brainclaw 1.13.0 → 1.15.0

package/dist/core/federation-cloud.js

@@ -1,18 +1,31 @@
 import { loadConfig } from './config.js';
 import { logger } from './logger.js';
+import { buildCloudWriteHeaders, resolveCloudSigningIdentity, } from './federation-signing.js';
 const DEFAULT_API_URL = 'https://app.brainclaw.dev';
+function envFlag(value) {
+    if (!value)
+        return false;
+    const v = value.trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes';
+}
 function resolveCloudConfig(cwd) {
     const envApiUrl = process.env.BRAINCLAW_CLOUD_URL;
     const envApiKey = process.env.BRAINCLAW_CLOUD_API_KEY;
+    const envProjectId = process.env.BRAINCLAW_PROJECT_ID;
+    const envRequireSigned = process.env.BRAINCLAW_CLOUD_REQUIRE_SIGNED;
     let configEnabled = false;
     let configEndpoint;
     let configApiKey;
+    let configProjectId;
+    let configRequireSigned = false;
     try {
         const config = loadConfig(cwd);
         if (config.cloud_sync) {
             configEnabled = config.cloud_sync.enabled === true;
             configEndpoint = config.cloud_sync.endpoint;
             configApiKey = config.cloud_sync.api_key;
+            configProjectId = config.cloud_sync.project_id;
+            configRequireSigned = config.cloud_sync.require_signed === true;
         }
     }
     catch {
@@ -24,7 +37,22 @@ function resolveCloudConfig(cwd) {
     // Env-supplied key implies explicit opt-in; config flag is the alternative
     const enabled = Boolean(envApiKey) || configEnabled;
     const apiUrl = envApiUrl ?? configEndpoint ?? DEFAULT_API_URL;
-    return { apiUrl, apiKey, enabled };
+    const projectId = envProjectId?.trim() || configProjectId;
+    const requireSigned = envRequireSigned !== undefined ? envFlag(envRequireSigned) : configRequireSigned;
+    return { apiUrl, apiKey, enabled, projectId, requireSigned };
+}
+/**
+ * Build the outgoing headers for a runtime write, signing when possible.
+ * Returns undefined when `require_signed` is set but no signing identity is
+ * available — the caller must NOT send the request (fail-closed).
+ */
+function writeHeaders(body, cloud, cwd) {
+    const signing = resolveCloudSigningIdentity(cwd);
+    return buildCloudWriteHeaders(body, {
+        apiKey: cloud.apiKey,
+        signing,
+        requireSigned: cloud.requireSigned,
+    });
 }
 export async function pushSignalToCloud(message, cwd) {
     const cloud = resolveCloudConfig(cwd);
@@ -32,14 +60,17 @@ export async function pushSignalToCloud(message, cwd) {
         logger.debug('Cloud not configured — skipping push');
         return false;
     }
+    const body = JSON.stringify(message);
+    const headers = writeHeaders(body, cloud, cwd);
+    if (!headers) {
+        logger.warn('Cloud push refused: require_signed is set but no approved signing identity/key is available (fail-closed).');
+        return false;
+    }
     try {
         const response = await fetch(`${cloud.apiUrl}/api/v1/messages`, {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': cloud.apiKey,
-            },
-            body: JSON.stringify(message),
+            headers,
+            body,
         });
         if (!response.ok) {
             logger.debug(`Cloud push failed: ${response.status} ${response.statusText}`);
@@ -83,14 +114,17 @@ export async function pushBoardToCloud(projectName, boardData, cwd) {
     const cloud = resolveCloudConfig(cwd);
     if (!cloud)
         return false;
+    const body = JSON.stringify(boardData);
+    const headers = writeHeaders(body, cloud, cwd);
+    if (!headers) {
+        logger.warn('Cloud board push refused: require_signed is set but no approved signing identity/key is available (fail-closed).');
+        return false;
+    }
     try {
         const response = await fetch(`${cloud.apiUrl}/api/v1/board/${encodeURIComponent(projectName)}`, {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': cloud.apiKey,
-            },
-            body: JSON.stringify(boardData),
+            headers,
+            body,
         });
         return response.ok;
     }
@@ -98,6 +132,35 @@ export async function pushBoardToCloud(projectName, boardData, cwd) {
         return false;
     }
 }
+export async function pushClaimToCloud(payload, cwd) {
+    const cloud = resolveCloudConfig(cwd);
+    if (!cloud)
+        return { kind: 'not_configured' };
+    const body = JSON.stringify(payload);
+    const headers = writeHeaders(body, cloud, cwd);
+    if (!headers)
+        return { kind: 'fail_closed' };
+    try {
+        const response = await fetch(`${cloud.apiUrl}/api/v1/claims/${encodeURIComponent(payload.id)}`, {
+            method: 'PUT',
+            headers,
+            body,
+        });
+        let code = null;
+        try {
+            const data = (await response.json());
+            const raw = data.code ?? data.status;
+            code = typeof raw === 'string' ? raw : null;
+        }
+        catch {
+            // Non-JSON body — leave code null; the HTTP status still classifies it.
