@creatornader/agent-bridge 0.3.1 → 0.5.0

package/dist/{chunk-Q6PPMXJC.js → chunk-SN7PIVDF.js}

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import {
+  SQLITE_INITIALIZATION_BUSY_TIMEOUT_MS,
   assertEdgeUpgradeCandidate,
   installEdgeMarkers,
   retrySqliteBusy
-} from "./chunk-5GMB3A77.js";
+} from "./chunk-IVG4XWWS.js";
 import {
   preparePrivateSqliteLocation,
   securePrivatePath,
+  securePrivateSqliteSidecar,
   verifyPrivatePathAccess
-} from "./chunk-NCO7RLBM.js";
+} from "./chunk-GTK4KOED.js";
 import {
   cursorScope,
   decodeCursor,
@@ -19,11 +21,16 @@ import {
 import { createHash, randomUUID } from "crypto";
 import { existsSync, lstatSync } from "fs";
 import { createRequire } from "module";
+import { pathToFileURL } from "url";
 var require2 = createRequire(import.meta.url);
 function openDatabase(path) {
   const { DatabaseSync } = require2("node:sqlite");
   return new DatabaseSync(path);
 }
+function openReadOnlyDatabase(path) {
+  const { DatabaseSync } = require2("node:sqlite");
+  return new DatabaseSync(`${pathToFileURL(path).toString()}?immutable=1`, { readOnly: true });
+}
 var MAX_SEQUENCE = 9223372036854775807n;
 var schema = `
 PRAGMA journal_mode = WAL;
@@ -42,6 +49,21 @@ CREATE TABLE IF NOT EXISTS edge_scopes (
   last_attempt_at TEXT,
   cache_contract INTEGER NOT NULL DEFAULT 1
 );
+CREATE TABLE IF NOT EXISTS edge_migration_gates (
+  scope_key TEXT PRIMARY KEY REFERENCES edge_scopes(scope_key),
+  state TEXT NOT NULL CHECK(state IN ('active', 'draining', 'retired')),
+  operation_id TEXT,
+  lease_token TEXT,
+  lease_expires_at TEXT,
+  updated_at TEXT NOT NULL,
+  CHECK(
+    (state='active' AND operation_id IS NULL AND lease_token IS NULL AND lease_expires_at IS NULL)
+    OR (state='draining' AND operation_id IS NOT NULL AND lease_token IS NOT NULL AND lease_expires_at IS NOT NULL)
+    OR (state='retired' AND operation_id IS NOT NULL AND lease_token IS NULL AND lease_expires_at IS NULL)
+  )
+);
+CREATE INDEX IF NOT EXISTS edge_migration_gates_state
+  ON edge_migration_gates(state, lease_expires_at);
 CREATE TABLE IF NOT EXISTS edge_outbox (
   position INTEGER PRIMARY KEY AUTOINCREMENT,
   scope_key TEXT NOT NULL REFERENCES edge_scopes(scope_key),
@@ -62,6 +84,15 @@ CREATE TABLE IF NOT EXISTS edge_outbox (
 );
 CREATE INDEX IF NOT EXISTS edge_outbox_due
   ON edge_outbox(scope_key, state, available_at, position);
+CREATE TRIGGER IF NOT EXISTS edge_outbox_migration_gate_insert
+BEFORE INSERT ON edge_outbox
+WHEN NOT EXISTS (
+  SELECT 1 FROM edge_migration_gates
+  WHERE scope_key=NEW.scope_key AND state='active'
+)
+BEGIN
+  SELECT RAISE(ABORT, 'edge migration gate rejects outbox publication');
+END;
 CREATE TABLE IF NOT EXISTS edge_inbox (
   scope_key TEXT NOT NULL REFERENCES edge_scopes(scope_key),
   message_id TEXT NOT NULL,
@@ -87,12 +118,81 @@ CREATE INDEX IF NOT EXISTS edge_inbox_thread
 CREATE INDEX IF NOT EXISTS edge_inbox_created
   ON edge_inbox(scope_key, created_at, sequence_key);
 `;
+function inspectEdgeScopeReadOnly(path, scope, now = /* @__PURE__ */ new Date()) {
+  if (!existsSync(path)) {
+    return { exists: false, gate: { scopeKey: edgeScopeKey(scope), state: "active", operationId: void 0, leaseExpiresAt: void 0, updatedAt: (/* @__PURE__ */ new Date(0)).toISOString() }, pending: 0, due: 0, scheduled: 0, leased: 0, blocked: 0, cached: 0 };
+  }
+  verifyPrivatePathAccess(path, "file");
+  const details = lstatSync(path);
+  if (!details.isFile() || details.isSymbolicLink()) throw new EdgeConflictError("edge database is not a private regular file");
+  if (existsSync(`${path}-wal`) || existsSync(`${path}-shm`)) {
