@creatornader/agent-bridge 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -6,6 +6,27 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-07-20
+
+### Fixed
+
+- Omit `informedBy` when a migrated PostgreSQL message stores SQL `NULL`, matching
+  the optional protocol field and the legacy and SQLite providers.
+- Add an unauthenticated `/healthz` liveness endpoint. It reports whether the HTTP
+  process can respond without querying PostgreSQL. `/readyz` remains the database-backed
+  readiness check.
+
+## [0.5.1] - 2026-07-20
+
+### Fixed
+
+- Let a production gateway receive its PostgreSQL CA bundle through the separate
+  `AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64` secret. The gateway decodes the bundle in
+  memory, forces certificate and hostname verification, and removes file-based TLS
+  CA parameters from the runtime URL. It rejects the ambiguous `ssl` parameter and
+  client-certificate file parameters instead of discarding them. The Fly preflight now
+  requires both runtime secrets.
+
 ## [0.5.0] - 2026-07-20
 
 ### Added
@@ -355,7 +376,8 @@ First tagged release. Marks the point where agent-bridge has shipped its initial
 - Narrative-leak detection in CI + on commit via `creatornader/textleaks@v0.2.0` (renamed from leakguard).
 
 [0.1.0]: https://github.com/creatornader/agent-bridge/releases/tag/v0.1.0
-[Unreleased]: https://github.com/creatornader/agent-bridge/compare/v0.5.0...HEAD
+[Unreleased]: https://github.com/creatornader/agent-bridge/compare/v0.5.1...HEAD
+[0.5.1]: https://github.com/creatornader/agent-bridge/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/creatornader/agent-bridge/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/creatornader/agent-bridge/compare/v0.3.1...v0.4.0
 [0.3.1]: https://github.com/creatornader/agent-bridge/compare/v0.3.0...v0.3.1

package/README.md

@@ -97,6 +97,9 @@ After an operator supplies an existing app, `npm run preflight:fly -- --app <app
 The command does not deploy, migrate, scale, restart, or print environment-variable
 values. The [Fly production procedure](docs/deployment.md#flyio-reference-hosting)
 keeps database migration and runtime-role bootstrap outside the gateway process.
+The Fly gateway expects two secrets: the restricted runtime database URL and a
+base64-encoded PostgreSQL CA bundle. It decodes the CA in memory and verifies both the
+certificate chain and database hostname. It never needs a CA file inside the image.
 
 The manual `gateway production proof` workflow tests an existing gateway after its
 deployment gate has passed. GitHub must run it from `main` in the protected
@@ -1051,7 +1054,9 @@ Client-local outbox and synchronization fields appear only in CLI status output.
 
 In-process `SyncingBridgeStore` diagnostics also expose the current loop state and a sanitized loop error. Standalone CLI health commands omit those fields because their short-lived diagnostic runtime is not the long-lived MCP client.
 
-The gateway exposes unauthenticated `/readyz`. `/v2/status` and `/metrics` require a valid credential.
+The gateway exposes two unauthenticated probes. `/healthz` reports HTTP process
+liveness without querying PostgreSQL. `/readyz` checks database and schema readiness.
+`/v2/status` and `/metrics` require a valid credential.
 
 Each gateway operation checks the scopes in the canonical registry. `capabilities` needs an active credential but no named scope. For requests with bodies, the gateway validates media type, size, and JSON before it opens the request transaction. It then audits scope denials and applies both a credential-wide token bucket and an operation bucket before domain work begins. Missing policy state or a failed denial audit closes the request with `security_unavailable`. Rate denials return the same rounded delay in `Retry-After` and `error.details.retryAfterSeconds`.
 

package/SECURITY.md

@@ -74,6 +74,13 @@ Keep the schema-owner, runtime, operator, archive, backup, and restore database
 authorities separate. Do not copy one client's token or backend file into another
 client's configuration.
 
+When a gateway receives `AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64`, it decodes the PEM
+bundle in memory and forces PostgreSQL certificate and hostname verification. The
+gateway removes `sslmode` and `sslrootcert` before it opens the pool. It rejects URL
+parameters for `ssl`, a client certificate, client key, or key password. Keep the
+restricted database URL in a separate secret. Do not put either value in the image,
+source tree, command arguments, or deployment logs.
+
 Managed PostgreSQL may expose a schema-owner administrator with `CREATEROLE` instead
 of true superuser authority. That capability is sufficient for migrations. Native backup
 requires the schema owner to be a true superuser or hold `BYPASSRLS`, because the source

package/dist/bridge.js

@@ -24,7 +24,7 @@ import {
 import "./chunk-GTK4KOED.js";
 import {
   PostgresBridgeStore
-} from "./chunk-XDNT6ZNZ.js";
+} from "./chunk-CVZAJ7TP.js";
 import {
   NATIVE_DR_ADVISORY_LOCK_KEY,
   REQUIRED_MIGRATIONS,
@@ -42,7 +42,7 @@ import {
   createGateway,
   hashCredential,
   safeTokenHashEqual
-} from "./chunk-P635FAN4.js";
+} from "./chunk-JUTJRAMA.js";
 import {
   BridgeService
 } from "./chunk-AWE3DFZV.js";

package/dist/{chunk-XDNT6ZNZ.js → chunk-CVZAJ7TP.js}

@@ -55,7 +55,7 @@ function asMessage(row) {
     expiresAt: asTimestamp(row.expires_at),
     idempotencyKey: row.idempotency_key ?? void 0,
     atribReceiptId: row.atrib_receipt_id ?? void 0,
-    informedBy: parse(row.informed_by),
+    informedBy: parse(row.informed_by) ?? void 0,
     metadata: parse(row.metadata),
     deliveryPolicy,
     createdAt: asTimestamp(row.created_at) ?? ""
@@ -618,4 +618,4 @@ var PostgresBridgeStore = class {
 export {
   PostgresBridgeStore
 };
-//# sourceMappingURL=chunk-XDNT6ZNZ.js.map
+//# sourceMappingURL=chunk-CVZAJ7TP.js.map

package/dist/chunk-CVZAJ7TP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/postgres-bridge-store.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n  DeliveryStateConflictError,\n  decodeCursor,\n  decodeScopedCursor,\n  encodeCursor,\n  encodeScopedCursor,\n  cursorScope,\n  scopedCursorScope,\n  validateDeliveryCursorPosition,\n  validateEventCursorPosition,\n  type AgentPresence,\n  type BridgeDelivery,\n  type BridgeDeliveryEvent,\n  type BridgeMessage,\n  type BridgePrincipal,\n  type DeliveryPolicy,\n} from \"./bridge-domain.js\";\nimport type {\n  BridgeStore,\n  BridgeDiagnostics,\n  ClaimOptions,\n  InsertMessageResult,\n  MessagePage,\n  MessageQuery,\n  DeliveryQuery,\n} from \"./bridge-store.js\";\nimport { assertIdempotentReplay } from \"./idempotency.js\";\n\nexport interface PgQueryable {\n  query<T extends Record<string, unknown> = Record<string, unknown>>(\n    sql: string,\n    values?: unknown[],\n  ): Promise<{ rows: T[]; rowCount: number | null }>;\n  connect?(): Promise<PgTransactionClient>;\n  release?(): void;\n  /** True when the queryable is already owned by an explicit request transaction. */\n  inTransaction?: boolean;\n}\nexport interface PgTransactionClient {\n  query<T extends Record<string, unknown> = Record<string, unknown>>(\n    sql: string,\n    values?: unknown[],\n  ): Promise<{ rows: T[]; rowCount: number | null }>;\n  release(error?: Error | boolean): void;\n}\n\ntype Row = Record<string, any>;\n\nfunction json(value: unknown): string | null {\n  return value === undefined ? null : JSON.stringify(value);\n}\n\nfunction parse(value: unknown): any {\n  return typeof value === \"string\" ? JSON.parse(value) : value;\n}\n\nfunction asTimestamp(value: unknown): string | undefined {\n  if (value === undefined || value === null) return undefined;\n  if (value instanceof Date) return value.toISOString();\n  return String(value);\n}\n\nfunction asMessage(row: Row): BridgeMessage {\n  const deliveryPolicy: DeliveryPolicy = row.delivery_mode === \"mailbox\"\n    ? { mode: \"mailbox\" }\n    : {\n        mode: \"leased\",\n        maxAttempts: Number(row.delivery_max_attempts),\n        retryBaseDelayMs: Number(row.delivery_retry_base_delay_ms),\n        retryMaxDelayMs: Number(row.delivery_retry_max_delay_ms),\n        retryJitterRatio: Number(row.delivery_retry_jitter_ratio),\n        ...(row.delivery_not_before ? { notBefore: asTimestamp(row.delivery_not_before) } : {}),\n      };\n  return {\n    id: String(row.id),\n    workspace: String(row.workspace),\n    project: row.project ?? undefined,\n    source: String(row.source),\n    sequence: String(row.sequence),\n    type: String(row.type),\n    content: String(row.content),\n    contentType: String(row.content_type),\n    data: parse(row.data),\n    targets: parse(row.targets) ?? [],\n    threadId: row.thread_id ?? undefined,\n    replyToId: row.reply_to_id ?? undefined,\n    correlationId: row.correlation_id ?? undefined,\n    causationId: row.causation_id ?? undefined,\n    priority: row.priority,\n    expiresAt: asTimestamp(row.expires_at),\n    idempotencyKey: row.idempotency_key ?? undefined,\n    atribReceiptId: row.atrib_receipt_id ?? undefined,\n    informedBy: parse(row.informed_by) ?? undefined,\n    metadata: parse(row.metadata),\n    deliveryPolicy,\n    createdAt: asTimestamp(row.created_at) ?? \"\",\n  };\n}\n\nfunction asDelivery(row: Row): BridgeDelivery {\n  return {\n    id: String(row.id),\n    messageId: String(row.message_id),\n    workspace: String(row.workspace),\n    recipient: String(row.recipient),\n    state: row.state,\n    attempt: Number(row.attempt),\n    cycleAttempt: Number(row.cycle_attempt ?? row.attempt),\n    requeueCount: Number(row.requeue_count ?? 0),\n    createdAt: asTimestamp(row.created_at) ?? \"\",\n    priorityRank: Number(row.priority_rank),\n    availableAt: asTimestamp(row.available_at) ?? \"\",\n    leaseToken: row.lease_token ?? undefined,\n    leaseOwner: row.lease_owner ?? undefined,\n    leaseExpiresAt: asTimestamp(row.lease_expires_at),\n    lastError: row.last_error ?? undefined,\n    lastActor: row.last_actor ?? undefined,\n    lastAction: row.last_action,\n  };\n}\n\nfunction asPresence(row: Row): AgentPresence {\n  return {\n    workspace: String(row.workspace), agent: String(row.agent), instance: String(row.instance),\n    runtimeType: row.runtime_type ?? undefined, capabilities: parse(row.capabilities) ?? [],\n    leaseExpiresAt: asTimestamp(row.lease_expires_at) ?? \"\", lastSeenAt: asTimestamp(row.last_seen_at) ?? \"\",\n  };\n}\n\nfunction asDeliveryEvent(row: Row): BridgeDeliveryEvent {\n  return {\n    sequence: String(row.sequence), deliveryId: String(row.delivery_id),\n    messageId: String(row.message_id), workspace: String(row.workspace),\n    recipient: String(row.recipient),\n    fromState: row.from_state == null ? undefined : row.from_state as BridgeDeliveryEvent[\"fromState\"],\n    toState: row.to_state as BridgeDeliveryEvent[\"toState\"], attempt: Number(row.attempt),\n    cycleAttempt: Number(row.cycle_attempt), requeueCount: Number(row.requeue_count),\n    leaseOwner: row.lease_owner ?? undefined, error: row.error ?? undefined,\n    actor: String(row.actor), action: row.action,\n    createdAt: asTimestamp(row.created_at) ?? \"\",\n  };\n}\n\nasync function transaction<T>(db: PgQueryable, work: (client: PgQueryable) => Promise<T>): Promise<T> {\n  if (db.inTransaction) return work(db);\n  const borrowed = !db.release && Boolean(db.connect);\n  const client = borrowed ? await db.connect!() : db;\n  try {\n    await client.query(\"BEGIN\");\n    const result = await work(client);\n    await client.query(\"COMMIT\");\n    return result;\n  } catch (error) {\n    await client.query(\"ROLLBACK\").catch(() => undefined);\n    throw error;\n  } finally {\n    if (borrowed && \"release\" in client && typeof client.release === \"function\") client.release();\n  }\n}\n\nexport class PostgresBridgeStore implements BridgeStore {\n  constructor(private readonly db: PgQueryable) {}\n\n  async initialize(): Promise<void> {\n    // Deployments apply ordered migrations before starting the service.\n  }\n\n  async insertMessage(\n    input: Omit<BridgeMessage, \"sequence\" | \"createdAt\">,\n  ): Promise<InsertMessageResult> {\n    const values = [\n      input.id,\n      input.workspace,\n      input.project ?? null,\n      input.source,\n      input.type,\n      input.content,\n      input.contentType,\n      json(input.data),\n      json(input.targets),\n      input.threadId ?? null,\n      input.replyToId ?? null,\n      input.correlationId ?? null,\n      input.causationId ?? null,\n      input.priority,\n      input.expiresAt ?? null,\n      input.idempotencyKey ?? null,\n      input.atribReceiptId ?? null,\n      json(input.informedBy),\n      json(input.metadata),\n      input.deliveryPolicy.mode,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.maxAttempts : null,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.retryBaseDelayMs : null,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.retryMaxDelayMs : null,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.retryJitterRatio : null,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.notBefore ?? null : null,\n    ];\n\n    const result = await this.db.query<Row>(\n      `WITH inserted AS (\n         INSERT INTO agent_bridge.messages (\n           id, workspace, project, source, type, content, content_type, data, targets,\n           thread_id, reply_to_id, correlation_id, causation_id, priority,\n           expires_at, idempotency_key, atrib_receipt_id, informed_by, metadata,\n           delivery_mode, delivery_max_attempts, delivery_retry_base_delay_ms,\n           delivery_retry_max_delay_ms, delivery_retry_jitter_ratio, delivery_not_before\n         )\n         VALUES (\n           $1, $2, $3, $4, $5, $6, $7, $8::jsonb, $9::jsonb,\n           $10, $11, $12, $13, $14, $15, $16, $17, $18::jsonb, $19::jsonb,\n           $20, $21, $22, $23, $24, $25\n         )\n         ON CONFLICT (workspace, source, idempotency_key)\n           WHERE idempotency_key IS NOT NULL\n         DO NOTHING\n         RETURNING *, true AS created\n       ), selected AS (\n         SELECT * FROM inserted\n         UNION ALL\n         SELECT existing.*, false AS created\n         FROM agent_bridge.messages existing\n         WHERE $16::text IS NOT NULL\n           AND existing.workspace = $2\n           AND existing.source = $4\n           AND existing.idempotency_key = $16\n           AND NOT EXISTS (SELECT 1 FROM inserted)\n         LIMIT 1\n       ), delivery_rows AS (\n         INSERT INTO agent_bridge.deliveries (\n           id, message_id, workspace, publisher, recipient, state, available_at,\n           created_at, priority_rank, last_actor, last_action\n         )\n         SELECT gen_random_uuid(), inserted.id, inserted.workspace, inserted.source, target, 'pending',\n                greatest(now(), coalesce(inserted.delivery_not_before, now())),\n                inserted.created_at,\n                case inserted.priority when 'urgent' then 0 when 'high' then 1 else 2 end,\n                inserted.source, 'created'\n         FROM inserted\n         CROSS JOIN LATERAL jsonb_array_elements_text(inserted.targets) AS target\n         WHERE inserted.delivery_mode = 'leased'\n         ON CONFLICT (message_id, recipient) DO NOTHING\n       )\n       SELECT * FROM selected`,\n      values,\n    );\n\n    let row = result.rows[0];\n    if (!row && input.idempotencyKey) {\n      const existing = await this.db.query<Row>(\n        `SELECT *, false AS created\n         FROM agent_bridge.messages\n         WHERE workspace=$1 AND source=$2 AND idempotency_key=$3`,\n        [input.workspace, input.source, input.idempotencyKey],\n      );\n      row = existing.rows[0];\n    }\n    if (!row) throw new Error(\"message insert did not return a row\");\n    const message = asMessage(row);\n    if (row.created !== true) assertIdempotentReplay(message, input);\n    return { message, created: row.created === true };\n  }\n\n  async listMessages(\n    principal: BridgePrincipal,\n    query: MessageQuery = {},\n  ): Promise<MessagePage> {\n    const scope = cursorScope(principal, query);\n    const cursor = decodeCursor(query.cursor, scope) ?? \"0\";\n    const limit = Math.min(Math.max(Math.trunc(query.limit ?? 50), 1), 200);\n    const boundary = query.latest ? undefined : await this.db.query<{ sequence: string | null }>(\n      \"SELECT max(sequence)::text AS sequence FROM agent_bridge.messages WHERE workspace=$1\",\n      [principal.workspace],\n    );\n    const highWater = boundary?.rows[0]?.sequence;\n    const values: unknown[] = query.latest\n      ? [principal.workspace, principal.agent]\n      : [principal.workspace, cursor, principal.agent];\n    const mailbox = query.mailbox ?? \"inbox\";\n    const agentParam = query.latest ? 2 : 3;\n    const visibility = mailbox === \"sent\" ? `source=$${agentParam}`\n      : mailbox === \"all\" ? `(source=$${agentParam} OR targets='[]'::jsonb OR targets ? $${agentParam})`\n      : `(targets='[]'::jsonb OR targets ? $${agentParam})`;\n    let sql = `SELECT * FROM agent_bridge.messages WHERE workspace=$1 ${query.latest ? \"\" : \"AND sequence>$2::bigint \"}AND ${visibility}`;\n\n    if (highWater) {\n      values.push(highWater);\n      sql += ` AND sequence <= $${values.length}::bigint`;\n    }\n\n    if (!query.includeExpired) {\n      sql += \" AND (expires_at IS NULL OR expires_at > now())\";\n    }\n    if (query.types?.length) {\n      values.push(query.types);\n      sql += ` AND type = ANY($${values.length})`;\n    }\n    if (query.source) {\n      values.push(query.source);\n      sql += ` AND source = $${values.length}`;\n    }\n    if (query.project) {\n      values.push(query.project);\n      sql += ` AND project = $${values.length}`;\n    }\n    if (query.since) {\n      values.push(query.since);\n      sql += ` AND created_at >= $${values.length}::timestamptz`;\n    }\n    if (query.receiptState && query.receiptState !== \"any\") {\n      sql += ` AND ${query.receiptState === \"unread\" ? \"NOT \" : \"\"}EXISTS (\n        SELECT 1 FROM agent_bridge.receipts receipt\n        WHERE receipt.workspace=agent_bridge.messages.workspace\n          AND receipt.message_id=agent_bridge.messages.id\n          AND receipt.principal=$${agentParam}\n      )`;\n    }\n    if (query.threadId) {\n      values.push(query.threadId);\n      sql += ` AND thread_id = $${values.length}`;\n    }\n\n    values.push(limit);\n    const result = await this.db.query<Row>(\n      `${sql} ORDER BY sequence ${query.latest ? \"DESC\" : \"ASC\"} LIMIT $${values.length}`,\n      values,\n    );\n    const messages = result.rows.map(asMessage);\n    const last = messages[messages.length - 1];\n    if (query.latest) return { messages, cursor: messages[0] ? encodeCursor(messages[0].sequence, scope) : query.cursor };\n    if (messages.length === limit) return { messages, cursor: encodeCursor(last!.sequence, scope) };\n    return { messages, cursor: highWater ? encodeCursor(highWater, scope) : query.cursor };\n  }\n\n  async recordReceipt(\n    principal: BridgePrincipal,\n    ids: string[],\n    readAt = new Date(),\n  ): Promise<number> {\n    const result = await this.db.query(\n      `INSERT INTO agent_bridge.receipts (workspace, message_id, principal, read_at)\n       SELECT message.workspace, message.id, $3, $4\n       FROM agent_bridge.messages message\n       WHERE message.workspace = $1 AND message.id = ANY($2::uuid[])\n         AND (message.targets='[]'::jsonb OR message.targets ? $3)\n       ON CONFLICT DO NOTHING`,\n      [principal.workspace, ids, principal.agent, readAt],\n    );\n    return result.rowCount ?? 0;\n  }\n\n  async claimDelivery(\n    principal: BridgePrincipal,\n    options: ClaimOptions,\n  ): Promise<BridgeDelivery | null> {\n    return transaction(this.db, async (db) => {\n      await db.query(\n        `UPDATE agent_bridge.deliveries delivery\n         SET state='dead', last_error='message expired', lease_token=NULL,\n             lease_owner=NULL, lease_expires_at=NULL,\n             last_actor='agent-bridge', last_action='message_expired'\n         FROM agent_bridge.messages message\n         WHERE delivery.workspace=$1 AND delivery.recipient=$2\n           AND ($3::uuid IS NULL OR delivery.message_id=$3)\n           AND delivery.state IN ('pending','retrying','claimed')\n           AND message.workspace=delivery.workspace AND message.id=delivery.message_id\n           AND message.expires_at IS NOT NULL AND message.expires_at<=now()`,\n        [principal.workspace, principal.agent, options.messageId ?? null],\n      );\n      await db.query(\n        `UPDATE agent_bridge.deliveries delivery\n         SET state='dead', last_error='maximum attempts reached', lease_token=NULL,\n             lease_owner=NULL, lease_expires_at=NULL,\n             last_actor='agent-bridge', last_action='attempts_exhausted'\n         FROM agent_bridge.messages message\n         WHERE delivery.workspace=$1 AND delivery.recipient=$2\n           AND ($3::uuid IS NULL OR delivery.message_id=$3)\n           AND message.workspace=delivery.workspace AND message.id=delivery.message_id\n           AND delivery.cycle_attempt>=message.delivery_max_attempts\n           AND (delivery.state IN ('pending','retrying')\n             OR (delivery.state='claimed' AND delivery.lease_expires_at<=now()))`,\n        [principal.workspace, principal.agent, options.messageId ?? null],\n      );\n      await db.query(\n        `UPDATE agent_bridge.deliveries delivery\n         SET state='retrying', available_at=now(), lease_token=NULL,\n             lease_owner=NULL, lease_expires_at=NULL,\n             last_error='lease expired', last_actor='agent-bridge', last_action='lease_expired'\n         FROM agent_bridge.messages message\n         WHERE delivery.workspace=$1 AND delivery.recipient=$2\n           AND ($3::uuid IS NULL OR delivery.message_id=$3)\n           AND message.workspace=delivery.workspace AND message.id=delivery.message_id\n           AND delivery.state='claimed' AND delivery.lease_expires_at<=now()\n           AND delivery.cycle_attempt<message.delivery_max_attempts`,\n        [principal.workspace, principal.agent, options.messageId ?? null],\n      );\n      const candidate = await db.query<Row>(\n        `SELECT delivery.id\n         FROM agent_bridge.deliveries delivery\n         JOIN agent_bridge.messages message\n           ON message.workspace=delivery.workspace AND message.id=delivery.message_id\n         WHERE delivery.workspace=$1 AND delivery.recipient=$2 AND ($3::uuid IS NULL OR delivery.message_id=$3)\n           AND delivery.state IN ('pending','retrying')\n           AND delivery.available_at<=now()\n           AND delivery.cycle_attempt<message.delivery_max_attempts\n           AND (message.expires_at IS NULL OR message.expires_at>now())\n         ORDER BY delivery.priority_rank, delivery.available_at, delivery.created_at, delivery.id\n         FOR UPDATE OF delivery SKIP LOCKED\n         LIMIT 1`,\n        [principal.workspace, principal.agent, options.messageId ?? null],\n      );\n      if (!candidate.rows[0]) return null;\n      const token = randomUUID();\n      const owner = principal.instance ?? principal.agent;\n      const claimed = await db.query<Row>(\n        `UPDATE agent_bridge.deliveries\n         SET state='claimed', attempt=attempt+1, cycle_attempt=cycle_attempt+1,\n             lease_token=$1, lease_owner=$2,\n             lease_expires_at=now()+($3*interval '1 millisecond'),\n             last_error=NULL, last_actor=$4, last_action='claim'\n         WHERE id=$5\n         RETURNING *`,\n        [token, owner, options.leaseMs, principal.agent, candidate.rows[0].id],\n      );\n      return asDelivery(claimed.rows[0]!);\n    });\n  }\n\n  async renewDelivery(\n    principal: BridgePrincipal,\n    id: string,\n    token: string,\n    leaseMs: number,\n  ): Promise<BridgeDelivery | null> {\n    const result = await this.db.query<Row>(\n      `UPDATE agent_bridge.deliveries\n       SET lease_expires_at=now() + ($1 * interval '1 millisecond')\n       WHERE workspace=$2 AND recipient=$3 AND lease_owner=$4 AND id=$5 AND lease_token=$6\n         AND state='claimed' AND lease_expires_at>now()\n       RETURNING *`,\n      [leaseMs, principal.workspace, principal.agent, principal.instance ?? principal.agent, id, token],\n    );\n    return result.rows[0] ? asDelivery(result.rows[0]) : null;\n  }\n\n  async settleDelivery(\n    principal: BridgePrincipal,\n    id: string,\n    token: string,\n    state: \"acked\" | \"retrying\" | \"dead\",\n    error?: string,\n    _retryPolicy?: import(\"./bridge-domain.js\").RetryPolicy,\n  ): Promise<BridgeDelivery | null> {\n    const result = await this.db.query<Row>(\n      `UPDATE agent_bridge.deliveries delivery\n       SET state=CASE\n             WHEN $1='retrying' AND cycle_attempt>=message.delivery_max_attempts THEN 'dead'\n             ELSE $1\n           END,\n           available_at=CASE\n             WHEN $1='retrying' AND cycle_attempt<message.delivery_max_attempts THEN\n               now() + (\n                 LEAST(message.delivery_retry_max_delay_ms::double precision,\n                       message.delivery_retry_base_delay_ms::double precision * power(2, GREATEST(cycle_attempt - 1, 0)))\n                 * (1 + ((random() * 2) - 1) * message.delivery_retry_jitter_ratio)\n                 * interval '1 millisecond'\n               )\n             ELSE available_at\n           END,\n           last_error=$2, lease_token=NULL, lease_owner=NULL, lease_expires_at=NULL,\n           last_actor=$4,\n           last_action=CASE\n             WHEN $1='acked' THEN 'ack'\n             WHEN $1='dead' THEN 'nack_dead'\n             WHEN cycle_attempt>=message.delivery_max_attempts THEN 'attempts_exhausted'\n             ELSE 'nack_retry'\n           END\n       FROM agent_bridge.messages message\n       WHERE delivery.workspace=$3 AND delivery.recipient=$4 AND delivery.lease_owner=$5\n         AND message.workspace=delivery.workspace AND message.id=delivery.message_id\n         AND delivery.id=$6 AND delivery.lease_token=$7 AND delivery.state='claimed' AND delivery.lease_expires_at>now()\n       RETURNING delivery.