+        }
+        return { kind: 'response', httpStatus: response.status, code };
+    }
+    catch (err) {
+        return { kind: 'network_error', error: err.message };
+    }
+}
 export function isCloudConfigured(cwd) {
     return resolveCloudConfig(cwd) !== undefined;
 }
@@ -111,4 +174,72 @@ export function isCloudSyncEnabled(cwd) {
     const cloud = resolveCloudConfig(cwd);
     return cloud !== undefined && cloud.enabled;
 }
+/**
+ * Startup diagnostics for the cloud bridge: remote health, resolved signing
+ * identity, approved-agent lookup, and a local↔remote key fingerprint match.
+ * Never throws — every probe degrades to an error field so the CLI can print a
+ * complete report.
+ */
+export async function diagnoseCloudBridge(cwd) {
+    const cloud = resolveCloudConfig(cwd);
+    const apiUrl = cloud?.apiUrl ?? process.env.BRAINCLAW_CLOUD_URL ?? DEFAULT_API_URL;
+    const signingIdentity = resolveCloudSigningIdentity(cwd);
+    const diag = {
+        configured: Boolean(cloud),
+        enabled: cloud?.enabled ?? false,
+        apiUrl,
+        projectId: cloud?.projectId,
+        requireSigned: cloud?.requireSigned ?? false,
+        signing: signingIdentity
+            ? {
+                available: true,
+                cloudAgentId: signingIdentity.cloudAgentId,
+                agentName: signingIdentity.agentName,
+                fingerprint: signingIdentity.fingerprint,
+            }
+            : {
+                available: false,
+                reason: 'No approved agent id/name configured, or the agent has no local Ed25519 key. '
+                    + 'Register the agent and its key with the cloud first.',
+            },
+    };
+    if (!cloud)
+        return diag;
+    // Remote health
+    try {
+        const res = await fetch(`${apiUrl}/api/v1/health`);
+        const data = (await res.json());
+        diag.health = { ok: res.ok, status: String(data.status ?? ''), version: String(data.version ?? '') };
+    }
+    catch (e) {
+        diag.health = { ok: false, error: e.message };
+    }
+    // Approved-agent lookup + fingerprint match
+    if (signingIdentity) {
+        try {
+            const res = await fetch(`${apiUrl}/api/v1/agents/${encodeURIComponent(signingIdentity.cloudAgentId)}`, {
+                headers: { 'X-API-Key': cloud.apiKey },
+            });
+            if (res.ok) {
+                const data = (await res.json());
+                const agent = data.agent;
+                diag.approvedAgent = {
+                    found: Boolean(agent),
+                    status: agent?.status,
+                    trustLevel: agent?.trust_level,
+                    fingerprintMatch: agent?.key_fingerprint
+                        ? agent.key_fingerprint === signingIdentity.fingerprint
+                        : false,
+                };
+            }
+            else {
+                diag.approvedAgent = { found: false, error: `HTTP ${res.status}` };
+            }
+        }
+        catch (e) {
+            diag.approvedAgent = { found: false, error: e.message };
+        }
+    }
+    return diag;
+}
 //# sourceMappingURL=federation-cloud.js.map

package/dist/core/federation-outbox.js

@@ -0,0 +1,292 @@
+/**
+ * Federation outbox — durable queue for signed edge → cloud runtime writes
+ * (pln#101 Phase 2, increment 1: CLAIM). Design of record: decision dec#123.