+    throw new EdgeConflictError("read-only migration inspection refuses an edge with live WAL state");
+  }
+  const db = openReadOnlyDatabase(path);
+  try {
+    const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name IN ('edge_scopes','edge_migration_gates','edge_outbox','edge_inbox') ORDER BY name").all();
+    if (tables.length === 0) {
+      const userTables = db.prepare("SELECT count(*) AS count FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").get();
+      if (Number(userTables.count) !== 0) throw new EdgeConflictError("edge database is not an Agent Bridge edge store");
+      return { exists: true, gate: { scopeKey: edgeScopeKey(scope), state: "active", operationId: void 0, leaseExpiresAt: void 0, updatedAt: (/* @__PURE__ */ new Date(0)).toISOString() }, pending: 0, due: 0, scheduled: 0, leased: 0, blocked: 0, cached: 0 };
+    }
+    if (tables.length !== 4) throw new EdgeConflictError("edge database schema is incomplete");
+    const key = edgeScopeKey(scope);
+    const scopeRow = db.prepare("SELECT 1 AS present FROM edge_scopes WHERE scope_key=?").get(key);
+    if (!scopeRow) {
+      return { exists: true, gate: { scopeKey: key, state: "active", operationId: void 0, leaseExpiresAt: void 0, updatedAt: (/* @__PURE__ */ new Date(0)).toISOString() }, pending: 0, due: 0, scheduled: 0, leased: 0, blocked: 0, cached: 0 };
+    }
+    const gateRow = db.prepare("SELECT state,operation_id,lease_expires_at,updated_at FROM edge_migration_gates WHERE scope_key=?").get(key);
+    if (!gateRow || !["active", "draining", "retired"].includes(String(gateRow.state))) throw new EdgeConflictError("edge migration gate is missing or invalid");
+    const nowText = now.toISOString();
+    const counts = db.prepare(`SELECT
+      sum(CASE WHEN state='pending' THEN 1 ELSE 0 END) AS pending,
+      sum(CASE WHEN state='pending' AND available_at<=? AND (lease_expires_at IS NULL OR lease_expires_at<=?) THEN 1 ELSE 0 END) AS due,
+      sum(CASE WHEN state='pending' AND available_at>? AND (lease_expires_at IS NULL OR lease_expires_at<=?) THEN 1 ELSE 0 END) AS scheduled,
+      sum(CASE WHEN state='pending' AND lease_expires_at>? THEN 1 ELSE 0 END) AS leased,
+      sum(CASE WHEN state='blocked' THEN 1 ELSE 0 END) AS blocked
+      FROM edge_outbox WHERE scope_key=?`).get(nowText, nowText, nowText, nowText, nowText, key);
+    const cached = db.prepare("SELECT count(*) AS count FROM edge_inbox WHERE scope_key=?").get(key);
+    return {
+      exists: true,
+      gate: { scopeKey: key, state: gateRow.state, operationId: gateRow.operation_id ? String(gateRow.operation_id) : void 0, leaseExpiresAt: gateRow.lease_expires_at ? String(gateRow.lease_expires_at) : void 0, updatedAt: gateRow.updated_at ? String(gateRow.updated_at) : (/* @__PURE__ */ new Date(0)).toISOString() },
+      pending: Number(counts.pending ?? 0),
+      due: Number(counts.due ?? 0),
+      scheduled: Number(counts.scheduled ?? 0),
+      leased: Number(counts.leased ?? 0),
+      blocked: Number(counts.blocked ?? 0),
+      cached: Number(cached.count ?? 0)
+    };
+  } finally {
+    db.close();
+  }
+}
 var EdgeConflictError = class extends Error {
   constructor() {
     super(...arguments);
     this.code = "edge_idempotency_conflict";
   }
 };
+var EdgeMigrationDrainingError = class extends Error {
+  constructor(gate) {
+    super("edge scope is draining for a client migration");
+    this.gate = gate;
+    this.code = "client_migration_draining";
+  }
+};
+var EdgeMigrationRetiredError = class extends Error {
+  constructor(gate) {
+    super("edge scope was retired by a client migration");
+    this.gate = gate;
+    this.code = "client_migration_retired";
+  }
+};
