@creatornader/agent-bridge 0.2.0

package/dist/chunk-JOUBDRYX.js

@@ -0,0 +1,272 @@
+#!/usr/bin/env node
+import {
+  BridgeService
+} from "./chunk-CKSKUBDQ.js";
+import {
+  BridgeValidationError
+} from "./chunk-BV6W4AJK.js";
+
+// src/gateway.ts
+import { randomUUID } from "crypto";
+import { createServer } from "http";
+
+// src/gateway-auth.ts
+import { createHash, timingSafeEqual } from "crypto";
+function hashCredential(token) {
+  return createHash("sha256").update(token, "utf8").digest("hex");
+}
+var PostgresCredentialResolver = class {
+  constructor(db) {
+    this.db = db;
+  }
+  async resolve(token, signal) {
+    if (signal?.aborted) throw signal.reason;
+    const hash = hashCredential(token);
+    const result = await this.db.query(
+      `SELECT credential.id, credential.workspace_id, agent.principal
+       FROM agent_bridge.credentials credential
+       JOIN agent_bridge.agents agent
+         ON agent.id=credential.agent_id AND agent.workspace_id=credential.workspace_id
+       JOIN agent_bridge.workspaces workspace ON workspace.id=credential.workspace_id
+       WHERE credential.token_hash=$1 AND credential.revoked_at IS NULL
+         AND (credential.expires_at IS NULL OR credential.expires_at>now())
+         AND agent.disabled_at IS NULL AND workspace.disabled_at IS NULL
+       LIMIT 1`,
+      [hash]
+    );
+    const row = result.rows[0];
+    if (signal?.aborted) throw signal.reason;
+    return row ? { id: row.id, principal: { workspace: row.workspace_id, agent: row.principal } } : null;
+  }
+};
+function bearerToken(value) {
+  if (!value?.startsWith("Bearer ")) return null;
+  const token = value.slice(7);
+  if (!token || token.length > 4096 || /\s/.test(token)) return null;
+  return token;
+}
+function safeTokenHashEqual(token, expectedHash) {
+  const actual = Buffer.from(hashCredential(token));
+  const expected = Buffer.from(expectedHash);
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+
+// src/gateway.ts
+var jsonHeaders = { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" };
+function send(res, status, value, requestId) {
+  if (res.writableEnded) return;
+  res.writeHead(status, { ...jsonHeaders, "x-request-id": requestId });
+  res.end(JSON.stringify(value));
+}
+function failure(res, status, code, requestId) {
+  send(res, status, { error: { code, requestId } }, requestId);
+}
+async function body(req, limit, signal) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    const cleanup = () => {
+      req.off("data", onData);
+      req.off("end", onEnd);
+      req.off("error", onError);
+      signal.removeEventListener("abort", onAbort);
+    };
+    const finish = (callback) => {
+      cleanup();
+      callback();
+    };
+    const onData = (chunk) => {
+      const buffer = Buffer.from(chunk);
+      size += buffer.length;
+      if (size > limit) {
+        finish(() => reject(Object.assign(new Error("body too large"), {
+          status: 413,
+          code: "body_too_large"
+        })));
+        req.resume();
+        return;
+      }
+      chunks.push(buffer);
+    };
+    const onEnd = () => finish(() => {
+      if (!size) {
+        resolve({});
+        return;
+      }
+      try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") throw new Error();
+        resolve(parsed);
+      } catch {
+        reject(Object.assign(new Error("invalid JSON"), { status: 400, code: "malformed_json" }));
+      }
+    });
+    const onError = (error) => finish(() => reject(error));
+    const onAbort = () => {
+      finish(() => reject(signal.reason));
+      req.resume();
+    };
+    req.on("data", onData);
+    req.on("end", onEnd);
+    req.on("error", onError);
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+}
+function numberParam(value, name) {
+  if (value === null) return void 0;
+  const result = Number(value);
+  if (!Number.isSafeInteger(result)) throw new BridgeValidationError(`${name} is invalid`);
+  return result;
+}
+function active(signal) {
+  if (signal.aborted) throw signal.reason;
+}
+function createGateway(options) {
+  const service = new BridgeService(options.store);
+  const metrics = { requests: 0, errors: 0, timeouts: 0, authFailures: 0 };
+  const limit = options.bodyLimitBytes ?? 128 * 1024;
+  const deadline = options.requestDeadlineMs ?? 1e4;
+  const origins = new Set(options.allowedOrigins ?? []);
+  return createServer((req, res) => {
+    const requestId = randomUUID();
+    const abort = new AbortController();
+    let mutationStarted = false;
+    metrics.requests += 1;
+    const timer = setTimeout(() => {
+      abort.abort(new Error("request deadline exceeded"));
+      metrics.timeouts += 1;
+      metrics.errors += 1;
+      res.once("finish", () => {
+        if (!req.complete) req.destroy();
+      });
+      failure(
+        res,
+        504,
+        mutationStarted ? "mutation_outcome_unknown" : "request_timeout",
+        requestId
+      );
+    }, deadline);
+    void (async () => {
+      const url = new URL(req.url ?? "/", "http://gateway.invalid");
+      if (req.method === "GET" && url.pathname === "/readyz") {
+        let ready = false;
+        try {
+          ready = await (options.ready?.() ?? options.store.initialize().then(() => true));
+        } catch {
+          ready = false;
+        }
+        send(res, ready ? 200 : 503, { status: ready ? "ready" : "not_ready" }, requestId);
+        return;
+      }
+      const origin = req.headers.origin;
+      if (origin && !origins.has(origin)) {
+        failure(res, 403, "origin_forbidden", requestId);
+        return;
+      }
+      const token = bearerToken(req.headers.authorization);
+      const credential = token ? await options.credentials.resolve(token, abort.signal) : null;
+      active(abort.signal);
