@claude-flow/plugin-agent-federation 1.0.2 → 1.0.4

package/dist/domain/entities/federation-node.d.ts

@@ -1,104 +0,0 @@
-import { TrustLevel } from './trust-level.js';
-import { FederationNodeState, SuspensionReason, TransitionReason } from '../value-objects/federation-node-state.js';
-export interface FederationNodeCapabilities {
-    readonly agentTypes: readonly string[];
-    readonly maxConcurrentSessions: number;
-    readonly supportedProtocols: readonly string[];
-    readonly complianceModes: readonly string[];
-}
-export interface FederationNodeMetadata {
-    readonly organizationId?: string;
-    readonly region?: string;
-    readonly version?: string;
-    readonly [key: string]: unknown;
-}
-/** Last-transition record kept on the entity for the audit trail. */
-export interface FederationNodeStateRecord {
-    readonly state: FederationNodeState;
-    readonly changedAt: Date;
-    readonly reason?: SuspensionReason;
-    readonly correlationId?: string;
-}
-export interface FederationNodeProps {
-    readonly nodeId: string;
-    readonly publicKey: string;
-    readonly endpoint: string;
-    readonly capabilities: FederationNodeCapabilities;
-    readonly trustLevel: TrustLevel;
-    readonly trustScore: number;
-    readonly lastSeen: Date;
-    readonly metadata: FederationNodeMetadata;
-    /** Phase 2: peer state. Defaults to ACTIVE if unset. */
-    readonly state?: FederationNodeState;
-    /** Phase 2: when the current state was entered. Defaults to now. */
-    readonly stateChangedAt?: Date;
-    /** Phase 2: why we entered the current non-ACTIVE state. */
-    readonly stateReason?: SuspensionReason;
-    /** Phase 2: caller correlation key for the last transition. */
-    readonly stateCorrelationId?: string;
-}
-export declare class FederationNode {
-    readonly nodeId: string;
-    readonly publicKey: string;
-    readonly endpoint: string;
-    readonly capabilities: FederationNodeCapabilities;
-    private _trustLevel;
-    private _trustScore;
-    private _lastSeen;
-    private readonly _metadata;
-    private _state;
-    private _stateChangedAt;
-    private _stateReason?;
-    private _stateCorrelationId?;
-    constructor(props: FederationNodeProps);
-    get trustLevel(): TrustLevel;
-    get trustScore(): number;
-    get lastSeen(): Date;
-    get metadata(): FederationNodeMetadata;
-    /** Current peer state (ADR-097 Phase 2). */
-    get state(): FederationNodeState;
-    /** When the current state was entered. */
-    get stateChangedAt(): Date;
-    /** Last-transition record for the audit trail. */
-    get stateRecord(): FederationNodeStateRecord;
-    /** Convenience predicate: is this peer accepting outbound sends? */
-    get isActive(): boolean;
-    /** Convenience predicate: is this peer terminally evicted? */
-    get isEvicted(): boolean;
-    updateTrustLevel(level: TrustLevel): void;
-    updateTrustScore(score: number): void;
-    markSeen(): void;
-    isStale(maxAgeMs: number): boolean;
-    /**
-     * Transition this peer to SUSPENDED. Legal from ACTIVE only — calling
-     * from SUSPENDED or EVICTED returns false (the entity is already at or
-     * past the breaker threshold, so a duplicate trip is a no-op).
-     *
-     * Returns true if the state changed, false if the call was rejected
-     * (illegal transition). The breaker treats false as "already handled."
-     */
-    suspend(reason: TransitionReason, now?: Date): boolean;
-    /**
-     * Transition this peer to EVICTED. Legal from ACTIVE or SUSPENDED.
-     * EVICTED is terminal under normal flow — only `reactivate` (operator-
-     * initiated) can move the peer back to ACTIVE.
-     */
-    evict(reason: TransitionReason, now?: Date): boolean;
-    /**
-     * Transition back to ACTIVE. Legal from SUSPENDED (after cooldown +
-     * probe success — the breaker is responsible for those checks; this
-     * entity does not gate on time) or from EVICTED (operator override).
-     *
-     * `correlationId` lets the caller record *why* they're reactivating
-     * (probe ID, operator ticket, etc.) for the audit trail.
-     */
-    reactivate(correlationId?: string, now?: Date): boolean;
-    private _transition;
-    toProps(): FederationNodeProps;
-    static create(props: Omit<FederationNodeProps, 'trustLevel' | 'trustScore' | 'lastSeen'> & {
-        trustLevel?: TrustLevel;
-        trustScore?: number;
-        lastSeen?: Date;
-    }): FederationNode;
-}
-//# sourceMappingURL=federation-node.d.ts.map

