agentic-flow 2.0.13 → 2.1.0

package/dist/router/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/router/types.ts"],"names":[],"mappings":"AAAA,oCAAoC","sourcesContent":["// Core types for multi-model router\n\nexport interface LLMProvider {\n  name: string;\n  type: ProviderType;\n  supportsStreaming: boolean;\n  supportsTools: boolean;\n  supportsMCP: boolean;\n  chat(params: ChatParams): Promise<ChatResponse>;\n  stream?(params: ChatParams): AsyncGenerator<StreamChunk>;\n  validateCapabilities(features: string[]): boolean;\n}\n\nexport type ProviderType = 'anthropic' | 'openai' | 'openrouter' | 'ollama' | 'litellm' | 'onnx' | 'gemini' | 'custom';\n\nexport interface ChatParams {\n  model: string;\n  messages: Message[];\n  temperature?: number;\n  maxTokens?: number;\n  tools?: Tool[];\n  toolChoice?: 'auto' | 'any' | 'none' | { type: 'tool'; name: string };\n  stream?: boolean;\n  metadata?: Record<string, any>;\n  provider?: string; // Force specific provider (gemini, openrouter, anthropic, etc.)\n}\n\nexport interface Message {\n  role: 'user' | 'assistant' | 'system';\n  content: string | ContentBlock[];\n}\n\nexport interface ContentBlock {\n  type: 'text' | 'tool_use' | 'tool_result';\n  text?: string;\n  id?: string;\n  name?: string;\n  input?: any;\n  content?: any;\n  is_error?: boolean;\n}\n\nexport interface Tool {\n  name: string;\n  description: string;\n  input_schema: {\n    type: 'object';\n    properties: Record<string, any>;\n    required?: string[];\n  };\n}\n\nexport interface ChatResponse {\n  id: string;\n  model: string;\n  content: ContentBlock[];\n  stopReason?: 'end_turn' | 'max_tokens' | 'tool_use' | 'stop_sequence';\n  usage?: {\n    inputTokens: number;\n    outputTokens: number;\n  };\n  metadata?: {\n    provider: string;\n    model?: string;\n    cost?: number;\n    latency?: number;\n    executionProviders?: string[];\n    [key: string]: any;\n  };\n}\n\nexport interface StreamChunk {\n  type: 'content_block_start' | 'content_block_delta' | 'content_block_stop' | 'message_start' | 'message_delta' | 'message_stop';\n  delta?: {\n    type: 'text_delta' | 'input_json_delta';\n    text?: string;\n    partial_json?: string;\n  };\n  content_block?: ContentBlock;\n  message?: Partial<ChatResponse>;\n  usage?: {\n    inputTokens: number;\n    outputTokens: number;\n  };\n}\n\nexport interface ProviderConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  organization?: string;\n  models?: {\n    default: string;\n    fast?: string;\n    advanced?: string;\n    [key: string]: string | undefined;\n  };\n  timeout?: number;\n  maxRetries?: number;\n  retryDelay?: number;\n  rateLimit?: {\n    requestsPerMinute?: number;\n    tokensPerMinute?: number;\n  };\n  preferences?: Record<string, any>;\n  // ONNX-specific config\n  modelPath?: string;\n  executionProviders?: string[];\n  maxTokens?: number;\n  temperature?: number;\n  localInference?: boolean;\n  gpuAcceleration?: boolean;\n}\n\nexport interface RouterConfig {\n  version: string;\n  defaultProvider: ProviderType;\n  fallbackChain?: ProviderType[];\n  providers: Record<ProviderType, ProviderConfig>;\n  routing?: RoutingConfig;\n  toolCalling?: ToolCallingConfig;\n  monitoring?: MonitoringConfig;\n  cache?: CacheConfig;\n}\n\nexport interface RoutingConfig {\n  mode: 'manual' | 'cost-optimized' | 'performance-optimized' | 'quality-optimized' | 'rule-based';\n  rules?: RoutingRule[];\n  costOptimization?: {\n    enabled: boolean;\n    maxCostPerRequest?: number;\n    budgetAlerts?: {\n      daily?: number;\n      monthly?: number;\n    };\n    preferCheaper?: boolean;\n    costThreshold?: number;\n  };\n  performance?: {\n    timeout?: number;\n    concurrentRequests?: number;\n    circuitBreaker?: {\n      enabled: boolean;\n      threshold: number;\n      timeout: number;\n      resetTimeout?: number;\n    };\n  };\n}\n\nexport interface RoutingRule {\n  condition: {\n    agentType?: string[];\n    requiresTools?: boolean;\n    complexity?: 'low' | 'medium' | 'high';\n    privacy?: 'low' | 'medium' | 'high';\n    localOnly?: boolean;\n    requiresReasoning?: boolean;\n  };\n  action: {\n    provider: ProviderType;\n    model: string;\n    temperature?: number;\n    maxTokens?: number;\n  };\n  reason?: string;\n}\n\nexport interface ToolCallingConfig {\n  translationEnabled: boolean;\n  defaultFormat: 'anthropic' | 'openai' | 'auto-detect';\n  formatMapping?: Record<string, string>;\n  fallbackStrategy?: 'disable-tools' | 'use-text' | 'fail';\n}\n\nexport interface MonitoringConfig {\n  enabled: boolean;\n  logLevel: 'debug' | 'info' | 'warn' | 'error';\n  metrics?: {\n    trackCost?: boolean;\n    trackLatency?: boolean;\n    trackTokens?: boolean;\n    trackErrors?: boolean;\n  };\n  alerts?: {\n    costThreshold?: number;\n    errorRate?: number;\n    latencyThreshold?: number;\n  };\n}\n\nexport interface CacheConfig {\n  enabled: boolean;\n  ttl?: number;\n  maxSize?: number;\n  strategy?: 'lru' | 'fifo' | 'lfu';\n  providers?: Record<string, { ttl?: number }>;\n}\n\nexport interface RouterMetrics {\n  totalRequests: number;\n  totalCost: number;\n  totalTokens: {\n    input: number;\n    output: number;\n  };\n  providerBreakdown: Record<string, {\n    requests: number;\n    cost: number;\n    avgLatency: number;\n    errors: number;\n  }>;\n  agentBreakdown?: Record<string, {\n    requests: number;\n    cost: number;\n  }>;\n}\n\nexport interface ProviderError extends Error {\n  provider: string;\n  statusCode?: number;\n  retryable: boolean;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/router/types.ts"],"names":[],"mappings":"AAAA,oCAAoC","sourcesContent":["// Core types for multi-model router\n\nexport interface LLMProvider {\n  name: string;\n  type: ProviderType;\n  supportsStreaming: boolean;\n  supportsTools: boolean;\n  supportsMCP: boolean;\n  chat(params: ChatParams): Promise<ChatResponse>;\n  stream?(params: ChatParams): AsyncGenerator<StreamChunk>;\n  validateCapabilities(features: string[]): boolean;\n}\n\nexport type ProviderType = 'anthropic' | 'openai' | 'openrouter' | 'ollama' | 'litellm' | 'onnx' | 'gemini' | 'custom';\n\nexport interface ChatParams {\n  model: string;\n  messages: Message[];\n  temperature?: number;\n  maxTokens?: number;\n  tools?: Tool[];\n  toolChoice?: 'auto' | 'any' | 'none' | { type: 'tool'; name: string };\n  stream?: boolean;\n  metadata?: Record<string, any>;\n  provider?: string; // Force specific provider (gemini, openrouter, anthropic, etc.)\n}\n\nexport interface Message {\n  role: 'user' | 'assistant' | 'system';\n  content: string | ContentBlock[];\n}\n\nexport interface ContentBlock {\n  type: 'text' | 'tool_use' | 'tool_result';\n  text?: string;\n  id?: string;\n  name?: string;\n  input?: any;\n  content?: any;\n  is_error?: boolean;\n}\n\nexport interface Tool {\n  name: string;\n  description: string;\n  input_schema: {\n    type: 'object';\n    properties: Record<string, any>;\n    required?: string[];\n  };\n}\n\nexport interface ChatResponse {\n  id: string;\n  model: string;\n  content: ContentBlock[];\n  stopReason?: 'end_turn' | 'max_tokens' | 'tool_use' | 'stop_sequence';\n  usage?: {\n    inputTokens: number;\n    outputTokens: number;\n  };\n  metadata?: {\n    provider: string;\n    model?: string;\n    cost?: number;\n    latency?: number;\n    executionProviders?: string[];\n    [key: string]: any;\n  };\n}\n\nexport interface StreamChunk {\n  type: 'content_block_start' | 'content_block_delta' | 'content_block_stop' | 'message_start' | 'message_delta' | 'message_stop';\n  delta?: {\n    type: 'text_delta' | 'input_json_delta';\n    text?: string;\n    partial_json?: string;\n  };\n  content_block?: ContentBlock;\n  message?: Partial<ChatResponse>;\n  usage?: {\n    inputTokens: number;\n    outputTokens: number;\n  };\n}\n\nexport interface ProviderConfig {\n  apiKey?: string;\n  baseUrl?: string;\n  organization?: string;\n  models?: {\n    default: string;\n    fast?: string;\n    advanced?: string;\n    [key: string]: string | undefined;\n  };\n  timeout?: number;\n  maxRetries?: number;\n  retryDelay?: number;\n  rateLimit?: {\n    requestsPerMinute?: number;\n    tokensPerMinute?: number;\n  };\n  preferences?: Record<string, any>;\n  // ONNX-specific config\n  modelPath?: string;\n  executionProviders?: string[];\n  maxTokens?: number;\n  temperature?: number;\n  localInference?: boolean;\n  gpuAcceleration?: boolean;\n}\n\nexport interface RouterConfig {\n  version: string;\n  defaultProvider: ProviderType;\n  fallbackChain?: ProviderType[];\n  providers: Record<ProviderType, ProviderConfig>;\n  routing?: RoutingConfig;\n  toolCalling?: ToolCallingConfig;\n  monitoring?: MonitoringConfig;\n  cache?: CacheConfig;\n}\n\nexport interface RoutingConfig {\n  // 'cost-optimized' = legacy heuristic provider ordering;\n  // 'cost-optimal'   = learned predicted-quality-per-cost routing (ADR-073)\n  mode: 'manual' | 'cost-optimized' | 'cost-optimal' | 'performance-optimized' | 'quality-optimized' | 'rule-based';\n  rules?: RoutingRule[];\n  costOptimization?: {\n    enabled: boolean;\n    maxCostPerRequest?: number;\n    budgetAlerts?: {\n      daily?: number;\n      monthly?: number;\n    };\n    preferCheaper?: boolean;\n    costThreshold?: number;\n  };\n  performance?: {\n    timeout?: number;\n    concurrentRequests?: number;\n    circuitBreaker?: {\n      enabled: boolean;\n      threshold: number;\n      timeout: number;\n      resetTimeout?: number;\n    };\n  };\n}\n\nexport interface RoutingRule {\n  condition: {\n    agentType?: string[];\n    requiresTools?: boolean;\n    complexity?: 'low' | 'medium' | 'high';\n    privacy?: 'low' | 'medium' | 'high';\n    localOnly?: boolean;\n    requiresReasoning?: boolean;\n  };\n  action: {\n    provider: ProviderType;\n    model: string;\n    temperature?: number;\n    maxTokens?: number;\n  };\n  reason?: string;\n}\n\nexport interface ToolCallingConfig {\n  translationEnabled: boolean;\n  defaultFormat: 'anthropic' | 'openai' | 'auto-detect';\n  formatMapping?: Record<string, string>;\n  fallbackStrategy?: 'disable-tools' | 'use-text' | 'fail';\n}\n\nexport interface MonitoringConfig {\n  enabled: boolean;\n  logLevel: 'debug' | 'info' | 'warn' | 'error';\n  metrics?: {\n    trackCost?: boolean;\n    trackLatency?: boolean;\n    trackTokens?: boolean;\n    trackErrors?: boolean;\n  };\n  alerts?: {\n    costThreshold?: number;\n    errorRate?: number;\n    latencyThreshold?: number;\n  };\n}\n\nexport interface CacheConfig {\n  enabled: boolean;\n  ttl?: number;\n  maxSize?: number;\n  strategy?: 'lru' | 'fifo' | 'lfu';\n  providers?: Record<string, { ttl?: number }>;\n}\n\nexport interface RouterMetrics {\n  totalRequests: number;\n  totalCost: number;\n  totalTokens: {\n    input: number;\n    output: number;\n  };\n  providerBreakdown: Record<string, {\n    requests: number;\n    cost: number;\n    avgLatency: number;\n    errors: number;\n  }>;\n  agentBreakdown?: Record<string, {\n    requests: number;\n    cost: number;\n  }>;\n}\n\nexport interface ProviderError extends Error {\n  provider: string;\n  statusCode?: number;\n  retryable: boolean;\n}\n"]}