+var EdgeMigrationLeaseError = class extends Error {
+  constructor() {
+    super("client migration worker no longer holds the edge drain lease");
+    this.code = "client_migration_lease_lost";
+  }
+};
 function canonical(value) {
   if (value === void 0) return "null";
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -143,20 +243,26 @@ function parseDraft(value) {
 function parseMessage(value) {
   return JSON.parse(String(value));
 }
+function safeOperationId(value) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
+    throw new Error("client migration operation ID is invalid");
+  }
+  return value.toLowerCase();
+}
 var SQLiteEdgeStore = class {
   constructor(path, scope, busyTimeoutMs = 2e3) {
     this.path = path;
     this.scope = scope;
     this.busyTimeoutMs = busyTimeoutMs;
     this.initialized = false;
-    const selected = preparePrivateSqliteLocation(path, true);
+    const selected = preparePrivateSqliteLocation(path, true, "defer");
     this.databasePath = selected;
     this.preexistingFiles = new Set(selected === ":memory:" ? [] : [selected, `${selected}-wal`, `${selected}-shm`].filter(existsSync));
     const before = selected === ":memory:" || !existsSync(selected) ? void 0 : lstatSync(selected);
     this.db = openDatabase(selected);
     try {
       this.db.exec(`PRAGMA busy_timeout = ${Math.max(1, Math.trunc(this.busyTimeoutMs))}`);
-      this.restrictFiles();
+      this.restrictFiles(false);
       if (before) {
         const after = lstatSync(selected);
         if (after.dev !== before.dev || after.ino !== before.ino) throw new Error("SQLite edge database path identity changed while opening");
@@ -167,17 +273,59 @@ var SQLiteEdgeStore = class {
     }
     this.key = edgeScopeKey(scope);
   }
-  restrictFiles() {
+  restrictFiles(includeSidecars = true) {
     if (this.databasePath === ":memory:") return;
-    for (const path of [this.databasePath, `${this.databasePath}-wal`, `${this.databasePath}-shm`]) {
+    const paths = includeSidecars ? [this.databasePath, `${this.databasePath}-wal`, `${this.databasePath}-shm`] : [this.databasePath];
+    for (const path of paths) {
       if (!existsSync(path)) continue;
       if (path === this.databasePath && this.preexistingFiles.has(path)) verifyPrivatePathAccess(path, "file");
-      else securePrivatePath(path, "file");
+      else if (path === this.databasePath) securePrivatePath(path, "file");
+      else securePrivateSqliteSidecar(path);
     }
   }
   get scopeKey() {
     return this.key;
   }
+  gateFromRow(row) {
+    const state = String(row.state);
+    if (state !== "active" && state !== "draining" && state !== "retired") {
+      throw new EdgeConflictError("edge migration gate state is invalid");
+    }
+    const operationId = row.operation_id === null || row.operation_id === void 0 ? void 0 : safeOperationId(String(row.operation_id));
+    const leaseExpiresAt = row.lease_expires_at === null || row.lease_expires_at === void 0 ? void 0 : String(row.lease_expires_at);
+    const updatedAt = String(row.updated_at ?? "");
+    if (!updatedAt || !Number.isFinite(Date.parse(updatedAt))) {
+      throw new EdgeConflictError("edge migration gate timestamp is invalid");
+    }
+    const leaseToken = row.lease_token === null || row.lease_token === void 0 ? void 0 : String(row.lease_token);
+    if (state === "active" && (operationId || leaseExpiresAt || leaseToken) || state === "draining" && (!operationId || !leaseExpiresAt || !leaseToken) || state === "retired" && (!operationId || leaseExpiresAt || leaseToken)) {
+      throw new EdgeConflictError("edge migration gate state is invalid");
+    }
+    return { scopeKey: this.key, state, operationId, leaseExpiresAt, updatedAt };
