@creatornader/agent-bridge 0.3.1 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@creatornader/agent-bridge",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Durable, pull-first mailbox and work-delivery control plane for AI agents across runtimes, sessions, and machines.",
   "type": "module",
   "license": "Apache-2.0",
@@ -87,13 +87,17 @@
     "pretest": "npm run build",
     "test": "vitest run",
     "test:built": "vitest run",
+    "test:postgres:contract": "vitest run test/postgres_integration.test.ts --maxWorkers=1 --hookTimeout=60000",
+    "test:postgres:preflight": "node scripts/postgres-preflight.mjs",
+    "test:postgres:preflight:full": "node scripts/postgres-preflight.mjs --full",
+    "test:windows:contract": "vitest run test/private-path.test.ts test/windows-native-smoke.test.ts --maxWorkers=1 --testTimeout=180000 -t \"applies and verifies native Windows file and directory ACLs|recovers an (enrollment|client-operation) subsystem lock\" && vitest run test/client-maintenance.test.ts --maxWorkers=1 --testTimeout=180000",
     "typecheck": "tsc --noEmit",
     "contracts:generate": "npm run build --silent && npm run contracts:generate:built",
     "contracts:generate:built": "node dist/contracts/generate.js",
     "contracts:check": "npm run build --silent && npm run contracts:check:built",
     "contracts:check:built": "node dist/contracts/generate.js --check",
     "check": "npm run typecheck && npm run build && npm run contracts:check:built && npm run test:built",
-    "check:windows": "npm run typecheck && npm run build && npm run contracts:check:built && vitest run --maxWorkers=2 --testTimeout=90000"
+    "check:windows": "npm run typecheck && npm run build && npm run contracts:check:built && vitest run --maxWorkers=2 --testTimeout=90000 --exclude test/private-path.test.ts --exclude test/client-maintenance.test.ts --exclude test/cli.test.ts"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",

package/schemas/agent-bridge-v2.capabilities.json

@@ -88,6 +88,12 @@
                 "legacy-supabase"
               ]
             },
+            "grantedScopes": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
             "operations": {
               "type": "array",
               "items": {
@@ -134,6 +140,24 @@
         "status:read"
       ]
     },
+    {
+      "id": "issue_endpoint_migration_challenge",
+      "summary": "Issue a short-lived endpoint migration challenge commitment.",
+      "http": {
+        "method": "POST",
+        "path": "/v2/endpoint-migration-challenges"
+      },
+      "requiredScopes": []
+    },
+    {
+      "id": "consume_endpoint_migration_challenge",
+      "summary": "Consume a short-lived endpoint migration challenge commitment.",
+      "http": {
+        "method": "POST",
+        "path": "/v2/endpoint-migration-challenges/consume"
+      },
+      "requiredScopes": []
+    },
     {
       "id": "gateway_metrics",
       "summary": "Read Prometheus gateway counters.",

package/schemas/agent-bridge-v2.mcp.json

@@ -77,6 +77,12 @@
               "legacy-supabase"
             ]
           },
+          "grantedScopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
           "operations": {
             "type": "array",
             "items": {

package/schemas/agent-bridge-v2.schema.json

@@ -338,6 +338,12 @@
             "legacy-supabase"
           ]
         },
+        "grantedScopes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "operations": {
           "type": "array",
           "items": {
@@ -432,6 +438,12 @@
             "legacy-supabase"
           ]
         },
+        "grantedScopes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "operations": {
           "type": "array",
           "items": {
@@ -586,6 +598,12 @@
             }
           ]
         },
+        "gatewayAuthorityId": {
+          "type": "string"
+        },
+        "credentialId": {
+          "type": "string"
+        },
         "principal": {
           "type": "object",
           "required": [
@@ -605,6 +623,111 @@
       },
       "additionalProperties": true
     },
+    "issue_endpoint_migration_challengeRequest": {
+      "type": "object",
+      "required": [
+        "challenge",
+        "expectedGatewayAuthorityId",
+        "verifierCredentialId"
+      ],
+      "properties": {
+        "challenge": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "expectedGatewayAuthorityId": {
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+        "verifierCredentialId": {
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "issue_endpoint_migration_challengeResponse": {
+      "type": "object",
+      "required": [
+        "gatewayAuthorityId",
+        "issuerCredentialId",
+        "verifierCredentialId",
+        "expiresAt"
+      ],
+      "properties": {
+        "gatewayAuthorityId": {
+          "type": "string"
+        },
+        "issuerCredentialId": {
+          "type": "string"
+        },
+        "verifierCredentialId": {
+          "type": "string"
+        },
+        "expiresAt": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "consume_endpoint_migration_challengeRequest": {
+      "type": "object",
+      "required": [
+        "challenge",
+        "expectedGatewayAuthorityId",
+        "issuerCredentialId"
+      ],
+      "properties": {
+        "challenge": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "expectedGatewayAuthorityId": {
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+        "issuerCredentialId": {
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "consume_endpoint_migration_challengeResponse": {
+      "type": "object",
+      "required": [
+        "gatewayAuthorityId",
+        "issuerCredentialId",
+        "verifierCredentialId",
+        "expiresAt",
+        "consumed"
+      ],
+      "properties": {
+        "gatewayAuthorityId": {
+          "type": "string"
+        },
+        "issuerCredentialId": {
+          "type": "string"
+        },
+        "verifierCredentialId": {
+          "type": "string"
+        },
+        "expiresAt": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "consumed": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    },
     "client_statusRequest": {
       "type": "object",
       "properties": {},
@@ -834,6 +957,12 @@
                 }
               ]
             },
+            "gatewayAuthorityId": {
+              "type": "string"
+            },
+            "credentialId": {
+              "type": "string"
+            },
             "principal": {
               "type": "object",
               "required": [
@@ -927,6 +1056,7 @@
                 "idle",
                 "running",
                 "backoff",
+                "paused",
                 "stopped",
                 "failed"
               ]
@@ -936,6 +1066,19 @@
             },
             "remoteError": {
               "type": "string"
+            },
+            "migrationState": {
+              "enum": [
+                "active",
+                "draining",
+                "retired"
+              ]
+            },
+            "migrationOperationId": {
+              "type": "string"
+            },
+            "migrationLeaseExpiresAt": {
+              "type": "string"
             }
           },
           "additionalProperties": true
@@ -1195,6 +1338,12 @@
                 }
               ]
             },
+            "gatewayAuthorityId": {
+              "type": "string"
+            },
+            "credentialId": {
+              "type": "string"
+            },
             "principal": {
               "type": "object",
               "required": [
@@ -1288,6 +1437,7 @@
                 "idle",
                 "running",
                 "backoff",
+                "paused",
                 "stopped",
                 "failed"
               ]
@@ -1297,6 +1447,19 @@
             },
             "remoteError": {
               "type": "string"
+            },
+            "migrationState": {
+              "enum": [
+                "active",
+                "draining",
+                "retired"
+              ]
+            },
+            "migrationOperationId": {
+              "type": "string"
+            },
+            "migrationLeaseExpiresAt": {
+              "type": "string"
             }
           },
           "additionalProperties": true

