@claude-flow/plugin-agent-federation 1.0.0-alpha.8 → 1.0.0

package/dist/a2a/planner-descriptor.js

@@ -0,0 +1,100 @@
+import { validateAgentCard } from './agent-card.js';
+const CAPABILITY_ID_RE = /^[A-Za-z0-9](?:[A-Za-z0-9._:/-]{0,126}[A-Za-z0-9])?$/;
+const FORBIDDEN_CONTROLS_RE = /[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2060\u2066-\u2069\ufeff]/u;
+const MAX_REMOTE_SKILLS = 256;
+const MAX_CAPABILITIES = 32;
+const MAX_FIELD_CHARS = 2_048;
+const MAX_CONSTRAINTS = 16;
+const MAX_CONSTRAINT_CHARS = 512;
+/**
+ * Project a third-party A2A Agent Card into planner-visible metadata.
+ *
+ * Security boundary: card descriptions, skill descriptions, examples, tags,
+ * provider text, documentation URLs, extension parameters, and all other
+ * remote prose are deliberately absent from the return type. Only a bounded
+ * canonical skill identifier may cross the registration boundary, and its
+ * planner semantics come from a host-controlled resolver.
+ */
+export function projectPlannerSafeAgentCard(card, policy) {
+    const validation = validateAgentCard(card);
+    if (!validation.valid) {
+        throw new Error('A2A Agent Card is structurally invalid');
+    }
+    if (card.skills.length > MAX_REMOTE_SKILLS) {
+        throw new Error('A2A Agent Card exceeds the remote skill limit');
+    }
+    const maximumCapabilities = policy.maximumCapabilities ?? MAX_CAPABILITIES;
+    if (!Number.isSafeInteger(maximumCapabilities) || maximumCapabilities < 1 || maximumCapabilities > MAX_CAPABILITIES) {
+        throw new Error('Planner capability limit is invalid');
+    }
+    const capabilities = [];
+    const seen = new Set();
+    let rejectedSkillCount = 0;
+    let duplicateSkillCount = 0;
+    for (const skill of card.skills) {
+        const id = canonicalCapabilityId(skill.id);
+        if (id === undefined) {
+            rejectedSkillCount += 1;
+            continue;
+        }
+        if (seen.has(id)) {
+            duplicateSkillCount += 1;
+            continue;
+        }
+        seen.add(id);
+        const resolved = policy.resolveCapability(id);
+        if (resolved === undefined) {
+            rejectedSkillCount += 1;
+            continue;
+        }
+        capabilities.push(validateResolvedCapability(id, resolved));
+        if (capabilities.length >= maximumCapabilities)
+            break;
+    }
+    return {
+        descriptor: {
+            schema: 'ruflo/planner-safe-agent-descriptor/v1',
+            source: 'a2a-agent-card',
+            capabilities,
+            authority: 'none',
+        },
+        rejectedSkillCount,
+        duplicateSkillCount,
+    };
+}
+function canonicalCapabilityId(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const normalized = value.normalize('NFKC');
+    if (FORBIDDEN_CONTROLS_RE.test(normalized))
+        return undefined;
+    if (!CAPABILITY_ID_RE.test(normalized))
+        return undefined;
+    return normalized;
+}
+function validateResolvedCapability(expectedId, definition) {
+    const id = canonicalCapabilityId(definition.id);
+    if (id === undefined || id !== expectedId) {
+        throw new Error('Resolved planner capability identifier does not match registration identifier');
+    }
+    if (!Array.isArray(definition.usageConstraints) || definition.usageConstraints.length > MAX_CONSTRAINTS) {
+        throw new Error('Resolved planner capability constraints are invalid');
+    }
+    return {
+        id,
+        functionality: canonicalPlannerText(definition.functionality, MAX_FIELD_CHARS, 'functionality'),
+        inputSpecification: canonicalPlannerText(definition.inputSpecification, MAX_FIELD_CHARS, 'input specification'),
+        outputSpecification: canonicalPlannerText(definition.outputSpecification, MAX_FIELD_CHARS, 'output specification'),
+        usageConstraints: definition.usageConstraints.map((constraint) => canonicalPlannerText(constraint, MAX_CONSTRAINT_CHARS, 'usage constraint')),
+    };
+}
+function canonicalPlannerText(value, maximumChars, field) {
+    if (typeof value !== 'string')
+        throw new Error(`Resolved planner ${field} must be text`);
+    const normalized = value.normalize('NFKC').trim();
+    if (normalized.length < 1 || normalized.length > maximumChars || FORBIDDEN_CONTROLS_RE.test(normalized)) {
+        throw new Error(`Resolved planner ${field} is invalid`);
+    }
+    return normalized;
+}
+//# sourceMappingURL=planner-descriptor.js.map

