@creatornader/agent-bridge 0.4.0 → 0.5.1

package/dist/{chunk-PDIHDBP3.js → chunk-7VJI2MXI.js}

@@ -10,7 +10,7 @@ import {
   isSupportedLocalSqliteSchemaContract,
   sqliteSchemaContractHash,
   verifySqliteHealth
-} from "./chunk-DQOZJJZ2.js";
+} from "./chunk-IVG4XWWS.js";
 import {
   preparePrivateFileLocation,
   preparePrivateSqliteLocation,
@@ -21,7 +21,7 @@ import {
 import {
   NATIVE_DR_ADVISORY_LOCK_KEY,
   rowIsolationReady
-} from "./chunk-6BTJE6D4.js";
+} from "./chunk-QNXHDOJ5.js";
 
 // src/native-dr-bundle.ts
 import { createHash } from "crypto";
@@ -487,7 +487,7 @@ var SSL_PARAMETERS = /* @__PURE__ */ new Set([
   "sslrootcert",
   "sslsni"
 ]);
-var DERIVED_ROLE = /^agent_bridge_(?:runtime|data_owner|context_reader|event_writer|control_owner|control_operator|control_auditor|archive_operator)_[0-9a-f]{16}$/;
+var DERIVED_ROLE = /^agent_bridge_(?:runtime|data_owner|context_reader|event_writer|control_owner|control_operator|control_auditor|archive_operator|backup_reader)_[0-9a-f]{16}$/;
 var ROLE_NAME = /^[^\u0000-\u001f\u007f]{1,63}$/u;
 function validPostgresIdentifier(value) {
   return value !== "PUBLIC" && !value.includes(":") && ROLE_NAME.test(value) && Buffer.byteLength(value, "utf8") <= 63;
@@ -934,21 +934,62 @@ function buildPostgresMembershipStatements(inventory, serverMajor2) {
   if (!Number.isSafeInteger(serverMajor2) || serverMajor2 < 15 || serverMajor2 > 18) {
     throw new Error("PostgreSQL membership target major must be between 15 and 18");
   }
-  return validatePostgresRoleInventory(inventory).memberships.map((membership) => {
+  const validated = validatePostgresRoleInventory(inventory);
+  const schemaOwner = validated.roles.find((role) => role.kind === "schema-owner");
+  const rolesByName = new Map(validated.roles.map((role) => [role.name, role]));
+  const orderedMemberships = [...validated.memberships].sort((left, right) => {
+    const leftOwnerAuthority = left.member === schemaOwner.name ? 0 : 1;
+    const rightOwnerAuthority = right.member === schemaOwner.name ? 0 : 1;
+    return leftOwnerAuthority - rightOwnerAuthority || left.role.localeCompare(right.role) || left.member.localeCompare(right.member);
+  });
+  return orderedMemberships.filter(
+    (membership) => rolesByName.get(membership.member).kind !== "external-principal"
+  ).map((membership) => {
+    let grant;
     if (serverMajor2 === 15) {
       if (!membership.inheritOption || !membership.setOption) {
         throw new Error("PostgreSQL 15 cannot preserve membership INHERIT FALSE or SET FALSE semantics");
       }
-      return `GRANT ${quoteIdentifier(membership.role)} TO ${quoteIdentifier(membership.member)}${membership.adminOption ? " WITH ADMIN OPTION" : ""};`;
-    }
-    const options = [
-      `ADMIN ${membership.adminOption ? "OPTION" : "FALSE"}`,
-      `INHERIT ${membership.inheritOption ? "TRUE" : "FALSE"}`,
-      `SET ${membership.setOption ? "TRUE" : "FALSE"}`
-    ].join(", ");
-    return `GRANT ${quoteIdentifier(membership.role)} TO ${quoteIdentifier(membership.member)} WITH ${options};`;
+      grant = `GRANT ${quoteIdentifier(membership.role)} TO ${quoteIdentifier(membership.member)}${membership.adminOption ? " WITH ADMIN OPTION" : ""};`;
+    } else {
+      const options = [
+        `ADMIN ${membership.adminOption ? "OPTION" : "FALSE"}`,
+        `INHERIT ${membership.inheritOption ? "TRUE" : "FALSE"}`,
+        `SET ${membership.setOption ? "TRUE" : "FALSE"}`
+      ].join(", ");
+      grant = `GRANT ${quoteIdentifier(membership.role)} TO ${quoteIdentifier(membership.member)} WITH ${options};`;
+    }
+    const role = rolesByName.get(membership.role);
+    const schemaOwnerGrantedDerivedMembership = membership.member !== schemaOwner.name && role.kind === "derived";
+    return schemaOwnerGrantedDerivedMembership ? `SET LOCAL ROLE ${quoteIdentifier(schemaOwner.name)}; ${grant} RESET ROLE;` : grant;
   });
 }
+function suspendedPostgresMemberships(inventory) {
+  const suffix = createHash2("md5").update(inventory.databaseName).digest("hex").slice(0, 16);
+  const recognizedRoles = /* @__PURE__ */ new Map([
+    [`agent_bridge_control_operator_${suffix}`, "operator"],