package/dist/sdk/plugins.d.ts

@@ -36,8 +36,8 @@ export type PluginConfig = LocalPluginConfig | NpmPluginConfig | RemotePluginCon
 export interface PluginTool {
     name: string;
     description: string;
-    inputSchema: Record<string, any>;
-    handler: (input: any) => Promise<any>;
+    inputSchema: Record<string, unknown>;
+    handler: (input: unknown) => Promise<unknown>;
 }
 /**
  * Loaded plugin instance
@@ -77,7 +77,7 @@ export declare function getAllPluginTools(): PluginTool[];
 /**
  * Execute a plugin tool
  */
-export declare function executePluginTool(toolName: string, input: any): Promise<any>;
+export declare function executePluginTool(toolName: string, input: unknown): Promise<unknown>;
 /**
  * Load plugins from SDK configuration
  */
@@ -85,7 +85,7 @@ export declare function loadPluginsFromConfig(configs: PluginConfig[]): Promise<
 /**
  * Get plugin configuration for SDK query options
  */
-export declare function getPluginsForSdk(): any[];
+export declare function getPluginsForSdk(): PluginConfig[];
 /**
  * Create an inline plugin helper
  */
@@ -96,7 +96,7 @@ export declare function createPlugin(name: string, tools: PluginTool[]): LoadedP
 export declare function defineTool<T>(config: {
     name: string;
     description: string;
-    inputSchema: Record<string, any>;
-    handler: (input: T) => Promise<any>;
+    inputSchema: Record<string, unknown>;
+    handler: (input: T) => Promise<unknown>;
 }): PluginTool;
 //# sourceMappingURL=plugins.d.ts.map