package/dist/a2a/planner-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner-descriptor.js","sourceRoot":"","sources":["../../src/a2a/planner-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAqB,MAAM,iBAAiB,CAAC;AAEvE,MAAM,gBAAgB,GAAG,sDAAsD,CAAC;AAChF,MAAM,qBAAqB,GAAG,kFAAkF,CAAC;AACjH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAkCjC;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAkB,EAClB,MAA+B;IAE/B,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,IAAI,gBAAgB,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,GAAG,gBAAgB,EAAE,CAAC;QACpH,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,YAAY,GAAkC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAE5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,kBAAkB,IAAI,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,mBAAmB,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEb,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,kBAAkB,IAAI,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5D,IAAI,YAAY,CAAC,MAAM,IAAI,mBAAmB;YAAE,MAAM;IACxD,CAAC;IAED,OAAO;QACL,UAAU,EAAE;YACV,MAAM,EAAE,wCAAwC;YAChD,MAAM,EAAE,gBAAgB;YACxB,YAAY;YACZ,SAAS,EAAE,MAAM;SAClB;QACD,kBAAkB;QAClB,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAkB,EAClB,UAAuC;IAEvC,MAAM,EAAE,GAAG,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,EAAE;QACF,aAAa,EAAE,oBAAoB,CAAC,UAAU,CAAC,aAAa,EAAE,eAAe,EAAE,eAAe,CAAC;QAC/F,kBAAkB,EAAE,oBAAoB,CAAC,UAAU,CAAC,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,CAAC;QAC/G,mBAAmB,EAAE,oBAAoB,CAAC,UAAU,CAAC,mBAAmB,EAAE,eAAe,EAAE,sBAAsB,CAAC;QAClH,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC/D,oBAAoB,CAAC,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAC3E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,YAAoB,EAAE,KAAa;IAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,eAAe,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,YAAY,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,aAAa,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/a2a/well-known.d.ts

@@ -0,0 +1,46 @@
+/**
+ * A2A well-known Agent Card endpoint (A2A 1.0 §8.2 discovery + §8.6 caching).
+ *
+ * Serves `GET /.well-known/agent-card.json` from a minimal `node:http`
+ * server. Security posture follows ADR-166 (mcp-bridge unauthenticated-RCE
+ * remediation): binds 127.0.0.1 by default and REFUSES a non-loopback bind
+ * unless the caller passes `allowNonLoopback: true` explicitly. The endpoint
+ * is read-only (GET/HEAD on one exact path), exposes only the public card,
+ * and is entirely opt-in — nothing here weakens the federation transport's
+ * existing bind or auth behavior.
+ */
+import { type A2AAgentCard } from './agent-card.js';
+export interface AgentCardServerOptions {
+    /** Card supplier — re-invoked per request so a late-published manifest is picked up. */
+    readonly getCard: () => A2AAgentCard | null;
+    readonly port: number;
+    /** Bind host. Default 127.0.0.1 (ADR-166 posture). */
+    readonly host?: string;
+    /** Serve path. Default A2A_WELL_KNOWN_PATH. */
+    readonly path?: string;
+    /**
+     * Explicit opt-in required to bind anything other than loopback. Without
+     * it a non-loopback host is rejected at start (fail-closed).
+     */
+    readonly allowNonLoopback?: boolean;
+    /** Cache-Control max-age seconds (spec §8.6.1). Default 300. */
+    readonly cacheMaxAgeSeconds?: number;
+}
+export interface AgentCardServerHandle {
+    readonly url: string;
+    readonly host: string;
+    readonly port: number;
+    close(): Promise<void>;
+}
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Start the well-known Agent Card HTTP endpoint.
+ *
+ * Responses:
+ *   GET/HEAD <path>  → 200 application/json (+ Cache-Control, ETag per §8.6)
+ *                      or 503 when no card is available yet
+ *   other method     → 405
+ *   other path       → 404
+ */
+export declare function startAgentCardServer(options: AgentCardServerOptions): Promise<AgentCardServerHandle>;
+//# sourceMappingURL=well-known.d.ts.map

package/dist/a2a/well-known.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/a2a/well-known.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEzE,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,YAAY,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA6DhC"}