+ *
+ * Layout under `.brainclaw/coordination/federation/`:
+ *   outbox/<id>@r<rev>.json   — pending, awaiting push
+ *   sent/<id>@r<rev>.json     — archived after a successful/superseded push (the marker)
+ *   parked/<id>@r<rev>.json   — dead-letter (conflict / persistent 4xx)
+ *
+ * Enqueue is DIFF-BASED at the claim persistence chokepoint (saveClaimUnlocked),
+ * which runs under the store mutation mutex, so per-claim rev reservation is
+ * serialized for free (no separate lock). Only lifecycle transitions enqueue;
+ * mid-life saves (same status) and cloud-origin materialization (suppressEnqueue)
+ * do not. All work here is local file I/O — never network.
+ *
+ * @module
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { nowISO } from './ids.js';
+import { resolveEntityDir } from './io.js';
+import { isCloudSyncEnabled } from './federation-cloud.js';
+import { logger } from './logger.js';
+// ── Directories ─────────────────────────────────────────────────────────────
+function federationSubdir(sub, cwd, mode) {
+    return resolveEntityDir(`federation/${sub}`, cwd ?? process.cwd(), mode);
+}
+function ensureDir(dir) {
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+}
+// ── Canonical content hash (edge is the sole computer; cloud stores+compares) ──
+/** Deterministic JSON with recursively sorted object keys. */
+function stableStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(',')}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(',')}}`;
+}
+/**
+ * Canonical content hash of a claim's SEMANTIC body — excludes the rev, all
+ * volatile/local-only fields (user, model, adopted_at, enqueue metadata), and
+ * the signature timestamp. Same-rev + different hash ⇒ genuinely divergent
+ * bodies (a conflict the cloud must not silently absorb).
+ */
+export function claimContentHash(claim) {
+    // Identity fields (agent_id/agent_name) are excluded: they are constant over a
+    // claim's life and the local↔cloud agent-id mapping is a transport concern,
+    // not claim content. What matters for divergence detection is the lifecycle body.
+    const body = {
+        id: claim.id,
+        status: claim.status,
+        scope: claim.scope,
+        description: claim.description,
+        plan_id: claim.plan_id ?? null,
+        host_id: claim.host_id ?? null,
+        session_id: claim.session_id ?? null,
+        expires_at: claim.expires_at ?? null,
+        worktree_path: claim.worktree_path ?? null,
+        created_at: claim.created_at,
+        released_at: claim.released_at ?? null,
+    };
+    return crypto.createHash('sha256').update(stableStringify(body)).digest('hex');
+}
+function buildClaimPayload(claim, rev, contentHash) {
+    return {
+        id: claim.id,
+        rev,
+        agent_name: claim.agent,
+        scope: claim.scope,
+        description: claim.description,
+        status: claim.status,
+        plan_id: claim.plan_id ?? null,
+        host_id: claim.host_id ?? null,
+        session_id: claim.session_id ?? null,
+        expires_at: claim.expires_at ?? null,
+        worktree_path: claim.worktree_path ?? null,
+        created_at: claim.created_at,
+        released_at: claim.released_at ?? null,
+        content_hash: contentHash,
+    };
+}
+// ── Rev reservation (serialized by the caller's store mutex) ───────────────────
+const REV_RE = /@r(\d+)\.json$/;
+function revsForId(id, dir) {
+    if (!fs.existsSync(dir))
+        return [];
+    const revs = [];
+    for (const name of fs.readdirSync(dir)) {
+        if (!name.startsWith(`${id}@r`))
+            continue;
+        const m = name.match(REV_RE);
+        if (m)
+            revs.push(parseInt(m[1], 10));
+    }
+    return revs;
+}
+/** Highest rev already reserved for this id across outbox + sent (0 if none). */
+function maxRevForId(id, cwd) {
+    const all = [
+        ...revsForId(id, federationSubdir('outbox', cwd, 'read')),
+        ...revsForId(id, federationSubdir('sent', cwd, 'read')),
+    ];
+    return all.length ? Math.max(...all) : 0;
+}
+function recordFilename(id, rev) {
+    return `${id}@r${rev}.json`;
+}
+function writeRecordAtomic(dir, filename, record) {
+    ensureDir(dir);
+    const finalPath = path.join(dir, filename);
+    const tmpPath = path.join(dir, `.${filename}.${process.pid}.tmp`);
+    fs.writeFileSync(tmpPath, `${JSON.stringify(record, null, 2)}\n`, 'utf-8');
+    fs.renameSync(tmpPath, finalPath);
+}
+// ── Enablement gate (memoized per cwd — resolve config once per process) ───────
+const enabledCache = new Map();
+function syncEnabledCached(cwd) {
+    const key = cwd ?? process.cwd();
+    const cached = enabledCache.get(key);
+    if (cached !== undefined)
+        return cached;
+    let value = false;
+    try {
+        value = isCloudSyncEnabled(cwd);
+    }
+    catch {
+        // Missing/unreadable config → treat federation as disabled.