*`,\n      [\n        state,\n        error?.slice(0, 1024) ?? null,\n        principal.workspace,\n        principal.agent,\n        principal.instance ?? principal.agent,\n        id,\n        token,\n      ],\n    );\n    return result.rows[0] ? asDelivery(result.rows[0]) : null;\n  }\n\n  async listDeliveries(principal: BridgePrincipal, query: DeliveryQuery = {}) {\n    const filters = {\n      role: query.role ?? \"all\",\n      states: [...(query.states ?? [])].sort(),\n      messageId: query.messageId ?? null,\n      recipient: query.recipient ?? null,\n    };\n    const scope = scopedCursorScope(\"deliveries\", principal, filters);\n    const boundary = validateDeliveryCursorPosition(decodeScopedCursor(query.cursor, scope));\n    const createdAt = boundary?.createdAt;\n    const id = boundary?.id;\n    const limit = query.limit ?? 50;\n    const values: unknown[] = [principal.workspace, principal.agent];\n    const clauses = [\"delivery.workspace=$1\"];\n    const role = query.role ?? \"all\";\n    clauses.push(role === \"recipient\" ? \"delivery.recipient=$2\" : role === \"publisher\" ? \"message.source=$2\" : \"(delivery.recipient=$2 OR message.source=$2)\");\n    if (createdAt && id) {\n      values.push(createdAt, id);\n      clauses.push(`(delivery.created_at,delivery.id)>($${values.length - 1}::timestamptz,$${values.length}::uuid)`);\n    }\n    if (query.messageId) { values.push(query.messageId); clauses.push(`delivery.message_id=$${values.length}`); }\n    if (query.recipient) { values.push(query.recipient); clauses.push(`delivery.recipient=$${values.length}`); }\n    if (query.states?.length) { values.push(query.states); clauses.push(`delivery.state=ANY($${values.length}::text[])`); }\n    values.push(limit);\n    const result = await this.db.query<Row>(\n      `SELECT delivery.* FROM agent_bridge.deliveries delivery\n       JOIN agent_bridge.messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id\n       WHERE ${clauses.join(\" AND \")}\n       ORDER BY delivery.created_at,delivery.id LIMIT $${values.length}`,\n      values,\n    );\n    const deliveries = result.rows.map(asDelivery);\n    const last = deliveries[deliveries.length - 1];\n    return { deliveries, cursor: deliveries.length === limit && last ? encodeScopedCursor(scope, { createdAt: last.createdAt, id: last.id }) : undefined };\n  }\n\n  async listDeliveryEvents(principal: BridgePrincipal, id: string, query: { cursor?: string; limit?: number } = {}) {\n    const limit = Math.min(Math.max(query.limit ?? 50, 1), 200);\n    const scope = scopedCursorScope(\"delivery-events\", principal, { deliveryId: id });\n    const position = validateEventCursorPosition(decodeScopedCursor(query.cursor, scope));\n    const result = await this.db.query<Row>(\n      `SELECT event.* FROM agent_bridge.delivery_events event\n       JOIN agent_bridge.messages message ON message.workspace=event.workspace AND message.id=event.message_id\n       WHERE event.workspace=$1 AND event.delivery_id=$2 AND event.sequence>$3::bigint\n         AND (event.recipient=$4 OR message.source=$4)\n       ORDER BY event.sequence LIMIT $5`,\n      [principal.workspace, id, position ?? \"0\", principal.agent, limit],\n    );\n    const events = result.rows.map(asDeliveryEvent);\n    const last = events[events.length - 1];\n    return { events, cursor: events.length === limit && last ? encodeScopedCursor(scope, last.sequence) : undefined };\n  }\n\n  async cancelDelivery(principal: BridgePrincipal, id: string) {\n    return transaction(this.db, async (db) => {\n      const visible = await db.query<Row>(\n        `SELECT delivery.* FROM agent_bridge.deliveries delivery\n         JOIN agent_bridge.messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id\n         WHERE delivery.id=$1 AND delivery.workspace=$2 AND message.source=$3 FOR UPDATE OF delivery`,\n        [id, principal.workspace, principal.agent],\n      );\n      const current = visible.rows[0];\n      if (!current) return null;\n      if (current.state === \"cancelled\") return asDelivery(current);\n      if (![\"pending\", \"retrying\", \"claimed\"].includes(current.state)) {\n        throw new DeliveryStateConflictError(`cannot cancel a ${current.state} delivery`);\n      }\n      const result = await db.query<Row>(\n        `UPDATE agent_bridge.deliveries SET state='cancelled', lease_token=NULL,\n         lease_owner=NULL, lease_expires_at=NULL, last_error=NULL,\n         last_actor=$1, last_action='cancel' WHERE id=$2 RETURNING *`,\n        [principal.agent, id],\n      );\n      return asDelivery(result.rows[0]!);\n    });\n  }\n\n  async requeueDelivery(principal: BridgePrincipal, id: string) {\n    return transaction(this.db, async (db) => {\n      const visible = await db.query<Row>(\n        `SELECT delivery.*,message.expires_at,message.delivery_not_before\n         FROM agent_bridge.deliveries delivery\n         JOIN agent_bridge.messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id\n         WHERE delivery.id=$1 AND delivery.workspace=$2 AND message.source=$3 FOR UPDATE OF delivery`,\n        [id, principal.workspace, principal.agent],\n      );\n      const current = visible.rows[0];\n      if (!current) return null;\n      if (![\"dead\", \"cancelled\"].includes(current.state)) {\n        throw new DeliveryStateConflictError(`cannot requeue a ${current.state} delivery`);\n      }\n      if (current.expires_at && new Date(current.expires_at).getTime() <= Date.now()) {\n        throw new DeliveryStateConflictError(\"cannot requeue an expired message\");\n      }\n      const result = await db.query<Row>(\n        `UPDATE agent_bridge.deliveries SET state='pending',\n         available_at=greatest(now(),coalesce($1::timestamptz,now())),\n         cycle_attempt=0,requeue_count=requeue_count+1,\n         lease_token=NULL,lease_owner=NULL,lease_expires_at=NULL,last_error=NULL,\n         last_actor=$2,last_action='requeue' WHERE id=$3 RETURNING *`,\n        [current.delivery_not_before, principal.agent, id],\n      );\n      return asDelivery(result.rows[0]!);\n    });\n  }\n\n  async diagnostics(principal: BridgePrincipal): Promise<BridgeDiagnostics> {\n    const result = await this.db.query<Row>(\n      `SELECT\n         count(*) FILTER (WHERE state='pending')::integer AS pending,\n         count(*) FILTER (WHERE state='claimed')::integer AS claimed,\n         count(*) FILTER (WHERE state='retrying')::integer AS retrying,\n         count(*) FILTER (WHERE state='dead')::integer AS dead,\n         count(*) FILTER (WHERE state='cancelled')::integer AS cancelled,\n         min(available_at) FILTER (WHERE state IN ('pending','retrying')) AS oldest_available,\n         count(*) FILTER (WHERE state IN ('pending','retrying') AND available_at<=now())::integer AS due,\n         count(*) FILTER (WHERE state IN ('pending','retrying') AND available_at>now())::integer AS scheduled,\n         count(*) FILTER (WHERE state='claimed' AND lease_expires_at<=now())::integer AS expired_leases,\n         min(available_at) FILTER (WHERE state IN ('pending','retrying') AND available_at<=now()) AS oldest_due,\n         coalesce(greatest(0,extract(epoch FROM (now()-min(available_at) FILTER (WHERE state IN ('pending','retrying') AND available_at<=now())))*1000),0)::bigint AS queue_lag_ms\n       FROM agent_bridge.deliveries WHERE workspace=$1 AND recipient=$2`,\n      [principal.workspace, principal.agent],\n    );\n    const queue = result.rows[0] ?? {};\n    return {\n      schemaVersion: \"postgres-v2\",\n      deliverySupported: true,\n      pending: Number(queue.pending ?? 0),\n      claimed: Number(queue.claimed ?? 0),\n      retrying: Number(queue.retrying ?? 0),\n      dead: Number(queue.dead ?? 0),\n      cancelled: Number(queue.cancelled ?? 0),\n      oldestAvailableAt: asTimestamp(queue.oldest_available),\n      due: Number(queue.due ?? 0),\n      scheduled: Number(queue.scheduled ?? 0),\n      expiredLeases: Number(queue.expired_leases ?? 0),\n      oldestDueAt: asTimestamp(queue.oldest_due),\n      queueLagMs: Number(queue.queue_lag_ms ?? 0),\n    };\n  }\n\n  async heartbeat(principal: BridgePrincipal, leaseMs: number, runtimeType?: string, capabilities: string[] = []): Promise<AgentPresence> {\n    await this.db.query(\n      \"DELETE FROM agent_bridge.agent_instances WHERE workspace=$1 AND lease_expires_at<=now()\",\n      [principal.workspace],\n    );\n    const result = await this.db.query<Row>(\n      `WITH locked AS (\n         SELECT pg_advisory_xact_lock(hashtextextended($1, 0))\n       )\n       INSERT INTO agent_bridge.agent_instances (workspace,agent,instance,runtime_type,capabilities,lease_expires_at,last_seen_at)\n       SELECT $1,$2,$3,$4,$5::jsonb,now() + ($6 * interval '1 millisecond'),now()\n       FROM locked\n       WHERE EXISTS (\n         SELECT 1 FROM agent_bridge.agent_instances\n         WHERE workspace=$1 AND agent=$2 AND instance=$3\n       ) OR ((\n         SELECT count(*) < 128 FROM agent_bridge.agent_instances\n         WHERE workspace=$1 AND agent=$2\n       ) AND (\n         SELECT count(*) < 4096 FROM agent_bridge.agent_instances\n         WHERE workspace=$1\n       )\n       )\n       ON CONFLICT (workspace,agent,instance) DO UPDATE SET runtime_type=excluded.runtime_type,capabilities=excluded.capabilities,lease_expires_at=excluded.lease_expires_at,last_seen_at=excluded.last_seen_at\n       RETURNING *`,\n      [principal.workspace, principal.agent, principal.instance, runtimeType ?? null, JSON.stringify(capabilities), leaseMs],\n    );\n    if (!result.rows[0]) {\n      throw Object.assign(new Error(\"active instance limit reached\"), {\n        status: 429,\n        code: \"presence_limit\",\n      });\n    }\n    return asPresence(result.rows[0]!);\n  }\n\n  async listPresence(principal: BridgePrincipal): Promise<AgentPresence[]> {\n    await this.db.query(\n      \"DELETE FROM agent_bridge.agent_instances WHERE workspace=$1 AND lease_expires_at<=now()\",\n      [principal.workspace],\n    );\n    const result = await this.db.query<Row>(\n      \"SELECT * FROM agent_bridge.agent_instances WHERE workspace=$1 ORDER BY agent,instance\",\n      [principal.workspace],\n    );\n    return result.rows.map(asPresence);\n  }\n\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAiD3B,SAAS,KAAK,OAA+B;AAC3C,SAAO,UAAU,SAAY,OAAO,KAAK,UAAU,KAAK;AAC1D;AAEA,SAAS,MAAM,OAAqB;AAClC,SAAO,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACzD;AAEA,SAAS,YAAY,OAAoC;AACvD,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,UAAU,KAAyB;AAC1C,QAAM,iBAAiC,IAAI,kBAAkB,YACzD,EAAE,MAAM,UAAU,IAClB;AAAA,IACE,MAAM;AAAA,IACN,aAAa,OAAO,IAAI,qBAAqB;AAAA,IAC7C,kBAAkB,OAAO,IAAI,4BAA4B;AAAA,IACzD,iBAAiB,OAAO,IAAI,2BAA2B;AAAA,IACvD,kBAAkB,OAAO,IAAI,2BAA2B;AAAA,IACxD,GAAI,IAAI,sBAAsB,EAAE,WAAW,YAAY,IAAI,mBAAmB,EAAE,IAAI,CAAC;AAAA,EACvF;AACJ,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,SAAS,IAAI,WAAW;AAAA,IACxB,QAAQ,OAAO,IAAI,MAAM;AAAA,IACzB,UAAU,OAAO,IAAI,QAAQ;AAAA,IAC7B,MAAM,OAAO,IAAI,IAAI;AAAA,IACrB,SAAS,OAAO,IAAI,OAAO;AAAA,IAC3B,aAAa,OAAO,IAAI,YAAY;AAAA,IACpC,MAAM,MAAM,IAAI,IAAI;AAAA,IACpB,SAAS,MAAM,IAAI,OAAO,KAAK,CAAC;AAAA,IAChC,UAAU,IAAI,aAAa;AAAA,IAC3B,WAAW,IAAI,eAAe;AAAA,IAC9B,eAAe,IAAI,kBAAkB;AAAA,IACrC,aAAa,IAAI,gBAAgB;AAAA,IACjC,UAAU,IAAI;AAAA,IACd,WAAW,YAAY,IAAI,UAAU;AAAA,IACrC,gBAAgB,IAAI,mBAAmB;AAAA,IACvC,gBAAgB,IAAI,oBAAoB;AAAA,IACxC,YAAY,MAAM,IAAI,WAAW,KAAK;AAAA,IACtC,UAAU,MAAM,IAAI,QAAQ;AAAA,IAC5B;AAAA,IACA,WAAW,YAAY,IAAI,UAAU,KAAK;AAAA,EAC5C;AACF;AAEA,SAAS,WAAW,KAA0B;AAC5C,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,WAAW,OAAO,IAAI,UAAU;AAAA,IAChC,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,OAAO,IAAI;AAAA,IACX,SAAS,OAAO,IAAI,OAAO;AAAA,IAC3B,cAAc,OAAO,IAAI,iBAAiB,IAAI,OAAO;AAAA,IACrD,cAAc,OAAO,IAAI,iBAAiB,CAAC;AAAA,IAC3C,WAAW,YAAY,IAAI,UAAU,KAAK;AAAA,IAC1C,cAAc,OAAO,IAAI,aAAa;AAAA,IACtC,aAAa,YAAY,IAAI,YAAY,KAAK;AAAA,IAC9C,YAAY,IAAI,eAAe;AAAA,IAC/B,YAAY,IAAI,eAAe;AAAA,IAC/B,gBAAgB,YAAY,IAAI,gBAAgB;AAAA,IAChD,WAAW,IAAI,cAAc;AAAA,IAC7B,WAAW,IAAI,cAAc;AAAA,IAC7B,YAAY,IAAI;AAAA,EAClB;AACF;AAEA,SAAS,WAAW,KAAyB;AAC3C,SAAO;AAAA,IACL,WAAW,OAAO,IAAI,SAAS;AAAA,IAAG,OAAO,OAAO,IAAI,KAAK;AAAA,IAAG,UAAU,OAAO,IAAI,QAAQ;AAAA,IACzF,aAAa,IAAI,gBAAgB;AAAA,IAAW,cAAc,MAAM,IAAI,YAAY,KAAK,CAAC;AAAA,IACtF,gBAAgB,YAAY,IAAI,gBAAgB,KAAK;AAAA,IAAI,YAAY,YAAY,IAAI,YAAY,KAAK;AAAA,EACxG;AACF;AAEA,SAAS,gBAAgB,KAA+B;AACtD,SAAO;AAAA,IACL,UAAU,OAAO,IAAI,QAAQ;AAAA,IAAG,YAAY,OAAO,IAAI,WAAW;AAAA,IAClE,WAAW,OAAO,IAAI,UAAU;AAAA,IAAG,WAAW,OAAO,IAAI,SAAS;AAAA,IAClE,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,WAAW,IAAI,cAAc,OAAO,SAAY,IAAI;AAAA,IACpD,SAAS,IAAI;AAAA,IAA4C,SAAS,OAAO,IAAI,OAAO;AAAA,IACpF,cAAc,OAAO,IAAI,aAAa;AAAA,IAAG,cAAc,OAAO,IAAI,aAAa;AAAA,IAC/E,YAAY,IAAI,eAAe;AAAA,IAAW,OAAO,IAAI,SAAS;AAAA,IAC9D,OAAO,OAAO,IAAI,KAAK;AAAA,IAAG,QAAQ,IAAI;AAAA,IACtC,WAAW,YAAY,IAAI,UAAU,KAAK;AAAA,EAC5C;AACF;AAEA,eAAe,YAAe,IAAiB,MAAuD;AACpG,MAAI,GAAG,cAAe,QAAO,KAAK,EAAE;AACpC,QAAM,WAAW,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;AAClD,QAAM,SAAS,WAAW,MAAM,GAAG,QAAS,IAAI;AAChD,MAAI;AACF,UAAM,OAAO,MAAM,OAAO;AAC1B,UAAM,SAAS,MAAM,KAAK,MAAM;AAChC,UAAM,OAAO,MAAM,QAAQ;AAC3B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,OAAO,MAAM,UAAU,EAAE,MAAM,MAAM,MAAS;AACpD,UAAM;AAAA,EACR,UAAE;AACA,QAAI,YAAY,aAAa,UAAU,OAAO,OAAO,YAAY,WAAY,QAAO,QAAQ;AAAA,EAC9F;AACF;AAEO,IAAM,sBAAN,MAAiD;AAAA,EACtD,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAE/C,MAAM,aAA4B;AAAA,EAElC;AAAA,EAEA,MAAM,cACJ,OAC8B;AAC9B,UAAM,SAAS;AAAA,MACb,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,WAAW;AAAA,MACjB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,KAAK,MAAM,IAAI;AAAA,MACf,KAAK,MAAM,OAAO;AAAA,MAClB,MAAM,YAAY;AAAA,MAClB,MAAM,aAAa;AAAA,MACnB,MAAM,iBAAiB;AAAA,MACvB,MAAM,eAAe;AAAA,MACrB,MAAM;AAAA,MACN,MAAM,aAAa;AAAA,MACnB,MAAM,kBAAkB;AAAA,MACxB,MAAM,kBAAkB;AAAA,MACxB,KAAK,MAAM,UAAU;AAAA,MACrB,KAAK,MAAM,QAAQ;AAAA,MACnB,MAAM,eAAe;AAAA,MACrB,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,cAAc;AAAA,MAC5E,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,mBAAmB;AAAA,MACjF,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,kBAAkB;AAAA,MAChF,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,mBAAmB;AAAA,MACjF,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,aAAa,OAAO;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MA4CA;AAAA,IACF;AAEA,QAAI,MAAM,OAAO,KAAK,CAAC;AACvB,QAAI,CAAC,OAAO,MAAM,gBAAgB;AAChC,YAAM,WAAW,MAAM,KAAK,GAAG;AAAA,QAC7B;AAAA;AAAA;AAAA,QAGA,CAAC,MAAM,WAAW,MAAM,QAAQ,MAAM,cAAc;AAAA,MACtD;AACA,YAAM,SAAS,KAAK,CAAC;AAAA,IACvB;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,qCAAqC;AAC/D,UAAM,UAAU,UAAU,GAAG;AAC7B,QAAI,IAAI,YAAY,KAAM,wBAAuB,SAAS,KAAK;AAC/D,WAAO,EAAE,SAAS,SAAS,IAAI,YAAY,KAAK;AAAA,EAClD;AAAA,EAEA,MAAM,aACJ,WACA,QAAsB,CAAC,GACD;AACtB,UAAM,QAAQ,YAAY,WAAW,KAAK;AAC1C,UAAM,SAAS,aAAa,MAAM,QAAQ,KAAK,KAAK;AACpD,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,MAAM,SAAS,EAAE,GAAG,CAAC,GAAG,GAAG;AACtE,UAAM,WAAW,MAAM,SAAS,SAAY,MAAM,KAAK,GAAG;AAAA,MACxD;AAAA,MACA,CAAC,UAAU,SAAS;AAAA,IACtB;AACA,UAAM,YAAY,UAAU,KAAK,CAAC,GAAG;AACrC,UAAM,SAAoB,MAAM,SAC5B,CAAC,UAAU,WAAW,UAAU,KAAK,IACrC,CAAC,UAAU,WAAW,QAAQ,UAAU,KAAK;AACjD,UAAM,UAAU,MAAM,WAAW;AACjC,UAAM,aAAa,MAAM,SAAS,IAAI;AACtC,UAAM,aAAa,YAAY,SAAS,WAAW,UAAU,KACzD,YAAY,QAAQ,YAAY,UAAU,yCAAyC,UAAU,MAC7F,sCAAsC,UAAU;AACpD,QAAI,MAAM,0DAA0D,MAAM,SAAS,KAAK,0BAA0B,OAAO,UAAU;AAEnI,QAAI,WAAW;AACb,aAAO,KAAK,SAAS;AACrB,aAAO,qBAAqB,OAAO,MAAM;AAAA,IAC3C;AAEA,QAAI,CAAC,MAAM,gBAAgB;AACzB,aAAO;AAAA,IACT;AACA,QAAI,MAAM,OAAO,QAAQ;AACvB,aAAO,KAAK,MAAM,KAAK;AACvB,aAAO,oBAAoB,OAAO,MAAM;AAAA,IAC1C;AACA,QAAI,MAAM,QAAQ;AAChB,aAAO,KAAK,MAAM,MAAM;AACxB,aAAO,kBAAkB,OAAO,MAAM;AAAA,IACxC;AACA,QAAI,MAAM,SAAS;AACjB,aAAO,KAAK,MAAM,OAAO;AACzB,aAAO,mBAAmB,OAAO,MAAM;AAAA,IACzC;AACA,QAAI,MAAM,OAAO;AACf,aAAO,KAAK,MAAM,KAAK;AACvB,aAAO,uBAAuB,OAAO,MAAM;AAAA,IAC7C;AACA,QAAI,MAAM,gBAAgB,MAAM,iBAAiB,OAAO;AACtD,aAAO,QAAQ,MAAM,iBAAiB,WAAW,SAAS,EAAE;AAAA;AAAA;AAAA;AAAA,mCAI/B,UAAU;AAAA;AAAA,IAEzC;AACA,QAAI,MAAM,UAAU;AAClB,aAAO,KAAK,MAAM,QAAQ;AAC1B,aAAO,qBAAqB,OAAO,MAAM;AAAA,IAC3C;AAEA,WAAO,KAAK,KAAK;AACjB,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B,GAAG,GAAG,sBAAsB,MAAM,SAAS,SAAS,KAAK,WAAW,OAAO,MAAM;AAAA,MACjF;AAAA,IACF;AACA,UAAM,WAAW,OAAO,KAAK,IAAI,SAAS;AAC1C,UAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,QAAI,MAAM,OAAQ,QAAO,EAAE,UAAU,QAAQ,SAAS,CAAC,IAAI,aAAa,SAAS,CAAC,EAAE,UAAU,KAAK,IAAI,MAAM,OAAO;AACpH,QAAI,SAAS,WAAW,MAAO,QAAO,EAAE,UAAU,QAAQ,aAAa,KAAM,UAAU,KAAK,EAAE;AAC9F,WAAO,EAAE,UAAU,QAAQ,YAAY,aAAa,WAAW,KAAK,IAAI,MAAM,OAAO;AAAA,EACvF;AAAA,EAEA,MAAM,cACJ,WACA,KACA,SAAS,oBAAI,KAAK,GACD;AACjB,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,UAAU,WAAW,KAAK,UAAU,OAAO,MAAM;AAAA,IACpD;AACA,WAAO,OAAO,YAAY;AAAA,EAC5B;AAAA,EAEA,MAAM,cACJ,WACA,SACgC;AAChC,WAAO,YAAY,KAAK,IAAI,OAAO,OAAO;AACxC,YAAM,GAAG;AAAA,QACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUA,CAAC,UAAU,WAAW,UAAU,OAAO,QAAQ,aAAa,IAAI;AAAA,MAClE;AACA,YAAM,GAAG;AAAA,QACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAWA,CAAC,UAAU,WAAW,UAAU,OAAO,QAAQ,aAAa,IAAI;AAAA,MAClE;AACA,YAAM,GAAG;AAAA,QACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUA,CAAC,UAAU,WAAW,UAAU,OAAO,QAAQ,aAAa,IAAI;AAAA,MAClE;AACA,YAAM,YAAY,MAAM,GAAG;AAAA,QACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,UAAU,WAAW,UAAU,OAAO,QAAQ,aAAa,IAAI;AAAA,MAClE;AACA,UAAI,CAAC,UAAU,KAAK,CAAC,EAAG,QAAO;AAC/B,YAAM,QAAQ,WAAW;AACzB,YAAM,QAAQ,UAAU,YAAY,UAAU;AAC9C,YAAM,UAAU,MAAM,GAAG;AAAA,QACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOA,CAAC,OAAO,OAAO,QAAQ,SAAS,UAAU,OAAO,UAAU,KAAK,CAAC,EAAE,EAAE;AAAA,MACvE;AACA,aAAO,WAAW,QAAQ,KAAK,CAAC,CAAE;AAAA,IACpC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cACJ,WACA,IACA,OACA,SACgC;AAChC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,SAAS,UAAU,WAAW,UAAU,OAAO,UAAU,YAAY,UAAU,OAAO,IAAI,KAAK;AAAA,IAClG;AACA,WAAO,OAAO,KAAK,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,CAAC,IAAI;AAAA,EACvD;AAAA,EAEA,MAAM,eACJ,WACA,IACA,OACA,OACA,OACA,cACgC;AAChC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MA4BA;AAAA,QACE;AAAA,QACA,OAAO,MAAM,GAAG,IAAI,KAAK;AAAA,QACzB,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU,YAAY,UAAU;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,KAAK,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,CAAC,IAAI;AAAA,EACvD;AAAA,EAEA,MAAM,eAAe,WAA4B,QAAuB,CAAC,GAAG;AAC1E,UAAM,UAAU;AAAA,MACd,MAAM,MAAM,QAAQ;AAAA,MACpB,QAAQ,CAAC,GAAI,MAAM,UAAU,CAAC,CAAE,EAAE,KAAK;AAAA,MACvC,WAAW,MAAM,aAAa;AAAA,MAC9B,WAAW,MAAM,aAAa;AAAA,IAChC;AACA,UAAM,QAAQ,kBAAkB,cAAc,WAAW,OAAO;AAChE,UAAM,WAAW,+BAA+B,mBAAmB,MAAM,QAAQ,KAAK,CAAC;AACvF,UAAM,YAAY,UAAU;AAC5B,UAAM,KAAK,UAAU;AACrB,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAoB,CAAC,UAAU,WAAW,UAAU,KAAK;AAC/D,UAAM,UAAU,CAAC,uBAAuB;AACxC,UAAM,OAAO,MAAM,QAAQ;AAC3B,YAAQ,KAAK,SAAS,cAAc,0BAA0B,SAAS,cAAc,sBAAsB,8CAA8C;AACzJ,QAAI,aAAa,IAAI;AACnB,aAAO,KAAK,WAAW,EAAE;AACzB,cAAQ,KAAK,uCAAuC,OAAO,SAAS,CAAC,kBAAkB,OAAO,MAAM,SAAS;AAAA,IAC/G;AACA,QAAI,MAAM,WAAW;AAAE,aAAO,KAAK,MAAM,SAAS;AAAG,cAAQ,KAAK,wBAAwB,OAAO,MAAM,EAAE;AAAA,IAAG;AAC5G,QAAI,MAAM,WAAW;AAAE,aAAO,KAAK,MAAM,SAAS;AAAG,cAAQ,KAAK,uBAAuB,OAAO,MAAM,EAAE;AAAA,IAAG;AAC3G,QAAI,MAAM,QAAQ,QAAQ;AAAE,aAAO,KAAK,MAAM,MAAM;AAAG,cAAQ,KAAK,uBAAuB,OAAO,MAAM,WAAW;AAAA,IAAG;AACtH,WAAO,KAAK,KAAK;AACjB,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA,eAES,QAAQ,KAAK,OAAO,CAAC;AAAA,yDACqB,OAAO,MAAM;AAAA,MAChE;AAAA,IACF;AACA,UAAM,aAAa,OAAO,KAAK,IAAI,UAAU;AAC7C,UAAM,OAAO,WAAW,WAAW,SAAS,CAAC;AAC7C,WAAO,EAAE,YAAY,QAAQ,WAAW,WAAW,SAAS,OAAO,mBAAmB,OAAO,EAAE,WAAW,KAAK,WAAW,IAAI,KAAK,GAAG,CAAC,IAAI,OAAU;AAAA,EACvJ;AAAA,EAEA,MAAM,mBAAmB,WAA4B,IAAY,QAA6C,CAAC,GAAG;AAChH,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,MAAM,SAAS,IAAI,CAAC,GAAG,GAAG;AAC1D,UAAM,QAAQ,kBAAkB,mBAAmB,WAAW,EAAE,YAAY,GAAG,CAAC;AAChF,UAAM,WAAW,4BAA4B,mBAAmB,MAAM,QAAQ,KAAK,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,UAAU,WAAW,IAAI,YAAY,KAAK,UAAU,OAAO,KAAK;AAAA,IACnE;AACA,UAAM,SAAS,OAAO,KAAK,IAAI,eAAe;AAC9C,UAAM,OAAO,OAAO,OAAO,SAAS,CAAC;AACrC,WAAO,EAAE,QAAQ,QAAQ,OAAO,WAAW,SAAS,OAAO,mBAAmB,OAAO,KAAK,QAAQ,IAAI,OAAU;AAAA,EAClH;AAAA,EAEA,MAAM,eAAe,WAA4B,IAAY;AAC3D,WAAO,YAAY,KAAK,IAAI,OAAO,OAAO;AACxC,YAAM,UAAU,MAAM,GAAG;AAAA,QACvB;AAAA;AAAA;AAAA,QAGA,CAAC,IAAI,UAAU,WAAW,UAAU,KAAK;AAAA,MAC3C;AACA,YAAM,UAAU,QAAQ,KAAK,CAAC;AAC9B,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,QAAQ,UAAU,YAAa,QAAO,WAAW,OAAO;AAC5D,UAAI,CAAC,CAAC,WAAW,YAAY,SAAS,EAAE,SAAS,QAAQ,KAAK,GAAG;AAC/D,cAAM,IAAI,2BAA2B,mBAAmB,QAAQ,KAAK,WAAW;AAAA,MAClF;AACA,YAAM,SAAS,MAAM,GAAG;AAAA,QACtB;AAAA;AAAA;AAAA,QAGA,CAAC,UAAU,OAAO,EAAE;AAAA,MACtB;AACA,aAAO,WAAW,OAAO,KAAK,CAAC,CAAE;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gBAAgB,WAA4B,IAAY;AAC5D,WAAO,YAAY,KAAK,IAAI,OAAO,OAAO;AACxC,YAAM,UAAU,MAAM,GAAG;AAAA,QACvB;AAAA;AAAA;AAAA;AAAA,QAIA,CAAC,IAAI,UAAU,WAAW,UAAU,KAAK;AAAA,MAC3C;AACA,YAAM,UAAU,QAAQ,KAAK,CAAC;AAC9B,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,CAAC,CAAC,QAAQ,WAAW,EAAE,SAAS,QAAQ,KAAK,GAAG;AAClD,cAAM,IAAI,2BAA2B,oBAAoB,QAAQ,KAAK,WAAW;AAAA,MACnF;AACA,UAAI,QAAQ,cAAc,IAAI,KAAK,QAAQ,UAAU,EAAE,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC9E,cAAM,IAAI,2BAA2B,mCAAmC;AAAA,MAC1E;AACA,YAAM,SAAS,MAAM,GAAG;AAAA,QACtB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,CAAC,QAAQ,qBAAqB,UAAU,OAAO,EAAE;AAAA,MACnD;AACA,aAAO,WAAW,OAAO,KAAK,CAAC,CAAE;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,WAAwD;AACxE,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,UAAU,WAAW,UAAU,KAAK;AAAA,IACvC;AACA,UAAM,QAAQ,OAAO,KAAK,CAAC,KAAK,CAAC;AACjC,WAAO;AAAA,MACL,eAAe;AAAA,MACf,mBAAmB;AAAA,MACnB,SAAS,OAAO,MAAM,WAAW,CAAC;AAAA,MAClC,SAAS,OAAO,MAAM,WAAW,CAAC;AAAA,MAClC,UAAU,OAAO,MAAM,YAAY,CAAC;AAAA,MACpC,MAAM,OAAO,MAAM,QAAQ,CAAC;AAAA,MAC5B,WAAW,OAAO,MAAM,aAAa,CAAC;AAAA,MACtC,mBAAmB,YAAY,MAAM,gBAAgB;AAAA,MACrD,KAAK,OAAO,MAAM,OAAO,CAAC;AAAA,MAC1B,WAAW,OAAO,MAAM,aAAa,CAAC;AAAA,MACtC,eAAe,OAAO,MAAM,kBAAkB,CAAC;AAAA,MAC/C,aAAa,YAAY,MAAM,UAAU;AAAA,MACzC,YAAY,OAAO,MAAM,gBAAgB,CAAC;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,WAA4B,SAAiB,aAAsB,eAAyB,CAAC,GAA2B;AACtI,UAAM,KAAK,GAAG;AAAA,MACZ;AAAA,MACA,CAAC,UAAU,SAAS;AAAA,IACtB;AACA,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAmBA,CAAC,UAAU,WAAW,UAAU,OAAO,UAAU,UAAU,eAAe,MAAM,KAAK,UAAU,YAAY,GAAG,OAAO;AAAA,IACvH;AACA,QAAI,CAAC,OAAO,KAAK,CAAC,GAAG;AACnB,YAAM,OAAO,OAAO,IAAI,MAAM,+BAA+B,GAAG;AAAA,QAC9D,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,WAAO,WAAW,OAAO,KAAK,CAAC,CAAE;AAAA,EACnC;AAAA,EAEA,MAAM,aAAa,WAAsD;AACvE,UAAM,KAAK,GAAG;AAAA,MACZ;AAAA,MACA,CAAC,UAAU,SAAS;AAAA,IACtB;AACA,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA,MACA,CAAC,UAAU,SAAS;AAAA,IACtB;AACA,WAAO,OAAO,KAAK,IAAI,UAAU;AAAA,EACnC;AAEF;","names":[]}

