@creatornader/agent-bridge 0.2.0 → 0.3.0

package/dist/gateway-main.js

@@ -1,24 +1,166 @@
 #!/usr/bin/env node
 import {
   PostgresBridgeStore
-} from "./chunk-O26W5QHS.js";
+} from "./chunk-2DFNOLMO.js";
 import {
   loadMigrationPlan,
   migrationsReady,
   runMigrations,
   runtimeSchemaReady
-} from "./chunk-6MAZ6YLZ.js";
+} from "./chunk-45BZGB77.js";
+import "./chunk-VOQIDTCJ.js";
 import {
   PostgresCredentialResolver,
   createGateway
-} from "./chunk-JOUBDRYX.js";
-import "./chunk-YD6YJATN.js";
-import "./chunk-CKSKUBDQ.js";
-import "./chunk-BV6W4AJK.js";
+} from "./chunk-WAI2IYIQ.js";
+import "./chunk-4VB44KJU.js";
+import "./chunk-GADH244D.js";
+import "./chunk-BZLMF5O5.js";
 
 // src/gateway-main.ts
 import { fileURLToPath } from "url";
 import pg from "pg";
+
+// src/gateway-security.ts
+var PostgresGatewaySecurity = class {
+  constructor(db) {
+    this.db = db;
+  }
+  functionName(bound, unbound) {
+    return this.db.inTransaction ? bound : unbound;
+  }
+  async recordScopeDenial(credentialId, operationId, requestId, signal) {
+    if (signal?.aborted) throw signal.reason;
+    await this.db.query(
+      `SELECT agent_bridge.${this.functionName("record_scope_denial", "record_scope_denial_unbound_011")}($1::uuid, $2::text, $3::uuid)`,
+      [credentialId, operationId, requestId]
+    );
+    if (signal?.aborted) throw signal.reason;
+  }
+  async consume(credentialId, operationId, requestId, signal) {
+    if (signal?.aborted) throw signal.reason;
+    const result = await this.db.query(
+      `SELECT allowed, limit_value, remaining_value, retry_after_seconds, denied_policy_id
+       FROM agent_bridge.${this.functionName("consume_rate_limit", "consume_rate_limit_unbound_011")}($1::uuid, $2::text, $3::uuid)`,
+      [credentialId, operationId, requestId]
+    );
+    if (signal?.aborted) throw signal.reason;
+    const row = result.rows[0];
+    if (!row) throw new Error("rate limit policy is missing");
+    return {
+      allowed: row.allowed,
+      policyId: row.denied_policy_id,
+      limit: Math.max(0, Number(row.limit_value)),
+      remaining: Math.max(0, Number(row.remaining_value)),
+      retryAfterSeconds: Math.max(0, Number(row.retry_after_seconds))
+    };
+  }
+};
+
+// src/postgres-request-authority.ts
+var MutationOutcomeUnknownError = class extends Error {
+  constructor() {
+    super("The database commit outcome is unknown");
+    this.status = 503;
+    this.code = "mutation_outcome_unknown";
+  }
+};
+var PostgresRequestAuthority = class {
+  constructor(pool) {
+    this.pool = pool;
+  }
+  async run(credentialId, credentialHash, requestId, signal, work) {
+    if (signal.aborted) throw signal.reason;
+    const client = await this.pool.connect();
+    const db = { inTransaction: true, query: (sql, values) => client.query(sql, values) };
+    let transactionOpen = false;
+    let domainSavepoint = false;
+    let commitDispatched = false;
+    let commitCompleted = false;
+    let discard;
+    try {
+      if (signal.aborted) throw signal.reason;
+      await client.query("BEGIN");
+      transactionOpen = true;
+      const opened = await client.query(
+        `SELECT credential_id,workspace_id,principal,scopes
+         FROM agent_bridge.open_request_authority($1::uuid,$2::text,$3::uuid)`,
+        [credentialId, credentialHash, requestId]
+      );
+      const row = opened.rows[0];
+      if (!row) {
+        await client.query("ROLLBACK");
+        transactionOpen = false;
+        throw Object.assign(new Error("Credential is not active"), { status: 401, code: "unauthorized" });
+      }
+      if (signal.aborted) throw signal.reason;
+      const context = {
+        credential: { id: row.credential_id, principal: { workspace: row.workspace_id, agent: row.principal }, scopes: row.scopes },
+        store: new PostgresBridgeStore(db),
+        security: new PostgresGatewaySecurity(db),
+        beginDomainWork: async () => {
+          if (domainSavepoint) return;
+          if (signal.aborted) throw signal.reason;
+          await client.query("SAVEPOINT agent_bridge_domain_work");
+          if (signal.aborted) throw signal.reason;
+          domainSavepoint = true;
+        }
+      };
+      try {
+        const result = await work(context);
+        if (signal.aborted) throw signal.reason;
+        await client.query("SELECT agent_bridge.close_request_authority()");