+      if (!credential) {
+        metrics.authFailures += 1;
+        failure(res, 401, "unauthorized", requestId);
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/metrics") {
+        res.writeHead(200, { ...jsonHeaders, "content-type": "text/plain; version=0.0.4", "x-request-id": requestId });
+        res.end(Object.entries(metrics).map(([key, value]) => `agent_bridge_gateway_${key}_total ${value}`).join("\n") + "\n");
+        return;
+      }
+      const instanceHeader = req.headers["x-agent-bridge-instance"];
+      const principal = {
+        ...credential.principal,
+        instance: Array.isArray(instanceHeader) ? instanceHeader[0] : instanceHeader
+      };
+      if (req.method === "GET" && url.pathname === "/v2/status") {
+        if (!options.store.diagnostics) {
+          send(res, 200, { schemaVersion: "postgres-v2", deliverySupported: false, pending: null, claimed: null, retrying: null, dead: null, principal: credential.principal }, requestId);
+        } else {
+          send(res, 200, { ...await options.store.diagnostics(principal), principal: credential.principal }, requestId);
+        }
+        return;
+      }
+      if (req.method === "POST" && req.headers["content-type"]?.split(";", 1)[0] !== "application/json") {
+        failure(res, 415, "unsupported_media_type", requestId);
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/v2/messages") {
+        const input = await body(req, limit, abort.signal);
+        active(abort.signal);
+        mutationStarted = true;
+        send(res, 201, await service.publish(principal, input), requestId);
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/v2/history") {
+        const types = url.searchParams.getAll("type");
+        send(res, 200, await service.history(principal, {
+          cursor: url.searchParams.get("cursor") ?? void 0,
+          limit: numberParam(url.searchParams.get("limit"), "limit"),
+          types: types.length ? types : void 0,
+          includeExpired: url.searchParams.get("includeExpired") === "true",
+          source: url.searchParams.get("source") ?? void 0,
+          since: url.searchParams.get("since") ?? void 0,
+          unacknowledgedBy: url.searchParams.get("unacknowledgedBy") ?? void 0,
+          threadId: url.searchParams.get("threadId") ?? void 0,
+          latest: url.searchParams.get("latest") === "true"
+        }), requestId);
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/v2/receipts") {
+        const input = await body(req, limit, abort.signal);
+        active(abort.signal);
+        mutationStarted = true;
+        send(res, 200, { recorded: await service.acknowledge(principal, input.messageIds) }, requestId);
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/v2/deliveries/claim") {
+        const input = await body(req, limit, abort.signal);
+        active(abort.signal);
+        mutationStarted = true;
+        send(res, 200, await service.claim(principal, input), requestId);
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/v2/presence/heartbeat") {
+        const input = await body(req, limit, abort.signal);
+        active(abort.signal);
+        mutationStarted = true;
+        send(res, 200, await service.heartbeat(principal, input), requestId);
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/v2/presence") {
+        send(res, 200, { agents: await service.presence(principal) }, requestId);
+        return;
+      }
+      const match = url.pathname.match(/^\/v2\/deliveries\/([^/]+)\/(extend|ack|nack)$/);
+      if (req.method === "POST" && match) {
+        const input = await body(req, limit, abort.signal);
+        active(abort.signal);
+        mutationStarted = true;
+        const [, id, action] = match;
+        const result = action === "extend" ? await service.extend(principal, id, input.leaseToken, input.leaseMs) : action === "ack" ? await service.ack(principal, id, input.leaseToken) : await service.nack(principal, id, input.leaseToken, input.error, input.dead, input.retryPolicy);
+        if (!result) failure(res, 409, "lease_conflict", requestId);
+        else send(res, 200, result, requestId);
+        return;
+      }
+      failure(res, 404, "not_found", requestId);
+    })().catch((error) => {
+      if (res.writableEnded) return;
+      metrics.errors += 1;
+      if (error instanceof BridgeValidationError) failure(res, 400, error.code, requestId);
+      else failure(res, error?.status ?? 500, error?.code ?? "internal_error", requestId);
+    }).finally(() => clearTimeout(timer));
+  });
+}
+
+export {
+  hashCredential,
+  PostgresCredentialResolver,
+  bearerToken,
+  safeTokenHashEqual,
+  createGateway
+};
+//# sourceMappingURL=chunk-JOUBDRYX.js.map

package/dist/chunk-JOUBDRYX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/gateway.ts","../src/gateway-auth.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { createServer, type IncomingMessage, type ServerResponse } from \"node:http\";\nimport { BridgeValidationError, type MessageDraft } from \"./bridge-domain.js\";\nimport { BridgeService } from \"./bridge-service.js\";\nimport type { BridgeStore } from \"./bridge-store.js\";\nimport { bearerToken, type CredentialResolver } from \"./gateway-auth.js\";\n\nexport interface GatewayOptions {\n  store: BridgeStore;\n  credentials: CredentialResolver;\n  allowedOrigins?: string[];\n  bodyLimitBytes?: number;\n  requestDeadlineMs?: number;\n  ready?: () => Promise<boolean>;\n}\n\ntype Metrics = { requests: number; errors: number; timeouts: number; authFailures: number };\nconst jsonHeaders = { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" };\n\nfunction send(res: ServerResponse, status: number, value: unknown, requestId: string): void {\n  if (res.writableEnded) return;\n  