+  }
+  gateInTransaction() {
+    const row = this.db.prepare(`SELECT state,operation_id,lease_token,lease_expires_at,updated_at
+      FROM edge_migration_gates WHERE scope_key=?`).get(this.key);
+    if (!row) throw new EdgeConflictError("edge migration gate is missing");
+    return this.gateFromRow(row);
+  }
+  assertScopeActiveInTransaction() {
+    const gate = this.gateInTransaction();
+    if (gate.state === "draining") throw new EdgeMigrationDrainingError(gate);
+    if (gate.state === "retired") throw new EdgeMigrationRetiredError(gate);
+  }
+  assertDrainLeaseInTransaction(lease, now) {
+    const gate = this.gateInTransaction();
+    if (gate.state !== "draining" || gate.operationId !== lease.operationId || gate.leaseExpiresAt !== lease.leaseExpiresAt || Date.parse(gate.leaseExpiresAt) <= now.getTime()) {
+      throw new EdgeMigrationLeaseError();
+    }
+    const row = this.db.prepare("SELECT lease_token FROM edge_migration_gates WHERE scope_key=?").get(this.key);
+    if (row.lease_token !== lease.leaseToken) throw new EdgeMigrationLeaseError();
+  }
+  assertClaimAuthorityInTransaction(now, lease) {
+    if (lease) this.assertDrainLeaseInTransaction(lease, now);
+    else this.assertScopeActiveInTransaction();
+  }
   async initialize() {
     if (this.initialized) return;
     if (!this.initialization) {
@@ -192,8 +340,9 @@ var SQLiteEdgeStore = class {
   }
   async initializeOnce() {
     assertEdgeUpgradeCandidate(this.db);
-    await retrySqliteBusy(() => this.db.exec(schema), this.busyTimeoutMs);
-    await retrySqliteBusy(() => this.db.exec("BEGIN IMMEDIATE"), this.busyTimeoutMs);
+    const initializationTimeoutMs = Math.max(this.busyTimeoutMs, SQLITE_INITIALIZATION_BUSY_TIMEOUT_MS);
+    await retrySqliteBusy(() => this.db.exec(schema), initializationTimeoutMs);
+    await retrySqliteBusy(() => this.db.exec("BEGIN IMMEDIATE"), initializationTimeoutMs);
     try {
       const scopeColumns = this.db.prepare("PRAGMA table_info(edge_scopes)").all();
       if (!scopeColumns.some((column) => column.name === "cache_contract")) {
@@ -223,6 +372,10 @@ var SQLiteEdgeStore = class {
     const endpointHash = createHash("sha256").update(this.scope.endpoint.replace(/\/$/, "")).digest("hex");
     this.db.prepare(`INSERT INTO edge_scopes (scope_key, endpoint_hash, workspace, agent)
       VALUES (?, ?, ?, ?) ON CONFLICT(scope_key) DO NOTHING`).run(this.key, endpointHash, this.scope.principal.workspace, this.scope.principal.agent);
+    this.db.prepare(`INSERT INTO edge_migration_gates
+      (scope_key,state,operation_id,lease_token,lease_expires_at,updated_at)
+      SELECT scope_key,'active',NULL,NULL,NULL,? FROM edge_scopes
+      WHERE scope_key=? ON CONFLICT(scope_key) DO NOTHING`).run((/* @__PURE__ */ new Date()).toISOString(), this.key);
     const contract = this.db.prepare("SELECT cache_contract FROM edge_scopes WHERE scope_key=?").get(this.key);
     if (Number(contract.cache_contract) < 1) {
       this.db.exec("BEGIN IMMEDIATE");
@@ -238,6 +391,162 @@ var SQLiteEdgeStore = class {
   async ready() {
     await this.initialize();
   }
+  async migrationGate() {
+    await this.ready();
+    return this.gateInTransaction();
+  }
+  /** Refuse new normal-client writes before any remote attempt begins. */
+  async assertScopeActive() {
+    await this.ready();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      this.assertScopeActiveInTransaction();
+      this.db.exec("COMMIT");
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  /** Refuse remote publication unless this worker still owns the durable drain lease. */
+  async assertDrainLease(lease, now = /* @__PURE__ */ new Date()) {