+        if (signal.aborted) throw signal.reason;
+        commitDispatched = true;
+        await client.query("COMMIT");
+        commitCompleted = true;
+        transactionOpen = false;
+        return result;
+      } catch (error) {
+        if (commitDispatched) throw new MutationOutcomeUnknownError();
+        if (signal.aborted) throw error;
+        try {
+          if (domainSavepoint) {
+            await client.query("ROLLBACK TO SAVEPOINT agent_bridge_domain_work");
+          }
+          await client.query("SELECT agent_bridge.close_request_authority()");
+        } catch {
+          try {
+            await client.query("ROLLBACK");
+          } catch (rollbackError) {
+            discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));
+          }
+          transactionOpen = false;
+          throw error;
+        }
+        if (signal.aborted) throw signal.reason;
+        commitDispatched = true;
+        await client.query("COMMIT");
+        commitCompleted = true;
+        transactionOpen = false;
+        throw error;
+      }
+    } catch (error) {
+      if (commitDispatched && !commitCompleted) {
+        discard = error instanceof Error ? error : new Error(String(error));
+        throw error instanceof MutationOutcomeUnknownError ? error : new MutationOutcomeUnknownError();
+      }
+      if (transactionOpen) {
+        try {
+          await client.query("ROLLBACK");
+          transactionOpen = false;
+        } catch (rollbackError) {
+          discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));
+        }
+      }
+      throw error;
+    } finally {
+      client.release(discard);
+    }
+  }
+};
+
+// src/gateway-main.ts
 function integer(value, fallback, name) {
   if (value === void 0) return fallback;
   const parsed = Number(value);
@@ -68,18 +210,58 @@ async function main() {
   const pool = new pg.Pool({
     connectionString: databaseUrl,
     max: poolSize,
+    connectionTimeoutMillis: databaseTimeout,
     query_timeout: databaseTimeout,
     statement_timeout: databaseTimeout,
     application_name: "agent-bridge-gateway"
   });
+  const readinessPool = new pg.Pool({
+    connectionString: databaseUrl,
+    max: 1,
+    connectionTimeoutMillis: databaseTimeout,
+    query_timeout: databaseTimeout,
+    statement_timeout: databaseTimeout,
+    application_name: "agent-bridge-gateway-readiness"
+  });
   const store = new PostgresBridgeStore(pool);
+  let readinessCheckedAt = 0;
+  let readinessValue = false;
+  let readinessInFlight;
+  const probeSchema = async () => await migrationsReady(readinessPool, migrationPlan) && await runtimeSchemaReady(readinessPool);
+  const schemaReady = (force = false) => {
+    if (!force && Date.now() - readinessCheckedAt < 1e3) {
+      return Promise.resolve(readinessValue);
+    }
+    if (readinessInFlight) return readinessInFlight;
+    let current;
+    current = probeSchema().then((ready) => {
+      readinessValue = ready;
+      readinessCheckedAt = Date.now();
+      return ready;
+    }).finally(() => {
+      if (readinessInFlight === current) readinessInFlight = void 0;
+    });
+    readinessInFlight = current;
+    return current;
+  };
+  try {
+    if (!await schemaReady(true)) {
+      throw new Error("runtime database is not ready for enforced row isolation");
+    }
+  } catch (error) {
+    await Promise.allSettled([pool.end(), readinessPool.end()]);
+    throw error;
+  }
   const gateway = createGateway({
     store,
     credentials: new PostgresCredentialResolver(pool),
+    security: new PostgresGatewaySecurity(pool),
+    requestAuthority: new PostgresRequestAuthority(pool),
     allowedOrigins,
     bodyLimitBytes,
     requestDeadlineMs: deadline,
-    ready: async () => await migrationsReady(pool, migrationPlan) && await runtimeSchemaReady(pool)
+    ready: schemaReady,
+    rowIsolationReady: schemaReady
   });
   gateway.listen(port, host, () => {
     process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}
@@ -92,7 +274,7 @@ async function main() {
     await new Promise((resolve, reject) => {
       gateway.close((error) => error ? reject(error) : resolve());
     });
-    await pool.end();
+    await Promise.all([pool.end(), readinessPool.end()]);
   }
   process.once("SIGINT", () => void shutdown());
   process.once("SIGTERM", () => void shutdown());

