@creatornader/agent-bridge 0.2.0 → 0.3.1

package/dist/cli.js

@@ -1,82 +1,997 @@
 #!/usr/bin/env node
 import {
-  runMigrations
-} from "./chunk-6MAZ6YLZ.js";
+  PortableArchiveError,
+  PortableArchiveFile,
+  PostgresPortableArchiveStore,
+  SQLitePortableArchiveStore,
+  streamPortableArchive,
+  validatePortableArchiveRequestId
+} from "./chunk-A6W4QALF.js";
 import {
   readClientConfigFile,
   resolveClientConfig
-} from "./chunk-KVR4JBRF.js";
+} from "./chunk-2EVLG3YA.js";
 import {
   createClientRuntime
-} from "./chunk-JTC5YURG.js";
+} from "./chunk-UAHMP6GC.js";
 import {
   BridgeHttpError,
   LegacySupabaseError,
   legacyContextMetadata,
   legacyNumericMessageId
-} from "./chunk-AXL2I7FH.js";
-import "./chunk-WEULPMUY.js";
-import "./chunk-YD6YJATN.js";
-import "./chunk-CKSKUBDQ.js";
-import "./chunk-BV6W4AJK.js";
+} from "./chunk-CEXBMOI5.js";
+import "./chunk-Q6PPMXJC.js";
+import {
+  NativeDrBundleError,
+  NativeDrBundleReader,
+  NativeDrCommandError,
+  PostgresNativeDrError,
+  backupLocalSqlite,
+  backupPostgresNativeDr,
+  restoreLocalSqlite,
+  restorePostgresNativeDr,
+  validateNativeDrId,
+  validateNativeDrTimeout,
+  verifyNativeDrBundle,
+  verifyPostgresNativeDrArtifacts,
+  writeNativeDrBundle
+} from "./chunk-MBPZXTJA.js";
+import "./chunk-5GMB3A77.js";
+import {
+  PrivatePathError,
+  preparePrivateFileLocation,
+  securePrivatePath,
+  verifyPrivatePathAccess
+} from "./chunk-NCO7RLBM.js";
+import {
+  loadMigrationPlan,
+  runMigrations
+} from "./chunk-45BZGB77.js";
+import "./chunk-VOQIDTCJ.js";
+import "./chunk-4VB44KJU.js";
+import {
+  capabilityDocument,
+  operationForCli,
+  parseCliResponse,
+  validateRequest
+} from "./chunk-GADH244D.js";
+import "./chunk-BZLMF5O5.js";
 
 // src/cli.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import { homedir as homedir2, tmpdir } from "os";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
+import { createHash as createHash4 } from "crypto";
+import { basename, dirname as dirname5, join as join5 } from "path";
+import { homedir as homedir4, tmpdir } from "os";
 import { mkdtempSync } from "fs";
-import { fileURLToPath, pathToFileURL } from "url";
-import pg from "pg";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
+import pg3 from "pg";
+
+// src/legacy-project-reconciliation.ts
+var lock = `LOCK TABLE public.shared_context IN SHARE MODE;
+  LOCK TABLE agent_bridge.messages IN ACCESS EXCLUSIVE MODE;
+  LOCK TABLE agent_bridge.receipts IN SHARE ROW EXCLUSIVE MODE;
+  LOCK TABLE agent_bridge.deliveries IN SHARE MODE`;
+function preflight(migrationChecksum) {
+  return `DO $reconcile$ BEGIN
+  IF to_regclass('public.shared_context') IS NULL THEN
+    RAISE EXCEPTION 'public.shared_context does not exist';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM agent_bridge.schema_migrations
+    WHERE version=8
+      AND name='message_projects'
+      AND checksum='${migrationChecksum}'
+  ) THEN
+    RAISE EXCEPTION 'migration 008_message_projects does not match the expected migration plan';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema='agent_bridge'
+      AND table_name='messages'
+      AND column_name='project'
+      AND data_type='text'
+  ) THEN
+    RAISE EXCEPTION 'agent_bridge.messages.project is missing or has the wrong type';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conrelid='agent_bridge.messages'::regclass
+      AND conname='messages_project_label'
+      AND contype='c'
+      AND convalidated
+  ) THEN
+    RAISE EXCEPTION 'messages_project_label constraint is missing or invalid';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_index index_state
+    JOIN pg_class index_class ON index_class.oid=index_state.indexrelid
+    WHERE index_state.indrelid='agent_bridge.messages'::regclass
+      AND index_class.relname='messages_project'
+      AND index_state.indisvalid
+      AND index_state.indisready
+  ) THEN
+    RAISE EXCEPTION 'messages_project index is missing or invalid';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM agent_bridge.workspaces WHERE id='agent-bridge'
+  ) THEN
+    RAISE EXCEPTION 'canonical workspace agent-bridge must be provisioned before reconciliation';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM public.shared_context
+    WHERE project IS NOT NULL
+      AND (project<>btrim(project) OR char_length(project) NOT BETWEEN 1 AND 128)
+  ) THEN
+    RAISE EXCEPTION 'legacy shared_context contains invalid project labels';
+  END IF;
+  IF EXISTS (
+    SELECT agent_bridge.legacy_message_uuid(id, metadata)
+    FROM public.shared_context GROUP BY 1 HAVING count(*)>1
+  ) THEN
+    RAISE EXCEPTION 'legacy shared_context contains duplicate message IDs';
+  END IF;
+  IF (
+    SELECT count(*) FROM public.shared_context context
+    JOIN agent_bridge.messages message
+      ON message.id=agent_bridge.legacy_message_uuid(context.id, context.metadata)
+  ) <> (SELECT count(*) FROM public.shared_context) THEN
+    RAISE EXCEPTION 'legacy shared_context and v2 message counts do not match';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM public.shared_context context
+    JOIN agent_bridge.messages message
+      ON message.id=agent_bridge.legacy_message_uuid(context.id, context.metadata)
+    WHERE NOT (
+      (message.workspace=coalesce(context.project,'legacy') AND message.project IS NULL)
+      OR (message.workspace='agent-bridge' AND message.project IS NOT DISTINCT FROM context.project)
+    )
+  ) THEN
+    RAISE EXCEPTION 'legacy message has a conflicting workspace or project';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM public.shared_context context
+    JOIN agent_bridge.messages message
+      ON message.id=agent_bridge.legacy_message_uuid(context.id, context.metadata)
+    WHERE message.source IS DISTINCT FROM context.source
+       OR message.type IS DISTINCT FROM coalesce(
+         context.metadata #>> '{message_envelope,kind}', context.category
+       )
+       OR message.content IS DISTINCT FROM context.content
+       OR message.content_type IS DISTINCT FROM coalesce(
+         context.metadata #>> '{message_envelope,payload_mime}', 'text/plain'
+       )
+       OR message.data IS DISTINCT FROM context.metadata #> '{message_envelope,payload}'
+       OR message.targets IS DISTINCT FROM CASE
+         WHEN jsonb_typeof(context.metadata #> '{message_envelope,target_agents}')='array'
+           THEN context.metadata #> '{message_envelope,target_agents}'
+         ELSE '[]'::jsonb
+       END
+       OR message.thread_id IS DISTINCT FROM context.metadata #>> '{message_envelope,thread_id}'
+       OR message.reply_to_id IS DISTINCT FROM context.metadata #>> '{message_envelope,reply_to_id}'
+       OR message.correlation_id IS DISTINCT FROM context.metadata #>> '{message_envelope,correlation_id}'
+       OR message.causation_id IS DISTINCT FROM context.metadata #>> '{message_envelope,causation_id}'
+       OR message.priority IS DISTINCT FROM CASE
+         WHEN context.priority IN ('info','high','urgent') THEN context.priority ELSE 'info'
+       END
+       OR message.expires_at IS DISTINCT FROM agent_bridge.safe_timestamptz(
+         context.metadata #>> '{message_envelope,expires_at}'
+       )
+       OR message.idempotency_key IS DISTINCT FROM context.metadata #>> '{message_envelope,idempotency_key}'
+       OR message.atrib_receipt_id IS DISTINCT FROM coalesce(
+         context.atrib_receipt_id,
+         context.metadata #>> '{message_envelope,atrib_receipt_id}'
+       )
+       OR message.informed_by IS DISTINCT FROM context.metadata #> '{message_envelope,informed_by}'
+       OR message.metadata IS DISTINCT FROM context.metadata
+       OR message.created_at IS DISTINCT FROM context.created_at
+  ) THEN
+    RAISE EXCEPTION 'legacy message content differs from migration 006 import';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM public.shared_context context
+    JOIN agent_bridge.messages message
+      ON message.id=agent_bridge.legacy_message_uuid(context.id, context.metadata)
+    JOIN agent_bridge.deliveries delivery
+      ON delivery.workspace=message.workspace AND delivery.message_id=message.id
+  ) THEN
+    RAISE EXCEPTION 'legacy messages with deliveries cannot be reconciled';
+  END IF;
+  IF EXISTS (
+    WITH candidates AS (
+      SELECT message.id, message.source, message.idempotency_key
+      FROM public.shared_context context
+      JOIN agent_bridge.messages message
+        ON message.id=agent_bridge.legacy_message_uuid(context.id, context.metadata)
+      WHERE message.idempotency_key IS NOT NULL
+    ), canonical AS (
+      SELECT candidate.id, candidate.source, candidate.idempotency_key FROM candidates candidate
+      UNION ALL
+      SELECT existing.id, existing.source, existing.idempotency_key
+      FROM agent_bridge.messages existing
+      WHERE existing.workspace='agent-bridge'
+        AND existing.idempotency_key IS NOT NULL
+        AND NOT EXISTS (SELECT 1 FROM candidates candidate WHERE candidate.id=existing.id)
+    )
+    SELECT source, idempotency_key FROM canonical
+    GROUP BY source, idempotency_key HAVING count(*)>1
+  ) THEN
+    RAISE EXCEPTION 'legacy idempotency key collides in canonical workspace';
+  END IF;
+END $reconcile$`;
+}
+var counts = `SELECT
+  count(*)::int AS messages,
+  count(*) FILTER (
+    WHERE message.workspace<>'agent-bridge'
+      OR message.project IS DISTINCT FROM context.project
+  )::int AS changed,
+  coalesce(sum((
+    SELECT count(*) FROM agent_bridge.receipts receipt
+    WHERE receipt.workspace=message.workspace AND receipt.message_id=message.id
+  )),0)::int AS receipts
+FROM public.shared_context context
+JOIN agent_bridge.messages message
+  ON message.id=agent_bridge.legacy_message_uuid(context.id, context.metadata)`;
+function report(mode, row) {
+  return {
+    mode,
+    workspace: "agent-bridge",
+    messages: Number(row?.messages ?? 0),
+    receipts: Number(row?.receipts ?? 0),
+    deliveries: 0,
+    changed: Number(row?.changed ?? 0)
+  };
+}
+async function reconcileLegacyProjects(db, options) {
+  if (!/^[0-9a-f]{64}$/.test(options.migrationChecksum)) {
+    throw new Error("migrationChecksum must be 64 lowercase hexadecimal characters");
+  }
+  const apply = options.apply === true;
+  const verify = preflight(options.migrationChecksum);
+  await db.query("BEGIN");
+  try {
+    await db.query("SELECT pg_advisory_xact_lock(1646705660)");
+    await db.query(verify);
+    if (apply) {
+      await db.query(lock);
+      await db.query(verify);
+    }
+    const before = await db.query(counts);
+    const summary = report(apply ? "apply" : "dry-run", before.rows[0]);
+    if (!apply) {
+      await db.query("ROLLBACK");
+      return summary;
+    }
+    const totals = await db.query(
+      `SELECT
+         (SELECT count(*)::int FROM agent_bridge.messages) AS messages,
+         (SELECT count(*)::int FROM agent_bridge.receipts) AS receipts`
+    );
+    await db.query(`CREATE TEMP TABLE reconcile_receipts ON COMMIT DROP AS
+      SELECT receipt.* FROM agent_bridge.receipts receipt
+      JOIN public.shared_context context
+        ON receipt.message_id=agent_bridge.legacy_message_uuid(context.id,context.metadata)
+       AND receipt.workspace=coalesce(context.project,'legacy')`);
+    await db.query(`DELETE FROM agent_bridge.receipts receipt
+      USING reconcile_receipts saved
+      WHERE receipt.workspace=saved.workspace
+        AND receipt.message_id=saved.message_id
+        AND receipt.principal=saved.principal`);
+    await db.query("ALTER TABLE agent_bridge.messages DISABLE TRIGGER messages_immutable");
+    await db.query(`UPDATE agent_bridge.messages message
+      SET workspace='agent-bridge', project=context.project
+      FROM public.shared_context context
+      WHERE message.id=agent_bridge.legacy_message_uuid(context.id,context.metadata)
+        AND (message.workspace<>'agent-bridge' OR message.project IS DISTINCT FROM context.project)`);
+    await db.query("ALTER TABLE agent_bridge.messages ENABLE TRIGGER messages_immutable");
+    await db.query(`INSERT INTO agent_bridge.receipts (workspace,message_id,principal,read_at)
+      SELECT 'agent-bridge',message_id,principal,read_at FROM reconcile_receipts`);
+    const verified = await db.query(`SELECT
+      (SELECT count(*)::int FROM agent_bridge.messages) AS messages,
+      (SELECT count(*)::int FROM agent_bridge.receipts) AS receipts,
+      (SELECT count(*)::int FROM public.shared_context context
+       JOIN agent_bridge.messages message
+         ON message.id=agent_bridge.legacy_message_uuid(context.id,context.metadata)
+       WHERE message.workspace<>'agent-bridge'
+          OR message.project IS DISTINCT FROM context.project) AS mismatches,
+      (SELECT count(*)::int FROM public.shared_context context
+       JOIN agent_bridge.deliveries delivery
+         ON delivery.message_id=agent_bridge.legacy_message_uuid(context.id,context.metadata)) AS deliveries`);
+    const expected = totals.rows[0];
+    const actual = verified.rows[0];
+    if (!expected || !actual || Number(actual.messages) !== Number(expected.messages) || Number(actual.receipts) !== Number(expected.receipts) || Number(actual.mismatches) !== 0 || Number(actual.deliveries) !== 0) {
+      throw new Error("legacy project reconciliation verification failed");
+    }
+    await db.query("COMMIT");
+    return summary;
+  } catch (error) {
+    await db.query("ROLLBACK").catch(() => void 0);
+    throw error;
+  }
+}
 
 // src/client-installer.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
-import { createHash, randomUUID } from "crypto";
-import { homedir } from "os";
-import { dirname, join } from "path";
+import {
+  accessSync,
+  closeSync as closeSync2,
+  constants as constants2,
+  existsSync as existsSync2,
+  fsyncSync as fsyncSync2,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { homedir as homedir2 } from "os";
+import { delimiter, dirname as dirname2, extname, isAbsolute, join as join2, resolve as resolve2 } from "path";
 import { spawnSync } from "child_process";
+import { fileURLToPath } from "url";
+
+// src/enrollment-file.ts
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { createHash, randomUUID } from "crypto";
+import { homedir, hostname } from "os";
+import { dirname, join, parse, relative, resolve, sep } from "path";
+var ENROLLMENT_SCHEMA = "agent-bridge.enrollment";
+var ENROLLMENT_VERSION = 1;
+function object(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(label + " must be an object");
+  }
+  return value;
+}
+function text(value, label, maximum = 128) {
+  if (typeof value !== "string" || !value || value !== value.trim() || value.length > maximum || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(label + " is invalid");
+  }
+  return value;
+}
+function nullableText(value, label) {
+  return value === null ? null : text(value, label);
+}
+var RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?(Z|([+-])(\d{2}):(\d{2}))$/;
+function canonicalTimestamp(value, label) {
+  if (value === null) return null;
+  const selected = text(value, label, 64);
+  const match = RFC3339.exec(selected);
+  if (!match) throw new Error(label + " must be RFC3339 with a timezone");
+  const [
+    ,
+    yearText,
+    monthText,
+    dayText,
+    hourText,
+    minuteText,
+    secondText,
+    fraction = "",
+    zone,
+    sign,
+    offsetHourText = "0",
+    offsetMinuteText = "0"
+  ] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const millisecond = Number(fraction.padEnd(3, "0"));
+  const offsetHour = Number(offsetHourText);
+  const offsetMinute = Number(offsetMinuteText);
+  if (hour > 23 || minute > 59 || second > 59 || offsetHour > 23 || offsetMinute > 59) {
+    throw new Error(label + " is invalid");
+  }
+  const wall = /* @__PURE__ */ new Date(0);
+  wall.setUTCFullYear(year, month - 1, day);
+  wall.setUTCHours(hour, minute, second, millisecond);
+  if (wall.getUTCFullYear() !== year || wall.getUTCMonth() !== month - 1 || wall.getUTCDate() !== day || wall.getUTCHours() !== hour || wall.getUTCMinutes() !== minute || wall.getUTCSeconds() !== second || wall.getUTCMilliseconds() !== millisecond) {
+    throw new Error(label + " is invalid");
+  }
+  const direction = zone === "Z" ? 0 : sign === "+" ? 1 : -1;
+  const instant2 = new Date(wall.getTime() - direction * (offsetHour * 60 + offsetMinute) * 6e4);
+  if (!Number.isFinite(instant2.getTime())) throw new Error(label + " is invalid");
+  return instant2.toISOString();
+}
+function canonicalGatewayUrl(value, label) {
+  const selected = text(value, label, 2048);
+  let parsed;
+  try {
+    parsed = new URL(selected);
+  } catch {
+    throw new Error(label + " is invalid");
+  }
+  if (parsed.username || parsed.password) throw new Error(label + " cannot contain credentials");
+  if (parsed.hash) throw new Error(label + " cannot contain a fragment");
+  const loopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback)) {
+    throw new Error(label + " must use HTTPS, or HTTP on an explicit loopback host");
+  }
+  return parsed.toString();
+}
+function uuid(value, label) {
+  const selected = text(value, label, 36);
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(selected)) {
+    throw new Error(label + " is invalid");
+  }
+  return selected;
+}
+function runtime(value) {
+  if (value !== "codex" && value !== "claude-code" && value !== "claude-desktop") {
+    throw new Error("enrollment runtime is invalid");
+  }
+  return value;
+}
+function validateInput(value, operation) {
+  const input = object(value, "enrollment input");
+  const gatewayUrl = canonicalGatewayUrl(input.gatewayUrl, "enrollment gatewayUrl");
+  const credentialId = input.credentialId === null ? null : uuid(input.credentialId, "enrollment credentialId");
+  const workspaceName = nullableText(input.workspaceName, "enrollment workspaceName");
+  const graceUntil = canonicalTimestamp(input.graceUntil, "enrollment graceUntil");
+  const invalidateImmediately = input.invalidateImmediately;
+  if (typeof invalidateImmediately !== "boolean") throw new Error("enrollment invalidateImmediately is invalid");
+  if (operation === "provision" && (credentialId !== null || workspaceName === null || graceUntil !== null || invalidateImmediately)) {
+    throw new Error("provision enrollment input is invalid");
+  }
+  if (operation === "rotate" && (credentialId === null || workspaceName !== null || graceUntil === null === !invalidateImmediately)) {
+    throw new Error("rotation must choose graceUntil or invalidateImmediately");
+  }
+  return {
+    gatewayUrl,
+    workspaceId: text(input.workspaceId, "enrollment workspaceId"),
+    principal: text(input.principal, "enrollment principal"),
+    runtime: runtime(input.runtime),
+    instance: text(input.instance, "enrollment instance"),
+    credentialId,
+    workspaceName,
+    displayName: nullableText(input.displayName, "enrollment displayName"),
+    runtimeType: text(input.runtimeType, "enrollment runtimeType"),
+    label: nullableText(input.label, "enrollment label"),
+    scopeSetName: text(input.scopeSetName, "enrollment scopeSetName"),
+    expiresAt: canonicalTimestamp(input.expiresAt, "enrollment expiresAt"),
+    graceUntil,
+    invalidateImmediately
+  };
+}
+function validateResult(value, input) {
+  if (value === null) return null;
+  const result = object(value, "enrollment result");
+  if (typeof result.replayed !== "boolean") throw new Error("enrollment result replayed is invalid");
+  const validated = {
+    workspaceId: text(result.workspaceId, "enrollment result workspaceId"),
+    principal: text(result.principal, "enrollment result principal"),
+    agentId: result.agentId === null ? null : uuid(result.agentId, "enrollment result agentId"),
+    credentialId: uuid(result.credentialId, "enrollment result credentialId"),
+    replayed: result.replayed
+  };
+  if (validated.workspaceId !== input.workspaceId || validated.principal !== input.principal) {
+    throw new Error("enrollment result does not match its workspace and principal");
+  }
+  return validated;
+}
+function enrollmentTokenHash(enrollment2) {
+  if (!enrollment2.token) throw new Error("enrollment no longer contains a credential");
+  return createHash("sha256").update(enrollment2.token, "utf8").digest("hex");
+}
+function validateEnrollmentFile(value) {
+  const file = object(value, "enrollment file");
+  if (file.schema !== ENROLLMENT_SCHEMA || file.version !== ENROLLMENT_VERSION) {
+    throw new Error("unsupported enrollment schema or version");
+  }
+  if (file.provider !== "gateway") throw new Error("enrollment provider must be gateway");
+  if (!["pending", "ready", "consuming", "consumed"].includes(String(file.state))) {
+    throw new Error("enrollment state is invalid");
+  }
+  if (file.operation !== "provision" && file.operation !== "rotate") {
+    throw new Error("enrollment operation is invalid");
+  }
+  const state = file.state;
+  if (!Number.isSafeInteger(file.revision) || Number(file.revision) < 0) {
+    throw new Error("enrollment revision is invalid");
+  }
+  const input = validateInput(file.input, file.operation);
+  const token = file.token === null ? null : text(file.token, "enrollment token", 4096);
+  const result = validateResult(file.result, input);
+  const completedAt = canonicalTimestamp(file.completedAt, "enrollment completedAt");
+  if (state === "pending" && (result !== null || completedAt !== null || token === null)) {
+    throw new Error("pending enrollment state is invalid");
+  }
+  if ((state === "ready" || state === "consuming") && (result === null || completedAt === null || token === null)) {
+    throw new Error(state + " enrollment state is invalid");
+  }
+  if (state === "consumed" && (result === null || completedAt === null || token !== null)) {
+    throw new Error("consumed enrollment state is invalid");
+  }
+  return {
+    schema: ENROLLMENT_SCHEMA,
+    version: ENROLLMENT_VERSION,
+    provider: "gateway",
+    revision: Number(file.revision),
+    state,
+    operation: file.operation,
+    requestId: uuid(file.requestId, "enrollment requestId"),
+    createdAt: (() => {
+      const createdAt = canonicalTimestamp(file.createdAt, "enrollment createdAt");
+      if (createdAt === null) throw new Error("enrollment createdAt is invalid");