+    await this.ready();
+    if (lease.scopeKey !== this.key) throw new EdgeMigrationLeaseError();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      this.assertDrainLeaseInTransaction(lease, now);
+      this.db.exec("COMMIT");
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  async claimDrainLease(operationId, now, leaseMs, mode) {
+    await this.ready();
+    const normalizedOperationId = safeOperationId(operationId);
+    const duration = Math.max(1, Math.trunc(leaseMs));
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const gate = this.gateInTransaction();
+      if (gate.state === "retired") throw new EdgeMigrationRetiredError(gate);
+      if (mode === "begin" && gate.state !== "active") throw new EdgeMigrationDrainingError(gate);
+      if (mode === "resume") {
+        if (gate.state !== "draining" || gate.operationId !== normalizedOperationId || !gate.leaseExpiresAt || Date.parse(gate.leaseExpiresAt) > now.getTime()) {
+          throw new EdgeMigrationDrainingError(gate);
+        }
+      }
+      const leaseToken = randomUUID();
+      const leaseExpiresAt = new Date(now.getTime() + duration).toISOString();
+      const updated = this.db.prepare(`UPDATE edge_migration_gates
+        SET state='draining',operation_id=?,lease_token=?,lease_expires_at=?,updated_at=?
+        WHERE scope_key=?`).run(
+        normalizedOperationId,
+        leaseToken,
+        leaseExpiresAt,
+        now.toISOString(),
+        this.key
+      );
+      if (updated.changes !== 1) throw new EdgeConflictError("edge migration gate could not be acquired");
+      this.db.exec("COMMIT");
+      return { scopeKey: this.key, operationId: normalizedOperationId, leaseToken, leaseExpiresAt };
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  /** Start a new durable drain only from an active edge scope. */
+  async beginDrain(operationId, now = /* @__PURE__ */ new Date(), leaseMs = 3e4) {
+    return this.claimDrainLease(operationId, now, leaseMs, "begin");
+  }
+  /** Resume the same persisted drain only after the prior worker lease expires. */
+  async resumeDrain(operationId, now = /* @__PURE__ */ new Date(), leaseMs = 3e4) {
+    return this.claimDrainLease(operationId, now, leaseMs, "resume");
+  }
+  /** Backward-compatible dispatcher for callers that have already inspected the gate. */
+  async acquireDrainLease(operationId, now = /* @__PURE__ */ new Date(), leaseMs = 3e4) {
+    const gate = await this.migrationGate();
+    if (gate.state === "active") return this.beginDrain(operationId, now, leaseMs);
+    return this.resumeDrain(operationId, now, leaseMs);
+  }
+  /** Verify the held lease and require an exact zero-work outbox before a cutover continues. */
+  async assertDrainComplete(lease, now = /* @__PURE__ */ new Date()) {
+    await this.ready();
+    if (lease.scopeKey !== this.key) throw new EdgeMigrationLeaseError();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      this.assertDrainLeaseInTransaction(lease, now);
+      const counts = this.db.prepare(`SELECT
+        sum(CASE WHEN state='pending' THEN 1 ELSE 0 END) AS pending,
+        sum(CASE WHEN state='pending' AND available_at<=? AND (lease_expires_at IS NULL OR lease_expires_at<=?) THEN 1 ELSE 0 END) AS due,
+        sum(CASE WHEN state='pending' AND available_at>? AND (lease_expires_at IS NULL OR lease_expires_at<=?) THEN 1 ELSE 0 END) AS scheduled,
+        sum(CASE WHEN state='pending' AND lease_expires_at>? THEN 1 ELSE 0 END) AS leased,
+        sum(CASE WHEN state='blocked' THEN 1 ELSE 0 END) AS blocked
+        FROM edge_outbox WHERE scope_key=?`).get(
+        now.toISOString(),
+        now.toISOString(),