package/dist/gateway-main.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/gateway-main.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport pg from \"pg\";\nimport { PostgresCredentialResolver } from \"./gateway-auth.js\";\nimport { createGateway } from \"./gateway.js\";\nimport {\n  loadMigrationPlan,\n  migrationsReady,\n  runMigrations,\n  runtimeSchemaReady,\n} from \"./migrations.js\";\nimport { PostgresBridgeStore } from \"./postgres-bridge-store.js\";\n\nfunction integer(value: string | undefined, fallback: number, name: string): number {\n  if (value === undefined) return fallback;\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${name} must be a positive integer`);\n  return parsed;\n}\n\nasync function main(): Promise<void> {\n  const migrationsDirectory = fileURLToPath(new URL(\"../sql/migrations\", import.meta.url));\n  if (process.argv.includes(\"--migrate-only\")) {\n    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;\n    if (!databaseUrl) throw new Error(\"AGENT_BRIDGE_DATABASE_URL is required for migrations\");\n    const migrationPool = new pg.Pool({\n      connectionString: databaseUrl,\n      max: 1,\n      application_name: \"agent-bridge-migrator\",\n    });\n    try {\n      await runMigrations(migrationPool, migrationsDirectory);\n    } finally {\n      await migrationPool.end();\n    }\n    return;\n  }\n  if (process.env.AGENT_BRIDGE_MIGRATE === \"1\") {\n    throw new Error(\"AGENT_BRIDGE_MIGRATE is not supported; run agent-bridge migrate separately\");\n  }\n  const databaseUrl = process.env.AGENT_BRIDGE_RUNTIME_DATABASE_URL;\n  if (!databaseUrl) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway\");\n  }\n\n  const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 10_000, \"request deadline\");\n  const databaseTimeout = integer(\n    process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,\n    Math.max(1, Math.floor(deadline / 3)),\n    \"database timeout\",\n  );\n  const poolSize = integer(process.env.AGENT_BRIDGE_DATABASE_POOL_SIZE, 10, \"database pool size\");\n  const bodyLimitBytes = integer(\n    process.env.AGENT_BRIDGE_BODY_LIMIT_BYTES,\n    128 * 1024,\n    \"body limit\",\n  );\n  const host = process.env.AGENT_BRIDGE_HOST ?? \"127.0.0.1\";\n  const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, \"gateway port\");\n  const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  const migrationPlan = await loadMigrationPlan(migrationsDirectory);\n  const pool = new pg.Pool({\n    connectionString: databaseUrl,\n    max: poolSize,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway\",\n  });\n\n  const store = new PostgresBridgeStore(pool);\n  const gateway = createGateway({\n    store,\n    credentials: new PostgresCredentialResolver(pool),\n    allowedOrigins,\n    bodyLimitBytes,\n    requestDeadlineMs: deadline,\n    ready: async () =>\n      await migrationsReady(pool, migrationPlan) && await runtimeSchemaReady(pool),\n  });\n\n  gateway.listen(port, host, () => {\n    process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}\\n`);\n  });\n\n  let stopping = false;\n  async function shutdown(): Promise<void> {\n    if (stopping) return;\n    stopping = true;\n    await new Promise<void>((resolve, reject) => {\n      gateway.close((error) => error ? reject(error) : resolve());\n    });\n    await pool.end();\n  }\n\n  process.once(\"SIGINT\", () => void shutdown());\n  process.once(\"SIGTERM\", () => void shutdown());\n}\n\nvoid main().catch((error) => {\n  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,QAAQ;AAWf,SAAS,QAAQ,OAA2B,UAAkB,MAAsB;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACrG,SAAO;AACT;AAEA,eAAe,OAAsB;AACnC,QAAM,sBAAsB,cAAc,IAAI,IAAI,qBAAqB,YAAY,GAAG,CAAC;AACvF,MAAI,QAAQ,KAAK,SAAS,gBAAgB,GAAG;AAC3C,UAAMA,eAAc,QAAQ,IAAI;AAChC,QAAI,CAACA,aAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,MAChC,kBAAkBA;AAAA,MAClB,KAAK;AAAA,MACL,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI;AACF,YAAM,cAAc,eAAe,mBAAmB;AAAA,IACxD,UAAE;AACA,YAAM,cAAc,IAAI;AAAA,IAC1B;AACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,yBAAyB,KAAK;AAC5C,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,kCAAkC,KAAQ,kBAAkB;AACjG,QAAM,kBAAkB;AAAA,IACtB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,QAAQ,IAAI,iCAAiC,IAAI,oBAAoB;AAC9F,QAAM,iBAAiB;AAAA,IACrB,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,IAAI,qBAAqB;AAC9C,QAAM,OAAO,QAAQ,QAAQ,IAAI,mBAAmB,MAAM,cAAc;AACxE,QAAM,iBAAiB,QAAQ,IAAI,8BAC/B,MAAM,GAAG,EACV,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AACjB,QAAM,gBAAgB,MAAM,kBAAkB,mBAAmB;AACjE,QAAM,OAAO,IAAI,GAAG,KAAK;AAAA,IACvB,kBAAkB;AAAA,IAClB,KAAK;AAAA,IACL,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,QAAQ,IAAI,oBAAoB,IAAI;AAC1C,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA,aAAa,IAAI,2BAA2B,IAAI;AAAA,IAChD;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,OAAO,YACL,MAAM,gBAAgB,MAAM,aAAa,KAAK,MAAM,mBAAmB,IAAI;AAAA,EAC/E,CAAC;AAED,UAAQ,OAAO,MAAM,MAAM,MAAM;AAC/B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AAED,MAAI,WAAW;AACf,iBAAe,WAA0B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAQ,MAAM,CAAC,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,IAC5D,CAAC;AACD,UAAM,KAAK,IAAI;AAAA,EACjB;AAEA,UAAQ,KAAK,UAAU,MAAM,KAAK,SAAS,CAAC;AAC5C,UAAQ,KAAK,WAAW,MAAM,KAAK,SAAS,CAAC;AAC/C;AAEA,KAAK,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3B,UAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AAClF,UAAQ,WAAW;AACrB,CAAC;","names":["databaseUrl"]}