package/dist/sdk/plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/sdk/plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,eAAe,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAEzG;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD;;GAEG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmBnF;AAuJD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CAEjD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAE3D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAOxE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMlD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,EAAE,CAQhD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAYlF;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAY5F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,EAAE,CAoBxC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,YAAY,CAE5E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACrC,GAAG,UAAU,CAOb"}
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/sdk/plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyCH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,eAAe,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAEzG;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IAEpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD;;GAEG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmBnF;AAyJD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CAEjD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAE3D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAOxE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMlD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,EAAE,CAQhD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY1F;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAY5F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CAoBjD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,YAAY,CAE5E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzC,GAAG,UAAU,CAOb"}

package/dist/sdk/plugins.js

@@ -10,6 +10,41 @@
 import { logger } from "../utils/logger.js";
 import { existsSync, readFileSync } from "fs";
 import { join, resolve } from "path";
+/**
+ * Assert that a URL is safe to fetch (CWE-918 SSRF mitigation).
+ * Only HTTPS URLs pointing to non-private hosts are allowed.
+ */
+function assertSafeUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`Invalid plugin URL: ${rawUrl}`);
+    }
+    if (parsed.protocol !== 'https:') {
+        throw new Error(`Plugin URL must use HTTPS (got ${parsed.protocol}): ${rawUrl}`);
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    // Block RFC-1918, link-local, loopback, and metadata service addresses
+    const privatePatterns = [
+        /^localhost$/,
+        /^127\./,
+        /^10\./,
+        /^172\.(1[6-9]|2\d|3[01])\./,
+        /^192\.168\./,
+        /^169\.254\./, // link-local (AWS metadata, etc.)
+        /^::1$/,
+        /^fc00:/,
+        /^fe80:/,
+        /^0\.0\.0\.0$/,
+    ];
+    for (const pattern of privatePatterns) {
+        if (pattern.test(hostname)) {
+            throw new Error(`Plugin URL targets a private/internal address: ${rawUrl}`);
+        }
+    }
+}
 // Plugin registry
 const loadedPlugins = new Map();
 /**
@@ -105,6 +140,8 @@ async function loadNpmPlugin(config) {
  */
 async function loadRemotePlugin(config) {
     try {
+        // Validate URL before fetching to prevent SSRF (CWE-918)
+        assertSafeUrl(config.url);
         const response = await fetch(config.url);
         if (!response.ok) {
             throw new Error(`HTTP ${response.status}: ${response.statusText}`);