res.writeHead(status, { ...jsonHeaders, \"x-request-id\": requestId });\n  res.end(JSON.stringify(value));\n}\n\nfunction failure(res: ServerResponse, status: number, code: string, requestId: string): void {\n  send(res, status, { error: { code, requestId } }, requestId);\n}\n\nasync function body(\n  req: IncomingMessage,\n  limit: number,\n  signal: AbortSignal,\n): Promise<Record<string, any>> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    const cleanup = () => {\n      req.off(\"data\", onData);\n      req.off(\"end\", onEnd);\n      req.off(\"error\", onError);\n      signal.removeEventListener(\"abort\", onAbort);\n    };\n    const finish = (callback: () => void) => {\n      cleanup();\n      callback();\n    };\n    const onData = (chunk: Buffer | string) => {\n      const buffer = Buffer.from(chunk);\n      size += buffer.length;\n      if (size > limit) {\n        finish(() => reject(Object.assign(new Error(\"body too large\"), {\n          status: 413,\n          code: \"body_too_large\",\n        })));\n        req.resume();\n        return;\n      }\n      chunks.push(buffer);\n    };\n    const onEnd = () => finish(() => {\n      if (!size) {\n        resolve({});\n        return;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n        if (!parsed || Array.isArray(parsed) || typeof parsed !== \"object\") throw new Error();\n        resolve(parsed);\n      } catch {\n        reject(Object.assign(new Error(\"invalid JSON\"), { status: 400, code: \"malformed_json\" }));\n      }\n    });\n    const onError = (error: Error) => finish(() => reject(error));\n    const onAbort = () => {\n      finish(() => reject(signal.reason));\n      req.resume();\n    };\n    req.on(\"data\", onData);\n    req.on(\"end\", onEnd);\n    req.on(\"error\", onError);\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    if (signal.aborted) onAbort();\n  });\n}\n\nfunction numberParam(value: string | null, name: string): number | undefined {\n  if (value === null) return undefined;\n  const result = Number(value);\n  if (!Number.isSafeInteger(result)) throw new BridgeValidationError(`${name} is invalid`);\n  return result;\n}\n\nfunction active(signal: AbortSignal): void {\n  if (signal.aborted) throw signal.reason;\n}\n\nexport function createGateway(options: GatewayOptions) {\n  const service = new BridgeService(options.store);\n  const metrics: Metrics = { requests: 0, errors: 0, timeouts: 0, authFailures: 0 };\n  const limit = options.bodyLimitBytes ?? 128 * 1024;\n  const deadline = options.requestDeadlineMs ?? 10_000;\n  const origins = new Set(options.allowedOrigins ?? []);\n\n  return createServer((req, res) => {\n    const requestId = randomUUID();\n    const abort = new AbortController();\n    let mutationStarted = false;\n    metrics.requests += 1;\n    const timer = setTimeout(() => {\n      abort.abort(new Error(\"request deadline exceeded\"));\n      metrics.timeouts += 1; metrics.errors += 1;\n      res.once(\"finish\", () => {\n        if (!req.complete) req.destroy();\n      });\n      failure(\n        res,\n        504,\n        mutationStarted ? \"mutation_outcome_unknown\" : \"request_timeout\",\n        requestId,\n      );\n    }, deadline);\n\n    void (async () => {\n      const url = new URL(req.url ?? \"/\", \"http://gateway.invalid\");\n      if (req.method === \"GET\" && url.pathname === \"/readyz\") {\n        let ready = false;\n        try {\n          ready = await (options.ready?.() ?? options.store.initialize().then(() => true));\n        } catch {\n          ready = false;\n        }\n        send(res, ready ? 200 : 503, { status: ready ? \"ready\" : \"not_ready\" }, requestId);\n        return;\n      }\n      const origin = req.headers.origin;\n      if (origin && !origins.has(origin)) {\n        failure(res, 403, \"origin_forbidden\", requestId); return;\n      }\n      const token = bearerToken(req.headers.authorization);\n      const credential = token ? await options.credentials.resolve(token, abort.signal) : null;\n      active(abort.signal);\n      if (!credential) {\n        metrics.authFailures += 1;\n        failure(res, 401, \"unauthorized\", requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/metrics\") {\n        res.writeHead(200, { ...jsonHeaders, \"content-type\": \"text/plain; version=0.0.4\", \"x-request-id\": requestId });\n        res.end(Object.entries(metrics).map(([key, value]) => `agent_bridge_gateway_${key}_total ${value}`).join(\"\\n\") + \"\\n\");\n        return;\n      }\n      const instanceHeader = req.headers[\"x-agent-bridge-instance\"];\n      const principal = {\n        ...credential.principal,\n        instance: Array.isArray(instanceHeader) ? instanceHeader[0] : instanceHeader,\n      };\n\n      if (req.method === \"GET\" && url.pathname === \"/v2/status\") {\n        if (!options.store.diagnostics) {\n          send(res, 200, { schemaVersion: \"postgres-v2\", deliverySupported: false, pending: null, claimed: null, retrying: null, dead: null, principal: credential.principal }, requestId);\n        } else {\n          send(res, 200, { ...await options.store.diagnostics(principal), principal: credential.principal }, requestId);\n        }\n        return;\n      }\n\n      if (req.method === \"POST\" && req.headers[\"content-type\"]?.split(\";\", 1)[0] !