+{"version":3,"sources":["../src/gateway-main.ts","../src/gateway-security.ts","../src/postgres-request-authority.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport pg from \"pg\";\nimport { PostgresCredentialResolver } from \"./gateway-auth.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\nimport { createGateway } from \"./gateway.js\";\nimport {\n  loadMigrationPlan,\n  migrationsReady,\n  runMigrations,\n  runtimeSchemaReady,\n} from \"./migrations.js\";\nimport { PostgresBridgeStore } from \"./postgres-bridge-store.js\";\nimport { PostgresRequestAuthority } from \"./postgres-request-authority.js\";\n\nfunction integer(value: string | undefined, fallback: number, name: string): number {\n  if (value === undefined) return fallback;\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${name} must be a positive integer`);\n  return parsed;\n}\n\nasync function main(): Promise<void> {\n  const migrationsDirectory = fileURLToPath(new URL(\"../sql/migrations\", import.meta.url));\n  if (process.argv.includes(\"--migrate-only\")) {\n    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;\n    if (!databaseUrl) throw new Error(\"AGENT_BRIDGE_DATABASE_URL is required for migrations\");\n    const migrationPool = new pg.Pool({\n      connectionString: databaseUrl,\n      max: 1,\n      application_name: \"agent-bridge-migrator\",\n    });\n    try {\n      await runMigrations(migrationPool, migrationsDirectory);\n    } finally {\n      await migrationPool.end();\n    }\n    return;\n  }\n  if (process.env.AGENT_BRIDGE_MIGRATE === \"1\") {\n    throw new Error(\"AGENT_BRIDGE_MIGRATE is not supported; run agent-bridge migrate separately\");\n  }\n  const databaseUrl = process.env.AGENT_BRIDGE_RUNTIME_DATABASE_URL;\n  if (!databaseUrl) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway\");\n  }\n\n  const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 10_000, \"request deadline\");\n  const databaseTimeout = integer(\n    process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,\n    Math.max(1, Math.floor(deadline / 3)),\n    \"database timeout\",\n  );\n  const poolSize = integer(process.env.AGENT_BRIDGE_DATABASE_POOL_SIZE, 10, \"database pool size\");\n  const bodyLimitBytes = integer(\n    process.env.AGENT_BRIDGE_BODY_LIMIT_BYTES,\n    128 * 1024,\n    \"body limit\",\n  );\n  const host = process.env.AGENT_BRIDGE_HOST ?? \"127.0.0.1\";\n  const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, \"gateway port\");\n  const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  const migrationPlan = await loadMigrationPlan(migrationsDirectory);\n  const pool = new pg.Pool({\n    connectionString: databaseUrl,\n    max: poolSize,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway\",\n  });\n  const readinessPool = new pg.Pool({\n    connectionString: databaseUrl,\n    max: 1,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway-readiness\",\n  });\n\n  const store = new PostgresBridgeStore(pool);\n  let readinessCheckedAt = 0;\n  let readinessValue = false;\n  let readinessInFlight: Promise<boolean> | undefined;\n  const probeSchema = async () =>\n    await migrationsReady(readinessPool, migrationPlan) && await runtimeSchemaReady(readinessPool);\n  const schemaReady = (force = false): Promise<boolean> => {\n    if (!force && Date.now() - readinessCheckedAt < 1_000) {\n      return Promise.resolve(readinessValue);\n    }\n    if (readinessInFlight) return readinessInFlight;\n    let current: Promise<boolean>;\n    current = probeSchema()\n      .then((ready) => {\n        readinessValue = ready;\n        readinessCheckedAt = Date.now();\n        return ready;\n      })\n      .finally(() => {\n        if (readinessInFlight === current) readinessInFlight = undefined;\n      });\n    readinessInFlight = current;\n    return current;\n  };\n  try {\n    if (!await schemaReady(true)) {\n      throw new Error(\"runtime database is not ready for enforced row isolation\");\n    }\n  } catch (error) {\n    await Promise.allSettled([pool.end(), readinessPool.end()]);\n    throw error;\n  }\n  const gateway = createGateway({\n    store,\n    credentials: new PostgresCredentialResolver(pool),\n    security: new PostgresGatewaySecurity(pool),\n    requestAuthority: new PostgresRequestAuthority(pool),\n    allowedOrigins,\n    bodyLimitBytes,\n    requestDeadlineMs: deadline,\n    ready: schemaReady,\n    rowIsolationReady: schemaReady,\n  });\n\n  gateway.listen(port, host, () => {\n    process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}\\n`);\n  });\n\n  let stopping = false;\n  async function shutdown(): Promise<void> {\n    if (stopping) return;\n    stopping = true;\n    await new Promise<void>((resolve, reject) => {\n      gateway.close((error) => error ? reject(error) : resolve());\n    });\n    await Promise.all([pool.end(), readinessPool.end()]);\n  }\n\n  process.once(\"SIGINT\", () => void shutdown());\n  process.once(\"SIGTERM\", () => void shutdown());\n}\n\nvoid main().catch((error) => {\n  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n  process.exitCode = 1;\n});\n","import type { PgQueryable } from \"./postgres-bridge-store.js\";\nimport type { OperationId } from \"./contracts/registry.js\";\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  policyId: string | null;\n  limit: number;\n  remaining: number;\n  retryAfterSeconds: number;\n}\n\nexport interface GatewaySecurity {\n  recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void>;\n  consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision>;\n}\n\nexport class PostgresGatewaySecurity implements GatewaySecurity {\n  constructor(private readonly db: PgQueryable) {}\n\n  private functionName(bound: string, unbound: string): string {\n    return this.db.inTransaction ? bound : unbound;\n  }\n\n  async recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    if (signal?.aborted) throw signal.reason;\n    await this.db.query(\n      `SELECT agent_bridge.