package/dist/sdk/plugins.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../src/sdk/plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAW,MAAM,MAAM,CAAC;AAoD9C,kBAAkB;AAClB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB;IACnD,IAAI,CAAC;QACH,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,OAAO;gBACV,OAAO,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;YACvC,KAAK,KAAK;gBACR,OAAO,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,KAAK,QAAQ;gBACX,OAAO,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,KAAK,QAAQ;gBACX,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAClC;gBACE,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,MAAyB;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEvD,IAAI,QAAQ,GAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAE1D,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,gCAAgC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC;IAE/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAiB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;IAExE,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,SAAS,UAAU,EAAE;QAC7B,KAAK;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IAEF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,MAAuB;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;QAC1G,MAAM,KAAK,GAAiB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QAExE,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO;YACrC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO;YACtD,MAAM,EAAE,OAAO,MAAM,CAAC,OAAO,EAAE;YAC/B,KAAK;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QAEF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAE7E,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAA0B;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtC,8BAA8B;QAC9B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,eAAe;YACvC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO;YACrC,MAAM,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE;YAC9B,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QAEF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAE5E,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAA0B;IAClD,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IAEF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAgB;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAU;IAClE,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAE9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACzD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAuB;IACjE,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAU,EAAE,CAAC;IAE1B,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAE9B,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAmB;IAC5D,OAAO,gBAAgB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAI,MAK7B;IACC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAuC;KACxD,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Plugins System - Load and manage Claude Agent SDK plugins\n *\n * Supports loading plugins from:\n * - Local filesystem\n * - NPM packages\n * - Remote URLs\n * - In-memory definitions\n */\n\nimport { logger } from \"../utils/logger.js\";\nimport { existsSync, readFileSync } from \"fs\";\nimport { join, resolve, dirname } from \"path\";\n\n/**\n * Plugin configuration types\n */\nexport interface LocalPluginConfig {\n  type: 'local';\n  path: string;\n}\n\nexport interface NpmPluginConfig {\n  type: 'npm';\n  package: string;\n  version?: string;\n}\n\nexport interface RemotePluginConfig {\n  type: 'remote';\n  url: string;\n  checksum?: string;\n}\n\nexport interface InlinePluginConfig {\n  type: 'inline';\n  name: string;\n  tools: PluginTool[];\n}\n\nexport type PluginConfig = LocalPluginConfig | NpmPluginConfig | RemotePluginConfig | InlinePluginConfig;\n\n/**\n * Plugin tool definition\n */\nexport interface PluginTool {\n  name: string;\n  description: string;\n  inputSchema: Record<string, any>;\n  handler: (input: any) => Promise<any>;\n}\n\n/**\n * Loaded plugin instance\n */\nexport interface LoadedPlugin {\n  name: string;\n  version: string;\n  source: string;\n  tools: PluginTool[];\n  enabled: boolean;\n  loadedAt: number;\n}\n\n// Plugin registry\nconst loadedPlugins = new Map<string, LoadedPlugin>();\n\n/**\n * Load a plugin from configuration\n */\nexport async function loadPlugin(config: PluginConfig): Promise<LoadedPlugin | null> {\n  try {\n    switch (config.type) {\n      case 'local':\n        return await loadLocalPlugin(config);\n      case 'npm':\n        return await loadNpmPlugin(config);\n      case 'remote':\n        return await loadRemotePlugin(config);\n      case 'inline':\n        return loadInlinePlugin(config);\n      default:\n        logger.error('Unknown plugin type', { config });\n        return null;\n    }\n  } catch (error) {\n    logger.error('Failed to load plugin', { config, error: (error as Error).message });\n    return null;\n  }\n}\n\n/**\n * Load plugin from local filesystem\n */\nasync function loadLocalPlugin(config: LocalPluginConfig): Promise<LoadedPlugin | null> {\n  const pluginPath = resolve(config.path);\n\n  if (!existsSync(pluginPath)) {\n    logger.error('Plugin path does not exist', { path: pluginPath });\n    return null;\n  }\n\n  // Look for package.json or plugin.json\n  const packageJsonPath = join(pluginPath, 'package.json');\n  const pluginJsonPath = join(pluginPath, 'plugin.json');\n\n  let metadata: any = { name: 'unknown', version: '0.0.0' };\n\n  if (existsSync(packageJsonPath)) {\n    metadata = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));\n  } else if (existsSync(pluginJsonPath)) {\n    metadata = JSON.parse(readFileSync(pluginJsonPath, 'utf-8'));\n  }\n\n  // Try to load the plugin module\n  const mainPath = join(pluginPath, metadata.main || 'index.js');\n\n  if (!existsSync(mainPath)) {\n    logger.error('Plugin main file not found', { path: mainPath });\n    return null;\n  }\n\n  const module = await import(mainPath);\n  const tools: PluginTool[] = module.tools || module.default?.tools || [];\n\n  const plugin: LoadedPlugin = {\n    name: metadata.name,\n    version: metadata.version,\n    source: `local:${pluginPath}`,\n    tools,\n    enabled: true,\n    loadedAt: Date.now()\n  };\n\n  loadedPlugins.set(plugin.name, plugin);\n  logger.info('Local plugin loaded', { name: plugin.name, tools: tools.length });\n\n  return plugin;\n}\n\n/**\n * Load plugin from NPM package\n */\nasync function loadNpmPlugin(config: NpmPluginConfig): Promise<LoadedPlugin | null> {\n  try {\n    const module = await import(config.package);\n    const metadata = module.default?.metadata || { name: config.package, version: config.version || '0.0.0' };\n    const tools: PluginTool[] = module.tools || module.default?.tools || [];\n\n    const plugin: LoadedPlugin = {\n      name: metadata.name || config.package,\n      version: metadata.version || config.version || '0.0.0',\n      source: `npm:${config.package}`,\n      tools,\n      enabled: true,\n      loadedAt: Date.now()\n    };\n\n    loadedPlugins.set(plugin.name, plugin);\n    logger.info('NPM plugin loaded', { name: plugin.name, tools: tools.length });\n\n    return plugin;\n  } catch (error) {\n    logger.error('Failed to load NPM plugin', { package: config.package, error: (error as Error).message });\n    return null;\n  }\n}\n\n/**\n * Load plugin from remote URL\n */\nasync function loadRemotePlugin(config: RemotePluginConfig): Promise<LoadedPlugin | null> {\n  try {\n    const response = await fetch(config.url);\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n    }\n\n    const content = await response.text();\n\n    // Verify checksum if provided\n    if (config.checksum) {\n      const hash = await computeHash(content);\n      if (hash !