+    }
+    enabledCache.set(key, value);
+    return value;
+}
+/** Test/hook seam: drop the memoized enablement (config changed on disk). */
+export function clearFederationEnablementCache() {
+    enabledCache.clear();
+}
+/**
+ * Cheap gate for the persistence seam: is a federation enqueue possibly needed?
+ * Lets the caller skip the prev-status load entirely when not federating.
+ */
+export function isFederationEnqueueActive(cwd, suppress) {
+    return !suppress && syncEnabledCached(cwd);
+}
+// ── Enqueue (the diff-based seam entry point) ──────────────────────────────────
+/**
+ * Enqueue a claim lifecycle transition for cloud sync, if it qualifies.
+ *
+ * Called from saveClaimUnlocked (under the store mutation mutex). Enqueues iff:
+ * cloud sync is enabled, not suppressed (cloud-origin materialization), and the
+ * save is a real transition — a create, or a status change. Mid-life saves that
+ * do not change status do NOT enqueue (dec#123). Never throws to the caller.
+ *
+ * Returns the reserved rev, or null when nothing was enqueued.
+ */
+export function maybeEnqueueClaimTransition(claim, prevStatus, created, cwd, suppress) {
+    try {
+        if (suppress)
+            return null;
+        if (!syncEnabledCached(cwd))
+            return null;
+        const isTransition = created || prevStatus !== claim.status;
+        if (!isTransition)
+            return null;
+        const rev = maxRevForId(claim.id, cwd) + 1;
+        const contentHash = claimContentHash(claim);
+        const record = {
+            op: 'upsert_claim',
+            entity_type: 'claim',
+            entity_id: claim.id,
+            rev,
+            from_status: prevStatus ?? null,
+            to_status: claim.status,
+            content_hash: contentHash,
+            payload: buildClaimPayload(claim, rev, contentHash),
+            enqueued_at: nowISO(),
+            attempts: 0,
+            last_status: null,
+            last_error: null,
+            last_attempt_at: null,
+        };
+        writeRecordAtomic(federationSubdir('outbox', cwd, 'write'), recordFilename(claim.id, rev), record);
+        logger.debug(`Federation outbox: enqueued claim ${claim.id}@r${rev} (${prevStatus ?? 'new'}→${claim.status})`);
+        return rev;
+    }
+    catch (err) {
+        // Federation bookkeeping must never break a claim write.
+        logger.debug('Federation outbox enqueue failed (non-fatal):', err);
+        return null;
+    }
+}
+// ── Drain-side helpers (used by `brainclaw federation sync`) ───────────────────
+function loadRecordsFrom(dir) {
+    if (!fs.existsSync(dir))
+        return [];
+    const out = [];
+    for (const name of fs.readdirSync(dir)) {
+        if (!name.endsWith('.json') || name.startsWith('.'))