== \"application/json\") {\n        failure(res, 415, \"unsupported_media_type\", requestId); return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/messages\") {\n        const input = await body(req, limit, abort.signal) as unknown as MessageDraft;\n        active(abort.signal);\n        mutationStarted = true;\n        send(res, 201, await service.publish(principal, input), requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/history\") {\n        const types = url.searchParams.getAll(\"type\");\n        send(res, 200, await service.history(principal, {\n          cursor: url.searchParams.get(\"cursor\") ?? undefined,\n          limit: numberParam(url.searchParams.get(\"limit\"), \"limit\"),\n          types: types.length ? types : undefined,\n          includeExpired: url.searchParams.get(\"includeExpired\") === \"true\",\n          source: url.searchParams.get(\"source\") ?? undefined,\n          since: url.searchParams.get(\"since\") ?? undefined,\n          unacknowledgedBy: url.searchParams.get(\"unacknowledgedBy\") ?? undefined,\n          threadId: url.searchParams.get(\"threadId\") ?? undefined,\n          latest: url.searchParams.get(\"latest\") === \"true\",\n        }), requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/receipts\") {\n        const input = await body(req, limit, abort.signal);\n        active(abort.signal);\n        mutationStarted = true;\n        send(res, 200, { recorded: await service.acknowledge(principal, input.messageIds) }, requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/deliveries/claim\") {\n        const input = await body(req, limit, abort.signal);\n        active(abort.signal);\n        mutationStarted = true;\n        send(res, 200, await service.claim(principal, input), requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/presence/heartbeat\") {\n        const input = await body(req, limit, abort.signal);\n        active(abort.signal);\n        mutationStarted = true;\n        send(res, 200, await service.heartbeat(principal, input), requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/presence\") {\n        send(res, 200, { agents: await service.presence(principal) }, requestId); return;\n      }\n      const match = url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/(extend|ack|nack)$/);\n      if (req.method === \"POST\" && match) {\n        const input = await body(req, limit, abort.signal);\n        active(abort.signal);\n        mutationStarted = true;\n        const [, id, action] = match;\n        const result = action === \"extend\"\n          ? await service.extend(principal, id, input.leaseToken, input.leaseMs)\n          : action === \"ack\"\n            ? await service.ack(principal, id, input.leaseToken)\n            : await service.nack(principal, id, input.leaseToken, input.error, input.dead, input.retryPolicy);\n        if (!result) failure(res, 409, \"lease_conflict\", requestId);\n        else send(res, 200, result, requestId);\n        return;\n      }\n      failure(res, 404, \"not_found\", requestId);\n    })().catch((error: any) => {\n      if (res.writableEnded) return;\n      metrics.errors += 1;\n      if (error instanceof BridgeValidationError) failure(res, 400, error.code, requestId);\n      else failure(res, error?.status ?? 500, error?.code ?? \"internal_error\", requestId);\n    }).finally(() => clearTimeout(timer));\n  });\n}\n","import { createHash, timingSafeEqual } from \"node:crypto\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { PgQueryable } from \"./postgres-bridge-store.js\";\n\nexport interface AuthenticatedCredential {\n  id: string;\n  principal: BridgePrincipal;\n}\n\nexport interface CredentialResolver {\n  resolve(token: string, signal?: AbortSignal): Promise<AuthenticatedCredential | null>;\n}\n\nexport function hashCredential(token: string): string {\n  return createHash(\"sha256\").update(token, \"utf8\").digest(\"hex\");\n}\n\nexport class PostgresCredentialResolver implements CredentialResolver {\n  constructor(private readonly db: PgQueryable) {}\n\n  async resolve(token: string, signal?: AbortSignal): Promise<AuthenticatedCredential | null> {\n    if (signal?.aborted) throw signal.reason;\n    const hash = hashCredential(token);\n    const result = await this.db.query<{\n      id: string; workspace_id: string; principal: string;\n    }>(\n      `SELECT credential.id, credential.workspace_id, agent.principal\n       FROM agent_bridge.credentials credential\n       JOIN agent_bridge.agents agent\n         ON agent.id=credential.agent_id AND agent.workspace_id=credential.workspace_id\n       JOIN agent_bridge.workspaces workspace ON workspace.id=credential.workspace_id\n       WHERE credential.token_hash=$1 AND credential.revoked_at IS NULL\n         AND (credential.expires_at IS NULL OR credential.expires_at>now())\n         AND agent.disabled_at IS NULL AND workspace.disabled_at IS NULL\n       LIMIT 1`,\n      [hash],\n    );\n    const row = result.rows[0];\n    if (signal?.aborted) throw signal.reason;\n    return row ? { id: row.id, principal: { workspace: row.workspace_id, agent: row.principal } } : null;\n  }\n}\n\nexport function bearerToken(value: string | undefined): string | null {\n  if (!value?.startsWith(\"Bearer \")) return null;\n  const token = value.slice(7);\n  if (!token || token.length > 4096 || /\\s/.test(token)) return null;\n  return token;\n}\n\nexport function safeTokenHashEqual(token: string, expectedHash: string): boolean {\n  const actual = Buffer.from(hashCredential(token));\n  const expected = Buffer.from(expectedHash);\n  return actual.length === expected.length && timingSafeEqual(actual, expected);\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAA+D;;;ACDxE,SAAS,YAAY,uBAAuB;AAarC,SAAS,eAAe,OAAuB;AACpD,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,KAAK;AAChE;AAEO,IAAM,6BAAN,MAA+D;AAAA,EACpE,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAE/C,MAAM,QAAQ,OAAe,QAA+D;AAC1F,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,OAAO,eAAe,KAAK;AACjC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAG3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA,CAAC,IAAI;AAAA,IACP;AACA,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,WAAO,MAAM,EAAE,IAAI,IAAI,IAAI,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU,EAAE,IAAI;AAAA,EAClG;AACF;AAEO,SAAS,YAAY,OAA0C;AACpE,MAAI,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AAC1C,QAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,MAAI,CAAC,SAAS,MAAM,SAAS,QAAQ,KAAK,KAAK,KAAK,EAAG,QAAO;AAC9D,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAe,cAA+B;AAC/E,QAAM,SAAS,OAAO,KAAK,eAAe,KAAK,CAAC;AAChD,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,SAAO,OAAO,WAAW,SAAS,UAAU,gBAAgB,QAAQ,QAAQ;AAC9E;;;ADrCA,IAAM,cAAc,EAAE,gBAAgB,mCAAmC,iBAAiB,WAAW;AAErG,SAAS,KAAK,KAAqB,QAAgB,OAAgB,WAAyB;AAC1F,MAAI,IAAI,cAAe;AACvB,MAAI,UAAU,QAAQ,EAAE,GAAG,aAAa,gBAAgB,UAAU,CAAC;AACnE,MAAI,IAAI,KAAK,UAAU,KAAK,CAAC;AAC/B;AAEA,SAAS,QAAQ,KAAqB,QAAgB,MAAc,WAAyB;AAC3F,OAAK,KAAK,QAAQ,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE,GAAG,SAAS;AAC7D;AAEA,eAAe,KACb,KACA,OACA,QAC8B;AAC9B,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,OAAO;AACX,UAAM,UAAU,MAAM;AACpB,UAAI,IAAI,QAAQ,MAAM;AACtB,UAAI,IAAI,OAAO,KAAK;AACpB,UAAI,IAAI,SAAS,OAAO;AACxB,aAAO,oBAAoB,SAAS,OAAO;AAAA,IAC7C;AACA,UAAM,SAAS,CAAC,aAAyB;AACvC,cAAQ;AACR,eAAS;AAAA,IACX;AACA,UAAM,SAAS,CAAC,UAA2B;AACzC,YAAM,SAAS,OAAO,KAAK,KAAK;AAChC,cAAQ,OAAO;AACf,UAAI,OAAO,OAAO;AAChB,eAAO,MAAM,OAAO,OAAO,OAAO,IAAI,MAAM,gBAAgB,GAAG;AAAA,UAC7D,QAAQ;AAAA,UACR,MAAM;AAAA,QACR,CAAC,CAAC,CAAC;AACH,YAAI,OAAO;AACX;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,QAAQ,MAAM,OAAO,MAAM;AAC/B,UAAI,CAAC,MAAM;AACT,gBAAQ,CAAC,CAAC;AACV;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAChE,YAAI,CAAC,UAAU,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM;AACpF,gBAAQ,MAAM;AAAA,MAChB,QAAQ;AACN,eAAO,OAAO,OAAO,IAAI,MAAM,cAAc,GAAG,EAAE,QAAQ,KAAK,MAAM,iBAAiB,CAAC,CAAC;AAAA,MAC1F;AAAA,IACF,CAAC;AACD,UAAM,UAAU,CAAC,UAAiB,OAAO,MAAM,OAAO,KAAK,CAAC;AAC5D,UAAM,UAAU,MAAM;AACpB,aAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAClC,UAAI,OAAO;AAAA,IACb;AACA,QAAI,GAAG,QAAQ,MAAM;AACrB,QAAI,GAAG,OAAO,KAAK;AACnB,QAAI,GAAG,SAAS,OAAO;AACvB,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,QAAI,OAAO,QAAS,SAAQ;AAAA,EAC9B,CAAC;AACH;AAEA,SAAS,YAAY,OAAsB,MAAkC;AAC3E,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,EAAG,OAAM,IAAI,sBAAsB,GAAG,IAAI,aAAa;AACvF,SAAO;AACT;AAEA,SAAS,OAAO,QAA2B;AACzC,MAAI,OAAO,QAAS,OAAM,OAAO;AACnC;AAEO,SAAS,cAAc,SAAyB;AACrD,QAAM,UAAU,IAAI,cAAc,QAAQ,KAAK;AAC/C,QAAM,UAAmB,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,EAAE;AAChF,QAAM,QAAQ,QAAQ,kBAAkB,MAAM;AAC9C,QAAM,WAAW,QAAQ,qBAAqB;AAC9C,QAAM,UAAU,IAAI,IAAI,QAAQ,kBAAkB,CAAC,CAAC;AAEpD,SAAO,aAAa,CAAC,KAAK,QAAQ;AAChC,UAAM,YAAY,WAAW;AAC7B,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI,kBAAkB;AACtB,YAAQ,YAAY;AACpB,UAAM,QAAQ,WAAW,MAAM;AAC7B,YAAM,MAAM,IAAI,MAAM,2BAA2B,CAAC;AAClD,cAAQ,YAAY;AAAG,cAAQ,UAAU;AACzC,UAAI,KAAK,UAAU,MAAM;AACvB,YAAI,CAAC,IAAI,SAAU,KAAI,QAAQ;AAAA,MACjC,CAAC;AACD;AAAA,QACE;AAAA,QACA;AAAA,QACA,kBAAkB,6BAA6B;AAAA,QAC/C;AAAA,MACF;AAAA,IACF,GAAG,QAAQ;AAEX,UAAM,YAAY;AAChB,YAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,wBAAwB;AAC5D,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,WAAW;AACtD,YAAI,QAAQ;AACZ,YAAI;AACF,kBAAQ,OAAO,QAAQ,QAAQ,KAAK,QAAQ,MAAM,WAAW,EAAE,KAAK,MAAM,IAAI;AAAA,QAChF,QAAQ;AACN,kBAAQ;AAAA,QACV;AACA,aAAK,KAAK,QAAQ,MAAM,KAAK,EAAE,QAAQ,QAAQ,UAAU,YAAY,GAAG,SAAS;AACjF;AAAA,MACF;AACA,YAAM,SAAS,IAAI,QAAQ;AAC3B,UAAI,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG;AAClC,gBAAQ,KAAK,KAAK,oBAAoB,SAAS;AAAG;AAAA,MACpD;AACA,YAAM,QAAQ,YAAY,IAAI,QAAQ,aAAa;AACnD,YAAM,aAAa,QAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO,MAAM,MAAM,IAAI;AACpF,aAAO,MAAM,MAAM;AACnB,UAAI,CAAC,YAAY;AACf,gBAAQ,gBAAgB;AACxB,gBAAQ,KAAK,KAAK,gBAAgB,SAAS;AAAG;AAAA,MAChD;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,YAAY;AACvD,YAAI,UAAU,KAAK,EAAE,GAAG,aAAa,gBAAgB,6BAA6B,gBAAgB,UAAU,CAAC;AAC7G,YAAI,IAAI,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,wBAAwB,GAAG,UAAU,KAAK,EAAE,EAAE,KAAK,IAAI,IAAI,IAAI;AACrH;AAAA,MACF;AACA,YAAM,iBAAiB,IAAI,QAAQ,yBAAyB;AAC5D,YAAM,YAAY;AAAA,QAChB,GAAG,WAAW;AAAA,QACd,UAAU,MAAM,QAAQ,cAAc,IAAI,eAAe,CAAC,IAAI;AAAA,MAChE;AAEA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,cAAc;AACzD,YAAI,CAAC,QAAQ,MAAM,aAAa;AAC9B,eAAK,KAAK,KAAK,EAAE,eAAe,eAAe,mBAAmB,OAAO,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM,MAAM,MAAM,WAAW,WAAW,UAAU,GAAG,SAAS;AAAA,QACjL,OAAO;AACL,eAAK,KAAK,KAAK,EAAE,GAAG,MAAM,QAAQ,MAAM,YAAY,SAAS,GAAG,WAAW,WAAW,UAAU,GAAG,SAAS;AAAA,QAC9G;AACA;AAAA,MACF;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,oBAAoB;AACjG,gBAAQ,KAAK,KAAK,0BAA0B,SAAS;AAAG;AAAA,MAC1D;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;AAC5D,cAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AACjD,eAAO,MAAM,MAAM;AACnB,0BAAkB;AAClB,aAAK,KAAK,KAAK,MAAM,QAAQ,QAAQ,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MACtE;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,eAAe;AAC1D,cAAM,QAAQ,IAAI,aAAa,OAAO,MAAM;AAC5C,aAAK,KAAK,KAAK,MAAM,QAAQ,QAAQ,WAAW;AAAA,UAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,UAC1C,OAAO,YAAY,IAAI,aAAa,IAAI,OAAO,GAAG,OAAO;AAAA,UACzD,OAAO,MAAM,SAAS,QAAQ;AAAA,UAC9B,gBAAgB,IAAI,aAAa,IAAI,gBAAgB,MAAM;AAAA,UAC3D,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,UAC1C,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,UACxC,kBAAkB,IAAI,aAAa,IAAI,kBAAkB,KAAK;AAAA,UAC9D,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,UAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,MAAM;AAAA,QAC7C,CAAC,GAAG,SAAS;AAAG;AAAA,MAClB;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;AAC5D,cAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AACjD,eAAO,MAAM,MAAM;AACnB,0BAAkB;AAClB,aAAK,KAAK,KAAK,EAAE,UAAU,MAAM,QAAQ,YAAY,WAAW,MAAM,UAAU,EAAE,GAAG,SAAS;AAAG;AAAA,MACnG;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,wBAAwB;AACpE,cAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AACjD,eAAO,MAAM,MAAM;AACnB,0BAAkB;AAClB,aAAK,