@claude-flow/plugin-agent-federation 1.0.0-alpha.9 → 1.0.1

package/dist/domain/services/wg-firewall-service.d.ts

@@ -0,0 +1,71 @@
+/**
+ * ADR-111 Phase 4 — Trust-graded firewall projection.
+ *
+ * Projects the WG_NETWORK_GATES table (defined in wg-mesh-service.ts) into
+ * concrete kernel-firewall rules. Two backends:
+ *
+ *   - `nftables` for Linux — atomic `nft -f <file>` loader, family `inet`,
+ *     hook `input` (interface-scoped to the WG iface).
+ *   - `pf` for macOS — `pfctl -a ruflo-fed -f <file>`, anchor-scoped so
+ *     ruflo's rules don't collide with the operator's main pf ruleset.
+ *
+ * Like Phase 2's WgMeshService this is a **pure-projection** service: it
+ * returns rule strings + the shell command the operator runs. It never
+ * shells out or modifies kernel state itself. Operator review is mandatory
+ * because `pf` / `nft` reloads atomically replace the active ruleset for
+ * the targeted scope — a typo here can drop ssh.
+ *
+ * v1 scope: the four trust levels VERIFIED/ATTESTED/TRUSTED/PRIVILEGED.
+ * UNTRUSTED peers are never in the mesh (excluded by WgMeshService) so
+ * they don't need a firewall rule either — implicit drop policy.
+ */
+import { FederationNode } from '../entities/federation-node.js';
+export type WgFirewallPlatform = 'linux-nftables' | 'darwin-pf';
+export interface WgFirewallServiceConfig {
+    /** Target platform. Default: auto-detect from process.platform. */
+    readonly platform?: WgFirewallPlatform;
+    /** WG interface name to scope rules to. Defaults to `ruflo-fed`. */
+    readonly interfaceName?: string;
+    /** Where the operator should write the rule file. Used for the load-command string. */
+    readonly rulePath?: string;
+    /** pf anchor (macOS only). Defaults to `ruflo-fed`. */
+    readonly pfAnchor?: string;
+}
+export interface WgFirewallRuleSet {
+    /** The full rule-file content the operator writes to disk. */
+    readonly content: string;
+    /** The shell command the operator runs to load it. */
+    readonly loadCmd: string;
+    /** Recommended file path (informational — the operator decides). */
+    readonly rulePath: string;
+    /** Per-peer rule projections for audit/inspection. */
+    readonly peerProjections: ReadonlyArray<{
+        readonly nodeId: string;
+        readonly trustLabel: string;
+        readonly meshIP: string;
+        readonly rules: readonly string[];
+    }>;
+}
+export declare class WgFirewallService {
+    private readonly platform;
+    private readonly interfaceName;
+    private readonly rulePath;
+    private readonly pfAnchor;
+    constructor(config?: WgFirewallServiceConfig);
+    getPlatform(): WgFirewallPlatform;
+    /**
+     * Project the current peer set into a complete rule file (nftables or pf)
+     * scoped to the WG interface.
+     *
+     * Peers below WG_MIN_MESH_TRUST (UNTRUSTED) are dropped — they have no
+     * mesh IP and shouldn't appear in firewall allow rules anyway. Peers
+     * without `metadata.wgMeshIP` are skipped (a stale manifest with no WG
+     * block; the mesh layer already excludes them).
+     */
+    projectRules(peers: readonly FederationNode[]): WgFirewallRuleSet;
+    private renderNftables;
+    private renderPf;
+    private defaultRulePath;
+    private trustLabel;
+}
+//# sourceMappingURL=wg-firewall-service.d.ts.map

package/dist/domain/services/wg-firewall-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wg-firewall-service.d.ts","sourceRoot":"","sources":["../../../src/domain/services/wg-firewall-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAIhE,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAEhE,MAAM,WAAW,uBAAuB;IACtC,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IACvC,oEAAoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;KACnC,CAAC,CAAC;CACJ;AAwDD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,MAAM,GAAE,uBAA4B;IAShD,WAAW,IAAI,kBAAkB;IAIjC;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,iBAAiB;IAsCjE,OAAO,CAAC,cAAc;IAmCtB,OAAO,CAAC,QAAQ;IAyBhB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,UAAU;CASnB"}

package/dist/domain/services/wg-firewall-service.js

@@ -0,0 +1,194 @@
+/**
+ * ADR-111 Phase 4 — Trust-graded firewall projection.