package/dist/domain/entities/federation-session.d.ts

@@ -1,55 +0,0 @@
-import { TrustLevel } from './trust-level.js';
-export interface SessionMetrics {
-    messagesSent: number;
-    messagesReceived: number;
-    piiRedactions: number;
-    threatDetections: number;
-    hmacFailures: number;
-    totalInteractions: number;
-}
-export interface FederationSessionProps {
-    readonly sessionId: string;
-    readonly localNodeId: string;
-    readonly remoteNodeId: string;
-    readonly trustLevel: TrustLevel;
-    readonly negotiatedCapabilities: readonly string[];
-    readonly createdAt: Date;
-    readonly expiresAt: Date;
-    readonly heartbeatInterval: number;
-    readonly sessionToken: string;
-    readonly metrics: SessionMetrics;
-}
-export declare class FederationSession {
-    readonly sessionId: string;
-    readonly localNodeId: string;
-    readonly remoteNodeId: string;
-    readonly negotiatedCapabilities: readonly string[];
-    readonly createdAt: Date;
-    readonly heartbeatInterval: number;
-    readonly sessionToken: string;
-    private _trustLevel;
-    private _expiresAt;
-    private _lastHeartbeat;
-    private _metrics;
-    private _active;
-    constructor(props: FederationSessionProps);
-    get trustLevel(): TrustLevel;
-    get expiresAt(): Date;
-    get lastHeartbeat(): Date;
-    get metrics(): Readonly<SessionMetrics>;
-    get active(): boolean;
-    isExpired(): boolean;
-    isHeartbeatOverdue(): boolean;
-    recordHeartbeat(): void;
-    renew(newExpiresAt: Date): void;
-    updateTrustLevel(level: TrustLevel): void;
-    recordMessageSent(): void;
-    recordMessageReceived(): void;
-    recordPiiRedaction(): void;
-    recordThreatDetection(): void;
-    recordHmacFailure(): void;
-    terminate(): void;
-    toProps(): FederationSessionProps;
-    static createMetrics(): SessionMetrics;
-}
-//# sourceMappingURL=federation-session.d.ts.map

package/dist/domain/entities/trust-level.d.ts

@@ -1,17 +0,0 @@
-export declare enum TrustLevel {
-    UNTRUSTED = 0,
-    VERIFIED = 1,
-    ATTESTED = 2,
-    TRUSTED = 3,
-    PRIVILEGED = 4
-}
-export interface TrustTransitionThreshold {
-    upgradeScore: number;
-    downgradeScore: number;
-    minInteractions: number;
-}
-export declare const TRUST_TRANSITION_THRESHOLDS: Record<string, TrustTransitionThreshold>;
-export declare const CAPABILITY_GATES: Record<TrustLevel, readonly string[]>;
-export declare function isOperationAllowed(trustLevel: TrustLevel, operation: string): boolean;
-export declare function getTrustLevelLabel(level: TrustLevel): string;
-//# sourceMappingURL=trust-level.d.ts.map