+      return createdAt;
+    })(),
+    completedAt,
+    input,
+    token,
+    result
+  };
+}
+function syncDirectory(path) {
+  if (process.platform === "win32") return;
+  const descriptor = openSync(path, "r");
+  try {
+    fsyncSync(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+var durabilityDefaults = { syncDirectory };
+function prepareDirectory(path) {
+  mkdirSync(path, { recursive: true, mode: 448 });
+  securePrivatePath(path, "directory");
+}
+function enrollmentRoot(env = process.env) {
+  if (env.AGENT_BRIDGE_ENROLLMENT_DIR) return resolve(env.AGENT_BRIDGE_ENROLLMENT_DIR);
+  const home2 = realpathSync(env.HOME ?? homedir());
+  return join(home2, ".agent-bridge", "enrollments");
+}
+function rejectSymlinkComponents(path) {
+  const root = parse(path).root;
+  let current = root;
+  for (const component of path.slice(root.length).split(sep).filter(Boolean)) {
+    current = join(current, component);
+    if (!existsSync(current)) break;
+    if (lstatSync(current).isSymbolicLink()) {
+      throw new Error("enrollment paths cannot contain symbolic links");
+    }
+  }
+}
+function verifyPrivateDirectory(path) {
+  rejectSymlinkComponents(path);
+  const details = lstatSync(path);
+  if (!details.isDirectory() || details.isSymbolicLink()) {
+    throw new Error("enrollment directory must be a real directory");
+  }
+  verifyPrivatePathAccess(path, "directory");
+  return { device: details.dev, inode: details.ino };
+}
+function sameDirectory(path, expected) {
+  const actual = verifyPrivateDirectory(path);
+  if (actual.device !== expected.device || actual.inode !== expected.inode) {
+    throw new Error("enrollment directory changed during the operation");
+  }
+}
+function verifyPrivatePath(root, directory) {
+  verifyPrivateDirectory(root);
+  const inside = relative(root, directory);
+  if (!inside) return;
+  let current = root;
+  for (const component of inside.split(sep).filter(Boolean)) {
+    current = join(current, component);
+    verifyPrivateDirectory(current);
+  }
+}
+function prepareEnrollmentRoot(env) {
+  const root = enrollmentRoot(env);
+  rejectSymlinkComponents(dirname(root));
+  prepareDirectory(root);
+  verifyPrivateDirectory(root);
+  return root;
+}
+function assertEnrollmentPath(path, env = process.env) {
+  const root = enrollmentRoot(env);
+  const selected = resolve(path);
+  const inside = relative(root, selected);
+  if (!inside || inside.startsWith(".." + sep) || inside === ".." || inside.includes(sep + ".." + sep)) {
+    throw new Error("enrollment file must be inside the configured enrollment directory");
+  }
+  rejectSymlinkComponents(root);
+  rejectSymlinkComponents(dirname(selected));
+  if (existsSync(root) && existsSync(dirname(selected))) {
+    verifyPrivatePath(root, dirname(selected));
+  }
+  return selected;
+}
+function serialized(value) {
+  return JSON.stringify(validateEnrollmentFile(value), null, 2) + "\n";
+}
+function defaultEnrollmentPath(requestId2, env = process.env) {
+  return join(enrollmentRoot(env), requestId2 + ".json");
+}
+function createPendingEnrollment(path, enrollment2, env = process.env) {
+  if (enrollment2.state !== "pending") throw new Error("new enrollment must be pending");
+  if (enrollment2.revision !== 0) throw new Error("new enrollment revision must be zero");
+  path = assertEnrollmentPath(path, env);
+  prepareEnrollmentRoot(env);
+  path = assertEnrollmentPath(path, env);
+  const directory = dirname(path);
+  prepareDirectory(directory);
+  verifyPrivatePath(enrollmentRoot(env), directory);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  const descriptor = openSync(path, "wx", 384);
+  try {
+    writeFileSync(descriptor, serialized(enrollment2), "utf8");
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    securePrivatePath(path, "file");
+    sameDirectory(directory, directoryIdentity);
+    syncDirectory(directory);
+  } catch (error) {
+    try {
+      closeSync(descriptor);
+    } catch {
+    }
+    rmSync(path, { force: true });
+    throw error;
+  }
+}
+function readEnrollmentUnlocked(path, env) {
+  path = assertEnrollmentPath(path, env);
+  const directory = dirname(path);
+  verifyPrivatePath(enrollmentRoot(env), directory);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  verifyPrivatePathAccess(path, "file");
+  const descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const details = fstatSync(descriptor);
+    if (!details.isFile()) throw new Error("enrollment path must be a regular file, not a symbolic link");
+    if (process.platform !== "win32") {
+      if ((details.mode & 63) !== 0) throw new Error("enrollment file permissions must be 0600");
+      if (typeof process.getuid === "function" && details.uid !== process.getuid()) {
+        throw new Error("enrollment file must be owned by the current user");
+      }
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync(descriptor, "utf8"));
+    } catch {
+      throw new Error("enrollment file is not valid JSON");
+    }
+    sameDirectory(directory, directoryIdentity);
+    return validateEnrollmentFile(parsed);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+function readEnrollment(path, env = process.env) {
+  return readEnrollmentUnlocked(path, env);
+}
+function assertActiveLock(lock2, enrollmentPath) {
+  if (lock2.released || lock2.enrollmentPath !== enrollmentPath) {
+    throw new Error("enrollment lock does not cover this file");
+  }
+  const open = fstatSync(lock2.descriptor);
+  const current = lstatSync(lock2.lockPath);
+  if (open.dev !== lock2.device || open.ino !== lock2.inode || current.dev !== lock2.device || current.ino !== lock2.inode || current.isSymbolicLink()) {
+    throw new Error("enrollment lock changed during the operation");
+  }
+}
+function acquireEnrollmentLock(path, env = process.env) {
+  prepareEnrollmentRoot(env);
+  path = assertEnrollmentPath(path, env);
+  const directory = dirname(path);
+  prepareDirectory(directory);
+  verifyPrivatePath(enrollmentRoot(env), directory);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  const lockPath = path + ".lock";
+  const descriptor = openSync(lockPath, "wx", 384);
+  const nonce = randomUUID();
+  try {
+    writeFileSync(descriptor, JSON.stringify({
+      schema: "agent-bridge.enrollment-lock",
+      version: 1,
+      enrollmentPath: path,
+      pid: process.pid,
+      host: hostname(),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      nonce
+    }) + "\n", "utf8");
+    fsyncSync(descriptor);
+    securePrivatePath(lockPath, "file");
+    sameDirectory(directory, directoryIdentity);
+    syncDirectory(directory);
+    const details = fstatSync(descriptor);
+    return {
+      enrollmentPath: path,
+      lockPath,
+      descriptor,
+      device: details.dev,
+      inode: details.ino,
+      nonce,
+      released: false
+    };
+  } catch (error) {
+    try {
+      closeSync(descriptor);
+    } catch {
+    }
+    rmSync(lockPath, { force: true });
+    throw error;
+  }
+}
+function releaseEnrollmentLock(lock2, dependencies = durabilityDefaults) {
+  assertActiveLock(lock2, lock2.enrollmentPath);
+  const directory = dirname(lock2.lockPath);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  closeSync(lock2.descriptor);
+  const current = lstatSync(lock2.lockPath);
+  if (current.dev !== lock2.device || current.ino !== lock2.inode) {
+    throw new Error("enrollment lock changed before release");
+  }
+  rmSync(lock2.lockPath);
+  lock2.released = true;
+  try {
+    sameDirectory(directory, directoryIdentity);
+    dependencies.syncDirectory(directory);
+  } catch {
+    return "durability-unknown";
+  }
+  return "released";
+}
+function recoverEnrollmentLock(path, env = process.env, now = Date.now()) {
+  path = assertEnrollmentPath(path, env);
+  const lockPath = path + ".lock";
+  verifyPrivatePathAccess(lockPath, "file");
+  const descriptor = openSync(lockPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const details = fstatSync(descriptor);
+    if (!details.isFile()) throw new Error("enrollment lock is not a regular file");
+    if (process.platform !== "win32") {
+      if ((details.mode & 63) !== 0) throw new Error("enrollment lock permissions must be 0600");
+      if (typeof process.getuid === "function" && details.uid !== process.getuid()) {
+        throw new Error("enrollment lock must be owned by the current user");
+      }
+    }
+    let metadata;
+    try {
+      metadata = object(JSON.parse(readFileSync(descriptor, "utf8")), "enrollment lock");
+    } catch {
+      throw new Error("enrollment lock metadata is invalid");
+    }
+    if (metadata.schema !== "agent-bridge.enrollment-lock" || metadata.version !== 1 || metadata.enrollmentPath !== path || metadata.host !== hostname() || typeof metadata.pid !== "number" || !Number.isSafeInteger(metadata.pid) || typeof metadata.createdAt !== "string" || !RFC3339.test(metadata.createdAt)) {
+      throw new Error("enrollment lock metadata is invalid");
+    }
+    const age = now - new Date(metadata.createdAt).getTime();
+    if (age < 6e4) throw new Error("enrollment lock is too recent to recover");
+    try {
+      process.kill(metadata.pid, 0);
+      throw new Error("enrollment lock owner is still running");
+    } catch (error) {
+      if (error instanceof Error && error.message === "enrollment lock owner is still running") throw error;
+      if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ESRCH") {
+        throw new Error("cannot prove that the enrollment lock owner has stopped");
+      }
+    }
+    const current = lstatSync(lockPath);
+    if (current.dev !== details.dev || current.ino !== details.ino) {
+      throw new Error("enrollment lock changed during recovery");
+    }
+  } finally {
+    closeSync(descriptor);
+  }
+  rmSync(lockPath);
+  syncDirectory(dirname(lockPath));
+}
+function deleteEnrollmentFile(path, lock2, env = process.env, dependencies = durabilityDefaults) {
+  path = assertEnrollmentPath(path, env);
+  assertActiveLock(lock2, path);
+  let current;
+  try {
+    current = readEnrollmentUnlocked(path, env);
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return "missing";
+    }
+    throw error;
+  }
+  if (current.state !== "consumed" || current.token !== null) {
+    throw new Error("only a consumed enrollment can be deleted");
+  }
+  const directory = dirname(path);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  try {
+    rmSync(path);
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return "missing";
+    }
+    throw error;
+  }
+  try {
+    sameDirectory(directory, directoryIdentity);
+    dependencies.syncDirectory(directory);
+  } catch {
+    return "deleted-durability-unknown";
+  }
+  return "deleted-and-durable";
+}
+function transitionEnrollment(path, current, state, changes = {}, env = process.env, heldLock) {
+  path = assertEnrollmentPath(path, env);
+  const lock2 = heldLock ?? acquireEnrollmentLock(path, env);
+  try {
+    assertActiveLock(lock2, path);
+    const onDisk = readEnrollmentUnlocked(path, env);
+    if (onDisk.revision !== current.revision || onDisk.state !== current.state || onDisk.requestId !== current.requestId || onDisk.operation !== current.operation || onDisk.token !== current.token) {
+      throw new Error("stale enrollment transition refused");
+    }
+    const transition = current.state + "->" + state;
+    if (!(/* @__PURE__ */ new Set([
+      "pending->ready",
+      "ready->consuming",
+      "consuming->ready",
+      "consuming->consumed"
+    ])).has(transition)) {
+      throw new Error("illegal enrollment state transition: " + transition);
+    }
+    const next = validateEnrollmentFile({
+      ...onDisk,
+      ...changes,
+      state,
+      revision: onDisk.revision + 1
+    });
+    const directory = dirname(path);
+    const directoryIdentity = verifyPrivateDirectory(directory);
+    const temporary = path + "." + process.pid + "." + randomUUID() + ".tmp";
+    const descriptor = openSync(temporary, "wx", 384);
+    try {
+      writeFileSync(descriptor, serialized(next), "utf8");
+      fsyncSync(descriptor);
+      closeSync(descriptor);
+      securePrivatePath(temporary, "file");
+      sameDirectory(directory, directoryIdentity);
+      renameSync(temporary, path);
+      verifyPrivatePathAccess(path, "file");
+      sameDirectory(directory, directoryIdentity);
+      syncDirectory(directory);
+      return next;
+    } catch (error) {
+      try {
+        closeSync(descriptor);
+      } catch {
+      }
+      rmSync(temporary, { force: true });
+      throw error;
+    }
+  } finally {
+    if (!heldLock) releaseEnrollmentLock(lock2);
+  }
+}
+
+// src/client-installer.ts
+function assertExecutable(path) {
+  if (!existsSync2(path)) {
+    throw new Error(`Claude Desktop MCP executable does not exist: ${path}`);
+  }
+  if (!statSync(path).isFile()) {
+    throw new Error(`Claude Desktop MCP executable is not a file: ${path}`);
+  }
+  try {
+    accessSync(path, process.platform === "win32" ? constants2.F_OK : constants2.X_OK);
+  } catch {
+    throw new Error(`Claude Desktop MCP executable is not executable: ${path}`);
+  }
+  return path;
+}
+function resolveExecutable(command, env) {
+  if (isAbsolute(command) || command.includes("/") || command.includes("\\")) {
+    return assertExecutable(resolve2(command));
+  }
+  const searchPath = env.PATH ?? process.env.PATH ?? "";
+  const extensions = process.platform === "win32" && !extname(command) ? (env.PATHEXT ?? process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  for (const directory of searchPath.split(delimiter).filter(Boolean)) {
+    for (const extension of extensions) {
+      const candidate = join2(directory, command + extension);
+      if (!existsSync2(candidate)) continue;
+      return assertExecutable(resolve2(candidate));
+    }
+  }
+  throw new Error(`Claude Desktop MCP executable was not found on PATH: ${command}`);
+}
+function defaultServerEntry() {
+  const moduleDirectory = dirname2(fileURLToPath(import.meta.url));
+  const candidates = [
+    join2(moduleDirectory, "index.js"),
+    join2(moduleDirectory, "..", "dist", "index.js")
+  ];
+  const entry = candidates.find((candidate) => existsSync2(candidate) && statSync(candidate).isFile());
+  if (!entry) {
+    throw new Error(`Claude Desktop MCP server entry does not exist: ${candidates[0]}`);
+  }
+  return resolve2(entry);
+}
+function desktopLaunchContract(requestedCommand, env) {
+  const command = requestedCommand?.trim();
+  if (command) return { command: resolveExecutable(command, env), args: [] };
+  return {
+    command: assertExecutable(resolve2(process.execPath)),
+    args: [defaultServerEntry()]
+  };
+}
 function desktopConfigPath(env) {
   if (process.platform === "win32") {
     const appData = env.APPDATA;
     if (!appData) throw new Error("APPDATA is required for Claude Desktop installation");
-    return join(appData, "Claude", "claude_desktop_config.json");
+    return join2(appData, "Claude", "claude_desktop_config.json");
   }
-  const home = env.HOME ?? homedir();
-  return process.platform === "darwin" ? join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : join(home, ".config", "Claude", "claude_desktop_config.json");
+  const home2 = env.HOME ?? homedir2();
+  return process.platform === "darwin" ? join2(home2, "Library", "Application Support", "Claude", "claude_desktop_config.json") : join2(home2, ".config", "Claude", "claude_desktop_config.json");
 }
 function safeComponent(value) {
   const readable = value.replace(/[^A-Za-z0-9._-]+/g, "_").slice(0, 48) || "client";
-  const suffix = createHash("sha256").update(value).digest("hex").slice(0, 12);
+  const suffix = createHash2("sha256").update(value).digest("hex").slice(0, 12);
   return `${readable}-${suffix}`;
 }
-function clientBackendConfigPath(runtime, instance, env) {
-  const home = env.HOME ?? homedir();
-  return join(
-    home,
+function clientBackendConfigPath(runtime2, instance, env) {
+  const home2 = env.HOME ?? homedir2();
+  return join2(
+    home2,
     ".agent-bridge",
     "clients",
-    `${runtime}-${safeComponent(instance)}.config`
+    `${runtime2}-${safeComponent(instance)}.config`
   );
 }
 function replacePrivateFile(path, content) {
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  if (process.platform !== "win32") chmodSync(dirname(path), 448);
-  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
-  writeFileSync(temporary, content, { mode: 384 });
-  renameSync(temporary, path);
-  if (process.platform !== "win32") chmodSync(path, 384);
-}
-function writeBackendConfig(runtime, identity, instance, options) {
+  const directory = dirname2(path);
+  const privateRoot = dirname2(directory);
+  mkdirSync2(privateRoot, { recursive: true, mode: 448 });
+  securePrivatePath(privateRoot, "directory");
+  mkdirSync2(directory, { recursive: true, mode: 448 });
+  securePrivatePath(directory, "directory");
+  if (existsSync2(path)) verifyPrivatePathAccess(path, "file");
+  const temporary = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  const descriptor = openSync2(temporary, "wx", 384);
+  try {
+    writeFileSync2(descriptor, content);
+    fsyncSync2(descriptor);
+  } finally {
+    closeSync2(descriptor);
+  }
+  securePrivatePath(temporary, "file");
+  renameSync2(temporary, path);
+  verifyPrivatePathAccess(path, "file");
+  if (process.platform !== "win32") {
+    const descriptor2 = openSync2(directory, "r");
+    try {
+      fsyncSync2(descriptor2);
+    } finally {
+      closeSync2(descriptor2);
+    }
+  }
+}
+function writeBackendConfig(runtime2, identity, instance, options) {
   const env = options.env;
-  const home = env.HOME ?? homedir();
-  const sharedPath = env.AGENT_BRIDGE_CONFIG ?? join(home, ".agent-bridge", "config");
+  const home2 = env.HOME ?? homedir2();
+  const sharedPath = env.AGENT_BRIDGE_CONFIG ?? join2(home2, ".agent-bridge", "config");
   const shared = readClientConfigFile(sharedPath);
   const configuredProvider = env.AGENT_BRIDGE_PROVIDER?.trim() || shared.AGENT_BRIDGE_PROVIDER?.trim();
   const inferredGateway = !configuredProvider && Boolean(
     env.AGENT_BRIDGE_TOKEN?.trim() || shared.AGENT_BRIDGE_TOKEN?.trim()
   );
-  const provider = configuredProvider === "legacy" || configuredProvider === "supabase" ? "legacy-supabase" : configuredProvider ?? (inferredGateway ? "gateway" : void 0);
+  const provider3 = configuredProvider === "legacy" || configuredProvider === "supabase" ? "legacy-supabase" : configuredProvider ?? (inferredGateway ? "gateway" : void 0);
   const clientToken = options.token?.trim() || env.AGENT_BRIDGE_CLIENT_TOKEN?.trim();
-  if (provider === "gateway" && !clientToken) {
+  if (provider3 === "gateway" && !clientToken) {
     throw new Error(
       "gateway client installation requires --token or AGENT_BRIDGE_CLIENT_TOKEN"
     );
@@ -94,121 +1009,2213 @@ function writeBackendConfig(runtime, identity, instance, options) {
     AGENT_BRIDGE_TOKEN: resolved.provider === "gateway" ? resolved.credential : void 0,
     AGENT_BRIDGE_KEY: resolved.provider === "legacy-supabase" ? resolved.credential : void 0,
     AGENT_BRIDGE_DB: resolved.provider === "local" ? resolved.databasePath : void 0,
-    AGENT_BRIDGE_EDGE_DB: resolved.provider === "gateway" ? resolved.edgeDatabasePath : void 0
+    AGENT_BRIDGE_EDGE_DB: resolved.provider === "gateway" ? resolved.edgeDatabasePath : void 0,
+    AGENT_BRIDGE_CREDENTIAL_ID: options.binding?.credentialId,
+    AGENT_BRIDGE_PRINCIPAL: options.binding?.principal,
+    AGENT_BRIDGE_CLIENT_INSTANCE: options.binding?.instance
   };
   for (const value of Object.values(values)) {
     if (value?.includes("\n") || value?.includes("\r")) {
       throw new Error("client backend config values cannot contain newlines");
     }
   }
-  const path = clientBackendConfigPath(runtime, instance, env);
-  replacePrivateFile(
-    path,
-    `${Object.entries(values).filter((entry) => Boolean(entry[1])).map(([key, value]) => `${key}=${value}`).join("\n")}
-`
-  );
-  return path;
+  const path = clientBackendConfigPath(runtime2, instance, env);
+  replacePrivateFile(
+    path,
+    `${Object.entries(values).filter((entry) => Boolean(entry[1])).map(([key, value]) => `${key}=${value}`).join("\n")}
+`
+  );
+  return path;
+}
+function writeJsonConfig(path, identity, instance, backendConfigPath, launch) {
+  let config = {};
+  if (existsSync2(path)) {
+    try {
+      const parsed = JSON.parse(readFileSync2(path, "utf8"));
+      if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") throw new Error();
+      config = parsed;
+    } catch {
+      throw new Error(`Claude Desktop config is not valid JSON: ${path}`);
+    }
+  }
+  const currentServers = config.mcpServers;
+  const mcpServers = currentServers && !Array.isArray(currentServers) && typeof currentServers === "object" ? currentServers : {};
+  const next = {
+    ...config,
+    mcpServers: {
+      ...mcpServers,
+      "agent-bridge": {
+        command: launch.command,
+        args: launch.args,
+        env: {
+          AGENT_BRIDGE_AGENT: identity,
+          AGENT_BRIDGE_INSTANCE: instance,
+          AGENT_BRIDGE_CONFIG: backendConfigPath
+        }
+      }
+    }
+  };
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync2(temporary, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+  renameSync2(temporary, path);
+}
+function assertEnrollmentConfiguration(enrollment2, assertions) {
+  const input = enrollment2.input;
+  const env = assertions.env;
+  const home2 = env.HOME ?? homedir2();
+  const shared = readClientConfigFile(
+    env.AGENT_BRIDGE_CONFIG ?? join2(home2, ".agent-bridge", "config")
+  );
+  const conflicts = [
+    ["runtime", assertions.runtime, input.runtime],
+    ["identity", assertions.identity?.trim() || void 0, input.principal],
+    ["instance", assertions.instance?.trim() || void 0, input.instance],
+    ["AGENT_BRIDGE_AGENT", env.AGENT_BRIDGE_AGENT?.trim(), input.principal],
+    ["AGENT_BRIDGE_INSTANCE", env.AGENT_BRIDGE_INSTANCE?.trim(), input.instance],
+    ["AGENT_BRIDGE_URL", env.AGENT_BRIDGE_URL?.trim(), input.gatewayUrl],
+    ["AGENT_BRIDGE_WORKSPACE", env.AGENT_BRIDGE_WORKSPACE?.trim(), input.workspaceId],
+    ["shared AGENT_BRIDGE_URL", shared.AGENT_BRIDGE_URL?.trim(), input.gatewayUrl],