package/dist/{chunk-P635FAN4.js → chunk-JUTJRAMA.js}

@@ -259,6 +259,10 @@ function createGateway(options) {
     const requestBody = () => parsedBody ?? (parsedBody = jsonBody(req, limit, abort.signal));
     const dispatch = async (authority, response = res) => {
       const url = new URL(req.url ?? "/", "http://gateway.invalid");
+      if (req.method === "GET" && url.pathname === "/healthz") {
+        send(response, 200, { status: "alive" }, requestId);
+        return;
+      }
       if (req.method === "GET" && url.pathname === "/readyz") {
         let ready = false;
         try {
@@ -594,4 +598,4 @@ export {
   safeTokenHashEqual,
   createGateway
 };
-//# sourceMappingURL=chunk-P635FAN4.js.map
+//# sourceMappingURL=chunk-JUTJRAMA.js.map

package/dist/chunk-JUTJRAMA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/gateway.ts","../src/gateway-auth.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { createServer, type IncomingMessage, type ServerResponse } from \"node:http\";\nimport { BridgePrincipalMismatchError, BridgeValidationError, type MessageDraft } from \"./bridge-domain.js\";\nimport { BridgeService } from \"./bridge-service.js\";\nimport type { BridgeStore } from \"./bridge-store.js\";\nimport { bearerToken, hashCredential, type CredentialResolver } from \"./gateway-auth.js\";\nimport type { GatewaySecurity } from \"./gateway-security.js\";\nimport type { RequestAuthority, RequestAuthorityContext } from \"./postgres-request-authority.js\";\nimport {\n  capabilityDocument,\n  ContractResponseError,\n  ContractValidationError,\n  LEGACY_PROTOCOL_VERSION,\n  negotiateProtocolVersion,\n  operationContract,\n  parseResponse,\n  PROTOCOL_HEADER,\n  PROTOCOL_VERSION,\n  SUPPORTED_PROTOCOL_HEADER,\n  SUPPORTED_PROTOCOL_VERSIONS,\n  type OperationId,\n  validateRequest,\n  validateRequestForProtocol,\n} from \"./contracts/registry.js\";\n\nexport interface GatewayOptions {\n  store: BridgeStore;\n  credentials: CredentialResolver;\n  security: GatewaySecurity;\n  allowedOrigins?: string[];\n  bodyLimitBytes?: number;\n  requestDeadlineMs?: number;\n  ready?: () => Promise<boolean>;\n  /** Reports whether the configured database has verified row isolation. */\n  rowIsolationReady?: () => Promise<boolean>;\n  /** Production PostgreSQL request authority. Other providers omit this. */\n  requestAuthority?: RequestAuthority;\n}\n\ntype Metrics = { requests: number; errors: number; timeouts: number; authFailures: number };\nconst jsonHeaders = { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" };\n\ninterface ResponseWriter {\n  readonly writableEnded: boolean;\n  getHeader(name: string): string | number | readonly string[] | undefined;\n  setHeader(name: string, value: string | number | readonly string[]): unknown;\n  writeHead(status: number, headers?: any): unknown;\n  end(chunk?: any): unknown;\n}\n\nclass BufferedResponse implements ResponseWriter {\n  private readonly headers = new Map<string, string | number | readonly string[]>();\n  private status: number | undefined;\n  private headHeaders: any;\n  private body: any;\n\n  constructor(private readonly target: ServerResponse) {}\n  get writableEnded(): boolean { return this.body !== undefined; }\n  getHeader(name: string) { return this.headers.get(name.toLowerCase()) ?? this.target.getHeader(name); }\n  setHeader(name: string, value: string | number | readonly string[]) { this.headers.set(name.toLowerCase(), value); return this; }\n  writeHead(status: number, headers?: any) {\n    this.status = status;\n    this.headHeaders = headers;\n    return this;\n  }\n  end(chunk?: any) { this.body = chunk ?? null; return this; }\n  flush(): void {\n    if (this.target.writableEnded) return;\n    for (const [name, value] of this.headers) this.target.setHeader(name, value);\n    if (this.status !== undefined) this.target.writeHead(this.status, this.headHeaders);\n    if (this.body !== undefined) this.target.end(this.body);\n  }\n}\n\nfunction send(res: ResponseWriter, status: number, value: unknown, requestId: string): void {\n  if (res.writableEnded) return;\n  res.writeHead(status, {\n    ...jsonHeaders,\n    \"x-request-id\": requestId,\n  });\n  res.end(JSON.stringify(value));\n}\n\nfunction sendOperation(res: ResponseWriter, status: number, operation: string, value: unknown, requestId: string): void {\n  const canonical = parseResponse(operation, value) as Record<string, unknown>;\n  const protocolVersion = String(res.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n  if (protocolVersion !== LEGACY_PROTOCOL_VERSION) {\n    send(res, status, canonical, requestId);\n    return;\n  }\n  if (operation === \"claim_delivery\") {\n    send(res, status, canonical.delivery === null ? null : canonical, requestId);\n    return;\n  }\n  if ([\"cancel_delivery\", \"requeue_delivery\", \"extend_delivery\", \"acknowledge_delivery\", \"negative_acknowledge_delivery\"].includes(operation)) {\n    send(res, status, canonical.delivery, requestId);\n    return;\n  }\n  send(res, status, canonical, requestId);\n}\n\nfunction failure(\n  res: ResponseWriter,\n  status: number,\n  code: string,\n  requestId: string,\n  details: Record<string, unknown> = {},\n): void {\n  send(res, status, { error: { code, requestId, ...details } }, requestId);\n}\n\nasync function body(\n  req: IncomingMessage,\n  limit: number,\n  signal: AbortSignal,\n): Promise<Record<string, any>> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    const cleanup = () => {\n      req.off(\"data\", onData);\n      req.off(\"end\", onEnd);\n      req.off(\"error\", onError);\n      signal.removeEventListener(\"abort\", onAbort);\n    };\n    const finish = (callback: () => void) => {\n      cleanup();\n      callback();\n    };\n    const onData = (chunk: Buffer | string) => {\n      const buffer = Buffer.from(chunk);\n      size += buffer.length;\n      if (size > limit) {\n        finish(() => reject(Object.assign(new Error(\"body too large\"), {\n          status: 413,\n          code: \"body_too_large\",\n        })));\n        req.resume();\n        return;\n      }\n      chunks.push(buffer);\n    };\n    const onEnd = () => finish(() => {\n      if (!size) {\n        resolve({});\n        return;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n        if (!parsed || Array.isArray(parsed) || typeof parsed !== \"object\") throw new Error();\n        resolve(parsed);\n      } catch {\n        reject(Object.assign(new Error(\"invalid JSON\"), { status: 400, code: \"malformed_json\" }));\n      }\n    });\n    const onError = (error: Error) => finish(() => reject(error));\n    const onAbort = () => {\n      finish(() => reject(signal.reason));\n      req.resume();\n    };\n    req.on(\"data\", onData);\n    req.on(\"end\", onEnd);\n    req.on(\"error\", onError);\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    if (signal.aborted) onAbort();\n  });\n}\n\nasync function jsonBody(\n  req: IncomingMessage,\n  limit: number,\n  signal: AbortSignal,\n): Promise<Record<string, any>> {\n  if (hasRequestBody(req) && req.headers[\"content-type\"]?.split(\";\", 1)[0] !== \"application/json\") {\n    throw Object.assign(new Error(\"unsupported media type\"), {\n      status: 415,\n      code: \"unsupported_media_type\",\n    });\n  }\n  return body(req, limit, signal);\n}\n\nfunction numberParam(value: string | null, name: string): number | undefined {\n  if (value === null) return undefined;\n  const result = Number(value);\n  if (!Number.isSafeInteger(result)) throw new BridgeValidationError(`${name} is invalid`);\n  return result;\n}\n\nfunction booleanParam(value: string | null, name: string): boolean | undefined {\n  if (value === null) return undefined;\n  if (value === \"true\") return true;\n  if (value === \"false\") return false;\n  throw new BridgeValidationError(`${name} must be true or false`);\n}\n\nfunction hasRequestBody(req: IncomingMessage): boolean {\n  const length = req.headers[\"content-length\"];\n  return req.headers[\"transfer-encoding\"] !== undefined || (length !== undefined && length !== \"0\");\n}\n\nfunction pathBoundInput(\n  operation: string,\n  deliveryId: string,\n  rawInput: Record<string, unknown>,\n  protocolVersion?: string,\n): Record<string, unknown> {\n  if (Object.prototype.hasOwnProperty.call(rawInput, \"deliveryId\")) {\n    throw new ContractValidationError(operation, [{ path: \"/deliveryId\", message: \"deliveryId is supplied by the request path\" }]);\n  }\n  const value = { ...rawInput, deliveryId };\n  return protocolVersion\n    ? validateRequestForProtocol(operation, value, protocolVersion)\n    : validateRequest(operation, value);\n}\n\nfunction active(signal: AbortSignal): void {\n  if (signal.aborted) throw signal.reason;\n}\n\nfunction closedQuery(url: URL, operation: string, allowed: readonly string[]): void {\n  const unknown = [...url.searchParams.keys()].find((key) => !allowed.includes(key));\n  if (unknown) throw new ContractValidationError(operation, [{ path: `/${unknown}`, message: \"Unexpected query parameter\" }]);\n}\n\nfunction selectedProtocol(res: ResponseWriter): string {\n  return String(res.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n}\n\nfunction requireCurrentProtocol(res: ResponseWriter): void {\n  if (selectedProtocol(res) === LEGACY_PROTOCOL_VERSION) {\n    const error = new Error(\"Operation is not available in protocol 2.0\") as Error & { status: number; code: string };\n    error.status = 404;\n    error.code = \"not_found\";\n    throw error;\n  }\n}\n\nexport function createGateway(options: GatewayOptions) {\n  const metrics: Metrics = { requests: 0, errors: 0, timeouts: 0, authFailures: 0 };\n  const limit = options.bodyLimitBytes ?? 128 * 1024;\n  const deadline = options.requestDeadlineMs ?? 10_000;\n  const origins = new Set(options.allowedOrigins ?? []);\n\n  return createServer((req, res) => {\n    const requestId = randomUUID();\n    const abort = new AbortController();\n    let mutationStarted = false;\n    metrics.requests += 1;\n    const requestedProtocol = req.headers[PROTOCOL_HEADER];\n    const rawRequestedProtocol = Array.isArray(requestedProtocol) ? requestedProtocol[0] : requestedProtocol;\n    const initialProtocol = rawRequestedProtocol === undefined || rawRequestedProtocol.trim() === \"\"\n      ? LEGACY_PROTOCOL_VERSION\n      : (SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(rawRequestedProtocol.trim())\n        ? rawRequestedProtocol.trim()\n        : PROTOCOL_VERSION;\n    res.setHeader(PROTOCOL_HEADER, initialProtocol);\n    res.setHeader(SUPPORTED_PROTOCOL_HEADER, SUPPORTED_PROTOCOL_VERSIONS.join(\",\"));\n    const timer = setTimeout(() => {\n      abort.abort(new Error(\"request deadline exceeded\"));\n      metrics.timeouts += 1; metrics.errors += 1;\n      res.once(\"finish\", () => {\n        if (!req.complete) req.destroy();\n      });\n      failure(\n        res,\n        504,\n        mutationStarted ? \"mutation_outcome_unknown\" : \"request_timeout\",\n        requestId,\n      );\n    }, deadline);\n    let parsedBody: Promise<Record<string, any>> | undefined;\n    const requestBody = () => parsedBody ??= jsonBody(req, limit, abort.signal);\n\n    const dispatch = async (authority?: RequestAuthorityContext, response: ResponseWriter = res): Promise<void> => {\n      const url = new URL(req.url ?? \"/\", \"http://gateway.invalid\");\n      if (req.method === \"GET\" && url.pathname === \"/healthz\") {\n        send(response, 200, { status: \"alive\" }, requestId);\n        return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/readyz\") {\n        let ready = false;\n        try {\n          ready = await (options.ready?.() ?? options.store.initialize().then(() => true));\n        } catch {\n          ready = false;\n        }\n        send(response, ready ? 200 : 503, { status: ready ? \"ready\" : \"not_ready\" }, requestId);\n        return;\n      }\n      const origin = req.headers.origin;\n      if (origin && !origins.has(origin)) {\n        failure(response, 403, \"origin_forbidden\", requestId); return;\n      }\n      const token = bearerToken(req.headers.authorization);\n      if (options.requestAuthority && !authority) {\n        if (!token) {\n          metrics.authFailures += 1;\n          failure(response, 401, \"unauthorized\", requestId); return;\n        }\n        const preflight = await options.credentials.resolve(token, abort.signal);\n        active(abort.signal);\n        if (!preflight) {\n          metrics.authFailures += 1;\n          failure(response, 401, \"unauthorized\", requestId); return;\n        }\n        if (hasRequestBody(req)) await requestBody();\n        active(abort.signal);\n        const buffered = new BufferedResponse(res);\n        await options.requestAuthority!.run(\n          preflight.id,\n          hashCredential(token),\n          requestId,\n          abort.signal,\n          (context) => dispatch(context, buffered),\n        );\n        active(abort.signal);\n        buffered.flush();\n        return;\n      }\n      const credential = authority?.credential ?? (token ? await options.credentials.resolve(token, abort.signal) : null);\n      active(abort.signal);\n      if (!credential) {\n        metrics.authFailures += 1;\n        failure(response, 401, \"unauthorized\", requestId); return;\n      }\n      if (!Array.isArray(credential.scopes)) {\n        failure(response, 503, \"security_unavailable\", requestId); return;\n      }\n      const service = new BridgeService(authority?.store ?? options.store);\n      const security = authority?.security ?? options.security;\n      if (url.pathname.startsWith(\"/v2/\") || url.pathname === \"/metrics\") {\n        response.setHeader(PROTOCOL_HEADER, negotiateProtocolVersion(req.headers[PROTOCOL_HEADER]));\n      }\n      const authorize = async (operationId: OperationId): Promise<void> => {\n        const requiredScopes = operationContract(operationId).scopes;\n        if (requiredScopes.some((scope) => !credential.scopes.includes(scope))) {\n          try {\n            await security.recordScopeDenial(credential.id, operationId, requestId, abort.signal);\n          } catch {\n            throw Object.assign(new Error(\"Scope denial could not be audited\"), {\n              status: 503,\n              code: \"security_unavailable\",\n            });\n          }\n          throw Object.assign(new Error(\"Credential lacks a required scope\"), {\n            status: 403, code: \"insufficient_scope\", requiredScopes,\n          });\n        }\n        let decision;\n        try {\n          decision = await security.consume(credential.id, operationId, requestId, abort.signal);\n        } catch {\n          throw Object.assign(new Error(\"Rate limit state is unavailable\"), {\n            status: 503,\n            code: \"security_unavailable\",\n          });\n        }\n        if (!decision.allowed) {\n          const retryAfter = Math.max(1, Math.ceil(decision.retryAfterSeconds));\n          response.setHeader(\"retry-after\", String(retryAfter));\n          throw Object.assign(new Error(\"Credential rate limit exceeded\"), {\n            status: 429, code: \"rate_limited\", retryAfterSeconds: retryAfter,\n          });\n        }\n      };\n      if (req.method === \"GET\" && url.pathname === \"/metrics\") {\n        await authorize(\"gateway_metrics\");\n        validateRequest(\"gateway_metrics\", {});\n        const result = Object.entries(metrics).map(([key, value]) => `agent_bridge_gateway_${key}_total ${value}`).join(\"\\n\") + \"\\n\";\n        parseResponse(\"gateway_metrics\", result);\n        response.writeHead(200, {\n          ...jsonHeaders,\n          \"content-type\": \"text/plain; version=0.0.4\",\n          \"x-request-id\": requestId,\n        });\n        response.end(result);\n        return;\n      }\n      const instanceHeader = req.headers[\"x-agent-bridge-instance\"];\n      const principal = {\n        ...credential.principal,\n        instance: Array.isArray(instanceHeader) ? instanceHeader[0] : instanceHeader,\n      };\n\n      if (req.method === \"GET\" && url.pathname === \"/v2/capabilities\") {\n        requireCurrentProtocol(response);\n        await authorize(\"capabilities\");\n        closedQuery(url, \"capabilities\", []);\n        validateRequest(\"capabilities\", {});\n        let rowIsolation = false;\n        if (options.requestAuthority && options.rowIsolationReady) {\n          try {\n            rowIsolation = await options.rowIsolationReady();\n          } catch {\n            rowIsolation = false;\n          }\n        }\n        sendOperation(response, 200, \"capabilities\", {\n          ...capabilityDocument({\n            surface: \"http\",\n            provider: \"gateway\",\n            selectedProtocolVersion: String(response.getHeader(PROTOCOL_HEADER)),\n            requestAuthority: Boolean(options.requestAuthority),\n            rowIsolation,\n          }),\n          grantedScopes: [...credential.scopes],\n        }, requestId); return;\n      }\n\n      if (req.method === \"GET\" && url.pathname === \"/v2/status\") {\n        await authorize(\"status\");\n        closedQuery(url, \"status\", []);\n        validateRequest(\"status\", {});\n        const activeStore = authority?.store ?? options.store;\n        const authorityBinding = authority && response.getHeader(PROTOCOL_HEADER) === PROTOCOL_VERSION ? {\n          gatewayAuthorityId: authority.gatewayAuthorityId,\n          credentialId: authority.credential.id,\n        } : {};\n        if (!activeStore.diagnostics) {\n          sendOperation(response, 200, \"status\", { schemaVersion: \"postgres-v2\", deliverySupported: false, pending: null, claimed: null, retrying: null, dead: null, ...authorityBinding, principal: credential.principal }, requestId);\n        } else {\n          sendOperation(response, 200, \"status\", { ...await activeStore.diagnostics(principal), ...authorityBinding, principal: credential.principal }, requestId);\n        }\n        return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/endpoint-migration-challenges\") {\n        requireCurrentProtocol(response);\n        await authorize(\"issue_endpoint_migration_challenge\");\n        const input = validateRequestForProtocol(\"issue_endpoint_migration_challenge\", await requestBody(), selectedProtocol(response));\n        if (!authority?.endpointMigrationChallenges) throw Object.assign(new Error(\"endpoint migration challenges require request authority\"), { status: 503, code: \"security_unavailable\" });\n        active(abort.signal);\n        await authority.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"issue_endpoint_migration_challenge\", await authority.endpointMigrationChallenges.issue({\n          challenge: String(input.challenge),\n          expectedGatewayAuthorityId: String(input.expectedGatewayAuthorityId),\n          verifierCredentialId: String(input.verifierCredentialId),\n        }), requestId); return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/endpoint-migration-challenges/consume\") {\n        requireCurrentProtocol(response);\n        await authorize(\"consume_endpoint_migration_challenge\");\n        const input = validateRequestForProtocol(\"consume_endpoint_migration_challenge\", await requestBody(), selectedProtocol(response));\n        if (!authority?.endpointMigrationChallenges) throw Object.assign(new Error(\"endpoint migration challenges require request authority\"), { status: 503, code: \"security_unavailable\" });\n        active(abort.signal);\n        await authority.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"consume_endpoint_migration_challenge\", await authority.endpointMigrationChallenges.consume({\n          challenge: String(input.challenge),\n          expectedGatewayAuthorityId: String(input.expectedGatewayAuthorityId),\n          issuerCredentialId: String(input.issuerCredentialId),\n        }), requestId); return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/messages\") {\n        await authorize(\"publish_message\");\n        const input = validateRequestForProtocol(\"publish_message\", await requestBody(), String(response.getHeader(PROTOCOL_HEADER)));\n        if (input.source !== undefined && input.source !== principal.agent) {\n          throw new BridgePrincipalMismatchError(\"source must match the authenticated principal\");\n        }\n        const { source: _source, ...draft } = input;\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 201, \"publish_message\", await service.publish(principal, draft as unknown as MessageDraft), requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/history\") {\n        await authorize(\"history\");\n        closedQuery(url, \"history\", [\"cursor\", \"mailbox\", \"receiptState\", \"limit\", \"type\", \"includeExpired\", \"source\", \"project\", \"since\", \"unacknowledgedBy\", \"unacked_by\", \"threadId\", \"latest\"]);\n        const types = url.searchParams.getAll(\"type\");\n        const input = validateRequestForProtocol(\"history\", {\n          cursor: url.searchParams.get(\"cursor\") ?? undefined,\n          mailbox: url.searchParams.get(\"mailbox\") ?? undefined as any,\n          receiptState: url.searchParams.get(\"receiptState\") ?? undefined as any,\n          limit: numberParam(url.searchParams.get(\"limit\"), \"limit\"),\n          types: types.length ? types : undefined,\n          includeExpired: booleanParam(url.searchParams.get(\"includeExpired\"), \"includeExpired\"),\n          source: url.searchParams.get(\"source\") ?? undefined,\n          project: url.searchParams.get(\"project\") ?? undefined,\n          since: url.searchParams.get(\"since\") ?? undefined,\n          unacknowledgedBy: url.searchParams.get(\"unacknowledgedBy\") ?? url.searchParams.get(\"unacked_by\") ?? undefined,\n          threadId: url.searchParams.get(\"threadId\") ?? undefined,\n          latest: booleanParam(url.searchParams.get(\"latest\"), \"latest\"),\n        }, String(response.getHeader(PROTOCOL_HEADER)));\n        sendOperation(response, 200, \"history\", await service.history(principal, input), requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/receipts\") {\n        await authorize(\"record_receipt\");\n        const input = validateRequest(\"record_receipt\", await requestBody());\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"record_receipt\", { recorded: await service.acknowledge(principal, input.messageIds as string[]) }, requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/deliveries/claim\") {\n        await authorize(\"claim_delivery\");\n        const input = validateRequestForProtocol(\"claim_delivery\", await requestBody(), selectedProtocol(response));\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"claim_delivery\", await service.claim(principal, input) ?? { delivery: null }, requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/deliveries\") {\n        requireCurrentProtocol(response);\n        await authorize(\"list_deliveries\");\n        closedQuery(url, \"list_deliveries\", [\"cursor\", \"limit\", \"role\", \"messageId\", \"recipient\", \"state\"]);\n        const input = validateRequest(\"list_deliveries\", {cursor:url.searchParams.get(\"cursor\")??undefined,limit:numberParam(url.searchParams.get(\"limit\"),\"limit\"),role:url.searchParams.get(\"role\")??undefined,messageId:url.searchParams.get(\"messageId\")??undefined,recipient:url.searchParams.get(\"recipient\")??undefined,states:url.searchParams.getAll(\"state\")});\n        sendOperation(response,200,\"list_deliveries\",await service.deliveries(principal,input as any),requestId);return;\n      }\n      const eventsMatch=url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/events$/);\n      if(req.method===\"GET\"&&eventsMatch){requireCurrentProtocol(response);await authorize(\"list_delivery_events\");closedQuery(url,\"list_delivery_events\",[\"cursor\",\"limit\"]);const input=validateRequest(\"list_delivery_events\",{deliveryId:eventsMatch[1],cursor:url.searchParams.get(\"cursor\")??undefined,limit:numberParam(url.searchParams.get(\"limit\"),\"limit\")});sendOperation(response,200,\"list_delivery_events\",await service.deliveryEvents(principal,eventsMatch[1]!,input as any),requestId);return;}\n      const controlMatch=url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/(cancel|requeue)$/);\n      if(req.method===\"POST\"&&controlMatch){requireCurrentProtocol(response);const operation=controlMatch[2]===\"cancel\"?\"cancel_delivery\":\"requeue_delivery\";await authorize(operation);pathBoundInput(operation,controlMatch[1]!,await requestBody());await authority?.beginDomainWork();mutationStarted=true;const result=controlMatch[2]===\"cancel\"?await service.cancel(principal,controlMatch[1]!):await service.requeue(principal,controlMatch[1]!);if(!result)failure(response,404,\"not_found\",requestId);else sendOperation(response,200,operation,{delivery:result},requestId);return;}\n      if (req.method === \"POST\" && url.pathname === \"/v2/presence/heartbeat\") {\n        await authorize(\"heartbeat\");\n        const input = validateRequest(\"heartbeat\", await requestBody());\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"heartbeat\", await service.heartbeat(principal, input), requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/presence\") {\n        await authorize(\"presence\");\n        closedQuery(url, \"presence\", []);\n        validateRequest(\"presence\", {});\n        sendOperation(response, 200, \"presence\", { agents: await service.presence(principal) }, requestId); return;\n      }\n      const match = url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/(extend|ack|nack)$/);\n      if (req.method === \"POST\" && match) {\n        const operationId = match[2] === \"extend\" ? \"extend_delivery\" : match[2] === \"ack\" ? \"acknowledge_delivery\" : \"negative_acknowledge_delivery\";\n        await authorize(operationId);\n        const rawInput = await requestBody();\n        const protocolVersion = String(response.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n        const input = pathBoundInput(operationId, match[1]!, rawInput, protocolVersion);\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        const [, id, action] = match;\n        const result = action === \"extend\"\n          ? await service.extend(principal, id, input.leaseToken as string, input.leaseMs as number)\n          : action === \"ack\"\n            ? await service.ack(principal, id, input.leaseToken as string)\n            : await service.nack(\n                principal,\n                id,\n                input.leaseToken as string,\n                (input.error as string | undefined) ?? \"negative acknowledgment\",\n                (input.disposition ?? input.dead ?? \"retry\") as \"retry\" | \"dead\" | boolean,\n                input.retryPolicy,\n              );\n        if (!result) failure(response, 409, \"lease_conflict\", requestId);\n        else sendOperation(response, 200, operationId, { delivery: result }, requestId);\n        return;\n      }\n      failure(response, 404, \"not_found\", requestId);\n    };\n    void dispatch().catch((error: any) => {\n      if (res.writableEnded) return;\n      metrics.errors += 1;\n      if (error instanceof ContractValidationError || error instanceof ContractResponseError) {\n        failure(res, error.status, error.code, requestId, { operation: error.operation, issues: error.issues });\n      } else if (error?.status === 426) {\n        failure(res, 426, error.code, requestId, { supportedProtocolVersions: [...SUPPORTED_PROTOCOL_VERSIONS] });\n      } else if (error?.code === \"insufficient_scope\") {\n        failure(res, 403, error.code, requestId, { details: { requiredScopes: [...error.requiredScopes] } });\n      } else if (error?.code === \"rate_limited\") {\n        res.setHeader(\"retry-after\", String(error.retryAfterSeconds));\n        failure(res, 429, error.code, requestId, { details: { retryAfterSeconds: error.retryAfterSeconds } });\n      } else if (error instanceof BridgeValidationError || error instanceof BridgePrincipalMismatchError) {\n        failure(res, \"status\" in error ? error.status : 400, error.code, requestId, { message: error.message });\n      } else {\n        failure(res, error?.status ?? 500, error?.code ?? \"internal_error\", requestId);\n      }\n    }).finally(() => clearTimeout(timer));\n  });\n}\n","import { createHash, timingSafeEqual } from \"node:crypto\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport type { PgQueryable } from \"./postgres-bridge-store.js\";\n\nexport interface AuthenticatedCredential {\n  id: string;\n  principal: BridgePrincipal;\n  /** Canonical authorization scopes granted to this credential. */\n  scopes: readonly AuthorizationScope[];\n}\n\nexport interface CredentialResolver {\n  resolve(token: string, signal?: AbortSignal): Promise<AuthenticatedCredential | null>;\n}\n\nexport function hashCredential(token: string): string {\n  return createHash(\"sha256\").update(token, \"utf8\").digest(\"hex\");\n}\n\nexport class PostgresCredentialResolver implements CredentialResolver {\n  constructor(private readonly db: PgQueryable) {}\n\n  async resolve(token: string, signal?: AbortSignal): Promise<AuthenticatedCredential | null> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      credential_id: string; workspace_id: string; principal: string; scopes: AuthorizationScope[];\n    }>(\n      `SELECT credential_id,workspace_id,principal,scopes\n       FROM agent_bridge.resolve_credential_hash($1::text)`,\n      [hashCredential(token)],\n    );\n    const row = result.rows[0];\n    if (signal?.aborted) throw signal.reason;\n    return row ? {\n      id: row.credential_id,\n      principal: { workspace: row.workspace_id, agent: row.principal },\n      scopes: row.scopes,\n    } : null;\n  }\n}\n\nexport function bearerToken(value: string | undefined): string | null {\n  if (!value?.startsWith(\"Bearer \")) return null;\n  const token = value.slice(7);\n  if (!token || token.length > 4096 || /\\s/.test(token)) return null;\n  return token;\n}\n\nexport function safeTokenHashEqual(token: string, expectedHash: string): boolean {\n  const actual = Buffer.from(hashCredential(token));\n  const expected = Buffer.from(expectedHash);\n  return actual.length === expected.length && timingSafeEqual(actual, expected);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAA+D;;;ACDxE,SAAS,YAAY,uBAAuB;AAgBrC,SAAS,eAAe,OAAuB;AACpD,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,KAAK;AAChE;AAEO,IAAM,6BAAN,MAA+D;AAAA,EACpE,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAE/C,MAAM,QAAQ,OAAe,QAA+D;AAC1F,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAG3B;AAAA;AAAA,MAEA,CAAC,eAAe,KAAK,CAAC;AAAA,IACxB;AACA,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,WAAO,MAAM;AAAA,MACX,IAAI,IAAI;AAAA,MACR,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU;AAAA,MAC/D,QAAQ,IAAI;AAAA,IACd,IAAI;AAAA,EACN;AACF;AAEO,SAAS,YAAY,OAA0C;AACpE,MAAI,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AAC1C,QAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,MAAI,CAAC,SAAS,MAAM,SAAS,QAAQ,KAAK,KAAK,KAAK,EAAG,QAAO;AAC9D,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAe,cAA+B;AAC/E,QAAM,SAAS,OAAO,KAAK,eAAe,KAAK,CAAC;AAChD,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,SAAO,OAAO,WAAW,SAAS,UAAU,gBAAgB,QAAQ,QAAQ;AAC9E;;;ADbA,IAAM,cAAc,EAAE,gBAAgB,mCAAmC,iBAAiB,WAAW;AAUrG,IAAM,mBAAN,MAAiD;AAAA,EAM/C,YAA6B,QAAwB;AAAxB;AAL7B,SAAiB,UAAU,oBAAI,IAAiD;AAAA,EAK1B;AAAA,EACtD,IAAI,gBAAyB;AAAE,WAAO,KAAK,SAAS;AAAA,EAAW;AAAA,EAC/D,UAAU,MAAc;AAAE,WAAO,KAAK,QAAQ,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,OAAO,UAAU,IAAI;AAAA,EAAG;AAAA,EACtG,UAAU,MAAc,OAA4C;AAAE,SAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,KAAK;AAAG,WAAO;AAAA,EAAM;AAAA,EAChI,UAAU,QAAgB,SAAe;AACvC,SAAK,SAAS;AACd,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA,EACA,IAAI,OAAa;AAAE,SAAK,OAAO,SAAS;AAAM,WAAO;AAAA,EAAM;AAAA,EAC3D,QAAc;AACZ,QAAI,KAAK,OAAO,cAAe;AAC/B,eAAW,CAAC,MAAM,KAAK,KAAK,KAAK,QAAS,MAAK,OAAO,UAAU,MAAM,KAAK;AAC3E,QAAI,KAAK,WAAW,OAAW,MAAK,OAAO,UAAU,KAAK,QAAQ,KAAK,WAAW;AAClF,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACF;AAEA,SAAS,KAAK,KAAqB,QAAgB,OAAgB,WAAyB;AAC1F,MAAI,IAAI,cAAe;AACvB,MAAI,UAAU,QAAQ;AAAA,IACpB,GAAG;AAAA,IACH,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,IAAI,KAAK,UAAU,KAAK,CAAC;AAC/B;AAEA,SAAS,cAAc,KAAqB,QAAgB,WAAmB,OAAgB,WAAyB;AACtH,QAAM,YAAY,cAAc,WAAW,KAAK;AAChD,QAAM,kBAAkB,OAAO,IAAI,UAAU,eAAe,KAAK,gBAAgB;AACjF,MAAI,oBAAoB,yBAAyB;AAC/C,SAAK,KAAK,QAAQ,WAAW,SAAS;AACtC;AAAA,EACF;AACA,MAAI,cAAc,kBAAkB;AAClC,SAAK,KAAK,QAAQ,UAAU,aAAa,OAAO,OAAO,WAAW,SAAS;AAC3E;AAAA,EACF;AACA,MAAI,CAAC,mBAAmB,oBAAoB,mBAAmB,wBAAwB,+BAA+B,EAAE,SAAS,SAAS,GAAG;AAC3I,SAAK,KAAK,QAAQ,UAAU,UAAU,SAAS;AAC/C;AAAA,EACF;AACA,OAAK,KAAK,QAAQ,WAAW,SAAS;AACxC;AAEA,SAAS,QACP,KACA,QACA,MACA,WACA,UAAmC,CAAC,GAC9B;AACN,OAAK,KAAK,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,GAAG,QAAQ,EAAE,GAAG,SAAS;AACzE;AAEA,eAAe,KACb,KACA,OACA,QAC8B;AAC9B,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,OAAO;AACX,UAAM,UAAU,MAAM;AACpB,UAAI,IAAI,QAAQ,MAAM;AACtB,UAAI,IAAI,OAAO,KAAK;AACpB,UAAI,IAAI,SAAS,OAAO;AACxB,aAAO,oBAAoB,SAAS,OAAO;AAAA,IAC7C;AACA,UAAM,SAAS,CAAC,aAAyB;AACvC,cAAQ;AACR,eAAS;AAAA,IACX;AACA,UAAM,SAAS,CAAC,UAA2B;AACzC,YAAM,SAAS,OAAO,KAAK,KAAK;AAChC,cAAQ,OAAO;AACf,UAAI,OAAO,OAAO;AAChB,eAAO,MAAM,OAAO,OAAO,OAAO,IAAI,MAAM,gBAAgB,GAAG;AAAA,UAC7D,QAAQ;AAAA,UACR,MAAM;AAAA,QACR,CAAC,CAAC,CAAC;AACH,YAAI,OAAO;AACX;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,QAAQ,MAAM,OAAO,MAAM;AAC/B,UAAI,CAAC,MAAM;AACT,gBAAQ,CAAC,CAAC;AACV;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAChE,YAAI,CAAC,UAAU,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM;AACpF,gBAAQ,MAAM;AAAA,MAChB,QAAQ;AACN,eAAO,OAAO,OAAO,IAAI,MAAM,cAAc,GAAG,EAAE,QAAQ,KAAK,MAAM,iBAAiB,CAAC,CAAC;AAAA,MAC1F;AAAA,IACF,CAAC;AACD,UAAM,UAAU,CAAC,UAAiB,OAAO,MAAM,OAAO,KAAK,CAAC;AAC5D,UAAM,UAAU,MAAM;AACpB,aAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAClC,UAAI,OAAO;AAAA,IACb;AACA,QAAI,GAAG,QAAQ,MAAM;AACrB,QAAI,GAAG,OAAO,KAAK;AACnB,QAAI,GAAG,SAAS,OAAO;AACvB,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,QAAI,OAAO,QAAS,SAAQ;AAAA,EAC9B,CAAC;AACH;AAEA,eAAe,SACb,KACA,OACA,QAC8B;AAC9B,MAAI,eAAe,GAAG,KAAK,IAAI,QAAQ,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,oBAAoB;AAC/F,UAAM,OAAO,OAAO,IAAI,MAAM,wBAAwB,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,KAAK,KAAK,OAAO,MAAM;AAChC;AAEA,SAAS,YAAY,OAAsB,MAAkC;AAC3E,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,EAAG,OAAM,IAAI,sBAAsB,GAAG,IAAI,aAAa;AACvF,SAAO;AACT;AAEA,SAAS,aAAa,OAAsB,MAAmC;AAC7E,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAC9B,QAAM,IAAI,sBAAsB,GAAG,IAAI,wBAAwB;AACjE;AAEA,SAAS,eAAe,KAA+B;AACrD,QAAM,SAAS,IAAI,QAAQ,gBAAgB;AAC3C,SAAO,IAAI,QAAQ,mBAAmB,MAAM,UAAc,WAAW,UAAa,WAAW;AAC/F;AAEA,SAAS,eACP,WACA,YACA,UACA,iBACyB;AACzB,MAAI,OAAO,UAAU,eAAe,KAAK,UAAU,YAAY,GAAG;AAChE,UAAM,IAAI,wBAAwB,WAAW,CAAC,EAAE,MAAM,eAAe,SAAS,6CAA6C,CAAC,CAAC;AAAA,EAC/H;AACA,QAAM,QAAQ,EAAE,GAAG,UAAU,WAAW;AACxC,SAAO,kBACH,2BAA2B,WAAW,OAAO,eAAe,IAC5D,gBAAgB,WAAW,KAAK;AACtC;AAEA,SAAS,OAAO,QAA2B;AACzC,MAAI,OAAO,QAAS,OAAM,OAAO;AACnC;AAEA,SAAS,YAAY,KAAU,WAAmB,SAAkC;AAClF,QAAM,UAAU,CAAC,GAAG,IAAI,aAAa,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;AACjF,MAAI,QAAS,OAAM,IAAI,wBAAwB,WAAW,CAAC,EAAE,MAAM,IAAI,OAAO,IAAI,SAAS,6BAA6B,CAAC,CAAC;AAC5H;AAEA,SAAS,iBAAiB,KAA6B;AACrD,SAAO,OAAO,IAAI,UAAU,eAAe,KAAK,gBAAgB;AAClE;AAEA,SAAS,uBAAuB,KAA2B;AACzD,MAAI,iBAAiB,GAAG,MAAM,yBAAyB;AACrD,UAAM,QAAQ,IAAI,MAAM,4CAA4C;AACpE,UAAM,SAAS;AACf,UAAM,OAAO;AACb,UAAM;AAAA,EACR;AACF;AAEO,SAAS,cAAc,SAAyB;AACrD,QAAM,UAAmB,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,EAAE;AAChF,QAAM,QAAQ,QAAQ,kBAAkB,MAAM;AAC9C,QAAM,WAAW,QAAQ,qBAAqB;AAC9C,QAAM,UAAU,IAAI,IAAI,QAAQ,kBAAkB,CAAC,CAAC;AAEpD,SAAO,aAAa,CAAC,KAAK,QAAQ;AAChC,UAAM,YAAY,WAAW;AAC7B,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI,kBAAkB;AACtB,YAAQ,YAAY;AACpB,UAAM,oBAAoB,IAAI,QAAQ,eAAe;AACrD,UAAM,uBAAuB,MAAM,QAAQ,iBAAiB,IAAI,kBAAkB,CAAC,IAAI;AACvF,UAAM,kBAAkB,yBAAyB,UAAa,qBAAqB,KAAK,MAAM,KAC1F,0BACC,4BAAkD,SAAS,qBAAqB,KAAK,CAAC,IACrF,qBAAqB,KAAK,IAC1B;AACN,QAAI,UAAU,iBAAiB,eAAe;AAC9C,QAAI,UAAU,2BAA2B,4BAA4B,KAAK,GAAG,CAAC;AAC9E,UAAM,QAAQ,WAAW,MAAM;AAC7B,YAAM,MAAM,IAAI,MAAM,2BAA2B,CAAC;AAClD,cAAQ,YAAY;AAAG,cAAQ,UAAU;AACzC,UAAI,KAAK,UAAU,MAAM;AACvB,YAAI,CAAC,IAAI,SAAU,KAAI,QAAQ;AAAA,MACjC,CAAC;AACD;AAAA,QACE;AAAA,QACA;AAAA,QACA,kBAAkB,6BAA6B;AAAA,QAC/C;AAAA,MACF;AAAA,IACF,GAAG,QAAQ;AACX,QAAI;AACJ,UAAM,cAAc,MAAM,4BAAe,SAAS,KAAK,OAAO,MAAM,MAAM;AAE1E,UAAM,WAAW,OAAO,WAAqC,WAA2B,QAAuB;AAC7G,YAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,wBAAwB;AAC5D,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,YAAY;AACvD,aAAK,UAAU,KAAK,EAAE,QAAQ,QAAQ,GAAG,SAAS;AAClD;AAAA,MACF;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,WAAW;AACtD,YAAI,QAAQ;AACZ,YAAI;AACF,kBAAQ,OAAO,QAAQ,QAAQ,KAAK,QAAQ,MAAM,WAAW,EAAE,KAAK,MAAM,IAAI;AAAA,QAChF,QAAQ;AACN,kBAAQ;AAAA,QACV;AACA,aAAK,UAAU,QAAQ,MAAM,KAAK,EAAE,QAAQ,QAAQ,UAAU,YAAY,GAAG,SAAS;AACtF;AAAA,MACF;AACA,YAAM,SAAS,IAAI,QAAQ;AAC3B,UAAI,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG;AAClC,gBAAQ,UAAU,KAAK,oBAAoB,SAAS;AAAG;AAAA,MACzD;AACA,YAAM,QAAQ,YAAY,IAAI,QAAQ,aAAa;AACnD,UAAI,QAAQ,oBAAoB,CAAC,WAAW;AAC1C,YAAI,CAAC,OAAO;AACV,kBAAQ,gBAAgB;AACxB,kBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,QACrD;AACA,cAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,OAAO,MAAM,MAAM;AACvE,eAAO,MAAM,MAAM;AACnB,YAAI,CAAC,WAAW;AACd,kBAAQ,gBAAgB;AACxB,kBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,QACrD;AACA,YAAI,eAAe,GAAG,EAAG,OAAM,YAAY;AAC3C,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,IAAI,iBAAiB,GAAG;AACzC,cAAM,QAAQ,iBAAkB;AAAA,UAC9B,UAAU;AAAA,UACV,eAAe,KAAK;AAAA,UACpB;AAAA,UACA,MAAM;AAAA,UACN,CAAC,YAAY,SAAS,SAAS,QAAQ;AAAA,QACzC;AACA,eAAO,MAAM,MAAM;AACnB,iBAAS,MAAM;AACf;AAAA,MACF;AACA,YAAM,aAAa,WAAW,eAAe,QAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO,MAAM,MAAM,IAAI;AAC9G,aAAO,MAAM,MAAM;AACnB,UAAI,CAAC,YAAY;AACf,gBAAQ,gBAAgB;AACxB,gBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,MACrD;AACA,UAAI,CAAC,MAAM,QAAQ,WAAW,MAAM,GAAG;AACrC,gBAAQ,UAAU,KAAK,wBAAwB,SAAS;AAAG;AAAA,MAC7D;AACA,YAAM,UAAU,IAAI,cAAc,WAAW,SAAS,QAAQ,KAAK;AACnE,YAAM,WAAW,WAAW,YAAY,QAAQ;AAChD,UAAI,IAAI,SAAS,WAAW,MAAM,KAAK,IAAI,aAAa,YAAY;AAClE,iBAAS,UAAU,iBAAiB,yBAAyB,IAAI,QAAQ,eAAe,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,YAAY,OAAO,gBAA4C;AACnE,cAAM,iBAAiB,kBAAkB,WAAW,EAAE;AACtD,YAAI,eAAe,KAAK,CAAC,UAAU,CAAC,WAAW,OAAO,SAAS,KAAK,CAAC,GAAG;AACtE,cAAI;AACF,kBAAM,SAAS,kBAAkB,WAAW,IAAI,aAAa,WAAW,MAAM,MAAM;AAAA,UACtF,QAAQ;AACN,kBAAM,OAAO,OAAO,IAAI,MAAM,mCAAmC,GAAG;AAAA,cAClE,QAAQ;AAAA,cACR,MAAM;AAAA,YACR,CAAC;AAAA,UACH;AACA,gBAAM,OAAO,OAAO,IAAI,MAAM,mCAAmC,GAAG;AAAA,YAClE,QAAQ;AAAA,YAAK,MAAM;AAAA,YAAsB;AAAA,UAC3C,CAAC;AAAA,QACH;AACA,YAAI;AACJ,YAAI;AACF,qBAAW,MAAM,SAAS,QAAQ,WAAW,IAAI,aAAa,WAAW,MAAM,MAAM;AAAA,QACvF,QAAQ;AACN,gBAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,GAAG;AAAA,YAChE,QAAQ;AAAA,YACR,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AACA,YAAI,CAAC,SAAS,SAAS;AACrB,gBAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,iBAAiB,CAAC;AACpE,mBAAS,UAAU,eAAe,OAAO,UAAU,CAAC;AACpD,gBAAM,OAAO,OAAO,IAAI,MAAM,gCAAgC,GAAG;AAAA,YAC/D,QAAQ;AAAA,YAAK,MAAM;AAAA,YAAgB,mBAAmB;AAAA,UACxD,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,YAAY;AACvD,cAAM,UAAU,iBAAiB;AACjC,wBAAgB,mBAAmB,CAAC,CAAC;AACrC,cAAM,SAAS,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,wBAAwB,GAAG,UAAU,KAAK,EAAE,EAAE,KAAK,IAAI,IAAI;AACxH,sBAAc,mBAAmB,MAAM;AACvC,iBAAS,UAAU,KAAK;AAAA,UACtB,GAAG;AAAA,UACH,gBAAgB;AAAA,UAChB,gBAAgB;AAAA,QAClB,CAAC;AACD,iBAAS,IAAI,MAAM;AACnB;AAAA,MACF;AACA,YAAM,iBAAiB,IAAI,QAAQ,yBAAyB;AAC5D,YAAM,YAAY;AAAA,QAChB,GAAG,WAAW;AAAA,QACd,UAAU,MAAM,QAAQ,cAAc,IAAI,eAAe,CAAC,IAAI;AAAA,MAChE;AAEA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,oBAAoB;AAC/D,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,cAAc;AAC9B,oBAAY,KAAK,gBAAgB,CAAC,CAAC;AACnC,wBAAgB,gBAAgB,CAAC,CAAC;AAClC,YAAI,eAAe;AACnB,YAAI,QAAQ,oBAAoB,QAAQ,mBAAmB;AACzD,cAAI;AACF,2BAAe,MAAM,QAAQ,kBAAkB;AAAA,UACjD,QAAQ;AACN,2BAAe;AAAA,UACjB;AAAA,QACF;AACA,sBAAc,UAAU,KAAK,gBAAgB;AAAA,UAC3C,GAAG,mBAAmB;AAAA,YACpB,SAAS;AAAA,YACT,UAAU;AAAA,YACV,yBAAyB,OAAO,SAAS,UAAU,eAAe,CAAC;AAAA,YACnE,kBAAkB,QAAQ,QAAQ,gBAAgB;AAAA,YAClD;AAAA,UACF,CAAC;AAAA,UACD,eAAe,CAAC,GAAG,WAAW,MAAM;AAAA,QACtC,GAAG,SAAS;AAAG;AAAA,MACjB;AAEA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,cAAc;AACzD,cAAM,UAAU,QAAQ;AACxB,oBAAY,KAAK,UAAU,CAAC,CAAC;AAC7B,wBAAgB,UAAU,CAAC,CAAC;AAC5B,cAAM,cAAc,WAAW,SAAS,QAAQ;AAChD,cAAM,mBAAmB,aAAa,SAAS,UAAU,eAAe,MAAM,mBAAmB;AAAA,UAC/F,oBAAoB,UAAU;AAAA,UAC9B,cAAc,UAAU,WAAW;AAAA,QACrC,IAAI,CAAC;AACL,YAAI,CAAC,YAAY,aAAa;AAC5B,wBAAc,UAAU,KAAK,UAAU,EAAE,eAAe,eAAe,mBAAmB,OAAO,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM,MAAM,MAAM,GAAG,kBAAkB,WAAW,WAAW,UAAU,GAAG,SAAS;AAAA,QAC9N,OAAO;AACL,wBAAc,UAAU,KAAK,UAAU,EAAE,GAAG,MAAM,YAAY,YAAY,SAAS,GAAG,GAAG,kBAAkB,WAAW,WAAW,UAAU,GAAG,SAAS;AAAA,QACzJ;AACA;AAAA,MACF;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,qCAAqC;AACjF,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,oCAAoC;AACpD,cAAM,QAAQ,2BAA2B,sCAAsC,MAAM,YAAY,GAAG,iBAAiB,QAAQ,CAAC;AAC9H,YAAI,CAAC,WAAW,4BAA6B,OAAM,OAAO,OAAO,IAAI,MAAM,yDAAyD,GAAG,EAAE,QAAQ,KAAK,MAAM,uBAAuB,CAAC;AACpL,eAAO,MAAM,MAAM;AACnB,cAAM,UAAU,gBAAgB;AAAG,0BAAkB;AACrD,sBAAc,UAAU,KAAK,sCAAsC,MAAM,UAAU,4BAA4B,MAAM;AAAA,UACnH,WAAW,OAAO,MAAM,SAAS;AAAA,UACjC,4BAA4B,OAAO,MAAM,0BAA0B;AAAA,UACnE,sBAAsB,OAAO,MAAM,oBAAoB;AAAA,QACzD,CAAC,GAAG,SAAS;AAAG;AAAA,MAClB;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,6CAA6C;AACzF,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,sCAAsC;AACtD,cAAM,QAAQ,2BAA2B,wCAAwC,MAAM,YAAY,GAAG,iBAAiB,QAAQ,CAAC;AAChI,YAAI,CAAC,WAAW,4BAA6B,OAAM,OAAO,OAAO,IAAI,MAAM,yDAAyD,GAAG,EAAE,QAAQ,KAAK,MAAM,uBAAuB,CAAC;AACpL,eAAO,MAAM,MAAM;AACnB,cAAM,UAAU,gBAAgB;AAAG,0BAAkB;AACrD,sBAAc,UAAU,KAAK,wCAAwC,MAAM,UAAU,4BAA4B,QAAQ;AAAA,UACvH,WAAW,OAAO,MAAM,SAAS;AAAA,UACjC,4BAA4B,OAAO,MAAM,0BAA0B;AAAA,UACnE,oBAAoB,OAAO,MAAM,kBAAkB;AAAA,QACrD,CAAC,GAAG,SAAS;AAAG;AAAA,MAClB;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;AAC5D,cAAM,UAAU,iBAAiB;AACjC,cAAM,QAAQ,2BAA2B,mBAAmB,MAAM,YAAY,GAAG,OAAO,SAAS,UAAU,eAAe,CAAC,CAAC;AAC5H,YAAI,MAAM,WAAW,UAAa,MAAM,WAAW,UAAU,OAAO;AAClE,gBAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACxF;AACA,cAAM,EAAE,QAAQ,SAAS,GAAG,MAAM,IAAI;AACtC,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,mBAAmB,MAAM,QAAQ,QAAQ,WAAW,KAAgC,GAAG,SAAS;AAAG;AAAA,MAClI;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,eAAe;AAC1D,cAAM,UAAU,SAAS;AACzB,oBAAY,KAAK,WAAW,CAAC,UAAU,WAAW,gBAAgB,SAAS,QAAQ,kBAAkB,UAAU,WAAW,SAAS,oBAAoB,cAAc,YAAY,QAAQ,CAAC;AAC1L,cAAM,QAAQ,IAAI,aAAa,OAAO,MAAM;AAC5C,cAAM,QAAQ,2BAA2B,WAAW;AAAA,UAClD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,UAC1C,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,UAC5C,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,UACtD,OAAO,YAAY,IAAI,aAAa,IAAI,OAAO,GAAG,OAAO;AAAA,UACzD,OAAO,MAAM,SAAS,QAAQ;AAAA,UAC9B,gBAAgB,aAAa,IAAI,aAAa,IAAI,gBAAgB,GAAG,gBAAgB;AAAA,UACrF,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,UAC1C,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,UAC5C,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,UACxC,kBAAkB,IAAI,aAAa,IAAI,kBAAkB,KAAK,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,UACpG,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,UAC9C,QAAQ,aAAa,IAAI,aAAa,IAAI,QAAQ,GAAG,QAAQ;AAAA,QAC/D,GAAG,OAAO,SAAS,UAAU,eAAe,CAAC,CAAC;AAC9C,sBAAc,UAAU,KAAK,WAAW,MAAM,QAAQ,QAAQ,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MAC/F;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;AAC5D,cAAM,UAAU,gBAAgB;AAChC,cAAM,QAAQ,gBAAgB,kBAAkB,MAAM,YAAY,CAAC;AACnE,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,kBAAkB,EAAE,UAAU,MAAM,QAAQ,YAAY,WAAW,MAAM,UAAsB,EAAE,GAAG,SAAS;AAAG;AAAA,MAC/I;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,wBAAwB;AACpE,cAAM,UAAU,gBAAgB;AAChC,cAAM,QAAQ,2BAA2B,kBAAkB,MAAM,YAAY,GAAG,iBAAiB,QAAQ,CAAC;AAC1G,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,kBAAkB,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,EAAE,UAAU,KAAK,GAAG,SAAS;AAAG;AAAA,MAC1H;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,kBAAkB;AAC7D,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,iBAAiB;AACjC,oBAAY,KAAK,mBAAmB,CAAC,UAAU,SAAS,QAAQ,aAAa,aAAa,OAAO,CAAC;AAClG,cAAM,QAAQ,gBAAgB,mBAAmB,EAAC,QAAO,IAAI,aAAa,IAAI,QAAQ,KAAG,QAAU,OAAM,YAAY,IAAI,aAAa,IAAI,OAAO,GAAE,OAAO,GAAE,MAAK,IAAI,aAAa,IAAI,MAAM,KAAG,QAAU,WAAU,IAAI,aAAa,IAAI,WAAW,KAAG,QAAU,WAAU,IAAI,aAAa,IAAI,WAAW,KAAG,QAAU,QAAO,IAAI,aAAa,OAAO,OAAO,EAAC,CAAC;AAC/V,sBAAc,UAAS,KAAI,mBAAkB,MAAM,QAAQ,WAAW,WAAU,KAAY,GAAE,SAAS;AAAE;AAAA,MAC3G;AACA,YAAM,cAAY,IAAI,SAAS,MAAM,qCAAqC;AAC1E,UAAG,IAAI,WAAS,SAAO,aAAY;AAAC,+BAAuB,QAAQ;AAAE,cAAM,UAAU,sBAAsB;AAAE,oBAAY,KAAI,wBAAuB,CAAC,UAAS,OAAO,CAAC;AAAE,cAAM,QAAM,gBAAgB,wBAAuB,EAAC,YAAW,YAAY,CAAC,GAAE,QAAO,IAAI,aAAa,IAAI,QAAQ,KAAG,QAAU,OAAM,YAAY,IAAI,aAAa,IAAI,OAAO,GAAE,OAAO,EAAC,CAAC;AAAE,sBAAc,UAAS,KAAI,wBAAuB,MAAM,QAAQ,eAAe,WAAU,YAAY,CAAC,GAAG,KAAY,GAAE,SAAS;AAAE;AAAA,MAAO;AAC3e,YAAM,eAAa,IAAI,SAAS,MAAM,+CAA+C;AACrF,UAAG,IAAI,WAAS,UAAQ,cAAa;AAAC,+BAAuB,QAAQ;AAAE,cAAM,YAAU,aAAa,CAAC,MAAI,WAAS,oBAAkB;AAAmB,cAAM,UAAU,SAAS;AAAE,uBAAe,WAAU,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC;AAAE,cAAM,WAAW,gBAAgB;AAAE,0BAAgB;AAAK,cAAM,SAAO,aAAa,CAAC,MAAI,WAAS,MAAM,QAAQ,OAAO,WAAU,aAAa,CAAC,CAAE,IAAE,MAAM,QAAQ,QAAQ,WAAU,aAAa,CAAC,CAAE;AAAE,YAAG,CAAC,OAAO,SAAQ,UAAS,KAAI,aAAY,SAAS;AAAA,YAAO,eAAc,UAAS,KAAI,WAAU,EAAC,UAAS,OAAM,GAAE,SAAS;AAAE;AAAA,MAAO;AACzjB,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,0BAA0B;AACtE,cAAM,UAAU,WAAW;AAC3B,cAAM,QAAQ,gBAAgB,aAAa,MAAM,YAAY,CAAC;AAC9D,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,aAAa,MAAM,QAAQ,UAAU,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MACnG;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,gBAAgB;AAC3D,cAAM,UAAU,UAAU;AAC1B,oBAAY,KAAK,YAAY,CAAC,CAAC;AAC/B,wBAAgB,YAAY,CAAC,CAAC;AAC9B,sBAAc,UAAU,KAAK,YAAY,EAAE,QAAQ,MAAM,QAAQ,SAAS,SAAS,EAAE,GAAG,SAAS;AAAG;AAAA,MACtG;AACA,YAAM,QAAQ,IAAI,SAAS,MAAM,gDAAgD;AACjF,UAAI,IAAI,WAAW,UAAU,OAAO;AAClC,cAAM,cAAc,MAAM,CAAC,MAAM,WAAW,oBAAoB,MAAM,CAAC,MAAM,QAAQ,yBAAyB;AAC9G,cAAM,UAAU,WAAW;AAC3B,cAAM,WAAW,MAAM,YAAY;AACnC,cAAM,kBAAkB,OAAO,SAAS,UAAU,eAAe,KAAK,gBAAgB;AACtF,cAAM,QAAQ,eAAe,aAAa,MAAM,CAAC,GAAI,UAAU,eAAe;AAC9E,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,cAAM,CAAC,EAAE,IAAI,MAAM,IAAI;AACvB,cAAM,SAAS,WAAW,WACtB,MAAM,QAAQ,OAAO,WAAW,IAAI,MAAM,YAAsB,MAAM,OAAiB,IACvF,WAAW,QACT,MAAM,QAAQ,IAAI,WAAW,IAAI,MAAM,UAAoB,IAC3D,MAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACL,MAAM,SAAgC;AAAA,UACtC,MAAM,eAAe,MAAM,QAAQ;AAAA,UACpC,MAAM;AAAA,QACR;AACN,YAAI,CAAC,OAAQ,SAAQ,UAAU,KAAK,kBAAkB,SAAS;AAAA,YAC1D,eAAc,UAAU,KAAK,aAAa,EAAE,UAAU,OAAO,GAAG,SAAS;AAC9E;AAAA,MACF;AACA,cAAQ,UAAU,KAAK,aAAa,SAAS;AAAA,IAC/C;AACA,SAAK,SAAS,EAAE,MAAM,CAAC,UAAe;AACpC,UAAI,IAAI,cAAe;AACvB,cAAQ,UAAU;AAClB,UAAI,iBAAiB,2BAA2B,iBAAiB,uBAAuB;AACtF,gBAAQ,KAAK,MAAM,QAAQ,MAAM,MAAM,WAAW,EAAE,WAAW,MAAM,WAAW,QAAQ,MAAM,OAAO,CAAC;AAAA,MACxG,WAAW,OAAO,WAAW,KAAK;AAChC,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,2BAA2B,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAAA,MAC1G,WAAW,OAAO,SAAS,sBAAsB;AAC/C,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,EAAE,gBAAgB,CAAC,GAAG,MAAM,cAAc,EAAE,EAAE,CAAC;AAAA,MACrG,WAAW,OAAO,SAAS,gBAAgB;AACzC,YAAI,UAAU,eAAe,OAAO,MAAM,iBAAiB,CAAC;AAC5D,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,EAAE,mBAAmB,MAAM,kBAAkB,EAAE,CAAC;AAAA,MACtG,WAAW,iBAAiB,yBAAyB,iBAAiB,8BAA8B;AAClG,gBAAQ,KAAK,YAAY,QAAQ,MAAM,SAAS,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,MACxG,OAAO;AACL,gBAAQ,KAAK,OAAO,UAAU,KAAK,OAAO,QAAQ,kBAAkB,SAAS;AAAA,MAC/E;AAAA,IACF,CAAC,EAAE,QAAQ,MAAM,aAAa,KAAK,CAAC;AAAA,EACtC,CAAC;AACH;","names":[]}