+            continue;
+        const filepath = path.join(dir, name);
+        try {
+            out.push({ record: JSON.parse(fs.readFileSync(filepath, 'utf-8')), filepath });
+        }
+        catch (err) {
+            logger.debug(`Federation outbox: skipping unreadable record ${name}:`, err);
+        }
+    }
+    return out;
+}
+export function listOutboxRecords(cwd) {
+    return loadRecordsFrom(federationSubdir('outbox', cwd, 'read'))
+        .sort((a, b) => (a.record.entity_id.localeCompare(b.record.entity_id)) || (a.record.rev - b.record.rev));
+}
+/** Highest rev already archived in sent/ for an id (the sync marker). 0 if none. */
+export function sentMarkerRev(id, cwd) {
+    const revs = revsForId(id, federationSubdir('sent', cwd, 'read'));
+    return revs.length ? Math.max(...revs) : 0;
+}
+function removeFileIfExists(filepath) {
+    try {
+        if (fs.existsSync(filepath))
+            fs.unlinkSync(filepath);
+    }
+    catch { /* best-effort */ }
+}
+/** Archive a record from outbox → sent (success or superseded). */
+export function archiveToSent(rec, meta, cwd) {
+    const sentDir = federationSubdir('sent', cwd, 'write');
+    const archived = {
+        ...rec.record,
+        synced_at: nowISO(),
+        http_status: meta.http_status,
+    };
+    writeRecordAtomic(sentDir, recordFilename(rec.record.entity_id, rec.record.rev), archived);
+    removeFileIfExists(rec.filepath);
+}
+/** Move a record from outbox → parked (dead-letter). */
+export function parkRecord(rec, reason, cwd) {
+    const parkedDir = federationSubdir('parked', cwd, 'write');
+    const parked = {
+        ...rec.record,
+        parked_at: nowISO(),
+        parked_reason: reason,
+    };
+    writeRecordAtomic(parkedDir, recordFilename(rec.record.entity_id, rec.record.rev), parked);
+    removeFileIfExists(rec.filepath);
+}
+/** Persist an updated attempt count / last error on a still-pending record. */
+export function recordAttempt(rec, meta, cwd) {
+    const updated = {
+        ...rec.record,
+        attempts: rec.record.attempts + 1,
+        last_status: meta.http_status,
+        last_error: meta.error,
+        last_attempt_at: nowISO(),
+    };
+    writeRecordAtomic(federationSubdir('outbox', cwd, 'write'), recordFilename(rec.record.entity_id, rec.record.rev), updated);
+}
+/**
+ * Startup reconcile before a drain: for each outbox record, if sent/ already
+ * holds a rev >= this one, this record is already superseded — drop it. If the
+ * SAME rev exists in sent with a different content_hash, park it (divergence).
+ */
+export function reconcileOutbox(cwd) {
+    const result = { dropped: 0, parked: 0 };
+    const sentDir = federationSubdir('sent', cwd, 'read');
+    for (const rec of listOutboxRecords(cwd)) {
+        const sentRev = sentMarkerRev(rec.record.entity_id, cwd);
+        if (sentRev < rec.record.rev)
+            continue;
+        // A sent record at >= this rev exists. If the SAME rev has a different hash, park.
+        const sameRevPath = path.join(sentDir, recordFilename(rec.record.entity_id, rec.record.rev));
+        if (fs.existsSync(sameRevPath)) {
+            try {
+                const sent = JSON.parse(fs.readFileSync(sameRevPath, 'utf-8'));
+                if (sent.content_hash !== rec.record.content_hash) {
+                    parkRecord(rec, 'reconcile: same rev already sent with a different content_hash', cwd);
+                    result.parked++;
+                    continue;
+                }
+            }
+            catch { /* fall through to drop */ }
+        }
+        removeFileIfExists(rec.filepath);
+        result.dropped++;
+    }
+    return result;
+}
+//# sourceMappingURL=federation-outbox.js.map

package/dist/core/federation-signing.js

@@ -0,0 +1,115 @@
+/**
+ * Ed25519 request signing for the Brainclaw Cloud federation bridge (pln#100).
+ *
+ * The cloud verifier (brainclaw-cloud/src/middleware/signature.ts) expects three
+ * headers on a signed runtime write:
+ *   X-Agent-Id:        the cloud agent id whose public_key_pem is stored in D1
+ *   X-Agent-Signature: base64 Ed25519 signature over (body + timestamp)
+ *   X-Agent-Timestamp: ISO-8601 timestamp (5-minute replay window)
+ *
+ * The signing key is the agent's local Ed25519 private key managed by
+ * agent-registry (~/.brainclaw/keys/<id>.ed25519.pem). Its SPKI public-key PEM
+ * is what gets registered with the cloud, and sha256(pem) is the fingerprint
+ * both sides compute — so a local↔remote fingerprint match proves the same key.
+ *
+ * @module
+ */
+import crypto from 'node:crypto';
+import { loadConfig } from './config.js';
+import { loadAgentSigningKey, resolveRegisteredAgentIdentity } from './agent-registry.js';
+import { logger } from './logger.js';
+export const AGENT_ID_HEADER = 'X-Agent-Id';
+export const AGENT_SIGNATURE_HEADER = 'X-Agent-Signature';
+export const AGENT_TIMESTAMP_HEADER = 'X-Agent-Timestamp';
+/**
+ * Sign a request body with an Ed25519 private key, producing the cloud's
+ * signature headers. The signed message is exactly `body + timestamp` (UTF-8),
+ * mirroring the verifier. Node signs Ed25519 with a null algorithm.