+ *
+ * Projects the WG_NETWORK_GATES table (defined in wg-mesh-service.ts) into
+ * concrete kernel-firewall rules. Two backends:
+ *
+ *   - `nftables` for Linux — atomic `nft -f <file>` loader, family `inet`,
+ *     hook `input` (interface-scoped to the WG iface).
+ *   - `pf` for macOS — `pfctl -a ruflo-fed -f <file>`, anchor-scoped so
+ *     ruflo's rules don't collide with the operator's main pf ruleset.
+ *
+ * Like Phase 2's WgMeshService this is a **pure-projection** service: it
+ * returns rule strings + the shell command the operator runs. It never
+ * shells out or modifies kernel state itself. Operator review is mandatory
+ * because `pf` / `nft` reloads atomically replace the active ruleset for
+ * the targeted scope — a typo here can drop ssh.
+ *
+ * v1 scope: the four trust levels VERIFIED/ATTESTED/TRUSTED/PRIVILEGED.
+ * UNTRUSTED peers are never in the mesh (excluded by WgMeshService) so
+ * they don't need a firewall rule either — implicit drop policy.
+ */
+import { TrustLevel } from '../entities/trust-level.js';
+import { WG_NETWORK_GATES, WG_MIN_MESH_TRUST } from './wg-mesh-service.js';
+const DEFAULT_INTERFACE = 'ruflo-fed';
+const DEFAULT_PF_ANCHOR = 'ruflo-fed';
+function autoDetectPlatform() {
+    switch (process.platform) {
+        case 'linux': return 'linux-nftables';
+        case 'darwin': return 'darwin-pf';
+        default:
+            // Other platforms (win32/freebsd) — fall back to linux-nftables since
+            // most production federation hosts are linux. The operator can
+            // override via config.platform.
+            return 'linux-nftables';
+    }
+}
+/**
+ * Defense-in-depth: every value spliced into a rule line goes through this
+ * filter. Allows the chars `nft`/`pf` syntax actually needs and refuses
+ * anything else — a poisoned manifest can't escape the rule string.
+ */
+function assertSafeRuleArg(s, label) {
+    if (!/^[A-Za-z0-9_./:-]+$/.test(s)) {
+        throw new Error(`WgFirewallService: refusing unsafe ${label}: ${JSON.stringify(s)}`);
+    }
+}
+function projectRuleNftables(rule, srcIP) {
+    if (rule.proto === 'all') {
+        return `        ip saddr ${srcIP} accept`;
+    }
+    if (rule.port !== undefined) {
+        return `        ip saddr ${srcIP} ${rule.proto} dport ${rule.port} accept`;
+    }
+    if (rule.portRange) {
+        const [lo, hi] = rule.portRange;
+        return `        ip saddr ${srcIP} ${rule.proto} dport ${lo}-${hi} accept`;
+    }
+    throw new Error(`projectRuleNftables: rule missing port/portRange/all: ${JSON.stringify(rule)}`);
+}
+function projectRulePf(rule, iface, srcIP) {
+    if (rule.proto === 'all') {
+        return `pass in on ${iface} from ${srcIP} to any keep state`;
+    }
+    if (rule.port !== undefined) {
+        return `pass in on ${iface} proto ${rule.proto} from ${srcIP} to any port ${rule.port} keep state`;
+    }
+    if (rule.portRange) {
+        const [lo, hi] = rule.portRange;
+        return `pass in on ${iface} proto ${rule.proto} from ${srcIP} to any port ${lo}:${hi} keep state`;
+    }
+    throw new Error(`projectRulePf: rule missing port/portRange/all: ${JSON.stringify(rule)}`);
+}
+export class WgFirewallService {
+    platform;
+    interfaceName;
+    rulePath;
+    pfAnchor;
+    constructor(config = {}) {
+        this.platform = config.platform ?? autoDetectPlatform();
+        this.interfaceName = config.interfaceName ?? DEFAULT_INTERFACE;
+        assertSafeRuleArg(this.interfaceName, 'interfaceName');
+        this.pfAnchor = config.pfAnchor ?? DEFAULT_PF_ANCHOR;
+        assertSafeRuleArg(this.pfAnchor, 'pfAnchor');
+        this.rulePath = config.rulePath ?? this.defaultRulePath();
+    }
+    getPlatform() {
+        return this.platform;
+    }
+    /**
+     * Project the current peer set into a complete rule file (nftables or pf)
+     * scoped to the WG interface.