package/dist/domain/services/audit-service.d.ts

@@ -1,69 +0,0 @@
-export type FederationAuditEventType = 'peer_discovered' | 'peer_manifest_published' | 'handshake_initiated' | 'handshake_completed' | 'handshake_failed' | 'handshake_rejected' | 'session_created' | 'session_renewed' | 'session_expired' | 'session_terminated' | 'message_sent' | 'message_received' | 'message_rejected' | 'message_timeout' | 'pii_detected' | 'pii_stripped' | 'pii_blocked' | 'threat_detected' | 'threat_blocked' | 'threat_learned' | 'claim_checked' | 'claim_denied' | 'trust_level_changed' | 'consensus_proposed' | 'consensus_voted' | 'consensus_reached' | 'consensus_failed';
-export type AuditSeverity = 'info' | 'warn' | 'error' | 'critical';
-export type AuditCategory = 'discovery' | 'handshake' | 'message' | 'pii' | 'security' | 'consensus';
-export type ComplianceMode = 'hipaa' | 'soc2' | 'gdpr' | 'none';
-export interface FederationAuditEvent {
-    readonly eventId: string;
-    readonly timestamp: string;
-    readonly nodeId: string;
-    readonly sessionId?: string;
-    readonly eventType: FederationAuditEventType;
-    readonly severity: AuditSeverity;
-    readonly category: AuditCategory;
-    readonly sourceNodeId?: string;
-    readonly targetNodeId?: string;
-    readonly agentId?: string;
-    readonly trustLevel?: number;
-    readonly piiDetected?: boolean;
-    readonly piiTypesFound?: string[];
-    readonly piiAction?: string;
-    readonly threatDetected?: boolean;
-    readonly threatTypes?: string[];
-    readonly claimsChecked?: string[];
-    readonly claimsResult?: 'granted' | 'denied';
-    readonly latencyMs?: number;
-    readonly messageSizeBytes?: number;
-    readonly complianceMode?: ComplianceMode;
-    readonly dataResidency?: string;
-    readonly metadata?: Record<string, unknown>;
-}
-export interface AuditQuery {
-    readonly eventType?: FederationAuditEventType;
-    readonly severity?: AuditSeverity;
-    readonly category?: AuditCategory;
-    readonly nodeId?: string;
-    readonly sessionId?: string;
-    readonly since?: Date;
-    readonly until?: Date;
-    readonly limit?: number;
-    readonly offset?: number;
-}
-export type AuditExportFormat = 'json' | 'csv' | 'ndjson';
-export interface AuditServiceDeps {
-    generateEventId: () => string;
-    getLocalNodeId: () => string;
-    persistEvent: (event: FederationAuditEvent) => Promise<void>;
-    queryEvents: (query: AuditQuery) => Promise<FederationAuditEvent[]>;
-    onAuditEvent?: (event: FederationAuditEvent) => void;
-}
-export interface AuditServiceConfig {
-    readonly complianceMode: ComplianceMode;
-    readonly dataResidency?: string;
-    readonly retentionDays: number;
-    readonly batchSize: number;
-}
-export declare class AuditService {
-    private readonly deps;
-    private readonly config;
-    private readonly buffer;
-    constructor(deps: AuditServiceDeps, config?: Partial<AuditServiceConfig>);
-    log(eventType: FederationAuditEventType, details?: Partial<Omit<FederationAuditEvent, 'eventId' | 'timestamp' | 'nodeId' | 'eventType' | 'severity' | 'category' | 'complianceMode'>>): Promise<FederationAuditEvent>;
-    query(query: AuditQuery): Promise<FederationAuditEvent[]>;
-    export(query: AuditQuery, format: AuditExportFormat): Promise<string>;
-    flush(): Promise<void>;
-    getBufferSize(): number;
-    private buildEvent;
-    private applyHipaaCompliance;
-    private toCsv;
-}
-//# sourceMappingURL=audit-service.d.ts.map

package/dist/domain/services/discovery-service.d.ts

@@ -1,68 +0,0 @@
-import { FederationNode } from '../entities/federation-node.js';
-import type { WgManifestSection } from '../value-objects/wg-config.js';
-export type DiscoveryMechanism = 'static' | 'dns-sd' | 'ipfs-registry' | 'a2a-card';
-export interface FederationManifest {
-    readonly nodeId: string;
-    readonly publicKey: string;
-    readonly endpoint: string;
-    readonly capabilities: {
-        readonly agentTypes: readonly string[];
-        readonly maxConcurrentSessions: number;
-        readonly supportedProtocols: readonly string[];
-        readonly complianceModes: readonly string[];
-    };
-    readonly version: string;
-    readonly signature: string;
-    readonly timestamp: string;
-    /**
-     * ADR-111 — optional WG mesh identity. Present only when the publishing
-     * node has opted into the in-tree WG layer (`config.wgMesh: true`).
-     * The Ed25519 manifest signature covers this block too — peers verifying
-     * the manifest also verify the WG-key binding.
-     */
-    readonly wg?: WgManifestSection;
-}
-export interface DiscoveryServiceDeps {
-    signManifest: (manifest: Omit<FederationManifest, 'signature'>) => Promise<string>;
-    verifyManifest: (manifest: FederationManifest) => Promise<boolean>;
-    onPeerDiscovered?: (node: FederationNode) => void;
-}
-export interface DiscoveryConfig {
-    readonly staticPeers: readonly string[];
-    readonly enableDnsSd: boolean;
-    readonly enableIpfsRegistry: boolean;
-    readonly ipfsRegistryCid?: string;
-    readonly discoveryIntervalMs: number;
-    readonly staleThresholdMs: number;
-}
-export declare class DiscoveryService {
-    private readonly deps;
-    private readonly config;
-    private readonly knownPeers;
-    private localManifest;
-    private discoveryTimer;
-    constructor(deps: DiscoveryServiceDeps, config?: Partial<DiscoveryConfig>);
-    publishManifest(manifest: Omit<FederationManifest, 'signature'>): Promise<FederationManifest>;
-    getLocalManifest(): FederationManifest | null;
-    discoverPeers(): Promise<FederationNode[]>;
-    addStaticPeer(endpoint: string, manifest?: FederationManifest): Promise<FederationNode>;
-    /**
-     * Register an externally-discovered peer (e.g. mapped from an A2A Agent
-     * Card via `fromAgentCard`). Unlike `addStaticPeer` this takes a fully
-     * constructed node — the caller owns validation of the external format —
-     * and the node keeps whatever trust level it was constructed with
-     * (A2A-card peers arrive UNTRUSTED). Existing peers are refreshed, not
-     * replaced, so accumulated trust state survives re-discovery.
-     */
-    registerExternalPeer(node: FederationNode): FederationNode;
-    removePeer(nodeId: string): boolean;
-    getPeer(nodeId: string): FederationNode | undefined;
-    listPeers(): FederationNode[];
-    listActivePeers(): FederationNode[];
-    pruneStale(): string[];
-    startPeriodicDiscovery(): void;
-    stopPeriodicDiscovery(): void;
-    private findByEndpoint;
-    private hashEndpoint;
-}
-//# sourceMappingURL=discovery-service.d.ts.map