+    [`agent_bridge_control_auditor_${suffix}`, "auditor"],
+    [`agent_bridge_archive_operator_${suffix}`, "archive"]
+  ]);
+  const rolesByName = new Map(inventory.roles.map((role) => [role.name, role]));
+  const suspended = [];
+  for (const membership of inventory.memberships) {
+    if (rolesByName.get(membership.member)?.kind !== "external-principal") continue;
+    const recognized = recognizedRoles.get(membership.role);
+    if (recognized === "archive") {
+      suspended.push({ kind: "archive", member: membership.member });
+      continue;
+    }
+    if (recognized === "operator" || recognized === "auditor") {
+      suspended.push({
+        kind: "control",
+        member: membership.member,
+        controlRole: recognized
+      });
+    }
+  }
+  return suspended;
+}
 var DEFAULT_PRIVILEGE_OBJECTS = {
   r: "TABLES",
   S: "SEQUENCES",
@@ -1221,7 +1262,8 @@ async function collectPostgresRoleInventory(client, databaseName) {
       FROM unnest(ARRAY[
         'agent_bridge_runtime_','agent_bridge_data_owner_','agent_bridge_context_reader_',
         'agent_bridge_event_writer_','agent_bridge_control_owner_','agent_bridge_control_operator_',
-        'agent_bridge_control_auditor_','agent_bridge_archive_operator_'
+        'agent_bridge_control_auditor_','agent_bridge_archive_operator_',
+        'agent_bridge_backup_reader_'
       ]) prefix
     ), object_roles AS (
       SELECT namespace.nspowner AS oid, 'schema-owner'::text AS kind
@@ -1300,13 +1342,14 @@ async function collectPostgresRoleInventory(client, databaseName) {
   const names = roleRows.rows.map((row) => row.name);
   const membershipRows = names.length === 0 ? { rows: [], rowCount: 0 } : await client.query(`
     SELECT granted.rolname AS role, member.rolname AS member,
-      membership.admin_option AS "adminOption",
-      coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true) AS "inheritOption",
-      coalesce((to_jsonb(membership)->>'set_option')::boolean,true) AS "setOption"
+      bool_or(membership.admin_option) AS "adminOption",
+      bool_or(coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)) AS "inheritOption",
+      bool_or(coalesce((to_jsonb(membership)->>'set_option')::boolean,true)) AS "setOption"
     FROM pg_catalog.pg_auth_members membership
     JOIN pg_catalog.pg_roles granted ON granted.oid=membership.roleid
     JOIN pg_catalog.pg_roles member ON member.oid=membership.member
     WHERE granted.rolname=ANY($1::text[]) AND member.rolname=ANY($1::text[])
+    GROUP BY granted.rolname,member.rolname
     ORDER BY granted.rolname,member.rolname`, [names]);
   if (names.length > 0) {
     const boundary = await client.query(`
@@ -1395,8 +1438,11 @@ async function collectSnapshotMetadata(client, checkRowReady) {
   if (migrations.length === 0) throw new PostgresNativeDrError("SOURCE_SCHEMA_EMPTY", "source has no Agent Bridge migrations");
   const schemaVersion = Math.max(...migrations.map((migration) => migration.version));
   const tableRows = await client.query(`
-    SELECT table_name AS "tableName" FROM information_schema.tables
-    WHERE table_schema='agent_bridge' AND table_type='BASE TABLE' ORDER BY table_name`);
+    SELECT relation.relname AS "tableName"
+    FROM pg_catalog.pg_class relation
+    JOIN pg_catalog.pg_namespace namespace ON namespace.oid=relation.relnamespace
+    WHERE namespace.nspname='agent_bridge' AND relation.relkind IN ('r','p')
+    ORDER BY relation.relname`);
   const tableCounts = {};
   for (const row of tableRows.rows) {
     const qualified = `agent_bridge.${row.tableName}`;
@@ -1407,6 +1453,9 @@ async function collectSnapshotMetadata(client, checkRowReady) {
     if (!value || !/^(?:0|[1-9][0-9]*)$/u.test(value)) throw new PostgresNativeDrError("SOURCE_COUNT_INVALID", `source count is invalid for ${qualified}`);
     tableCounts[qualified] = value;
   }
+  if (!tableRows.rows.some((row) => row.tableName === "deliveries")) {
+    throw new PostgresNativeDrError("SOURCE_COUNT_INVALID", "source deliveries table is unavailable");
+  }
   const claimed = await client.query(
     `SELECT count(*)::text AS count FROM agent_bridge.deliveries WHERE state='claimed'`