== config.checksum) {\n        throw new Error('Checksum mismatch - plugin may be compromised');\n      }\n    }\n\n    // Parse plugin definition (JSON format)\n    const pluginDef = JSON.parse(content);\n\n    const plugin: LoadedPlugin = {\n      name: pluginDef.name || 'remote-plugin',\n      version: pluginDef.version || '0.0.0',\n      source: `remote:${config.url}`,\n      tools: pluginDef.tools || [],\n      enabled: true,\n      loadedAt: Date.now()\n    };\n\n    loadedPlugins.set(plugin.name, plugin);\n    logger.info('Remote plugin loaded', { name: plugin.name, url: config.url });\n\n    return plugin;\n  } catch (error) {\n    logger.error('Failed to load remote plugin', { url: config.url, error: (error as Error).message });\n    return null;\n  }\n}\n\n/**\n * Load inline plugin from configuration\n */\nfunction loadInlinePlugin(config: InlinePluginConfig): LoadedPlugin {\n  const plugin: LoadedPlugin = {\n    name: config.name,\n    version: '1.0.0',\n    source: 'inline',\n    tools: config.tools,\n    enabled: true,\n    loadedAt: Date.now()\n  };\n\n  loadedPlugins.set(plugin.name, plugin);\n  logger.info('Inline plugin loaded', { name: plugin.name, tools: config.tools.length });\n\n  return plugin;\n}\n\n/**\n * Compute SHA-256 hash for checksum verification\n */\nasync function computeHash(content: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(content);\n  const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n  const hashArray = Array.from(new Uint8Array(hashBuffer));\n  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Get all loaded plugins\n */\nexport function getLoadedPlugins(): LoadedPlugin[] {\n  return Array.from(loadedPlugins.values());\n}\n\n/**\n * Get plugin by name\n */\nexport function getPlugin(name: string): LoadedPlugin | null {\n  return loadedPlugins.get(name) || null;\n}\n\n/**\n * Enable/disable a plugin\n */\nexport function setPluginEnabled(name: string, enabled: boolean): boolean {\n  const plugin = loadedPlugins.get(name);\n  if (!plugin) return false;\n\n  plugin.enabled = enabled;\n  logger.info('Plugin state changed', { name, enabled });\n  return true;\n}\n\n/**\n * Unload a plugin\n */\nexport function unloadPlugin(name: string): boolean {\n  const existed = loadedPlugins.delete(name);\n  if (existed) {\n    logger.info('Plugin unloaded', { name });\n  }\n  return existed;\n}\n\n/**\n * Get all tools from enabled plugins\n */\nexport function getAllPluginTools(): PluginTool[] {\n  const tools: PluginTool[] = [];\n  for (const plugin of loadedPlugins.values()) {\n    if (plugin.enabled) {\n      tools.push(...plugin.tools);\n    }\n  }\n  return tools;\n}\n\n/**\n * Execute a plugin tool\n */\nexport async function executePluginTool(toolName: string, input: any): Promise<any> {\n  for (const plugin of loadedPlugins.values()) {\n    if (!plugin.enabled) continue;\n\n    const tool = plugin.tools.find(t => t.name === toolName);\n    if (tool) {\n      logger.info('Executing plugin tool', { plugin: plugin.name, tool: toolName });\n      return tool.handler(input);\n    }\n  }\n\n  throw new Error(`Plugin tool not found: ${toolName}`);\n}\n\n/**\n * Load plugins from SDK configuration\n */\nexport async function loadPluginsFromConfig(configs: PluginConfig[]): Promise<LoadedPlugin[]> {\n  const loaded: LoadedPlugin[] = [];\n\n  for (const config of configs) {\n    const plugin = await loadPlugin(config);\n    if (plugin) {\n      loaded.push(plugin);\n    }\n  }\n\n  logger.info('Plugins loaded from config', { total: loaded.length });\n  return loaded;\n}\n\n/**\n * Get plugin configuration for SDK query options\n */\nexport function getPluginsForSdk(): any[] {\n  const plugins: any[] = [];\n\n  for (const plugin of loadedPlugins.values()) {\n    if (!plugin.enabled) continue;\n\n    if (plugin.source.startsWith('local:')) {\n      plugins.push({\n        type: 'local',\n        path: plugin.source.replace('local:', '')\n      });\n    } else if (plugin.source.startsWith('npm:')) {\n      plugins.push({\n        type: 'npm',\n        package: plugin.source.replace('npm:', '')\n      });\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Create an inline plugin helper\n */\nexport function createPlugin(name: string, tools: PluginTool[]): LoadedPlugin {\n  return loadInlinePlugin({ type: 'inline', name, tools });\n}\n\n/**\n * Plugin tool builder for type-safe tool creation\n */\nexport function defineTool<T>(config: {\n  name: string;\n  description: string;\n  inputSchema: Record<string, any>;\n  handler: (input: T) => Promise<any>;\n}): PluginTool {\n  return {\n    name: config.name,\n    description: config.description,\n    inputSchema: config.inputSchema,\n    handler: config.handler as (input: any) => Promise<any>\n  };\n}\n"]}
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../src/sdk/plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAErC;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,uEAAuE;IACvE,MAAM,eAAe,GAAG;QACtB,aAAa;QACb,QAAQ;QACR,OAAO;QACP,4BAA4B;QAC5B,aAAa;QACb,aAAa,EAAQ,kCAAkC;QACvD,OAAO;QACP,QAAQ;QACR,QAAQ;QACR,cAAc;KACf,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;AACH,CAAC;AAsDD,kBAAkB;AAClB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB;IACnD,IAAI,CAAC;QACH,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,OAAO;gBACV,OAAO,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;YACvC,KAAK,KAAK;gBACR,OAAO,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,KAAK,QAAQ;gBACX,OAAO,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,KAAK,QAAQ;gBACX,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAClC;gBACE,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,MAAyB;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEvD,IAAI,QAAQ,GAAuD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAEzG,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,gCAAgC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC;IAE/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAiB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;IAExE,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,SAAS,UAAU,EAAE;QAC7B,KAAK;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IAEF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,MAAuB;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;QAC1G,MAAM,KAAK,GAAiB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QAExE,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO;YACrC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO;YACtD,MAAM,EAAE,OAAO,MAAM,CAAC,OAAO,EAAE;YAC/B,KAAK;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QAEF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAE7E,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAA0B;IACxD,IAAI,CAAC;QACH,yDAAyD;QACzD,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtC,8BAA8B;QAC9B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,eAAe;YACvC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO;YACrC,MAAM,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE;YAC9B,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QAEF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAE5E,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAA0B;IAClD,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IAEF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAgB;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAc;IACtE,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAE9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACzD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAuB;IACjE,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAE9B,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAmB;IAC5D,OAAO,gBAAgB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAI,MAK7B;IACC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAA+C;KAChE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Plugins System - Load and manage Claude Agent SDK plugins\n *\n * Supports loading plugins from:\n * - Local filesystem\n * - NPM packages\n * - Remote URLs\n * - In-memory definitions\n */\n\nimport { logger } from \"../utils/logger.js\";\nimport { existsSync, readFileSync } from \"fs\";\nimport { join, resolve } from \"path\";\n\n/**\n * Assert that a URL is safe to fetch (CWE-918 SSRF mitigation).\n * Only HTTPS URLs pointing to non-private hosts are allowed.\n */\nfunction assertSafeUrl(rawUrl: string): void {\n  let parsed: URL;\n  try {\n    parsed = new URL(rawUrl);\n  } catch {\n    throw new Error(`Invalid plugin URL: ${rawUrl}`);\n  }\n  if (parsed.protocol !== 'https:') {\n    throw new Error(`Plugin URL must use HTTPS (got ${parsed.protocol}): ${rawUrl}`);\n  }\n  const hostname = parsed.hostname.toLowerCase();\n  // Block RFC-1918, link-local, loopback, and metadata service addresses\n  const privatePatterns = [\n    /^localhost$/,\n    /^127\\./,\n    /^10\\./,\n    /^172\\.(1[6-9]|2\\d|3[01])\\./,\n    /^192\\.168\\./,\n    /^169\\.254\\./,       // link-local (AWS metadata, etc.)