package/dist/a2a/well-known.js

@@ -0,0 +1,84 @@
+/**
+ * A2A well-known Agent Card endpoint (A2A 1.0 §8.2 discovery + §8.6 caching).
+ *
+ * Serves `GET /.well-known/agent-card.json` from a minimal `node:http`
+ * server. Security posture follows ADR-166 (mcp-bridge unauthenticated-RCE
+ * remediation): binds 127.0.0.1 by default and REFUSES a non-loopback bind
+ * unless the caller passes `allowNonLoopback: true` explicitly. The endpoint
+ * is read-only (GET/HEAD on one exact path), exposes only the public card,
+ * and is entirely opt-in — nothing here weakens the federation transport's
+ * existing bind or auth behavior.
+ */
+import { createServer } from 'node:http';
+import { createHash } from 'node:crypto';
+import { A2A_WELL_KNOWN_PATH } from './agent-card.js';
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
+export function isLoopbackHost(host) {
+    return LOOPBACK_HOSTS.has(host) || host.startsWith('127.');
+}
+/**
+ * Start the well-known Agent Card HTTP endpoint.
+ *
+ * Responses:
+ *   GET/HEAD <path>  → 200 application/json (+ Cache-Control, ETag per §8.6)
+ *                      or 503 when no card is available yet
+ *   other method     → 405
+ *   other path       → 404
+ */
+export function startAgentCardServer(options) {
+    const host = options.host ?? '127.0.0.1';
+    const path = options.path ?? A2A_WELL_KNOWN_PATH;
+    const maxAge = options.cacheMaxAgeSeconds ?? 300;
+    if (!isLoopbackHost(host) && options.allowNonLoopback !== true) {
+        return Promise.reject(new Error(`A2A agent-card server: refusing non-loopback bind ${host} without allowNonLoopback: true (ADR-166)`));
+    }
+    const server = createServer((req, res) => {
+        const reqPath = (req.url ?? '').split('?')[0];
+        if (reqPath !== path) {
+            res.writeHead(404, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: 'not_found', agentCardPath: path }));
+            return;
+        }
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            res.writeHead(405, { allow: 'GET, HEAD', 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: 'method_not_allowed' }));
+            return;
+        }
+        const card = options.getCard();
+        if (!card) {
+            res.writeHead(503, { 'content-type': 'application/json', 'retry-after': '5' });
+            res.end(JSON.stringify({ error: 'agent_card_not_ready' }));
+            return;
+        }
+        const body = JSON.stringify(card, null, 2);
+        const etag = `"${createHash('sha256').update(body).digest('hex').slice(0, 32)}"`;
+        if (req.headers['if-none-match'] === etag) {
+            res.writeHead(304, { etag });
+            res.end();
+            return;
+        }
+        res.writeHead(200, {
+            'content-type': 'application/json',
+            'cache-control': `public, max-age=${maxAge}`,
+            etag,
+        });
+        res.end(req.method === 'HEAD' ? undefined : body);
+    });
+    return new Promise((resolvePromise, rejectPromise) => {
+        server.once('error', rejectPromise);
+        server.listen(options.port, host, () => {
+            server.removeListener('error', rejectPromise);
+            const addr = server.address();
+            const boundPort = typeof addr === 'object' && addr !== null ? addr.port : options.port;
+            resolvePromise({
+                url: `http://${host}:${boundPort}${path}`,
+                host,
+                port: boundPort,
+                close: () => new Promise((res2, rej2) => {
+                    server.close((err) => (err ? rej2(err) : res2()));
+                }),
+            });
+        });
+    });
+}
+//# sourceMappingURL=well-known.js.map

package/dist/a2a/well-known.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/a2a/well-known.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAqB,MAAM,iBAAiB,CAAC;AA0BzE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC;IAEjD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAC7B,qDAAqD,IAAI,2CAA2C,CACrG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QACjF,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7B,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,mBAAmB,MAAM,EAAE;YAC5C,IAAI;SACL,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YACvF,cAAc,CAAC;gBACb,GAAG,EAAE,UAAU,IAAI,IAAI,SAAS,GAAG,IAAI,EAAE;gBACzC,IAAI;gBACJ,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;oBAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACpD,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/application/claim-checker.d.ts

@@ -0,0 +1,27 @@
+import type { FederationClaimType, PolicyEngineDeps } from './policy-engine.js';
+export type FederationAuthorizationMode = 'legacy' | 'observe' | 'enforce';
+export interface FederationClaimCheckerConfig {
+    mode?: FederationAuthorizationMode;
+    grantedClaims?: readonly string[];
+    onObservation?: (claim: FederationClaimType, granted: boolean) => void;
+}
+export interface FederationClaimChecker {
+    mode: FederationAuthorizationMode;
+    grantedClaims: ReadonlySet<FederationClaimType>;
+    checkClaim: PolicyEngineDeps['checkClaim'];
+}
+/**
+ * Compatibility bridge for the legacy federation policy engine.
+ *
+ * This removes the anonymous `() => true` production stub and makes
+ * compatibility behavior explicit:
+ * - legacy: preserve pre-ADR-325 behavior;
+ * - observe: calculate and report missing grants without blocking;
+ * - enforce: default deny unless the exact claim is configured.
+ *
+ * ADR-324 policy adapters can supply the `grantedClaims` set after evaluating
+ * the request; ownership-changing federation messages remain disabled in the
+ * default message policy until the full ingress PEP is composed.
+ */
+export declare function createFederationClaimChecker(config?: FederationClaimCheckerConfig): FederationClaimChecker;
+//# sourceMappingURL=claim-checker.d.ts.map