+        now.toISOString(),
+        now.toISOString(),
+        now.toISOString(),
+        this.key
+      );
+      if (Number(counts.pending ?? 0) !== 0 || Number(counts.due ?? 0) !== 0 || Number(counts.scheduled ?? 0) !== 0 || Number(counts.leased ?? 0) !== 0 || Number(counts.blocked ?? 0) !== 0) {
+        throw new EdgeConflictError("edge scope cannot complete a drain with retained outbox work");
+      }
+      this.db.exec("COMMIT");
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  async renewDrainLease(lease, now = /* @__PURE__ */ new Date(), leaseMs = 3e4) {
+    await this.ready();
+    if (lease.scopeKey !== this.key) throw new EdgeMigrationLeaseError();
+    const duration = Math.max(1, Math.trunc(leaseMs));
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      this.assertDrainLeaseInTransaction(lease, now);
+      const leaseExpiresAt = new Date(now.getTime() + duration).toISOString();
+      const updated = this.db.prepare(`UPDATE edge_migration_gates
+        SET lease_expires_at=?,updated_at=? WHERE scope_key=? AND state='draining'
+          AND operation_id=? AND lease_token=? AND lease_expires_at=?`).run(
+        leaseExpiresAt,
+        now.toISOString(),
+        this.key,
+        lease.operationId,
+        lease.leaseToken,
+        lease.leaseExpiresAt
+      );
+      if (updated.changes !== 1) throw new EdgeMigrationLeaseError();
+      this.db.exec("COMMIT");
+      return { ...lease, leaseExpiresAt };
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  async retireScope(lease, now = /* @__PURE__ */ new Date()) {
+    await this.ready();
+    if (lease.scopeKey !== this.key) throw new EdgeMigrationLeaseError();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      this.assertDrainLeaseInTransaction(lease, now);
+      const stats = this.db.prepare(`SELECT count(*) AS count FROM edge_outbox
+        WHERE scope_key=?`).get(this.key);
+      if (Number(stats.count) !== 0) throw new EdgeConflictError("edge scope cannot retire with retained outbox work");
+      const updated = this.db.prepare(`UPDATE edge_migration_gates
+        SET state='retired',lease_token=NULL,lease_expires_at=NULL,updated_at=?
+        WHERE scope_key=? AND state='draining' AND operation_id=? AND lease_token=?`).run(
+        now.toISOString(),
+        this.key,
+        lease.operationId,
+        lease.leaseToken
+      );
+      if (updated.changes !== 1) throw new EdgeMigrationLeaseError();
+      this.db.exec("COMMIT");
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
   async enqueue(input, now = /* @__PURE__ */ new Date()) {
     await this.ready();
     const draft = stableIdempotency(input);
@@ -246,6 +555,7 @@ var SQLiteEdgeStore = class {
     const nowText = now.toISOString();
     this.db.exec("BEGIN IMMEDIATE");
     try {
+      this.assertScopeActiveInTransaction();
       const existing = this.db.prepare(`SELECT * FROM edge_outbox
         WHERE scope_key=? AND (message_id=? OR idempotency_key=?) ORDER BY position LIMIT 1`).get(this.key, draft.id, draft.idempotencyKey);
       if (existing) {
@@ -265,11 +575,12 @@ var SQLiteEdgeStore = class {
       throw error;
     }
   }
-  async claimNext(now = /* @__PURE__ */ new Date(), leaseMs = 3e4) {
+  async claimNext(now = /* @__PURE__ */ new Date(), leaseMs = 3e4, migrationLease) {
     await this.ready();
     const nowText = now.toISOString();
     this.db.exec("BEGIN IMMEDIATE");
     try {
+      this.assertClaimAuthorityInTransaction(now, migrationLease);
       const head = this.db.prepare(`SELECT * FROM edge_outbox
         WHERE scope_key=? AND state='pending' AND available_at<=?
           AND (lease_expires_at IS NULL OR lease_expires_at<=?)