+     *
+     * Peers below WG_MIN_MESH_TRUST (UNTRUSTED) are dropped — they have no
+     * mesh IP and shouldn't appear in firewall allow rules anyway. Peers
+     * without `metadata.wgMeshIP` are skipped (a stale manifest with no WG
+     * block; the mesh layer already excludes them).
+     */
+    projectRules(peers) {
+        const eligible = peers.filter(p => {
+            if (p.trustLevel < WG_MIN_MESH_TRUST)
+                return false;
+            const meshIP = p.metadata.wgMeshIP;
+            return typeof meshIP === 'string' && meshIP.length > 0;
+        });
+        const peerProjections = eligible.map(peer => {
+            const meshIP = peer.metadata.wgMeshIP.replace(/\/32$/, '');
+            assertSafeRuleArg(meshIP, 'meshIP');
+            const ruleSpecs = WG_NETWORK_GATES[peer.trustLevel];
+            const rules = ruleSpecs.map(r => this.platform === 'linux-nftables'
+                ? projectRuleNftables(r, meshIP)
+                : projectRulePf(r, this.interfaceName, meshIP));
+            return {
+                nodeId: peer.nodeId,
+                trustLabel: this.trustLabel(peer.trustLevel),
+                meshIP: peer.metadata.wgMeshIP,
+                rules,
+            };
+        });
+        const content = this.platform === 'linux-nftables'
+            ? this.renderNftables(peerProjections)
+            : this.renderPf(peerProjections);
+        return {
+            content,
+            loadCmd: this.platform === 'linux-nftables'
+                ? `nft -f ${this.rulePath}`
+                : `pfctl -a ${this.pfAnchor} -f ${this.rulePath}`,
+            rulePath: this.rulePath,
+            peerProjections,
+        };
+    }
+    renderNftables(projections) {
+        // Atomic nft script. The `flush` clears existing rules in the table
+        // before reload — same atomicity property nft itself guarantees.
+        // Default policy DROP so anything not explicitly allowed is rejected.
+        const lines = [];
+        lines.push('#!/usr/sbin/nft -f');
+        lines.push('# Generated by ruflo federation plugin — ADR-111 Phase 4.');
+        lines.push('# Operator MUST review before `nft -f`. A typo here can drop ssh.');
+        lines.push('# This file is overwritten on every peer-set change; do not hand-edit.');
+        lines.push('');
+        lines.push('table inet ruflo_fed {');
+        lines.push('    chain wg_input {');
+        lines.push(`        type filter hook input priority 0; policy drop;`);
+        lines.push(`        iifname "${this.interfaceName}" jump wg_peer_rules`);
+        lines.push('    }');
+        lines.push('    chain wg_peer_rules {');
+        if (projections.length === 0) {
+            lines.push('        # No ATTESTED+ peers in mesh.');
+        }
+        for (const p of projections) {
+            lines.push(`        # peer ${p.nodeId} — trust=${p.trustLabel} mesh=${p.meshIP}`);
+            for (const rule of p.rules) {
+                lines.push(rule);
+            }
+        }
+        lines.push('    }');
+        lines.push('}');
+        return lines.join('\n');
+    }
+    renderPf(projections) {
+        const lines = [];
+        lines.push('# Generated by ruflo federation plugin — ADR-111 Phase 4.');
+        lines.push('# Operator MUST review before `pfctl -f`. A typo here can drop ssh.');
+        lines.push(`# This anchor is scoped to ${this.pfAnchor}; main pf ruleset stays untouched.`);
+        lines.push('');
+        // Default within the anchor: pass nothing not explicitly allowed.
+        // The main ruleset's policy still applies; the anchor only adds allows.
