ip_address: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'hash', [TrustLevel.TRUSTED]: 'hash', [TrustLevel.PRIVILEGED]: 'pass' },
+    jwt: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'redact' },
+    aws_key: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'block' },
+    private_key: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'block' },
+    database_url: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'redact' },
+    github_token: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'block', [TrustLevel.TRUSTED]: 'block', [TrustLevel.PRIVILEGED]: 'redact' },
+    address: { [TrustLevel.UNTRUSTED]: 'block', [TrustLevel.VERIFIED]: 'block', [TrustLevel.ATTESTED]: 'redact', [TrustLevel.TRUSTED]: 'redact', [TrustLevel.PRIVILEGED]: 'pass' },
+};
+export class PIIPipelineService {
+    deps;
+    policy;
+    calibrations;
+    confidenceThresholds;
+    constructor(deps, policy, confidenceThresholds) {
+        this.deps = deps;
+        this.policy = {
+            defaultAction: policy?.defaultAction ?? 'redact',
+            overrides: policy?.overrides ?? {},
+            hashAlgorithm: policy?.hashAlgorithm ?? 'sha256',
+            hashSalt: policy?.hashSalt ?? '',
+            redactionPlaceholder: policy?.redactionPlaceholder ?? '[REDACTED:{type}]',
+        };
+        this.calibrations = new Map();
+        this.confidenceThresholds = { ...DEFAULT_CONFIDENCE_THRESHOLDS, ...confidenceThresholds };
+    }
+    detect(text) {
+        const detections = [];
+        for (const [type, pattern] of Object.entries(PII_PATTERNS)) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(text)) !== null) {
+                const contextStart = Math.max(0, match.index - 20);
+                const contextEnd = Math.min(text.length, match.index + match[0].length + 20);
+                const confidence = this.computeConfidence(type, match[0], text);
+                detections.push({
+                    type: type,
+                    value: match[0],
+                    confidence,
+                    offset: match.index,
+                    context: text.slice(contextStart, contextEnd),
+                });
+            }
+        }
+        return detections.sort((a, b) => b.offset - a.offset);
+    }
+    classify(detections) {
+        const classified = new Map();
+        for (const detection of detections) {
+            const existing = classified.get(detection.type) ?? [];
+            existing.push(detection);
+            classified.set(detection.type, existing);
+        }
+        return classified;
+    }
+    evaluate(detection, trustLevel) {
+        if (detection.confidence < this.getEffectiveThreshold(detection.type)) {
+            return 'pass';
+        }
+        const override = this.policy.overrides[detection.type];
+        if (override?.trustLevelOverride?.[trustLevel]) {
+            return override.trustLevelOverride[trustLevel];
+        }
+        const defaultMatrix = DEFAULT_POLICY_MATRIX[detection.type];
+        if (defaultMatrix) {
+            return defaultMatrix[trustLevel];
+        }
+        return this.policy.defaultAction;
+    }
+    transform(text, trustLevel) {
+        const detections = this.detect(text);
+        const actionsApplied = [];
+        let transformedText = text;
+        let blocked = false;
+        const sortedDetections = [...detections].sort((a, b) => b.offset - a.offset);
+        for (const detection of sortedDetections) {
+            const action = this.evaluate(detection, trustLevel);
+            actionsApplied.push({ type: detection.type, action });
+            switch (action) {
+                case 'block':
+                    blocked = true;
+                    break;
+                case 'redact': {
+                    const placeholder = this.policy.redactionPlaceholder.replace('{type}', detection.type);
+                    transformedText =
+                        transformedText.slice(0, detection.offset) +
+                            placeholder +
+                            transformedText.slice(detection.offset + detection.value.length);
+                    break;
+                }
+                case 'hash': {
+                    const hashed = this.deps.hashFunction(detection.value, this.policy.hashSalt);
+                    const hashPlaceholder = `[HASH:${detection.type}:${hashed.slice(0, 8)}]`;
+                    transformedText =
+                        transformedText.slice(0, detection.offset) +
+                            hashPlaceholder +
+                            transformedText.slice(detection.offset + detection.value.length);
+                    break;
+                }
+                case 'pass':
+                    break;
+            }
+        }
+        return {
+            originalText: text,
+            transformedText: blocked ? '' : transformedText,
+            detections,
+            actionsApplied,
+            blocked,
+        };
+    }
+    updateCalibration(type, calibration) {
+        this.calibrations.set(type, calibration);
+    }
+    getCalibration(type) {
+        return this.calibrations.get(type);
+    }
+    computeConfidence(type, value, _fullText) {
+        const calibration = this.calibrations.get(type);
+        let baseConfidence;
+        switch (type) {
+            case 'ssn':
+            case 'credit_card':
+            case 'aws_key':
+            case 'github_token':
+                baseConfidence = 0.95;
+                break;
+            case 'email':
+            case 'jwt':
+            case 'private_key':
+            case 'database_url':
+                baseConfidence = 0.9;
+                break;
+            case 'api_key':
+            case 'password':
+                baseConfidence = 0.85;
+                break;
+            case 'phone':
+            case 'ip_address':
+                baseConfidence = 0.8;
+                break;
+            case 'name':
+            case 'address':
+                baseConfidence = 0.7;
+                break;
+            default:
+                baseConfidence = 0.75;
+        }
+        if (value.length < 5) {
+            baseConfidence *= 0.8;
+        }
+        if (calibration && calibration.totalOverrides > 10) {
+            const fpAdjustment = calibration.falsePositiveRate * 0.1;
+            baseConfidence = Math.max(0.1, baseConfidence - fpAdjustment);
+        }
+        return Math.min(1.0, Math.max(0.0, baseConfidence));
+    }
+    getEffectiveThreshold(type) {
+        const calibration = this.calibrations.get(type);
+        if (calibration && calibration.totalOverrides > 10) {
+            return calibration.adjustedThreshold;
+        }
+        return this.confidenceThresholds.ignore;
+    }
+    static defaultPolicy() {
+        return {
+            defaultAction: 'redact',
+            overrides: {},
+            hashAlgorithm: 'sha256',
+            hashSalt: '',
+            redactionPlaceholder: '[REDACTED:{type}]',
+        };
+    }
+    static defaultPolicyMatrix() {
+        return { ...DEFAULT_POLICY_MATRIX };
+    }
+}
+//# sourceMappingURL=pii-pipeline-service.js.map