   );
@@ -1418,6 +1467,7 @@ async function collectSnapshotMetadata(client, checkRowReady) {
     SELECT agent_bridge.security_schema_ready() AS security,
       agent_bridge.owner_control_plane_ready() AS "ownerControl",
       agent_bridge.portable_archive_ready() AS "portableArchive",
+      ${schemaVersion >= 21 ? 'agent_bridge.native_backup_ready() AS "nativeBackup",' : ""}
       agent_bridge.credential_security_prerequisite_definition() AS "securityDefinition",
       agent_bridge.row_isolation_catalog_definition() AS "rowIsolationDefinition",
       agent_bridge.owner_control_attestation_definition() AS "ownerControlDefinition",
@@ -1425,7 +1475,7 @@ async function collectSnapshotMetadata(client, checkRowReady) {
   const ready = readiness.rows[0];
   const rowReady = await checkRowReady(client);
   const authorityReady = await gatewayAuthorityReady(client, schemaVersion);
-  if (!ready?.security || !rowReady || !ready.ownerControl || !ready.portableArchive || !authorityReady || typeof ready.securityDefinition !== "string" || typeof ready.rowIsolationDefinition !== "string" || typeof ready.ownerControlDefinition !== "string" || typeof ready.portableArchiveDefinition !== "string") {
+  if (!ready?.security || !rowReady || !ready.ownerControl || !ready.portableArchive || schemaVersion >= 21 && !ready.nativeBackup || !authorityReady || typeof ready.securityDefinition !== "string" || typeof ready.rowIsolationDefinition !== "string" || typeof ready.ownerControlDefinition !== "string" || typeof ready.portableArchiveDefinition !== "string") {
     throw new PostgresNativeDrError("SOURCE_NOT_READY", "source PostgreSQL schema failed readiness attestation");
   }
   return {
@@ -1819,12 +1869,24 @@ async function targetTableCounts(client) {
   }
   return counts;
 }
-function expectedRestoredTableCounts(schema) {
+function expectedRestoredTableCounts(schema, suspendedMemberships) {
   const expected = { ...schema.tableCounts };
   for (const table of excludedDataTablesForSchemaVersion(schema.schemaVersion)) expected[table] = "0";
   const deliveryEvents = expected["agent_bridge.delivery_events"];
   if (deliveryEvents === void 0) throw new PostgresNativeDrError("INVALID_MANIFEST", "PostgreSQL delivery event count is missing");
   expected["agent_bridge.delivery_events"] = (BigInt(deliveryEvents) + BigInt(schema.claimedDeliveryCount)).toString();
+  for (const [kind, table] of [
+    ["control", "agent_bridge.control_membership_events"],
+    ["archive", "agent_bridge.archive_membership_events"]
+  ]) {
+    const increment = suspendedMemberships.filter((membership) => membership.kind === kind).length;
+    if (increment === 0) continue;
+    const current = expected[table];
+    if (current === void 0) {
+      throw new PostgresNativeDrError("INVALID_MANIFEST", `PostgreSQL ${kind} membership event count is missing`);
+    }
+    expected[table] = (BigInt(current) + BigInt(increment)).toString();
+  }
   return expected;
 }
 function compareStringMaps(actual, expected, label) {
@@ -1915,11 +1977,17 @@ async function restorePostgresNativeDrInternal(options) {
     if (metadata.schemaExists || !metadata.databaseFresh) {
       throw new PostgresNativeDrError("TARGET_NOT_FRESH", "target must be a dedicated fresh database without user objects or default ACLs");
     }
+    const schemaOwner = inventory.roles.find((role) => role.kind === "schema-owner");
     const conflicts = await target.query(
-      `SELECT rolname AS name FROM pg_catalog.pg_roles WHERE rolname=ANY($1::text[]) ORDER BY rolname`,
+      `SELECT rolname AS name,rolname=current_user AS "isCurrentUser",
+         rolsuper "isSuperuser"
+       FROM pg_catalog.pg_roles WHERE rolname=ANY($1::text[]) ORDER BY rolname`,
       [inventory.roles.map((role) => role.name)]
     );
-    if (conflicts.rows.length > 0) throw new PostgresNativeDrError("TARGET_ROLE_CONFLICT", "target contains a role required by the backup");
+    const reusesSchemaOwner = conflicts.rows.length === 1 && conflicts.rows[0]?.name === schemaOwner.name && conflicts.rows[0].isCurrentUser && conflicts.rows[0].isSuperuser;
+    if (conflicts.rows.length > 0 && !reusesSchemaOwner) {
