4 Commits

Include renames

Author	SHA1	Message	Date
jason.woltje	838c44086c	feat(#462): add federation query source routing (#673)	2026-06-24 21:39:45 +00:00
jarvisandClaude Sonnet 4.6	37675ae3f2	fix(federation/client): serialize cache fills, destroy evicted Agent, cover env-var guard ... - HIGH-A: resolveEntry now uses promise-cache pattern so concurrent callers serialize on a single in-flight build, eliminating duplicate key material in heap and duplicate DB round-trips - HIGH-B: flushPeer destroys the evicted undici Agent so stale TLS connections close on cert rotation - MED-C: add regression test for PEER_MISCONFIGURED when STEP_CA_ROOT_CERT_PATH is unset Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-04-23 22:56:57 -05:00
jarvisandClaude Opus 4.7	a4a6769a6d	fix(federation/client): pin Step-CA root, fix lockfile, harden cache test ... CRIT-1: regenerate pnpm-lock.yaml so apps/gateway resolves [email protected].6 (prior PR pushed package.json without lockfile update; CI failed with ERR_PNPM_OUTDATED_LOCKFILE). Incidentally cleans 57 lines of stale peer-dep entries. CRIT-2: cache-hit test no longer swallows resolveEntry errors. Calls the private method directly twice and asserts identity equality plus a single DB select, removing the silent-failure path the prior assertion allowed. HIGH-1: mTLS Agent now pins Step-CA root via STEP_CA_ROOT_CERT_PATH. Without the env var resolveEntry throws PEER_MISCONFIGURED, refusing to dial peers against the public trust store. PEM is read once and cached on the service instance. Co-Authored-By: Claude Opus 4.7 <[email protected]>	2026-04-23 22:30:09 -05:00
jarvisandClaude Sonnet 4.6	21650fb194	feat(federation): outbound mTLS FederationClient (FED-M3-08) ... Implements FederationClientService — a NestJS injectable that dials peer gateways over mTLS (undici Agent with cert+sealed-key from federation_peers), invokes list/get/capabilities verbs, validates responses via Zod, and surfaces all failure modes as typed FederationClientError with a coherent error code taxonomy (PEER_NOT_FOUND, PEER_INACTIVE, PEER_MISCONFIGURED, NETWORK, FORBIDDEN, HTTP_{status}, INVALID_RESPONSE). Per-peer Agent instances are cached in a Map for the service lifetime; flushPeer(peerId) invalidates the cache for M5/M6 cert rotation and revocation events. Wired into FederationModule providers + exports so QuerySourceService (M3-09) can inject it. 13 unit tests covering all required scenarios via undici MockAgent + real sealClientKey/unsealClientKey round-trip. Closes #462 Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-04-23 22:16:52 -05:00