package/dist/application/claim-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-checker.d.ts","sourceRoot":"","sources":["../../src/application/claim-checker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,MAAM,2BAA2B,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAY3E,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,EAAE,2BAA2B,CAAC;IACnC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACxE;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,2BAA2B,CAAC;IAClC,aAAa,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAChD,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,GAAE,4BAAiC,GACxC,sBAAsB,CAuBxB"}

package/dist/application/claim-checker.js

@@ -0,0 +1,46 @@
+const FEDERATION_CLAIMS = new Set([
+    'federation:discover',
+    'federation:connect',
+    'federation:read',
+    'federation:write',
+    'federation:admin',
+    'federation:memory',
+    'federation:spawn',
+]);
+/**
+ * Compatibility bridge for the legacy federation policy engine.
+ *
+ * This removes the anonymous `() => true` production stub and makes
+ * compatibility behavior explicit:
+ * - legacy: preserve pre-ADR-325 behavior;
+ * - observe: calculate and report missing grants without blocking;
+ * - enforce: default deny unless the exact claim is configured.
+ *
+ * ADR-324 policy adapters can supply the `grantedClaims` set after evaluating
+ * the request; ownership-changing federation messages remain disabled in the
+ * default message policy until the full ingress PEP is composed.
+ */
+export function createFederationClaimChecker(config = {}) {
+    const mode = config.mode ?? 'legacy';
+    if (mode !== 'legacy' && mode !== 'observe' && mode !== 'enforce') {
+        throw new TypeError(`Unsupported federation authorization mode: ${String(mode)}`);
+    }
+    const grantedClaims = new Set();
+    for (const claim of config.grantedClaims ?? []) {
+        if (!FEDERATION_CLAIMS.has(claim)) {
+            throw new TypeError(`Unknown federation claim: ${claim}`);
+        }
+        grantedClaims.add(claim);
+    }
+    return {
+        mode,
+        grantedClaims,
+        checkClaim: (claim) => {
+            const granted = grantedClaims.has(claim);
+            if (mode === 'observe')
+                config.onObservation?.(claim, granted);
+            return mode !== 'enforce' || granted;
+        },
+    };
+}
+//# sourceMappingURL=claim-checker.js.map

package/dist/application/claim-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-checker.js","sourceRoot":"","sources":["../../src/application/claim-checker.ts"],"names":[],"mappings":"AAIA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAsB;IACrD,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC,CAAC;AAcH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAuC,EAAE;IAEzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC;IACrC,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,8CAA8C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAA4B,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,KAA4B,CAAC,CAAC;IAClD,CAAC;IAED,OAAO;QACL,IAAI;QACJ,aAAa;QACb,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/D,OAAO,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/application/federation-breaker-service.d.ts

@@ -132,11 +132,21 @@ export declare function evaluatePolicy(samples: readonly NormalizedSample[], nod
  * Construct once per federation coordinator. Inject the policy if you need
  * non-default thresholds (Phase 4 doctor surface will let users tune them).
  */
+/**
+ * ADR-111 Phase 3 — callback invoked after the breaker applies a successful
+ * state transition. Used by the coordinator to propagate suspends to the
+ * WG mesh layer (clearing AllowedIPs). Not invoked for `apply=false` dry runs
+ * or `NONE` / `REACTIVATE_ELIGIBLE` decisions. Errors thrown from the callback
+ * are swallowed at the breaker — the entity transition has already happened,
+ * and side-effect failures shouldn't unwind the breaker's internal state.
+ */
+export type BreakerTransitionListener = (node: FederationNode, decision: BreakerDecision) => void | Promise<void>;
 export declare class FederationBreakerService {
     private readonly policy;
     private readonly samples;
     private readonly maxSamplesPerPeer;
-    constructor(policy?: BreakerPolicy, maxSamplesPerPeer?: number);
+    private readonly onTransition?;
+    constructor(policy?: BreakerPolicy, maxSamplesPerPeer?: number, onTransition?: BreakerTransitionListener);
     /** Read the active policy (handy for tests + doctor surface). */
     getPolicy(): BreakerPolicy;
     /**