+        if (projections.length === 0) {
+            lines.push('# No ATTESTED+ peers in mesh.');
+        }
+        for (const p of projections) {
+            lines.push(`# peer ${p.nodeId} — trust=${p.trustLabel} mesh=${p.meshIP}`);
+            for (const rule of p.rules) {
+                lines.push(rule);
+            }
+        }
+        return lines.join('\n');
+    }
+    defaultRulePath() {
+        return this.platform === 'linux-nftables'
+            ? '/etc/nftables.d/ruflo-fed.nft'
+            : `/etc/pf.anchors/${this.pfAnchor}`;
+    }
+    trustLabel(level) {
+        switch (level) {
+            case TrustLevel.UNTRUSTED: return 'UNTRUSTED';
+            case TrustLevel.VERIFIED: return 'VERIFIED';
+            case TrustLevel.ATTESTED: return 'ATTESTED';
+            case TrustLevel.TRUSTED: return 'TRUSTED';
+            case TrustLevel.PRIVILEGED: return 'PRIVILEGED';
+        }
+    }
+}
+//# sourceMappingURL=wg-firewall-service.js.map

package/dist/domain/services/wg-firewall-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wg-firewall-service.js","sourceRoot":"","sources":["../../../src/domain/services/wg-firewall-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAmB,MAAM,sBAAsB,CAAC;AA+B5F,MAAM,iBAAiB,GAAG,WAAW,CAAC;AACtC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC,SAAS,kBAAkB;IACzB,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,OAAO,CAAC,CAAC,OAAO,gBAAgB,CAAC;QACtC,KAAK,QAAQ,CAAC,CAAC,OAAO,WAAW,CAAC;QAClC;YACE,sEAAsE;YACtE,+DAA+D;YAC/D,gCAAgC;YAChC,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,CAAS,EAAE,KAAa;IACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAgB,EAAE,KAAa;IAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,oBAAoB,KAAK,SAAS,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,oBAAoB,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,IAAI,SAAS,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,OAAO,oBAAoB,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB,EAAE,KAAa,EAAE,KAAa;IACnE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,cAAc,KAAK,SAAS,KAAK,oBAAoB,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,cAAc,KAAK,UAAU,IAAI,CAAC,KAAK,SAAS,KAAK,gBAAgB,IAAI,CAAC,IAAI,aAAa,CAAC;IACrG,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,OAAO,cAAc,KAAK,UAAU,IAAI,CAAC,KAAK,SAAS,KAAK,gBAAgB,EAAE,IAAI,EAAE,aAAa,CAAC;IACpG,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAqB;IAC7B,aAAa,CAAS;IACtB,QAAQ,CAAS;IACjB,QAAQ,CAAS;IAElC,YAAY,SAAkC,EAAE;QAC9C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC;QACxD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,iBAAiB,CAAC;QAC/D,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACrD,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;IAC5D,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAgC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAChC,IAAI,CAAC,CAAC,UAAU,GAAG,iBAAiB;gBAAE,OAAO,KAAK,CAAC;YACnD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,QAA8B,CAAC;YACzD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAC1C,MAAM,MAAM,GAAI,IAAI,CAAC,QAAQ,CAAC,QAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC9B,IAAI,CAAC,QAAQ,KAAK,gBAAgB;gBAChC,CAAC,CAAC,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC;gBAChC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CACjD,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC5C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAkB;gBACxC,KAAK;aACN,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,gBAAgB;YAChD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAEnC,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,QAAQ,KAAK,gBAAgB;gBACzC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE;gBAC3B,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,EAAE;YACnD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe;SAChB,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,WAKrB;QACA,oEAAoE;QACpE,iEAAiE;QACjE,sEAAsE;QACtE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,aAAa,sBAAsB,CAAC,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,UAAU,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEO,QAAQ,CAAC,WAKf;QACA,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAClF,KAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,QAAQ,oCAAoC,CAAC,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,kEAAkE;QAClE,wEAAwE;QACxE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,UAAU,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEO,eAAe;QACrB,OAAO,IAAI,CAAC,QAAQ,KAAK,gBAAgB;YACvC,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,mBAAmB,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzC,CAAC;IAEO,UAAU,CAAC,KAAiB;QAClC,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,WAAW,CAAC;YAC9C,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC;YAC5C,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC;YAC5C,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,SAAS,CAAC;YAC1C,KAAK,UAAU,CAAC,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC;QAClD,CAAC;IACH,CAAC;CACF"}

package/dist/domain/services/wg-mesh-service.d.ts

@@ -0,0 +1,156 @@
+/**
+ * ADR-111 Phase 2 — WgMeshService.