package/dist/gateway-main.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PostgresBridgeStore
-} from "./chunk-XDNT6ZNZ.js";
+} from "./chunk-CVZAJ7TP.js";
 import {
   loadMigrationPlan,
   migrationsReady,
@@ -12,7 +12,7 @@ import "./chunk-VOQIDTCJ.js";
 import {
   PostgresCredentialResolver,
   createGateway
-} from "./chunk-P635FAN4.js";
+} from "./chunk-JUTJRAMA.js";
 import "./chunk-AWE3DFZV.js";
 import "./chunk-E4OWHGUE.js";
 import "./chunk-BZLMF5O5.js";
@@ -224,6 +224,66 @@ var PostgresRequestAuthority = class {
   }
 };
 
+// src/postgres-runtime-connection.ts
+var MAX_CA_PEM_BYTES = 256 * 1024;
+var BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;
+var CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----/u;
+var CLIENT_CERTIFICATE_PARAMETERS = [
+  "sslcert",
+  "sslkey",
+  "sslpassword"
+];
+function decodeCaPem(encoded) {
+  const value = encoded.trim();
+  if (!value) throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be empty");
+  if (!BASE64_PATTERN.test(value)) {
+    throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64");
+  }
+  const bytes = Buffer.from(value, "base64");
+  if (bytes.toString("base64") !== value) {
+    throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64");
+  }
+  if (bytes.byteLength > MAX_CA_PEM_BYTES) {
+    throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 exceeds 256 KiB after decoding");
+  }
+  const pem = bytes.toString("utf8").trim();
+  if (pem.includes("\0") || !CERTIFICATE_PATTERN.test(pem)) {
+    throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must decode to a PEM certificate bundle");
+  }
+  return pem;
+}
+function runtimePostgresConnectionConfig(connectionString, caBase64) {
+  if (caBase64 === void 0) return { connectionString };
+  let parsed;
+  try {
+    parsed = new URL(connectionString);
+  } catch {
+    throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_URL must be a valid PostgreSQL URL");
+  }
+  if (parsed.protocol !== "postgresql:" && parsed.protocol !== "postgres:") {
+    throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_URL must use postgresql:// or postgres://");
+  }
+  if (CLIENT_CERTIFICATE_PARAMETERS.some((parameter) => parsed.searchParams.has(parameter))) {
+    throw new Error(
+      "AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with client certificate URL parameters"
+    );
+  }
+  if (parsed.searchParams.has("ssl")) {
+    throw new Error(
+      "AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with the ssl URL parameter"
+    );
+  }
+  parsed.searchParams.delete("sslmode");
+  parsed.searchParams.delete("sslrootcert");
+  return {
+    connectionString: parsed.toString(),
+    ssl: {
+      ca: decodeCaPem(caBase64),
+      rejectUnauthorized: true
+    }
+  };
+}
+
 // src/gateway-main.ts
 function integer(value, fallback, name) {
   if (value === void 0) return fallback;
@@ -271,8 +331,12 @@ async function main() {
   const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, "gateway port");
   const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS?.split(",").map((origin) => origin.trim()).filter(Boolean);
   const migrationPlan = await loadMigrationPlan(migrationsDirectory);
+  const runtimeConnection = runtimePostgresConnectionConfig(
+    databaseUrl,
+    process.env.AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64
+  );
   const pool = new pg.Pool({
-    connectionString: databaseUrl,
+    ...runtimeConnection,
     max: poolSize,
     connectionTimeoutMillis: databaseTimeout,
     query_timeout: databaseTimeout,
@@ -280,7 +344,7 @@ async function main() {
     application_name: "agent-bridge-gateway"
   });
   const readinessPool = new pg.Pool({
-    connectionString: databaseUrl,
+    ...runtimeConnection,
     max: 1,
     connectionTimeoutMillis: databaseTimeout,
     query_timeout: databaseTimeout,