+    ["shared AGENT_BRIDGE_WORKSPACE", shared.AGENT_BRIDGE_WORKSPACE?.trim(), input.workspaceId]
+  ];
+  for (const [name, actual, expected] of conflicts) {
+    if (actual && actual !== expected) throw new Error(name + " conflicts with the enrollment file");
+  }
+  for (const [name, provider3] of [
+    ["AGENT_BRIDGE_PROVIDER", env.AGENT_BRIDGE_PROVIDER?.trim()],
+    ["shared AGENT_BRIDGE_PROVIDER", shared.AGENT_BRIDGE_PROVIDER?.trim()]
+  ]) {
+    if (provider3 && provider3 !== "gateway") throw new Error(name + " conflicts with the enrollment file");
+  }
+  if (assertions.token) throw new Error("--token cannot be used with --enrollment-file");
+  if (env.AGENT_BRIDGE_CLIENT_TOKEN || env.AGENT_BRIDGE_TOKEN) {
+    throw new Error("token environment variables cannot be used with --enrollment-file");
+  }
+}
+function removeConsumedEnrollment(path, result, lock2, env) {
+  try {
+    const deletion = deleteEnrollmentFile(path, lock2, env);
+    if (deletion === "missing") {
+      return {
+        ...result,
+        installed: true,
+        enrollmentDeleted: false,
+        enrollmentFile: path,
+        enrollmentStatus: "consumed-file-missing"
+      };
+    }
+    if (deletion === "deleted-durability-unknown") {
+      return {
+        ...result,
+        installed: true,
+        enrollmentDeleted: true,
+        enrollmentStatus: "consumed-deletion-durability-unknown"
+      };
+    }
+    return {
+      ...result,
+      installed: true,
+      enrollmentDeleted: true,
+      enrollmentStatus: "consumed"
+    };
+  } catch {
+    return {
+      ...result,
+      installed: true,
+      enrollmentDeleted: false,
+      enrollmentFile: path,
+      enrollmentStatus: "consumed-file-retained"
+    };
+  }
+}
+function backendMatches(path, enrollment2, credentialId, requireToken) {
+  if (!existsSync2(path)) return false;
+  const config = readClientConfigFile(path);
+  return config.AGENT_BRIDGE_PROVIDER === "gateway" && config.AGENT_BRIDGE_URL === enrollment2.input.gatewayUrl && config.AGENT_BRIDGE_WORKSPACE === enrollment2.input.workspaceId && config.AGENT_BRIDGE_CREDENTIAL_ID === credentialId && config.AGENT_BRIDGE_PRINCIPAL === enrollment2.input.principal && config.AGENT_BRIDGE_CLIENT_INSTANCE === enrollment2.input.instance && (!requireToken || config.AGENT_BRIDGE_TOKEN === enrollment2.token);
+}
+function desktopRegistrationState(enrollment2, backendConfigPath, launch, env) {
+  const path = desktopConfigPath(env);
+  if (!existsSync2(path)) return "absent";
+  try {
+    const config = JSON.parse(readFileSync2(path, "utf8"));
+    const server = config?.mcpServers?.["agent-bridge"];
+    if (!server) return "absent";
+    const exactEnvironment = server?.env?.AGENT_BRIDGE_AGENT === enrollment2.input.principal && server?.env?.AGENT_BRIDGE_INSTANCE === enrollment2.input.instance && server?.env?.AGENT_BRIDGE_CONFIG === backendConfigPath;
+    if (server?.command === "agent-bridge-mcp" && (server?.args === void 0 || Array.isArray(server.args) && server.args.length === 0) && exactEnvironment) return "legacy";
+    return server?.command === launch.command && Array.isArray(server?.args) && server.args.length === launch.args.length && server.args.every((arg, index) => arg === launch.args[index]) && exactEnvironment ? "matching" : "conflict";
+  } catch {
+    return "conflict";
+  }
+}
+function repairLegacyDesktopRegistration(state, enrollment2, backendConfigPath, launch, env) {
+  if (state !== "legacy") return state;
+  writeJsonConfig(
+    desktopConfigPath(env),
+    enrollment2.input.principal,
+    enrollment2.input.instance,
+    backendConfigPath,
+    launch
+  );
+  const repaired = desktopRegistrationState(enrollment2, backendConfigPath, launch, env);
+  return repaired === "legacy" ? "conflict" : repaired;
+}
+function nativeRegistrationState(enrollment2, backendConfigPath, command, scope, execute) {
+  const executable = enrollment2.input.runtime === "codex" ? "codex" : "claude";
+  const args = enrollment2.input.runtime === "codex" ? ["mcp", "get", "agent-bridge", "--json"] : ["mcp", "get", "agent-bridge"];
+  const result = execute(executable, args);
+  if (result.error) throw new Error(enrollment2.input.runtime + " MCP inspection failed");
+  if (result.status !== 0) {
+    const output2 = (result.stdout + "\n" + result.stderr).trim();
+    const notFound = enrollment2.input.runtime === "codex" ? output2 === "Error: No MCP server named 'agent-bridge' found." : output2 === 'No MCP server named "agent-bridge".' || /^No MCP server named "agent-bridge"\. Configured servers: [^\r\n]+$/.test(output2);
+    if (notFound) return "absent";
+    throw new Error(enrollment2.input.runtime + " MCP inspection failed");
+  }
+  if (enrollment2.input.runtime === "codex") {
+    try {
+      const server = JSON.parse(result.stdout);
+      const transport = server?.transport;
+      const environment = transport?.env;
+      const exactEnvironment = environment && typeof environment === "object" && !Array.isArray(environment) && Object.keys(environment).sort().join(",") === "AGENT_BRIDGE_AGENT,AGENT_BRIDGE_CONFIG,AGENT_BRIDGE_INSTANCE";
+      return server?.name === "agent-bridge" && server?.enabled === true && transport?.type === "stdio" && transport?.command === command && Array.isArray(transport?.args) && transport.args.length === 0 && exactEnvironment && transport?.env?.AGENT_BRIDGE_AGENT === enrollment2.input.principal && transport?.env?.AGENT_BRIDGE_INSTANCE === enrollment2.input.instance && transport?.env?.AGENT_BRIDGE_CONFIG === backendConfigPath ? "matching" : "conflict";
+    } catch {
+      return "conflict";
+    }
+  }
+  const lines = result.stdout.replace(/\r\n/g, "\n").split("\n");
+  const scopeLine = {
+    local: "  Scope: Local config (private to you in this project)",
+    user: "  Scope: User config (available in all your projects)",
+    project: "  Scope: Project config (shared via .mcp.json)"
+  }[scope];
+  const expectedPrefix = [
+    "agent-bridge:",
+    scopeLine
+  ];
+  if (lines[0] !== expectedPrefix[0] || lines[1] !== expectedPrefix[1] || lines[3] !== "  Type: stdio" || lines[4] !== "  Command: " + command || lines[5] !== "  Args:" || lines[6] !== "  Environment:") return "conflict";
+  const environmentLines = [];
+  let index = 7;
+  while (index < lines.length && lines[index]?.startsWith("    ")) {
+    environmentLines.push(lines[index]);
+    index += 1;
+  }
+  const expectedEnvironment = [
+    "    AGENT_BRIDGE_AGENT=" + enrollment2.input.principal,
+    "    AGENT_BRIDGE_INSTANCE=" + enrollment2.input.instance,
+    "    AGENT_BRIDGE_CONFIG=" + backendConfigPath
+  ].sort();
+  if (environmentLines.sort().join("\n") !== expectedEnvironment.join("\n")) return "conflict";
+  while (lines[index] === "") index += 1;
+  if (lines[index] !== "To remove this server, run: claude mcp remove agent-bridge -s " + scope) {
+    return "conflict";
+  }
+  if (lines.slice(index + 1).some((line) => line !== "")) return "conflict";
+  return "matching";
+}
+function enrolledInstallLocked(runtimeAssertion, identityAssertion, options, execute, lock2) {
+  const env = options.env ?? process.env;
+  let enrollment2 = readEnrollment(options.enrollmentFile, env);
+  assertEnrollmentConfiguration(enrollment2, {
+    runtime: runtimeAssertion,
+    identity: identityAssertion,
+    instance: options.instance,
+    token: options.token,
+    env
+  });
+  const runtime2 = enrollment2.input.runtime;
+  const identity = enrollment2.input.principal;
+  const expectedPath = clientBackendConfigPath(runtime2, enrollment2.input.instance, env);
+  const command = options.command?.trim() || "agent-bridge-mcp";
+  const desktopLaunch = runtime2 === "claude-desktop" ? desktopLaunchContract(options.command, env) : void 0;
+  const scope = options.scope ?? "user";
+  const baseResult = {
+    runtime: runtime2,
+    identity,
+    instance: enrollment2.input.instance,
+    method: runtime2 === "claude-desktop" ? "json-config" : "native-cli",
+    configPath: runtime2 === "claude-desktop" ? desktopConfigPath(env) : void 0,
+    backendConfigPath: expectedPath,
+    restartRequired: true
+  };
+  if (enrollment2.state === "consumed") {
+    if (!enrollment2.result || !backendMatches(expectedPath, enrollment2, enrollment2.result.credentialId, false)) {
+      throw new Error("consumed enrollment no longer matches its client backend");
+    }
+    const inspected = runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment2, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment2, expectedPath, command, scope, execute);
+    const registration = runtime2 === "claude-desktop" ? repairLegacyDesktopRegistration(
+      inspected,
+      enrollment2,
+      expectedPath,
+      desktopLaunch,
+      env
+    ) : inspected;
+    if (registration !== "matching") {
+      throw new Error("consumed enrollment no longer matches its MCP registration");
+    }
+    return removeConsumedEnrollment(options.enrollmentFile, baseResult, lock2, env);
+  }
+  if (enrollment2.state === "pending") {
+    throw new Error("enrollment is pending; resume the owner command first");
+  }
+  const recovering = enrollment2.state === "consuming";
+  if (!recovering && enrollment2.operation === "provision" && existsSync2(expectedPath)) {
+    throw new Error("provision enrollment would replace an existing client backend file");
+  }
+  if (!recovering && enrollment2.operation === "provision") {
+    const registration = runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment2, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment2, expectedPath, command, scope, execute);
+    if (registration !== "absent") {
+      throw new Error("provision enrollment would replace an existing MCP registration");
+    }
+  }
+  if (enrollment2.state === "ready") {
+    enrollment2 = transitionEnrollment(options.enrollmentFile, enrollment2, "consuming", {}, env, lock2);
+  }
+  if (enrollment2.state !== "consuming" || !enrollment2.token) {
+    throw new Error("enrollment is not ready for installation");
+  }
+  const derivedEnv = {
+    ...env,
+    AGENT_BRIDGE_PROVIDER: "gateway",
+    AGENT_BRIDGE_URL: enrollment2.input.gatewayUrl,
+    AGENT_BRIDGE_WORKSPACE: enrollment2.input.workspaceId,
+    AGENT_BRIDGE_AGENT: void 0,
+    AGENT_BRIDGE_INSTANCE: void 0,
+    AGENT_BRIDGE_CLIENT_TOKEN: void 0
+  };
+  let result;
+  let sideEffectsCompleted = false;
+  try {
+    if (enrollment2.operation === "rotate") {
+      if (!enrollment2.input.credentialId || !enrollment2.result) {
+        throw new Error("rotation enrollment lacks credential lineage");
+      }
+      const predecessorMatches = backendMatches(
+        expectedPath,
+        enrollment2,
+        enrollment2.input.credentialId,
+        false
+      );
+      const successorMatches = recovering && backendMatches(
+        expectedPath,
+        enrollment2,
+        enrollment2.result.credentialId,
+        true
+      );
+      if (!predecessorMatches && !successorMatches) {
+        throw new Error("rotation requires an exactly bound predecessor or successor backend");
+      }
+      const inspected = runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment2, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment2, expectedPath, command, scope, execute);
+      const registration = runtime2 === "claude-desktop" ? repairLegacyDesktopRegistration(
+        inspected,
+        enrollment2,
+        expectedPath,
+        desktopLaunch,
+        env
+      ) : inspected;
+      if (registration !== "matching") {
+        throw new Error("rotation requires the exact existing MCP registration");
+      }
+      if (predecessorMatches) {
+        const previous = readFileSync2(expectedPath);
+        try {
+          writeBackendConfig(runtime2, identity, enrollment2.input.instance, {
+            token: enrollment2.token,
+            env: derivedEnv,
+            binding: {
+              credentialId: enrollment2.result.credentialId,
+              principal: identity,
+              instance: enrollment2.input.instance
+            }
+          });
+        } catch (error) {
+          replacePrivateFile(expectedPath, previous);
+          throw error;
+        }
+      }
+      result = baseResult;
+      sideEffectsCompleted = true;
+    } else {
+      if (recovering && existsSync2(expectedPath) && !backendMatches(
+        expectedPath,
+        enrollment2,
+        enrollment2.result.credentialId,
+        true
+      )) {
+        throw new Error("consuming enrollment conflicts with its client backend file");
+      }
+      const inspected = recovering ? runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment2, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment2, expectedPath, command, scope, execute) : "absent";
+      const registration = recovering && runtime2 === "claude-desktop" ? repairLegacyDesktopRegistration(
+        inspected,
+        enrollment2,
+        expectedPath,
+        desktopLaunch,
+        env
+      ) : inspected;
+      if (recovering && registration === "conflict") {
+        throw new Error("consuming enrollment conflicts with the registered MCP server");
+      }
+      if (recovering && backendMatches(
+        expectedPath,
+        enrollment2,
+        enrollment2.result.credentialId,
+        true
+      ) && registration === "matching") {
+        result = baseResult;
+      } else {
+        result = installClient(runtime2, identity, {
+          command: runtime2 === "claude-desktop" ? options.command : command,
+          scope: options.scope,
+          instance: enrollment2.input.instance,
+          token: enrollment2.token,
+          backendBinding: {
+            credentialId: enrollment2.result.credentialId,
+            principal: identity,
+            instance: enrollment2.input.instance
+          },
+          env: derivedEnv
+        }, execute);
+        sideEffectsCompleted = true;
+        const verified = runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment2, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment2, expectedPath, command, scope, execute);
+        if (verified !== "matching") throw new Error("MCP registration verification failed");
+      }
+    }
+  } catch (error) {
+    if (!recovering && !sideEffectsCompleted) {
+      transitionEnrollment(options.enrollmentFile, enrollment2, "ready", {}, env, lock2);
+    }
+    throw error;
+  }
+  enrollment2 = transitionEnrollment(
+    options.enrollmentFile,
+    enrollment2,
+    "consumed",
+    { token: null },
+    env,
+    lock2
+  );
+  return removeConsumedEnrollment(options.enrollmentFile, result, lock2, env);
+}
+function enrolledInstall(runtime2, identity, options, execute) {
+  const env = options.env ?? process.env;
+  if (options.recoverLock) recoverEnrollmentLock(options.enrollmentFile, env);
+  const lock2 = acquireEnrollmentLock(options.enrollmentFile, env);
+  let result;
+  try {
+    result = enrolledInstallLocked(runtime2, identity, options, execute, lock2);
+  } catch (error) {
+    if (!lock2.released) {
+      try {
+        releaseEnrollmentLock(lock2);
+      } catch {
+      }
+    }
+    throw error;
+  }
+  let lockReleaseStatus;
+  try {
+    const release = releaseEnrollmentLock(lock2);
+    lockReleaseStatus = release === "released" ? "released" : "durability-unknown";
+  } catch {
+    lockReleaseStatus = existsSync2(lock2.lockPath) ? "retained" : "durability-unknown";
+  }
+  return { ...result, lockReleaseStatus };
+}
+function installClient(runtime2, identity, options = {}, execute = (command, args) => spawnSync(command, args, { encoding: "utf8" })) {
+  if (options.enrollmentFile) {
+    return enrolledInstall(runtime2, identity, {
+      ...options,
+      enrollmentFile: options.enrollmentFile
+    }, execute);
+  }
+  if (!runtime2) throw new Error("install runtime is required");
+  const normalizedIdentity = identity.trim();
+  if (!normalizedIdentity || normalizedIdentity.length > 128) throw new Error("--identity is required");
+  const instance = options.instance?.trim() || `${runtime2}-${randomUUID2()}`;
+  if (instance.length > 128) throw new Error("--instance exceeds 128 characters");
+  if (options.scope && !["local", "user", "project"].includes(options.scope)) {
+    throw new Error("scope must be local, user, or project");
+  }
+  const command = options.command?.trim() || "agent-bridge-mcp";
+  const env = options.env ?? process.env;
+  const desktopLaunch = runtime2 === "claude-desktop" ? desktopLaunchContract(options.command, env) : void 0;
+  const expectedPath = clientBackendConfigPath(runtime2, instance, env);
+  const previous = existsSync2(expectedPath) ? readFileSync2(expectedPath) : void 0;
+  try {
+    const backendConfigPath = writeBackendConfig(runtime2, normalizedIdentity, instance, {
+      token: options.token,
+      env,
+      binding: options.backendBinding
+    });
+    if (runtime2 === "claude-desktop") {
+      const path = desktopConfigPath(env);
+      writeJsonConfig(path, normalizedIdentity, instance, backendConfigPath, desktopLaunch);
+      return { runtime: runtime2, identity: normalizedIdentity, instance, method: "json-config", configPath: path, backendConfigPath, restartRequired: true };
+    }
+    const executable = runtime2 === "codex" ? "codex" : "claude";
+    const args = runtime2 === "codex" ? [
+      "mcp",
+      "add",
+      "agent-bridge",
+      "--env",
+      `AGENT_BRIDGE_AGENT=${normalizedIdentity}`,
+      "--env",
+      `AGENT_BRIDGE_INSTANCE=${instance}`,
+      "--env",
+      `AGENT_BRIDGE_CONFIG=${backendConfigPath}`,
+      "--",
+      command
+    ] : [
+      "mcp",
+      "add",
+      "--scope",
+      options.scope ?? "user",
+      "agent-bridge",
+      "-e",
+      `AGENT_BRIDGE_AGENT=${normalizedIdentity}`,
+      "-e",
+      `AGENT_BRIDGE_INSTANCE=${instance}`,
+      "-e",
+      `AGENT_BRIDGE_CONFIG=${backendConfigPath}`,
+      "--",
+      command
+    ];
+    const result = execute(executable, args);
+    if (result.error || result.status !== 0) {
+      const detail = result.stderr?.trim() || result.error?.message || `exit ${result.status}`;
+      throw new Error(`${runtime2} MCP installation failed: ${detail}`);
+    }
+    return { runtime: runtime2, identity: normalizedIdentity, instance, method: "native-cli", backendConfigPath, restartRequired: true };
+  } catch (error) {
+    try {
+      if (previous) replacePrivateFile(expectedPath, previous);
+      else rmSync2(expectedPath, { force: true });
+    } catch (rollbackError) {
+      const detail = rollbackError instanceof Error ? rollbackError.message : String(rollbackError);
+      throw new Error(`${error instanceof Error ? error.message : String(error)}; client config rollback failed: ${detail}`);
+    }
+    throw error;
+  }
+}
+
+// src/owner-control.ts
+import { randomBytes, randomUUID as randomUUID3 } from "crypto";
+import pg from "pg";
+var OwnerDatabaseFailure = class extends Error {
+  constructor(driverCode) {
+    super("owner database operation failed");
+    this.driverCode = driverCode;
+  }
+};
+async function ownerQuery(db, sql, values) {
+  try {
+    return await db.query(sql, values);
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code ?? "") : "";
+    throw new OwnerDatabaseFailure(code);
+  }
+}
+var defaultDependencies = {
+  connect(databaseUrl) {
+    const pool = new pg.Pool({
+      connectionString: databaseUrl,
+      max: 1,
+      connectionTimeoutMillis: 1e4,
+      query_timeout: 3e4
+    });
+    return { db: pool, close: () => pool.end() };
+  },
+  now: () => /* @__PURE__ */ new Date(),
+  requestId: () => randomUUID3(),
+  token: () => randomBytes(32).toString("base64url"),
+  instance: (runtime2) => runtime2 + "-" + randomUUID3()
+};
+function stringOption(options, name) {
+  const value = options[name];
+  return typeof value === "string" ? value : void 0;
+}
+function required(options, name) {
+  const value = stringOption(options, name);
+  if (!value) throw new Error("--" + name + " is required");
+  return value;
+}
+function selectWithEnvironment(options, name, env, environmentName, requiredValue) {
+  const explicit = stringOption(options, name);
+  const environment = env[environmentName]?.trim() || void 0;
+  if (explicit && environment && explicit !== environment) {
+    throw new Error("--" + name + " conflicts with " + environmentName);
+  }
+  const selected = explicit ?? environment;
+  if (requiredValue && !selected) {
+    throw new Error("--" + name + " or " + environmentName + " is required");
+  }
+  return selected;
+}
+function timestamp(options, name) {
+  const value = stringOption(options, name) ?? null;
+  return canonicalTimestamp(value, "--" + name);
+}
+function installRuntime(options) {
+  const value = required(options, "runtime");
+  if (value !== "codex" && value !== "claude-code" && value !== "claude-desktop") {
+    throw new Error("--runtime must be codex, claude-code, or claude-desktop");
+  }
+  return value;
+}
+function scopeSet(options) {
+  const value = required(options, "scope-set");
+  if (!/^[a-z][a-z0-9-]{0,63}$/.test(value)) throw new Error("--scope-set is invalid");
+  return value;
+}
+function uuidValue(value, label) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
+    throw new Error(label + " must be a UUID");
+  }
+  return value;
+}
+function uuidOption(options, name) {
+  return uuidValue(required(options, name), "--" + name);
+}
+var OWNER_OPTIONS = {
+  provision: /* @__PURE__ */ new Set([
+    "workspace",
+    "workspace-name",
+    "identity",
+    "runtime",
+    "instance",
+    "gateway-url",
+    "scope-set",
+    "display-name",
+    "runtime-type",
+    "label",
+    "expires-at",
+    "request-id",
+    "enrollment-file",
+    "recover-lock"
+  ]),
+  rotate: /* @__PURE__ */ new Set([
+    "workspace",
+    "identity",
+    "runtime",
+    "instance",
+    "gateway-url",
+    "scope-set",
+    "runtime-type",
+    "label",
+    "expires-at",
+    "grace-until",
+    "invalidate-immediately",
+    "credential-id",
+    "request-id",
+    "enrollment-file",
+    "recover-lock"
+  ]),
+  inventory: /* @__PURE__ */ new Set(["workspace", "cursor", "limit"]),
+  revoke: /* @__PURE__ */ new Set(["credential-id", "reason", "request-id"])
+};
+function validateOwnerOptions(subcommand, options) {
+  if (stringOption(options, "resume")) {