+ *
+ * Pure-projection service: takes the federation peer registry + local
+ * WG identity and produces (a) a `wg-quick`-compatible config string,
+ * (b) per-peer `wg set` commands the operator runs to converge an
+ * already-running interface, and (c) the AllowedIPs slice that maps to
+ * each peer's trust level.
+ *
+ * Deliberately does NOT shell out. Bringing up a network interface
+ * requires root and modifies system state — per CLAUDE.md's
+ * destructive-actions guidance the service emits the commands; the
+ * operator (or a thin shell wrapper they audit) runs them.
+ *
+ * Phase 3 (breaker integration) consumes this service: peer state
+ * transitions invoke removeAllowedIPs/removePeer/restoreAllowedIPs,
+ * which produce commands without side effects.
+ */
+import { TrustLevel } from '../entities/trust-level.js';
+import { FederationNode } from '../entities/federation-node.js';
+import type { WgLocalKey } from '../value-objects/wg-config.js';
+export interface WgPortRule {
+    readonly proto: 'tcp' | 'udp' | 'all';
+    readonly port?: number;
+    readonly portRange?: readonly [number, number];
+}
+/**
+ * Trust-level → reachability. ADR-111's `WG_NETWORK_GATES`.
+ *
+ * Note: WireGuard's `AllowedIPs` is L3 routing, not L4 ACL — these port
+ * rules describe what the L4 firewall (Phase 4: nftables/pf) should
+ * enforce. v1 (this phase) only produces the rules; Phase 4 projects
+ * them into kernel firewall syntax. Until then, callers using v1
+ * fall back to the simpler "AllowedIPs = peer's mesh IP" model (option
+ * (b) in the ADR — app-layer auth carries the access decision).
+ */
+export declare const WG_NETWORK_GATES: Record<TrustLevel, readonly WgPortRule[]>;
+/**
+ * Minimum trust level whose peers get a `[Peer]` block in the WG config.
+ * UNTRUSTED stays out of the mesh entirely — it's the explicit drop bucket.
+ */
+export declare const WG_MIN_MESH_TRUST: TrustLevel;
+export interface WgPeerFields {
+    readonly wgPublicKey: string;
+    readonly wgMeshIP: string;
+    readonly wgEndpoint: string;
+}
+/**
+ * Return the validated peer wg fields, or null if any is malformed or
+ * out-of-range. Callers treat null as "peer not eligible for mesh" — the
+ * peer stays in the federation discovery registry but is excluded from
+ * the wg config and any wg commands.
+ */
+export declare function readSafePeerWgFields(peer: FederationNode): WgPeerFields | null;
+export interface WgMeshServiceConfig {
+    /** Local interface name. Defaults to `ruflo-fed`. */
+    readonly interfaceName?: string;
+    /** Local UDP listen port. WireGuard's standard is 51820. */
+    readonly listenPort?: number;
+    /** Mesh subnet for AllowedIPs filtering. Defaults to DEFAULT_MESH_SUBNET. */
+    readonly meshSubnet?: string;
+}
+export interface WgPeerSummary {
+    readonly nodeId: string;
+    readonly trustLevel: TrustLevel;
+    readonly trustLabel: string;
+    readonly meshIP: string;
+    readonly endpoint: string;
+    readonly publicKey: string;
+    readonly state: 'active' | 'suspended' | 'evicted';
+    readonly allowedIPs: readonly string[];
+}
+/**
+ * A planned `wg(8)` mutation. Service consumers either execute these or
+ * surface them to the operator. Strings are validated for shell metachars
+ * before being formatted into a command — callers should still review.
+ */
+export interface WgCommand {
+    readonly verb: 'set-allowed-ips' | 'remove-allowed-ips' | 'remove-peer' | 'add-peer';
+    /** Public key of the peer this command targets. */
+    readonly peerPublicKey: string;
+    /** Render to a `wg set <iface> peer <pk> ...` shell-ready string. */
+    readonly cmd: string;
+    /** Human-readable rationale for audit logs. */
+    readonly rationale: string;
+}
+export declare class WgMeshService {
+    private readonly interfaceName;
+    private readonly listenPort;
+    private readonly meshSubnet;
+    private localKey;
+    private localMeshIP;
+    /** Per-peer AllowedIPs after the last applyTrustLevelToAllowedIPs() call. Drives restore from breaker. */
+    private readonly lastAppliedAllowedIPs;
+    /** Peer-pubkey → suspended flag for breaker integration. */
+    private readonly suspended;
+    /** Peer-pubkey → evicted flag. */
+    private readonly evicted;
+    constructor(config?: WgMeshServiceConfig);
+    /** Bind the local WG identity. Required before buildInterfaceConfig(). */
+    setLocalIdentity(key: WgLocalKey, meshIP: string): void;
+    getInterfaceName(): string;
+    getMeshSubnet(): string;
+    /**
+     * Build a `wg-quick`-compatible config string from current peers.