\n    /^::1$/,\n    /^fc00:/,\n    /^fe80:/,\n    /^0\\.0\\.0\\.0$/,\n  ];\n  for (const pattern of privatePatterns) {\n    if (pattern.test(hostname)) {\n      throw new Error(`Plugin URL targets a private/internal address: ${rawUrl}`);\n    }\n  }\n}\n\n/**\n * Plugin configuration types\n */\nexport interface LocalPluginConfig {\n  type: 'local';\n  path: string;\n}\n\nexport interface NpmPluginConfig {\n  type: 'npm';\n  package: string;\n  version?: string;\n}\n\nexport interface RemotePluginConfig {\n  type: 'remote';\n  url: string;\n  checksum?: string;\n}\n\nexport interface InlinePluginConfig {\n  type: 'inline';\n  name: string;\n  tools: PluginTool[];\n}\n\nexport type PluginConfig = LocalPluginConfig | NpmPluginConfig | RemotePluginConfig | InlinePluginConfig;\n\n/**\n * Plugin tool definition\n */\nexport interface PluginTool {\n  name: string;\n  description: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  inputSchema: Record<string, unknown>;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  handler: (input: unknown) => Promise<unknown>;\n}\n\n/**\n * Loaded plugin instance\n */\nexport interface LoadedPlugin {\n  name: string;\n  version: string;\n  source: string;\n  tools: PluginTool[];\n  enabled: boolean;\n  loadedAt: number;\n}\n\n// Plugin registry\nconst loadedPlugins = new Map<string, LoadedPlugin>();\n\n/**\n * Load a plugin from configuration\n */\nexport async function loadPlugin(config: PluginConfig): Promise<LoadedPlugin | null> {\n  try {\n    switch (config.type) {\n      case 'local':\n        return await loadLocalPlugin(config);\n      case 'npm':\n        return await loadNpmPlugin(config);\n      case 'remote':\n        return await loadRemotePlugin(config);\n      case 'inline':\n        return loadInlinePlugin(config);\n      default:\n        logger.error('Unknown plugin type', { config });\n        return null;\n    }\n  } catch (error) {\n    logger.error('Failed to load plugin', { config, error: (error as Error).message });\n    return null;\n  }\n}\n\n/**\n * Load plugin from local filesystem\n */\nasync function loadLocalPlugin(config: LocalPluginConfig): Promise<LoadedPlugin | null> {\n  const pluginPath = resolve(config.path);\n\n  if (!existsSync(pluginPath)) {\n    logger.error('Plugin path does not exist', { path: pluginPath });\n    return null;\n  }\n\n  // Look for package.json or plugin.json\n  const packageJsonPath = join(pluginPath, 'package.json');\n  const pluginJsonPath = join(pluginPath, 'plugin.json');\n\n  let metadata: { name?: string; version?: string; main?: string } = { name: 'unknown', version: '0.0.0' };\n\n  if (existsSync(packageJsonPath)) {\n    metadata = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));\n  } else if (existsSync(pluginJsonPath)) {\n    metadata = JSON.parse(readFileSync(pluginJsonPath, 'utf-8'));\n  }\n\n  // Try to load the plugin module\n  const mainPath = join(pluginPath, metadata.main || 'index.js');\n\n  if (!existsSync(mainPath)) {\n    logger.error('Plugin main file not found', { path: mainPath });\n    return null;\n  }\n\n  const module = await import(mainPath);\n  const tools: PluginTool[] = module.tools || module.default?.tools || [];\n\n  const plugin: LoadedPlugin = {\n    name: metadata.name,\n    version: metadata.version,\n    source: `local:${pluginPath}`,\n    tools,\n    enabled: true,\n    loadedAt: Date.now()\n  };\n\n  loadedPlugins.set(plugin.name, plugin);\n  logger.info('Local plugin loaded', { name: plugin.name, tools: tools.length });\n\n  return plugin;\n}\n\n/**\n * Load plugin from NPM package\n */\nasync function loadNpmPlugin(config: NpmPluginConfig): Promise<LoadedPlugin | null> {\n  try {\n    const module = await import(config.package);\n    const metadata = module.default?.metadata || { name: config.package, version: config.version || '0.0.0' };\n    const tools: PluginTool[] = module.tools || module.default?.tools || [];\n\n    const plugin: LoadedPlugin = {\n      name: metadata.name || config.package,\n      version: metadata.version || config.version || '0.0.0',\n      source: `npm:${config.package}`,\n      tools,\n      enabled: true,\n      loadedAt: Date.now()\n    };\n\n    loadedPlugins.set(plugin.name, plugin);\n    logger.info('NPM plugin loaded', { name: plugin.name, tools: tools.length });\n\n    return plugin;\n  } catch (error) {\n    logger.error('Failed to load NPM plugin', { package: config.package, error: (error as Error).message });\n    return null;\n  }\n}\n\n/**\n * Load plugin from remote URL\n */\nasync function loadRemotePlugin(config: RemotePluginConfig): Promise<LoadedPlugin | null> {\n  try {\n    // Validate URL before fetching to prevent SSRF (CWE-918)\n    assertSafeUrl(config.url);\n    const response = await fetch(config.url);\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n    }\n\n    const content = await response.text();\n\n    // Verify checksum if provided\n    if (config.checksum) {\n      const hash = await computeHash(content);\n      if (hash !== config.checksum) {\n        throw new Error('Checksum mismatch - plugin may be compromised');\n      }\n    }\n\n    // Parse plugin definition (JSON format)\n    const pluginDef = JSON.parse(content);\n\n    const plugin: LoadedPlugin = {\n      name: pluginDef.name || 'remote-plugin',\n      version: pluginDef.version || '0.0.0',\n      source: `remote:${config.url}`,\n      tools: pluginDef.tools || [],\n      enabled: true,\n      loadedAt: Date.now()\n    };\n\n    loadedPlugins.set(plugin.name, plugin);\n    logger.info('Remote plugin loaded', { name: plugin.name, url: config.url });\n\n    return plugin;\n  } catch (error) {\n    logger.error('Failed to load remote plugin', { url: config.url, error: (error as Error).message });\n    return null;\n  }\n}\n\n/**\n * Load inline plugin from configuration\n */\nfunction loadInlinePlugin(config: InlinePluginConfig): LoadedPlugin {\n  const plugin: LoadedPlugin = {\n    name: config.name,\n    version: '1.0.0',\n    source: 'inline',\n    tools: config.tools,\n    enabled: true,\n    loadedAt: Date.now()\n  };\n\n  loadedPlugins.set(plugin.name, plugin);\n  logger.info('Inline plugin loaded', { name: plugin.name, tools: config.tools.length });\n\n  return plugin;\n}\n\n/**\n * Compute SHA-256 hash for checksum verification\n */\nasync function computeHash(content: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(content);\n  const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n  const hashArray = Array.from(new Uint8Array(hashBuffer));\n  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Get all loaded plugins\n */\nexport function getLoadedPlugins(): LoadedPlugin[] {\n  return Array.from(loadedPlugins.values());\n}\n\n/**\n * Get plugin by name\n */\nexport function getPlugin(name: string): LoadedPlugin | null {\n  return loadedPlugins.get(name) || null;\n}\n\n/**\n * Enable/disable a plugin\n */\nexport function setPluginEnabled(name: string, enabled: boolean): boolean {\n  const plugin = loadedPlugins.get(name);\n  if (!plugin) return false;\n\n  plugin.enabled = enabled;\n  logger.info('Plugin state changed', { name, enabled });\n  return true;\n}\n\n/**\n * Unload a plugin\n */\nexport function unloadPlugin(name: string): boolean {\n  const existed = loadedPlugins.delete(name);\n  if (existed) {\n    logger.info('Plugin unloaded', { name });\n  }\n  return existed;\n}\n\n/**\n * Get all tools from enabled plugins\n */\nexport function getAllPluginTools(): PluginTool[] {\n  const tools: PluginTool[] = [];\n  for (const plugin of loadedPlugins.values()) {\n    if (plugin.enabled) {\n      tools.push(...plugin.tools);\n    }\n  }\n  return tools;\n}\n\n/**\n * Execute a plugin tool\n */\nexport async function executePluginTool(toolName: string, input: unknown): Promise<unknown> {\n  for (const plugin of loadedPlugins.values()) {\n    if (!plugin.enabled) continue;\n\n    const tool = plugin.tools.find(t => t.name === toolName);\n    if (tool) {\n      logger.info('Executing plugin tool', { plugin: plugin.name, tool: toolName });\n      return tool.handler(input);\n    }\n  }\n\n  throw new Error(`Plugin tool not found: ${toolName}`);\n}\n\n/**\n * Load plugins from SDK configuration\n */\nexport async function loadPluginsFromConfig(configs: PluginConfig[]): Promise<LoadedPlugin[]> {\n  const loaded: LoadedPlugin[] = [];\n\n  for (const config of configs) {\n    const plugin = await loadPlugin(config);\n    if (plugin) {\n      loaded.push(plugin);\n    }\n  }\n\n  logger.info('Plugins loaded from config', { total: loaded.length });\n  return loaded;\n}\n\n/**\n * Get plugin configuration for SDK query options\n */\nexport function getPluginsForSdk(): PluginConfig[] {\n  const plugins: PluginConfig[] = [];\n\n  for (const plugin of loadedPlugins.values()) {\n    if (!plugin.enabled) continue;\n\n    if (plugin.source.startsWith('local:')) {\n      plugins.push({\n        type: 'local',\n        path: plugin.source.replace('local:', '')\n      });\n    } else if (plugin.source.startsWith('npm:')) {\n      plugins.push({\n        type: 'npm',\n        package: plugin.source.replace('npm:', '')\n      });\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Create an inline plugin helper\n */\nexport function createPlugin(name: string, tools: PluginTool[]): LoadedPlugin {\n  return loadInlinePlugin({ type: 'inline', name, tools });\n}\n\n/**\n * Plugin tool builder for type-safe tool creation\n */\nexport function defineTool<T>(config: {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  handler: (input: T) => Promise<unknown>;\n}): PluginTool {\n  return {\n    name: config.name,\n    description: config.description,\n    inputSchema: config.inputSchema,\n    handler: config.handler as (input: unknown) => Promise<unknown>\n  };\n}\n"]}