+    const override = Object.keys(options).find((key) => key !== "resume" && key !== "recover-lock");
+    if (override) throw new Error("--" + override + " cannot be used with --resume");
+    if (subcommand !== "provision" && subcommand !== "rotate") {
+      throw new Error("--resume is valid only for provision or rotate");
+    }
+    return;
+  }
+  const allowed = OWNER_OPTIONS[subcommand];
+  const invalid = Object.keys(options).find((key) => !allowed?.has(key));
+  if (invalid) throw new Error("--" + invalid + " is not valid for owner " + subcommand);
+}
+function requestId(options, dependencies) {
+  return stringOption(options, "request-id") ? uuidOption(options, "request-id") : dependencies.requestId();
+}
+function initialEnrollment(operation, options, env, dependencies) {
+  const request = requestId(options, dependencies);
+  const runtime2 = installRuntime(options);
+  const gatewayUrl = canonicalGatewayUrl(
+    selectWithEnvironment(options, "gateway-url", env, "AGENT_BRIDGE_URL", true),
+    "--gateway-url"
+  );
+  const workspaceId = required(options, "workspace");
+  const principal = required(options, "identity");
+  const explicitInstance = stringOption(options, "instance");
+  const instance = operation === "rotate" ? explicitInstance ?? (() => {
+    throw new Error("--instance is required for rotation");
+  })() : explicitInstance ?? dependencies.instance(runtime2);
+  const graceUntil = timestamp(options, "grace-until");
+  const invalidateImmediately = options["invalidate-immediately"] === true || options["invalidate-immediately"] === "true";
+  if (operation === "rotate" && graceUntil === null === !invalidateImmediately) {
+    throw new Error("rotation requires exactly one of --grace-until or --invalidate-immediately");
+  }
+  if (operation === "provision" && (graceUntil !== null || invalidateImmediately)) {
+    throw new Error("provision does not accept rotation invalidation options");
+  }
+  const input = {
+    gatewayUrl,
+    workspaceId,
+    principal,
+    runtime: runtime2,
+    instance,
+    credentialId: operation === "rotate" ? uuidOption(options, "credential-id") : null,
+    workspaceName: operation === "provision" ? required(options, "workspace-name") : null,
+    displayName: stringOption(options, "display-name") ?? null,
+    runtimeType: stringOption(options, "runtime-type") ?? runtime2,
+    label: stringOption(options, "label") ?? null,
+    scopeSetName: scopeSet(options),
+    expiresAt: timestamp(options, "expires-at"),
+    graceUntil,
+    invalidateImmediately
+  };
+  if (operation === "rotate" && input.displayName !== null) {
+    throw new Error("rotate does not accept --display-name");
+  }
+  const enrollment2 = {
+    schema: "agent-bridge.enrollment",
+    version: 1,
+    provider: "gateway",
+    revision: 0,
+    state: "pending",
+    operation,
+    requestId: request,
+    createdAt: dependencies.now().toISOString(),
+    completedAt: null,
+    input,
+    token: dependencies.token(),
+    result: null
+  };
+  const path = stringOption(options, "enrollment-file") ?? defaultEnrollmentPath(request, env);
+  createPendingEnrollment(path, enrollment2, env);
+  return { path, enrollment: enrollment2 };
+}
+function enrollment(operation, options, env, dependencies) {
+  const resume = stringOption(options, "resume");
+  if (!resume) return initialEnrollment(operation, options, env, dependencies);
+  const loaded = readEnrollment(resume, env);
+  if (loaded.operation !== operation) {
+    throw new Error("enrollment operation is " + loaded.operation + ", not " + operation);
+  }
+  return { path: resume, enrollment: loaded };
+}
+function publicEnrollment(path, enrollment2) {
+  if (!enrollment2.result) throw new Error("enrollment has no completed result");
+  return {
+    schemaVersion: 1,
+    status: "ok",
+    operation: enrollment2.operation,
+    requestId: enrollment2.requestId,
+    enrollmentFile: path,
+    enrollmentState: enrollment2.state,
+    ...enrollment2.result
+  };
+}
+async function runProvision(db, path, enrollment2, completedAt, env, lock2) {
+  if (enrollment2.state !== "pending") return publicEnrollment(path, enrollment2);
+  const input = enrollment2.input;
+  const response = await ownerQuery(
+    db,
+    "SELECT * FROM agent_bridge.control_provision($1::uuid,$2::text,$3::text,$4::text,$5::text,$6::text,$7::char(64),$8::text,$9::text,$10::timestamptz)",
+    [
+      enrollment2.requestId,
+      input.workspaceId,
+      input.workspaceName,
+      input.principal,
+      input.displayName,
+      input.runtimeType,
+      enrollmentTokenHash(enrollment2),
+      input.label,
+      input.scopeSetName,
+      input.expiresAt
+    ]
+  );
+  const row = response.rows[0];
+  if (!row) throw new Error("owner provision returned no result");
+  const result = {
+    workspaceId: row.workspace_id,
+    principal: input.principal,
+    agentId: row.agent_id,
+    credentialId: row.credential_id,
+    replayed: row.replayed
+  };
+  const ready = transitionEnrollment(path, enrollment2, "ready", { completedAt, result }, env, lock2);
+  return publicEnrollment(path, ready);
+}
+async function runRotate(db, path, enrollment2, completedAt, env, lock2) {
+  if (enrollment2.state !== "pending") return publicEnrollment(path, enrollment2);
+  const input = enrollment2.input;
+  const response = await ownerQuery(
+    db,
+    "SELECT * FROM agent_bridge.control_rotate_credential($1::uuid,$2::uuid,$3::text,$4::text,$5::char(64),$6::text,$7::text,$8::timestamptz,$9::timestamptz)",
+    [
+      enrollment2.requestId,
+      input.credentialId,
+      input.workspaceId,
+      input.principal,
+      enrollmentTokenHash(enrollment2),
+      input.label,
+      input.scopeSetName,
+      input.expiresAt,
+      input.graceUntil
+    ]
+  );
+  const row = response.rows[0];
+  if (!row) throw new Error("owner rotation returned no result");
+  const result = {
+    workspaceId: row.workspace_id,
+    principal: row.principal,
+    agentId: null,
+    credentialId: row.credential_id,
+    replayed: row.replayed
+  };
+  const ready = transitionEnrollment(path, enrollment2, "ready", { completedAt, result }, env, lock2);
+  return publicEnrollment(path, ready);
+}
+function decodeCursor(raw, workspace) {
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+  } catch {
+    throw new Error("--cursor is not a valid owner inventory cursor");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("--cursor is not a valid owner inventory cursor");
+  }
+  const cursor2 = parsed;
+  if (cursor2.v !== 1 || cursor2.workspace !== workspace || typeof cursor2.createdAt !== "string" || typeof cursor2.credentialId !== "string") {
+    throw new Error("--cursor does not match this inventory request");
+  }
+  let createdAt;
+  try {
+    createdAt = canonicalTimestamp(cursor2.createdAt, "inventory cursor createdAt");
+  } catch {
+    throw new Error("--cursor is not a valid owner inventory cursor");
+  }
+  if (createdAt === null) throw new Error("--cursor is not a valid owner inventory cursor");
+  let credentialId;
+  try {
+    credentialId = uuidValue(cursor2.credentialId, "inventory cursor credentialId");
+  } catch {
+    throw new Error("--cursor is not a valid owner inventory cursor");
+  }
+  return { v: 1, workspace, createdAt, credentialId };
+}
+function encodeCursor(cursor2) {
+  return Buffer.from(JSON.stringify(cursor2), "utf8").toString("base64url");
+}
+function instant(value) {
+  if (value === null || value === void 0) return null;
+  return value instanceof Date ? value.toISOString() : new Date(String(value)).toISOString();
+}
+async function runInventory(db, options) {
+  const rawLimit = stringOption(options, "limit");
+  const limit = rawLimit === void 0 ? 100 : Number(rawLimit);
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e3) {
+    throw new Error("--limit must be an integer between 1 and 1000");
+  }
+  const workspace = stringOption(options, "workspace") ?? null;
+  const cursor2 = decodeCursor(stringOption(options, "cursor"), workspace);
+  const response = await ownerQuery(
+    db,
+    "SELECT * FROM agent_bridge.control_credential_inventory($1::text,$2::timestamptz,$3::uuid,$4::integer)",
+    [workspace, cursor2?.createdAt ?? null, cursor2?.credentialId ?? null, limit]
+  );
+  const credentials = response.rows.map((row) => ({
+    credentialId: row.credential_id,
+    workspaceId: row.workspace_id,
+    principal: row.principal,
+    label: row.label,
+    scopes: row.scopes,
+    scopeSetName: row.scope_set_name,
+    expiresAt: instant(row.expires_at),
+    revokedAt: instant(row.revoked_at),
+    revokedBy: row.revoked_by,
+    revocationReason: row.revocation_reason,
+    replacesCredentialId: row.replaces_credential_id,
+    expiryGraceUntil: instant(row.expiry_grace_until),
+    createdAt: instant(row.created_at),
+    lastUsedAt: instant(row.last_used_at),
+    agentDisabledAt: instant(row.agent_disabled_at),
+    workspaceDisabledAt: instant(row.workspace_disabled_at)
+  }));
+  const last = credentials.length ? credentials[credentials.length - 1] : void 0;
+  const nextCursor = credentials.length === limit && last?.createdAt ? encodeCursor({
+    v: 1,
+    workspace,
+    createdAt: last.createdAt,
+    credentialId: String(last.credentialId)
+  }) : null;
+  return {
+    schemaVersion: 1,
+    status: "ok",
+    operation: "inventory",
+    items: credentials,
+    page: { limit, nextCursor }
+  };
+}
+async function runRevoke(db, options, dependencies) {
+  const selectedRequestId = requestId(options, dependencies);
+  const credentialId = uuidOption(options, "credential-id");
+  const reason = stringOption(options, "reason") ?? "operator_request";
+  if (!["operator_request", "rotation", "compromise", "retired"].includes(reason)) {
+    throw new Error("--reason must be operator_request, rotation, compromise, or retired");
+  }
+  const response = await ownerQuery(
+    db,
+    "SELECT * FROM agent_bridge.control_revoke_credential($1::uuid,$2::uuid,$3::text)",
+    [selectedRequestId, credentialId, reason]
+  );
+  const row = response.rows[0];
+  if (!row) throw new Error("owner revoke returned no result");
+  return {
+    schemaVersion: 1,
+    status: "ok",
+    operation: "revoke",
+    requestId: selectedRequestId,
+    credentialId,
+    revoked: row.revoked,
+    replayed: row.replayed
+  };
+}
+async function runOwnerCommand(subcommand, options, env = process.env, dependencies = defaultDependencies) {
+  if (!subcommand || subcommand === "help") {
+    if (Object.keys(options).length) throw new Error("owner help does not accept options");
+    return {
+      command: "agent-bridge owner",
+      subcommands: ["provision", "inventory", "rotate", "revoke"],
+      authority: "AGENT_BRIDGE_OPERATOR_DATABASE_URL"
+    };
+  }
+  if (!["provision", "inventory", "rotate", "revoke"].includes(subcommand)) {
+    throw new Error("unsupported owner command: " + subcommand);
+  }
+  validateOwnerOptions(subcommand, options);
+  if (options["recover-lock"] === true && !stringOption(options, "resume")) {
+    throw new Error("--recover-lock requires --resume");
+  }
+  const databaseUrl = env.AGENT_BRIDGE_OPERATOR_DATABASE_URL?.trim();
+  if (!databaseUrl) throw new Error("AGENT_BRIDGE_OPERATOR_DATABASE_URL is required");
+  let connection;
+  try {
+    connection = dependencies.connect(databaseUrl);
+  } catch {
+    throw new Error("owner database connection failed");
+  }
+  try {
+    if (subcommand === "inventory") return await runInventory(connection.db, options);
+    if (subcommand === "revoke") return await runRevoke(connection.db, options, dependencies);
+    const mutation = subcommand;
+    const selected = enrollment(mutation, options, env, dependencies);
+    if (options["recover-lock"] === true) recoverEnrollmentLock(selected.path, env);
+    const lock2 = acquireEnrollmentLock(selected.path, env);
+    try {
+      const current = readEnrollment(selected.path, env);
+      if (current.operation !== mutation) {
+        throw new Error("enrollment operation is " + current.operation + ", not " + mutation);
+      }
+      if (subcommand === "provision") {
+        return await runProvision(
+          connection.db,
+          selected.path,
+          current,
+          dependencies.now().toISOString(),
+          env,
+          lock2
+        );
+      }
+      return await runRotate(
+        connection.db,
+        selected.path,
+        current,
+        dependencies.now().toISOString(),
+        env,
+        lock2
+      );
+    } finally {
+      releaseEnrollmentLock(lock2);
+    }
+  } catch (error) {
+    if (!(error instanceof OwnerDatabaseFailure)) throw error;
+    const code = error.driverCode;
+    if (code === "42501") throw new Error("owner database authorization denied");
+    if (code === "23505") throw new Error("owner request conflicts with existing state");
+    if (code === "22P02" || code === "22007" || code === "22023") {
+      throw new Error("owner database rejected invalid input");
+    }
+    throw new Error("owner database operation failed");
+  } finally {
+    try {
+      await connection.close();
+    } catch {
+      throw new Error("owner database close failed");
+    }
+  }
+}
+
+// src/archive-cli.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import {
+  closeSync as closeSync3,
+  constants as constants3,
+  existsSync as existsSync3,
+  fstatSync as fstatSync2,
+  fsyncSync as fsyncSync3,
+  linkSync,
+  lstatSync as lstatSync2,
+  openSync as openSync3,
+  renameSync as renameSync3,
+  unlinkSync,
+  writeSync
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, resolve as resolve3 } from "path";
+import pg2 from "pg";
+var BOOLEAN_OPTIONS = /* @__PURE__ */ new Set(["apply", "dry-run", "force"]);
+var OPERATION_OPTIONS = {
+  export: /* @__PURE__ */ new Set(["provider", "workspace", "output", "db", "config", "force", "request-id"]),
+  verify: /* @__PURE__ */ new Set(["file"]),
+  import: /* @__PURE__ */ new Set(["provider", "file", "db", "config", "workspace", "request-id", "apply", "dry-run"])
+};
+var ArchiveCommandError = class extends Error {
+  constructor(code, message, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+  }
+};
+function fail(code, message, details) {
+  throw new ArchiveCommandError(code, message, details);
+}
+function parseArchiveArgs(argv) {
+  const operation = argv[0];
+  if (operation !== "export" && operation !== "verify" && operation !== "import") fail("INVALID_COMMAND", "usage: agent-bridge archive <export|verify|import>");
+  const options = {};
+  for (let index = 1; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (!argument.startsWith("--") || argument === "--") fail("INVALID_ARGUMENT", `unexpected positional argument: ${argument}`);
+    const name = argument.slice(2);
+    if (!name || name.includes("=")) fail("INVALID_OPTION", `invalid option: ${argument}`);
+    if (!OPERATION_OPTIONS[operation].has(name)) fail("INVALID_OPTION", `--${name} is not valid for archive ${operation}`);
+    if (options[name] !== void 0) fail("DUPLICATE_OPTION", `--${name} may only be provided once`);
+    if (BOOLEAN_OPTIONS.has(name)) {
+      options[name] = true;
+      continue;
+    }
+    const selected = argv[index + 1];
+    if (!selected || selected.startsWith("--")) fail("MISSING_OPTION_VALUE", `--${name} requires a value`);
+    options[name] = selected;
+    index += 1;
+  }
+  if (operation === "import" && options.apply === true && options["dry-run"] === true) fail("INVALID_OPTION", "--apply and --dry-run are mutually exclusive");
+  return { operation, options };
+}
+var stringOption2 = (options, name) => typeof options[name] === "string" ? options[name] : void 0;
+function archiveRequestId(options) {
+  const value = stringOption2(options, "request-id") ?? randomUUID4();
+  try {
+    return validatePortableArchiveRequestId(value);
+  } catch {
+    return fail("INVALID_REQUEST_ID", "--request-id must be a UUID");
+  }
+}
+function required2(options, name) {
+  const selected = stringOption2(options, name)?.trim();
+  if (!selected) fail("MISSING_OPTION", `--${name} is required`);
+  return selected;
+}
+function provider(options) {
+  const selected = required2(options, "provider");
+  if (selected !== "local" && selected !== "postgres") fail("INVALID_PROVIDER", "--provider must be local or postgres");
+  if (selected === "postgres" && (options.db !== void 0 || options.config !== void 0)) fail("INVALID_OPTION", "PostgreSQL archives accept authority only from AGENT_BRIDGE_ARCHIVE_DATABASE_URL");
+  return selected;
+}
+var home = (env) => env.HOME?.trim() || homedir3();
+function localDatabase(options, env) {
+  const configPath = stringOption2(options, "config") ?? env.AGENT_BRIDGE_CONFIG?.trim() ?? join3(home(env), ".agent-bridge", "config");
+  const config = readClientConfigFile(configPath);
+  const selected = stringOption2(options, "db") ?? env.AGENT_BRIDGE_DB?.trim() ?? config.AGENT_BRIDGE_DB?.trim() ?? join3(home(env), ".agent-bridge", "bridge.sqlite3");
+  return isAbsolute2(selected) ? selected : resolve3(selected);
+}
+function createStore(selected, options, env) {
+  if (selected === "local") {
+    const store = new SQLitePortableArchiveStore(localDatabase(options, env));
+    return { store, close: async () => {
+      store.close();
+    } };
+  }
+  const databaseUrl = env.AGENT_BRIDGE_ARCHIVE_DATABASE_URL?.trim();
+  if (!databaseUrl) fail("MISSING_AUTHORITY", "AGENT_BRIDGE_ARCHIVE_DATABASE_URL is required");
+  const pool = new pg2.Pool({ connectionString: databaseUrl, max: 1, connectionTimeoutMillis: 1e4, query_timeout: 3e4 });
+  return { store: new PostgresPortableArchiveStore(pool), close: () => pool.end() };
+}
+function syncDirectory2(path) {
+  if (process.platform === "win32") return;
+  const descriptor = openSync3(path, "r");
+  try {
+    fsyncSync3(descriptor);
+  } finally {
+    closeSync3(descriptor);
+  }
+}
+async function publishArchive(path, force, session, workspace, options) {
+  const exportRequestId = validatePortableArchiveRequestId(options.requestId);
+  const target = resolve3(path);
+  const directory = dirname3(target);
+  const temporary = join3(directory, `.${exportRequestId}.agent-bridge-archive.tmp`);
+  const backup = join3(directory, `.${exportRequestId}.agent-bridge-archive.backup`);
+  const operations = {
+    link: options.fileOperations?.link ?? linkSync,
+    rename: options.fileOperations?.rename ?? renameSync3,
+    unlink: options.fileOperations?.unlink ?? unlinkSync,
+    syncDirectory: options.fileOperations?.syncDirectory ?? syncDirectory2
+  };
+  let descriptor;
+  let created = false;
+  let linked = false;
+  let replacementVisible = false;
+  let durablyPublished = false;
+  let backupCreated = false;
+  let preserveBackup = false;
+  let targetExisted = false;
+  const ambiguous = (message) => new ArchiveCommandError(
+    "ARCHIVE_PUBLICATION_AMBIGUOUS",
+    message,
+    {
+      requestId: exportRequestId,
+      file: target,
+      published: "unknown",
+      auditStatus: "started",
+      ...backupCreated ? { backupFile: backup } : {}
+    }
+  );
+  try {
+    verifyPrivatePathAccess(directory, "directory");
+    if (existsSync3(target)) {
+      const stat = lstatSync2(target);
+      if (stat.isSymbolicLink() || !stat.isFile()) fail("INVALID_OUTPUT", "archive output must be a regular file");
+      if (!force) fail("OUTPUT_EXISTS", "archive output already exists; pass --force to replace it");
+      targetExisted = true;
+    }
+    descriptor = openSync3(temporary, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL, 384);
+    created = true;
+    securePrivatePath(temporary, "file");
+    const metadata = await (options.stream ?? streamPortableArchive)(session, workspace, exportRequestId, (bytes) => {
+      let offset = 0;
+      while (offset < bytes.length) offset += writeSync(descriptor, bytes, offset, bytes.length - offset);
+    });
+    fsyncSync3(descriptor);
+    const opened = fstatSync2(descriptor);
+    const named = lstatSync2(temporary);
+    if (opened.dev !== named.dev || opened.ino !== named.ino || !named.isFile() || named.isSymbolicLink()) fail("INVALID_OUTPUT", "archive temporary path identity changed before publication");
+    if (force && targetExisted) {
+      const noFollow = typeof constants3.O_NOFOLLOW === "number" ? constants3.O_NOFOLLOW : 0;
+      const targetDescriptor = openSync3(target, constants3.O_RDONLY | noFollow);
+      try {
+        const openedTarget = fstatSync2(targetDescriptor);
+        const namedTarget = lstatSync2(target);
+        if (!openedTarget.isFile() || namedTarget.isSymbolicLink() || openedTarget.dev !== namedTarget.dev || openedTarget.ino !== namedTarget.ino) {
+          fail("INVALID_OUTPUT", "archive output identity changed before replacement");
+        }
+        verifyPrivatePathAccess(target, "file");
+        operations.link(target, backup);
+        backupCreated = true;
+        const backupStat = lstatSync2(backup);
+        if (!backupStat.isFile() || backupStat.isSymbolicLink() || openedTarget.dev !== backupStat.dev || openedTarget.ino !== backupStat.ino) {
+          fail("INVALID_OUTPUT", "archive backup identity changed before replacement");
+        }
+        verifyPrivatePathAccess(backup, "file");
+        operations.syncDirectory(directory);
+      } finally {
+        closeSync3(targetDescriptor);
+      }
+    }
+    if (force) {
+      operations.rename(temporary, target);
+      created = false;
+      replacementVisible = true;
+    } else {
+      try {
+        operations.link(temporary, target);
+      } catch (error) {
+        if (error.code === "EEXIST") fail("OUTPUT_EXISTS", "archive output already exists; pass --force to replace it");
+        throw error;
+      }
+      linked = true;
+      operations.unlink(temporary);
+      created = false;
+    }
+    verifyPrivatePathAccess(target, "file");
+    operations.syncDirectory(directory);
+    durablyPublished = true;
+    if (backupCreated) {
+      try {
+        operations.unlink(backup);
+      } catch {
+        preserveBackup = true;
+        fail("ARCHIVE_BACKUP_RETAINED", "archive was published but backup cleanup could not be proved; retry the same request ID", {
+          requestId: exportRequestId,