package/dist/gateway-main.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/gateway-main.ts","../src/gateway-security.ts","../src/postgres-request-authority.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport pg from \"pg\";\nimport { PostgresCredentialResolver } from \"./gateway-auth.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\nimport { createGateway } from \"./gateway.js\";\nimport {\n  loadMigrationPlan,\n  migrationsReady,\n  runMigrations,\n  runtimeSchemaReady,\n} from \"./migrations.js\";\nimport { PostgresBridgeStore } from \"./postgres-bridge-store.js\";\nimport { PostgresRequestAuthority } from \"./postgres-request-authority.js\";\n\nfunction integer(value: string | undefined, fallback: number, name: string): number {\n  if (value === undefined) return fallback;\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${name} must be a positive integer`);\n  return parsed;\n}\n\nasync function main(): Promise<void> {\n  const migrationsDirectory = fileURLToPath(new URL(\"../sql/migrations\", import.meta.url));\n  if (process.argv.includes(\"--migrate-only\")) {\n    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;\n    if (!databaseUrl) throw new Error(\"AGENT_BRIDGE_DATABASE_URL is required for migrations\");\n    const migrationPool = new pg.Pool({\n      connectionString: databaseUrl,\n      max: 1,\n      application_name: \"agent-bridge-migrator\",\n    });\n    try {\n      await runMigrations(migrationPool, migrationsDirectory);\n    } finally {\n      await migrationPool.end();\n    }\n    return;\n  }\n  if (process.env.AGENT_BRIDGE_MIGRATE === \"1\") {\n    throw new Error(\"AGENT_BRIDGE_MIGRATE is not supported; run agent-bridge migrate separately\");\n  }\n  const databaseUrl = process.env.AGENT_BRIDGE_RUNTIME_DATABASE_URL;\n  if (!databaseUrl) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway\");\n  }\n\n  const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 10_000, \"request deadline\");\n  const databaseTimeout = integer(\n    process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,\n    Math.max(1, Math.floor(deadline / 3)),\n    \"database timeout\",\n  );\n  const poolSize = integer(process.env.AGENT_BRIDGE_DATABASE_POOL_SIZE, 10, \"database pool size\");\n  const bodyLimitBytes = integer(\n    process.env.AGENT_BRIDGE_BODY_LIMIT_BYTES,\n    128 * 1024,\n    \"body limit\",\n  );\n  const host = process.env.AGENT_BRIDGE_HOST ?? \"127.0.0.1\";\n  const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, \"gateway port\");\n  const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  const migrationPlan = await loadMigrationPlan(migrationsDirectory);\n  const pool = new pg.Pool({\n    connectionString: databaseUrl,\n    max: poolSize,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway\",\n  });\n  const readinessPool = new pg.Pool({\n    connectionString: databaseUrl,\n    max: 1,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway-readiness\",\n  });\n\n  const store = new PostgresBridgeStore(pool);\n  let readinessCheckedAt = 0;\n  let readinessValue = false;\n  let readinessInFlight: Promise<boolean> | undefined;\n  const probeSchema = async () =>\n    await migrationsReady(readinessPool, migrationPlan) && await runtimeSchemaReady(readinessPool);\n  const schemaReady = (force = false): Promise<boolean> => {\n    if (!force && Date.now() - readinessCheckedAt < 1_000) {\n      return Promise.resolve(readinessValue);\n    }\n    if (readinessInFlight) return readinessInFlight;\n    let current: Promise<boolean>;\n    current = probeSchema()\n      .then((ready) => {\n        readinessValue = ready;\n        readinessCheckedAt = Date.now();\n        return ready;\n      })\n      .finally(() => {\n        if (readinessInFlight === current) readinessInFlight = undefined;\n      });\n    readinessInFlight = current;\n    return current;\n  };\n  try {\n    if (!await schemaReady(true)) {\n      throw new Error(\"runtime database is not ready for enforced row isolation\");\n    }\n  } catch (error) {\n    await Promise.allSettled([pool.end(), readinessPool.end()]);\n    throw error;\n  }\n  const gateway = createGateway({\n    store,\n    credentials: new PostgresCredentialResolver(pool),\n    security: new PostgresGatewaySecurity(pool),\n    requestAuthority: new PostgresRequestAuthority(pool),\n    allowedOrigins,\n    bodyLimitBytes,\n    requestDeadlineMs: deadline,\n    ready: schemaReady,\n    rowIsolationReady: schemaReady,\n  });\n\n  gateway.listen(port, host, () => {\n    process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}\\n`);\n  });\n\n  let stopping = false;\n  async function shutdown(): Promise<void> {\n    if (stopping) return;\n    stopping = true;\n    await new Promise<void>((resolve, reject) => {\n      gateway.close((error) => error ? reject(error) : resolve());\n    });\n    await Promise.all([pool.end(), readinessPool.end()]);\n  }\n\n  process.once(\"SIGINT\", () => void shutdown());\n  process.once(\"SIGTERM\", () => void shutdown());\n}\n\nvoid main().catch((error) => {\n  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n  process.exitCode = 1;\n});\n","import type { PgQueryable } from \"./postgres-bridge-store.js\";\nimport type { OperationId } from \"./contracts/registry.js\";\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  policyId: string | null;\n  limit: number;\n  remaining: number;\n  retryAfterSeconds: number;\n}\n\nexport interface GatewaySecurity {\n  recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void>;\n  consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision>;\n}\n\nexport class PostgresGatewaySecurity implements GatewaySecurity {\n  constructor(private readonly db: PgQueryable) {}\n\n  private functionName(bound: string, unbound: string): string {\n    return this.db.inTransaction ? bound : unbound;\n  }\n\n  async recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    if (signal?.aborted) throw signal.reason;\n    await this.db.query(\n      `SELECT agent_bridge.${this.functionName(\"record_scope_denial\", \"record_scope_denial_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n  }\n\n  async consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      allowed: boolean;\n      limit_value: string | number;\n      remaining_value: string | number;\n      retry_after_seconds: string | number;\n      denied_policy_id: string | null;\n    }>(\n      `SELECT allowed, limit_value, remaining_value, retry_after_seconds, denied_policy_id\n       FROM agent_bridge.${this.functionName(\"consume_rate_limit\", \"consume_rate_limit_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n    const row = result.rows[0];\n    if (!row) throw new Error(\"rate limit policy is missing\");\n    return {\n      allowed: row.allowed,\n      policyId: row.denied_policy_id,\n      limit: Math.max(0, Number(row.limit_value)),\n      remaining: Math.max(0, Number(row.remaining_value)),\n      retryAfterSeconds: Math.max(0, Number(row.retry_after_seconds)),\n    };\n  }\n}\n","import type pg from \"pg\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport { PostgresBridgeStore, type PgQueryable } from \"./postgres-bridge-store.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\n\nexport interface RequestAuthorityContext {\n  gatewayAuthorityId: string;\n  credential: { id: string; principal: BridgePrincipal; scopes: readonly AuthorizationScope[] };\n  store: PostgresBridgeStore;\n  security: PostgresGatewaySecurity;\n  /** Establishes the savepoint separating durable security accounting from domain work. */\n  beginDomainWork(): Promise<void>;\n  endpointMigrationChallenges?: {\n    issue(input: { challenge: string; expectedGatewayAuthorityId: string; verifierCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string }>;\n    consume(input: { challenge: string; expectedGatewayAuthorityId: string; issuerCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string | null; consumed: boolean }>;\n  };\n}\n\nexport interface RequestAuthority {\n  run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T>;\n}\n\ntype AuthorityRow = {\n  gateway_authority_id: string;\n  credential_id: string;\n  workspace_id: string;\n  principal: string;\n  scopes: AuthorizationScope[];\n};\n\nfunction timestamp(value: unknown): string {\n  if (value instanceof Date) return value.toISOString();\n  return String(value);\n}\n\nfunction endpointMigrationFailure(error: unknown): never {\n  const sqlstate = typeof error === \"object\" && error !== null && \"code\" in error\n    ? String((error as { code?: unknown }).code ?? \"\")\n    : \"\";\n  if (sqlstate === \"28000\") {\n    throw Object.assign(new Error(\"endpoint migration binding was rejected\"), {\n      status: 409,\n      code: \"endpoint_migration_binding_rejected\",\n    });\n  }\n  if (sqlstate === \"23505\") {\n    throw Object.assign(new Error(\"endpoint migration challenge conflicts with existing state\"), {\n      status: 409,\n      code: \"endpoint_migration_challenge_conflict\",\n    });\n  }\n  throw error;\n}\n\nexport class MutationOutcomeUnknownError extends Error {\n  readonly status = 503;\n  readonly code = \"mutation_outcome_unknown\";\n  constructor() { super(\"The database commit outcome is unknown\"); }\n}\n\nexport class PostgresRequestAuthority implements RequestAuthority {\n  constructor(private readonly pool: Pick<pg.Pool, \"connect\">) {}\n\n  async run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T> {\n    if (signal.aborted) throw signal.reason;\n    const client = await this.pool.connect();\n    const db: PgQueryable = { inTransaction: true, query: (sql, values) => client.query(sql, values) };\n    let transactionOpen = false;\n    let domainSavepoint = false;\n    let commitDispatched = false;\n    let commitCompleted = false;\n    let discard: Error | undefined;\n    try {\n      if (signal.aborted) throw signal.reason;\n      await client.query(\"BEGIN\");\n      transactionOpen = true;\n      const opened = await client.query<AuthorityRow>(\n        `SELECT gateway_authority_id,credential_id,workspace_id,principal,scopes\n         FROM agent_bridge.open_request_authority_bound($1::uuid,$2::text,$3::uuid)`,\n        [credentialId, credentialHash, requestId],\n      );\n      const row = opened.rows[0];\n      if (!row) {\n        await client.query(\"ROLLBACK\");\n        transactionOpen = false;\n        throw Object.assign(new Error(\"Credential is not active\"), { status: 401, code: \"unauthorized\" });\n      }\n      if (signal.aborted) throw signal.reason;\n      const context: RequestAuthorityContext = {\n        gatewayAuthorityId: row.gateway_authority_id,\n        credential: { id: row.credential_id, principal: { workspace: row.workspace_id, agent: row.principal }, scopes: row.scopes },\n        store: new PostgresBridgeStore(db),\n        security: new PostgresGatewaySecurity(db),\n        beginDomainWork: async () => {\n          if (domainSavepoint) return;\n          if (signal.aborted) throw signal.reason;\n          await client.query(\"SAVEPOINT agent_bridge_domain_work\");\n          if (signal.aborted) throw signal.reason;\n          domainSavepoint = true;\n        },\n        endpointMigrationChallenges: {\n          issue: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at\n                 FROM agent_bridge.issue_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.verifierCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be issued\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: timestamp(row.expires_at),\n            };\n          },\n          consume: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date | null;\n                consumed: boolean;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at,consumed\n                 FROM agent_bridge.consume_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.issuerCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be consumed\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: row.expires_at === null ? null : timestamp(row.expires_at),\n              consumed: row.consumed,\n            };\n          },\n        },\n      };\n      try {\n        const result = await work(context);\n        if (signal.aborted) throw signal.reason;\n        await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        return result;\n      } catch (error) {\n        if (commitDispatched) throw new MutationOutcomeUnknownError();\n        if (signal.aborted) throw error;\n        try {\n          if (domainSavepoint) {\n            await client.query(\"ROLLBACK TO SAVEPOINT agent_bridge_domain_work\");\n          }\n          await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        } catch {\n          try {\n            await client.query(\"ROLLBACK\");\n          } catch (rollbackError) {\n            discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));\n          }\n          transactionOpen = false;\n          throw error;\n        }\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        throw error;\n      }\n    } catch (error) {\n      if (commitDispatched && !commitCompleted) {\n        discard = error instanceof Error ? error : new Error(String(error));\n        throw error instanceof MutationOutcomeUnknownError ? error : new MutationOutcomeUnknownError();\n      }\n      if (transactionOpen) {\n        try { await client.query(\"ROLLBACK\"); transactionOpen = false; }\n        catch (rollbackError) { discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError)); }\n      }\n      throw error;\n    } finally {\n      client.release(discard);\n    }\n  }\n\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,QAAQ;;;ACyBR,IAAM,0BAAN,MAAyD;AAAA,EAC9D,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAEvC,aAAa,OAAe,SAAyB;AAC3D,WAAO,KAAK,GAAG,gBAAgB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAM,kBACJ,cACA,aACA,WACA,QACe;AACf,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,KAAK,GAAG;AAAA,MACZ,uBAAuB,KAAK,aAAa,uBAAuB,iCAAiC,CAAC;AAAA,MAClG,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAAA,EACpC;AAAA,EAEA,MAAM,QACJ,cACA,aACA,WACA,QAC4B;AAC5B,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAO3B;AAAA,2BACqB,KAAK,aAAa,sBAAsB,gCAAgC,CAAC;AAAA,MAC9F,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8BAA8B;AACxD,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,MAC1C,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,eAAe,CAAC;AAAA,MAClD,mBAAmB,KAAK,IAAI,GAAG,OAAO,IAAI,mBAAmB,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;AC7CA,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,yBAAyB,OAAuB;AACvD,QAAM,WAAW,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACtE,OAAQ,MAA6B,QAAQ,EAAE,IAC/C;AACJ,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,yCAAyC,GAAG;AAAA,MACxE,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,4DAA4D,GAAG;AAAA,MAC3F,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM;AACR;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,cAAc;AAAE,UAAM,wCAAwC;AAF9D,SAAS,SAAS;AAClB,SAAS,OAAO;AAAA,EACiD;AACnE;AAEO,IAAM,2BAAN,MAA2D;AAAA,EAChE,YAA6B,MAAgC;AAAhC;AAAA,EAAiC;AAAA,EAE9D,MAAM,IAAO,cAAsB,gBAAwB,WAAmB,QAAqB,MAAoE;AACrK,QAAI,OAAO,QAAS,OAAM,OAAO;AACjC,UAAM,SAAS,MAAM,KAAK,KAAK,QAAQ;AACvC,UAAM,KAAkB,EAAE,eAAe,MAAM,OAAO,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,MAAM,EAAE;AACjG,QAAI,kBAAkB;AACtB,QAAI,kBAAkB;AACtB,QAAI,mBAAmB;AACvB,QAAI,kBAAkB;AACtB,QAAI;AACJ,QAAI;AACF,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,OAAO,MAAM,OAAO;AAC1B,wBAAkB;AAClB,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B;AAAA;AAAA,QAEA,CAAC,cAAc,gBAAgB,SAAS;AAAA,MAC1C;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,KAAK;AACR,cAAM,OAAO,MAAM,UAAU;AAC7B,0BAAkB;AAClB,cAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG,EAAE,QAAQ,KAAK,MAAM,eAAe,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,UAAmC;AAAA,QACvC,oBAAoB,IAAI;AAAA,QACxB,YAAY,EAAE,IAAI,IAAI,eAAe,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU,GAAG,QAAQ,IAAI,OAAO;AAAA,QAC1H,OAAO,IAAI,oBAAoB,EAAE;AAAA,QACjC,UAAU,IAAI,wBAAwB,EAAE;AAAA,QACxC,iBAAiB,YAAY;AAC3B,cAAI,gBAAiB;AACrB,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,gBAAM,OAAO,MAAM,oCAAoC;AACvD,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,4BAAkB;AAAA,QACpB;AAAA,QACA,6BAA6B;AAAA,UAC3B,OAAO,OAAO,UAAU;AACtB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAMpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,sBAAsB,MAAM,SAAS;AAAA,cAChF;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,kDAAkD;AAC5E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAW,UAAUA,KAAI,UAAU;AAAA,YACrC;AAAA,UACF;AAAA,UACA,SAAS,OAAO,UAAU;AACxB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAOpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,oBAAoB,MAAM,SAAS;AAAA,cAC9E;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,oDAAoD;AAC9E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAWA,KAAI,eAAe,OAAO,OAAO,UAAUA,KAAI,UAAU;AAAA,cACpE,UAAUA,KAAI;AAAA,YAChB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,cAAM,OAAO,MAAM,+CAA+C;AAClE,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAkB,OAAM,IAAI,4BAA4B;AAC5D,YAAI,OAAO,QAAS,OAAM;AAC1B,YAAI;AACF,cAAI,iBAAiB;AACnB,kBAAM,OAAO,MAAM,gDAAgD;AAAA,UACrE;AACA,gBAAM,OAAO,MAAM,+CAA+C;AAAA,QACpE,QAAQ;AACN,cAAI;AACF,kBAAM,OAAO,MAAM,UAAU;AAAA,UAC/B,SAAS,eAAe;AACtB,sBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,UAC5F;AACA,4BAAkB;AAClB,gBAAM;AAAA,QACR;AACA,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,cAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAO;AACd,UAAI,oBAAoB,CAAC,iBAAiB;AACxC,kBAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAClE,cAAM,iBAAiB,8BAA8B,QAAQ,IAAI,4BAA4B;AAAA,MAC/F;AACA,UAAI,iBAAiB;AACnB,YAAI;AAAE,gBAAM,OAAO,MAAM,UAAU;AAAG,4BAAkB;AAAA,QAAO,SACxD,eAAe;AAAE,oBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,QAAG;AAAA,MACvH;AACA,YAAM;AAAA,IACR,UAAE;AACA,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AAEF;;;AF/LA,SAAS,QAAQ,OAA2B,UAAkB,MAAsB;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACrG,SAAO;AACT;AAEA,eAAe,OAAsB;AACnC,QAAM,sBAAsB,cAAc,IAAI,IAAI,qBAAqB,YAAY,GAAG,CAAC;AACvF,MAAI,QAAQ,KAAK,SAAS,gBAAgB,GAAG;AAC3C,UAAMC,eAAc,QAAQ,IAAI;AAChC,QAAI,CAACA,aAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,MAChC,kBAAkBA;AAAA,MAClB,KAAK;AAAA,MACL,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI;AACF,YAAM,cAAc,eAAe,mBAAmB;AAAA,IACxD,UAAE;AACA,YAAM,cAAc,IAAI;AAAA,IAC1B;AACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,yBAAyB,KAAK;AAC5C,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,kCAAkC,KAAQ,kBAAkB;AACjG,QAAM,kBAAkB;AAAA,IACtB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,QAAQ,IAAI,iCAAiC,IAAI,oBAAoB;AAC9F,QAAM,iBAAiB;AAAA,IACrB,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,IAAI,qBAAqB;AAC9C,QAAM,OAAO,QAAQ,QAAQ,IAAI,mBAAmB,MAAM,cAAc;AACxE,QAAM,iBAAiB,QAAQ,IAAI,8BAC/B,MAAM,GAAG,EACV,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AACjB,QAAM,gBAAgB,MAAM,kBAAkB,mBAAmB;AACjE,QAAM,OAAO,IAAI,GAAG,KAAK;AAAA,IACvB,kBAAkB;AAAA,IAClB,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IAChC,kBAAkB;AAAA,IAClB,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,QAAQ,IAAI,oBAAoB,IAAI;AAC1C,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AACrB,MAAI;AACJ,QAAM,cAAc,YAClB,MAAM,gBAAgB,eAAe,aAAa,KAAK,MAAM,mBAAmB,aAAa;AAC/F,QAAM,cAAc,CAAC,QAAQ,UAA4B;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,qBAAqB,KAAO;AACrD,aAAO,QAAQ,QAAQ,cAAc;AAAA,IACvC;AACA,QAAI,kBAAmB,QAAO;AAC9B,QAAI;AACJ,cAAU,YAAY,EACnB,KAAK,CAAC,UAAU;AACf,uBAAiB;AACjB,2BAAqB,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,sBAAsB,QAAS,qBAAoB;AAAA,IACzD,CAAC;AACH,wBAAoB;AACpB,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,CAAC,MAAM,YAAY,IAAI,GAAG;AAC5B,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAC1D,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA,aAAa,IAAI,2BAA2B,IAAI;AAAA,IAChD,UAAU,IAAI,wBAAwB,IAAI;AAAA,IAC1C,kBAAkB,IAAI,yBAAyB,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,OAAO;AAAA,IACP,mBAAmB;AAAA,EACrB,CAAC;AAED,UAAQ,OAAO,MAAM,MAAM,MAAM;AAC/B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AAED,MAAI,WAAW;AACf,iBAAe,WAA0B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAQ,MAAM,CAAC,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,IAC5D,CAAC;AACD,UAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAAA,EACrD;AAEA,UAAQ,KAAK,UAAU,MAAM,KAAK,SAAS,CAAC;AAC5C,UAAQ,KAAK,WAAW,MAAM,KAAK,SAAS,CAAC;AAC/C;AAEA,KAAK,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3B,UAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AAClF,UAAQ,WAAW;AACrB,CAAC;","names":["row","databaseUrl"]}
+{"version":3,"sources":["../src/gateway-main.ts","../src/gateway-security.ts","../src/postgres-request-authority.ts","../src/postgres-runtime-connection.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport pg from \"pg\";\nimport { PostgresCredentialResolver } from \"./gateway-auth.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\nimport { createGateway } from \"./gateway.js\";\nimport {\n  loadMigrationPlan,\n  migrationsReady,\n  runMigrations,\n  runtimeSchemaReady,\n} from \"./migrations.js\";\nimport { PostgresBridgeStore } from \"./postgres-bridge-store.js\";\nimport { PostgresRequestAuthority } from \"./postgres-request-authority.js\";\nimport { runtimePostgresConnectionConfig } from \"./postgres-runtime-connection.js\";\n\nfunction integer(value: string | undefined, fallback: number, name: string): number {\n  if (value === undefined) return fallback;\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${name} must be a positive integer`);\n  return parsed;\n}\n\nasync function main(): Promise<void> {\n  const migrationsDirectory = fileURLToPath(new URL(\"../sql/migrations\", import.meta.url));\n  if (process.argv.includes(\"--migrate-only\")) {\n    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;\n    if (!databaseUrl) throw new Error(\"AGENT_BRIDGE_DATABASE_URL is required for migrations\");\n    const migrationPool = new pg.Pool({\n      connectionString: databaseUrl,\n      max: 1,\n      application_name: \"agent-bridge-migrator\",\n    });\n    try {\n      await runMigrations(migrationPool, migrationsDirectory);\n    } finally {\n      await migrationPool.end();\n    }\n    return;\n  }\n  if (process.env.AGENT_BRIDGE_MIGRATE === \"1\") {\n    throw new Error(\"AGENT_BRIDGE_MIGRATE is not supported; run agent-bridge migrate separately\");\n  }\n  const databaseUrl = process.env.AGENT_BRIDGE_RUNTIME_DATABASE_URL;\n  if (!databaseUrl) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway\");\n  }\n\n  const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 10_000, \"request deadline\");\n  const databaseTimeout = integer(\n    process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,\n    Math.max(1, Math.floor(deadline / 3)),\n    \"database timeout\",\n  );\n  const poolSize = integer(process.env.AGENT_BRIDGE_DATABASE_POOL_SIZE, 10, \"database pool size\");\n  const bodyLimitBytes = integer(\n    process.env.AGENT_BRIDGE_BODY_LIMIT_BYTES,\n    128 * 1024,\n    \"body limit\",\n  );\n  const host = process.env.AGENT_BRIDGE_HOST ?? \"127.0.0.1\";\n  const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, \"gateway port\");\n  const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  const migrationPlan = await loadMigrationPlan(migrationsDirectory);\n  const runtimeConnection = runtimePostgresConnectionConfig(\n    databaseUrl,\n    process.env.AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64,\n  );\n  const pool = new pg.Pool({\n    ...runtimeConnection,\n    max: poolSize,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway\",\n  });\n  const readinessPool = new pg.Pool({\n    ...runtimeConnection,\n    max: 1,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway-readiness\",\n  });\n\n  const store = new PostgresBridgeStore(pool);\n  let readinessCheckedAt = 0;\n  let readinessValue = false;\n  let readinessInFlight: Promise<boolean> | undefined;\n  const probeSchema = async () =>\n    await migrationsReady(readinessPool, migrationPlan) && await runtimeSchemaReady(readinessPool);\n  const schemaReady = (force = false): Promise<boolean> => {\n    if (!force && Date.now() - readinessCheckedAt < 1_000) {\n      return Promise.resolve(readinessValue);\n    }\n    if (readinessInFlight) return readinessInFlight;\n    let current: Promise<boolean>;\n    current = probeSchema()\n      .then((ready) => {\n        readinessValue = ready;\n        readinessCheckedAt = Date.now();\n        return ready;\n      })\n      .finally(() => {\n        if (readinessInFlight === current) readinessInFlight = undefined;\n      });\n    readinessInFlight = current;\n    return current;\n  };\n  try {\n    if (!await schemaReady(true)) {\n      throw new Error(\"runtime database is not ready for enforced row isolation\");\n    }\n  } catch (error) {\n    await Promise.allSettled([pool.end(), readinessPool.end()]);\n    throw error;\n  }\n  const gateway = createGateway({\n    store,\n    credentials: new PostgresCredentialResolver(pool),\n    security: new PostgresGatewaySecurity(pool),\n    requestAuthority: new PostgresRequestAuthority(pool),\n    allowedOrigins,\n    bodyLimitBytes,\n    requestDeadlineMs: deadline,\n    ready: schemaReady,\n    rowIsolationReady: schemaReady,\n  });\n\n  gateway.listen(port, host, () => {\n    process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}\\n`);\n  });\n\n  let stopping = false;\n  async function shutdown(): Promise<void> {\n    if (stopping) return;\n    stopping = true;\n    await new Promise<void>((resolve, reject) => {\n      gateway.close((error) => error ? reject(error) : resolve());\n    });\n    await Promise.all([pool.end(), readinessPool.end()]);\n  }\n\n  process.once(\"SIGINT\", () => void shutdown());\n  process.once(\"SIGTERM\", () => void shutdown());\n}\n\nvoid main().catch((error) => {\n  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n  process.exitCode = 1;\n});\n","import type { PgQueryable } from \"./postgres-bridge-store.js\";\nimport type { OperationId } from \"./contracts/registry.js\";\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  policyId: string | null;\n  limit: number;\n  remaining: number;\n  retryAfterSeconds: number;\n}\n\nexport interface GatewaySecurity {\n  recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void>;\n  consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision>;\n}\n\nexport class PostgresGatewaySecurity implements GatewaySecurity {\n  constructor(private readonly db: PgQueryable) {}\n\n  private functionName(bound: string, unbound: string): string {\n    return this.db.inTransaction ? bound : unbound;\n  }\n\n  async recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    if (signal?.aborted) throw signal.reason;\n    await this.db.query(\n      `SELECT agent_bridge.${this.functionName(\"record_scope_denial\", \"record_scope_denial_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n  }\n\n  async consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      allowed: boolean;\n      limit_value: string | number;\n      remaining_value: string | number;\n      retry_after_seconds: string | number;\n      denied_policy_id: string | null;\n    }>(\n      `SELECT allowed, limit_value, remaining_value, retry_after_seconds, denied_policy_id\n       FROM agent_bridge.${this.functionName(\"consume_rate_limit\", \"consume_rate_limit_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n    const row = result.rows[0];\n    if (!row) throw new Error(\"rate limit policy is missing\");\n    return {\n      allowed: row.allowed,\n      policyId: row.denied_policy_id,\n      limit: Math.max(0, Number(row.limit_value)),\n      remaining: Math.max(0, Number(row.remaining_value)),\n      retryAfterSeconds: Math.max(0, Number(row.retry_after_seconds)),\n    };\n  }\n}\n","import type pg from \"pg\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport { PostgresBridgeStore, type PgQueryable } from \"./postgres-bridge-store.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\n\nexport interface RequestAuthorityContext {\n  gatewayAuthorityId: string;\n  credential: { id: string; principal: BridgePrincipal; scopes: readonly AuthorizationScope[] };\n  store: PostgresBridgeStore;\n  security: PostgresGatewaySecurity;\n  /** Establishes the savepoint separating durable security accounting from domain work. */\n  beginDomainWork(): Promise<void>;\n  endpointMigrationChallenges?: {\n    issue(input: { challenge: string; expectedGatewayAuthorityId: string; verifierCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string }>;\n    consume(input: { challenge: string; expectedGatewayAuthorityId: string; issuerCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string | null; consumed: boolean }>;\n  };\n}\n\nexport interface RequestAuthority {\n  run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T>;\n}\n\ntype AuthorityRow = {\n  gateway_authority_id: string;\n  credential_id: string;\n  workspace_id: string;\n  principal: string;\n  scopes: AuthorizationScope[];\n};\n\nfunction timestamp(value: unknown): string {\n  if (value instanceof Date) return value.toISOString();\n  return String(value);\n}\n\nfunction endpointMigrationFailure(error: unknown): never {\n  const sqlstate = typeof error === \"object\" && error !== null && \"code\" in error\n    ? String((error as { code?: unknown }).code ?? \"\")\n    : \"\";\n  if (sqlstate === \"28000\") {\n    throw Object.assign(new Error(\"endpoint migration binding was rejected\"), {\n      status: 409,\n      code: \"endpoint_migration_binding_rejected\",\n    });\n  }\n  if (sqlstate === \"23505\") {\n    throw Object.assign(new Error(\"endpoint migration challenge conflicts with existing state\"), {\n      status: 409,\n      code: \"endpoint_migration_challenge_conflict\",\n    });\n  }\n  throw error;\n}\n\nexport class MutationOutcomeUnknownError extends Error {\n  readonly status = 503;\n  readonly code = \"mutation_outcome_unknown\";\n  constructor() { super(\"The database commit outcome is unknown\"); }\n}\n\nexport class PostgresRequestAuthority implements RequestAuthority {\n  constructor(private readonly pool: Pick<pg.Pool, \"connect\">) {}\n\n  async run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T> {\n    if (signal.aborted) throw signal.reason;\n    const client = await this.pool.connect();\n    const db: PgQueryable = { inTransaction: true, query: (sql, values) => client.query(sql, values) };\n    let transactionOpen = false;\n    let domainSavepoint = false;\n    let commitDispatched = false;\n    let commitCompleted = false;\n    let discard: Error | undefined;\n    try {\n      if (signal.aborted) throw signal.reason;\n      await client.query(\"BEGIN\");\n      transactionOpen = true;\n      const opened = await client.query<AuthorityRow>(\n        `SELECT gateway_authority_id,credential_id,workspace_id,principal,scopes\n         FROM agent_bridge.open_request_authority_bound($1::uuid,$2::text,$3::uuid)`,\n        [credentialId, credentialHash, requestId],\n      );\n      const row = opened.rows[0];\n      if (!row) {\n        await client.query(\"ROLLBACK\");\n        transactionOpen = false;\n        throw Object.assign(new Error(\"Credential is not active\"), { status: 401, code: \"unauthorized\" });\n      }\n      if (signal.aborted) throw signal.reason;\n      const context: RequestAuthorityContext = {\n        gatewayAuthorityId: row.gateway_authority_id,\n        credential: { id: row.credential_id, principal: { workspace: row.workspace_id, agent: row.principal }, scopes: row.scopes },\n        store: new PostgresBridgeStore(db),\n        security: new PostgresGatewaySecurity(db),\n        beginDomainWork: async () => {\n          if (domainSavepoint) return;\n          if (signal.aborted) throw signal.reason;\n          await client.query(\"SAVEPOINT agent_bridge_domain_work\");\n          if (signal.aborted) throw signal.reason;\n          domainSavepoint = true;\n        },\n        endpointMigrationChallenges: {\n          issue: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at\n                 FROM agent_bridge.issue_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.verifierCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be issued\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: timestamp(row.expires_at),\n            };\n          },\n          consume: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date | null;\n                consumed: boolean;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at,consumed\n                 FROM agent_bridge.consume_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.issuerCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be consumed\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: row.expires_at === null ? null : timestamp(row.expires_at),\n              consumed: row.consumed,\n            };\n          },\n        },\n      };\n      try {\n        const result = await work(context);\n        if (signal.aborted) throw signal.reason;\n        await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        return result;\n      } catch (error) {\n        if (commitDispatched) throw new MutationOutcomeUnknownError();\n        if (signal.aborted) throw error;\n        try {\n          if (domainSavepoint) {\n            await client.query(\"ROLLBACK TO SAVEPOINT agent_bridge_domain_work\");\n          }\n          await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        } catch {\n          try {\n            await client.query(\"ROLLBACK\");\n          } catch (rollbackError) {\n            discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));\n          }\n          transactionOpen = false;\n          throw error;\n        }\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        throw error;\n      }\n    } catch (error) {\n      if (commitDispatched && !commitCompleted) {\n        discard = error instanceof Error ? error : new Error(String(error));\n        throw error instanceof MutationOutcomeUnknownError ? error : new MutationOutcomeUnknownError();\n      }\n      if (transactionOpen) {\n        try { await client.query(\"ROLLBACK\"); transactionOpen = false; }\n        catch (rollbackError) { discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError)); }\n      }\n      throw error;\n    } finally {\n      client.release(discard);\n    }\n  }\n\n}\n","import type { PoolConfig } from \"pg\";\n\nconst MAX_CA_PEM_BYTES = 256 * 1024;\nconst BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;\nconst CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]+-----END CERTIFICATE-----/u;\nconst CLIENT_CERTIFICATE_PARAMETERS = [\n  \"sslcert\",\n  \"sslkey\",\n  \"sslpassword\",\n] as const;\n\nfunction decodeCaPem(encoded: string): string {\n  const value = encoded.trim();\n  if (!value) throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be empty\");\n  if (!BASE64_PATTERN.test(value)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  const bytes = Buffer.from(value, \"base64\");\n  if (bytes.toString(\"base64\") !== value) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  if (bytes.byteLength > MAX_CA_PEM_BYTES) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 exceeds 256 KiB after decoding\");\n  }\n  const pem = bytes.toString(\"utf8\").trim();\n  if (pem.includes(\"\\0\") || !CERTIFICATE_PATTERN.test(pem)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must decode to a PEM certificate bundle\");\n  }\n  return pem;\n}\n\nexport function runtimePostgresConnectionConfig(\n  connectionString: string,\n  caBase64: string | undefined,\n): Pick<PoolConfig, \"connectionString\" | \"ssl\"> {\n  if (caBase64 === undefined) return { connectionString };\n\n  let parsed: URL;\n  try {\n    parsed = new URL(connectionString);\n  } catch {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must be a valid PostgreSQL URL\");\n  }\n  if (parsed.protocol !== \"postgresql:\" && parsed.protocol !== \"postgres:\") {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must use postgresql:// or postgres://\");\n  }\n\n  if (CLIENT_CERTIFICATE_PARAMETERS.some((parameter) => parsed.searchParams.has(parameter))) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with client certificate URL parameters\",\n    );\n  }\n  if (parsed.searchParams.has(\"ssl\")) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with the ssl URL parameter\",\n    );\n  }\n  parsed.searchParams.delete(\"sslmode\");\n  parsed.searchParams.delete(\"sslrootcert\");\n  return {\n    connectionString: parsed.toString(),\n    ssl: {\n      ca: decodeCaPem(caBase64),\n      rejectUnauthorized: true,\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,QAAQ;;;ACyBR,IAAM,0BAAN,MAAyD;AAAA,EAC9D,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAEvC,aAAa,OAAe,SAAyB;AAC3D,WAAO,KAAK,GAAG,gBAAgB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAM,kBACJ,cACA,aACA,WACA,QACe;AACf,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,KAAK,GAAG;AAAA,MACZ,uBAAuB,KAAK,aAAa,uBAAuB,iCAAiC,CAAC;AAAA,MAClG,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAAA,EACpC;AAAA,EAEA,MAAM,QACJ,cACA,aACA,WACA,QAC4B;AAC5B,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAO3B;AAAA,2BACqB,KAAK,aAAa,sBAAsB,gCAAgC,CAAC;AAAA,MAC9F,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8BAA8B;AACxD,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,MAC1C,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,eAAe,CAAC;AAAA,MAClD,mBAAmB,KAAK,IAAI,GAAG,OAAO,IAAI,mBAAmB,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;AC7CA,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,yBAAyB,OAAuB;AACvD,QAAM,WAAW,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACtE,OAAQ,MAA6B,QAAQ,EAAE,IAC/C;AACJ,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,yCAAyC,GAAG;AAAA,MACxE,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,4DAA4D,GAAG;AAAA,MAC3F,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM;AACR;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,cAAc;AAAE,UAAM,wCAAwC;AAF9D,SAAS,SAAS;AAClB,SAAS,OAAO;AAAA,EACiD;AACnE;AAEO,IAAM,2BAAN,MAA2D;AAAA,EAChE,YAA6B,MAAgC;AAAhC;AAAA,EAAiC;AAAA,EAE9D,MAAM,IAAO,cAAsB,gBAAwB,WAAmB,QAAqB,MAAoE;AACrK,QAAI,OAAO,QAAS,OAAM,OAAO;AACjC,UAAM,SAAS,MAAM,KAAK,KAAK,QAAQ;AACvC,UAAM,KAAkB,EAAE,eAAe,MAAM,OAAO,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,MAAM,EAAE;AACjG,QAAI,kBAAkB;AACtB,QAAI,kBAAkB;AACtB,QAAI,mBAAmB;AACvB,QAAI,kBAAkB;AACtB,QAAI;AACJ,QAAI;AACF,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,OAAO,MAAM,OAAO;AAC1B,wBAAkB;AAClB,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B;AAAA;AAAA,QAEA,CAAC,cAAc,gBAAgB,SAAS;AAAA,MAC1C;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,KAAK;AACR,cAAM,OAAO,MAAM,UAAU;AAC7B,0BAAkB;AAClB,cAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG,EAAE,QAAQ,KAAK,MAAM,eAAe,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,UAAmC;AAAA,QACvC,oBAAoB,IAAI;AAAA,QACxB,YAAY,EAAE,IAAI,IAAI,eAAe,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU,GAAG,QAAQ,IAAI,OAAO;AAAA,QAC1H,OAAO,IAAI,oBAAoB,EAAE;AAAA,QACjC,UAAU,IAAI,wBAAwB,EAAE;AAAA,QACxC,iBAAiB,YAAY;AAC3B,cAAI,gBAAiB;AACrB,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,gBAAM,OAAO,MAAM,oCAAoC;AACvD,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,4BAAkB;AAAA,QACpB;AAAA,QACA,6BAA6B;AAAA,UAC3B,OAAO,OAAO,UAAU;AACtB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAMpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,sBAAsB,MAAM,SAAS;AAAA,cAChF;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,kDAAkD;AAC5E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAW,UAAUA,KAAI,UAAU;AAAA,YACrC;AAAA,UACF;AAAA,UACA,SAAS,OAAO,UAAU;AACxB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAOpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,oBAAoB,MAAM,SAAS;AAAA,cAC9E;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,oDAAoD;AAC9E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAWA,KAAI,eAAe,OAAO,OAAO,UAAUA,KAAI,UAAU;AAAA,cACpE,UAAUA,KAAI;AAAA,YAChB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,cAAM,OAAO,MAAM,+CAA+C;AAClE,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAkB,OAAM,IAAI,4BAA4B;AAC5D,YAAI,OAAO,QAAS,OAAM;AAC1B,YAAI;AACF,cAAI,iBAAiB;AACnB,kBAAM,OAAO,MAAM,gDAAgD;AAAA,UACrE;AACA,gBAAM,OAAO,MAAM,+CAA+C;AAAA,QACpE,QAAQ;AACN,cAAI;AACF,kBAAM,OAAO,MAAM,UAAU;AAAA,UAC/B,SAAS,eAAe;AACtB,sBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,UAC5F;AACA,4BAAkB;AAClB,gBAAM;AAAA,QACR;AACA,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,cAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAO;AACd,UAAI,oBAAoB,CAAC,iBAAiB;AACxC,kBAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAClE,cAAM,iBAAiB,8BAA8B,QAAQ,IAAI,4BAA4B;AAAA,MAC/F;AACA,UAAI,iBAAiB;AACnB,YAAI;AAAE,gBAAM,OAAO,MAAM,UAAU;AAAG,4BAAkB;AAAA,QAAO,SACxD,eAAe;AAAE,oBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,QAAG;AAAA,MACvH;AACA,YAAM;AAAA,IACR,UAAE;AACA,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AAEF;;;AC3MA,IAAM,mBAAmB,MAAM;AAC/B,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,YAAY,SAAyB;AAC5C,QAAM,QAAQ,QAAQ,KAAK;AAC3B,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yDAAyD;AACrF,MAAI,CAAC,eAAe,KAAK,KAAK,GAAG;AAC/B,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ;AACzC,MAAI,MAAM,SAAS,QAAQ,MAAM,OAAO;AACtC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,MAAM,aAAa,kBAAkB;AACvC,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,MAAM,MAAM,SAAS,MAAM,EAAE,KAAK;AACxC,MAAI,IAAI,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,GAAG,GAAG;AACxD,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AACA,SAAO;AACT;AAEO,SAAS,gCACd,kBACA,UAC8C;AAC9C,MAAI,aAAa,OAAW,QAAO,EAAE,iBAAiB;AAEtD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,gBAAgB;AAAA,EACnC,QAAQ;AACN,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,OAAO,aAAa,iBAAiB,OAAO,aAAa,aAAa;AACxE,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AAEA,MAAI,8BAA8B,KAAK,CAAC,cAAc,OAAO,aAAa,IAAI,SAAS,CAAC,GAAG;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,aAAa,IAAI,KAAK,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,OAAO,SAAS;AACpC,SAAO,aAAa,OAAO,aAAa;AACxC,SAAO;AAAA,IACL,kBAAkB,OAAO,SAAS;AAAA,IAClC,KAAK;AAAA,MACH,IAAI,YAAY,QAAQ;AAAA,MACxB,oBAAoB;AAAA,IACtB;AAAA,EACF;AACF;;;AHnDA,SAAS,QAAQ,OAA2B,UAAkB,MAAsB;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACrG,SAAO;AACT;AAEA,eAAe,OAAsB;AACnC,QAAM,sBAAsB,cAAc,IAAI,IAAI,qBAAqB,YAAY,GAAG,CAAC;AACvF,MAAI,QAAQ,KAAK,SAAS,gBAAgB,GAAG;AAC3C,UAAMC,eAAc,QAAQ,IAAI;AAChC,QAAI,CAACA,aAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,MAChC,kBAAkBA;AAAA,MAClB,KAAK;AAAA,MACL,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI;AACF,YAAM,cAAc,eAAe,mBAAmB;AAAA,IACxD,UAAE;AACA,YAAM,cAAc,IAAI;AAAA,IAC1B;AACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,yBAAyB,KAAK;AAC5C,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,kCAAkC,KAAQ,kBAAkB;AACjG,QAAM,kBAAkB;AAAA,IACtB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,QAAQ,IAAI,iCAAiC,IAAI,oBAAoB;AAC9F,QAAM,iBAAiB;AAAA,IACrB,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,IAAI,qBAAqB;AAC9C,QAAM,OAAO,QAAQ,QAAQ,IAAI,mBAAmB,MAAM,cAAc;AACxE,QAAM,iBAAiB,QAAQ,IAAI,8BAC/B,MAAM,GAAG,EACV,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AACjB,QAAM,gBAAgB,MAAM,kBAAkB,mBAAmB;AACjE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ,IAAI;AAAA,EACd;AACA,QAAM,OAAO,IAAI,GAAG,KAAK;AAAA,IACvB,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IAChC,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,QAAQ,IAAI,oBAAoB,IAAI;AAC1C,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AACrB,MAAI;AACJ,QAAM,cAAc,YAClB,MAAM,gBAAgB,eAAe,aAAa,KAAK,MAAM,mBAAmB,aAAa;AAC/F,QAAM,cAAc,CAAC,QAAQ,UAA4B;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,qBAAqB,KAAO;AACrD,aAAO,QAAQ,QAAQ,cAAc;AAAA,IACvC;AACA,QAAI,kBAAmB,QAAO;AAC9B,QAAI;AACJ,cAAU,YAAY,EACnB,KAAK,CAAC,UAAU;AACf,uBAAiB;AACjB,2BAAqB,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,sBAAsB,QAAS,qBAAoB;AAAA,IACzD,CAAC;AACH,wBAAoB;AACpB,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,CAAC,MAAM,YAAY,IAAI,GAAG;AAC5B,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAC1D,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA,aAAa,IAAI,2BAA2B,IAAI;AAAA,IAChD,UAAU,IAAI,wBAAwB,IAAI;AAAA,IAC1C,kBAAkB,IAAI,yBAAyB,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,OAAO;AAAA,IACP,mBAAmB;AAAA,EACrB,CAAC;AAED,UAAQ,OAAO,MAAM,MAAM,MAAM;AAC/B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AAED,MAAI,WAAW;AACf,iBAAe,WAA0B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAQ,MAAM,CAAC,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,IAC5D,CAAC;AACD,UAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAAA,EACrD;AAEA,UAAQ,KAAK,UAAU,MAAM,KAAK,SAAS,CAAC;AAC5C,UAAQ,KAAK,WAAW,MAAM,KAAK,SAAS,CAAC;AAC/C;AAEA,KAAK,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3B,UAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AAClF,UAAQ,WAAW;AACrB,CAAC;","names":["row","databaseUrl"]}

package/dist/gateway.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createGateway
-} from "./chunk-P635FAN4.js";
+} from "./chunk-JUTJRAMA.js";
 import "./chunk-AWE3DFZV.js";
 import "./chunk-E4OWHGUE.js";
 import "./chunk-BZLMF5O5.js";

package/docs/architecture-v2.md

@@ -606,7 +606,13 @@ Limits apply to content bytes, payload bytes, metadata depth, target count, batc
 
 The CLI provides `init`, `doctor`, `status`, `demo`, `send`, `inbox`, `history`, `claim`, `ack`, `nack`, `watch`, `sync`, portable archive, and migration commands. Existing `post` and `get` aliases remain available.
 
-`/readyz` reports storage and schema readiness. Authenticated HTTP status reports the bound principal, provider schema, delivery counts, and the oldest due delivery. When production request authority is active, it also returns additive `gatewayAuthorityId` and `credentialId` fields. They are optional in HTTP 2.1. CLI `doctor` and `status` use a separate client-status contract that also reports local edge state and remote gateway reachability.
+`/healthz` reports HTTP process liveness without querying PostgreSQL. `/readyz` reports
+storage and schema readiness. Both probes are unauthenticated. Authenticated HTTP status
+reports the bound principal, provider schema, delivery counts, and the oldest due
+delivery. When production request authority is active, it also returns additive
+`gatewayAuthorityId` and `credentialId` fields. They are optional in HTTP 2.1. CLI
+`doctor` and `status` use a separate client-status contract that also reports local edge
+state and remote gateway reachability.
 
 Gateway responses carry a request ID, including stable error envelopes. Scope failures return required scopes under `error.details`. Rate failures return a rounded retry delay in both the HTTP header and error details. Authenticated Prometheus output counts requests, errors, timeouts, and authentication failures. Responses, metrics, and append-only security events exclude bearer tokens, hashes, database URLs, payload bodies, arbitrary metadata, and credential material.
 

package/docs/deployment.md

@@ -175,12 +175,26 @@ names and check results but never environment-variable values. A passing local c
 does not prove that an external resource exists or that deployment is safe.
 
 The long-running Fly machine may receive only the restricted
-`AGENT_BRIDGE_RUNTIME_DATABASE_URL` database authority. Do not give it
+`AGENT_BRIDGE_RUNTIME_DATABASE_URL` database authority and the public CA bundle in
+`AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64`. The gateway decodes the CA in memory,
+removes `sslmode` and `sslrootcert` from the URL, and enables certificate and hostname
+verification. It rejects the `ssl` parameter and client-certificate file parameters.
+Do not give it
 `AGENT_BRIDGE_DATABASE_URL`, `AGENT_BRIDGE_OPERATOR_DATABASE_URL`,
 `AGENT_BRIDGE_RUNTIME_PASSWORD`, a client bearer token, or a Supabase client key. The
 preflight rejects those names. Keep schema-owner, control-operator, archive, and DR
 authority in separate operator jobs.
 