${this.functionName(\"record_scope_denial\", \"record_scope_denial_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n  }\n\n  async consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      allowed: boolean;\n      limit_value: string | number;\n      remaining_value: string | number;\n      retry_after_seconds: string | number;\n      denied_policy_id: string | null;\n    }>(\n      `SELECT allowed, limit_value, remaining_value, retry_after_seconds, denied_policy_id\n       FROM agent_bridge.${this.functionName(\"consume_rate_limit\", \"consume_rate_limit_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n    const row = result.rows[0];\n    if (!row) throw new Error(\"rate limit policy is missing\");\n    return {\n      allowed: row.allowed,\n      policyId: row.denied_policy_id,\n      limit: Math.max(0, Number(row.limit_value)),\n      remaining: Math.max(0, Number(row.remaining_value)),\n      retryAfterSeconds: Math.max(0, Number(row.retry_after_seconds)),\n    };\n  }\n}\n","import type pg from \"pg\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport { PostgresBridgeStore, type PgQueryable } from \"./postgres-bridge-store.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\n\nexport interface RequestAuthorityContext {\n  credential: { id: string; principal: BridgePrincipal; scopes: readonly AuthorizationScope[] };\n  store: PostgresBridgeStore;\n  security: PostgresGatewaySecurity;\n  /** Establishes the savepoint separating durable security accounting from domain work. */\n  beginDomainWork(): Promise<void>;\n}\n\nexport interface RequestAuthority {\n  run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T>;\n}\n\ntype AuthorityRow = {\n  credential_id: string;\n  workspace_id: string;\n  principal: string;\n  scopes: AuthorizationScope[];\n};\n\nexport class MutationOutcomeUnknownError extends Error {\n  readonly status = 503;\n  readonly code = \"mutation_outcome_unknown\";\n  constructor() { super(\"The database commit outcome is unknown\"); }\n}\n\nexport class PostgresRequestAuthority implements RequestAuthority {\n  constructor(private readonly pool: Pick<pg.Pool, \"connect\">) {}\n\n  async run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T> {\n    if (signal.aborted) throw signal.reason;\n    const client = await this.pool.connect();\n    const db: PgQueryable = { inTransaction: true, query: (sql, values) => client.query(sql, values) };\n    let transactionOpen = false;\n    let domainSavepoint = false;\n    let commitDispatched = false;\n    let commitCompleted = false;\n    let discard: Error | undefined;\n    try {\n      if (signal.aborted) throw signal.reason;\n      await client.query(\"BEGIN\");\n      transactionOpen = true;\n      const opened = await client.query<AuthorityRow>(\n        `SELECT credential_id,workspace_id,principal,scopes\n         FROM agent_bridge.open_request_authority($1::uuid,$2::text,$3::uuid)`,\n        [credentialId, credentialHash, requestId],\n      );\n      const row = opened.rows[0];\n      if (!row) {\n        await client.query(\"ROLLBACK\");\n        transactionOpen = false;\n        throw Object.assign(new Error(\"Credential is not active\"), { status: 401, code: \"unauthorized\" });\n      }\n      if (signal.aborted) throw signal.reason;\n      const context: RequestAuthorityContext = {\n        credential: { id: row.credential_id, principal: { workspace: row.workspace_id, agent: row.principal }, scopes: row.scopes },\n        store: new PostgresBridgeStore(db),\n        security: new PostgresGatewaySecurity(db),\n        beginDomainWork: async () => {\n          if (domainSavepoint) return;\n          if (signal.aborted) throw signal.reason;\n          await client.query(\"SAVEPOINT agent_bridge_domain_work\");\n          if (signal.aborted) throw signal.reason;\n          domainSavepoint = true;\n        },\n      };\n      try {\n        const result = await work(context);\n        if (signal.aborted) throw signal.reason;\n        await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        return result;\n      } catch (error) {\n        if (commitDispatched) throw new MutationOutcomeUnknownError();\n        if (signal.aborted) throw error;\n        try {\n          if (domainSavepoint) {\n            await client.query(\"ROLLBACK TO SAVEPOINT agent_bridge_domain_work\");\n          }\n          await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        } catch {\n          try {\n            await client.query(\"ROLLBACK\");\n          } catch (rollbackError) {\n            discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));\n          }\n          transactionOpen = false;\n          throw error;\n        }\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        throw error;\n      }\n    } catch (error) {\n      if (commitDispatched && !commitCompleted) {\n        discard = error instanceof Error ? error : new Error(String(error));\n        throw error instanceof MutationOutcomeUnknownError ? error : new MutationOutcomeUnknownError();\n      }\n      if (transactionOpen) {\n        try { await client.query(\"ROLLBACK\"); transactionOpen = false; }\n        catch (rollbackError) { discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError)); }\n      }\n      throw error;\n    } finally {\n      client.release(discard);\n    }\n  }\n\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,QAAQ;;;ACyBR,IAAM,0BAAN,MAAyD;AAAA,EAC9D,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAEvC,aAAa,OAAe,SAAyB;AAC3D,WAAO,KAAK,GAAG,gBAAgB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAM,kBACJ,cACA,aACA,WACA,QACe;AACf,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,KAAK,GAAG;AAAA,MACZ,uBAAuB,KAAK,aAAa,uBAAuB,iCAAiC,CAAC;AAAA,MAClG,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAAA,EACpC;AAAA,EAEA,MAAM,QACJ,cACA,aACA,WACA,QAC4B;AAC5B,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAO3B;AAAA,2BACqB,KAAK,aAAa,sBAAsB,gCAAgC,CAAC;AAAA,MAC9F,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8BAA8B;AACxD,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,MAC1C,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,eAAe,CAAC;AAAA,MAClD,mBAAmB,KAAK,IAAI,GAAG,OAAO,IAAI,mBAAmB,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;ACnDO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,cAAc;AAAE,UAAM,wCAAwC;AAF9D,SAAS,SAAS;AAClB,SAAS,OAAO;AAAA,EACiD;AACnE;AAEO,IAAM,2BAAN,MAA2D;AAAA,EAChE,YAA6B,MAAgC;AAAhC;AAAA,EAAiC;AAAA,EAE9D,MAAM,IAAO,cAAsB,gBAAwB,WAAmB,QAAqB,MAAoE;AACrK,QAAI,OAAO,QAAS,OAAM,OAAO;AACjC,UAAM,SAAS,MAAM,KAAK,KAAK,QAAQ;AACvC,UAAM,KAAkB,EAAE,eAAe,MAAM,OAAO,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,MAAM,EAAE;AACjG,QAAI,kBAAkB;AACtB,QAAI,kBAAkB;AACtB,QAAI,mBAAmB;AACvB,QAAI,kBAAkB;AACtB,QAAI;AACJ,QAAI;AACF,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,OAAO,MAAM,OAAO;AAC1B,wBAAkB;AAClB,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B;AAAA;AAAA,QAEA,CAAC,cAAc,gBAAgB,SAAS;AAAA,MAC1C;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,KAAK;AACR,cAAM,OAAO,MAAM,UAAU;AAC7B,0BAAkB;AAClB,cAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG,EAAE,QAAQ,KAAK,MAAM,eAAe,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,UAAmC;AAAA,QACvC,YAAY,EAAE,IAAI,IAAI,eAAe,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU,GAAG,QAAQ,IAAI,OAAO;AAAA,QAC1H,OAAO,IAAI,oBAAoB,EAAE;AAAA,QACjC,UAAU,IAAI,wBAAwB,EAAE;AAAA,QACxC,iBAAiB,YAAY;AAC3B,cAAI,gBAAiB;AACrB,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,gBAAM,OAAO,MAAM,oCAAoC;AACvD,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,4BAAkB;AAAA,QACpB;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,cAAM,OAAO,MAAM,+CAA+C;AAClE,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAkB,OAAM,IAAI,4BAA4B;AAC5D,YAAI,OAAO,QAAS,OAAM;AAC1B,YAAI;AACF,cAAI,iBAAiB;AACnB,kBAAM,OAAO,MAAM,gDAAgD;AAAA,UACrE;AACA,gBAAM,OAAO,MAAM,+CAA+C;AAAA,QACpE,QAAQ;AACN,cAAI;AACF,kBAAM,OAAO,MAAM,UAAU;AAAA,UAC/B,SAAS,eAAe;AACtB,sBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,UAC5F;AACA,4BAAkB;AAClB,gBAAM;AAAA,QACR;AACA,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,cAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAO;AACd,UAAI,oBAAoB,CAAC,iBAAiB;AACxC,kBAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAClE,cAAM,iBAAiB,8BAA8B,QAAQ,IAAI,4BAA4B;AAAA,MAC/F;AACA,UAAI,iBAAiB;AACnB,YAAI;AAAE,gBAAM,OAAO,MAAM,UAAU;AAAG,4BAAkB;AAAA,QAAO,SACxD,eAAe;AAAE,oBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,QAAG;AAAA,MACvH;AACA,YAAM;AAAA,IACR,UAAE;AACA,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AAEF;;;AF1GA,SAAS,QAAQ,OAA2B,UAAkB,MAAsB;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACrG,SAAO;AACT;AAEA,eAAe,OAAsB;AACnC,QAAM,sBAAsB,cAAc,IAAI,IAAI,qBAAqB,YAAY,GAAG,CAAC;AACvF,MAAI,QAAQ,KAAK,SAAS,gBAAgB,GAAG;AAC3C,UAAMA,eAAc,QAAQ,IAAI;AAChC,QAAI,CAACA,aAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,MAChC,kBAAkBA;AAAA,MAClB,KAAK;AAAA,MACL,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI;AACF,YAAM,cAAc,eAAe,mBAAmB;AAAA,IACxD,UAAE;AACA,YAAM,cAAc,IAAI;AAAA,IAC1B;AACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,yBAAyB,KAAK;AAC5C,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,kCAAkC,KAAQ,kBAAkB;AACjG,QAAM,kBAAkB;AAAA,IACtB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,QAAQ,IAAI,iCAAiC,IAAI,oBAAoB;AAC9F,QAAM,iBAAiB;AAAA,IACrB,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,IAAI,qBAAqB;AAC9C,QAAM,OAAO,QAAQ,QAAQ,IAAI,mBAAmB,MAAM,cAAc;AACxE,QAAM,iBAAiB,QAAQ,IAAI,8BAC/B,MAAM,GAAG,EACV,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AACjB,QAAM,gBAAgB,MAAM,kBAAkB,mBAAmB;AACjE,QAAM,OAAO,IAAI,GAAG,KAAK;AAAA,IACvB,kBAAkB;AAAA,IAClB,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IAChC,kBAAkB;AAAA,IAClB,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,QAAQ,IAAI,oBAAoB,IAAI;AAC1C,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AACrB,MAAI;AACJ,QAAM,cAAc,YAClB,MAAM,gBAAgB,eAAe,aAAa,KAAK,MAAM,mBAAmB,aAAa;AAC/F,QAAM,cAAc,CAAC,QAAQ,UAA4B;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,qBAAqB,KAAO;AACrD,aAAO,QAAQ,QAAQ,cAAc;AAAA,IACvC;AACA,QAAI,kBAAmB,QAAO;AAC9B,QAAI;AACJ,cAAU,YAAY,EACnB,KAAK,CAAC,UAAU;AACf,uBAAiB;AACjB,2BAAqB,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,sBAAsB,QAAS,qBAAoB;AAAA,IACzD,CAAC;AACH,wBAAoB;AACpB,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,CAAC,MAAM,YAAY,IAAI,GAAG;AAC5B,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAC1D,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA,aAAa,IAAI,2BAA2B,IAAI;AAAA,IAChD,UAAU,IAAI,wBAAwB,IAAI;AAAA,IAC1C,kBAAkB,IAAI,yBAAyB,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,OAAO;AAAA,IACP,mBAAmB;AAAA,EACrB,CAAC;AAED,UAAQ,OAAO,MAAM,MAAM,MAAM;AAC/B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AAED,MAAI,WAAW;AACf,iBAAe,WAA0B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAQ,MAAM,CAAC,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,IAC5D,CAAC;AACD,UAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAAA,EACrD;AAEA,UAAQ,KAAK,UAAU,MAAM,KAAK,SAAS,CAAC;AAC5C,UAAQ,KAAK,WAAW,MAAM,KAAK,SAAS,CAAC;AAC/C;AAEA,KAAK,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3B,UAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AAClF,UAAQ,WAAW;AACrB,CAAC;","names":["databaseUrl"]}