+          file: target,
+          backupFile: backup,
+          backupState: "retained",
+          published: true,
+          auditStatus: "started"
+        });
+      }
+      backupCreated = false;
+      try {
+        operations.syncDirectory(directory);
+      } catch {
+        fail("ARCHIVE_BACKUP_CLEANUP_AMBIGUOUS", "archive was published but backup deletion durability is unknown; retry the same request ID", {
+          requestId: exportRequestId,
+          file: target,
+          backupFile: backup,
+          backupState: "unknown",
+          published: true,
+          auditStatus: "started"
+        });
+      }
+    }
+    try {
+      await session.complete({ ...metadata, publishedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    } catch {
+      let auditStatus = "unknown";
+      try {
+        await session.abandon("audit_failed");
+        auditStatus = "abandoned";
+      } catch {
+      }
+      const details = { requestId: exportRequestId, file: target, published: true, auditStatus };
+      if (auditStatus === "abandoned") fail("ARCHIVE_AUDIT_ABANDONED", "archive was published but its completion audit was abandoned", details);
+      fail("ARCHIVE_AUDIT_AMBIGUOUS", "archive was published but its completion audit outcome is unknown", details);
+    }
+    return metadata;
+  } catch (error) {
+    if (!durablyPublished) {
+      if (force && replacementVisible) {
+        if (backupCreated) {
+          try {
+            operations.rename(backup, target);
+            backupCreated = false;
+            replacementVisible = false;
+            verifyPrivatePathAccess(target, "file");
+            operations.syncDirectory(directory);
+          } catch {
+            preserveBackup = true;
+            throw ambiguous("archive replacement failed and restoration could not be proved; use owner reconciliation");
+          }
+        } else {
+          try {
+            operations.unlink(target);
+            replacementVisible = false;
+            operations.syncDirectory(directory);
+          } catch {
+            throw ambiguous("archive replacement failed and removal could not be proved; use owner reconciliation");
+          }
+        }
+      } else if (backupCreated) {
+        try {
+          operations.unlink(backup);
+          backupCreated = false;
+          operations.syncDirectory(directory);
+        } catch {
+          preserveBackup = true;
+          throw ambiguous("archive backup cleanup could not be proved; use owner reconciliation");
+        }
+      }
+      if (linked && descriptor !== void 0) {
+        try {
+          const opened = fstatSync2(descriptor);
+          const named = lstatSync2(target);
+          if (opened.dev === named.dev && opened.ino === named.ino) {
+            operations.unlink(target);
+            linked = false;
+            operations.syncDirectory(directory);
+          }
+        } catch {
+          throw ambiguous("archive publication failed and output removal could not be proved; use owner reconciliation");
+        }
+      }
+      try {
+        await session.abandon("publication_failed");
+      } catch {
+        throw new ArchiveCommandError(
+          "ARCHIVE_AUDIT_AMBIGUOUS",
+          "archive publication did not complete but its audit outcome is unknown",
+          { requestId: exportRequestId, file: target, published: false, auditStatus: "unknown" }
+        );
+      }
+    }
+    throw error;
+  } finally {
+    if (descriptor !== void 0) closeSync3(descriptor);
+    if (created) {
+      try {
+        operations.unlink(temporary);
+      } catch {
+      }
+    }
+    if (backupCreated && !preserveBackup && !replacementVisible) {
+      try {
+        operations.unlink(backup);
+        operations.syncDirectory(directory);
+      } catch {
+      }
+    }
+  }
+}
+var success = (operation, value) => ({ schemaVersion: 1, status: "ok", operation, ...value });
+function recoveryArtifactPaths(target, requestId2) {
+  const directory = dirname3(target);
+  return [
+    join3(directory, `.${requestId2}.agent-bridge-archive.tmp`),
+    join3(directory, `.${requestId2}.agent-bridge-archive.backup`)
+  ];
+}
+function existingRecoveryArtifacts(target, requestId2) {
+  return recoveryArtifactPaths(target, requestId2).filter((path) => existsSync3(path));
+}
+function openVerifiedPrivateFile(path) {
+  verifyPrivatePathAccess(path, "file");
+  const before = lstatSync2(path);
+  const noFollow = typeof constants3.O_NOFOLLOW === "number" ? constants3.O_NOFOLLOW : 0;
+  const descriptor = openSync3(path, constants3.O_RDONLY | noFollow);
+  try {
+    const opened = fstatSync2(descriptor);
+    const after = lstatSync2(path);
+    if (!opened.isFile() || before.isSymbolicLink() || after.isSymbolicLink() || opened.dev !== before.dev || opened.ino !== before.ino || opened.dev !== after.dev || opened.ino !== after.ino) {
+      fail("INVALID_OUTPUT", "archive recovery path identity changed");
+    }
+    return descriptor;
+  } catch (error) {
+    closeSync3(descriptor);
+    throw error;
+  }
+}
+function removeRecoveryArtifacts(target, requestId2) {
+  for (const path of existingRecoveryArtifacts(target, requestId2)) {
+    const descriptor = openVerifiedPrivateFile(path);
+    try {
+      const opened = fstatSync2(descriptor);
+      const named = lstatSync2(path);
+      if (opened.dev !== named.dev || opened.ino !== named.ino) fail("INVALID_OUTPUT", "archive recovery path identity changed");
+      unlinkSync(path);
+    } finally {
+      closeSync3(descriptor);
+    }
+    syncDirectory2(dirname3(path));
+  }
+}
+function verifyCompletedExport(path, requestId2, expected) {
+  const target = resolve3(path);
+  const recoveryPaths2 = existingRecoveryArtifacts(target, requestId2);
+  if (!existsSync3(target)) fail("ARCHIVE_REPLAY_FILE_MISSING", "completed export file is missing; use a new request ID", { requestId: requestId2, file: target, recoveryPaths: recoveryPaths2 });
+  let archive;
+  try {
+    try {
+      archive = new PortableArchiveFile(target);
+    } catch {
+      fail("ARCHIVE_REPLAY_FILE_MISMATCH", "completed export file is not a valid private archive", { requestId: requestId2, file: target, recoveryPaths: recoveryPaths2 });
+    }
+    let actual;
+    try {
+      actual = archive.verify();
+    } catch {
+      fail("ARCHIVE_REPLAY_FILE_MISMATCH", "completed export file is not a valid matching archive", { requestId: requestId2, file: target, recoveryPaths: recoveryPaths2 });
+    }
+    if (actual.exportRequestId !== requestId2 || expected.exportRequestId !== requestId2 || actual.workspace !== expected.workspace || actual.digest !== expected.digest || actual.messageCount !== expected.messageCount || actual.receiptCount !== expected.receiptCount) {
+      fail("ARCHIVE_REPLAY_FILE_MISMATCH", "completed export file does not match the recorded audit; use a new request ID", { requestId: requestId2, file: target, recoveryPaths: recoveryPaths2 });
+    }
+    try {
+      archive.proveDurable();
+    } catch {
+      fail("ARCHIVE_REPLAY_DURABILITY_AMBIGUOUS", "completed export file durability could not be reproved", { requestId: requestId2, file: target, published: true, auditStatus: "completed", recoveryPaths: recoveryPaths2 });
+    }
+    try {
+      removeRecoveryArtifacts(target, requestId2);
+    } catch {
+      fail("ARCHIVE_RECOVERY_ARTIFACT_RETAINED", "completed export recovery artifacts could not be removed", { requestId: requestId2, file: target, published: true, auditStatus: "completed", recoveryPaths: existingRecoveryArtifacts(target, requestId2) });
+    }
+    try {
+      archive.proveDurable();
+    } catch {
+      fail("ARCHIVE_REPLAY_DURABILITY_AMBIGUOUS", "completed export file durability could not be reproved after cleanup", { requestId: requestId2, file: target, published: true, auditStatus: "completed", recoveryPaths: existingRecoveryArtifacts(target, requestId2) });
+    }
+    return actual;
+  } finally {
+    archive?.close();
+  }
+}
+async function reconcileActiveExport(path, requestId2, workspace, session) {
+  const target = resolve3(path);
+  const details = { requestId: requestId2, file: target, recoveryPaths: existingRecoveryArtifacts(target, requestId2), published: "unknown", auditStatus: "started" };
+  if (!existsSync3(target)) fail("ARCHIVE_RECONCILIATION_FILE_MISSING", "active export file is missing; use a new request ID or owner reconciliation", details);
+  let archive;
+  try {
+    try {
+      archive = new PortableArchiveFile(target);
+    } catch {
+      fail("ARCHIVE_RECONCILIATION_FILE_MISMATCH", "active export file is not a valid private archive", details);
+    }
+    let metadata;
+    try {
+      metadata = archive.verify();
+    } catch {
+      fail("ARCHIVE_RECONCILIATION_FILE_MISMATCH", "active export file is not a valid matching archive", details);
+    }
+    if (metadata.exportRequestId !== requestId2 || metadata.workspace !== workspace) {
+      fail("ARCHIVE_RECONCILIATION_FILE_MISMATCH", "active export file does not match the requested workspace; use a new request ID or owner reconciliation", details);
+    }
+    try {
+      archive.proveDurable();
+    } catch {
+      fail("ARCHIVE_RECONCILIATION_DURABILITY_AMBIGUOUS", "active export file durability could not be proved; retry the same request ID", details);
+    }
+    try {
+      removeRecoveryArtifacts(target, requestId2);
+    } catch {
+      fail("ARCHIVE_RECOVERY_ARTIFACT_RETAINED", "active export recovery artifacts could not be removed; retry the same request ID", {
+        ...details,
+        recoveryPaths: existingRecoveryArtifacts(target, requestId2),
+        published: true
+      });
+    }
+    try {
+      archive.proveDurable();
+    } catch {
+      fail("ARCHIVE_RECONCILIATION_DURABILITY_AMBIGUOUS", "active export durability after cleanup could not be proved; retry the same request ID", { ...details, published: true });
+    }
+    const publishedAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      await session.reconcile({ ...metadata, publishedAt });
+    } catch {
+      fail("ARCHIVE_RECONCILIATION_AMBIGUOUS", "active export reconciliation outcome is unknown; retry the same request ID", { ...details, published: true, auditStatus: "unknown" });
+    }
+    return { ...metadata, publishedAt };
+  } finally {
+    archive?.close();
+  }
+}
+async function runArchiveCommand(argv, env = process.env) {
+  const { operation, options } = parseArchiveArgs(argv);
+  try {
+    if (operation === "verify") {
+      const path2 = required2(options, "file");
+      let archive2;
+      try {
+        archive2 = new PortableArchiveFile(path2);
+        const metadata = archive2.verify();
+        return success(operation, { file: resolve3(path2), exportRequestId: metadata.exportRequestId, workspace: metadata.workspace, digest: metadata.digest, messages: metadata.messageCount, receipts: metadata.receiptCount });
+      } finally {
+        archive2?.close();
+      }
+    }
+    const selected = provider(options);
+    if (operation === "export") {
+      const workspace = required2(options, "workspace");
+      const path2 = required2(options, "output");
+      const requestId2 = archiveRequestId(options);
+      const connection = createStore(selected, options, env);
+      let session;
+      try {
+        const start = await connection.store.beginExport(requestId2, workspace);
+        if (start.status === "completed") {
+          const metadata2 = verifyCompletedExport(path2, requestId2, start.metadata);
+          return success(operation, { provider: selected, requestId: requestId2, replayed: true, reconciled: false, file: resolve3(path2), workspace, digest: metadata2.digest, messages: metadata2.messageCount, receipts: metadata2.receiptCount, publishedAt: start.metadata.publishedAt });
+        }
+        session = start.session;
+        if (start.replayed) {
+          const metadata2 = await reconcileActiveExport(path2, requestId2, workspace, session);
+          return success(operation, { provider: selected, requestId: requestId2, replayed: true, reconciled: true, file: resolve3(path2), workspace, digest: metadata2.digest, messages: metadata2.messageCount, receipts: metadata2.receiptCount, publishedAt: metadata2.publishedAt });
+        }
+        const metadata = await publishArchive(path2, options.force === true, session, workspace, { requestId: requestId2 });
+        return success(operation, { provider: selected, requestId: requestId2, replayed: false, reconciled: false, file: resolve3(path2), workspace, digest: metadata.digest, messages: metadata.messageCount, receipts: metadata.receiptCount });
+      } finally {
+        await session?.close();
+        await connection.close();
+      }
+    }
+    const path = required2(options, "file");
+    const archive = new PortableArchiveFile(path);
+    try {
+      const metadata = archive.verify();
+      const assertedWorkspace = stringOption2(options, "workspace")?.trim();
+      if (assertedWorkspace && assertedWorkspace !== metadata.workspace) fail("WORKSPACE_MISMATCH", "--workspace does not match the archive workspace");
+      const requestId2 = archiveRequestId(options);
+      const connection = createStore(selected, options, env);
+      try {
+        const result = await connection.store.importWorkspace(requestId2, metadata, archive, { apply: options.apply === true });
+        return success(operation, { provider: selected, file: resolve3(path), exportRequestId: metadata.exportRequestId, ...result });
+      } finally {
+        await connection.close();
+      }
+    } finally {
+      archive.close();
+    }
+  } catch (error) {
+    if (error instanceof ArchiveCommandError) throw error;
+    if (error instanceof PrivatePathError) fail("INSECURE_PATH", "archive file or directory does not satisfy the private path policy");
+    if (error instanceof PortableArchiveError) fail("INVALID_ARCHIVE", error.message);
+    fail("ARCHIVE_OPERATION_FAILED", "archive operation failed");
+  }
+}
+
+// src/dr-cli.ts
+import { createHash as createHash3, randomUUID as randomUUID5 } from "crypto";
+import {
+  closeSync as closeSync4,
+  constants as constants4,
+  existsSync as existsSync4,
+  fstatSync as fstatSync3,
+  fsyncSync as fsyncSync4,
+  linkSync as linkSync2,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync3,
+  openSync as openSync4,
+  rmSync as rmSync3,
+  unlinkSync as unlinkSync2
+} from "fs";
+import { dirname as dirname4, join as join4, resolve as resolve4 } from "path";
+var POSTGRES_DUMP_ENTRY = "postgres/database.dump";
+var POSTGRES_ROLES_ENTRY = "postgres/roles.json";
+var OPTIONS = {
+  backup: /* @__PURE__ */ new Set(["provider", "source", "output", "backup-id", "timeout-ms", "tool-directory"]),
+  verify: /* @__PURE__ */ new Set(["provider", "bundle", "tool-directory"]),
+  restore: /* @__PURE__ */ new Set(["provider", "bundle", "target", "request-id", "timeout-ms", "tool-directory", "accept-source-sql-risk"])
+};
+var FLAGS = {
+  backup: /* @__PURE__ */ new Set(),
+  verify: /* @__PURE__ */ new Set(),
+  restore: /* @__PURE__ */ new Set(["accept-source-sql-risk"])
+};
+var fail2 = (code, message, details) => {
+  throw new NativeDrCommandError(code, message, details);
+};
+function parse2(argv) {
+  const operation = argv[0];
+  if (operation !== "backup" && operation !== "verify" && operation !== "restore") {
+    fail2("INVALID_COMMAND", "usage: agent-bridge dr <backup|verify|restore>");
+  }
+  const selectedOperation = operation;
+  const options = {};
+  for (let index = 1; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (!argument.startsWith("--") || argument === "--") {
+      fail2("INVALID_ARGUMENT", "DR commands do not accept positional arguments");
+    }
+    const name = argument.slice(2);
+    if (!name || name.includes("=") || !OPTIONS[selectedOperation].has(name)) {
+      fail2("INVALID_OPTION", `--${name} is not valid for dr ${selectedOperation}`);
+    }
+    if (options[name] !== void 0) fail2("DUPLICATE_OPTION", `--${name} may only be provided once`);
+    if (FLAGS[selectedOperation].has(name)) {
+      options[name] = true;
+      continue;
+    }
+    const value = argv[index + 1];
+    if (!value || value.startsWith("--")) fail2("MISSING_OPTION_VALUE", `--${name} requires a value`);
+    options[name] = value;
+    index += 1;
+  }
+  return { operation: selectedOperation, options };
+}
+function optional(options, name) {
+  const value = options[name];
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function required3(options, name) {
+  const value = optional(options, name);
+  if (!value) fail2("MISSING_OPTION", `--${name} is required`);
+  return value;
+}
+function timeout(options) {
+  const value = optional(options, "timeout-ms");
+  return value === void 0 ? void 0 : validateNativeDrTimeout(Number(value));
+}
+function provider2(options) {
+  const selected = required3(options, "provider");
+  if (selected !== "local" && selected !== "postgres") fail2("INVALID_PROVIDER", "--provider must be local or postgres");
+  return selected;
+}
+function rejectProviderOption(options, name, selected, operation) {
+  if (options[name] !== void 0) fail2("INVALID_OPTION", `--${name} is not valid for ${selected} DR ${operation}`);
+}
+function syncFile(path) {
+  const before = lstatSync3(path);
+  const noFollow = typeof constants4.O_NOFOLLOW === "number" ? constants4.O_NOFOLLOW : 0;
+  const descriptor = openSync4(path, constants4.O_RDWR | noFollow);
+  try {
+    const opened = fstatSync3(descriptor);
+    const named = lstatSync3(path);
+    if (!opened.isFile() || before.isSymbolicLink() || named.isSymbolicLink() || !sameNode(before, opened) || !sameNode(opened, named)) {
+      fail2("INSECURE_PATH", "DR publication path identity changed before file synchronization");
+    }
+    fsyncSync4(descriptor);
+  } finally {
+    closeSync4(descriptor);
+  }
+}
+function syncDirectory3(path, platform = process.platform) {
+  if (platform === "win32") return false;
+  const descriptor = openSync4(path, constants4.O_RDONLY);
+  try {
+    fsyncSync4(descriptor);
+  } finally {
+    closeSync4(descriptor);
+  }
+  return true;
+}
+function fileOperations(dependencies) {
+  return {
+    link: dependencies.fileOperations?.link ?? linkSync2,
+    syncDirectory: dependencies.fileOperations?.syncDirectory ?? ((path) => syncDirectory3(path, dependencies.platform ?? process.platform)),
+    syncFile: dependencies.fileOperations?.syncFile ?? syncFile,
+    afterPublish: dependencies.fileOperations?.afterPublish
+  };
+}
+function sameNode(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function createPrivateDirectory(path) {
+  mkdirSync3(path, { mode: 448 });
+  const before = lstatSync3(path);
+  securePrivatePath(path, "directory");
+  verifyPrivatePathAccess(path, "directory");
+  const after = lstatSync3(path);
+  if (!before.isDirectory() || before.isSymbolicLink() || !sameNode(before, after)) {
+    fail2("INSECURE_PATH", "DR staging directory identity changed while securing it");
+  }
+  return after;
+}
+function openPrivateFile(path) {
+  const noFollow = typeof constants4.O_NOFOLLOW === "number" ? constants4.O_NOFOLLOW : 0;
+  const descriptor = openSync4(path, constants4.O_RDWR | constants4.O_CREAT | constants4.O_EXCL | noFollow, 384);
+  try {
+    const before = fstatSync3(descriptor);
+    securePrivatePath(path, "file");
+    verifyPrivatePathAccess(path, "file");
+    const after = lstatSync3(path);
+    if (!before.isFile() || after.isSymbolicLink() || !sameNode(before, after)) {
+      fail2("INSECURE_PATH", "DR staging file identity changed while securing it");
+    }
+    return { descriptor, identity: after };
+  } catch (error) {
+    closeSync4(descriptor);
+    throw error;
+  }
+}
+function artifactAnchor(descriptor, sha256) {
+  const stat = fstatSync3(descriptor, { bigint: true });
+  if (!stat.isFile()) fail2("ARTIFACT_ANCHOR_INVALID", "PostgreSQL DR artifact anchor is not a regular file");
+  return {
+    descriptor,
+    device: stat.dev.toString(),
+    inode: stat.ino.toString(),
+    size: stat.size.toString(),
+    ctimeNanoseconds: stat.ctimeNs.toString(),
+    mtimeNanoseconds: stat.mtimeNs.toString(),
+    sha256
+  };
+}
+function extractPostgresBundle(bundle, stage) {
+  const descriptors = /* @__PURE__ */ new Map();
+  try {
+    for (const [name, filename] of [
+      [POSTGRES_DUMP_ENTRY, "postgres-database.dump"],
+      [POSTGRES_ROLES_ENTRY, "postgres-roles.json"]
+    ]) {
+      const path = join4(stage, filename);
+      descriptors.set(name, { ...openPrivateFile(path), path });
+    }
+    const reader = new NativeDrBundleReader(bundle);
+    let metadata;
+    try {
+      metadata = reader.inspect((entry) => descriptors.get(entry.name)?.descriptor);
+    } finally {
+      reader.close();
+    }
+    if (metadata.manifest.kind !== "postgres") {
+      fail2("PROVIDER_MISMATCH", `DR bundle provider is ${metadata.manifest.kind}, not postgres`);
+    }
+    for (const value of descriptors.values()) {
+      const opened = fstatSync3(value.descriptor);
+      const named = lstatSync3(value.path);
+      if (!opened.isFile() || named.isSymbolicLink() || !sameNode(opened, named)) {
+        fail2("INSECURE_PATH", "DR extraction path identity changed while reading the bundle");
+      }
+      fsyncSync4(value.descriptor);
+      securePrivatePath(value.path, "file");
+      verifyPrivatePathAccess(value.path, "file");
+    }
+    const dump = descriptors.get(POSTGRES_DUMP_ENTRY);
+    const roles = descriptors.get(POSTGRES_ROLES_ENTRY);
+    const dumpEntry = metadata.manifest.entries.find((entry) => entry.name === POSTGRES_DUMP_ENTRY);
+    const rolesEntry = metadata.manifest.entries.find((entry) => entry.name === POSTGRES_ROLES_ENTRY);
+    return {
+      metadata,
+      dumpPath: dump.path,
+      rolesPath: roles.path,
+      artifactAnchors: {
+        dump: artifactAnchor(dump.descriptor, dumpEntry.sha256),
+        roles: artifactAnchor(roles.descriptor, rolesEntry.sha256)
+      },
+      descriptors
+    };
+  } catch (error) {
+    for (const value of descriptors.values()) {
+      try {
+        closeSync4(value.descriptor);
+      } catch {
+      }
+    }
+    throw error;
+  }
 }
-function writeJsonConfig(path, identity, instance, backendConfigPath, command) {