KAAK,KAAK,MAAM,QAAQ,MAAM,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MACpE;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,0BAA0B;AACtE,cAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AACjD,eAAO,MAAM,MAAM;AACnB,0BAAkB;AAClB,aAAK,KAAK,KAAK,MAAM,QAAQ,UAAU,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MACxE;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,gBAAgB;AAC3D,aAAK,KAAK,KAAK,EAAE,QAAQ,MAAM,QAAQ,SAAS,SAAS,EAAE,GAAG,SAAS;AAAG;AAAA,MAC5E;AACA,YAAM,QAAQ,IAAI,SAAS,MAAM,gDAAgD;AACjF,UAAI,IAAI,WAAW,UAAU,OAAO;AAClC,cAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AACjD,eAAO,MAAM,MAAM;AACnB,0BAAkB;AAClB,cAAM,CAAC,EAAE,IAAI,MAAM,IAAI;AACvB,cAAM,SAAS,WAAW,WACtB,MAAM,QAAQ,OAAO,WAAW,IAAI,MAAM,YAAY,MAAM,OAAO,IACnE,WAAW,QACT,MAAM,QAAQ,IAAI,WAAW,IAAI,MAAM,UAAU,IACjD,MAAM,QAAQ,KAAK,WAAW,IAAI,MAAM,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM,WAAW;AACpG,YAAI,CAAC,OAAQ,SAAQ,KAAK,KAAK,kBAAkB,SAAS;AAAA,YACrD,MAAK,KAAK,KAAK,QAAQ,SAAS;AACrC;AAAA,MACF;AACA,cAAQ,KAAK,KAAK,aAAa,SAAS;AAAA,IAC1C,GAAG,EAAE,MAAM,CAAC,UAAe;AACzB,UAAI,IAAI,cAAe;AACvB,cAAQ,UAAU;AAClB,UAAI,iBAAiB,sBAAuB,SAAQ,KAAK,KAAK,MAAM,MAAM,SAAS;AAAA,UAC9E,SAAQ,KAAK,OAAO,UAAU,KAAK,OAAO,QAAQ,kBAAkB,SAAS;AAAA,IACpF,CAAC,EAAE,QAAQ,MAAM,aAAa,KAAK,CAAC;AAAA,EACtC,CAAC;AACH;","names":[]}

package/dist/chunk-JTC5YURG.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import {
+  HttpBridgeStore,
+  LegacySupabaseRestStore
+} from "./chunk-AXL2I7FH.js";
+import {
+  SQLiteBridgeStore,
+  SQLiteEdgeStore,
+  SyncingBridgeStore
+} from "./chunk-WEULPMUY.js";
+import {
+  BridgeService
+} from "./chunk-CKSKUBDQ.js";
+
+// src/client-runtime.ts
+import { chmodSync, mkdirSync } from "fs";
+import { basename, dirname } from "path";
+function createStore(config) {
+  if (config.provider === "local") {
+    if (config.databasePath !== ":memory:") {
+      const directory = dirname(config.databasePath);
+      mkdirSync(directory, { recursive: true, mode: 448 });
+      if (basename(directory) === ".agent-bridge") chmodSync(directory, 448);
+    }
+    return new SQLiteBridgeStore(config.databasePath);
+  }
+  if (config.provider === "gateway") {
+    const directory = dirname(config.edgeDatabasePath);
+    mkdirSync(directory, { recursive: true, mode: 448 });
+    if (basename(directory) === ".agent-bridge") chmodSync(directory, 448);
+    const remote = new HttpBridgeStore({ baseUrl: config.url, token: config.credential, principal: config.principal });
+    const edge = new SQLiteEdgeStore(config.edgeDatabasePath, { endpoint: config.url, principal: config.principal });
+    return new SyncingBridgeStore(edge, remote, config.principal);
+  }
+  return new LegacySupabaseRestStore(config.url, config.credential);
+}
+async function createClientRuntime(config) {
+  const store = createStore(config);
+  await store.initialize();
+  return { config, store, service: new BridgeService(store), close: async () => {
+    await store.close?.();
+  } };
+}
+
+export {
+  createStore,
+  createClientRuntime
+};
+//# sourceMappingURL=chunk-JTC5YURG.js.map

package/dist/chunk-JTC5YURG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client-runtime.ts"],"sourcesContent":["import { chmodSync, mkdirSync } from \"node:fs\";\nimport { basename, dirname } from \"node:path\";\nimport { BridgeService } from \"./bridge-service.js\";\nimport type { BridgeStore } from \"./bridge-store.js\";\nimport { HttpBridgeStore } from \"./http-bridge-store.js\";\nimport { SQLiteEdgeStore } from \"./sqlite-edge-store.js\";\nimport { SyncingBridgeStore } from \"./syncing-bridge-store.js\";\nimport { LegacySupabaseRestStore } from \"./legacy-supabase-store.js\";\nimport { SQLiteBridgeStore } from \"./sqlite-bridge-store.js\";\nimport type { ClientConfig } from \"./client-config.js\";\n\nexport interface ClientRuntime { config: ClientConfig; store: BridgeStore; service: BridgeService; close(): Promise<void>; }\n\nexport function createStore(config: ClientConfig): BridgeStore {\n  if (config.provider === \"local\") {\n    if (config.databasePath !== \":memory:\") {\n      const directory = dirname(config.databasePath);\n      mkdirSync(directory, { recursive: true, mode: 0o700 });\n      if (basename(directory) === \".agent-bridge\") chmodSync(directory, 0o700);\n    }\n    return new SQLiteBridgeStore(config.databasePath);\n  }\n  if (config.provider === \"gateway\") {\n    const directory = dirname(config.edgeDatabasePath);\n    mkdirSync(directory, { recursive: true, mode: 0o700 });\n    if (basename(directory) === \".agent-bridge\") chmodSync(directory, 0o700);\n    const remote = new HttpBridgeStore({ baseUrl: config.url!, token: config.credential!, principal: config.principal });\n    const edge = new SQLiteEdgeStore(config.edgeDatabasePath, { endpoint: config.url!, principal: config.principal });\n    return new SyncingBridgeStore(edge, remote, config.principal);\n  }\n  return new LegacySupabaseRestStore(config.url!, config.credential!);\n}\n\nexport async function createClientRuntime(config: ClientConfig): Promise<ClientRuntime> {\n  const store = createStore(config);\n  await store.initialize();\n  return { config, store, service: new BridgeService(store), close: async () => { await store.close?.(); } };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,WAAW,iBAAiB;AACrC,SAAS,UAAU,eAAe;AAY3B,SAAS,YAAY,QAAmC;AAC7D,MAAI,OAAO,aAAa,SAAS;AAC/B,QAAI,OAAO,iBAAiB,YAAY;AACtC,YAAM,YAAY,QAAQ,OAAO,YAAY;AAC7C,gBAAU,WAAW,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACrD,UAAI,SAAS,SAAS,MAAM,gBAAiB,WAAU,WAAW,GAAK;AAAA,IACzE;AACA,WAAO,IAAI,kBAAkB,OAAO,YAAY;AAAA,EAClD;AACA,MAAI,OAAO,aAAa,WAAW;AACjC,UAAM,YAAY,QAAQ,OAAO,gBAAgB;AACjD,cAAU,WAAW,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACrD,QAAI,SAAS,SAAS,MAAM,gBAAiB,WAAU,WAAW,GAAK;AACvE,UAAM,SAAS,IAAI,gBAAgB,EAAE,SAAS,OAAO,KAAM,OAAO,OAAO,YAAa,WAAW,OAAO,UAAU,CAAC;AACnH,UAAM,OAAO,IAAI,gBAAgB,OAAO,kBAAkB,EAAE,UAAU,OAAO,KAAM,WAAW,OAAO,UAAU,CAAC;AAChH,WAAO,IAAI,mBAAmB,MAAM,QAAQ,OAAO,SAAS;AAAA,EAC9D;AACA,SAAO,IAAI,wBAAwB,OAAO,KAAM,OAAO,UAAW;AACpE;AAEA,eAAsB,oBAAoB,QAA8C;AACtF,QAAM,QAAQ,YAAY,MAAM;AAChC,QAAM,MAAM,WAAW;AACvB,SAAO,EAAE,QAAQ,OAAO,SAAS,IAAI,cAAc,KAAK,GAAG,OAAO,YAAY;AAAE,UAAM,MAAM,QAAQ;AAAA,EAAG,EAAE;AAC3G;","names":[]}