+Import both runtime secrets through stdin so neither value appears in command
+arguments or a temporary file:
+
+```bash
+{
+  printf 'AGENT_BRIDGE_RUNTIME_DATABASE_URL=%s\n' "$(tr -d '\r\n' < runtime-url)"
+  printf 'AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64=%s\n' "$(base64 < database-ca.pem | tr -d '\r\n')"
+} | fly secrets import --stage --app <app>
+```
+
 ### Operator order and gates
 
 The following actions change external state and require an operator gate. The
@@ -213,9 +227,8 @@ repository does not perform them:
    runtime password to that job only. The bootstrap is transactional and changes an
    existing login only when its attributes, ownership, and membership graph already
    match the recorded runtime contract. It never adopts a restored `NOLOGIN` shell.
-6. Construct the restricted runtime URL, set only
-   `AGENT_BRIDGE_RUNTIME_DATABASE_URL` on the Fly app, and run the app-aware read-only
-   preflight.
+6. Construct the restricted runtime URL. Import it and the base64-encoded PostgreSQL CA
+   as the two runtime secrets shown above, then run the app-aware read-only preflight.
 7. Deploy the immutable image with `fly deploy --config deploy/fly.toml --app <app>`.
    Require `/readyz` before routing clients.
 8. Run authenticated capability and status probes, then publish, pull, claim, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@creatornader/agent-bridge",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Durable, pull-first mailbox and work-delivery control plane for AI agents across runtimes, sessions, and machines.",
   "type": "module",
   "license": "Apache-2.0",

package/dist/chunk-P635FAN4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/gateway.ts","../src/gateway-auth.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { createServer, type IncomingMessage, type ServerResponse } from \"node:http\";\nimport { BridgePrincipalMismatchError, BridgeValidationError, type MessageDraft } from \"./bridge-domain.js\";\nimport { BridgeService } from \"./bridge-service.js\";\nimport type { BridgeStore } from \"./bridge-store.js\";\nimport { bearerToken, hashCredential, type CredentialResolver } from \"./gateway-auth.js\";\nimport type { GatewaySecurity } from \"./gateway-security.js\";\nimport type { RequestAuthority, RequestAuthorityContext } from \"./postgres-request-authority.js\";\nimport {\n  capabilityDocument,\n  ContractResponseError,\n  ContractValidationError,\n  LEGACY_PROTOCOL_VERSION,\n  negotiateProtocolVersion,\n  operationContract,\n  parseResponse,\n  PROTOCOL_HEADER,\n  PROTOCOL_VERSION,\n  SUPPORTED_PROTOCOL_HEADER,\n  SUPPORTED_PROTOCOL_VERSIONS,\n  type OperationId,\n  validateRequest,\n  validateRequestForProtocol,\n} from \"./contracts/registry.js\";\n\nexport interface GatewayOptions {\n  store: BridgeStore;\n  credentials: CredentialResolver;\n  security: GatewaySecurity;\n  allowedOrigins?: string[];\n  bodyLimitBytes?: number;\n  requestDeadlineMs?: number;\n  ready?: () => Promise<boolean>;\n  /** Reports whether the configured database has verified row isolation. */\n  rowIsolationReady?: () => Promise<boolean>;\n  /** Production PostgreSQL request authority. Other providers omit this. */\n  requestAuthority?: RequestAuthority;\n}\n\ntype Metrics = { requests: number; errors: number; timeouts: number; authFailures: number };\nconst jsonHeaders = { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" };\n\ninterface ResponseWriter {\n  readonly writableEnded: boolean;\n  getHeader(name: string): string | number | readonly string[] | undefined;\n  setHeader(name: string, value: string | number | readonly string[]): unknown;\n  writeHead(status: number, headers?: any): unknown;\n  end(chunk?: any): unknown;\n}\n\nclass BufferedResponse implements ResponseWriter {\n  private readonly headers = new Map<string, string | number | readonly string[]>();\n  private status: number | undefined;\n  private headHeaders: any;\n  private body: any;\n\n  constructor(private readonly target: ServerResponse) {}\n  get writableEnded(): boolean { return this.body !== undefined; }\n  getHeader(name: string) { return this.headers.get(name.toLowerCase()) ?? this.target.getHeader(name); }\n  setHeader(name: string, value: string | number | readonly string[]) { this.headers.set(name.toLowerCase(), value); return this; }\n  writeHead(status: number, headers?: any) {\n    this.status = status;\n    this.headHeaders = headers;\n    return this;\n  }\n  end(chunk?: any) { this.body = chunk ?? null; return this; }\n  flush(): void {\n    if (this.target.writableEnded) return;\n    for (const [name, value] of this.headers) this.target.setHeader(name, value);\n    if (this.status !== undefined) this.target.writeHead(this.status, this.headHeaders);\n    if (this.body !== undefined) this.target.end(this.body);\n  }\n}\n\nfunction send(res: ResponseWriter, status: number, value: unknown, requestId: string): void {\n  if (res.writableEnded) return;\n  res.writeHead(status, {\n    ...jsonHeaders,\n    \"x-request-id\": requestId,\n  });\n  res.end(JSON.stringify(value));\n}\n\nfunction sendOperation(res: ResponseWriter, status: number, operation: string, value: unknown, requestId: string): void {\n  const canonical = parseResponse(operation, value) as Record<string, unknown>;\n  const protocolVersion = String(res.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n  if (protocolVersion !== LEGACY_PROTOCOL_VERSION) {\n    send(res, status, canonical, requestId);\n    return;\n  }\n  if (operation === \"claim_delivery\") {\n    send(res, status, canonical.delivery === null ? null : canonical, requestId);\n    return;\n  }\n  if ([\"cancel_delivery\", \"requeue_delivery\", \"extend_delivery\", \"acknowledge_delivery\", \"negative_acknowledge_delivery\"].includes(operation)) {\n    send(res, status, canonical.delivery, requestId);\n    return;\n  }\n  send(res, status, canonical, requestId);\n}\n\nfunction failure(\n  res: ResponseWriter,\n  status: number,\n  code: string,\n  requestId: string,\n  details: Record<string, unknown> = {},\n): void {\n  send(res, status, { error: { code, requestId, ...details } }, requestId);\n}\n\nasync function body(\n  req: IncomingMessage,\n  limit: number,\n  signal: AbortSignal,\n): Promise<Record<string, any>> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    const cleanup = () => {\n      req.off(\"data\", onData);\n      req.off(\"end\", onEnd);\n      req.off(\"error\", onError);\n      signal.removeEventListener(\"abort\", onAbort);\n    };\n    const finish = (callback: () => void) => {\n      cleanup();\n      callback();\n    };\n    const onData = (chunk: Buffer | string) => {\n      const buffer = Buffer.from(chunk);\n      size += buffer.length;\n      if (size > limit) {\n        finish(() => reject(Object.assign(new Error(\"body too large\"), {\n          status: 413,\n          code: \"body_too_large\",\n        })));\n        req.resume();\n        return;\n      }\n      chunks.push(buffer);\n    };\n    const onEnd = () => finish(() => {\n      if (!size) {\n        resolve({});\n        return;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n        if (!parsed || Array.isArray(parsed) || typeof parsed !== \"object\") throw new Error();\n        resolve(parsed);\n      } catch {\n        reject(Object.assign(new Error(\"invalid JSON\"), { status: 400, code: \"malformed_json\" }));\n      }\n    });\n    const onError = (error: Error) => finish(() => reject(error));\n    const onAbort = () => {\n      finish(() => reject(signal.reason));\n      req.resume();\n    };\n    req.on(\"data\", onData);\n    req.on(\"end\", onEnd);\n    req.on(\"error\", onError);\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    if (signal.aborted) onAbort();\n  });\n}\n\nasync function jsonBody(\n  req: IncomingMessage,\n  limit: number,\n  signal: AbortSignal,\n): Promise<Record<string, any>> {\n  if (hasRequestBody(req) && req.headers[\"content-type\"]?.split(\";\", 1)[0] !== \"application/json\") {\n    throw Object.assign(new Error(\"unsupported media type\"), {\n      status: 415,\n      code: \"unsupported_media_type\",\n    });\n  }\n  return body(req, limit, signal);\n}\n\nfunction numberParam(value: string | null, name: string): number | undefined {\n  if (value === null) return undefined;\n  const result = Number(value);\n  if (!Number.isSafeInteger(result)) throw new BridgeValidationError(`${name} is invalid`);\n  return result;\n}\n\nfunction booleanParam(value: string | null, name: string): boolean | undefined {\n  if (value === null) return undefined;\n  if (value === \"true\") return true;\n  if (value === \"false\") return false;\n  throw new BridgeValidationError(`${name} must be true or false`);\n}\n\nfunction hasRequestBody(req: IncomingMessage): boolean {\n  const length = req.headers[\"content-length\"];\n  return req.headers[\"transfer-encoding\"] !== undefined || (length !== undefined && length !== \"0\");\n}\n\nfunction pathBoundInput(\n  operation: string,\n  deliveryId: string,\n  rawInput: Record<string, unknown>,\n  protocolVersion?: string,\n): Record<string, unknown> {\n  if (Object.prototype.hasOwnProperty.call(rawInput, \"deliveryId\")) {\n    throw new ContractValidationError(operation, [{ path: \"/deliveryId\", message: \"deliveryId is supplied by the request path\" }]);\n  }\n  const value = { ...rawInput, deliveryId };\n  return protocolVersion\n    ? validateRequestForProtocol(operation, value, protocolVersion)\n    : validateRequest(operation, value);\n}\n\nfunction active(signal: AbortSignal): void {\n  if (signal.aborted) throw signal.reason;\n}\n\nfunction closedQuery(url: URL, operation: string, allowed: readonly string[]): void {\n  const unknown = [...url.searchParams.keys()].find((key) => !allowed.includes(key));\n  if (unknown) throw new ContractValidationError(operation, [{ path: `/${unknown}`, message: \"Unexpected query parameter\" }]);\n}\n\nfunction selectedProtocol(res: ResponseWriter): string {\n  return String(res.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n}\n\nfunction requireCurrentProtocol(res: ResponseWriter): void {\n  if (selectedProtocol(res) === LEGACY_PROTOCOL_VERSION) {\n    const error = new Error(\"Operation is not available in protocol 2.0\") as Error & { status: number; code: string };\n    error.status = 404;\n    error.code = \"not_found\";\n    throw error;\n  }\n}\n\nexport function createGateway(options: GatewayOptions) {\n  const metrics: Metrics = { requests: 0, errors: 0, timeouts: 0, authFailures: 0 };\n  const limit = options.bodyLimitBytes ?? 128 * 1024;\n  const deadline = options.requestDeadlineMs ?? 10_000;\n  const origins = new Set(options.allowedOrigins ?? []);\n\n  return createServer((req, res) => {\n    const requestId = randomUUID();\n    const abort = new AbortController();\n    let mutationStarted = false;\n    metrics.requests += 1;\n    const requestedProtocol = req.headers[PROTOCOL_HEADER];\n    const rawRequestedProtocol = Array.isArray(requestedProtocol) ? requestedProtocol[0] : requestedProtocol;\n    const initialProtocol = rawRequestedProtocol === undefined || rawRequestedProtocol.trim() === \"\"\n      ? LEGACY_PROTOCOL_VERSION\n      : (SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(rawRequestedProtocol.trim())\n        ? rawRequestedProtocol.trim()\n        : PROTOCOL_VERSION;\n    res.setHeader(PROTOCOL_HEADER, initialProtocol);\n    res.setHeader(SUPPORTED_PROTOCOL_HEADER, SUPPORTED_PROTOCOL_VERSIONS.join(\",\"));\n    const timer = setTimeout(() => {\n      abort.abort(new Error(\"request deadline exceeded\"));\n      metrics.timeouts += 1; metrics.errors += 1;\n      res.once(\"finish\", () => {\n        if (!req.complete) req.destroy();\n      });\n      failure(\n        res,\n        504,\n        mutationStarted ? \"mutation_outcome_unknown\" : \"request_timeout\",\n        requestId,\n      );\n    }, deadline);\n    let parsedBody: Promise<Record<string, any>> | undefined;\n    const requestBody = () => parsedBody ??= jsonBody(req, limit, abort.signal);\n\n    const dispatch = async (authority?: RequestAuthorityContext, response: ResponseWriter = res): Promise<void> => {\n      const url = new URL(req.url ?? \"/\", \"http://gateway.invalid\");\n      if (req.method === \"GET\" && url.pathname === \"/readyz\") {\n        let ready = false;\n        try {\n          ready = await (options.ready?.() ?? options.store.initialize().then(() => true));\n        } catch {\n          ready = false;\n        }\n        send(response, ready ? 200 : 503, { status: ready ? \"ready\" : \"not_ready\" }, requestId);\n        return;\n      }\n      const origin = req.headers.origin;\n      if (origin && !origins.has(origin)) {\n        failure(response, 403, \"origin_forbidden\", requestId); return;\n      }\n      const token = bearerToken(req.headers.authorization);\n      if (options.requestAuthority && !authority) {\n        if (!token) {\n          metrics.authFailures += 1;\n          failure(response, 401, \"unauthorized\", requestId); return;\n        }\n        const preflight = await options.credentials.resolve(token, abort.signal);\n        active(abort.signal);\n        if (!preflight) {\n          metrics.authFailures += 1;\n          failure(response, 401, \"unauthorized\", requestId); return;\n        }\n        if (hasRequestBody(req)) await requestBody();\n        active(abort.signal);\n        const buffered = new BufferedResponse(res);\n        await options.requestAuthority!.run(\n          preflight.id,\n          hashCredential(token),\n          requestId,\n          abort.signal,\n          (context) => dispatch(context, buffered),\n        );\n        active(abort.signal);\n        buffered.flush();\n        return;\n      }\n      const credential = authority?.credential ?? (token ? await options.credentials.resolve(token, abort.signal) : null);\n      active(abort.signal);\n      if (!credential) {\n        metrics.authFailures += 1;\n        failure(response, 401, \"unauthorized\", requestId); return;\n      }\n      if (!Array.isArray(credential.scopes)) {\n        failure(response, 503, \"security_unavailable\", requestId); return;\n      }\n      const service = new BridgeService(authority?.store ?? options.store);\n      const security = authority?.security ?? options.security;\n      if (url.pathname.startsWith(\"/v2/\") || url.pathname === \"/metrics\") {\n        response.setHeader(PROTOCOL_HEADER, negotiateProtocolVersion(req.headers[PROTOCOL_HEADER]));\n      }\n      const authorize = async (operationId: OperationId): Promise<void> => {\n        const requiredScopes = operationContract(operationId).scopes;\n        if (requiredScopes.some((scope) => !credential.scopes.includes(scope))) {\n          try {\n            await security.recordScopeDenial(credential.id, operationId, requestId, abort.signal);\n          } catch {\n            throw Object.assign(new Error(\"Scope denial could not be audited\"), {\n              status: 503,\n              code: \"security_unavailable\",\n            });\n          }\n          throw Object.assign(new Error(\"Credential lacks a required scope\"), {\n            status: 403, code: \"insufficient_scope\", requiredScopes,\n          });\n        }\n        let decision;\n        try {\n          decision = await security.consume(credential.id, operationId, requestId, abort.signal);\n        } catch {\n          throw Object.assign(new Error(\"Rate limit state is unavailable\"), {\n            status: 503,\n            code: \"security_unavailable\",\n          });\n        }\n        if (!decision.allowed) {\n          const retryAfter = Math.max(1, Math.ceil(decision.retryAfterSeconds));\n          response.setHeader(\"retry-after\", String(retryAfter));\n          throw Object.assign(new Error(\"Credential rate limit exceeded\"), {\n            status: 429, code: \"rate_limited\", retryAfterSeconds: retryAfter,\n          });\n        }\n      };\n      if (req.method === \"GET\" && url.pathname === \"/metrics\") {\n        await authorize(\"gateway_metrics\");\n        validateRequest(\"gateway_metrics\", {});\n        const result = Object.entries(metrics).map(([key, value]) => `agent_bridge_gateway_${key}_total ${value}`).join(\"\\n\") + \"\\n\";\n        parseResponse(\"gateway_metrics\", result);\n        response.writeHead(200, {\n          ...jsonHeaders,\n          \"content-type\": \"text/plain; version=0.0.4\",\n          \"x-request-id\": requestId,\n        });\n        response.end(result);\n        return;\n      }\n      const instanceHeader = req.headers[\"x-agent-bridge-instance\"];\n      const principal = {\n        ...credential.principal,\n        instance: Array.isArray(instanceHeader) ? instanceHeader[0] : instanceHeader,\n      };\n\n      if (req.method === \"GET\" && url.pathname === \"/v2/capabilities\") {\n        requireCurrentProtocol(response);\n        await authorize(\"capabilities\");\n        closedQuery(url, \"capabilities\", []);\n        validateRequest(\"capabilities\", {});\n        let rowIsolation = false;\n        if (options.requestAuthority && options.rowIsolationReady) {\n          try {\n            rowIsolation = await options.rowIsolationReady();\n          } catch {\n            rowIsolation = false;\n          }\n        }\n        sendOperation(response, 200, \"capabilities\", {\n          ...capabilityDocument({\n            surface: \"http\",\n            provider: \"gateway\",\n            selectedProtocolVersion: String(response.getHeader(PROTOCOL_HEADER)),\n            requestAuthority: Boolean(options.requestAuthority),\n            rowIsolation,\n          }),\n          grantedScopes: [...credential.scopes],\n        }, requestId); return;\n      }\n\n      if (req.method === \"GET\" && url.pathname === \"/v2/status\") {\n        await authorize(\"status\");\n        closedQuery(url, \"status\", []);\n        validateRequest(\"status\", {});\n        const activeStore = authority?.store ?? options.store;\n        const authorityBinding = authority && response.getHeader(PROTOCOL_HEADER) === PROTOCOL_VERSION ? {\n          gatewayAuthorityId: authority.gatewayAuthorityId,\n          credentialId: authority.credential.id,\n        } : {};\n        if (!activeStore.diagnostics) {\n          sendOperation(response, 200, \"status\", { schemaVersion: \"postgres-v2\", deliverySupported: false, pending: null, claimed: null, retrying: null, dead: null, ...authorityBinding, principal: credential.principal }, requestId);\n        } else {\n          sendOperation(response, 200, \"status\", { ...await activeStore.diagnostics(principal), ...authorityBinding, principal: credential.principal }, requestId);\n        }\n        return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/endpoint-migration-challenges\") {\n        requireCurrentProtocol(response);\n        await authorize(\"issue_endpoint_migration_challenge\");\n        const input = validateRequestForProtocol(\"issue_endpoint_migration_challenge\", await requestBody(), selectedProtocol(response));\n        if (!authority?.endpointMigrationChallenges) throw Object.assign(new Error(\"endpoint migration challenges require request authority\"), { status: 503, code: \"security_unavailable\" });\n        active(abort.signal);\n        await authority.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"issue_endpoint_migration_challenge\", await authority.endpointMigrationChallenges.issue({\n          challenge: String(input.challenge),\n          expectedGatewayAuthorityId: String(input.expectedGatewayAuthorityId),\n          verifierCredentialId: String(input.verifierCredentialId),\n        }), requestId); return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/endpoint-migration-challenges/consume\") {\n        requireCurrentProtocol(response);\n        await authorize(\"consume_endpoint_migration_challenge\");\n        const input = validateRequestForProtocol(\"consume_endpoint_migration_challenge\", await requestBody(), selectedProtocol(response));\n        if (!authority?.endpointMigrationChallenges) throw Object.assign(new Error(\"endpoint migration challenges require request authority\"), { status: 503, code: \"security_unavailable\" });\n        active(abort.signal);\n        await authority.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"consume_endpoint_migration_challenge\", await authority.endpointMigrationChallenges.consume({\n          challenge: String(input.challenge),\n          expectedGatewayAuthorityId: String(input.expectedGatewayAuthorityId),\n          issuerCredentialId: String(input.issuerCredentialId),\n        }), requestId); return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/messages\") {\n        await authorize(\"publish_message\");\n        const input = validateRequestForProtocol(\"publish_message\", await requestBody(), String(response.getHeader(PROTOCOL_HEADER)));\n        if (input.source !== undefined && input.source !== principal.agent) {\n          throw new BridgePrincipalMismatchError(\"source must match the authenticated principal\");\n        }\n        const { source: _source, ...draft } = input;\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 201, \"publish_message\", await service.publish(principal, draft as unknown as MessageDraft), requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/history\") {\n        await authorize(\"history\");\n        closedQuery(url, \"history\", [\"cursor\", \"mailbox\", \"receiptState\", \"limit\", \"type\", \"includeExpired\", \"source\", \"project\", \"since\", \"unacknowledgedBy\", \"unacked_by\", \"threadId\", \"latest\"]);\n        const types = url.searchParams.getAll(\"type\");\n        const input = validateRequestForProtocol(\"history\", {\n          cursor: url.searchParams.get(\"cursor\") ?? undefined,\n          mailbox: url.searchParams.get(\"mailbox\") ?? undefined as any,\n          receiptState: url.searchParams.get(\"receiptState\") ?? undefined as any,\n          limit: numberParam(url.searchParams.get(\"limit\"), \"limit\"),\n          types: types.length ? types : undefined,\n          includeExpired: booleanParam(url.searchParams.get(\"includeExpired\"), \"includeExpired\"),\n          source: url.searchParams.get(\"source\") ?? undefined,\n          project: url.searchParams.get(\"project\") ?? undefined,\n          since: url.searchParams.get(\"since\") ?? undefined,\n          unacknowledgedBy: url.searchParams.get(\"unacknowledgedBy\") ?? url.searchParams.get(\"unacked_by\") ?? undefined,\n          threadId: url.searchParams.get(\"threadId\") ?? undefined,\n          latest: booleanParam(url.searchParams.get(\"latest\"), \"latest\"),\n        }, String(response.getHeader(PROTOCOL_HEADER)));\n        sendOperation(response, 200, \"history\", await service.history(principal, input), requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/receipts\") {\n        await authorize(\"record_receipt\");\n        const input = validateRequest(\"record_receipt\", await requestBody());\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"record_receipt\", { recorded: await service.acknowledge(principal, input.messageIds as string[]) }, requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/deliveries/claim\") {\n        await authorize(\"claim_delivery\");\n        const input = validateRequestForProtocol(\"claim_delivery\", await requestBody(), selectedProtocol(response));\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"claim_delivery\", await service.claim(principal, input) ?? { delivery: null }, requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/deliveries\") {\n        requireCurrentProtocol(response);\n        await authorize(\"list_deliveries\");\n        closedQuery(url, \"list_deliveries\", [\"cursor\", \"limit\", \"role\", \"messageId\", \"recipient\", \"state\"]);\n        const input = validateRequest(\"list_deliveries\", {cursor:url.searchParams.get(\"cursor\")??undefined,limit:numberParam(url.searchParams.get(\"limit\"),\"limit\"),role:url.searchParams.get(\"role\")??undefined,messageId:url.searchParams.get(\"messageId\")??undefined,recipient:url.searchParams.get(\"recipient\")??undefined,states:url.searchParams.getAll(\"state\")});\n        sendOperation(response,200,\"list_deliveries\",await service.deliveries(principal,input as any),requestId);return;\n      }\n      const eventsMatch=url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/events$/);\n      if(req.method===\"GET\"&&eventsMatch){requireCurrentProtocol(response);await authorize(\"list_delivery_events\");closedQuery(url,\"list_delivery_events\",[\"cursor\",\"limit\"]);const input=validateRequest(\"list_delivery_events\",{deliveryId:eventsMatch[1],cursor:url.searchParams.get(\"cursor\")??undefined,limit:numberParam(url.searchParams.get(\"limit\"),\"limit\")});sendOperation(response,200,\"list_delivery_events\",await service.deliveryEvents(principal,eventsMatch[1]!,input as any),requestId);return;}\n      const controlMatch=url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/(cancel|requeue)$/);\n      if(req.method===\"POST\"&&controlMatch){requireCurrentProtocol(response);const operation=controlMatch[2]===\"cancel\"?