{"record":{"id":"34eef628beb19b13","repo":"ruvnet/ruflo","slug":"unsupported-federation-signature-mode-string-si","errorCode":null,"errorMessage":"Unsupported federation signature mode: ${String(signatureMode)}","messagePattern":"Unsupported federation signature mode: (.+?)","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/plugin.ts","lineNumber":103,"sourceCode":"  private transport: LoadedTransport | null = null;\n  // A2A Agent Card well-known endpoint (opt-in via config.a2aCard). Null\n  // when the HTTP surface is off — everything else works without it.\n  private agentCardServer: AgentCardServerHandle | null = null;\n\n  async initialize(context: PluginContext): Promise<void> {\n    this.context = context;\n    const config = context.config;\n\n    const nodeId = (config['nodeId'] as string) ?? `node-${Date.now().toString(36)}`;\n    const endpoint = (config['endpoint'] as string) ?? 'ws://localhost:9100';\n    const complianceMode = (config['complianceMode'] as ComplianceMode) ?? 'none';\n    const staticPeers = (config['staticPeers'] as string[]) ?? [];\n    const hashSalt = (config['hashSalt'] as string) ?? `salt-${nodeId}`;\n    const signatureMode =\n      (config['signatureMode'] as EnvelopeSignatureMode | undefined)\n      ?? DEFAULT_ENVELOPE_SIGNATURE_MODE;\n    if (!['legacy', 'prefer-jcs', 'require-jcs'].includes(signatureMode)) {\n      throw new TypeError(`Unsupported federation signature mode: ${String(signatureMode)}`);\n    }\n\n    // ADR-095 G2: real Ed25519 keypair instead of empty publicKey + stub\n    // signatures. Persist to .claude-flow/federation/key-<nodeId>.json so\n    // the same node identity survives restarts. Audit log\n    // audit_1776483149979 flagged the previous \"verifySignature returns\n    // true unconditionally\" as a critical authn bypass; this closes it.\n    const keyDir = join(process.cwd(), '.claude-flow', 'federation');\n    const keyPath = join(keyDir, `key-${nodeId}.json`);\n    let privateKey: Uint8Array;\n    let publicKeyHex: string;\n    try {\n      if (existsSync(keyPath)) {\n        const stored = JSON.parse(readFileSync(keyPath, 'utf-8')) as { privateKey: string; publicKey: string; nodeId: string };\n        privateKey = new Uint8Array(Buffer.from(stored.privateKey, 'hex'));\n        publicKeyHex = stored.publicKey;\n      } else {\n        privateKey = ed.utils.randomPrivateKey();","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/plugin.ts#L85-L121","documentation":"Startup validation in the agent-federation plugin constructor: config.signatureMode (an EnvelopeSignatureMode) must be exactly 'legacy', 'prefer-jcs', or 'require-jcs'; anything else raises a TypeError immediately. When the key is absent the plugin falls back to DEFAULT_ENVELOPE_SIGNATURE_MODE, so this error always indicates an explicitly supplied bad value.","triggerScenarios":"Passing signatureMode with a typo, wrong case, or invented value (e.g. 'jcs', 'Require-JCS', 'prefer_jcs'), or a config pipeline that coerces the value into a non-string (number, boolean, or nested object).","commonSituations":"Copying config snippets between plugin versions whose mode names changed; env-var mapping that injects the literal string 'undefined'; YAML/JSON config parsed into a nested object instead of a scalar string.","solutions":["Set signatureMode to one of the exact strings: 'legacy', 'prefer-jcs', or 'require-jcs'","Omit the key entirely to use the built-in default mode","Add a startup config validator that checks the enum before the plugin is constructed"],"exampleFix":"// before\nconst config = { signatureMode: 'jcs' }; // TypeError: Unsupported federation signature mode\n\n// after\nconst config = { signatureMode: 'prefer-jcs' };","handlingStrategy":"type-guard","validationCode":"const MODES = ['legacy', 'prefer-jcs', 'require-jcs'] as const;\nconst raw = config['signatureMode'];\nif (raw !== undefined && !isEnvelopeSignatureMode(raw)) {\n  throw new TypeError(`Unsupported federation signature mode: ${String(raw)} (allowed: ${MODES.join(', ')})`);\n}","typeGuard":"const ENVELOPE_SIGNATURE_MODES = ['legacy', 'prefer-jcs', 'require-jcs'] as const;\ntype EnvelopeSignatureMode = (typeof ENVELOPE_SIGNATURE_MODES)[number];\nfunction isEnvelopeSignatureMode(v: unknown): v is EnvelopeSignatureMode {\n  return typeof v === 'string' && (ENVELOPE_SIGNATURE_MODES as readonly string[]).includes(v);\n}","tryCatchPattern":"try {\n  host.register(plugin, config);\n} catch (e) {\n  if (e instanceof TypeError && e.message.startsWith('Unsupported federation signature mode')) {\n    // fail deployment; surface the allowed list to the operator\n  } else throw e;\n}","preventionTips":["Derive allowed values from one shared constant used by both config validation and docs","Validate plugin config in CI before deploy","Prefer omitting optional enum keys over copying values between environments"],"tags":["configuration","enum-validation","typescript","federation","startup"],"backgroundTag":"invalid-configuration-value","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}