+     *
+     * Peers below WG_MIN_MESH_TRUST (UNTRUSTED) are excluded entirely.
+     * Suspended peers stay in the config but with `AllowedIPs =` empty
+     * (soft-block). Evicted peers are dropped completely.
+     *
+     * Operator writes this to `/etc/wireguard/<interface>.conf` and runs
+     * `wg-quick up <interface>`.
+     */
+    buildInterfaceConfig(peers: readonly FederationNode[]): string;
+    /**
+     * Compute the AllowedIPs slice for a peer at its current trust level.
+     * v1: each peer gets its own /32 mesh IP. Phase 4 will narrow this
+     * further via firewall rules; v1 keeps L3 broad and relies on the app
+     * layer + trust gates for access decisions.
+     */
+    computeAllowedIPs(peer: FederationNode, meshIP: string): readonly string[];
+    /**
+     * Apply trust level → AllowedIPs as a `wg set` command for an
+     * already-running interface. Used when a peer joins or its trust level
+     * changes without needing a full config rewrite.
+     */
+    applyTrustLevelToAllowedIPs(peer: FederationNode, meshIP: string, pubkey: string): WgCommand;
+    /**
+     * Phase 3 hook — peer SUSPENDED. Clear AllowedIPs (soft-block: keeps
+     * the peer's public key registered with the interface but blocks all
+     * routing to/from it).
+     */
+    removeAllowedIPs(peer: FederationNode, pubkey: string, reason?: string): WgCommand;
+    /**
+     * Phase 3 hook — peer reactivated. Restore the AllowedIPs slice that
+     * was active before suspension. Returns null if the peer was never
+     * suspended (idempotent).
+     */
+    restoreAllowedIPs(peer: FederationNode, meshIP: string, pubkey: string): WgCommand | null;
+    /**
+     * Phase 3 hook — peer EVICTED. Terminal removal from the mesh; the
+     * peer's `[Peer]` block is dropped on next config rebuild and an
+     * immediate `wg set <iface> peer <pk> remove` is emitted to flush
+     * runtime state without a config reload.
+     */
+    removePeer(peer: FederationNode, pubkey: string, reason?: string): WgCommand;
+    /** Summarize the mesh state for `federation_wg_status` (Phase 6) and audit. */
+    summarize(peers: readonly FederationNode[]): readonly WgPeerSummary[];
+    /**
+     * Defense-in-depth: validate that all bits we splice into a shell
+     * command are alphanumeric / base64 / WG-allowed chars. Refuses the
+     * command rather than ship a substring that might escape its slot.
+     */
+    private formatCmd;
+}
+//# sourceMappingURL=wg-mesh-service.d.ts.map

package/dist/domain/services/wg-mesh-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wg-mesh-service.d.ts","sourceRoot":"","sources":["../../../src/domain/services/wg-mesh-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAsB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGnF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAkBtE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAAgC,CAAC;AAmBjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,GAAG,IAAI,CAY9E;AAED,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAKD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,oBAAoB,GAAG,aAAa,GAAG,UAAU,CAAC;IACrF,mDAAmD;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,WAAW,CAAuB;IAC1C,0GAA0G;IAC1G,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAwC;IAC9E,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,kCAAkC;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;gBAEjC,MAAM,GAAE,mBAAwB;IAM5C,0EAA0E;IAC1E,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAKvD,gBAAgB,IAAI,MAAM;IAI1B,aAAa,IAAI,MAAM;IAIvB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM;IAoC9D;;;;;OAKG;IACH,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE;IAO1E;;;;OAIG;IACH,2BAA2B,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;IAU5F;;;;OAIG;IACH,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS;IAUlF;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAazF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS;IAY5E,+EAA+E;IAC/E,SAAS,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,aAAa,EAAE;IA2BrE;;;;OAIG;IACH,OAAO,CAAC,SAAS;CAQlB"}