package/dist/domain/services/handshake-service.d.ts

@@ -1,58 +0,0 @@
-import { FederationNode } from '../entities/federation-node.js';
-import { FederationSession } from '../entities/federation-session.js';
-export interface HandshakeChallenge {
-    readonly challengeId: string;
-    readonly nonce: string;
-    readonly timestamp: string;
-    readonly sourceNodeId: string;
-    readonly targetNodeId: string;
-}
-export interface HandshakeChallengeResponse {
-    readonly challengeId: string;
-    readonly signedNonce: string;
-    readonly publicKey: string;
-    readonly capabilities: readonly string[];
-}
-export interface HandshakeResult {
-    readonly success: boolean;
-    readonly session?: FederationSession;
-    readonly error?: string;
-}
-export interface HandshakeServiceDeps {
-    generateSessionId: () => string;
-    generateSessionToken: () => string;
-    generateNonce: () => string;
-    signChallenge: (nonce: string) => Promise<string>;
-    verifySignature: (nonce: string, signature: string, publicKey: string) => Promise<boolean>;
-    getLocalNodeId: () => string;
-    getLocalPublicKey: () => string;
-    getLocalCapabilities: () => readonly string[];
-}
-export interface HandshakeConfig {
-    readonly sessionTtlMs: number;
-    readonly maxSessionTtlMs: number;
-    readonly heartbeatIntervalMs: number;
-    readonly challengeTimeoutMs: number;
-}
-export declare class HandshakeService {
-    private readonly deps;
-    private readonly config;
-    private readonly pendingChallenges;
-    constructor(deps: HandshakeServiceDeps, config?: Partial<HandshakeConfig>);
-    initiateHandshake(remoteNode: FederationNode): Promise<HandshakeChallenge>;
-    respondToHandshake(challenge: HandshakeChallenge): Promise<HandshakeChallengeResponse>;
-    verifyChallenge(response: HandshakeChallengeResponse, remoteNode: FederationNode): Promise<HandshakeResult>;
-    /**
-     * Establish a capability-limited session from discovery evidence.
-     *
-     * A signed manifest proves that the advertised key bound the protocol list;
-     * it does not prove live challenge response, so this path never elevates
-     * beyond VERIFIED. Endpoint-only peers remain UNTRUSTED with no negotiated
-     * optional capabilities. A future wire handshake may elevate either session
-     * after authenticating a response received from the remote process.
-     */
-    establishDiscoverySession(remoteNode: FederationNode, verifiedManifest: boolean): FederationSession;
-    renewSession(session: FederationSession): FederationSession;
-    private cleanExpiredChallenges;
-}
-//# sourceMappingURL=handshake-service.d.ts.map