+      throw new PostgresNativeDrError("TARGET_ROLE_CONFLICT", "target contains a role required by the backup");
+    }
     await assertPostgresRestoreAuthority(target);
     admin = deps.createClient(administrativeDatabaseUrl(targetUrl, metadata.databaseName));
     await admin.connect();
@@ -1929,12 +1997,13 @@ async function restorePostgresNativeDrInternal(options) {
     securePrivatePath(schemaAclListPath, "file");
     verifyPrivatePathAccess(schemaAclListPath, "file");
     for (const [index, statement] of buildPostgresRoleShellStatements(inventory).entries()) {
+      const role = inventory.roles[index];
+      if (reusesSchemaOwner && role.name === schemaOwner.name) continue;
       phase = "role shell creation";
       restoreStarted = true;
       await target.query(statement);
-      createdRoles.push(inventory.roles[index].name);
+      createdRoles.push(role.name);
     }
-    const schemaOwner = inventory.roles.find((role) => role.kind === "schema-owner");
     phase = "schema creation";
     await target.query(`CREATE SCHEMA agent_bridge AUTHORIZATION ${quoteIdentifier(schemaOwner.name)}`);
     phase = "schema ACL restore";
@@ -1965,6 +2034,25 @@ async function restorePostgresNativeDrInternal(options) {
     transactionOpen = true;
     phase = "membership restore";
     for (const statement of buildPostgresMembershipStatements(inventory, major)) await target.query(statement);
+    const suspendedMemberships = suspendedPostgresMemberships(inventory);
+    phase = "external membership suspension";
+    for (const membership of suspendedMemberships) {
+      if (membership.kind === "control") {
+        await target.query(
+          `INSERT INTO agent_bridge.control_membership_events(
+             request_id,action,member_role,control_role,actor
+           ) VALUES($1::uuid,'revoke',$2::name,$3,$4::name)`,
+          [deps.randomId(), membership.member, membership.controlRole, schemaOwner.name]
+        );
+      } else {
+        await target.query(
+          `INSERT INTO agent_bridge.archive_membership_events(
+             request_id,action,member_role,actor
+           ) VALUES($1::uuid,'revoke',$2::name,$3::name)`,
+          [deps.randomId(), membership.member, schemaOwner.name]
+        );
+      }
+    }
     phase = "default privilege restore";
     for (const statement of buildPostgresDefaultPrivilegeStatements(inventory)) await target.query(statement);
     phase = "claim normalization";
@@ -1990,12 +2078,13 @@ async function restorePostgresNativeDrInternal(options) {
     }
     phase = "table count validation";
     const counts = await targetTableCounts(target);
-    compareStringMaps(counts, expectedRestoredTableCounts(schema), "restored PostgreSQL");
+    compareStringMaps(counts, expectedRestoredTableCounts(schema, suspendedMemberships), "restored PostgreSQL");
     phase = "readiness validation";
     const readiness = await target.query(`
       SELECT agent_bridge.security_schema_ready() AS security,
         agent_bridge.owner_control_plane_ready() AS "ownerControl",
         agent_bridge.portable_archive_ready() AS "portableArchive",
+        ${schema.schemaVersion >= 21 ? 'agent_bridge.native_backup_ready() AS "nativeBackup",' : ""}
         agent_bridge.credential_security_prerequisite_definition() AS "securityDefinition",
         agent_bridge.row_isolation_catalog_definition() AS "rowIsolationDefinition",
         agent_bridge.owner_control_attestation_definition() AS "ownerControlDefinition",
@@ -2008,6 +2097,7 @@ async function restorePostgresNativeDrInternal(options) {
       !restoredRowReady ? "row-isolation" : void 0,
       !ready?.ownerControl ? "owner-control" : void 0,
       !ready?.portableArchive ? "portable-archive" : void 0,
+      schema.schemaVersion >= 21 && !ready?.nativeBackup ? "native-backup" : void 0,
       !restoredGatewayAuthorityReady ? "gateway-authority" : void 0
     ].filter(Boolean);
     if (failedReadiness.length > 0) {
@@ -2578,4 +2668,4 @@ export {
   restoreLocalSqlite,
   SQLITE_EDGE_APPLICATION_ID
 };
-//# sourceMappingURL=chunk-PDIHDBP3.js.map
+//# sourceMappingURL=chunk-7VJI2MXI.js.map