package/dist/application/federation-breaker-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation-breaker-service.d.ts","sourceRoot":"","sources":["../../src/application/federation-breaker-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAEL,gBAAgB,EAMjB,MAAM,kDAAkD,CAAC;AAE1D,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,wDAAwD;IACxD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,sBAAsB,EAAE,aAQnC,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAEpD,6EAA6E;AAC7E,UAAU,gBAAgB;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,IAAI,GACR,eAAe,CAqDjB;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGzC,MAAM,GAAE,aAAsC,EAC9C,iBAAiB,GAAE,MAAqC;IAO1D,iEAAiE;IACjE,SAAS,IAAI,aAAa;IAI1B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,GAAE,IAAiB,GAAG,IAAI;IAkBjE;;;;;;OAMG;IACH,QAAQ,CACN,IAAI,EAAE,cAAc,EACpB,GAAG,GAAE,IAAiB,EACtB,KAAK,GAAE,OAAc,GACpB,eAAe;IA6BlB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,GAAG,GAAE,IAAiB,GAAG,eAAe,EAAE;IAIjF,oEAAoE;IACpE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG;QAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9C;CAqBF"}
+{"version":3,"file":"federation-breaker-service.d.ts","sourceRoot":"","sources":["../../src/application/federation-breaker-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAEL,gBAAgB,EAMjB,MAAM,kDAAkD,CAAC;AAE1D,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,wDAAwD;IACxD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,sBAAsB,EAAE,aAQnC,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAEpD,6EAA6E;AAC7E,UAAU,gBAAgB;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,IAAI,GACR,eAAe,CAqDjB;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG,CACtC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,eAAe,KACtB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAA4B;gBAGxD,MAAM,GAAE,aAAsC,EAC9C,iBAAiB,GAAE,MAAqC,EACxD,YAAY,CAAC,EAAE,yBAAyB;IAQ1C,iEAAiE;IACjE,SAAS,IAAI,aAAa;IAI1B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,GAAE,IAAiB,GAAG,IAAI;IAkBjE;;;;;;OAMG;IACH,QAAQ,CACN,IAAI,EAAE,cAAc,EACpB,GAAG,GAAE,IAAiB,EACtB,KAAK,GAAE,OAAc,GACpB,eAAe;IAqClB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,GAAG,GAAE,IAAiB,GAAG,eAAe,EAAE;IAIjF,oEAAoE;IACpE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG;QAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9C;CAqBF"}

package/dist/application/federation-breaker-service.js

@@ -128,21 +128,16 @@ export function evaluatePolicy(samples, node, policy, now) {
     }
     return { action: 'NONE', nodeId: node.nodeId };
 }
-/**
- * Stateful service: owns the per-peer sample buffer, applies decisions to
- * entities, and exposes the breaker control surface to the coordinator.
- *
- * Construct once per federation coordinator. Inject the policy if you need
- * non-default thresholds (Phase 4 doctor surface will let users tune them).
- */
 export class FederationBreakerService {
     policy;
     samples;
     maxSamplesPerPeer;
-    constructor(policy = DEFAULT_BREAKER_POLICY, maxSamplesPerPeer = DEFAULT_MAX_SAMPLES_PER_PEER) {
+    onTransition;
+    constructor(policy = DEFAULT_BREAKER_POLICY, maxSamplesPerPeer = DEFAULT_MAX_SAMPLES_PER_PEER, onTransition) {
         this.policy = policy;
         this.samples = new Map();
         this.maxSamplesPerPeer = maxSamplesPerPeer;
+        this.onTransition = onTransition;
     }
     /** Read the active policy (handy for tests + doctor surface). */
     getPolicy() {
@@ -187,15 +182,16 @@ export class FederationBreakerService {
         const decision = evaluatePolicy(buf, node, this.policy, now);
         if (!apply)
             return decision;
+        let transitioned = false;
         switch (decision.action) {
             case 'SUSPEND': {
                 const reason = { reason: decision.reason };
-                node.suspend(reason, now);
+                transitioned = node.suspend(reason, now);
                 break;
             }
             case 'EVICT': {
                 const reason = { reason: decision.reason };
-                node.evict(reason, now);
+                transitioned = node.evict(reason, now);
                 break;
             }
             case 'REACTIVATE_ELIGIBLE':
@@ -206,6 +202,12 @@ export class FederationBreakerService {
             case 'NONE':
                 break;
         }
+        if (transitioned && this.onTransition) {
+            // Side-effect listener (ADR-111 Phase 3). Errors are swallowed so a
+            // failing WG propagation can't unwind the entity transition that
+            // already succeeded — coordinator should log via its own audit trail.
+            Promise.resolve(this.onTransition(node, decision)).catch(() => { });
+        }
         return decision;
     }
     /**