\"cancel_delivery\":\"requeue_delivery\";await authorize(operation);pathBoundInput(operation,controlMatch[1]!,await requestBody());await authority?.beginDomainWork();mutationStarted=true;const result=controlMatch[2]===\"cancel\"?await service.cancel(principal,controlMatch[1]!):await service.requeue(principal,controlMatch[1]!);if(!result)failure(response,404,\"not_found\",requestId);else sendOperation(response,200,operation,{delivery:result},requestId);return;}\n      if (req.method === \"POST\" && url.pathname === \"/v2/presence/heartbeat\") {\n        await authorize(\"heartbeat\");\n        const input = validateRequest(\"heartbeat\", await requestBody());\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"heartbeat\", await service.heartbeat(principal, input), requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/presence\") {\n        await authorize(\"presence\");\n        closedQuery(url, \"presence\", []);\n        validateRequest(\"presence\", {});\n        sendOperation(response, 200, \"presence\", { agents: await service.presence(principal) }, requestId); return;\n      }\n      const match = url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/(extend|ack|nack)$/);\n      if (req.method === \"POST\" && match) {\n        const operationId = match[2] === \"extend\" ? \"extend_delivery\" : match[2] === \"ack\" ? \"acknowledge_delivery\" : \"negative_acknowledge_delivery\";\n        await authorize(operationId);\n        const rawInput = await requestBody();\n        const protocolVersion = String(response.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n        const input = pathBoundInput(operationId, match[1]!, rawInput, protocolVersion);\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        const [, id, action] = match;\n        const result = action === \"extend\"\n          ? await service.extend(principal, id, input.leaseToken as string, input.leaseMs as number)\n          : action === \"ack\"\n            ? await service.ack(principal, id, input.leaseToken as string)\n            : await service.nack(\n                principal,\n                id,\n                input.leaseToken as string,\n                (input.error as string | undefined) ?? \"negative acknowledgment\",\n                (input.disposition ?? input.dead ?? \"retry\") as \"retry\" | \"dead\" | boolean,\n                input.retryPolicy,\n              );\n        if (!result) failure(response, 409, \"lease_conflict\", requestId);\n        else sendOperation(response, 200, operationId, { delivery: result }, requestId);\n        return;\n      }\n      failure(response, 404, \"not_found\", requestId);\n    };\n    void dispatch().catch((error: any) => {\n      if (res.writableEnded) return;\n      metrics.errors += 1;\n      if (error instanceof ContractValidationError || error instanceof ContractResponseError) {\n        failure(res, error.status, error.code, requestId, { operation: error.operation, issues: error.issues });\n      } else if (error?.status === 426) {\n        failure(res, 426, error.code, requestId, { supportedProtocolVersions: [...SUPPORTED_PROTOCOL_VERSIONS] });\n      } else if (error?.code === \"insufficient_scope\") {\n        failure(res, 403, error.code, requestId, { details: { requiredScopes: [...error.requiredScopes] } });\n      } else if (error?.code === \"rate_limited\") {\n        res.setHeader(\"retry-after\", String(error.retryAfterSeconds));\n        failure(res, 429, error.code, requestId, { details: { retryAfterSeconds: error.retryAfterSeconds } });\n      } else if (error instanceof BridgeValidationError || error instanceof BridgePrincipalMismatchError) {\n        failure(res, \"status\" in error ? error.status : 400, error.code, requestId, { message: error.message });\n      } else {\n        failure(res, error?.status ?? 500, error?.code ?? \"internal_error\", requestId);\n      }\n    }).finally(() => clearTimeout(timer));\n  });\n}\n","import { createHash, timingSafeEqual } from \"node:crypto\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport type { PgQueryable } from \"./postgres-bridge-store.js\";\n\nexport interface AuthenticatedCredential {\n  id: string;\n  principal: BridgePrincipal;\n  /** Canonical authorization scopes granted to this credential. */\n  scopes: readonly AuthorizationScope[];\n}\n\nexport interface CredentialResolver {\n  resolve(token: string, signal?: AbortSignal): Promise<AuthenticatedCredential | null>;\n}\n\nexport function hashCredential(token: string): string {\n  return createHash(\"sha256\").update(token, \"utf8\").digest(\"hex\");\n}\n\nexport class PostgresCredentialResolver implements CredentialResolver {\n  constructor(private readonly db: PgQueryable) {}\n\n  async resolve(token: string, signal?: AbortSignal): Promise<AuthenticatedCredential | null> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      credential_id: string; workspace_id: string; principal: string; scopes: AuthorizationScope[];\n    }>(\n      `SELECT credential_id,workspace_id,principal,scopes\n       FROM agent_bridge.resolve_credential_hash($1::text)`,\n      [hashCredential(token)],\n    );\n    const row = result.rows[0];\n    if (signal?.aborted) throw signal.reason;\n    return row ? {\n      id: row.credential_id,\n      principal: { workspace: row.workspace_id, agent: row.principal },\n      scopes: row.scopes,\n    } : null;\n  }\n}\n\nexport function bearerToken(value: string | undefined): string | null {\n  if (!value?.startsWith(\"Bearer \")) return null;\n  const token = value.slice(7);\n  if (!token || token.length > 4096 || /\\s/.test(token)) return null;\n  return token;\n}\n\nexport function safeTokenHashEqual(token: string, expectedHash: string): boolean {\n  const actual = Buffer.from(hashCredential(token));\n  const expected = Buffer.from(expectedHash);\n  return actual.length === expected.length && timingSafeEqual(actual, expected);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAA+D;;;ACDxE,SAAS,YAAY,uBAAuB;AAgBrC,SAAS,eAAe,OAAuB;AACpD,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,KAAK;AAChE;AAEO,IAAM,6BAAN,MAA+D;AAAA,EACpE,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAE/C,MAAM,QAAQ,OAAe,QAA+D;AAC1F,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAG3B;AAAA;AAAA,MAEA,CAAC,eAAe,KAAK,CAAC;AAAA,IACxB;AACA,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,WAAO,MAAM;AAAA,MACX,IAAI,IAAI;AAAA,MACR,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU;AAAA,MAC/D,QAAQ,IAAI;AAAA,IACd,IAAI;AAAA,EACN;AACF;AAEO,SAAS,YAAY,OAA0C;AACpE,MAAI,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AAC1C,QAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,MAAI,CAAC,SAAS,MAAM,SAAS,QAAQ,KAAK,KAAK,KAAK,EAAG,QAAO;AAC9D,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAe,cAA+B;AAC/E,QAAM,SAAS,OAAO,KAAK,eAAe,KAAK,CAAC;AAChD,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,SAAO,OAAO,WAAW,SAAS,UAAU,gBAAgB,QAAQ,QAAQ;AAC9E;;;ADbA,IAAM,cAAc,EAAE,gBAAgB,mCAAmC,iBAAiB,WAAW;AAUrG,IAAM,mBAAN,MAAiD;AAAA,EAM/C,YAA6B,QAAwB;AAAxB;AAL7B,SAAiB,UAAU,oBAAI,IAAiD;AAAA,EAK1B;AAAA,EACtD,IAAI,gBAAyB;AAAE,WAAO,KAAK,SAAS;AAAA,EAAW;AAAA,EAC/D,UAAU,MAAc;AAAE,WAAO,KAAK,QAAQ,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,OAAO,UAAU,IAAI;AAAA,EAAG;AAAA,EACtG,UAAU,MAAc,OAA4C;AAAE,SAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,KAAK;AAAG,WAAO;AAAA,EAAM;AAAA,EAChI,UAAU,QAAgB,SAAe;AACvC,SAAK,SAAS;AACd,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA,EACA,IAAI,OAAa;AAAE,SAAK,OAAO,SAAS;AAAM,WAAO;AAAA,EAAM;AAAA,EAC3D,QAAc;AACZ,QAAI,KAAK,OAAO,cAAe;AAC/B,eAAW,CAAC,MAAM,KAAK,KAAK,KAAK,QAAS,MAAK,OAAO,UAAU,MAAM,KAAK;AAC3E,QAAI,KAAK,WAAW,OAAW,MAAK,OAAO,UAAU,KAAK,QAAQ,KAAK,WAAW;AAClF,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACF;AAEA,SAAS,KAAK,KAAqB,QAAgB,OAAgB,WAAyB;AAC1F,MAAI,IAAI,cAAe;AACvB,MAAI,UAAU,QAAQ;AAAA,IACpB,GAAG;AAAA,IACH,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,IAAI,KAAK,UAAU,KAAK,CAAC;AAC/B;AAEA,SAAS,cAAc,KAAqB,QAAgB,WAAmB,OAAgB,WAAyB;AACtH,QAAM,YAAY,cAAc,WAAW,KAAK;AAChD,QAAM,kBAAkB,OAAO,IAAI,UAAU,eAAe,KAAK,gBAAgB;AACjF,MAAI,oBAAoB,yBAAyB;AAC/C,SAAK,KAAK,QAAQ,WAAW,SAAS;AACtC;AAAA,EACF;AACA,MAAI,cAAc,kBAAkB;AAClC,SAAK,KAAK,QAAQ,UAAU,aAAa,OAAO,OAAO,WAAW,SAAS;AAC3E;AAAA,EACF;AACA,MAAI,CAAC,mBAAmB,oBAAoB,mBAAmB,wBAAwB,+BAA+B,EAAE,SAAS,SAAS,GAAG;AAC3I,SAAK,KAAK,QAAQ,UAAU,UAAU,SAAS;AAC/C;AAAA,EACF;AACA,OAAK,KAAK,QAAQ,WAAW,SAAS;AACxC;AAEA,SAAS,QACP,KACA,QACA,MACA,WACA,UAAmC,CAAC,GAC9B;AACN,OAAK,KAAK,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,GAAG,QAAQ,EAAE,GAAG,SAAS;AACzE;AAEA,eAAe,KACb,KACA,OACA,QAC8B;AAC9B,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,OAAO;AACX,UAAM,UAAU,MAAM;AACpB,UAAI,IAAI,QAAQ,MAAM;AACtB,UAAI,IAAI,OAAO,KAAK;AACpB,UAAI,IAAI,SAAS,OAAO;AACxB,aAAO,oBAAoB,SAAS,OAAO;AAAA,IAC7C;AACA,UAAM,SAAS,CAAC,aAAyB;AACvC,cAAQ;AACR,eAAS;AAAA,IACX;AACA,UAAM,SAAS,CAAC,UAA2B;AACzC,YAAM,SAAS,OAAO,KAAK,KAAK;AAChC,cAAQ,OAAO;AACf,UAAI,OAAO,OAAO;AAChB,eAAO,MAAM,OAAO,OAAO,OAAO,IAAI,MAAM,gBAAgB,GAAG;AAAA,UAC7D,QAAQ;AAAA,UACR,MAAM;AAAA,QACR,CAAC,CAAC,CAAC;AACH,YAAI,OAAO;AACX;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,QAAQ,MAAM,OAAO,MAAM;AAC/B,UAAI,CAAC,MAAM;AACT,gBAAQ,CAAC,CAAC;AACV;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAChE,YAAI,CAAC,UAAU,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM;AACpF,gBAAQ,MAAM;AAAA,MAChB,QAAQ;AACN,eAAO,OAAO,OAAO,IAAI,MAAM,cAAc,GAAG,EAAE,QAAQ,KAAK,MAAM,iBAAiB,CAAC,CAAC;AAAA,MAC1F;AAAA,IACF,CAAC;AACD,UAAM,UAAU,CAAC,UAAiB,OAAO,MAAM,OAAO,KAAK,CAAC;AAC5D,UAAM,UAAU,MAAM;AACpB,aAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAClC,UAAI,OAAO;AAAA,IACb;AACA,QAAI,GAAG,QAAQ,MAAM;AACrB,QAAI,GAAG,OAAO,KAAK;AACnB,QAAI,GAAG,SAAS,OAAO;AACvB,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,QAAI,OAAO,QAAS,SAAQ;AAAA,EAC9B,CAAC;AACH;AAEA,eAAe,SACb,KACA,OACA,QAC8B;AAC9B,MAAI,eAAe,GAAG,KAAK,IAAI,QAAQ,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,oBAAoB;AAC/F,UAAM,OAAO,OAAO,IAAI,MAAM,wBAAwB,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,KAAK,KAAK,OAAO,MAAM;AAChC;AAEA,SAAS,YAAY,OAAsB,MAAkC;AAC3E,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,EAAG,OAAM,IAAI,sBAAsB,GAAG,IAAI,aAAa;AACvF,SAAO;AACT;AAEA,SAAS,aAAa,OAAsB,MAAmC;AAC7E,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAC9B,QAAM,IAAI,sBAAsB,GAAG,IAAI,wBAAwB;AACjE;AAEA,SAAS,eAAe,KAA+B;AACrD,QAAM,SAAS,IAAI,QAAQ,gBAAgB;AAC3C,SAAO,IAAI,QAAQ,mBAAmB,MAAM,UAAc,WAAW,UAAa,WAAW;AAC/F;AAEA,SAAS,eACP,WACA,YACA,UACA,iBACyB;AACzB,MAAI,OAAO,UAAU,eAAe,KAAK,UAAU,YAAY,GAAG;AAChE,UAAM,IAAI,wBAAwB,WAAW,CAAC,EAAE,MAAM,eAAe,SAAS,6CAA6C,CAAC,CAAC;AAAA,EAC/H;AACA,QAAM,QAAQ,EAAE,GAAG,UAAU,WAAW;AACxC,SAAO,kBACH,2BAA2B,WAAW,OAAO,eAAe,IAC5D,gBAAgB,WAAW,KAAK;AACtC;AAEA,SAAS,OAAO,QAA2B;AACzC,MAAI,OAAO,QAAS,OAAM,OAAO;AACnC;AAEA,SAAS,YAAY,KAAU,WAAmB,SAAkC;AAClF,QAAM,UAAU,CAAC,GAAG,IAAI,aAAa,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;AACjF,MAAI,QAAS,OAAM,IAAI,wBAAwB,WAAW,CAAC,EAAE,MAAM,IAAI,OAAO,IAAI,SAAS,6BAA6B,CAAC,CAAC;AAC5H;AAEA,SAAS,iBAAiB,KAA6B;AACrD,SAAO,OAAO,IAAI,UAAU,eAAe,KAAK,gBAAgB;AAClE;AAEA,SAAS,uBAAuB,KAA2B;AACzD,MAAI,iBAAiB,GAAG,MAAM,yBAAyB;AACrD,UAAM,QAAQ,IAAI,MAAM,4CAA4C;AACpE,UAAM,SAAS;AACf,UAAM,OAAO;AACb,UAAM;AAAA,EACR;AACF;AAEO,SAAS,cAAc,SAAyB;AACrD,QAAM,UAAmB,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,EAAE;AAChF,QAAM,QAAQ,QAAQ,kBAAkB,MAAM;AAC9C,QAAM,WAAW,QAAQ,qBAAqB;AAC9C,QAAM,UAAU,IAAI,IAAI,QAAQ,kBAAkB,CAAC,CAAC;AAEpD,SAAO,aAAa,CAAC,KAAK,QAAQ;AAChC,UAAM,YAAY,WAAW;AAC7B,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI,kBAAkB;AACtB,YAAQ,YAAY;AACpB,UAAM,oBAAoB,IAAI,QAAQ,eAAe;AACrD,UAAM,uBAAuB,MAAM,QAAQ,iBAAiB,IAAI,kBAAkB,CAAC,IAAI;AACvF,UAAM,kBAAkB,yBAAyB,UAAa,qBAAqB,KAAK,MAAM,KAC1F,0BACC,4BAAkD,SAAS,qBAAqB,KAAK,CAAC,IACrF,qBAAqB,KAAK,IAC1B;AACN,QAAI,UAAU,iBAAiB,eAAe;AAC9C,QAAI,UAAU,2BAA2B,4BAA4B,KAAK,GAAG,CAAC;AAC9E,UAAM,QAAQ,WAAW,MAAM;AAC7B,YAAM,MAAM,IAAI,MAAM,2BAA2B,CAAC;AAClD,cAAQ,YAAY;AAAG,cAAQ,UAAU;AACzC,UAAI,KAAK,UAAU,MAAM;AACvB,YAAI,CAAC,IAAI,SAAU,KAAI,QAAQ;AAAA,MACjC,CAAC;AACD;AAAA,QACE;AAAA,QACA;AAAA,QACA,kBAAkB,6BAA6B;AAAA,QAC/C;AAAA,MACF;AAAA,IACF,GAAG,QAAQ;AACX,QAAI;AACJ,UAAM,cAAc,MAAM,4BAAe,SAAS,KAAK,OAAO,MAAM,MAAM;AAE1E,UAAM,WAAW,OAAO,WAAqC,WAA2B,QAAuB;AAC7G,YAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,wBAAwB;AAC5D,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,WAAW;AACtD,YAAI,QAAQ;AACZ,YAAI;AACF,kBAAQ,OAAO,QAAQ,QAAQ,KAAK,QAAQ,MAAM,WAAW,EAAE,KAAK,MAAM,IAAI;AAAA,QAChF,QAAQ;AACN,kBAAQ;AAAA,QACV;AACA,aAAK,UAAU,QAAQ,MAAM,KAAK,EAAE,QAAQ,QAAQ,UAAU,YAAY,GAAG,SAAS;AACtF;AAAA,MACF;AACA,YAAM,SAAS,IAAI,QAAQ;AAC3B,UAAI,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG;AAClC,gBAAQ,UAAU,KAAK,oBAAoB,SAAS;AAAG;AAAA,MACzD;AACA,YAAM,QAAQ,YAAY,IAAI,QAAQ,aAAa;AACnD,UAAI,QAAQ,oBAAoB,CAAC,WAAW;AAC1C,YAAI,CAAC,OAAO;AACV,kBAAQ,gBAAgB;AACxB,kBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,QACrD;AACA,cAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,OAAO,MAAM,MAAM;AACvE,eAAO,MAAM,MAAM;AACnB,YAAI,CAAC,WAAW;AACd,kBAAQ,gBAAgB;AACxB,kBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,QACrD;AACA,YAAI,eAAe,GAAG,EAAG,OAAM,YAAY;AAC3C,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,IAAI,iBAAiB,GAAG;AACzC,cAAM,QAAQ,iBAAkB;AAAA,UAC9B,UAAU;AAAA,UACV,eAAe,KAAK;AAAA,UACpB;AAAA,UACA,MAAM;AAAA,UACN,CAAC,YAAY,SAAS,SAAS,QAAQ;AAAA,QACzC;AACA,eAAO,MAAM,MAAM;AACnB,iBAAS,MAAM;AACf;AAAA,MACF;AACA,YAAM,aAAa,WAAW,eAAe,QAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO,MAAM,MAAM,IAAI;AAC9G,aAAO,MAAM,MAAM;AACnB,UAAI,CAAC,YAAY;AACf,gBAAQ,gBAAgB;AACxB,gBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,MACrD;AACA,UAAI,CAAC,MAAM,QAAQ,WAAW,MAAM,GAAG;AACrC,gBAAQ,UAAU,KAAK,wBAAwB,SAAS;AAAG;AAAA,MAC7D;AACA,YAAM,UAAU,IAAI,cAAc,WAAW,SAAS,QAAQ,KAAK;AACnE,YAAM,WAAW,WAAW,YAAY,QAAQ;AAChD,UAAI,IAAI,SAAS,WAAW,MAAM,KAAK,IAAI,aAAa,YAAY;AAClE,iBAAS,UAAU,iBAAiB,yBAAyB,IAAI,QAAQ,eAAe,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,YAAY,OAAO,gBAA4C;AACnE,cAAM,iBAAiB,kBAAkB,WAAW,EAAE;AACtD,YAAI,eAAe,KAAK,CAAC,UAAU,CAAC,WAAW,OAAO,SAAS,KAAK,CAAC,GAAG;AACtE,cAAI;AACF,kBAAM,SAAS,kBAAkB,WAAW,IAAI,aAAa,WAAW,MAAM,MAAM;AAAA,UACtF,QAAQ;AACN,kBAAM,OAAO,OAAO,IAAI,MAAM,mCAAmC,GAAG;AAAA,cAClE,QAAQ;AAAA,cACR,MAAM;AAAA,YACR,CAAC;AAAA,UACH;AACA,gBAAM,OAAO,OAAO,IAAI,MAAM,mCAAmC,GAAG;AAAA,YAClE,QAAQ;AAAA,YAAK,MAAM;AAAA,YAAsB;AAAA,UAC3C,CAAC;AAAA,QACH;AACA,YAAI;AACJ,YAAI;AACF,qBAAW,MAAM,SAAS,QAAQ,WAAW,IAAI,aAAa,WAAW,MAAM,MAAM;AAAA,QACvF,QAAQ;AACN,gBAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,GAAG;AAAA,YAChE,QAAQ;AAAA,YACR,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AACA,YAAI,CAAC,SAAS,SAAS;AACrB,gBAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,iBAAiB,CAAC;AACpE,mBAAS,UAAU,eAAe,OAAO,UAAU,CAAC;AACpD,gBAAM,OAAO,OAAO,IAAI,MAAM,gCAAgC,GAAG;AAAA,YAC/D,QAAQ;AAAA,YAAK,MAAM;AAAA,YAAgB,mBAAmB;AAAA,UACxD,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,YAAY;AACvD,cAAM,UAAU,iBAAiB;AACjC,wBAAgB,mBAAmB,CAAC,CAAC;AACrC,cAAM,SAAS,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,wBAAwB,GAAG,UAAU,KAAK,EAAE,EAAE,KAAK,IAAI,IAAI;AACxH,sBAAc,mBAAmB,MAAM;AACvC,iBAAS,UAAU,KAAK;AAAA,UACtB,GAAG;AAAA,UACH,gBAAgB;AAAA,UAChB,gBAAgB;AAAA,QAClB,CAAC;AACD,iBAAS,IAAI,MAAM;AACnB;AAAA,MACF;AACA,YAAM,iBAAiB,IAAI,QAAQ,yBAAyB;AAC5D,YAAM,YAAY;AAAA,QAChB,GAAG,WAAW;AAAA,QACd,UAAU,MAAM,QAAQ,cAAc,IAAI,eAAe,CAAC,IAAI;AAAA,MAChE;AAEA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,oBAAoB;AAC/D,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,cAAc;AAC9B,oBAAY,KAAK,gBAAgB,CAAC,CAAC;AACnC,wBAAgB,gBAAgB,CAAC,CAAC;AAClC,YAAI,eAAe;AACnB,YAAI,QAAQ,oBAAoB,QAAQ,mBAAmB;AACzD,cAAI;AACF,2BAAe,MAAM,QAAQ,kBAAkB;AAAA,UACjD,QAAQ;AACN,2BAAe;AAAA,UACjB;AAAA,QACF;AACA,sBAAc,UAAU,KAAK,gBAAgB;AAAA,UAC3C,GAAG,mBAAmB;AAAA,YACpB,SAAS;AAAA,YACT,UAAU;AAAA,YACV,yBAAyB,OAAO,SAAS,UAAU,eAAe,CAAC;AAAA,YACnE,kBAAkB,QAAQ,QAAQ,gBAAgB;AAAA,YAClD;AAAA,UACF,CAAC;AAAA,UACD,eAAe,CAAC,GAAG,WAAW,MAAM;AAAA,QACtC,GAAG,SAAS;AAAG;AAAA,MACjB;AAEA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,cAAc;AACzD,cAAM,UAAU,QAAQ;AACxB,oBAAY,KAAK,UAAU,CAAC,CAAC;AAC7B,wBAAgB,UAAU,CAAC,CAAC;AAC5B,cAAM,cAAc,WAAW,SAAS,QAAQ;AAChD,cAAM,mBAAmB,aAAa,SAAS,UAAU,eAAe,MAAM,mBAAmB;AAAA,UAC/F,oBAAoB,UAAU;AAAA,UAC9B,cAAc,UAAU,WAAW;AAAA,QACrC,IAAI,CAAC;AACL,YAAI,CAAC,YAAY,aAAa;AAC5B,wBAAc,UAAU,KAAK,UAAU,EAAE,eAAe,eAAe,mBAAmB,OAAO,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM,MAAM,MAAM,GAAG,kBAAkB,WAAW,WAAW,UAAU,GAAG,SAAS;AAAA,QAC9N,OAAO;AACL,wBAAc,UAAU,KAAK,UAAU,EAAE,GAAG,MAAM,YAAY,YAAY,SAAS,GAAG,GAAG,kBAAkB,WAAW,WAAW,UAAU,GAAG,SAAS;AAAA,QACzJ;AACA;AAAA,MACF;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,qCAAqC;AACjF,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,oCAAoC;AACpD,cAAM,QAAQ,2BAA2B,sCAAsC,MAAM,YAAY,GAAG,iBAAiB,QAAQ,CAAC;AAC9H,YAAI,CAAC,WAAW,4BAA6B,OAAM,OAAO,OAAO,IAAI,MAAM,yDAAyD,GAAG,EAAE,QAAQ,KAAK,MAAM,uBAAuB,CAAC;AACpL,eAAO,MAAM,MAAM;AACnB,cAAM,UAAU,gBAAgB;AAAG,0BAAkB;AACrD,sBAAc,UAAU,KAAK,sCAAsC,MAAM,UAAU,4BAA4B,MAAM;AAAA,UACnH,WAAW,OAAO,MAAM,SAAS;AAAA,UACjC,4BAA4B,OAAO,MAAM,0BAA0B;AAAA,UACnE,sBAAsB,OAAO,MAAM,oBAAoB;AAAA,QACzD,CAAC,GAAG,SAAS;AAAG;AAAA,MAClB;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,6CAA6C;AACzF,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,sCAAsC;AACtD,cAAM,QAAQ,2BAA2B,wCAAwC,MAAM,YAAY,GAAG,iBAAiB,QAAQ,CAAC;AAChI,YAAI,CAAC,WAAW,4BAA6B,OAAM,OAAO,OAAO,IAAI,MAAM,yDAAyD,GAAG,EAAE,QAAQ,KAAK,MAAM,uBAAuB,CAAC;AACpL,eAAO,MAAM,MAAM;AACnB,cAAM,UAAU,gBAAgB;AAAG,0BAAkB;AACrD,sBAAc,UAAU,KAAK,wCAAwC,MAAM,UAAU,4BAA4B,QAAQ;AAAA,UACvH,WAAW,OAAO,MAAM,SAAS;AAAA,UACjC,4BAA4B,OAAO,MAAM,0BAA0B;AAAA,UACnE,oBAAoB,OAAO,MAAM,kBAAkB;AAAA,QACrD,CAAC,GAAG,SAAS;AAAG;AAAA,MAClB;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;AAC5D,cAAM,UAAU,iBAAiB;AACjC,cAAM,QAAQ,2BAA2B,mBAAmB,MAAM,YAAY,GAAG,OAAO,SAAS,UAAU,eAAe,CAAC,CAAC;AAC5H,YAAI,MAAM,WAAW,UAAa,MAAM,WAAW,UAAU,OAAO;AAClE,gBAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACxF;AACA,cAAM,EAAE,QAAQ,SAAS,GAAG,MAAM,IAAI;AACtC,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,mBAAmB,MAAM,QAAQ,QAAQ,WAAW,KAAgC,GAAG,SAAS;AAAG;AAAA,MAClI;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,eAAe;AAC1D,cAAM,UAAU,SAAS;AACzB,oBAAY,KAAK,WAAW,CAAC,UAAU,WAAW,gBAAgB,SAAS,QAAQ,kBAAkB,UAAU,WAAW,SAAS,oBAAoB,cAAc,YAAY,QAAQ,CAAC;AAC1L,cAAM,QAAQ,IAAI,aAAa,OAAO,MAAM;AAC5C,cAAM,QAAQ,2BAA2B,WAAW;AAAA,UAClD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,UAC1C,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,UAC5C,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,UACtD,OAAO,YAAY,IAAI,aAAa,IAAI,OAAO,GAAG,OAAO;AAAA,UACzD,OAAO,MAAM,SAAS,QAAQ;AAAA,UAC9B,gBAAgB,aAAa,IAAI,aAAa,IAAI,gBAAgB,GAAG,gBAAgB;AAAA,UACrF,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,UAC1C,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,UAC5C,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,UACxC,kBAAkB,IAAI,aAAa,IAAI,kBAAkB,KAAK,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,UACpG,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,UAC9C,QAAQ,aAAa,IAAI,aAAa,IAAI,QAAQ,GAAG,QAAQ;AAAA,QAC/D,GAAG,OAAO,SAAS,UAAU,eAAe,CAAC,CAAC;AAC9C,sBAAc,UAAU,KAAK,WAAW,MAAM,QAAQ,QAAQ,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MAC/F;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;AAC5D,cAAM,UAAU,gBAAgB;AAChC,cAAM,QAAQ,gBAAgB,kBAAkB,MAAM,YAAY,CAAC;AACnE,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,kBAAkB,EAAE,UAAU,MAAM,QAAQ,YAAY,WAAW,MAAM,UAAsB,EAAE,GAAG,SAAS;AAAG;AAAA,MAC/I;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,wBAAwB;AACpE,cAAM,UAAU,gBAAgB;AAChC,cAAM,QAAQ,2BAA2B,kBAAkB,MAAM,YAAY,GAAG,iBAAiB,QAAQ,CAAC;AAC1G,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,kBAAkB,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,EAAE,UAAU,KAAK,GAAG,SAAS;AAAG;AAAA,MAC1H;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,kBAAkB;AAC7D,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,iBAAiB;AACjC,oBAAY,KAAK,mBAAmB,CAAC,UAAU,SAAS,QAAQ,aAAa,aAAa,OAAO,CAAC;AAClG,cAAM,QAAQ,gBAAgB,mBAAmB,EAAC,QAAO,IAAI,aAAa,IAAI,QAAQ,KAAG,QAAU,OAAM,YAAY,IAAI,aAAa,IAAI,OAAO,GAAE,OAAO,GAAE,MAAK,IAAI,aAAa,IAAI,MAAM,KAAG,QAAU,WAAU,IAAI,aAAa,IAAI,WAAW,KAAG,QAAU,WAAU,IAAI,aAAa,IAAI,WAAW,KAAG,QAAU,QAAO,IAAI,aAAa,OAAO,OAAO,EAAC,CAAC;AAC/V,sBAAc,UAAS,KAAI,mBAAkB,MAAM,QAAQ,WAAW,WAAU,KAAY,GAAE,SAAS;AAAE;AAAA,MAC3G;AACA,YAAM,cAAY,IAAI,SAAS,MAAM,qCAAqC;AAC1E,UAAG,IAAI,WAAS,SAAO,aAAY;AAAC,+BAAuB,QAAQ;AAAE,cAAM,UAAU,sBAAsB;AAAE,oBAAY,KAAI,wBAAuB,CAAC,UAAS,OAAO,CAAC;AAAE,cAAM,QAAM,gBAAgB,wBAAuB,EAAC,YAAW,YAAY,CAAC,GAAE,QAAO,IAAI,aAAa,IAAI,QAAQ,KAAG,QAAU,OAAM,YAAY,IAAI,aAAa,IAAI,OAAO,GAAE,OAAO,EAAC,CAAC;AAAE,sBAAc,UAAS,KAAI,wBAAuB,MAAM,QAAQ,eAAe,WAAU,YAAY,CAAC,GAAG,KAAY,GAAE,SAAS;AAAE;AAAA,MAAO;AAC3e,YAAM,eAAa,IAAI,SAAS,MAAM,+CAA+C;AACrF,UAAG,IAAI,WAAS,UAAQ,cAAa;AAAC,+BAAuB,QAAQ;AAAE,cAAM,YAAU,aAAa,CAAC,MAAI,WAAS,oBAAkB;AAAmB,cAAM,UAAU,SAAS;AAAE,uBAAe,WAAU,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC;AAAE,cAAM,WAAW,gBAAgB;AAAE,0BAAgB;AAAK,cAAM,SAAO,aAAa,CAAC,MAAI,WAAS,MAAM,QAAQ,OAAO,WAAU,aAAa,CAAC,CAAE,IAAE,MAAM,QAAQ,QAAQ,WAAU,aAAa,CAAC,CAAE;AAAE,YAAG,CAAC,OAAO,SAAQ,UAAS,KAAI,aAAY,SAAS;AAAA,YAAO,eAAc,UAAS,KAAI,WAAU,EAAC,UAAS,OAAM,GAAE,SAAS;AAAE;AAAA,MAAO;AACzjB,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,0BAA0B;AACtE,cAAM,UAAU,WAAW;AAC3B,cAAM,QAAQ,gBAAgB,aAAa,MAAM,YAAY,CAAC;AAC9D,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,aAAa,MAAM,QAAQ,UAAU,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MACnG;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,gBAAgB;AAC3D,cAAM,UAAU,UAAU;AAC1B,oBAAY,KAAK,YAAY,CAAC,CAAC;AAC/B,wBAAgB,YAAY,CAAC,CAAC;AAC9B,sBAAc,UAAU,KAAK,YAAY,EAAE,QAAQ,MAAM,QAAQ,SAAS,SAAS,EAAE,GAAG,SAAS;AAAG;AAAA,MACtG;AACA,YAAM,QAAQ,IAAI,SAAS,MAAM,gDAAgD;AACjF,UAAI,IAAI,WAAW,UAAU,OAAO;AAClC,cAAM,cAAc,MAAM,CAAC,MAAM,WAAW,oBAAoB,MAAM,CAAC,MAAM,QAAQ,yBAAyB;AAC9G,cAAM,UAAU,WAAW;AAC3B,cAAM,WAAW,MAAM,YAAY;AACnC,cAAM,kBAAkB,OAAO,SAAS,UAAU,eAAe,KAAK,gBAAgB;AACtF,cAAM,QAAQ,eAAe,aAAa,MAAM,CAAC,GAAI,UAAU,eAAe;AAC9E,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,cAAM,CAAC,EAAE,IAAI,MAAM,IAAI;AACvB,cAAM,SAAS,WAAW,WACtB,MAAM,QAAQ,OAAO,WAAW,IAAI,MAAM,YAAsB,MAAM,OAAiB,IACvF,WAAW,QACT,MAAM,QAAQ,IAAI,WAAW,IAAI,MAAM,UAAoB,IAC3D,MAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACL,MAAM,SAAgC;AAAA,UACtC,MAAM,eAAe,MAAM,QAAQ;AAAA,UACpC,MAAM;AAAA,QACR;AACN,YAAI,CAAC,OAAQ,SAAQ,UAAU,KAAK,kBAAkB,SAAS;AAAA,YAC1D,eAAc,UAAU,KAAK,aAAa,EAAE,UAAU,OAAO,GAAG,SAAS;AAC9E;AAAA,MACF;AACA,cAAQ,UAAU,KAAK,aAAa,SAAS;AAAA,IAC/C;AACA,SAAK,SAAS,EAAE,MAAM,CAAC,UAAe;AACpC,UAAI,IAAI,cAAe;AACvB,cAAQ,UAAU;AAClB,UAAI,iBAAiB,2BAA2B,iBAAiB,uBAAuB;AACtF,gBAAQ,KAAK,MAAM,QAAQ,MAAM,MAAM,WAAW,EAAE,WAAW,MAAM,WAAW,QAAQ,MAAM,OAAO,CAAC;AAAA,MACxG,WAAW,OAAO,WAAW,KAAK;AAChC,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,2BAA2B,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAAA,MAC1G,WAAW,OAAO,SAAS,sBAAsB;AAC/C,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,EAAE,gBAAgB,CAAC,GAAG,MAAM,cAAc,EAAE,EAAE,CAAC;AAAA,MACrG,WAAW,OAAO,SAAS,gBAAgB;AACzC,YAAI,UAAU,eAAe,OAAO,MAAM,iBAAiB,CAAC;AAC5D,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,EAAE,mBAAmB,MAAM,kBAAkB,EAAE,CAAC;AAAA,MACtG,WAAW,iBAAiB,yBAAyB,iBAAiB,8BAA8B;AAClG,gBAAQ,KAAK,YAAY,QAAQ,MAAM,SAAS,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,MACxG,OAAO;AACL,gBAAQ,KAAK,OAAO,UAAU,KAAK,OAAO,QAAQ,kBAAkB,SAAS;AAAA,MAC/E;AAAA,IACF,CAAC,EAAE,QAAQ,MAAM,aAAa,KAAK,CAAC;AAAA,EACtC,CAAC;AACH;","names":[]}