@@ -499,6 +810,7 @@ var SQLiteEdgeStore = class {
     const state = this.db.prepare(`SELECT pull_cursor, last_sync_at, last_error,
       last_outbound_sync_at,last_inbound_sync_at,last_attempt_at
       FROM edge_scopes WHERE scope_key=?`).get(this.key);
+    const migrationGate = this.gateInTransaction();
     const oldestDueAt = counts.oldest_due ? String(counts.oldest_due) : void 0;
     const oldestBlockedAt = Number(counts.blocked_age_unknown ?? 0) > 0 ? void 0 : counts.oldest_blocked ? String(counts.oldest_blocked) : void 0;
     return {
@@ -520,7 +832,10 @@ var SQLiteEdgeStore = class {
       nextRetryAt: counts.next_retry ? String(counts.next_retry) : void 0,
       lastOutboundSyncAt: state.last_outbound_sync_at ? String(state.last_outbound_sync_at) : void 0,
       lastInboundSyncAt: state.last_inbound_sync_at ? String(state.last_inbound_sync_at) : void 0,
-      lastAttemptAt: state.last_attempt_at ? String(state.last_attempt_at) : void 0
+      lastAttemptAt: state.last_attempt_at ? String(state.last_attempt_at) : void 0,
+      migrationState: migrationGate.state,
+      migrationOperationId: migrationGate.operationId,
+      migrationLeaseExpiresAt: migrationGate.leaseExpiresAt
     };
   }
   async close() {
@@ -545,7 +860,7 @@ function isRetryableSyncError(error) {
   const status = statusOf(error);
   const code = codeOf(error);
   if (["network_error", "request_timeout"].includes(code)) return true;
-  if (["invalid_input", "idempotency_conflict", "edge_idempotency_conflict", "principal_mismatch", "protocol_mismatch", "store_closed"].includes(code)) return false;
+  if (["invalid_input", "idempotency_conflict", "edge_idempotency_conflict", "principal_mismatch", "protocol_mismatch", "store_closed", "client_migration_draining", "client_migration_retired", "client_migration_lease_lost"].includes(code)) return false;
   return status === 0 || status === 408 || status === 425 || status === 429 || status !== void 0 && status >= 500;
 }
 function provisional(draft, createdAt) {
@@ -567,12 +882,18 @@ var SyncingBridgeStore = class {
     this.leaseMs = options.leaseMs ?? 3e4;
     this.autoSync = options.autoSync ?? true;
     this.idleDelayMs = Math.max(this.baseDelayMs + 1, options.idleDelayMs ?? 3e4);
+    this.edgeDrainLease = options.edgeDrainLease;
+    this.closeEdge = options.closeEdge ?? true;
     this.loopState = this.autoSync ? "idle" : "disabled";
   }
   async initialize() {
     await this.edge.initialize();
     if (this.autoSync) this.startTransportLoop();
   }
+  /** Replace a renewed maintenance lease without creating another edge wrapper. */
+  setDrainLease(lease) {
+    this.edgeDrainLease = lease;
+  }
   startTransportLoop() {
     if (this.background) return;
     this.background = this.transportLoop().catch((error) => {
@@ -620,6 +941,11 @@ var SyncingBridgeStore = class {
       this.loopState = "running";
       const report = await this.sync({ maxPush: 100, maxPages: 1, signal: this.closeController.signal });
       if (this.stopped) break;
+      if (report.migrationState !== "active" && !this.edgeDrainLease) {
+        this.loopState = "paused";
+        await this.wait(this.idleDelayMs);
+        continue;
+      }
       if (report.failureRetryable === false) {
         this.backgroundError = Object.assign(
           new Error(`gateway synchronization failed permanently: ${report.lastError ?? "sync_error"}`),
@@ -668,6 +994,13 @@ var SyncingBridgeStore = class {
   }
   async flushOne(signal) {
     await this.edge.noteAttempt(this.now());
+    try {
+      if (this.edgeDrainLease) await this.edge.assertDrainLease(this.edgeDrainLease, this.now());
+      else await this.edge.assertScopeActive();
+    } catch (error) {
+      if (error instanceof EdgeMigrationDrainingError || error instanceof EdgeMigrationRetiredError || error instanceof EdgeMigrationLeaseError) return { state: "paused", error };
+      throw error;