package/dist/application/federation-breaker-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"federation-breaker-service.js","sourceRoot":"","sources":["../../src/application/federation-breaker-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EACL,mBAAmB,EAGnB,iBAAiB,EACjB,eAAe,EACf,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,kDAAkD,CAAC;AAgC1D,MAAM,CAAC,MAAM,sBAAsB,GAAkB,MAAM,CAAC,MAAM,CAAC;IACjE,iBAAiB,EAAE,GAAG;IACtB,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACjC,qBAAqB,EAAE,GAAG;IAC1B,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IAC/B,iBAAiB,EAAE,EAAE;IACrB,UAAU,EAAE,8BAA8B;IAC1C,iBAAiB,EAAE,4BAA4B;CAChD,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAiCpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAoC,EACpC,IAAoB,EACpB,MAAqB,EACrB,GAAS;IAET,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QACjD,IAAI,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxE,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,sBAAsB;aAC/B,CAAC;QACJ,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,qEAAqE;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IACvD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,yBAAyB;SAClC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,UAAU;YAAE,SAAS;QAC1C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAC;QAC/B,IAAI,KAAK,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,wBAAwB;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,MAAM,CAAgB;IACtB,OAAO,CAAkC;IACzC,iBAAiB,CAAS;IAE3C,YACE,SAAwB,sBAAsB,EAC9C,oBAA4B,4BAA4B;QAExD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,iEAAiE;IACjE,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAoB,EAAE,MAAY,IAAI,IAAI,EAAE;QACxD,MAAM,UAAU,GAAqB;YACnC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;YAChD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC5C,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,GAAG;SACtB,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrB,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CACN,IAAoB,EACpB,MAAY,IAAI,IAAI,EAAE,EACtB,QAAiB,IAAI;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE7D,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC;QAE5B,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,MAAM,GAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,MAAM,GAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACxB,MAAM;YACR,CAAC;YACD,KAAK,qBAAqB;gBACxB,gEAAgE;gBAChE,8DAA8D;gBAC9D,gEAAgE;gBAChE,MAAM;YACR,KAAK,MAAM;gBACT,MAAM;QACV,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,KAAgC,EAAE,MAAY,IAAI,IAAI,EAAE;QAC3D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,MAAc,EAAE,MAAY,IAAI,IAAI,EAAE;QAM7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAC/D,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,UAAU;gBAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC;YACvD,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,UAAU,EAAE,CAAC;gBACjC,KAAK,EAAE,CAAC;gBACR,IAAI,CAAC,CAAC,CAAC,OAAO;oBAAE,QAAQ,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM;YACN,WAAW,EAAE,GAAG,CAAC,MAAM;YACvB,cAAc,EAAE,MAAM;YACtB,oBAAoB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI;SAC1D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"federation-breaker-service.js","sourceRoot":"","sources":["../../src/application/federation-breaker-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EACL,mBAAmB,EAGnB,iBAAiB,EACjB,eAAe,EACf,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,kDAAkD,CAAC;AAgC1D,MAAM,CAAC,MAAM,sBAAsB,GAAkB,MAAM,CAAC,MAAM,CAAC;IACjE,iBAAiB,EAAE,GAAG;IACtB,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACjC,qBAAqB,EAAE,GAAG;IAC1B,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IAC/B,iBAAiB,EAAE,EAAE;IACrB,UAAU,EAAE,8BAA8B;IAC1C,iBAAiB,EAAE,4BAA4B;CAChD,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAiCpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAoC,EACpC,IAAoB,EACpB,MAAqB,EACrB,GAAS;IAET,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QACjD,IAAI,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxE,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,sBAAsB;aAC/B,CAAC;QACJ,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,qEAAqE;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IACvD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,yBAAyB;SAClC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,UAAU;YAAE,SAAS;QAC1C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAC;QAC/B,IAAI,KAAK,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,wBAAwB;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC;AAsBD,MAAM,OAAO,wBAAwB;IAClB,MAAM,CAAgB;IACtB,OAAO,CAAkC;IACzC,iBAAiB,CAAS;IAC1B,YAAY,CAA6B;IAE1D,YACE,SAAwB,sBAAsB,EAC9C,oBAA4B,4BAA4B,EACxD,YAAwC;QAExC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,iEAAiE;IACjE,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAoB,EAAE,MAAY,IAAI,IAAI,EAAE;QACxD,MAAM,UAAU,GAAqB;YACnC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;YAChD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC5C,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,GAAG;SACtB,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrB,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CACN,IAAoB,EACpB,MAAY,IAAI,IAAI,EAAE,EACtB,QAAiB,IAAI;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE7D,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC;QAE5B,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,MAAM,GAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7D,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACzC,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,MAAM,GAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7D,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACvC,MAAM;YACR,CAAC;YACD,KAAK,qBAAqB;gBACxB,gEAAgE;gBAChE,8DAA8D;gBAC9D,gEAAgE;gBAChE,MAAM;YACR,KAAK,MAAM;gBACT,MAAM;QACV,CAAC;QAED,IAAI,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,oEAAoE;YACpE,iEAAiE;YACjE,sEAAsE;YACtE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAiB,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,KAAgC,EAAE,MAAY,IAAI,IAAI,EAAE;QAC3D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,MAAc,EAAE,MAAY,IAAI,IAAI,EAAE;QAM7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAC/D,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,UAAU;gBAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC;YACvD,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,UAAU,EAAE,CAAC;gBACjC,KAAK,EAAE,CAAC;gBACR,IAAI,CAAC,CAAC,CAAC,OAAO;oBAAE,QAAQ,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM;YACN,WAAW,EAAE,GAAG,CAAC,MAAM;YACvB,cAAc,EAAE,MAAM;YACtB,oBAAoB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI;SAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/application/federation-coordinator.d.ts