package/dist/gateway.d.ts

@@ -1,4 +1,5 @@
 import 'node:http';
-import './bridge-store-BuGjxTn4.js';
-export { G as GatewayOptions, d as createGateway } from './gateway-BULozv3K.js';
-import './bridge-domain-BcnBeHOn.js';
+import './bridge-store-DPVSCwfs.js';
+export { G as GatewayOptions, c as createGateway } from './gateway-CggQ8vTC.js';
+import './bridge-domain-CBX3IVqC.js';
+import './postgres-bridge-store-Bfd3hRId.js';

package/dist/gateway.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import {
   createGateway
-} from "./chunk-JOUBDRYX.js";
-import "./chunk-CKSKUBDQ.js";
-import "./chunk-BV6W4AJK.js";
+} from "./chunk-WAI2IYIQ.js";
+import "./chunk-4VB44KJU.js";
+import "./chunk-GADH244D.js";
+import "./chunk-BZLMF5O5.js";
 export {
   createGateway
 };

package/dist/index.js

@@ -1,14 +1,17 @@
 #!/usr/bin/env node
 import {
   startServer
-} from "./chunk-4KAOBC5X.js";
-import "./chunk-KVR4JBRF.js";
-import "./chunk-JTC5YURG.js";
-import "./chunk-AXL2I7FH.js";
-import "./chunk-WEULPMUY.js";
-import "./chunk-YD6YJATN.js";
-import "./chunk-CKSKUBDQ.js";
-import "./chunk-BV6W4AJK.js";
+} from "./chunk-SPSMZOCJ.js";
+import "./chunk-2EVLG3YA.js";
+import "./chunk-UAHMP6GC.js";
+import "./chunk-CEXBMOI5.js";
+import "./chunk-Q6PPMXJC.js";
+import "./chunk-5GMB3A77.js";
+import "./chunk-NCO7RLBM.js";
+import "./chunk-VOQIDTCJ.js";
+import "./chunk-4VB44KJU.js";
+import "./chunk-GADH244D.js";
+import "./chunk-BZLMF5O5.js";
 
 // src/index.ts
 startServer().catch((err) => {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { startServer } from \"./server.js\";\n\nstartServer().catch((err) => {\n  console.error(\"Failed to start agent-bridge MCP server:\", err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;AAEA,YAAY,EAAE,MAAM,CAAC,QAAQ;AAC3B,UAAQ,MAAM,4CAA4C,GAAG;AAC7D,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { startServer } from \"./server.js\";\n\nstartServer().catch((err) => {\n  console.error(\"Failed to start agent-bridge MCP server:\", err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;AAEA,YAAY,EAAE,MAAM,CAAC,QAAQ;AAC3B,UAAQ,MAAM,4CAA4C,GAAG;AAC7D,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}