package/dist/chunk-KVR4JBRF.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+
+// src/client-config.ts
+import { existsSync, readFileSync } from "fs";
+import { createHash } from "crypto";
+import { homedir } from "os";
+import { join } from "path";
+function pathComponent(value) {
+  const readable = value.replace(/[^A-Za-z0-9._-]+/g, "_").slice(0, 48) || "_";
+  const suffix = createHash("sha256").update(value).digest("hex").slice(0, 12);
+  return `${readable}-${suffix}`;
+}
+function clean(value) {
+  return value?.trim() || void 0;
+}
+function unquote(value) {
+  const input = value.trim();
+  if (input.length > 1 && (input[0] === '"' && input[input.length - 1] === '"' || input[0] === "'" && input[input.length - 1] === "'")) return input.slice(1, -1);
+  return input;
+}
+function readClientConfigFile(path) {
+  if (!existsSync(path)) return {};
+  const result = {};
+  for (const raw of readFileSync(path, "utf8").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const separator = line.indexOf("=");
+    if (separator > 0) result[line.slice(0, separator).trim()] = unquote(line.slice(separator + 1));
+  }
+  return result;
+}
+function resolveClientConfig(env = process.env, explicitAgent) {
+  const home = clean(env.HOME) ?? homedir();
+  const configPath = clean(env.AGENT_BRIDGE_CONFIG) ?? join(home, ".agent-bridge", "config");
+  const file = readClientConfigFile(configPath);
+  const value = (key) => clean(env[key]) ?? clean(file[key]);
+  const rawProvider = value("AGENT_BRIDGE_PROVIDER") ?? (value("AGENT_BRIDGE_TOKEN") ? "gateway" : value("AGENT_BRIDGE_URL") ? "legacy-supabase" : "local");
+  const provider = rawProvider === "legacy" || rawProvider === "supabase" ? "legacy-supabase" : rawProvider;
+  if (!["local", "gateway", "legacy-supabase"].includes(provider)) throw new Error(`Unsupported AGENT_BRIDGE_PROVIDER: ${rawProvider}`);
+  const configuredAgent = clean(env.AGENT_BRIDGE_AGENT);
+  const requestedAgent = clean(explicitAgent);
+  if (configuredAgent && requestedAgent && configuredAgent !== requestedAgent) {
+    throw new Error(`source must match AGENT_BRIDGE_AGENT (${configuredAgent}); got ${requestedAgent}`);
+  }
+  const agent = requestedAgent ?? configuredAgent;
+  if (!agent) throw new Error("AGENT_BRIDGE_AGENT is required");
+  const url = value("AGENT_BRIDGE_URL");
+  const credential = provider === "gateway" ? value("AGENT_BRIDGE_TOKEN") : value("AGENT_BRIDGE_KEY");
+  if (provider !== "local" && (!url || !credential)) throw new Error(`${provider} requires AGENT_BRIDGE_URL and ${provider === "gateway" ? "AGENT_BRIDGE_TOKEN" : "AGENT_BRIDGE_KEY"}`);
+  const workspace = value("AGENT_BRIDGE_WORKSPACE") ?? (provider === "legacy-supabase" ? "*" : "default");
+  const instance = clean(env.AGENT_BRIDGE_INSTANCE);
+  const databasePath = value("AGENT_BRIDGE_DB") ?? join(home, ".agent-bridge", "bridge.sqlite3");
+  const edgeDatabasePath = value("AGENT_BRIDGE_EDGE_DB") ?? join(home, ".agent-bridge", "edge.sqlite3");
+  const cursorScope = createHash("sha256").update(`${provider}\0${provider === "local" ? databasePath : url}`).digest("hex").slice(0, 16);
+  return {
+    provider,
+    principal: { workspace, agent, instance },
+    url,
+    credential,
+    databasePath,
+    edgeDatabasePath,
+    cursorPath: value("AGENT_BRIDGE_CURSOR") ?? join(
+      home,
+      ".agent-bridge",
+      "cursors",
+      pathComponent(provider),
+      cursorScope,
+      pathComponent(workspace),
+      pathComponent(agent),
+      pathComponent(instance ?? "default")
+    ),
+    configPath
+  };
+}
+
+export {
+  readClientConfigFile,
+  resolveClientConfig
+};
+//# sourceMappingURL=chunk-KVR4JBRF.js.map

package/dist/chunk-KVR4JBRF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client-config.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { createHash } from \"node:crypto\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\n\nexport type ClientProvider = \"local\" | \"gateway\" | \"legacy-supabase\";\n\nexport interface ClientEnvironment extends NodeJS.ProcessEnv {\n  AGENT_BRIDGE_PROVIDER?: string;\n  AGENT_BRIDGE_URL?: string;\n  AGENT_BRIDGE_KEY?: string;\n  AGENT_BRIDGE_TOKEN?: string;\n  AGENT_BRIDGE_AGENT?: string;\n  AGENT_BRIDGE_WORKSPACE?: string;\n  AGENT_BRIDGE_INSTANCE?: string;\n  AGENT_BRIDGE_DB?: string;\n  AGENT_BRIDGE_EDGE_DB?: string;\n  AGENT_BRIDGE_CONFIG?: string;\n  AGENT_BRIDGE_CURSOR?: string;\n}\n\nexport interface ClientConfig {\n  provider: ClientProvider;\n  principal: BridgePrincipal;\n  url?: string;\n  credential?: string;\n  databasePath: string;\n  edgeDatabasePath: string;\n  cursorPath: string;\n  configPath: string;\n}\n\nfunction pathComponent(value: string): string {\n  const readable = value.replace(/[^A-Za-z0-9._-]+/g, \"_\").slice(0, 48) || \"_\";\n  const suffix = createHash(\"sha256\").update(value).digest(\"hex\").slice(0, 12);\n  return `${readable}-${suffix}`;\n}\n\nfunction clean(value: string | undefined): string | undefined {\n  return value?.trim() || undefined;\n}\n\nfunction unquote(value: string): string {\n  const input = value.trim();\n  if (input.length > 1 && ((input[0] === '\"' && input[input.length - 1] === '\"') || (input[0] === \"'\" && input[input.length - 1] === \"'\"))) return input.slice(1, -1);\n  return input;\n}\n\nexport function readClientConfigFile(path: string): Record<string, string> {\n  if (!existsSync(path)) return {};\n  const result: Record<string, string> = {};\n  for (const raw of readFileSync(path, \"utf8\").split(/\\r?