@@ -1,4 +1,4 @@
-import { type FederationNodeStateRecord } from '../domain/entities/federation-node.js';
+import { FederationNode, type FederationNodeStateRecord } from '../domain/entities/federation-node.js';
 import { FederationSession } from '../domain/entities/federation-session.js';
 import { type FederationMessageType } from '../domain/entities/federation-envelope.js';
 import { TrustLevel } from '../domain/entities/trust-level.js';
@@ -8,11 +8,12 @@ import { HandshakeService } from '../domain/services/handshake-service.js';
 import { RoutingService, type RoutingResult } from '../domain/services/routing-service.js';
 import { AuditService } from '../domain/services/audit-service.js';
 import { PIIPipelineService } from '../domain/services/pii-pipeline-service.js';
-import { TrustEvaluator } from './trust-evaluator.js';
+import { TrustEvaluator, type BootstrapElevationAuditEntry } from './trust-evaluator.js';
 import { PolicyEngine } from './policy-engine.js';
 import { enforceBudget, validateBudget } from '../domain/value-objects/federation-budget.js';
 import type { FederationBreakerService } from './federation-breaker-service.js';
 import type { SpendReporter } from './spend-reporter.js';
+import type { WgMeshService, WgCommand } from '../domain/services/wg-mesh-service.js';
 /**
  * Optional per-call budget controls (ADR-097 Phase 1). All fields are
  * optional; omitted means "no limit on that axis" (the default unbounded
@@ -42,6 +43,9 @@ export interface FederationCoordinatorConfig {
     readonly publicKey: string;
     readonly endpoint: string;
     readonly capabilities: readonly string[];
+    /** Wire protocols this runtime is prepared to advertise and negotiate. */
+    readonly supportedProtocols?: readonly string[];
+    readonly version?: string;
 }
 export interface FederationStatus {
     readonly nodeId: string;
@@ -64,6 +68,20 @@ export interface FederationStatus {
 export interface FederationCoordinatorIntegrations {
     readonly spendReporter?: SpendReporter;
     readonly breakerService?: FederationBreakerService;
+    /**
+     * ADR-111 Phase 3 — optional WG mesh service. When present, peer state
+     * transitions (evict/reactivate/breaker-suspend) emit `wg set` commands
+     * to a sink supplied by `wgCommandSink`. No-op for peers without a `wg`
+     * manifest block, so wiring the service is safe even in mixed deployments.
+     */
+    readonly wgMesh?: WgMeshService;
+    /**
+     * Where emitted WG commands go. Defaults to the audit log only. Integrators
+     * can plug in a shell executor here (after operator approval — bringing up
+     * a network interface is destructive). Commands include shell-ready
+     * `wg set <iface> ...` strings; the sink should still validate before exec.
+     */
+    readonly wgCommandSink?: (cmd: WgCommand) => void | Promise<void>;
 }
 export declare class FederationCoordinator {
     private readonly config;
@@ -78,10 +96,19 @@ export declare class FederationCoordinator {
     private initialized;
     private readonly spendReporter?;
     private readonly breakerService?;
+    private readonly wgMesh?;
+    private readonly wgCommandSink?;
     constructor(config: FederationCoordinatorConfig, discovery: DiscoveryService, handshake: HandshakeService, routing: RoutingService, audit: AuditService, piiPipeline: PIIPipelineService, trustEvaluator: TrustEvaluator, policyEngine: PolicyEngine, integrations?: FederationCoordinatorIntegrations);
+    /**
+     * ADR-111 Phase 3 — emit a WG command for an audited peer transition.
+     * No-op if no wgMesh is configured or the peer lacks a `wg` manifest
+     * block. Commands flow to `wgCommandSink` (if any) and always to the
+     * audit log so reactivation is fully traceable.
+     */
+    private emitWgCommand;
     initialize(manifest: Omit<FederationManifest, 'signature'>): Promise<void>;
     shutdown(): Promise<void>;
-    joinPeer(endpoint: string): Promise<FederationSession>;
+    joinPeer(endpoint: string, manifest?: FederationManifest): Promise<FederationSession>;
     leavePeer(nodeId: string): Promise<void>;
     sendMessage<T>(targetNodeId: string, messageType: FederationMessageType, payload: T, options?: SendOptions): Promise<RoutingResult>;
     /**
@@ -108,6 +135,13 @@ export declare class FederationCoordinator {
     getPeerStates(): readonly (FederationNodeStateRecord & {
         readonly nodeId: string;
     })[];
+    /**
+     * ADR-111 Phase 6: public read of the discovery peer list. Used by
+     * federation_wg_status MCP tool + WG firewall projection. Returns the
+     * full known-peer set (active + suspended + evicted) — filter via
+     * .isActive / state if you only want the live mesh members.
+     */
+    listPeers(): readonly FederationNode[];
     /**
      * Aggregated counts for the doctor surface — `{ active: N, suspended: M,
      * evicted: K }`. Cheap O(peers) sweep; safe to call from a status line.
@@ -151,6 +185,17 @@ export declare class FederationCoordinator {
         readonly success: boolean;
         readonly ts?: string;
     }): Promise<void>;
+    /**
+     * Founder-bootstrap trust elevation (ADR-164 §3.5.4 — operator escape hatch
+     * used in the autopilot Day-1 scenario where a freshly-joined BBS peer
+     * needs TRUSTED before organic minInteractions thresholds can accrue).
+     *
+     * Refuses if the target node is not a registered federation peer (returns
+     * null). On success, writes a `trust_level_changed` audit entry tagged
+     * `bootstrap_elevation` with the operator-supplied reason, and returns
+     * the audit entry so the CLI / caller can print it to stdout.
+     */
+    bootstrapElevatePeer(nodeId: string, newLevel: TrustLevel, reason: string): Promise<BootstrapElevationAuditEntry | null>;
     /**
      * Operator-initiated reactivate. Used after an integrator-supplied
      * health probe confirms a SUSPENDED peer is healthy, OR as an