package/dist/postgres-bridge-store-Bfd3hRId.d.ts

@@ -0,0 +1,49 @@
+import { b as BridgeMessage, c as BridgePrincipal, B as BridgeDelivery, R as RetryPolicy, a as BridgeDeliveryEvent, A as AgentPresence } from './bridge-domain-CBX3IVqC.js';
+import { a as BridgeStore, I as InsertMessageResult, d as MessageQuery, M as MessagePage, C as ClaimOptions, c as DeliveryQuery, B as BridgeDiagnostics } from './bridge-store-DPVSCwfs.js';
+
+interface PgQueryable {
+    query<T extends Record<string, unknown> = Record<string, unknown>>(sql: string, values?: unknown[]): Promise<{
+        rows: T[];
+        rowCount: number | null;
+    }>;
+    connect?(): Promise<PgTransactionClient>;
+    release?(): void;
+    /** True when the queryable is already owned by an explicit request transaction. */
+    inTransaction?: boolean;
+}
+interface PgTransactionClient {
+    query<T extends Record<string, unknown> = Record<string, unknown>>(sql: string, values?: unknown[]): Promise<{
+        rows: T[];
+        rowCount: number | null;
+    }>;
+    release(error?: Error | boolean): void;
+}
+declare class PostgresBridgeStore implements BridgeStore {
+    private readonly db;
+    constructor(db: PgQueryable);
+    initialize(): Promise<void>;
+    insertMessage(input: Omit<BridgeMessage, "sequence" | "createdAt">): Promise<InsertMessageResult>;
+    listMessages(principal: BridgePrincipal, query?: MessageQuery): Promise<MessagePage>;
+    recordReceipt(principal: BridgePrincipal, ids: string[], readAt?: Date): Promise<number>;
+    claimDelivery(principal: BridgePrincipal, options: ClaimOptions): Promise<BridgeDelivery | null>;
+    renewDelivery(principal: BridgePrincipal, id: string, token: string, leaseMs: number): Promise<BridgeDelivery | null>;
+    settleDelivery(principal: BridgePrincipal, id: string, token: string, state: "acked" | "retrying" | "dead", error?: string, _retryPolicy?: RetryPolicy): Promise<BridgeDelivery | null>;
+    listDeliveries(principal: BridgePrincipal, query?: DeliveryQuery): Promise<{
+        deliveries: BridgeDelivery[];
+        cursor: string | undefined;
+    }>;
+    listDeliveryEvents(principal: BridgePrincipal, id: string, query?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        events: BridgeDeliveryEvent[];
+        cursor: string | undefined;
+    }>;
+    cancelDelivery(principal: BridgePrincipal, id: string): Promise<BridgeDelivery | null>;
+    requeueDelivery(principal: BridgePrincipal, id: string): Promise<BridgeDelivery | null>;
+    diagnostics(principal: BridgePrincipal): Promise<BridgeDiagnostics>;
+    heartbeat(principal: BridgePrincipal, leaseMs: number, runtimeType?: string, capabilities?: string[]): Promise<AgentPresence>;
+    listPresence(principal: BridgePrincipal): Promise<AgentPresence[]>;
+}
+
+export { type PgQueryable as P, type PgTransactionClient as a, PostgresBridgeStore as b };

package/dist/server.d.ts

@@ -1,6 +1,6 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { ClientProvider } from './client-config.js';
-import './bridge-domain-BcnBeHOn.js';
+import './bridge-domain-CBX3IVqC.js';
 
 interface AgentBridgeServerConfig {
     supabaseUrl?: string;
@@ -15,6 +15,7 @@ interface AgentBridgeServerConfig {
     gatewayUrl?: string;
     gatewayToken?: string;
 }
+declare const MCP_IMPLEMENTATION_VERSION = "2.0.0";
 interface AgentBridgeServerEnv {
     AGENT_BRIDGE_URL?: string;
     AGENT_BRIDGE_KEY?: string;
@@ -31,4 +32,4 @@ declare function configFromEnv(env?: AgentBridgeServerEnv): AgentBridgeServerCon
 declare function createAgentBridgeServer(config: AgentBridgeServerConfig): Server;
 declare function startServer(config?: AgentBridgeServerConfig): Promise<void>;
 
-export { type AgentBridgeServerConfig, type AgentBridgeServerEnv, configFromEnv, createAgentBridgeServer, startServer };
+export { type AgentBridgeServerConfig, type AgentBridgeServerEnv, MCP_IMPLEMENTATION_VERSION, configFromEnv, createAgentBridgeServer, startServer };

package/dist/server.js

@@ -1,17 +1,22 @@
 #!/usr/bin/env node
 import {
+  MCP_IMPLEMENTATION_VERSION,
   configFromEnv,
   createAgentBridgeServer,
   startServer
-} from "./chunk-4KAOBC5X.js";
-import "./chunk-KVR4JBRF.js";
-import "./chunk-JTC5YURG.js";
-import "./chunk-AXL2I7FH.js";
-import "./chunk-WEULPMUY.js";
-import "./chunk-YD6YJATN.js";
-import "./chunk-CKSKUBDQ.js";
-import "./chunk-BV6W4AJK.js";
+} from "./chunk-SPSMZOCJ.js";
+import "./chunk-2EVLG3YA.js";
+import "./chunk-UAHMP6GC.js";
+import "./chunk-CEXBMOI5.js";
+import "./chunk-Q6PPMXJC.js";
+import "./chunk-5GMB3A77.js";
+import "./chunk-NCO7RLBM.js";
+import "./chunk-VOQIDTCJ.js";
+import "./chunk-4VB44KJU.js";
+import "./chunk-GADH244D.js";
+import "./chunk-BZLMF5O5.js";
 export {
+  MCP_IMPLEMENTATION_VERSION,
   configFromEnv,
   createAgentBridgeServer,
   startServer