+    }
     try {
       await this.ensureRemote(signal);
     } catch (error) {
@@ -678,7 +1011,13 @@ var SyncingBridgeStore = class {
         retryable: isRetryableSyncError(error)
       };
     }
-    const record = await this.edge.claimNext(this.now(), this.leaseMs);
+    let record;
+    try {
+      record = await this.edge.claimNext(this.now(), this.leaseMs, this.edgeDrainLease);
+    } catch (error) {
+      if (error instanceof EdgeMigrationDrainingError || error instanceof EdgeMigrationRetiredError || error instanceof EdgeMigrationLeaseError) return { state: "paused", error };
+      throw error;
+    }
     if (!record) return { state: "empty" };
     try {
       const result = await this.remote.insertMessage(record.draft, { signal });
@@ -723,6 +1062,7 @@ var SyncingBridgeStore = class {
   async insertMessage(message) {
     this.assertHealthy();
     this.assertPrincipal({ workspace: message.workspace, agent: message.source }, false);
+    await this.edge.assertScopeActive();
     let remoteError;
     try {
       await this.ensureRemote();
@@ -829,13 +1169,17 @@ var SyncingBridgeStore = class {
         continue;
       }
       if (result.state === "fatal") throw result.error;
+      if (result.state === "paused") {
+        lastError = codeOf(result.error);
+        break;
+      }
       lastError = codeOf(result.error);
       failureRetryable = result.state === "retry" ? result.retryable : void 0;
       if (result.state === "retry") online = false;
       if (result.state === "retry") break;
     }
     let pulled = 0;
-    if (maxPages > 0 && !this.cancelled(options.signal)) {
+    if (maxPages > 0 && !this.cancelled(options.signal) && !lastError?.startsWith("client_migration_")) {
       const pull = await this.pull(maxPages, options.signal);
       online = online && pull.online;
       pulled = pull.pulled;
@@ -856,7 +1200,10 @@ var SyncingBridgeStore = class {
       cursor: stats.pullCursor,
       lastSyncedAt: stats.lastSyncAt,
       lastError: lastError ?? stats.lastError,
-      failureRetryable
+      failureRetryable,
+      migrationState: stats.migrationState,
+      migrationOperationId: stats.migrationOperationId,
+      migrationLeaseExpiresAt: stats.migrationLeaseExpiresAt
     };
   }
   async listMessages(principal, query = {}) {
@@ -1001,7 +1348,10 @@ var SyncingBridgeStore = class {
       lastSyncAttemptAt: edge.lastAttemptAt,
       syncLoopState: this.backgroundError ? "failed" : this.loopState,
       syncLoopError: this.backgroundError ? codeOf(this.backgroundError) : void 0,
-      remoteError
+      remoteError,
+      migrationState: edge.migrationState,
+      migrationOperationId: edge.migrationOperationId,
+      migrationLeaseExpiresAt: edge.migrationLeaseExpiresAt
     };
   }
   async heartbeat(principal, leaseMs, runtimeType, capabilities = []) {
@@ -1028,10 +1378,12 @@ var SyncingBridgeStore = class {
     ]);
     const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
     if (this.backgroundError) failures.push(this.backgroundError);
-    try {
-      await this.edge.close();
-    } catch (error) {
-      failures.push(error);
+    if (this.closeEdge) {
+      try {
+        await this.edge.close();
+      } catch (error) {
+        failures.push(error);
+      }
     }
     if (failures.length === 1) throw failures[0];
     if (failures.length > 1) throw Object.assign(new Error("failed to close synchronized bridge store"), { errors: failures });
@@ -1039,7 +1391,11 @@ var SyncingBridgeStore = class {
 };
 
 export {
+  inspectEdgeScopeReadOnly,
   EdgeConflictError,
+  EdgeMigrationDrainingError,
+  EdgeMigrationRetiredError,
+  EdgeMigrationLeaseError,
   edgeMessageFingerprint,
   stableIdempotency,
   edgeScopeKey,
@@ -1047,4 +1403,4 @@ export {
   isRetryableSyncError,
   SyncingBridgeStore
 };
-//# sourceMappingURL=chunk-Q6PPMXJC.js.map
+//# sourceMappingURL=chunk-SN7PIVDF.js.map