\\n/)) {\n    const line = raw.trim();\n    if (!line || line.startsWith(\"#\")) continue;\n    const separator = line.indexOf(\"=\");\n    if (separator > 0) result[line.slice(0, separator).trim()] = unquote(line.slice(separator + 1));\n  }\n  return result;\n}\n\nexport function resolveClientConfig(\n  env: ClientEnvironment = process.env,\n  explicitAgent?: string,\n): ClientConfig {\n  const home = clean(env.HOME) ?? homedir();\n  const configPath = clean(env.AGENT_BRIDGE_CONFIG) ?? join(home, \".agent-bridge\", \"config\");\n  const file = readClientConfigFile(configPath);\n  const value = (key: keyof ClientEnvironment) => clean(env[key]) ?? clean(file[key]);\n  const rawProvider = value(\"AGENT_BRIDGE_PROVIDER\") ?? (value(\"AGENT_BRIDGE_TOKEN\") ? \"gateway\" : value(\"AGENT_BRIDGE_URL\") ? \"legacy-supabase\" : \"local\");\n  const provider = rawProvider === \"legacy\" || rawProvider === \"supabase\" ? \"legacy-supabase\" : rawProvider;\n  if (!([\"local\", \"gateway\", \"legacy-supabase\"] as string[]).includes(provider)) throw new Error(`Unsupported AGENT_BRIDGE_PROVIDER: ${rawProvider}`);\n  // Identity belongs to the active client process. A shared config file must\n  // never make one runtime impersonate the client that initialized the bridge.\n  const configuredAgent = clean(env.AGENT_BRIDGE_AGENT);\n  const requestedAgent = clean(explicitAgent);\n  if (configuredAgent && requestedAgent && configuredAgent !== requestedAgent) {\n    throw new Error(`source must match AGENT_BRIDGE_AGENT (${configuredAgent}); got ${requestedAgent}`);\n  }\n  const agent = requestedAgent ?? configuredAgent;\n  if (!agent) throw new Error(\"AGENT_BRIDGE_AGENT is required\");\n  const url = value(\"AGENT_BRIDGE_URL\");\n  const credential = provider === \"gateway\" ? value(\"AGENT_BRIDGE_TOKEN\") : value(\"AGENT_BRIDGE_KEY\");\n  if (provider !== \"local\" && (!url || !credential)) throw new Error(`${provider} requires AGENT_BRIDGE_URL and ${provider === \"gateway\" ? \"AGENT_BRIDGE_TOKEN\" : \"AGENT_BRIDGE_KEY\"}`);\n  const workspace = value(\"AGENT_BRIDGE_WORKSPACE\") ?? (provider === \"legacy-supabase\" ? \"*\" : \"default\");\n  const instance = clean(env.AGENT_BRIDGE_INSTANCE);\n  const databasePath = value(\"AGENT_BRIDGE_DB\") ?? join(home, \".agent-bridge\", \"bridge.sqlite3\");\n  const edgeDatabasePath = value(\"AGENT_BRIDGE_EDGE_DB\") ?? join(home, \".agent-bridge\", \"edge.sqlite3\");\n  const cursorScope = createHash(\"sha256\")\n    .update(`${provider}\\0${provider === \"local\" ? databasePath : url}`)\n    .digest(\"hex\")\n    .slice(0, 16);\n  return {\n    provider: provider as ClientProvider,\n    principal: { workspace, agent, instance },\n    url,\n    credential,\n    databasePath,\n    edgeDatabasePath,\n    cursorPath: value(\"AGENT_BRIDGE_CURSOR\") ?? join(\n      home,\n      \".agent-bridge\",\n      \"cursors\",\n      pathComponent(provider),\n      cursorScope,\n      pathComponent(workspace),\n      pathComponent(agent),\n      pathComponent(instance ?? \"default\"),\n    ),\n    configPath,\n  };\n}\n"],"mappings":";;;AAAA,SAAS,YAAY,oBAAoB;AACzC,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,YAAY;AA8BrB,SAAS,cAAc,OAAuB;AAC5C,QAAM,WAAW,MAAM,QAAQ,qBAAqB,GAAG,EAAE,MAAM,GAAG,EAAE,KAAK;AACzE,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC3E,SAAO,GAAG,QAAQ,IAAI,MAAM;AAC9B;AAEA,SAAS,MAAM,OAA+C;AAC5D,SAAO,OAAO,KAAK,KAAK;AAC1B;AAEA,SAAS,QAAQ,OAAuB;AACtC,QAAM,QAAQ,MAAM,KAAK;AACzB,MAAI,MAAM,SAAS,MAAO,MAAM,CAAC,MAAM,OAAO,MAAM,MAAM,SAAS,CAAC,MAAM,OAAS,MAAM,CAAC,MAAM,OAAO,MAAM,MAAM,SAAS,CAAC,MAAM,KAAO,QAAO,MAAM,MAAM,GAAG,EAAE;AAClK,SAAO;AACT;AAEO,SAAS,qBAAqB,MAAsC;AACzE,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,QAAM,SAAiC,CAAC;AACxC,aAAW,OAAO,aAAa,MAAM,MAAM,EAAE,MAAM,OAAO,GAAG;AAC3D,UAAM,OAAO,IAAI,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG;AACnC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,YAAY,EAAG,QAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,IAAI,QAAQ,KAAK,MAAM,YAAY,CAAC,CAAC;AAAA,EAChG;AACA,SAAO;AACT;AAEO,SAAS,oBACd,MAAyB,QAAQ,KACjC,eACc;AACd,QAAM,OAAO,MAAM,IAAI,IAAI,KAAK,QAAQ;AACxC,QAAM,aAAa,MAAM,IAAI,mBAAmB,KAAK,KAAK,MAAM,iBAAiB,QAAQ;AACzF,QAAM,OAAO,qBAAqB,UAAU;AAC5C,QAAM,QAAQ,CAAC,QAAiC,MAAM,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,GAAG,CAAC;AAClF,QAAM,cAAc,MAAM,uBAAuB,MAAM,MAAM,oBAAoB,IAAI,YAAY,MAAM,kBAAkB,IAAI,oBAAoB;AACjJ,QAAM,WAAW,gBAAgB,YAAY,gBAAgB,aAAa,oBAAoB;AAC9F,MAAI,CAAE,CAAC,SAAS,WAAW,iBAAiB,EAAe,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,sCAAsC,WAAW,EAAE;AAGlJ,QAAM,kBAAkB,MAAM,IAAI,kBAAkB;AACpD,QAAM,iBAAiB,MAAM,aAAa;AAC1C,MAAI,mBAAmB,kBAAkB,oBAAoB,gBAAgB;AAC3E,UAAM,IAAI,MAAM,yCAAyC,eAAe,UAAU,cAAc,EAAE;AAAA,EACpG;AACA,QAAM,QAAQ,kBAAkB;AAChC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,gCAAgC;AAC5D,QAAM,MAAM,MAAM,kBAAkB;AACpC,QAAM,aAAa,aAAa,YAAY,MAAM,oBAAoB,IAAI,MAAM,kBAAkB;AAClG,MAAI,aAAa,YAAY,CAAC,OAAO,CAAC,YAAa,OAAM,IAAI,MAAM,GAAG,QAAQ,kCAAkC,aAAa,YAAY,uBAAuB,kBAAkB,EAAE;AACpL,QAAM,YAAY,MAAM,wBAAwB,MAAM,aAAa,oBAAoB,MAAM;AAC7F,QAAM,WAAW,MAAM,IAAI,qBAAqB;AAChD,QAAM,eAAe,MAAM,iBAAiB,KAAK,KAAK,MAAM,iBAAiB,gBAAgB;AAC7F,QAAM,mBAAmB,MAAM,sBAAsB,KAAK,KAAK,MAAM,iBAAiB,cAAc;AACpG,QAAM,cAAc,WAAW,QAAQ,EACpC,OAAO,GAAG,QAAQ,KAAK,aAAa,UAAU,eAAe,GAAG,EAAE,EAClE,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AACd,SAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,WAAW,OAAO,SAAS;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAM,qBAAqB,KAAK;AAAA,MAC1C;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA,cAAc,SAAS;AAAA,MACvB,cAAc,KAAK;AAAA,MACnB,cAAc,YAAY,SAAS;AAAA,IACrC;AAAA,IACA;AAAA,EACF;AACF;","names":[]}