package/dist/application/federation-coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation-coordinator.d.ts","sourceRoot":"","sources":["../../src/application/federation-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAiC,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAGL,aAAa,EACb,cAAc,EACf,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC;CACpD;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA2B;gBAGzD,MAAM,EAAE,2BAA2B,EACnC,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,kBAAkB,EAC/B,cAAc,EAAE,cAAc,EAC9B,YAAY,EAAE,YAAY,EAC1B,YAAY,GAAE,iCAAsC;IAgBhD,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAU1E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAatD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxC,WAAW,CAAC,CAAC,EACjB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,qBAAqB,EAClC,OAAO,EAAE,CAAC,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,aAAa,CAAC;IAqHzB;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM;;;MAAwD;IAExE,gBAAgB,CAAC,CAAC,EACtB,WAAW,EAAE,qBAAqB,EAClC,OAAO,EAAE,CAAC,GACT,OAAO,CAAC,aAAa,EAAE,CAAC;IAK3B,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAqB3C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAkBvC,SAAS,IAAI,gBAAgB;IAgB7B;;;;;;;OAOG;IACH,aAAa,IAAI,SAAS,CAAC,yBAAyB,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE;IAOrF;;;OAGG;IACH,kBAAkB,IAAI;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAcvG;;;;;;;OAOG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,gBAAiC,EACzC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC;IAyBnB;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BjB;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB9E,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAI5D,iBAAiB,IAAI,iBAAiB,EAAE;YAI1B,gBAAgB;IAgC9B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,iBAAiB;CAK1B"}
+{"version":3,"file":"federation-coordinator.d.ts","sourceRoot":"","sources":["../../src/application/federation-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAiC,KAAK,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACxH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAGL,aAAa,EACb,cAAc,EACf,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAA2C;gBAGxE,MAAM,EAAE,2BAA2B,EACnC,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,kBAAkB,EAC/B,cAAc,EAAE,cAAc,EAC9B,YAAY,EAAE,YAAY,EAC1B,YAAY,GAAE,iCAAsC;IAkBtD;;;;;OAKG;YACW,aAAa;IAuBrB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBzB,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,OAAO,CAAC,iBAAiB,CAAC;IAavB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxC,WAAW,CAAC,CAAC,EACjB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,qBAAqB,EAClC,OAAO,EAAE,CAAC,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,aAAa,CAAC;IAqHzB;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM;;;MAAwD;IAExE,gBAAgB,CAAC,CAAC,EACtB,WAAW,EAAE,qBAAqB,EAClC,OAAO,EAAE,CAAC,GACT,OAAO,CAAC,aAAa,EAAE,CAAC;IAK3B,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAqB3C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAkBvC,SAAS,IAAI,gBAAgB;IAgB7B;;;;;;;OAOG;IACH,aAAa,IAAI,SAAS,CAAC,yBAAyB,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE;IAOrF;;;;;OAKG;IACH,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC;;;OAGG;IACH,kBAAkB,IAAI;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAcvG;;;;;;;OAOG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,gBAAiC,EACzC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC;IA+BnB;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BjB;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAuB/C;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B9E,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAI5D,iBAAiB,IAAI,iBAAiB,EAAE;YAI1B,gBAAgB;IA0B9B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,iBAAiB;CAK1B"}