-  let config = {};
-  if (existsSync(path)) {
+function closeExtractedPostgresBundle(extracted) {
+  for (const value of extracted.descriptors.values()) {
     try {
-      const parsed = JSON.parse(readFileSync(path, "utf8"));
-      if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") throw new Error();
-      config = parsed;
+      closeSync4(value.descriptor);
     } catch {
-      throw new Error(`Claude Desktop config is not valid JSON: ${path}`);
     }
   }
-  const currentServers = config.mcpServers;
-  const mcpServers = currentServers && !Array.isArray(currentServers) && typeof currentServers === "object" ? currentServers : {};
-  const next = {
-    ...config,
-    mcpServers: {
-      ...mcpServers,
-      "agent-bridge": {
-        command,
-        env: {
-          AGENT_BRIDGE_AGENT: identity,
-          AGENT_BRIDGE_INSTANCE: instance,
-          AGENT_BRIDGE_CONFIG: backendConfigPath
+  extracted.descriptors.clear();
+}
+function removeOwnedFile(path, identity) {
+  if (!existsSync4(path)) return true;
+  try {
+    const current = lstatSync3(path);
+    if (!identity || !current.isFile() || current.isSymbolicLink() || !sameNode(current, identity)) return false;
+    unlinkSync2(path);
+    return !existsSync4(path);
+  } catch {
+    return false;
+  }
+}
+function removeOwnedDirectory(path, identity) {
+  if (!existsSync4(path)) return true;
+  try {
+    const current = lstatSync3(path);
+    if (!identity || !current.isDirectory() || current.isSymbolicLink() || !sameNode(current, identity)) return false;
+    rmSync3(path, { recursive: true });
+    return !existsSync4(path);
+  } catch {
+    return false;
+  }
+}
+function recoveryPaths(paths) {
+  return paths.filter(existsSync4);
+}
+function verifyProviderBundle(path, expected) {
+  const expectedKind = expected === "local" ? "sqlite" : "postgres";
+  const reader = new NativeDrBundleReader(path);
+  try {
+    const metadata = reader.inspect();
+    if (metadata.manifest.kind !== expectedKind) {
+      fail2("PROVIDER_MISMATCH", `DR bundle provider is ${metadata.manifest.kind}, not ${expected}`);
+    }
+    return expected === "local" ? verifyNativeDrBundle(path) : metadata;
+  } finally {
+    reader.close();
+  }
+}
+function commandErrorWithRecovery(error, identity, paths) {
+  const details = error instanceof NativeDrCommandError || error instanceof PostgresNativeDrError ? { ...error.details } : {};
+  const nested = Array.isArray(details.recoveryPaths) ? details.recoveryPaths.filter((path) => typeof path === "string") : [];
+  delete details.recoveryPaths;
+  const retained = recoveryPaths([.../* @__PURE__ */ new Set([...nested, ...paths])]);
+  if (error instanceof NativeDrCommandError) {
+    return new NativeDrCommandError(error.code, error.message, {
+      ...details,
+      ...identity,
+      ...retained.length ? { recoveryPaths: retained } : {}
+    });
+  }
+  if (error instanceof PostgresNativeDrError) {
+    return new NativeDrCommandError(error.code, error.message, {
+      ...details,
+      ...identity,
+      ...retained.length ? { recoveryPaths: retained } : {}
+    });
+  }
+  if (error instanceof PrivatePathError) {
+    return new NativeDrCommandError("INSECURE_PATH", "DR path does not satisfy the private path policy", {
+      ...identity,
+      ...retained.length ? { recoveryPaths: retained } : {}
+    });
+  }
+  if (error instanceof NativeDrBundleError) {
+    return new NativeDrCommandError("INVALID_DR_BUNDLE", "DR bundle verification failed", {
+      ...identity,
+      ...retained.length ? { recoveryPaths: retained } : {}
+    });
+  }
+  return new NativeDrCommandError("DR_COMMAND_FAILED", "DR command failed", {
+    ...identity,
+    ...retained.length ? { recoveryPaths: retained } : {}
+  });
+}
+async function backupPostgresBundle(outputPath, backupId, toolDirectory, dependencies) {
+  const target = resolve4(outputPath);
+  preparePrivateFileLocation(target);
+  const directory = dirname4(target);
+  const stage = join4(directory, `.${backupId}.agent-bridge-dr.postgres.stage`);
+  const bundleStage = join4(directory, `.${backupId}.agent-bridge-dr.bundle.tmp`);
+  const priorRecovery = recoveryPaths([bundleStage, stage]);
+  if (priorRecovery.length) fail2("DR_RECOVERY_REQUIRED", "a prior PostgreSQL DR backup with this ID requires recovery", {
+    backupId,
+    output: target,
+    outputExists: existsSync4(target),
+    published: existsSync4(target) ? "unknown" : false,
+    recoveryPaths: priorRecovery
+  });
+  if (existsSync4(target)) fail2("OUTPUT_EXISTS", "DR output already exists");
+  let stageIdentity;
+  let bundleIdentity;
+  let descriptor;
+  let published = false;
+  let durable = false;
+  let directoryDurability = "confirmed";
+  const operations = fileOperations(dependencies);
+  const platform = dependencies.platform ?? process.platform;
+  try {
+    stageIdentity = createPrivateDirectory(stage);
+    operations.syncDirectory(directory);
+    const input = await (dependencies.backupPostgres ?? backupPostgresNativeDr)({
+      stagingDirectory: stage,
+      backupId,
+      environment: dependencies.environment ?? process.env,
+      ...toolDirectory ? { toolDirectory } : {}
+    });
+    if (input.backupId !== backupId || input.kind !== "postgres" || input.entries.length !== 2 || input.entries[0]?.name !== POSTGRES_DUMP_ENTRY || resolve4(input.entries[0].path) !== join4(stage, "postgres-database.dump") || input.entries[1]?.name !== POSTGRES_ROLES_ENTRY || resolve4(input.entries[1].path) !== join4(stage, "postgres-roles.json")) {
+      fail2("POSTGRES_STAGE_INVALID", "PostgreSQL DR adapter returned an unexpected staging contract");
+    }
+    operations.syncDirectory(stage);
+    const opened = openPrivateFile(bundleStage);
+    descriptor = opened.descriptor;
+    bundleIdentity = opened.identity;
+    writeNativeDrBundle(descriptor, input, bundleStage);
+    closeSync4(descriptor);
+    descriptor = void 0;
+    const verificationStage = join4(stage, "bundle-verification");
+    createPrivateDirectory(verificationStage);
+    const extracted = extractPostgresBundle(bundleStage, verificationStage);
+    try {
+      await (dependencies.verifyPostgres ?? verifyPostgresNativeDrArtifacts)({
+        dumpPath: extracted.dumpPath,
+        rolesPath: extracted.rolesPath,
+        schema: extracted.metadata.manifest.schema,
+        artifactAnchors: extracted.artifactAnchors,
+        ...toolDirectory ? { toolDirectory } : {}
+      });
+    } finally {
+      closeExtractedPostgresBundle(extracted);
+    }
+    const beforePublication = extracted.metadata;
+    try {
+      operations.link(bundleStage, target);
+      published = true;
+    } catch (error) {
+      if (error.code === "EEXIST") fail2("OUTPUT_EXISTS", "DR output already exists");
+      throw error;
+    }
+    const publishedIdentity = lstatSync3(target);
+    if (!bundleIdentity || !publishedIdentity.isFile() || publishedIdentity.isSymbolicLink() || !sameNode(bundleIdentity, publishedIdentity)) {
+      fail2("DR_PUBLICATION_INVALID", "published DR output does not reference the verified staging file", {
+        backupId,
+        output: target,
+        published: true,
+        durable: false,
+        verified: false,
+        recoveryPaths: recoveryPaths([bundleStage, stage])
+      });
+    }
+    try {
+      operations.syncFile(target);
+      operations.afterPublish?.(target);
+      if (!operations.syncDirectory(directory)) {
+        if (platform === "win32") directoryDurability = "unavailable";
+        else {
+          fail2("DR_PUBLICATION_AMBIGUOUS", "DR output is visible but directory durability is unproved", {
+            backupId,
+            output: target,
+            published: true,
+            durable: "unknown",
+            platform,
+            recoveryPaths: recoveryPaths([bundleStage, stage])
+          });
         }
       }
+      durable = true;
+    } catch {
+      fail2("DR_PUBLICATION_AMBIGUOUS", "DR output is visible but durability is unknown", {
+        backupId,
+        output: target,
+        published: true,
+        durable: "unknown",
+        recoveryPaths: recoveryPaths([bundleStage, stage])
+      });
     }
-  };
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  const temporary = `${path}.${process.pid}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(next, null, 2)}
-`, { mode: 384 });
-  renameSync(temporary, path);
+    let publishedMetadata;
+    try {
+      publishedMetadata = verifyProviderBundle(target, "postgres");
+    } catch {
+      fail2("DR_PUBLICATION_INVALID", "published DR output could not be verified", {
+        backupId,
+        output: target,
+        published: true,
+        durable: true,
+        verified: false,
+        recoveryPaths: recoveryPaths([bundleStage, stage])
+      });
+    }
+    if (!publishedMetadata) throw new NativeDrCommandError("DR_PUBLICATION_INVALID", "published DR output could not be verified");
+    if (publishedMetadata.bundleSha256 !== beforePublication.bundleSha256) {
+      fail2("DR_PUBLICATION_INVALID", "published DR output does not match its verified staging bundle", {
+        backupId,
+        output: target,
+        published: true,
+        durable: true,
+        verified: false,
+        recoveryPaths: recoveryPaths([bundleStage, stage])
+      });
+    }
+    const bundleRemoved = removeOwnedFile(bundleStage, bundleIdentity);
+    const stageRemoved = removeOwnedDirectory(stage, stageIdentity);
+    if (!bundleRemoved || !stageRemoved) {
+      fail2("DR_RECOVERY_ARTIFACT_RETAINED", "DR output is valid but a recovery artifact remains", {
+        backupId,
+        output: target,
+        published: true,
+        durable: true,
+        verified: true,
+        recoveryPaths: recoveryPaths([bundleStage, stage])
+      });
+    }
+    try {
+      if (!operations.syncDirectory(directory) && platform !== "win32") {
+        fail2("DR_CLEANUP_DURABILITY_UNKNOWN", "DR output is valid but staging cleanup durability is unproved", {
+          backupId,
+          output: target,
+          published: true,
+          durable: true,
+          verified: true,
+          cleanupDurability: "unproved",
+          platform
+        });
+      }
+    } catch (error) {
+      if (error instanceof NativeDrCommandError) throw error;
+      fail2("DR_CLEANUP_DURABILITY_UNKNOWN", "DR output is valid but staging cleanup durability is unknown", {
+        backupId,
+        output: target,
+        published: true,
+        durable: true,
+        verified: true
+      });
+    }
+    return { metadata: publishedMetadata, directoryDurability };
+  } catch (error) {
+    if (descriptor !== void 0) {
+      closeSync4(descriptor);
+      descriptor = void 0;
+    }
+    if (!published) {
+      removeOwnedFile(bundleStage, bundleIdentity);
+      removeOwnedDirectory(stage, stageIdentity);
+      try {
+        if (!operations.syncDirectory(directory)) {
+          if (platform === "win32") {
+            const primary = commandErrorWithRecovery(error, { backupId }, [bundleStage, stage]);
+            throw new NativeDrCommandError(primary.code, primary.message, {
+              ...primary.details,
+              cleanupDirectoryDurability: "unavailable",
+              platform
+            });
+          }
+          throw new NativeDrCommandError("DR_CLEANUP_DURABILITY_UNKNOWN", "DR backup failure cleanup durability is unproved", {
+            backupId,
+            cleanupDurability: "unproved",
+            platform,
+            recoveryPaths: recoveryPaths([bundleStage, stage])
+          });
+        }
+      } catch (cleanupError) {
+        if (cleanupError instanceof NativeDrCommandError) throw cleanupError;
+        throw new NativeDrCommandError("DR_CLEANUP_DURABILITY_UNKNOWN", "DR backup failure cleanup durability is unknown", {
+          backupId,
+          cleanupDurability: "unknown",
+          platform,
+          recoveryPaths: recoveryPaths([bundleStage, stage])
+        });
+      }
+      throw commandErrorWithRecovery(error, { backupId }, [bundleStage, stage]);
+    }
+    if (error instanceof NativeDrCommandError) throw error;
+    throw new NativeDrCommandError("DR_PUBLICATION_AMBIGUOUS", "DR publication outcome is incomplete", {
+      backupId,
+      output: target,
+      published: true,
+      durable: durable || "unknown",
+      recoveryPaths: recoveryPaths([bundleStage, stage])
+    });
+  } finally {
+    if (descriptor !== void 0) closeSync4(descriptor);
+  }
 }
-function installClient(runtime, identity, options = {}, execute = (command, args) => spawnSync(command, args, { encoding: "utf8" })) {
-  const normalizedIdentity = identity.trim();
-  if (!normalizedIdentity || normalizedIdentity.length > 128) throw new Error("--identity is required");
-  const instance = options.instance?.trim() || `${runtime}-${randomUUID()}`;
-  if (instance.length > 128) throw new Error("--instance exceeds 128 characters");
-  if (options.scope && !["local", "user", "project"].includes(options.scope)) {
-    throw new Error("scope must be local, user, or project");
+async function restorePostgresBundle(bundlePath, requestId2, toolDirectory, dependencies) {
+  const bundle = resolve4(bundlePath);
+  const directory = dirname4(bundle);
+  const stage = join4(directory, `.${requestId2}.agent-bridge-dr.postgres-restore.stage`);
+  if (existsSync4(stage)) fail2("DR_RECOVERY_REQUIRED", "a prior PostgreSQL DR restore with this ID requires recovery", {
+    requestId: requestId2,
+    bundle,
+    recoveryPaths: [stage]
+  });
+  let stageIdentity;
+  let targetRestored = false;
+  const platform = dependencies.platform ?? process.platform;
+  const operations = fileOperations(dependencies);
+  let extracted;
+  try {
+    stageIdentity = createPrivateDirectory(stage);
+    operations.syncDirectory(directory);
+    extracted = extractPostgresBundle(bundle, stage);
+    operations.syncDirectory(stage);
+    const result = await (dependencies.restorePostgres ?? restorePostgresNativeDr)({
+      dumpPath: extracted.dumpPath,
+      rolesPath: extracted.rolesPath,
+      schema: extracted.metadata.manifest.schema,
+      artifactAnchors: extracted.artifactAnchors,
+      acceptSourceSqlRisk: true,
+      environment: dependencies.environment ?? process.env,
+      ...toolDirectory ? { toolDirectory } : {}
+    });
+    targetRestored = true;
+    const metadata = extracted.metadata;
+    closeExtractedPostgresBundle(extracted);
+    extracted = void 0;
+    if (!removeOwnedDirectory(stage, stageIdentity)) {
+      fail2("DR_RECOVERY_ARTIFACT_RETAINED", "PostgreSQL restore completed but a recovery artifact remains", {
+        requestId: requestId2,
+        recoveryPaths: recoveryPaths([stage])
+      });
+    }
+    try {
+      if (!operations.syncDirectory(directory) && platform !== "win32") {
+        fail2("DR_CLEANUP_DURABILITY_UNKNOWN", "PostgreSQL restore completed but cleanup durability is unproved", {
+          requestId: requestId2,
+          targetRestored: true,
+          cleanupDurability: "unproved",
+          platform
+        });
+      }
+    } catch (error) {
+      if (error instanceof NativeDrCommandError) throw error;
+      fail2("DR_CLEANUP_DURABILITY_UNKNOWN", "PostgreSQL restore completed but cleanup durability is unknown", {
+        requestId: requestId2,
+        targetRestored: true,
+        cleanupDurability: "unknown",
+        platform
+      });
+    }
+    return { metadata, result, cleanupDirectoryDurability: platform === "win32" ? "unavailable" : "confirmed" };
+  } catch (error) {
+    if (extracted) {
+      closeExtractedPostgresBundle(extracted);
+      extracted = void 0;
+    }
+    const targetMutated = error instanceof PostgresNativeDrError && (error.details.targetMutated === true || error.details.restoreCompleted === true);
+    if (targetRestored || targetMutated) throw commandErrorWithRecovery(error, { requestId: requestId2 }, [stage]);
+    removeOwnedDirectory(stage, stageIdentity);
+    try {
+      if (!operations.syncDirectory(directory)) {
+        if (platform === "win32") {
+          const primary = commandErrorWithRecovery(error, { requestId: requestId2 }, [stage]);
+          throw new NativeDrCommandError(primary.code, primary.message, {
+            ...primary.details,
+            cleanupDirectoryDurability: "unavailable",
+            platform
+          });
+        }
+        throw new NativeDrCommandError("DR_CLEANUP_DURABILITY_UNKNOWN", "PostgreSQL restore failure cleanup durability is unproved", {
+          requestId: requestId2,
+          cleanupDurability: "unproved",
+          platform,
+          recoveryPaths: recoveryPaths([stage])
+        });
+      }
+    } catch (cleanupError) {
+      if (cleanupError instanceof NativeDrCommandError) throw cleanupError;
+      throw new NativeDrCommandError("DR_CLEANUP_DURABILITY_UNKNOWN", "PostgreSQL restore failure cleanup durability is unknown", {
+        requestId: requestId2,
+        cleanupDurability: "unknown",
+        platform,
+        recoveryPaths: recoveryPaths([stage])
+      });
+    }
+    throw commandErrorWithRecovery(error, { requestId: requestId2 }, [stage]);
   }
-  const command = options.command?.trim() || "agent-bridge-mcp";
-  const env = options.env ?? process.env;
-  const expectedPath = clientBackendConfigPath(runtime, instance, env);
-  const previous = existsSync(expectedPath) ? readFileSync(expectedPath) : void 0;
+}
+async function verifyPostgresBundle(bundlePath, toolDirectory, dependencies) {
+  const bundle = resolve4(bundlePath);
+  const directory = dirname4(bundle);
+  const bundlePathId = createHash3("sha256").update(bundle).digest("hex").slice(0, 32);
+  const stage = join4(directory, `.${bundlePathId}.agent-bridge-dr.postgres-verify.stage`);
+  if (existsSync4(stage)) fail2("DR_RECOVERY_REQUIRED", "a prior PostgreSQL DR verification requires recovery", {
+    bundle,
+    recoveryPaths: [stage]
+  });
+  const platform = dependencies.platform ?? process.platform;
+  const operations = fileOperations(dependencies);
+  let stageIdentity;
+  let extracted;
+  let verificationCompleted = false;
   try {
-    const backendConfigPath = writeBackendConfig(runtime, normalizedIdentity, instance, {
-      token: options.token,
-      env
+    stageIdentity = createPrivateDirectory(stage);
+    extracted = extractPostgresBundle(bundle, stage);
+    await (dependencies.verifyPostgres ?? verifyPostgresNativeDrArtifacts)({
+      dumpPath: extracted.dumpPath,
+      rolesPath: extracted.rolesPath,
+      schema: extracted.metadata.manifest.schema,
+      artifactAnchors: extracted.artifactAnchors,
+      ...toolDirectory ? { toolDirectory } : {}
     });
-    if (runtime === "claude-desktop") {
-      const path = desktopConfigPath(env);
-      writeJsonConfig(path, normalizedIdentity, instance, backendConfigPath, command);
-      return { runtime, identity: normalizedIdentity, instance, method: "json-config", configPath: path, backendConfigPath, restartRequired: true };
+    verificationCompleted = true;
+    const metadata = extracted.metadata;
+    closeExtractedPostgresBundle(extracted);
+    extracted = void 0;
+    if (!removeOwnedDirectory(stage, stageIdentity)) {
+      fail2("DR_RECOVERY_ARTIFACT_RETAINED", "PostgreSQL verification completed but a recovery artifact remains", {
+        backupId: metadata.manifest.backupId,
+        recoveryPaths: recoveryPaths([stage])
+      });
     }
-    const executable = runtime === "codex" ? "codex" : "claude";
-    const args = runtime === "codex" ? [
-      "mcp",
-      "add",
-      "agent-bridge",
-      "--env",
-      `AGENT_BRIDGE_AGENT=${normalizedIdentity}`,
-      "--env",
-      `AGENT_BRIDGE_INSTANCE=${instance}`,
-      "--env",
-      `AGENT_BRIDGE_CONFIG=${backendConfigPath}`,
-      "--",
-      command
-    ] : [
-      "mcp",
-      "add",
-      "--scope",
-      options.scope ?? "user",
-      "agent-bridge",
-      "-e",
-      `AGENT_BRIDGE_AGENT=${normalizedIdentity}`,
-      "-e",
-      `AGENT_BRIDGE_INSTANCE=${instance}`,
-      "-e",
-      `AGENT_BRIDGE_CONFIG=${backendConfigPath}`,
-      "--",
-      command
-    ];
-    const result = execute(executable, args);
-    if (result.error || result.status !== 0) {
-      const detail = result.stderr?.trim() || result.error?.message || `exit ${result.status}`;
-      throw new Error(`${runtime} MCP installation failed: ${detail}`);
+    const durable = operations.syncDirectory(directory);
+    if (!durable && platform !== "win32") {
+      fail2("DR_CLEANUP_DURABILITY_UNKNOWN", "PostgreSQL verification cleanup durability is unproved", {
+        backupId: metadata.manifest.backupId,
+        cleanupDurability: "unproved",
+        platform
+      });
     }
-    return { runtime, identity: normalizedIdentity, instance, method: "native-cli", backendConfigPath, restartRequired: true };
+    return { metadata, cleanupDirectoryDurability: durable ? "confirmed" : "unavailable" };
   } catch (error) {
+    if (extracted) closeExtractedPostgresBundle(extracted);
+    if (verificationCompleted) throw commandErrorWithRecovery(error, {}, [stage]);
+    removeOwnedDirectory(stage, stageIdentity);
     try {
-      if (previous) replacePrivateFile(expectedPath, previous);
-      else rmSync(expectedPath, { force: true });
-    } catch (rollbackError) {
-      const detail = rollbackError instanceof Error ? rollbackError.message : String(rollbackError);
-      throw new Error(`${error instanceof Error ? error.message : String(error)}; client config rollback failed: ${detail}`);
+      operations.syncDirectory(directory);
+    } catch {
     }
-    throw error;
+    throw commandErrorWithRecovery(error, {}, [stage]);
   }
 }
+var success2 = (operation, fields) => ({
+  schemaVersion: 1,
+  status: "ok",
+  operation,
+  ...fields
+});
+async function runDrCommand(argv, dependencies = {}) {
+  const { operation, options } = parse2(argv);
+  try {
+    const selected = provider2(options);
+    if (selected === "local") {
+      rejectProviderOption(options, "tool-directory", selected, operation);
+      rejectProviderOption(options, "accept-source-sql-risk", selected, operation);
+      if (operation === "backup") {
+        const source = required3(options, "source");