package/dist/domain/services/pii-pipeline-service.d.ts

@@ -1,65 +0,0 @@
-import { TrustLevel } from '../entities/trust-level.js';
-export type PIIType = 'email' | 'ssn' | 'credit_card' | 'api_key' | 'password' | 'name' | 'address' | 'phone' | 'ip_address' | 'jwt' | 'aws_key' | 'private_key' | 'database_url' | 'github_token';
-export type PIIAction = 'block' | 'redact' | 'hash' | 'pass';
-export interface PIIDetection {
-    readonly type: PIIType;
-    readonly value: string;
-    readonly confidence: number;
-    readonly offset: number;
-    readonly context: string;
-}
-export interface PIIPolicyConfig {
-    defaultAction: PIIAction;
-    overrides: Partial<Record<PIIType, {
-        action: PIIAction;
-        trustLevelOverride?: Partial<Record<TrustLevel, PIIAction>>;
-    }>>;
-    hashAlgorithm: 'sha256' | 'blake3';
-    hashSalt: string;
-    redactionPlaceholder: string;
-}
-export interface PIICalibration {
-    type: PIIType;
-    falsePositiveRate: number;
-    falseNegativeRate: number;
-    adjustedThreshold: number;
-    totalOverrides: number;
-    lastCalibrated: string;
-}
-export interface PIITransformResult {
-    readonly originalText: string;
-    readonly transformedText: string;
-    readonly detections: readonly PIIDetection[];
-    readonly actionsApplied: readonly {
-        type: PIIType;
-        action: PIIAction;
-    }[];
-    readonly blocked: boolean;
-}
-export interface PIIConfidenceThresholds {
-    autoBlock: number;
-    autoRedact: number;
-    flagForReview: number;
-    ignore: number;
-}
-export interface PIIPipelineServiceDeps {
-    hashFunction: (value: string, salt: string) => string;
-}
-export declare class PIIPipelineService {
-    private readonly deps;
-    private readonly policy;
-    private readonly calibrations;
-    private readonly confidenceThresholds;
-    constructor(deps: PIIPipelineServiceDeps, policy?: Partial<PIIPolicyConfig>, confidenceThresholds?: Partial<PIIConfidenceThresholds>);
-    detect(text: string): PIIDetection[];
-    classify(detections: PIIDetection[]): Map<PIIType, PIIDetection[]>;
-    evaluate(detection: PIIDetection, trustLevel: TrustLevel): PIIAction;
-    transform(text: string, trustLevel: TrustLevel): PIITransformResult;
-    updateCalibration(type: PIIType, calibration: PIICalibration): void;
-    getCalibration(type: PIIType): PIICalibration | undefined;
-    private computeConfidence;
-    private getEffectiveThreshold;
-    static defaultPolicy(): PIIPolicyConfig;
-    static defaultPolicyMatrix(): Record<PIIType, Record<TrustLevel, PIIAction>>;
-}
-//# sourceMappingURL=pii-pipeline-service.d.ts.map

package/dist/domain/services/routing-service.d.ts

@@ -1,54 +0,0 @@
-import { FederationEnvelope, type FederationEnvelopeProps, type FederationMessageType } from '../entities/federation-envelope.js';
-import { FederationSession } from '../entities/federation-session.js';
-import { TrustLevel } from '../entities/trust-level.js';
-export type RoutingMode = 'direct' | 'broadcast' | 'consensus';
-export interface RoutingResult {
-    readonly success: boolean;
-    readonly mode: RoutingMode;
-    readonly envelopeId: string;
-    readonly targetNodeIds: readonly string[];
-    readonly error?: string;
-    readonly latencyMs?: number;
-}
-export interface ConsensusProposal {
-    readonly proposalId: string;
-    readonly proposerNodeId: string;
-    readonly messageType: FederationMessageType;
-    readonly payload: unknown;
-    readonly quorumRequired: number;
-    readonly votes: Map<string, boolean>;
-    readonly createdAt: Date;
-    readonly expiresAt: Date;
-}
-export interface RoutingServiceDeps {
-    generateEnvelopeId: () => string;
-    generateNonce: () => string;
-    signEnvelope: (payload: string, sessionToken: string) => string;
-    verifyEnvelope: (payload: string, signature: string, sessionToken: string) => boolean;
-    scanPii: (text: string, trustLevel: number) => {
-        transformedText: string;
-        scanResult: FederationEnvelopeProps['piiScanResult'];
-    };
-    sendToNode: (nodeId: string, envelope: FederationEnvelope) => Promise<void>;
-    getActiveSessions: () => FederationSession[];
-    getLocalNodeId: () => string;
-    /** Current peer authority; absent peers/resolvers receive the untrusted PII policy. */
-    getPeerTrustLevel?: (nodeId: string) => TrustLevel | undefined;
-}
-export declare class RoutingService {
-    private readonly deps;
-    private readonly pendingProposals;
-    constructor(deps: RoutingServiceDeps);
-    selectMode(messageType: FederationMessageType): RoutingMode;
-    send<T>(session: FederationSession, messageType: FederationMessageType, payload: T): Promise<RoutingResult>;
-    broadcast<T>(messageType: FederationMessageType, payload: T): Promise<RoutingResult[]>;
-    propose<T>(messageType: FederationMessageType, payload: T, quorumFraction?: number): Promise<ConsensusProposal>;
-    recordVote(proposalId: string, nodeId: string, vote: boolean): boolean;
-    isConsensusReached(proposalId: string): {
-        reached: boolean;
-        approved: boolean;
-    };
-    verifyInboundEnvelope(envelope: FederationEnvelope, sessionToken: string): boolean;
-    cleanExpiredProposals(): void;
-}
-//# sourceMappingURL=routing-service.d.ts.map