package/dist/transport/index.d.ts

@@ -1,2 +1,3 @@
 export * from './quic.js';
+export { loadQuicTransport, isQuicAvailable, getTransportCapabilities, WebSocketFallbackTransport, DEFAULT_STREAM_ID, type AgentTransport, type AgentMessage, type InboundMessageHandler, type OnMessageOptions, type PoolStatistics, type TransportCapabilities, type QuicTransportConfig as LoaderQuicTransportConfig, type TlsConfig, } from './quic-loader.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/transport/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AACA,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AACA,cAAc,WAAW,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,IAAI,yBAAyB,EACrD,KAAK,SAAS,GACf,MAAM,kBAAkB,CAAC"}

package/dist/transport/index.js

@@ -1,3 +1,4 @@
 // Transport Layer Exports
 export * from './quic.js';
+export { loadQuicTransport, isQuicAvailable, getTransportCapabilities, WebSocketFallbackTransport, DEFAULT_STREAM_ID, } from './quic-loader.js';
 //# sourceMappingURL=index.js.map

package/dist/transport/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,cAAc,WAAW,CAAC","sourcesContent":["// Transport Layer Exports\nexport * from './quic.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,cAAc,WAAW,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,GASlB,MAAM,kBAAkB,CAAC","sourcesContent":["// Transport Layer Exports\nexport * from './quic.js';\nexport {\n  loadQuicTransport,\n  isQuicAvailable,\n  getTransportCapabilities,\n  WebSocketFallbackTransport,\n  DEFAULT_STREAM_ID,\n  type AgentTransport,\n  type AgentMessage,\n  type InboundMessageHandler,\n  type OnMessageOptions,\n  type PoolStatistics,\n  type TransportCapabilities,\n  type QuicTransportConfig as LoaderQuicTransportConfig,\n  type TlsConfig,\n} from './quic-loader.js';\n"]}

package/dist/transport/quic-loader.d.ts

@@ -0,0 +1,250 @@
+/** TLS configuration for wss:// peers (ADR-107). */
+export interface TlsConfig {
+    /** Path to PEM cert file (server side — bind certs for the listener). */
+    certPath?: string;
+    /** Path to PEM key file (server side). */
+    keyPath?: string;
+    /**
+     * Pinned `sha256/<base64>` fingerprints of acceptable peer certs
+     * (client side — outbound connections).
+     *
+     * When set, ONLY these exact certs are accepted. CA validation is
+     * skipped — the fingerprint IS the trust anchor. Fail-closed: if the
+     * peer's cert rotates and the fingerprint doesn't match, the
+     * connection is refused (operator must update config + restart).
+     *
+     * This prevents:
+     *   - Compromised public CAs issuing rogue certs for our domain
+     *   - TLS-MITM attacks where the attacker holds a valid cert chain
+     */
+    pinnedFingerprints?: string[];
+    /**
+     * Optional CA bundle path for non-pinned mode (e.g. private CA).
+     * Used only when `pinnedFingerprints` is empty/unset.
+     */
+    caPath?: string;
+}
+/** Caller-facing config — minimal common surface across both backends. */
+export interface QuicTransportConfig {
+    serverName?: string;
+    maxIdleTimeoutMs?: number;
+    maxConcurrentStreams?: number;
+    enable0Rtt?: boolean;
+    /** TLS materials for wss:// listeners + clients (ADR-107). */
+    tls?: TlsConfig;
+}
+export interface AgentMessage {
+    id: string;
+    type: 'task' | 'result' | 'status' | 'coordination' | 'heartbeat' | string;
+    payload: unknown;
+    metadata?: Record<string, unknown>;
+    /**
+     * Stream multiplexing identifier. Messages with different streamIds
+     * to the same peer are independent — receive queues and onMessage
+     * handlers can scope per-stream, eliminating head-of-line blocking
+     * for sequential `await` patterns on a single peer connection.
+     *
+     * Defaults to `'default'` if omitted (backward compat). Common
+     * patterns:
+     *   - One stream per logical request type (`'rpc'`, `'event'`,
+     *     `'control'`)
+     *   - One stream per task (`taskId` doubled as streamId)
+     *   - One stream per priority class (`'high'`, `'normal'`, `'low'`)
+     *
+     * Maps cleanly to native QUIC streams when AGENTIC_FLOW_QUIC_NATIVE=1
+     * (each app-layer streamId becomes a QUIC stream id at that point).
+     */
+    streamId?: string | number;
+}
+/** Default streamId when caller omits it. Backward-compat sentinel. */
+export declare const DEFAULT_STREAM_ID = "default";
+export interface PoolStatistics {
+    active: number;
+    idle: number;
+    created: number;
+    closed: number;
+}
+/** Inbound message handler — called for every received message. */
+export type InboundMessageHandler = (address: string, message: AgentMessage) => void | Promise<void>;
+/**
+ * Per-stream subscription options. Pass to `onMessage` to scope a
+ * handler to a specific streamId (only fires for messages with that
+ * exact streamId). Omit to receive all streams.
+ */
+export interface OnMessageOptions {
+    readonly streamId?: string | number;
+}
+/** Common interface both real-QUIC and fallback transports satisfy. */
+export interface AgentTransport {
+    send(address: string, message: AgentMessage): Promise<void>;
+    /**
+     * Receive the next message from a peer. Optional `streamId` scopes
+     * to that stream's queue (independent of other streams to the same
+     * peer). Omit to use the default stream — backward-compat behavior.
+     */
+    receive(address: string, streamId?: string | number): Promise<AgentMessage>;
+    request(address: string, message: AgentMessage): Promise<AgentMessage>;
+    sendBatch(address: string, messages: AgentMessage[]): Promise<void>;
+    getStats(): Promise<PoolStatistics>;
+    close(): Promise<void>;
+    /**
+     * Subscribe to inbound messages. The handler fires for every received
+     * message that matches `options.streamId` (if provided) or for every
+     * message regardless of streamId (if options omitted).
+     *
+     * Multiple handlers may be registered (per-stream OR all-streams or
+     * a mix). Errors thrown by a handler are logged but do not stop
+     * delivery to other handlers.
+     *
+     * Optional method — implementations that don't support push-style
+     * delivery may omit it. Callers should use `transport.onMessage?.(h)`
+     * to gracefully degrade.
+     */
+    onMessage?(handler: InboundMessageHandler, options?: OnMessageOptions): void;
+}
+/**
+ * WebSocket fallback transport.
+ *
+ * Spec compliance: implements the AgentTransport interface using
+ * `ws://` (or `wss://` if address starts with `wss://`). Each call to
+ * `send` lazily opens (or reuses) a connection to `address`. The
+ * `receive(address)` call drains the next queued message for that
+ * address; if none is queued it polls every 100ms until one arrives.
+ *
+ * Limits vs real QUIC: no 0-RTT resumption, no multiplexed streams
+ * (one TCP connection per peer), TLS handled by the WS layer (use
+ * `wss://` for encryption). Performance is "good enough" for federation
+ * messages at human/agent rates (≤ 100 RPS per peer).
+ */
+declare class WebSocketFallbackTransport implements AgentTransport {
+    private readonly config;
+    private connections;
+    /**
+     * Per-(address, streamId) message queue. Composite key shape
+     * `${address}#${streamId}` — see {@link queueKey}. Each stream gets
+     * its own FIFO so receive(addr, streamA) is independent of
+     * receive(addr, streamB) — eliminates head-of-line blocking on a
+     * single peer connection.
+     */
+    private messageQueue;
+    private connectionsCreated;
+    private connectionsClosed;
+    private servers;
+    /**
+     * Inbound handlers. Each entry is { handler, streamId? }. When
+     * streamId is undefined the handler receives ALL messages
+     * regardless of stream; otherwise only messages with the matching
+     * streamId. Lets callers register both per-stream + catch-all.
+     */
+    private inboundHandlers;
+    /**
+     * Server-accepted (inbound) sockets indexed by peer host (#162). A
+     * peer that already dialed us has a live, full-duplex socket here;
+     * {@link getOrCreateConnection} reuses it for replies instead of
+     * opening a fresh outbound connection — which, on a direct
+     * point-to-point link, can hit a per-process stale scoped route
+     * (`EHOSTUNREACH`) even while the inbound direction is healthy.
+     */
+    private inboundByHost;
+    /** Active liveness-probe intervals, cleared on close (#162). */
+    private heartbeats;
+    /**
+     * Liveness ping cadence, derived from `maxIdleTimeoutMs` (#162 — this
+     * config was previously accepted but never used). Pings at 1/6 of the
+     * idle timeout so a dead socket is caught within ~1/3 of it. Default
+     * 30000ms → 5000ms.
+     */
+    private get pingIntervalMs();
+    /**
+     * Normalize an address or socket `remoteAddress` to a bare host key
+     * for {@link inboundByHost} lookups. Strips `ws(s)://` scheme, an
+     * IPv6-mapped IPv4 prefix (`::ffff:`), bracketed IPv6 (`[::1]:port`),
+     * and a trailing `:port` on plain `host:port` forms. Bare IPv6
+     * (multiple colons, no brackets) is returned unchanged.
+     */
+    private hostOf;
+    /**
+     * Liveness probe for a socket (#162). Pings on {@link pingIntervalMs};
+     * a socket that misses a ping/pong window is terminated so a stale
+     * connection can't silently black-hole sends. The interval is unref'd
+     * (never keeps the process alive on its own) and cleared on close/error.
+     */
+    private startHeartbeat;
+    /** Compose the per-(address, streamId) queue key. */
+    private queueKey;
+    /** Resolve the streamId for a message — defaults to DEFAULT_STREAM_ID. */
+    private streamOf;
+    constructor(config: Required<QuicTransportConfig>);
+    static create(config?: QuicTransportConfig): Promise<WebSocketFallbackTransport>;
+    /**
+     * Bind a server-side listener so this transport instance can RECEIVE
+     * messages from a remote peer (in addition to sending). Federation
+     * peers run BOTH a listener and a client — calling listen(9100) plus
+     * send('peer:9100', ...) gives bidirectional connectivity.
+     *
+     * Enables `permessage-deflate` compression with thresholds chosen
+     * for federation envelopes (typically JSON, 100B-10KB):
+     *   - threshold: 256B — don't waste CPU compressing tiny pings
+     *   - level: 3 — balanced compression vs CPU (zlib's BEST_SPEED→6 range)
+     *   - serverNoContextTakeover: true — bound per-conn memory growth
+     */
+    listen(port: number, host?: string): Promise<void>;
+    /**
+     * Wire the server's `connection` and per-socket `message` handlers.
+     * Extracted so the wss:// path (where the WebSocketServer is attached
+     * to a pre-created https.Server) can share the same logic.
+     */
+    private attachServerHandlers;
+    private getOrCreateConnection;
+    send(address: string, message: AgentMessage): Promise<void>;
+    /**
+     * Register an inbound handler. Optional `options.streamId` scopes
+     * the handler to a specific stream (only fires for messages with
+     * matching streamId). Omit to subscribe to ALL streams.
+     *
+     * Patterns:
+     *   onMessage(h)                              — receives all
+     *   onMessage(h, { streamId: 'rpc' })         — receives only rpc
+     *   onMessage(h, { streamId: 'event' })       — receives only event
+     *   (both registered)                         — both fire on
+     *                                                their respective streams
+     */
+    onMessage(handler: InboundMessageHandler, options?: OnMessageOptions): void;
+    /**
+     * Fire all matching handlers for a received message. Stream-scoped
+     * handlers only fire when the message's streamId matches; all-stream
+     * handlers always fire. Errors thrown sync OR async-rejected by one
+     * handler don't stop delivery to others.
+     */
+    private dispatchInbound;
+    receive(address: string, streamId?: string | number): Promise<AgentMessage>;
+    request(address: string, message: AgentMessage): Promise<AgentMessage>;
+    sendBatch(address: string, messages: AgentMessage[]): Promise<void>;
+    getStats(): Promise<PoolStatistics>;
+    close(): Promise<void>;
+}
+/**
+ * Public API — load a working transport, preferring real QUIC when
+ * available, falling back to WebSocket otherwise. The returned object
+ * satisfies the AgentTransport interface in both cases.
+ *
+ * Example:
+ *   const t = await loadQuicTransport({ serverName: 'ruvultra:9100' });
+ *   await t.send('ruvultra:9100', { id: '1', type: 'task', payload: {...} });
+ *
+ * Federation v1 ships on the WebSocket fallback (this is the actual
+ * working transport today). When the native QUIC binding lands, set
+ * the AGENTIC_FLOW_QUIC_NATIVE=1 environment variable and the same
+ * code path picks up the upgrade with no API changes.
+ */
+export declare function loadQuicTransport(config?: QuicTransportConfig): Promise<AgentTransport>;
+/** Quick capability probe for the doctor / health surface. */
+export declare function isQuicAvailable(): Promise<boolean>;
+export interface TransportCapabilities {
+    quicAvailable: boolean;
+    webSocketFallbackAvailable: true;
+    selectedBackend: 'quic' | 'websocket';
+}
+export declare function getTransportCapabilities(): Promise<TransportCapabilities>;
+export { WebSocketFallbackTransport };
+//# sourceMappingURL=quic-loader.d.ts.map