+        const output2 = required3(options, "output");
+        const backupId = optional(options, "backup-id") ? validateNativeDrId(required3(options, "backup-id")) : randomUUID5();
+        const metadata3 = await backupLocalSqlite(source, output2, backupId, { timeoutMs: timeout(options) });
+        return success2(operation, {
+          provider: selected,
+          backupId: metadata3.manifest.backupId,
+          createdAt: metadata3.manifest.createdAt,
+          output: resolve4(output2),
+          bundleBytes: metadata3.bundleBytes,
+          bundleSha256: metadata3.bundleSha256
+        });
+      }
+      const bundle2 = required3(options, "bundle");
+      if (operation === "verify") {
+        const metadata3 = verifyProviderBundle(bundle2, selected);
+        return success2(operation, {
+          provider: selected,
+          backupId: metadata3.manifest.backupId,
+          createdAt: metadata3.manifest.createdAt,
+          bundle: resolve4(bundle2),
+          bundleBytes: metadata3.bundleBytes,
+          bundleSha256: metadata3.bundleSha256
+        });
+      }
+      const target = required3(options, "target");
+      const requestId3 = optional(options, "request-id") ? validateNativeDrId(required3(options, "request-id")) : randomUUID5();
+      const metadata2 = await restoreLocalSqlite(bundle2, target, requestId3, { timeoutMs: timeout(options) });
+      return success2(operation, {
+        provider: selected,
+        requestId: metadata2.requestId,
+        backupId: metadata2.manifest.backupId,
+        target: resolve4(target),
+        bundleSha256: metadata2.bundleSha256
+      });
+    }
+    rejectProviderOption(options, "source", selected, operation);
+    rejectProviderOption(options, "target", selected, operation);
+    rejectProviderOption(options, "timeout-ms", selected, operation);
+    const toolDirectory = optional(options, "tool-directory");
+    if (operation === "backup") {
+      const output2 = required3(options, "output");
+      const backupId = validateNativeDrId(required3(options, "backup-id"));
+      const { metadata: metadata2, directoryDurability } = await backupPostgresBundle(output2, backupId, toolDirectory, dependencies);
+      return success2(operation, {
+        provider: selected,
+        backupId: metadata2.manifest.backupId,
+        createdAt: metadata2.manifest.createdAt,
+        output: resolve4(output2),
+        bundleBytes: metadata2.bundleBytes,
+        bundleSha256: metadata2.bundleSha256,
+        directoryDurability,
+        ...directoryDurability === "unavailable" ? { platform: "win32" } : {}
+      });
+    }
+    const bundle = required3(options, "bundle");
+    if (operation === "verify") {
+      const { metadata: metadata2, cleanupDirectoryDurability: cleanupDirectoryDurability2 } = await verifyPostgresBundle(bundle, toolDirectory, dependencies);
+      return success2(operation, {
+        provider: selected,
+        backupId: metadata2.manifest.backupId,
+        createdAt: metadata2.manifest.createdAt,
+        bundle: resolve4(bundle),
+        bundleBytes: metadata2.bundleBytes,
+        bundleSha256: metadata2.bundleSha256,
+        cleanupDirectoryDurability: cleanupDirectoryDurability2,
+        ...cleanupDirectoryDurability2 === "unavailable" ? { platform: "win32" } : {}
+      });
+    }
+    if (options["accept-source-sql-risk"] !== true) {
+      fail2("SOURCE_SQL_RISK_NOT_ACCEPTED", "PostgreSQL native restore requires --accept-source-sql-risk");
+    }
+    const requestId2 = validateNativeDrId(required3(options, "request-id"));
+    const { metadata, result, cleanupDirectoryDurability } = await restorePostgresBundle(bundle, requestId2, toolDirectory, dependencies);
+    return success2(operation, {
+      provider: selected,
+      requestId: requestId2,
+      backupId: metadata.manifest.backupId,
+      bundleSha256: metadata.bundleSha256,
+      databaseName: result.databaseName,
+      normalizedClaimedDeliveries: result.normalizedClaimedDeliveries,
+      tableCounts: result.tableCounts,
+      readiness: result.readiness,
+      cleanupDirectoryDurability,
+      ...cleanupDirectoryDurability === "unavailable" ? { platform: "win32" } : {}
+    });
+  } catch (error) {
+    if (error instanceof NativeDrCommandError) throw error;
+    if (error instanceof PostgresNativeDrError) throw new NativeDrCommandError(error.code, error.message, error.details);
+    if (error instanceof PrivatePathError) fail2("INSECURE_PATH", "DR path does not satisfy the private path policy");
+    if (error instanceof NativeDrBundleError) fail2("INVALID_DR_BUNDLE", "DR bundle verification failed");
+    fail2("DR_COMMAND_FAILED", "DR command failed");
+  }
+  throw new NativeDrCommandError("DR_COMMAND_FAILED", "DR command failed");
+}
 
 // src/cli.ts
 var SUPPORTED_OPTIONS = /* @__PURE__ */ new Set([
@@ -226,6 +3233,10 @@ var SUPPORTED_OPTIONS = /* @__PURE__ */ new Set([
   "db",
   "dead",
   "delivery-id",
+  "delivery-max-attempts",
+  "delivery-mode",
+  "delivery-policy",
+  "disposition",
   "error",
   "expires-at",
   "force",
@@ -244,6 +3255,7 @@ var SUPPORTED_OPTIONS = /* @__PURE__ */ new Set([
   "max-interval-ms",
   "message-id",
   "metadata",
+  "not-before",
   "payload",
   "payload-ciphertext",
   "payload-mime",
@@ -264,16 +3276,40 @@ var SUPPORTED_OPTIONS = /* @__PURE__ */ new Set([
   "unacked-by",
   "url",
   "workspace",
+  "mailbox",
+  "receipt-state",
   "identity",
   "command",
   "scope",
+  "recipient",
+  "retry-base-ms",
+  "retry-jitter",
+  "retry-max-ms",
+  "role",
   "runtime",
   "capability",
+  "state",
   "max-pages",
-  "max-push"
+  "max-push",
+  "latest",
+  "apply",
+  "display-name",
+  "enrollment-file",
+  "credential-id",
+  "gateway-url",
+  "grace-until",
+  "invalidate-immediately",
+  "label",
+  "reason",
+  "request-id",
+  "resume",
+  "runtime-type",
+  "recover-lock",
+  "scope-set",
+  "workspace-name"
 ]);
-var BOOLEAN_OPTIONS = /* @__PURE__ */ new Set(["dead", "force", "json"]);
-function parse(argv) {
+var BOOLEAN_OPTIONS2 = /* @__PURE__ */ new Set(["apply", "dead", "force", "invalidate-immediately", "json", "latest", "recover-lock"]);
+function parse3(argv) {
   const command = argv[0] ?? "help";
   const options = {};
   const positionals = [];
@@ -286,7 +3322,7 @@ function parse(argv) {
     const key = value.slice(2);
     const next = argv[i + 1];
     if (!next || next.startsWith("--")) {
-      if (!BOOLEAN_OPTIONS.has(key)) throw new Error(`--${key} requires a value`);
+      if (!BOOLEAN_OPTIONS2.has(key)) throw new Error(`--${key} requires a value`);
       options[key] = true;
     } else {
       i++;
@@ -330,57 +3366,140 @@ function json(options, key) {
 function since(options) {
   const raw = one(options, "since");
   if (!raw) return void 0;
-  const relative = raw.match(/^(\d+)(h|d)$/);
-  if (!relative) return raw;
-  const amount = Number(relative[1]);
-  const milliseconds = amount * (relative[2] === "h" ? 36e5 : 864e5);
+  const relative2 = raw.match(/^(\d+)(h|d)$/);
+  if (!relative2) return raw;
+  const amount = Number(relative2[1]);
+  const milliseconds = amount * (relative2[2] === "h" ? 36e5 : 864e5);
   return new Date(Date.now() - milliseconds).toISOString();
 }
 function output(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 }
+function cliOutput(operationId, value, invocation) {
+  output(parseCliResponse(operationId, value, invocation));
+}
+function failedClientStatus(config, error, failure) {
+  const schemaVersion = config.provider === "legacy-supabase" ? "legacy-v1" : config.provider === "gateway" ? "postgres-v2" : "local-v2";
+  const remote = config.provider === "local" || !failure.remoteAttempted ? null : false;
+  const localHealthy = failure.component !== "local-store";
+  const code = error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : "diagnostics_failed";
+  cliOutput("client_status", {
+    status: "failed",
+    localHealthy,
+    connected: false,
+    remoteReachable: remote,
+    provider: config.provider,
+    workspace: config.principal.workspace,
+    agent: config.principal.agent,
+    instance: config.principal.instance ?? null,
+    schemaVersion,
+    endpoint: config.url ?? null,
+    database: config.provider === "local" ? config.databasePath : null,
+    cursorPath: config.cursorPath,
+    lastCursor: cursor(config.cursorPath) ?? null,
+    queue: { schemaVersion, deliverySupported: false, pending: null, claimed: null, retrying: null, dead: null },
+    checks: [{ name: failure.component, status: "failed", message: `${failure.component} diagnostics failed (${code})` }]
+  });
+}
 function cursor(path) {
   try {
-    return readFileSync2(path, "utf8").trim() || void 0;
+    return readFileSync3(path, "utf8").trim() || void 0;
   } catch {
     return void 0;
   }
 }
+function preparePrivateOutput(path) {
+  const directory = dirname5(path);
+  const existed = existsSync5(directory);
+  mkdirSync4(directory, { recursive: true, mode: 448 });
+  if (!existed || basename(directory) === ".agent-bridge") securePrivatePath(directory, "directory");
+  else verifyPrivatePathAccess(directory, "directory");
+  if (existsSync5(path)) verifyPrivatePathAccess(path, "file");
+}
 function saveCursor(path, value) {
   if (!value) return;
-  mkdirSync2(dirname2(path), { recursive: true });
+  preparePrivateOutput(path);
   const temporary = `${path}.${process.pid}.tmp`;
-  writeFileSync2(temporary, `${value}
+  try {
+    writeFileSync3(temporary, `${value}
 `, { mode: 384 });
-  renameSync2(temporary, path);
+    securePrivatePath(temporary, "file");
+    renameSync4(temporary, path);
+    verifyPrivatePathAccess(path, "file");
+  } catch (error) {
+    rmSync4(temporary, { force: true });
+    throw error;
+  }
+}
+function watchCursorPath(path, project) {
+  if (!project) return path;
+  const scope = createHash4("sha256").update(project).digest("hex").slice(0, 16);
+  return `${path}.project-${scope}`;
+}
+function packageVersion() {
+  const manifest = JSON.parse(readFileSync3(fileURLToPath2(new URL("../package.json", import.meta.url)), "utf8"));
+  if (typeof manifest.version !== "string" || !manifest.version) throw new Error("package version is unavailable");
+  return manifest.version;
 }
 function help() {
   process.stdout.write(`agent-bridge: provider-neutral agent messaging
 
 Commands:
-  init, doctor, status, pending, migrate, sync, demo, join, presence
-  send (post), inbox (get), history, acknowledge, claim, extend, ack, nack, watch
+  init, doctor, status, capabilities, pending, migrate, reconcile-legacy-projects, sync, demo, join, presence
+  send (post), inbox (get), sent, history, acknowledge, claim, extend, ack, nack, watch
+  deliveries, dead-letters, delivery-events, cancel, requeue
+  owner <provision|inventory|rotate|revoke>
+  archive <export|verify|import>
+  dr <backup|verify|restore>
   clients install <codex|claude-code|claude-desktop> --identity <name>
+
+Options:
+  -V, --version  Print the installed package version
+  -h, --help     Show this help
 `);
 }
 function rejectUnknownOptions(options) {
   const unknown = Object.keys(options).filter((key) => !SUPPORTED_OPTIONS.has(key));
   if (unknown.length) throw new Error(`unknown option: --${unknown[0]}`);
 }
+function rejectOptionsOutside(options, allowed, command) {
+  const invalid = Object.keys(options).find((key) => !allowed.has(key));
+  if (invalid) throw new Error(`--${invalid} is not valid for ${command}`);
+}
+var CLI_CONTEXT_OPTIONS = /* @__PURE__ */ new Set([
+  "agent",
+  "as",
+  "config",
+  "db",
+  "instance",
+  "json",
+  "key",
+  "provider",
+  "token",
+  "url",
+  "workspace"
+]);
+function validateCanonicalCommandOptions(command, options, config) {
+  const contract = operationForCli(command, config.provider, Object.keys(options));
+  if (!contract?.cli) return;
+  const allowed = /* @__PURE__ */ new Set([...CLI_CONTEXT_OPTIONS, ...contract.cli.options]);
+  const invalid = Object.keys(options).find((key) => !allowed.has(key));
+  if (invalid) throw new Error(`--${invalid} is not valid for ${command}`);
+}
 async function initialize(options) {
-  const home = process.env.HOME ?? homedir2();
-  const configPath = one(options, "config") ?? process.env.AGENT_BRIDGE_CONFIG ?? join2(home, ".agent-bridge", "config");
-  if (existsSync2(configPath) && !boolean(options, "force")) {
+  const home2 = process.env.HOME ?? homedir4();
+  const configPath = one(options, "config") ?? process.env.AGENT_BRIDGE_CONFIG ?? join5(home2, ".agent-bridge", "config");
+  if (existsSync5(configPath) && !boolean(options, "force")) {
     throw new Error(`Config already exists at ${configPath}; pass --force to replace it`);
   }
-  const provider = one(options, "provider") ?? process.env.AGENT_BRIDGE_PROVIDER ?? "local";
+  const provider3 = one(options, "provider") ?? process.env.AGENT_BRIDGE_PROVIDER ?? "local";
   if (one(options, "instance")) {
     throw new Error("--instance is client-scoped; set it in the active client process");
   }
   const values = {
-    AGENT_BRIDGE_PROVIDER: provider,
-    AGENT_BRIDGE_WORKSPACE: one(options, "workspace") ?? process.env.AGENT_BRIDGE_WORKSPACE ?? (provider === "legacy-supabase" || provider === "legacy" || provider === "supabase" ? "*" : "default"),
+    AGENT_BRIDGE_PROVIDER: provider3,
+    AGENT_BRIDGE_WORKSPACE: one(options, "workspace") ?? process.env.AGENT_BRIDGE_WORKSPACE ?? (provider3 === "legacy-supabase" || provider3 === "legacy" || provider3 === "supabase" ? "*" : "default"),
     AGENT_BRIDGE_DB: one(options, "db") ?? process.env.AGENT_BRIDGE_DB,
     AGENT_BRIDGE_EDGE_DB: process.env.AGENT_BRIDGE_EDGE_DB,
     AGENT_BRIDGE_URL: one(options, "url") ?? process.env.AGENT_BRIDGE_URL,
@@ -390,49 +3509,65 @@ async function initialize(options) {
   for (const value of Object.values(values)) {
     if (value?.includes("\n") || value?.includes("\r")) throw new Error("config values cannot contain newlines");
   }
-  mkdirSync2(dirname2(configPath), { recursive: true });
+  preparePrivateOutput(configPath);
   const temporary = `${configPath}.${process.pid}.tmp`;
-  writeFileSync2(
-    temporary,
-    Object.entries(values).filter((entry) => Boolean(entry[1])).map(([key, value]) => `${key}=${value}`).join("\n") + "\n",
-    { mode: 384 }
-  );
   let config;
   try {
+    writeFileSync3(
+      temporary,
+      Object.entries(values).filter((entry) => Boolean(entry[1])).map(([key, value]) => `${key}=${value}`).join("\n") + "\n",
+      { mode: 384 }
+    );
+    securePrivatePath(temporary, "file");
     config = resolveClientConfig(
       {
-        HOME: home,
+        HOME: home2,
         AGENT_BRIDGE_CONFIG: temporary,
         AGENT_BRIDGE_TOKEN: verificationToken
       },
       "agent-bridge-init"
     );
-    const runtime = await createClientRuntime(config);
+    const runtime2 = await createClientRuntime(config);
     try {
-      if (config.provider === "gateway") await runtime.store.verifyRemote?.();
+      if (config.provider === "gateway") await runtime2.store.verifyRemote?.();
     } finally {
-      await runtime.close();
+      await runtime2.close();
     }
-    renameSync2(temporary, configPath);
+    renameSync4(temporary, configPath);
+    verifyPrivatePathAccess(configPath, "file");
   } catch (error) {
-    rmSync2(temporary, { force: true });
+    rmSync4(temporary, { force: true });
     throw error;
   }
   output({ status: "ok", config: configPath, provider: config.provider, workspace: config.principal.workspace, identity: "process-scoped", database: config.provider === "local" ? config.databasePath : null });
 }
 function configFor(options, command) {
   const explicit = command === "send" ? one(options, "source") ?? one(options, "agent") : command === "acknowledge" || command === "ack" && Boolean(one(options, "ids")) ? one(options, "agent") : one(options, "as");
-  const project = one(options, "project");
-  const environment = one(options, "instance") ? { ...process.env, AGENT_BRIDGE_INSTANCE: one(options, "instance") } : process.env;
+  const environment = {
+    ...process.env,
+    ...one(options, "config") ? { AGENT_BRIDGE_CONFIG: one(options, "config") } : {},
+    ...one(options, "provider") ? { AGENT_BRIDGE_PROVIDER: one(options, "provider") } : {},
+    ...one(options, "db") ? { AGENT_BRIDGE_DB: one(options, "db") } : {},
+    ...one(options, "url") ? { AGENT_BRIDGE_URL: one(options, "url") } : {},
+    ...one(options, "key") ? { AGENT_BRIDGE_KEY: one(options, "key") } : {},
+    ...one(options, "token") ? { AGENT_BRIDGE_TOKEN: one(options, "token") } : {},
+    ...one(options, "instance") ? { AGENT_BRIDGE_INSTANCE: one(options, "instance") } : {}
+  };
   const config = resolveClientConfig(environment, explicit);
-  if (!project || project === config.principal.workspace) return config;
-  if (config.provider === "gateway") {
-    throw new Error("--project cannot override the workspace bound to a gateway credential");
+  const assertedWorkspace = one(options, "workspace");
+  if (config.provider === "gateway" && assertedWorkspace && assertedWorkspace !== config.principal.workspace) {
+    throw new Error("--workspace must match the workspace bound to the gateway credential");
   }
-  return resolveClientConfig(
-    { ...environment, AGENT_BRIDGE_WORKSPACE: project },
-    explicit
-  );
+  if (config.provider === "legacy-supabase" && assertedWorkspace && assertedWorkspace !== "*") {
+    throw new Error("--workspace is not supported by the global legacy Supabase schema");
+  }
+  if (config.provider === "local" && assertedWorkspace && assertedWorkspace !== config.principal.workspace) {
+    return resolveClientConfig(
+      { ...environment, AGENT_BRIDGE_WORKSPACE: assertedWorkspace },
+      explicit
+    );
+  }
+  return config;
 }
 function draft(options, positionals) {
   const content = one(options, "content") ?? positionals.join(" ");
@@ -443,7 +3578,12 @@ function draft(options, positionals) {
   if (one(options, "payload-ref")) envelope.payload_ref = one(options, "payload-ref");
   if (one(options, "payload-ciphertext")) envelope.payload_ciphertext = one(options, "payload-ciphertext");
   if (Object.keys(envelope).length) metadata.message_envelope = envelope;
+  const deliveryMode = one(options, "delivery-mode");
+  const deliveryTuning = ["delivery-max-attempts", "retry-base-ms", "retry-max-ms", "retry-jitter", "not-before"].some((key) => one(options, key) !== void 0);
+  if (deliveryTuning && !deliveryMode) throw new Error("--delivery-mode is required with delivery policy flags");
+  if (deliveryMode === "mailbox" && deliveryTuning) throw new Error("mailbox delivery mode does not accept retry or scheduling flags");
   return {
+    project: one(options, "project"),
     type: one(options, "type") ?? one(options, "kind") ?? one(options, "category") ?? "operational",
     content,
     targets: [...list(options, "target"), ...list(options, "target-agent"), ...list(options, "target-agents")],
@@ -459,13 +3599,15 @@ function draft(options, positionals) {
     atribReceiptId: one(options, "atrib-receipt-id"),
     informedBy: list(options, "informed-by"),
     data: json(options, "data") ?? json(options, "payload"),
-    metadata
+    metadata,
+    deliveryPolicy: json(options, "delivery-policy") ?? (deliveryMode ? deliveryMode === "mailbox" ? { mode: "mailbox" } : { mode: deliveryMode, maxAttempts: integer(options, "delivery-max-attempts", 5), retryBaseDelayMs: integer(options, "retry-base-ms", 1e3), retryMaxDelayMs: integer(options, "retry-max-ms", 6e4), retryJitterRatio: Number(one(options, "retry-jitter") ?? 0.2), notBefore: one(options, "not-before") } : void 0)
   };
 }
 async function localDemo() {
-  const directory = mkdtempSync(join2(tmpdir(), "agent-bridge-demo-"));
-  const databasePath = join2(directory, "demo.sqlite3");
-  const base = { provider: "local", databasePath, edgeDatabasePath: join2(directory, "edge.sqlite3"), cursorPath: join2(directory, "cursor"), configPath: join2(directory, "config"), credential: void 0, url: void 0 };
+  const directory = mkdtempSync(join5(tmpdir(), "agent-bridge-demo-"));
+  const databasePath = join5(directory, "demo.sqlite3");
+  securePrivatePath(directory, "directory");
+  const base = { provider: "local", databasePath, edgeDatabasePath: join5(directory, "edge.sqlite3"), cursorPath: join5(directory, "cursor"), configPath: join5(directory, "config"), credential: void 0, url: void 0 };
   let sender;
   let worker;
   try {
@@ -482,34 +3624,70 @@ async function localDemo() {
   } finally {
     await worker?.close();
     await sender?.close();
-    rmSync2(directory, { recursive: true, force: true });
+    rmSync4(directory, { recursive: true, force: true });
   }
 }
 async function runCli(argv = process.argv.slice(2)) {
-  const { command: raw, options, positionals } = parse(argv);
+  if (argv[0] === "archive") {
+    output(await runArchiveCommand(argv.slice(1), process.env));
+    return;
+  }
+  if (argv[0] === "dr") {
+    output(await runDrCommand(argv.slice(1)));
+    return;
+  }
+  const { command: raw, options, positionals } = parse3(argv);
   const command = { post: "send", get: "inbox", receipt: "acknowledge" }[raw] ?? raw;
+  if (["-V", "--version"].includes(command)) {
+    process.stdout.write(`${packageVersion()}
+`);
+    return;
+  }
   if (["help", "-h", "--help"].includes(command)) {
     help();
     return;
   }
   rejectUnknownOptions(options);
+  if (command === "owner") {
+    if (positionals.length !== 1) {
+      throw new Error("usage: agent-bridge owner <provision|inventory|rotate|revoke>");
+    }
+    const ownerOptions = {};
+    for (const [key, value] of Object.entries(options)) {
+      if (Array.isArray(value)) throw new Error("--" + key + " may only be provided once");
+      ownerOptions[key] = value;
+    }
+    output(await runOwnerCommand(positionals[0], ownerOptions, process.env));
+    return;
+  }
   if (command === "clients") {
-    if (positionals[0] !== "install" || !positionals[1]) {
+    if (positionals.length !== 2 || positionals[0] !== "install" || !positionals[1]) {
       throw new Error("usage: agent-bridge clients install <runtime> --identity <name>");
     }
-    const runtime2 = positionals[1];
-    if (!["codex", "claude-code", "claude-desktop"].includes(runtime2)) {