package/dist/domain/services/wg-firewall-service.d.ts

@@ -1,71 +0,0 @@
-/**
- * ADR-111 Phase 4 — Trust-graded firewall projection.
- *
- * Projects the WG_NETWORK_GATES table (defined in wg-mesh-service.ts) into
- * concrete kernel-firewall rules. Two backends:
- *
- *   - `nftables` for Linux — atomic `nft -f <file>` loader, family `inet`,
- *     hook `input` (interface-scoped to the WG iface).
- *   - `pf` for macOS — `pfctl -a ruflo-fed -f <file>`, anchor-scoped so
- *     ruflo's rules don't collide with the operator's main pf ruleset.
- *
- * Like Phase 2's WgMeshService this is a **pure-projection** service: it
- * returns rule strings + the shell command the operator runs. It never
- * shells out or modifies kernel state itself. Operator review is mandatory
- * because `pf` / `nft` reloads atomically replace the active ruleset for
- * the targeted scope — a typo here can drop ssh.
- *
- * v1 scope: the four trust levels VERIFIED/ATTESTED/TRUSTED/PRIVILEGED.
- * UNTRUSTED peers are never in the mesh (excluded by WgMeshService) so
- * they don't need a firewall rule either — implicit drop policy.
- */
-import { FederationNode } from '../entities/federation-node.js';
-export type WgFirewallPlatform = 'linux-nftables' | 'darwin-pf';
-export interface WgFirewallServiceConfig {
-    /** Target platform. Default: auto-detect from process.platform. */
-    readonly platform?: WgFirewallPlatform;
-    /** WG interface name to scope rules to. Defaults to `ruflo-fed`. */
-    readonly interfaceName?: string;
-    /** Where the operator should write the rule file. Used for the load-command string. */
-    readonly rulePath?: string;
-    /** pf anchor (macOS only). Defaults to `ruflo-fed`. */
-    readonly pfAnchor?: string;
-}
-export interface WgFirewallRuleSet {
-    /** The full rule-file content the operator writes to disk. */
-    readonly content: string;
-    /** The shell command the operator runs to load it. */
-    readonly loadCmd: string;
-    /** Recommended file path (informational — the operator decides). */
-    readonly rulePath: string;
-    /** Per-peer rule projections for audit/inspection. */
-    readonly peerProjections: ReadonlyArray<{
-        readonly nodeId: string;
-        readonly trustLabel: string;
-        readonly meshIP: string;
-        readonly rules: readonly string[];
-    }>;
-}
-export declare class WgFirewallService {
-    private readonly platform;
-    private readonly interfaceName;
-    private readonly rulePath;
-    private readonly pfAnchor;
-    constructor(config?: WgFirewallServiceConfig);
-    getPlatform(): WgFirewallPlatform;
-    /**
-     * Project the current peer set into a complete rule file (nftables or pf)
-     * scoped to the WG interface.
-     *
-     * Peers below WG_MIN_MESH_TRUST (UNTRUSTED) are dropped — they have no
-     * mesh IP and shouldn't appear in firewall allow rules anyway. Peers
-     * without `metadata.wgMeshIP` are skipped (a stale manifest with no WG
-     * block; the mesh layer already excludes them).
-     */
-    projectRules(peers: readonly FederationNode[]): WgFirewallRuleSet;
-    private renderNftables;
-    private renderPf;
-    private defaultRulePath;
-    private trustLabel;
-}
-//# sourceMappingURL=wg-firewall-service.d.ts.map