package/sql/migrations/017_gateway_authority_binding.sql

@@ -0,0 +1,99 @@
+begin;
+
+select pg_advisory_xact_lock(1646705660);
+
+create table agent_bridge.gateway_authority (
+  singleton boolean not null default true,
+  authority_id uuid not null default gen_random_uuid(),
+  constraint gateway_authority_singleton primary key (singleton),
+  constraint gateway_authority_singleton_true check (singleton),
+  constraint gateway_authority_id_unique unique (authority_id)
+);
+
+insert into agent_bridge.gateway_authority(singleton) values (true);
+
+create function agent_bridge.reject_gateway_authority_mutation()
+returns trigger
+language plpgsql set search_path = '' as $$
+begin
+  raise exception 'gateway authority is immutable';
+end
+$$;
+
+create trigger gateway_authority_immutable
+before update or delete or truncate on agent_bridge.gateway_authority
+for each statement execute function agent_bridge.reject_gateway_authority_mutation();
+
+create function agent_bridge.gateway_authority_ready()
+returns boolean
+language sql stable security definer set search_path = '' as $$
+  select count(*)=1 and bool_and(singleton and authority_id is not null)
+  from agent_bridge.gateway_authority
+$$;
+
+create function agent_bridge.open_request_authority_bound(
+  requested_credential_id uuid,
+  credential_hash text,
+  requested_request_id uuid
+) returns table(
+  gateway_authority_id uuid,
+  credential_id uuid,
+  workspace_id text,
+  principal text,
+  scopes text[]
+)
+language plpgsql volatile security definer set search_path = '' as $$
+declare
+  bound_gateway_authority_id uuid;
+  authority_credential_id uuid;
+  authority_workspace_id text;
+  authority_principal text;
+  authority_scopes text[];
+begin
+  select authority_id into strict bound_gateway_authority_id
+  from agent_bridge.gateway_authority
+  where singleton;
+
+  select authority.credential_id,authority.workspace_id,authority.principal,authority.scopes
+    into authority_credential_id,authority_workspace_id,authority_principal,authority_scopes
+  from agent_bridge.open_request_authority(
+    requested_credential_id,credential_hash,requested_request_id
+  ) authority;
+
+  if not found then return; end if;
+
+  gateway_authority_id := bound_gateway_authority_id;
+  credential_id := authority_credential_id;
+  workspace_id := authority_workspace_id;
+  principal := authority_principal;
+  scopes := authority_scopes;
+  return next;
+end
+$$;
+
+revoke all on agent_bridge.gateway_authority from public;
+revoke all on function agent_bridge.reject_gateway_authority_mutation() from public;
+revoke all on function agent_bridge.gateway_authority_ready() from public;
+revoke all on function agent_bridge.open_request_authority_bound(uuid,text,uuid) from public;
+
+do $roles$
+declare
+  runtime_role text := 'agent_bridge_runtime_' || substr(md5(current_database()),1,16);
+  role_name text;
+begin
+  foreach role_name in array array[runtime_role,'anon','authenticated'] loop
+    if exists (select 1 from pg_roles where rolname=role_name) then
+      execute format('revoke all on agent_bridge.gateway_authority from %I',role_name);
+      execute format('revoke all on function agent_bridge.gateway_authority_ready() from %I',role_name);
+      execute format('revoke all on function agent_bridge.open_request_authority_bound(uuid,text,uuid) from %I',role_name);
+    end if;
+  end loop;
+  execute format('grant execute on function agent_bridge.gateway_authority_ready() to %I',runtime_role);
+  execute format('grant execute on function agent_bridge.open_request_authority_bound(uuid,text,uuid) to %I',runtime_role);
+end
+$roles$;
+
+insert into agent_bridge.schema_migrations(version,name,checksum)
+values (17,'gateway_authority_binding','__AGENT_BRIDGE_MIGRATION_CHECKSUM__');
+
+commit;