-      throw new Error(`unsupported install runtime: ${runtime2}`);
+    rejectOptionsOutside(options, /* @__PURE__ */ new Set([
+      "identity",
+      "command",
+      "scope",
+      "instance",
+      "token",
+      "enrollment-file",
+      "recover-lock"
+    ]), "clients install");
+    const runtime3 = positionals[1];
+    if (runtime3 && !["codex", "claude-code", "claude-desktop"].includes(runtime3)) {
+      throw new Error(`unsupported install runtime: ${runtime3}`);
     }
     const scope = one(options, "scope");
     if (scope && !["local", "user", "project"].includes(scope)) {
       throw new Error("--scope must be local, user, or project");
     }
-    output(installClient(runtime2, one(options, "identity") ?? "", {
+    output(installClient(runtime3, one(options, "identity") ?? "", {
       command: one(options, "command"),
       scope,
       instance: one(options, "instance"),
       token: one(options, "token"),
+      enrollmentFile: one(options, "enrollment-file"),
+      recoverLock: boolean(options, "recover-lock"),
       env: process.env
     }));
     return;
@@ -525,11 +3703,11 @@ async function runCli(argv = process.argv.slice(2)) {
   if (command === "migrate") {
     const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;
     if (!databaseUrl) throw new Error("AGENT_BRIDGE_DATABASE_URL is required");
-    const pool = new pg.Pool({ connectionString: databaseUrl, max: 1 });
+    const pool = new pg3.Pool({ connectionString: databaseUrl, max: 1 });
     try {
       const applied = await runMigrations(
         pool,
-        fileURLToPath(new URL("../sql/migrations", import.meta.url))
+        fileURLToPath2(new URL("../sql/migrations", import.meta.url))
       );
       output({ status: "ok", applied });
     } finally {
@@ -537,19 +3715,99 @@ async function runCli(argv = process.argv.slice(2)) {
     }
     return;
   }
+  if (command === "reconcile-legacy-projects") {
+    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;
+    if (!databaseUrl) throw new Error("AGENT_BRIDGE_DATABASE_URL is required");
+    const pool = new pg3.Pool({ connectionString: databaseUrl, max: 1 });
+    try {
+      const directory = fileURLToPath2(new URL("../sql/migrations", import.meta.url));
+      const migration = (await loadMigrationPlan(directory)).find((entry) => entry.version === 8);
+      if (!migration || migration.name !== "message_projects") {
+        throw new Error("migration 008_message_projects is missing from the migration plan");
+      }
+      output(await reconcileLegacyProjects(pool, {
+        apply: boolean(options, "apply"),
+        migrationChecksum: migration.checksum
+      }));
+    } finally {
+      await pool.end();
+    }
+    return;
+  }
   const config = configFor(options, command);
-  const runtime = await createClientRuntime(config);
+  validateCanonicalCommandOptions(raw, options, config);
+  const assertedUnackedBy = one(options, "unacked-by");
+  if (assertedUnackedBy !== void 0 && assertedUnackedBy !== config.principal.agent) throw new Error("--unacked-by must equal the configured principal");
+  if (command === "capabilities") {
+    validateRequest("capabilities", {});
+    cliOutput("capabilities", capabilityDocument({ surface: "cli", provider: config.provider }));
+    return;
+  }
+  let runtime2;
+  try {
+    runtime2 = await createClientRuntime(config, {
+      autoSync: command !== "doctor" && command !== "status",
+      initializationMode: command === "status" ? "passive" : "active"
+    });
+  } catch (error) {
+    if (command !== "doctor" && command !== "status") throw error;
+    const remoteInitialization = command === "doctor" && config.provider === "legacy-supabase";
+    failedClientStatus(config, error, {
+      component: remoteInitialization ? "remote" : "local-store",
+      remoteAttempted: remoteInitialization
+    });
+    process.exitCode = 1;
+    return;
+  }
   try {
     if (command === "doctor" || command === "status") {
-      const diagnostics = await runtime.store.diagnostics?.(config.principal) ?? { schemaVersion: config.provider === "legacy-supabase" ? "legacy-v1" : "local-v2", deliverySupported: false, pending: null, claimed: null, retrying: null, dead: null };
-      output({ status: "ok", connected: true, provider: config.provider, workspace: config.principal.workspace, agent: config.principal.agent, instance: config.principal.instance ?? null, schemaVersion: diagnostics.schemaVersion, endpoint: config.url ?? null, database: config.provider === "local" ? config.databasePath : null, cursorPath: config.cursorPath, lastCursor: cursor(config.cursorPath) ?? null, queue: diagnostics });
+      validateRequest("client_status", {});
+      const active = command === "doctor";
+      try {
+        const diagnostics = await runtime2.store.diagnostics?.(config.principal, { mode: active ? "probe" : "snapshot" }) ?? { schemaVersion: config.provider === "legacy-supabase" ? "legacy-v1" : "local-v2", deliverySupported: false, pending: null, claimed: null, retrying: null, dead: null };
+        const remoteReachable = "remoteReachable" in diagnostics ? diagnostics.remoteReachable ?? null : active && config.provider === "legacy-supabase" ? true : null;
+        const checks = [{
+          name: "local-store",
+          status: "ok",
+          message: "local diagnostics are readable"
+        }];
+        if (config.provider !== "local") {
+          const provider3 = config.provider === "gateway" ? "gateway" : "legacy provider";
+          const remoteError2 = "remoteError" in diagnostics && typeof diagnostics.remoteError === "string" ? diagnostics.remoteError : void 0;
+          checks.push({
+            name: "remote",
+            status: remoteReachable === false ? "degraded" : remoteError2 ? "failed" : remoteReachable === true ? "ok" : "unknown",
+            message: remoteReachable === false ? `${provider3} is unreachable` : remoteError2 ? `${provider3} rejected diagnostics (${remoteError2})` : remoteReachable === true ? `${provider3} is reachable` : `${provider3} reachability has not been checked`
+          });
+        }
+        const blocked = "outboxBlocked" in diagnostics ? Number(diagnostics.outboxBlocked ?? 0) : 0;
+        checks.push({ name: "blocked-outbox", status: blocked > 0 ? "degraded" : "ok", message: blocked > 0 ? `${blocked} outbound message(s) require intervention` : "no blocked outbound messages" });
+        const expired = Number(diagnostics.expiredLeases ?? 0);
+        checks.push({ name: "expired-leases", status: expired > 0 ? "degraded" : "ok", message: expired > 0 ? `${expired} delivery lease(s) are expired` : "no expired delivery leases" });
+        const dead = Number(diagnostics.dead ?? 0);
+        checks.push({ name: "dead-deliveries", status: dead > 0 ? "degraded" : "ok", message: dead > 0 ? `${dead} dead delivery/deliveries are visible` : "no dead deliveries" });
+        const status = checks.some((check) => check.status === "failed") ? "failed" : checks.some((check) => check.status === "degraded") ? "degraded" : checks.some((check) => check.status === "unknown") ? "unknown" : "ok";
+        const remoteError = "remoteError" in diagnostics && typeof diagnostics.remoteError === "string";
+        const connected = config.provider === "local" ? true : remoteReachable === true && !remoteError;
+        const queue = { ...diagnostics };
+        delete queue.syncLoopState;
+        delete queue.syncLoopError;
+        cliOutput("client_status", { status, localHealthy: true, connected, remoteReachable, provider: config.provider, workspace: config.principal.workspace, agent: config.principal.agent, instance: config.principal.instance ?? null, schemaVersion: diagnostics.schemaVersion, endpoint: config.url ?? null, database: config.provider === "local" ? config.databasePath : null, cursorPath: config.cursorPath, lastCursor: cursor(config.cursorPath) ?? null, queue, checks });
+        if (active && status !== "ok") process.exitCode = status === "failed" ? 1 : 2;
+      } catch (error) {
+        failedClientStatus(config, error, { component: "local-store" });
+        process.exitCode = 1;
+      }
       return;
     }
     if (command === "pending") {
-      const diagnostics = await runtime.store.diagnostics?.(config.principal);
-      const page = await runtime.service.history(config.principal, {
+      const diagnostics = await runtime2.store.diagnostics?.(config.principal, {
+        mode: config.provider === "gateway" ? "probe" : "snapshot"
+      });
+      const page = await runtime2.service.history(config.principal, {
         limit: 1,
-        unacknowledgedBy: config.principal.agent
+        project: one(options, "project"),
+        receiptState: "unread"
       });
       const pendingDeliveries = diagnostics?.pending ?? 0;
       const retryingDeliveries = diagnostics?.retrying ?? 0;
@@ -557,55 +3815,91 @@ async function runCli(argv = process.argv.slice(2)) {
       const deliveryAvailable = pendingDeliveries > 0 || retryingDeliveries > 0 && oldest <= Date.now();
       const unread = page.messages.length > 0;
       const available = deliveryAvailable || unread;
+      const diagnosticsAuthoritative = !diagnostics || !("remoteReachable" in diagnostics) || diagnostics.remoteReachable === true;
+      const pageAuthority = page;
+      const historyAuthoritative = pageAuthority.acknowledgements !== "unknown" && pageAuthority.source !== "cache" && pageAuthority.stale !== true;
+      const authoritative = diagnosticsAuthoritative && historyAuthoritative;
       output({
         available,
         unread,
         deliveryAvailable,
         pending: pendingDeliveries,
         retrying: retryingDeliveries,
-        authoritative: !diagnostics || !("remoteReachable" in diagnostics) || diagnostics.remoteReachable !== false
+        authoritative,
+        state: available ? "available" : authoritative ? "empty" : "unknown"
       });
-      if (!available) process.exitCode = 1;
+      if (!available) process.exitCode = authoritative ? 1 : 2;
       return;
     }
     if (command === "send") {
-      output(await runtime.service.publish(config.principal, draft(options, positionals)));
+      const message = draft(options, positionals);
+      validateRequest("publish_message", { ...message, source: one(options, "source") });
+      cliOutput("publish_message", await runtime2.service.publish(config.principal, message));
       return;
     }
     if (command === "join") {
-      output(await runtime.service.heartbeat(config.principal, { leaseMs: integer(options, "lease-ms", 6e4), runtimeType: one(options, "runtime"), capabilities: list(options, "capability") }));
+      const input = validateRequest("heartbeat", { leaseMs: integer(options, "lease-ms", 6e4), runtimeType: one(options, "runtime"), capabilities: list(options, "capability") });
+      cliOutput("heartbeat", await runtime2.service.heartbeat(config.principal, input));
       return;
     }
     if (command === "presence") {
-      output({ agents: await runtime.service.presence(config.principal) });
+      validateRequest("presence", {});
+      cliOutput("presence", { agents: await runtime2.service.presence(config.principal) });
       return;
     }
     if (command === "sync") {
-      if (!runtime.store.sync) throw new Error("sync is available only with the gateway provider");
-      output(await runtime.store.sync({
+      if (!runtime2.store.sync) throw new Error("sync is available only with the gateway provider");
+      const input = validateRequest("sync", {
         maxPush: integer(options, "max-push", integer(options, "limit", 100)),
         maxPages: integer(options, "max-pages", 20)
-      }));
+      });
+      cliOutput("sync", await runtime2.store.sync(input));
       return;
     }
-    if (command === "history" || command === "inbox") {
-      const page = await runtime.service.history(config.principal, { cursor: one(options, "cursor"), limit: integer(options, "limit", 20), types: list(options, "type").concat(list(options, "category")), source: one(options, "source"), since: since(options), unacknowledgedBy: one(options, "unacked-by"), threadId: one(options, "thread-id"), latest: raw === "get" });
+    if (command === "history" || command === "inbox" || command === "sent") {
+      const query = validateRequest("history", { cursor: one(options, "cursor"), limit: integer(options, "limit", 20), types: list(options, "type").concat(list(options, "category")), source: one(options, "source"), project: one(options, "project"), since: since(options), mailbox: command === "inbox" ? "inbox" : command === "sent" ? "sent" : one(options, "mailbox"), receiptState: one(options, "receipt-state"), unacknowledgedBy: assertedUnackedBy, threadId: one(options, "thread-id"), latest: raw === "get" || boolean(options, "latest") });
+      const page = await runtime2.service.history(config.principal, query);
       if (raw === "get") {
-        output(page.messages.map((message) => ({ id: config.provider === "legacy-supabase" ? Number(message.sequence) : message.id, source: message.source, category: message.type, content: message.content, priority: message.priority, project: message.workspace === "*" ? null : message.workspace, metadata: legacyContextMetadata(message), created_at: message.createdAt })));
-      } else output(page);
+        cliOutput("history", page.messages.map((message) => ({ id: config.provider === "legacy-supabase" ? Number(message.sequence) : message.id, source: message.source, category: message.type, content: message.content, priority: message.priority, project: message.project ?? null, metadata: legacyContextMetadata(message), created_at: message.createdAt })), { command: raw, optionNames: Object.keys(options) });
+      } else cliOutput("history", page);
       return;
     }
     if (command === "acknowledge" || command === "ack" && one(options, "ids")) {
       const rawIds = list(options, "ids");
-      const acknowledged = config.provider === "legacy-supabase" && runtime.store.recordLegacyReceipt && rawIds.every((id) => /^\d+$/.test(id)) ? await runtime.store.recordLegacyReceipt(rawIds, config.principal.agent) : await runtime.service.acknowledge(
+      validateRequest("record_receipt", { messageIds: rawIds });
+      const acknowledged = config.provider === "legacy-supabase" && runtime2.store.recordLegacyReceipt && rawIds.every((id) => /^\d+$/.test(id)) ? await runtime2.store.recordLegacyReceipt(rawIds, config.principal.agent) : await runtime2.service.acknowledge(
         config.principal,
         rawIds.map(legacyNumericMessageId)
       );
-      output({ acknowledged, agent: config.principal.agent });
+      cliOutput("record_receipt", { acknowledged, agent: config.principal.agent }, {
+        command: raw,
+        optionNames: Object.keys(options)
+      });
       return;
     }
     if (command === "claim") {
-      output(await runtime.service.claim(config.principal, { leaseMs: integer(options, "lease-ms", 3e4), maxAttempts: integer(options, "max-attempts", 5) }));
+      const input = validateRequest("claim_delivery", { leaseMs: integer(options, "lease-ms", 3e4), maxAttempts: one(options, "max-attempts") === void 0 ? void 0 : integer(options, "max-attempts", 5) });
+      cliOutput("claim_delivery", await runtime2.service.claim(config.principal, input));
+      return;
+    }
+    if (command === "deliveries" || command === "dead-letters") {
+      const input = validateRequest("list_deliveries", { cursor: one(options, "cursor"), limit: integer(options, "limit", 50), role: one(options, "role"), messageId: one(options, "message-id"), recipient: one(options, "recipient"), states: command === "dead-letters" ? ["dead"] : list(options, "state") });
+      cliOutput("list_deliveries", await runtime2.service.deliveries(config.principal, input));
+      return;
+    }
+    if (command === "delivery-events") {
+      const input = validateRequest("list_delivery_events", { deliveryId: one(options, "delivery-id") ?? positionals[0], cursor: one(options, "cursor"), limit: integer(options, "limit", 50) });
+      cliOutput("list_delivery_events", await runtime2.service.deliveryEvents(config.principal, String(input.deliveryId), input));
+      return;
+    }
+    if (command === "cancel") {
+      const input = validateRequest("cancel_delivery", { deliveryId: one(options, "delivery-id") ?? positionals[0] });
+      cliOutput("cancel_delivery", await runtime2.service.cancel(config.principal, String(input.deliveryId)));
+      return;
+    }
+    if (command === "requeue") {
+      const input = validateRequest("requeue_delivery", { deliveryId: one(options, "delivery-id") ?? positionals[0] });
+      cliOutput("requeue_delivery", await runtime2.service.requeue(config.principal, String(input.deliveryId)));
       return;
     }
     const deliveryId = one(options, "delivery-id") ?? positionals[0];
@@ -614,15 +3908,19 @@ async function runCli(argv = process.argv.slice(2)) {
       if (["extend", "ack", "nack"].includes(command)) throw new Error("--delivery-id and --lease-token are required");
     }
     if (command === "extend") {
-      output(await runtime.service.extend(config.principal, deliveryId, leaseToken, integer(options, "lease-ms", 3e4)));
+      const input = validateRequest("extend_delivery", { deliveryId, leaseToken, leaseMs: integer(options, "lease-ms", 3e4) });
+      cliOutput("extend_delivery", await runtime2.service.extend(config.principal, String(input.deliveryId), String(input.leaseToken), input.leaseMs));
       return;
     }
     if (command === "ack") {
-      output(await runtime.service.ack(config.principal, deliveryId, leaseToken));
+      const input = validateRequest("acknowledge_delivery", { deliveryId, leaseToken });
+      cliOutput("acknowledge_delivery", await runtime2.service.ack(config.principal, String(input.deliveryId), String(input.leaseToken)));
       return;
     }
     if (command === "nack") {
-      output(await runtime.service.nack(config.principal, deliveryId, leaseToken, one(options, "error") ?? "negative acknowledgment", boolean(options, "dead")));
+      const disposition = one(options, "disposition") ?? (boolean(options, "dead") ? "dead" : "retry");
+      const input = validateRequest("negative_acknowledge_delivery", { deliveryId, leaseToken, error: one(options, "error") ?? "negative acknowledgment", disposition });
+      cliOutput("negative_acknowledge_delivery", await runtime2.service.nack(config.principal, String(input.deliveryId), String(input.leaseToken), String(input.error), input.disposition));
       return;
     }
     if (command === "watch") {
@@ -630,15 +3928,21 @@ async function runCli(argv = process.argv.slice(2)) {
       const baseInterval = Math.min(integer(options, "interval-ms", 1e3), 6e4);
       const maxInterval = Math.max(baseInterval, Math.min(integer(options, "max-interval-ms", 3e4), 3e5));
       let interval = baseInterval;
-      let current = cursor(config.cursorPath);
+      const project = one(options, "project");
+      const checkpointPath = watchCursorPath(config.cursorPath, project);
+      let current = cursor(checkpointPath);
       let seen = 0;
       for (let i = 0; i < polls; i++) {
         try {
-          const page = await runtime.service.history(config.principal, { cursor: current, limit: integer(options, "limit", 50) });
+          const page = await runtime2.service.history(config.principal, {
+            cursor: current,
+            limit: integer(options, "limit", 50),
+            project
+          });
           for (const message of page.messages) output(message);
           seen += page.messages.length;
           current = page.cursor;
-          saveCursor(config.cursorPath, current);
+          saveCursor(checkpointPath, current);
           interval = page.messages.length ? baseInterval : Math.min(maxInterval, Math.max(baseInterval, interval * 2));
         } catch (error) {
           const status = error instanceof BridgeHttpError || error instanceof LegacySupabaseError ? error.status : void 0;
@@ -648,7 +3952,7 @@ async function runCli(argv = process.argv.slice(2)) {
         }
         if (i + 1 < polls) {
           const jittered = Math.round(interval * (0.9 + Math.random() * 0.2));
-          await new Promise((resolve) => setTimeout(resolve, jittered));
+          await new Promise((resolve5) => setTimeout(resolve5, jittered));
         }
       }
       if (!seen && boolean(options, "json")) output({ status: "ok", messages: 0, cursor: current ?? null });
@@ -656,15 +3960,52 @@ async function runCli(argv = process.argv.slice(2)) {
     }
     throw new Error(`Unknown command: ${raw}`);
   } finally {
-    await runtime.close();
+    await runtime2.close();
+  }
+}
+function formatCliError(error, argv = process.argv.slice(2)) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (argv[0] === "archive") {
+    return JSON.stringify({
+      schemaVersion: 1,
+      status: "error",
+      operation: argv[1] ?? null,
+      error: {
+        code: error instanceof ArchiveCommandError ? error.code : "ARCHIVE_COMMAND_ERROR",
+        message: error instanceof ArchiveCommandError ? error.message : "archive command failed",
+        ...error instanceof ArchiveCommandError && error.details ? { details: error.details } : {}
+      }
+    }) + "\n";
   }
+  if (argv[0] === "dr") {
+    return JSON.stringify({
+      schemaVersion: 1,
+      status: "error",
+      operation: argv[1] ?? null,
+      error: {
+        code: error instanceof NativeDrCommandError ? error.code : "DR_COMMAND_ERROR",
+        message: error instanceof NativeDrCommandError ? error.message : "DR command failed",
+        ...error instanceof NativeDrCommandError && error.details ? { details: error.details } : {}
+      }
+    }) + "\n";
+  }
+  if (argv[0] === "owner") {
+    return JSON.stringify({
+      schemaVersion: 1,
+      status: "error",
+      operation: argv[1] ?? null,
+      error: { code: "OWNER_COMMAND_ERROR", message }
+    }) + "\n";
+  }
+  return `Error: ${message}
+`;
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) runCli().catch((error) => {
-  process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}
-`);
+  process.stderr.write(formatCliError(error));
   process.exitCode = 1;
 });
 export {
+  formatCliError,
   runCli
 };
 //# sourceMappingURL=cli.js.map