package/dist/transport/quic-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quic-loader.d.ts","sourceRoot":"","sources":["../../src/transport/quic-loader.ts"],"names":[],"mappings":"AA4BA,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,WAAW,GAAG,MAAM,CAAC;IAC3E,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B;AAED,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,YAAY,KAClB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC9E;AAED;;;;;;;;;;;;;GAaG;AACH,cAAM,0BAA2B,YAAW,cAAc;IAiG5C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAhGnC,OAAO,CAAC,WAAW,CAAgC;IACnD;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,OAAO,CAAsC;IACrD;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAGlB;IACL;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa,CAAgC;IACrD,gEAAgE;IAChE,OAAO,CAAC,UAAU,CAA6C;IAE/D;;;;;OAKG;IACH,OAAO,KAAK,cAAc,GAEzB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAQd;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAqBtB,qDAAqD;IACrD,OAAO,CAAC,QAAQ;IAIhB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ;gBAIa,MAAM,EAAE,QAAQ,CAAC,mBAAmB,CAAC;WAErD,MAAM,CAAC,MAAM,GAAE,mBAAwB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAY1F;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC3D;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;YA+Bd,qBAAqB;IA2G7B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjE;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,GAAE,gBAAqB,GAAG,IAAI;IAI/E;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAmBjB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,GAAG,MAA0B,GAAG,OAAO,CAAC,YAAY,CAAC;IAkB9F,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAKtE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC;IASnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA4B7B;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,GAAE,mBAAwB,GAC/B,OAAO,CAAC,cAAc,CAAC,CAazB;AAED,8DAA8D;AAC9D,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAExD;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,OAAO,CAAC;IACvB,0BAA0B,EAAE,IAAI,CAAC;IACjC,eAAe,EAAE,MAAM,GAAG,WAAW,CAAC;CACvC;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAO/E;AAED,OAAO,EAAE,0BAA0B,EAAE,CAAC"}