+ */
+export function signCloudBody(body, params) {
+    const timestamp = params.timestamp ?? new Date().toISOString();
+    const privateKey = crypto.createPrivateKey(params.privateKeyPem);
+    const signature = crypto.sign(null, Buffer.from(body + timestamp, 'utf-8'), privateKey);
+    return {
+        [AGENT_ID_HEADER]: params.agentId,
+        [AGENT_SIGNATURE_HEADER]: signature.toString('base64'),
+        [AGENT_TIMESTAMP_HEADER]: timestamp,
+    };
+}
+/**
+ * Build the outgoing header set for a cloud runtime write.
+ *
+ * - Always includes Content-Type + X-API-Key.
+ * - Adds the Ed25519 signature headers when a signing identity is available.
+ * - Returns `undefined` (fail-closed) when `requireSigned` is set but no signing
+ *   identity is available — the caller MUST NOT send the request in that case.
+ *
+ * Pure and dependency-injected (no filesystem/network) so it is unit-testable.
+ */
+export function buildCloudWriteHeaders(body, opts) {
+    const headers = {
+        'Content-Type': 'application/json',
+        'X-API-Key': opts.apiKey,
+    };
+    if (opts.signing) {
+        Object.assign(headers, signCloudBody(body, {
+            agentId: opts.signing.cloudAgentId,
+            privateKeyPem: opts.signing.privateKeyPem,
+            timestamp: opts.timestamp,
+        }));
+    }
+    else if (opts.requireSigned) {
+        return undefined;
+    }
+    return headers;
+}
+/**
+ * Resolve the approved agent identity used to sign runtime writes.
+ *
+ * The private key is loaded from the LOCAL brainclaw identity (resolved by
+ * configured agent name / current-agent), while `cloudAgentId` (the value for
+ * X-Agent-Id) comes from the configured cloud agent id when set — the cloud
+ * assigns its own id at registration, distinct from the local identity id. When
+ * no cloud id is configured (self-hosted / id-preserving), the local id is used.
+ *
+ * Returns undefined when no agent is configured or no local Ed25519 key exists.
+ */
+export function resolveCloudSigningIdentity(cwd, env = process.env) {
+    let cfgAgentId;
+    let cfgAgentName;
+    try {
+        const config = loadConfig(cwd);
+        cfgAgentId = config.cloud_sync?.agent_id;
+        cfgAgentName = config.cloud_sync?.agent_name;
+    }
+    catch {
+        // No project config — fall back to env only.
+    }
+    // X-Agent-Id must be the CLOUD agent id, which is distinct from the local
+    // identity id. BRAINCLAW_AGENT_ID is already the LOCAL id everywhere in
+    // brainclaw (current-agent resolution, etc.), so a dedicated
+    // BRAINCLAW_CLOUD_AGENT_ID override avoids sending the local id as the cloud
+    // header when a session exports BRAINCLAW_AGENT_ID (review finding, pln#100).
+    const cloudAgentId = (env.BRAINCLAW_CLOUD_AGENT_ID?.trim() || cfgAgentId || '').trim() || undefined;
+    const agentName = (env.BRAINCLAW_AGENT_NAME?.trim() || env.BRAINCLAW_AGENT?.trim() || cfgAgentName || '').trim() || undefined;
+    // Resolve the LOCAL identity backing the private key: prefer name, then fall
+    // back to a local-id match (self-hosted), then the current agent.
+    const identity = resolveRegisteredAgentIdentity({ agentName, cwd, env, allowCurrent: true, allowEnv: true }) ??
+        (cloudAgentId ? resolveRegisteredAgentIdentity({ agentId: cloudAgentId, cwd, env }) : undefined);
+    if (!identity) {
+        logger.debug('Cloud signing: no local agent identity resolved.');
+        return undefined;
+    }
+    const key = loadAgentSigningKey(identity.agent_id, env);
+    if (!key) {
+        logger.debug(`Cloud signing: agent '${identity.agent_name}' has no local Ed25519 key.`);
+        return undefined;
+    }
+    return {
+        cloudAgentId: cloudAgentId ?? identity.agent_id,
+        localAgentId: identity.agent_id,
+        agentName: identity.agent_name,
+        ...key,
+    };
+}
+//# sourceMappingURL=federation-signing.js.map