package/dist/chunk-XDNT6ZNZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/postgres-bridge-store.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n  DeliveryStateConflictError,\n  decodeCursor,\n  decodeScopedCursor,\n  encodeCursor,\n  encodeScopedCursor,\n  cursorScope,\n  scopedCursorScope,\n  validateDeliveryCursorPosition,\n  validateEventCursorPosition,\n  type AgentPresence,\n  type BridgeDelivery,\n  type BridgeDeliveryEvent,\n  type BridgeMessage,\n  type BridgePrincipal,\n  type DeliveryPolicy,\n} from \"./bridge-domain.js\";\nimport type {\n  BridgeStore,\n  BridgeDiagnostics,\n  ClaimOptions,\n  InsertMessageResult,\n  MessagePage,\n  MessageQuery,\n  DeliveryQuery,\n} from \"./bridge-store.js\";\nimport { assertIdempotentReplay } from \"./idempotency.js\";\n\nexport interface PgQueryable {\n  query<T extends Record<string, unknown> = Record<string, unknown>>(\n    sql: string,\n    values?: unknown[],\n  ): Promise<{ rows: T[]; rowCount: number | null }>;\n  connect?(): Promise<PgTransactionClient>;\n  release?(): void;\n  /** True when the queryable is already owned by an explicit request transaction. */\n  inTransaction?: boolean;\n}\nexport interface PgTransactionClient {\n  query<T extends Record<string, unknown> = Record<string, unknown>>(\n    sql: string,\n    values?: unknown[],\n  ): Promise<{ rows: T[]; rowCount: number | null }>;\n  release(error?: Error | boolean): void;\n}\n\ntype Row = Record<string, any>;\n\nfunction json(value: unknown): string | null {\n  return value === undefined ? null : JSON.stringify(value);\n}\n\nfunction parse(value: unknown): any {\n  return typeof value === \"string\" ? JSON.parse(value) : value;\n}\n\nfunction asTimestamp(value: unknown): string | undefined {\n  if (value === undefined || value === null) return undefined;\n  if (value instanceof Date) return value.toISOString();\n  return String(value);\n}\n\nfunction asMessage(row: Row): BridgeMessage {\n  const deliveryPolicy: DeliveryPolicy = row.delivery_mode === \"mailbox\"\n    ? { mode: \"mailbox\" }\n    : {\n        mode: \"leased\",\n        maxAttempts: Number(row.delivery_max_attempts),\n        retryBaseDelayMs: Number(row.delivery_retry_base_delay_ms),\n        retryMaxDelayMs: Number(row.delivery_retry_max_delay_ms),\n        retryJitterRatio: Number(row.delivery_retry_jitter_ratio),\n        ...(row.delivery_not_before ? { notBefore: asTimestamp(row.delivery_not_before) } : {}),\n      };\n  return {\n    id: String(row.id),\n    workspace: String(row.workspace),\n    project: row.project ?? undefined,\n    source: String(row.source),\n    sequence: String(row.sequence),\n    type: String(row.type),\n    content: String(row.content),\n    contentType: String(row.content_type),\n    data: parse(row.data),\n    targets: parse(row.targets) ?? [],\n    threadId: row.thread_id ?? undefined,\n    replyToId: row.reply_to_id ?? undefined,\n    correlationId: row.correlation_id ?? undefined,\n    causationId: row.causation_id ?? undefined,\n    priority: row.priority,\n    expiresAt: asTimestamp(row.expires_at),\n    idempotencyKey: row.idempotency_key ?? undefined,\n    atribReceiptId: row.atrib_receipt_id ?? undefined,\n    informedBy: parse(row.informed_by),\n    metadata: parse(row.metadata),\n    deliveryPolicy,\n    createdAt: asTimestamp(row.created_at) ?? \"\",\n  };\n}\n\nfunction asDelivery(row: Row): BridgeDelivery {\n  return {\n    id: String(row.id),\n    messageId: String(row.message_id),\n    workspace: String(row.workspace),\n    recipient: String(row.recipient),\n    state: row.state,\n    attempt: Number(row.attempt),\n    cycleAttempt: Number(row.cycle_attempt ?? row.attempt),\n    requeueCount: Number(row.requeue_count ?? 0),\n    createdAt: asTimestamp(row.created_at) ?? \"\",\n    priorityRank: Number(row.priority_rank),\n    availableAt: asTimestamp(row.available_at) ?? \"\",\n    leaseToken: row.lease_token ?? undefined,\n    leaseOwner: row.lease_owner ?? undefined,\n    leaseExpiresAt: asTimestamp(row.lease_expires_at),\n    lastError: row.last_error ?? undefined,\n    lastActor: row.last_actor ?? undefined,\n    lastAction: row.last_action,\n  };\n}\n\nfunction asPresence(row: Row): AgentPresence {\n  return {\n    workspace: String(row.workspace), agent: String(row.agent), instance: String(row.instance),\n    runtimeType: row.runtime_type ?? undefined, capabilities: parse(row.capabilities) ?? [],\n    leaseExpiresAt: asTimestamp(row.lease_expires_at) ?? \"\", lastSeenAt: asTimestamp(row.last_seen_at) ?? \"\",\n  };\n}\n\nfunction asDeliveryEvent(row: Row): BridgeDeliveryEvent {\n  return {\n    sequence: String(row.sequence), deliveryId: String(row.delivery_id),\n    messageId: String(row.message_id), workspace: String(row.workspace),\n    recipient: String(row.recipient),\n    fromState: row.from_state == null ? undefined : row.from_state as BridgeDeliveryEvent[\"fromState\"],\n    toState: row.to_state as BridgeDeliveryEvent[\"toState\"], attempt: Number(row.attempt),\n    cycleAttempt: Number(row.cycle_attempt), requeueCount: Number(row.requeue_count),\n    leaseOwner: row.lease_owner ?? undefined, error: row.error ?? undefined,\n    actor: String(row.actor), action: row.action,\n    createdAt: asTimestamp(row.created_at) ?? \"\",\n  };\n}\n\nasync function transaction<T>(db: PgQueryable, work: (client: PgQueryable) => Promise<T>): Promise<T> {\n  if (db.inTransaction) return work(db);\n  const borrowed = !db.release && Boolean(db.connect);\n  const client = borrowed ? await db.connect!() : db;\n  try {\n    await client.query(\"BEGIN\");\n    const result = await work(client);\n    await client.query(\"COMMIT\");\n    return result;\n  } catch (error) {\n    await client.query(\"ROLLBACK\").catch(() => undefined);\n    throw error;\n  } finally {\n    if (borrowed && \"release\" in client && typeof client.release === \"function\") client.release();\n  }\n}\n\nexport class PostgresBridgeStore implements BridgeStore {\n  constructor(private readonly db: PgQueryable) {}\n\n  async initialize(): Promise<void> {\n    // Deployments apply ordered migrations before starting the service.\n  }\n\n  async insertMessage(\n    input: Omit<BridgeMessage, \"sequence\" | \"createdAt\">,\n  ): Promise<InsertMessageResult> {\n    const values = [\n      input.id,\n      input.workspace,\n      input.project ?? null,\n      input.source,\n      input.type,\n      input.content,\n      input.contentType,\n      json(input.data),\n      json(input.targets),\n      input.threadId ?? null,\n      input.replyToId ?? null,\n      input.correlationId ?? null,\n      input.causationId ?? null,\n      input.priority,\n      input.expiresAt ?? null,\n      input.idempotencyKey ?? null,\n      input.atribReceiptId ?? null,\n      json(input.informedBy),\n      json(input.metadata),\n      input.deliveryPolicy.mode,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.maxAttempts : null,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.retryBaseDelayMs : null,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.retryMaxDelayMs : null,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.retryJitterRatio : null,\n      input.deliveryPolicy.mode === \"leased\" ? input.deliveryPolicy.notBefore ?? null : null,\n    ];\n\n    const result = await this.db.query<Row>(\n      `WITH inserted AS (\n         INSERT INTO agent_bridge.messages (\n           id, workspace, project, source, type, content, content_type, data, targets,\n           thread_id, reply_to_id, correlation_id, causation_id, priority,\n           expires_at, idempotency_key, atrib_receipt_id, informed_by, metadata,\n           delivery_mode, delivery_max_attempts, delivery_retry_base_delay_ms,\n           delivery_retry_max_delay_ms, delivery_retry_jitter_ratio, delivery_not_before\n         )\n         VALUES (\n           $1, $2, $3, $4, $5, $6, $7, $8::jsonb, $9::jsonb,\n           $10, $11, $12, $13, $14, $15, $16, $17, $18::jsonb, $19::jsonb,\n           $20, $21, $22, $23, $24, $25\n         )\n         ON CONFLICT (workspace, source, idempotency_key)\n           WHERE idempotency_key IS NOT NULL\n         DO NOTHING\n         RETURNING *, true AS created\n       ), selected AS (\n         SELECT * FROM inserted\n         UNION ALL\n         SELECT existing.*, false AS created\n         FROM agent_bridge.messages existing\n         WHERE $16::text IS NOT NULL\n           AND existing.workspace = $2\n           AND existing.source = $4\n           AND existing.idempotency_key = $16\n           AND NOT EXISTS (SELECT 1 FROM inserted)\n         LIMIT 1\n       ), delivery_rows AS (\n         INSERT INTO agent_bridge.deliveries (\n           id, message_id, workspace, publisher, recipient, state, available_at,\n           created_at, priority_rank, last_actor, last_action\n         )\n         SELECT gen_random_uuid(), inserted.id, inserted.workspace, inserted.source, target, 'pending',\n                greatest(now(), coalesce(inserted.delivery_not_before, now())),\n                inserted.created_at,\n                case inserted.priority when 'urgent' then 0 when 'high' then 1 else 2 end,\n                inserted.source, 'created'\n         FROM inserted\n         CROSS JOIN LATERAL jsonb_array_elements_text(inserted.targets) AS target\n         WHERE inserted.delivery_mode = 'leased'\n         ON CONFLICT (message_id, recipient) DO NOTHING\n       )\n       SELECT * FROM selected`,\n      values,\n    );\n\n    let row = result.rows[0];\n    if (!row && input.idempotencyKey) {\n      const existing = await this.db.query<Row>(\n        `SELECT *, false AS created\n         FROM agent_bridge.messages\n         WHERE workspace=$1 AND source=$2 AND idempotency_key=$3`,\n        [input.workspace, input.source, input.idempotencyKey],\n      );\n      row = existing.rows[0];\n    }\n    if (!row) throw new Error(\"message insert did not return a row\");\n    const message = asMessage(row);\n    if (row.created !== true) assertIdempotentReplay(message, input);\n    return { message, created: row.created === true };\n  }\n\n  async listMessages(\n    principal: BridgePrincipal,\n    query: MessageQuery = {},\n  ): Promise<MessagePage> {\n    const scope = cursorScope(principal, query);\n    const cursor = decodeCursor(query.cursor, scope) ?? \"0\";\n    const limit = Math.min(Math.max(Math.trunc(query.limit ?? 50), 1), 200);\n    const boundary = query.latest ? undefined : await this.db.query<{ sequence: string | null }>(\n      \"SELECT max(sequence)::text AS sequence FROM agent_bridge.messages WHERE workspace=$1\",\n      [principal.workspace],\n    );\n    const highWater = boundary?.rows[0]?.sequence;\n    const values: unknown[] = query.latest\n      ? [principal.workspace, principal.agent]\n      : [principal.workspace, cursor, principal.agent];\n    const mailbox = query.mailbox ?? \"inbox\";\n    const agentParam = query.latest ? 2 : 3;\n    const visibility = mailbox === \"sent\" ? `source=$${agentParam}`\n      : mailbox === \"all\" ? `(source=$${agentParam} OR targets='[]'::jsonb OR targets ? $${agentParam})`\n      : `(targets='[]'::jsonb OR targets ? $${agentParam})`;\n    let sql = `SELECT * FROM agent_bridge.messages WHERE workspace=$1 ${query.latest ? \"\" : \"AND sequence>$2::bigint \"}AND ${visibility}`;\n\n    if (highWater) {\n      values.push(highWater);\n      sql += ` AND sequence <= $${values.length}::bigint`;\n    }\n\n    if (!query.includeExpired) {\n      sql += \" AND (expires_at IS NULL OR expires_at > now())\";\n    }\n    if (query.types?.length) {\n      values.push(query.types);\n      sql += ` AND type = ANY($${values.length})`;\n    }\n    if (query.source) {\n      values.push(query.source);\n      sql += ` AND source = $${values.length}`;\n    }\n    if (query.project) {\n      values.push(query.project);\n      sql += ` AND project = $${values.length}`;\n    }\n    if (query.since) {\n      values.push(query.since);\n      sql += ` AND created_at >= $${values.length}::timestamptz`;\n    }\n    if (query.receiptState && query.receiptState !== \"any\") {\n      sql += ` AND ${query.receiptState === \"unread\" ? \"NOT \" : \"\"}EXISTS (\n        SELECT 1 FROM agent_bridge.receipts receipt\n        WHERE receipt.workspace=agent_bridge.messages.workspace\n          AND receipt.message_id=agent_bridge.messages.id\n          AND receipt.principal=$${agentParam}\n      )`;\n    }\n    if (query.threadId) {\n      values.push(query.threadId);\n      sql += ` AND thread_id = $${values.length}`;\n    }\n\n    values.push(limit);\n    const result = await this.db.query<Row>(\n      `${sql} ORDER BY sequence ${query.latest ? \"DESC\" : \"ASC\"} LIMIT $${values.length}`,\n      values,\n    );\n    const messages = result.rows.map(asMessage);\n    const last = messages[messages.length - 1];\n    if (query.latest) return { messages, cursor: messages[0] ? encodeCursor(messages[0].sequence, scope) : query.cursor };\n    if (messages.length === limit) return { messages, cursor: encodeCursor(last!.sequence, scope) };\n    return { messages, cursor: highWater ? encodeCursor(highWater, scope) : query.cursor };\n  }\n\n  async recordReceipt(\n    principal: BridgePrincipal,\n    ids: string[],\n    readAt = new Date(),\n  ): Promise<number> {\n    const result = await this.db.query(\n      `INSERT INTO agent_bridge.receipts (workspace, message_id, principal, read_at)\n       SELECT message.workspace, message.id, $3, $4\n       FROM agent_bridge.messages message\n       WHERE message.workspace = $1 AND message.id = ANY($2::uuid[])\n         AND (message.targets='[]'::jsonb OR message.targets ? $3)\n       ON CONFLICT DO NOTHING`,\n      [principal.workspace, ids, principal.agent, readAt],\n    );\n    return result.rowCount ?? 0;\n  }\n\n  async claimDelivery(\n    principal: BridgePrincipal,\n    options: ClaimOptions,\n  ): Promise<BridgeDelivery | null> {\n    return transaction(this.db, async (db) => {\n      await db.query(\n        `UPDATE agent_bridge.deliveries delivery\n         SET state='dead', last_error='message expired', lease_token=NULL,\n             lease_owner=NULL, lease_expires_at=NULL,\n             last_actor='agent-bridge', last_action='message_expired'\n         FROM agent_bridge.messages message\n         WHERE delivery.workspace=$1 AND delivery.recipient=$2\n           AND ($3::uuid IS NULL OR delivery.message_id=$3)\n           AND delivery.state IN ('pending','retrying','claimed')\n           AND message.workspace=delivery.workspace AND message.id=delivery.message_id\n           AND message.expires_at IS NOT NULL AND message.expires_at<=now()`,\n        [principal.workspace, principal.agent, options.messageId ?? null],\n      );\n      await db.query(\n        `UPDATE agent_bridge.deliveries delivery\n         SET state='dead', last_error='maximum attempts reached', lease_token=NULL,\n             lease_owner=NULL, lease_expires_at=NULL,\n             last_actor='agent-bridge', last_action='attempts_exhausted'\n         FROM agent_bridge.messages message\n         WHERE delivery.workspace=$1 AND delivery.recipient=$2\n           AND ($3::uuid IS NULL OR delivery.message_id=$3)\n           AND message.workspace=delivery.workspace AND message.id=delivery.message_id\n           AND delivery.cycle_attempt>=message.delivery_max_attempts\n           AND (delivery.state IN ('pending','retrying')\n             OR (delivery.state='claimed' AND delivery.lease_expires_at<=now()))`,\n        [principal.workspace, principal.agent, options.messageId ?? null],\n      );\n      await db.query(\n        `UPDATE agent_bridge.deliveries delivery\n         SET state='retrying', available_at=now(), lease_token=NULL,\n             lease_owner=NULL, lease_expires_at=NULL,\n             last_error='lease expired', last_actor='agent-bridge', last_action='lease_expired'\n         FROM agent_bridge.messages message\n         WHERE delivery.workspace=$1 AND delivery.recipient=$2\n           AND ($3::uuid IS NULL OR delivery.message_id=$3)\n           AND message.workspace=delivery.workspace AND message.id=delivery.message_id\n           AND delivery.state='claimed' AND delivery.lease_expires_at<=now()\n           AND delivery.cycle_attempt<message.delivery_max_attempts`,\n        [principal.workspace, principal.agent, options.messageId ?? null],\n      );\n      const candidate = await db.query<Row>(\n        `SELECT delivery.id\n         FROM agent_bridge.deliveries delivery\n         JOIN agent_bridge.messages message\n           ON message.workspace=delivery.workspace AND message.id=delivery.message_id\n         WHERE delivery.workspace=$1 AND delivery.recipient=$2 AND ($3::uuid IS NULL OR delivery.message_id=$3)\n           AND delivery.state IN ('pending','retrying')\n           AND delivery.available_at<=now()\n           AND delivery.cycle_attempt<message.delivery_max_attempts\n           AND (message.expires_at IS NULL OR message.expires_at>now())\n         ORDER BY delivery.priority_rank, delivery.available_at, delivery.created_at, delivery.id\n         FOR UPDATE OF delivery SKIP LOCKED\n         LIMIT 1`,\n        [principal.workspace, principal.agent, options.messageId ?? null],\n      );\n      if (!candidate.rows[0]) return null;\n      const token = randomUUID();\n      const owner = principal.instance ?? principal.agent;\n      const claimed = await db.query<Row>(\n        `UPDATE agent_bridge.deliveries\n         SET state='claimed', attempt=attempt+1, cycle_attempt=cycle_attempt+1,\n             lease_token=$1, lease_owner=$2,\n             lease_expires_at=now()+($3*interval '1 millisecond'),\n             last_error=NULL, last_actor=$4, last_action='claim'\n         WHERE id=$5\n         RETURNING *`,\n        [token, owner, options.leaseMs, principal.agent, candidate.rows[0].id],\n      );\n      return asDelivery(claimed.rows[0]!);\n    });\n  }\n\n  async renewDelivery(\n    principal: BridgePrincipal,\n    id: string,\n    token: string,\n    leaseMs: number,\n  ): Promise<BridgeDelivery | null> {\n    const result = await this.db.query<Row>(\n      `UPDATE agent_bridge.deliveries\n       SET lease_expires_at=now() + ($1 * interval '1 millisecond')\n       WHERE workspace=$2 AND recipient=$3 AND lease_owner=$4 AND id=$5 AND lease_token=$6\n         AND state='claimed' AND lease_expires_at>now()\n       RETURNING *`,\n      [leaseMs, principal.workspace, principal.agent, principal.instance ?? principal.agent, id, token],\n    );\n    return result.rows[0] ? asDelivery(result.rows[0]) : null;\n  }\n\n  async settleDelivery(\n    principal: BridgePrincipal,\n    id: string,\n    token: string,\n    state: \"acked\" | \"retrying\" | \"dead\",\n    error?: string,\n    _retryPolicy?: import(\"./bridge-domain.js\").RetryPolicy,\n  ): Promise<BridgeDelivery | null> {\n    const result = await this.db.query<Row>(\n      `UPDATE agent_bridge.deliveries delivery\n       SET state=CASE\n             WHEN $1='retrying' AND cycle_attempt>=message.delivery_max_attempts THEN 'dead'\n             ELSE $1\n           END,\n           available_at=CASE\n             WHEN $1='retrying' AND cycle_attempt<message.delivery_max_attempts THEN\n               now() + (\n                 LEAST(message.delivery_retry_max_delay_ms::double precision,\n                       message.delivery_retry_base_delay_ms::double precision * power(2, GREATEST(cycle_attempt - 1, 0)))\n                 * (1 + ((random() * 2) - 1) * message.delivery_retry_jitter_ratio)\n                 * interval '1 millisecond'\n               )\n             ELSE available_at\n           END,\n           last_error=$2, lease_token=NULL, lease_owner=NULL, lease_expires_at=NULL,\n           last_actor=$4,\n           last_action=CASE\n             WHEN $1='acked' THEN 'ack'\n             WHEN $1='dead' THEN 'nack_dead'\n             WHEN cycle_attempt>=message.delivery_max_attempts THEN 'attempts_exhausted'\n             ELSE 'nack_retry'\n           END\n       FROM agent_bridge.messages message\n       WHERE delivery.workspace=$3 AND delivery.recipient=$4 AND delivery.lease_owner=$5\n         AND message.workspace=delivery.workspace AND message.id=delivery.message_id\n         AND delivery.id=$6 AND delivery.lease_token=$7 AND delivery.state='claimed' AND delivery.lease_expires_at>now()\n       RETURNING delivery.*`,\n      [\n        state,\n        error?.slice(0, 1024) ?? null,\n        principal.workspace,\n        principal.agent,\n        principal.instance ?? principal.agent,\n        id,\n        token,\n      ],\n    );\n    return result.rows[0] ? asDelivery(result.rows[0]) : null;\n  }\n\n  async listDeliveries(principal: BridgePrincipal, query: DeliveryQuery = {}) {\n    const filters = {\n      role: query.role ?? \"all\",\n      states: [...(query.states ?? [])].sort(),\n      messageId: query.messageId ?? null,\n      recipient: query.recipient ?? null,\n    };\n    const scope = scopedCursorScope(\"deliveries\", principal, filters);\n    const boundary = validateDeliveryCursorPosition(decodeScopedCursor(query.cursor, scope));\n    const createdAt = boundary?.createdAt;\n    const id = boundary?.id;\n    const limit = query.limit ?? 50;\n    const values: unknown[] = [principal.workspace, principal.agent];\n    const clauses = [\"delivery.workspace=$1\"];\n    const role = query.role ?? \"all\";\n    clauses.push(role === \"recipient\" ? \"delivery.recipient=$2\" : role === \"publisher\" ? \"message.source=$2\" : \"(delivery.recipient=$2 OR message.source=$2)\");\n    if (createdAt && id) {\n      values.push(createdAt, id);\n      clauses.push(`(delivery.created_at,delivery.id)>($${values.length - 1}::timestamptz,$${values.length}::uuid)`);\n    }\n    if (query.messageId) { values.push(query.messageId); clauses.push(`delivery.message_id=$${values.length}`); }\n    if (query.recipient) { values.push(query.recipient); clauses.push(`delivery.recipient=$${values.length}`); }\n    if (query.states?.length) { values.push(query.states); clauses.push(`delivery.state=ANY($${values.length}::text[])`); }\n    values.push(limit);\n    const result = await this.db.query<Row>(\n      `SELECT delivery.* FROM agent_bridge.deliveries delivery\n       JOIN agent_bridge.messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id\n       WHERE ${clauses.join(\" AND \")}\n       ORDER BY delivery.created_at,delivery.id LIMIT $${values.length}`,\n      values,\n    );\n    const deliveries = result.rows.map(asDelivery);\n    const last = deliveries[deliveries.length - 1];\n    return { deliveries, cursor: deliveries.length === limit && last ? encodeScopedCursor(scope, { createdAt: last.createdAt, id: last.id }) : undefined };\n  }\n\n  async listDeliveryEvents(principal: BridgePrincipal, id: string, query: { cursor?: string; limit?: number } = {}) {\n    const limit = Math.min(Math.max(query.limit ?? 50, 1), 200);\n    const scope = scopedCursorScope(\"delivery-events\", principal, { deliveryId: id });\n    const position = validateEventCursorPosition(decodeScopedCursor(query.cursor, scope));\n    const result = await this.db.query<Row>(\n      `SELECT event.* FROM agent_bridge.delivery_events event\n       JOIN agent_bridge.messages message ON message.workspace=event.workspace AND message.id=event.message_id\n       WHERE event.workspace=$1 AND event.delivery_id=$2 AND event.sequence>$3::bigint\n         AND (event.recipient=$4 OR message.source=$4)\n       ORDER BY event.sequence LIMIT $5`,\n      [principal.workspace, id, position ?? \"0\", principal.agent, limit],\n    );\n    const events = result.rows.map(asDeliveryEvent);\n    const last = events[events.length - 1];\n    return { events, cursor: events.length === limit && last ? encodeScopedCursor(scope, last.sequence) : undefined };\n  }\n\n  async cancelDelivery(principal: BridgePrincipal, id: string) {\n    return transaction(this.db, async (db) => {\n      const visible = await db.query<Row>(\n        `SELECT delivery.* FROM agent_bridge.deliveries delivery\n         JOIN agent_bridge.messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id\n         WHERE delivery.id=$1 AND delivery.workspace=$2 AND message.source=$3 FOR UPDATE OF delivery`,\n        [id, principal.workspace, principal.agent],\n      );\n      const current = visible.rows[0];\n      if (!current) return null;\n      if (current.state === \"cancelled\") return asDelivery(current);\n      if (![\"pending\", \"retrying\", \"claimed\"].includes(current.state)) {\n        throw new DeliveryStateConflictError(`cannot cancel a ${current.state} delivery`);\n      }\n      const result = await db.query<Row>(\n        `UPDATE agent_bridge.deliveries SET state='cancelled', lease_token=NULL,\n         lease_owner=NULL, lease_expires_at=NULL, last_error=NULL,\n         last_actor=$1, last_action='cancel' WHERE id=$2 RETURNING *`,\n        [principal.agent, id],\n      );\n      return asDelivery(result.rows[0]!);\n    });\n  }\n\n  async requeueDelivery(principal: BridgePrincipal, id: string) {\n    return transaction(this.db, async (db) => {\n      const visible = await db.query<Row>(\n        `SELECT delivery.*,message.expires_at,message.delivery_not_before\n         FROM agent_bridge.deliveries delivery\n         JOIN agent_bridge.messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id\n         WHERE delivery.id=$1 AND delivery.workspace=$2 AND message.source=$3 FOR UPDATE OF delivery`,\n        [id, principal.workspace, principal.agent],\n      );\n      const current = visible.rows[0];\n      if (!current) return null;\n      if (![\"dead\", \"cancelled\"].includes(current.state)) {\n        throw new DeliveryStateConflictError(`cannot requeue a ${current.state} delivery`);\n      }\n      if (current.expires_at && new Date(current.expires_at).getTime() <= Date.now()) {\n        throw new DeliveryStateConflictError(\"cannot requeue an expired message\");\n      }\n      const result = await db.query<Row>(\n        `UPDATE agent_bridge.deliveries SET state='pending',\n         available_at=greatest(now(),coalesce($1::timestamptz,now())),\n         cycle_attempt=0,requeue_count=requeue_count+1,\n         lease_token=NULL,lease_owner=NULL,lease_expires_at=NULL,last_error=NULL,\n         last_actor=$2,last_action='requeue' WHERE id=$3 RETURNING *`,\n        [current.delivery_not_before, principal.agent, id],\n      );\n      return asDelivery(result.rows[0]!);\n    });\n  }\n\n  async diagnostics(principal: BridgePrincipal): Promise<BridgeDiagnostics> {\n    const result = await this.db.query<Row>(\n      `SELECT\n         count(*) FILTER (WHERE state='pending')::integer AS pending,\n         count(*) FILTER (WHERE state='claimed')::integer AS claimed,\n         count(*) FILTER (WHERE state='retrying')::integer AS retrying,\n         count(*) FILTER (WHERE state='dead')::integer AS dead,\n         count(*) FILTER (WHERE state='cancelled')::integer AS cancelled,\n         min(available_at) FILTER (WHERE state IN ('pending','retrying')) AS oldest_available,\n         count(*) FILTER (WHERE state IN ('pending','retrying') AND available_at<=now())::integer AS due,\n         count(*) FILTER (WHERE state IN ('pending','retrying') AND available_at>now())::integer AS scheduled,\n         count(*) FILTER (WHERE state='claimed' AND lease_expires_at<=now())::integer AS expired_leases,\n         min(available_at) FILTER (WHERE state IN ('pending','retrying') AND available_at<=now()) AS oldest_due,\n         coalesce(greatest(0,extract(epoch FROM (now()-min(available_at) FILTER (WHERE state IN ('pending','retrying') AND available_at<=now())))*1000),0)::bigint AS queue_lag_ms\n       FROM agent_bridge.deliveries WHERE workspace=$1 AND recipient=$2`,\n      [principal.workspace, principal.agent],\n    );\n    const queue = result.rows[0] ?? {};\n    return {\n      schemaVersion: \"postgres-v2\",\n      deliverySupported: true,\n      pending: Number(queue.pending ?? 0),\n      claimed: Number(queue.claimed ?? 0),\n      retrying: Number(queue.retrying ?? 0),\n      dead: Number(queue.dead ?? 0),\n      cancelled: Number(queue.cancelled ?? 0),\n      oldestAvailableAt: asTimestamp(queue.oldest_available),\n      due: Number(queue.due ?? 0),\n      scheduled: Number(queue.scheduled ?? 0),\n      expiredLeases: Number(queue.expired_leases ?? 0),\n      oldestDueAt: asTimestamp(queue.oldest_due),\n      queueLagMs: Number(queue.queue_lag_ms ?? 0),\n    };\n  }\n\n  async heartbeat(principal: BridgePrincipal, leaseMs: number, runtimeType?: string, capabilities: string[] = []): Promise<AgentPresence> {\n    await this.db.query(\n      \"DELETE FROM agent_bridge.agent_instances WHERE workspace=$1 AND lease_expires_at<=now()\",\n      [principal.workspace],\n    );\n    const result = await this.db.query<Row>(\n      `WITH locked AS (\n         SELECT pg_advisory_xact_lock(hashtextextended($1, 0))\n       )\n       INSERT INTO agent_bridge.agent_instances (workspace,agent,instance,runtime_type,capabilities,lease_expires_at,last_seen_at)\n       SELECT $1,$2,$3,$4,$5::jsonb,now() + ($6 * interval '1 millisecond'),now()\n       FROM locked\n       WHERE EXISTS (\n         SELECT 1 FROM agent_bridge.agent_instances\n         WHERE workspace=$1 AND agent=$2 AND instance=$3\n       ) OR ((\n         SELECT count(*) < 128 FROM agent_bridge.agent_instances\n         WHERE workspace=$1 AND agent=$2\n       ) AND (\n         SELECT count(*) < 4096 FROM agent_bridge.agent_instances\n         WHERE workspace=$1\n       )\n       )\n       ON CONFLICT (workspace,agent,instance) DO UPDATE SET runtime_type=excluded.runtime_type,capabilities=excluded.capabilities,lease_expires_at=excluded.lease_expires_at,last_seen_at=excluded.last_seen_at\n       RETURNING *`,\n      [principal.workspace, principal.agent, principal.instance, runtimeType ?? null, JSON.stringify(capabilities), leaseMs],\n    );\n    if (!result.rows[0]) {\n      throw Object.assign(new Error(\"active instance limit reached\"), {\n        status: 429,\n        code: \"presence_limit\",\n      });\n    }\n    return asPresence(result.rows[0]!);\n  }\n\n  async listPresence(principal: BridgePrincipal): Promise<AgentPresence[]> {\n    await this.db.query(\n      \"DELETE FROM agent_bridge.agent_instances WHERE workspace=$1 AND lease_expires_at<=now()\",\n      [principal.workspace],\n    );\n    const result = await this.db.query<Row>(\n      \"SELECT * FROM agent_bridge.agent_instances WHERE workspace=$1 ORDER BY agent,instance\",\n      [principal.workspace],\n    );\n    return result.rows.map(asPresence);\n  }\n\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAiD3B,SAAS,KAAK,OAA+B;AAC3C,SAAO,UAAU,SAAY,OAAO,KAAK,UAAU,KAAK;AAC1D;AAEA,SAAS,MAAM,OAAqB;AAClC,SAAO,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACzD;AAEA,SAAS,YAAY,OAAoC;AACvD,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,UAAU,KAAyB;AAC1C,QAAM,iBAAiC,IAAI,kBAAkB,YACzD,EAAE,MAAM,UAAU,IAClB;AAAA,IACE,MAAM;AAAA,IACN,aAAa,OAAO,IAAI,qBAAqB;AAAA,IAC7C,kBAAkB,OAAO,IAAI,4BAA4B;AAAA,IACzD,iBAAiB,OAAO,IAAI,2BAA2B;AAAA,IACvD,kBAAkB,OAAO,IAAI,2BAA2B;AAAA,IACxD,GAAI,IAAI,sBAAsB,EAAE,WAAW,YAAY,IAAI,mBAAmB,EAAE,IAAI,CAAC;AAAA,EACvF;AACJ,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,SAAS,IAAI,WAAW;AAAA,IACxB,QAAQ,OAAO,IAAI,MAAM;AAAA,IACzB,UAAU,OAAO,IAAI,QAAQ;AAAA,IAC7B,MAAM,OAAO,IAAI,IAAI;AAAA,IACrB,SAAS,OAAO,IAAI,OAAO;AAAA,IAC3B,aAAa,OAAO,IAAI,YAAY;AAAA,IACpC,MAAM,MAAM,IAAI,IAAI;AAAA,IACpB,SAAS,MAAM,IAAI,OAAO,KAAK,CAAC;AAAA,IAChC,UAAU,IAAI,aAAa;AAAA,IAC3B,WAAW,IAAI,eAAe;AAAA,IAC9B,eAAe,IAAI,kBAAkB;AAAA,IACrC,aAAa,IAAI,gBAAgB;AAAA,IACjC,UAAU,IAAI;AAAA,IACd,WAAW,YAAY,IAAI,UAAU;AAAA,IACrC,gBAAgB,IAAI,mBAAmB;AAAA,IACvC,gBAAgB,IAAI,oBAAoB;AAAA,IACxC,YAAY,MAAM,IAAI,WAAW;AAAA,IACjC,UAAU,MAAM,IAAI,QAAQ;AAAA,IAC5B;AAAA,IACA,WAAW,YAAY,IAAI,UAAU,KAAK;AAAA,EAC5C;AACF;AAEA,SAAS,WAAW,KAA0B;AAC5C,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,WAAW,OAAO,IAAI,UAAU;AAAA,IAChC,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,OAAO,IAAI;AAAA,IACX,SAAS,OAAO,IAAI,OAAO;AAAA,IAC3B,cAAc,OAAO,IAAI,iBAAiB,IAAI,OAAO;AAAA,IACrD,cAAc,OAAO,IAAI,iBAAiB,CAAC;AAAA,IAC3C,WAAW,YAAY,IAAI,UAAU,KAAK;AAAA,IAC1C,cAAc,OAAO,IAAI,aAAa;AAAA,IACtC,aAAa,YAAY,IAAI,YAAY,KAAK;AAAA,IAC9C,YAAY,IAAI,eAAe;AAAA,IAC/B,YAAY,IAAI,eAAe;AAAA,IAC/B,gBAAgB,YAAY,IAAI,gBAAgB;AAAA,IAChD,WAAW,IAAI,cAAc;AAAA,IAC7B,WAAW,IAAI,cAAc;AAAA,IAC7B,YAAY,IAAI;AAAA,EAClB;AACF;AAEA,SAAS,WAAW,KAAyB;AAC3C,SAAO;AAAA,IACL,WAAW,OAAO,IAAI,SAAS;AAAA,IAAG,OAAO,OAAO,IAAI,KAAK;AAAA,IAAG,UAAU,OAAO,IAAI,QAAQ;AAAA,IACzF,aAAa,IAAI,gBAAgB;AAAA,IAAW,cAAc,MAAM,IAAI,YAAY,KAAK,CAAC;AAAA,IACtF,gBAAgB,YAAY,IAAI,gBAAgB,KAAK;AAAA,IAAI,YAAY,YAAY,IAAI,YAAY,KAAK;AAAA,EACxG;AACF;AAEA,SAAS,gBAAgB,KAA+B;AACtD,SAAO;AAAA,IACL,UAAU,OAAO,IAAI,QAAQ;AAAA,IAAG,YAAY,OAAO,IAAI,WAAW;AAAA,IAClE,WAAW,OAAO,IAAI,UAAU;AAAA,IAAG,WAAW,OAAO,IAAI,SAAS;AAAA,IAClE,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,WAAW,IAAI,cAAc,OAAO,SAAY,IAAI;AAAA,IACpD,SAAS,IAAI;AAAA,IAA4C,SAAS,OAAO,IAAI,OAAO;AAAA,IACpF,cAAc,OAAO,IAAI,aAAa;AAAA,IAAG,cAAc,OAAO,IAAI,aAAa;AAAA,IAC/E,YAAY,IAAI,eAAe;AAAA,IAAW,OAAO,IAAI,SAAS;AAAA,IAC9D,OAAO,OAAO,IAAI,KAAK;AAAA,IAAG,QAAQ,IAAI;AAAA,IACtC,WAAW,YAAY,IAAI,UAAU,KAAK;AAAA,EAC5C;AACF;AAEA,eAAe,YAAe,IAAiB,MAAuD;AACpG,MAAI,GAAG,cAAe,QAAO,KAAK,EAAE;AACpC,QAAM,WAAW,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;AAClD,QAAM,SAAS,WAAW,MAAM,GAAG,QAAS,IAAI;AAChD,MAAI;AACF,UAAM,OAAO,MAAM,OAAO;AAC1B,UAAM,SAAS,MAAM,KAAK,MAAM;AAChC,UAAM,OAAO,MAAM,QAAQ;AAC3B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,OAAO,MAAM,UAAU,EAAE,MAAM,MAAM,MAAS;AACpD,UAAM;AAAA,EACR,UAAE;AACA,QAAI,YAAY,aAAa,UAAU,OAAO,OAAO,YAAY,WAAY,QAAO,QAAQ;AAAA,EAC9F;AACF;AAEO,IAAM,sBAAN,MAAiD;AAAA,EACtD,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAE/C,MAAM,aAA4B;AAAA,EAElC;AAAA,EAEA,MAAM,cACJ,OAC8B;AAC9B,UAAM,SAAS;AAAA,MACb,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,WAAW;AAAA,MACjB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,KAAK,MAAM,IAAI;AAAA,MACf,KAAK,MAAM,OAAO;AAAA,MAClB,MAAM,YAAY;AAAA,MAClB,MAAM,aAAa;AAAA,MACnB,MAAM,iBAAiB;AAAA,MACvB,MAAM,eAAe;AAAA,MACrB,MAAM;AAAA,MACN,MAAM,aAAa;AAAA,MACnB,MAAM,kBAAkB;AAAA,MACxB,MAAM,kBAAkB;AAAA,MACxB,KAAK,MAAM,UAAU;AAAA,MACrB,KAAK,MAAM,QAAQ;AAAA,MACnB,MAAM,eAAe;AAAA,MACrB,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,cAAc;AAAA,MAC5E,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,mBAAmB;AAAA,MACjF,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,kBAAkB;AAAA,MAChF,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,mBAAmB;AAAA,MACjF,MAAM,eAAe,SAAS,WAAW,MAAM,eAAe,aAAa,OAAO;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MA4CA;AAAA,IACF;AAEA,QAAI,MAAM,OAAO,KAAK,CAAC;AACvB,QAAI,CAAC,OAAO,MAAM,gBAAgB;AAChC,YAAM,WAAW,MAAM,KAAK,GAAG;AAAA,QAC7B;AAAA;AAAA;AAAA,QAGA,CAAC,MAAM,WAAW,MAAM,QAAQ,MAAM,cAAc;AAAA,MACtD;AACA,YAAM,SAAS,KAAK,CAAC;AAAA,IACvB;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,qCAAqC;AAC/D,UAAM,UAAU,UAAU,GAAG;AAC7B,QAAI,IAAI,YAAY,KAAM,wBAAuB,SAAS,KAAK;AAC/D,WAAO,EAAE,SAAS,SAAS,IAAI,YAAY,KAAK;AAAA,EAClD;AAAA,EAEA,MAAM,aACJ,WACA,QAAsB,CAAC,GACD;AACtB,UAAM,QAAQ,YAAY,WAAW,KAAK;AAC1C,UAAM,SAAS,aAAa,MAAM,QAAQ,KAAK,KAAK;AACpD,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,MAAM,SAAS,EAAE,GAAG,CAAC,GAAG,GAAG;AACtE,UAAM,WAAW,MAAM,SAAS,SAAY,MAAM,KAAK,GAAG;AAAA,MACxD;AAAA,MACA,CAAC,UAAU,SAAS;AAAA,IACtB;AACA,UAAM,YAAY,UAAU,KAAK,CAAC,GAAG;AACrC,UAAM,SAAoB,MAAM,SAC5B,CAAC,UAAU,WAAW,UAAU,KAAK,IACrC,CAAC,UAAU,WAAW,QAAQ,UAAU,KAAK;AACjD,UAAM,UAAU,MAAM,WAAW;AACjC,UAAM,aAAa,MAAM,SAAS,IAAI;AACtC,UAAM,aAAa,YAAY,SAAS,WAAW,UAAU,KACzD,YAAY,QAAQ,YAAY,UAAU,yCAAyC,UAAU,MAC7F,sCAAsC,UAAU;AACpD,QAAI,MAAM,0DAA0D,MAAM,SAAS,KAAK,0BAA0B,OAAO,UAAU;AAEnI,QAAI,WAAW;AACb,aAAO,KAAK,SAAS;AACrB,aAAO,qBAAqB,OAAO,MAAM;AAAA,IAC3C;AAEA,QAAI,CAAC,MAAM,gBAAgB;AACzB,aAAO;AAAA,IACT;AACA,QAAI,MAAM,OAAO,QAAQ;AACvB,aAAO,KAAK,MAAM,KAAK;AACvB,aAAO,oBAAoB,OAAO,MAAM;AAAA,IAC1C;AACA,QAAI,MAAM,QAAQ;AAChB,aAAO,KAAK,MAAM,MAAM;AACxB,aAAO,kBAAkB,OAAO,MAAM;AAAA,IACxC;AACA,QAAI,MAAM,SAAS;AACjB,aAAO,KAAK,MAAM,OAAO;AACzB,aAAO,mBAAmB,OAAO,MAAM;AAAA,IACzC;AACA,QAAI,MAAM,OAAO;AACf,aAAO,KAAK,MAAM,KAAK;AACvB,aAAO,uBAAuB,OAAO,MAAM;AAAA,IAC7C;AACA,QAAI,MAAM,gBAAgB,MAAM,iBAAiB,OAAO;AACtD,aAAO,QAAQ,MAAM,iBAAiB,WAAW,SAAS,EAAE;AAAA;AAAA;AAAA;AAAA,mCAI/B,UAAU;AAAA;AAAA,IAEzC;AACA,QAAI,MAAM,UAAU;AAClB,aAAO,KAAK,MAAM,QAAQ;AAC1B,aAAO,qBAAqB,OAAO,MAAM;AAAA,IAC3C;AAEA,WAAO,KAAK,KAAK;AACjB,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B,GAAG,GAAG,sBAAsB,MAAM,SAAS,SAAS,KAAK,WAAW,OAAO,MAAM;AAAA,MACjF;AAAA,IACF;AACA,UAAM,WAAW,OAAO,KAAK,IAAI,SAAS;AAC1C,UAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,QAAI,MAAM,OAAQ,QAAO,EAAE,UAAU,QAAQ,SAAS,CAAC,IAAI,aAAa,SAAS,CAAC,EAAE,UAAU,KAAK,IAAI,MAAM,OAAO;AACpH,QAAI,SAAS,WAAW,MAAO,QAAO,EAAE,UAAU,QAAQ,aAAa,KAAM,UAAU,KAAK,EAAE;AAC9F,WAAO,EAAE,UAAU,QAAQ,YAAY,aAAa,WAAW,KAAK,IAAI,MAAM,OAAO;AAAA,EACvF;AAAA,EAEA,MAAM,cACJ,WACA,KACA,SAAS,oBAAI,KAAK,GACD;AACjB,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,UAAU,WAAW,KAAK,UAAU,OAAO,MAAM;AAAA,IACpD;AACA,WAAO,OAAO,YAAY;AAAA,EAC5B;AAAA,EAEA,MAAM,cACJ,WACA,SACgC;AAChC,WAAO,YAAY,KAAK,IAAI,OAAO,OAAO;AACxC,YAAM,GAAG;AAAA,QACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUA,CAAC,UAAU,WAAW,UAAU,OAAO,QAAQ,aAAa,IAAI;AAAA,MAClE;AACA,YAAM,GAAG;AAAA,QACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAWA,CAAC,UAAU,WAAW,UAAU,OAAO,QAAQ,aAAa,IAAI;AAAA,MAClE;AACA,YAAM,GAAG;AAAA,QACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUA,CAAC,UAAU,WAAW,UAAU,OAAO,QAAQ,aAAa,IAAI;AAAA,MAClE;AACA,YAAM,YAAY,MAAM,GAAG;AAAA,QACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,UAAU,WAAW,UAAU,OAAO,QAAQ,aAAa,IAAI;AAAA,MAClE;AACA,UAAI,CAAC,UAAU,KAAK,CAAC,EAAG,QAAO;AAC/B,YAAM,QAAQ,WAAW;AACzB,YAAM,QAAQ,UAAU,YAAY,UAAU;AAC9C,YAAM,UAAU,MAAM,GAAG;AAAA,QACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOA,CAAC,OAAO,OAAO,QAAQ,SAAS,UAAU,OAAO,UAAU,KAAK,CAAC,EAAE,EAAE;AAAA,MACvE;AACA,aAAO,WAAW,QAAQ,KAAK,CAAC,CAAE;AAAA,IACpC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cACJ,WACA,IACA,OACA,SACgC;AAChC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,SAAS,UAAU,WAAW,UAAU,OAAO,UAAU,YAAY,UAAU,OAAO,IAAI,KAAK;AAAA,IAClG;AACA,WAAO,OAAO,KAAK,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,CAAC,IAAI;AAAA,EACvD;AAAA,EAEA,MAAM,eACJ,WACA,IACA,OACA,OACA,OACA,cACgC;AAChC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MA4BA;AAAA,QACE;AAAA,QACA,OAAO,MAAM,GAAG,IAAI,KAAK;AAAA,QACzB,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU,YAAY,UAAU;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,KAAK,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,CAAC,IAAI;AAAA,EACvD;AAAA,EAEA,MAAM,eAAe,WAA4B,QAAuB,CAAC,GAAG;AAC1E,UAAM,UAAU;AAAA,MACd,MAAM,MAAM,QAAQ;AAAA,MACpB,QAAQ,CAAC,GAAI,MAAM,UAAU,CAAC,CAAE,EAAE,KAAK;AAAA,MACvC,WAAW,MAAM,aAAa;AAAA,MAC9B,WAAW,MAAM,aAAa;AAAA,IAChC;AACA,UAAM,QAAQ,kBAAkB,cAAc,WAAW,OAAO;AAChE,UAAM,WAAW,+BAA+B,mBAAmB,MAAM,QAAQ,KAAK,CAAC;AACvF,UAAM,YAAY,UAAU;AAC5B,UAAM,KAAK,UAAU;AACrB,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAoB,CAAC,UAAU,WAAW,UAAU,KAAK;AAC/D,UAAM,UAAU,CAAC,uBAAuB;AACxC,UAAM,OAAO,MAAM,QAAQ;AAC3B,YAAQ,KAAK,SAAS,cAAc,0BAA0B,SAAS,cAAc,sBAAsB,8CAA8C;AACzJ,QAAI,aAAa,IAAI;AACnB,aAAO,KAAK,WAAW,EAAE;AACzB,cAAQ,KAAK,uCAAuC,OAAO,SAAS,CAAC,kBAAkB,OAAO,MAAM,SAAS;AAAA,IAC/G;AACA,QAAI,MAAM,WAAW;AAAE,aAAO,KAAK,MAAM,SAAS;AAAG,cAAQ,KAAK,wBAAwB,OAAO,MAAM,EAAE;AAAA,IAAG;AAC5G,QAAI,MAAM,WAAW;AAAE,aAAO,KAAK,MAAM,SAAS;AAAG,cAAQ,KAAK,uBAAuB,OAAO,MAAM,EAAE;AAAA,IAAG;AAC3G,QAAI,MAAM,QAAQ,QAAQ;AAAE,aAAO,KAAK,MAAM,MAAM;AAAG,cAAQ,KAAK,uBAAuB,OAAO,MAAM,WAAW;AAAA,IAAG;AACtH,WAAO,KAAK,KAAK;AACjB,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA,eAES,QAAQ,KAAK,OAAO,CAAC;AAAA,yDACqB,OAAO,MAAM;AAAA,MAChE;AAAA,IACF;AACA,UAAM,aAAa,OAAO,KAAK,IAAI,UAAU;AAC7C,UAAM,OAAO,WAAW,WAAW,SAAS,CAAC;AAC7C,WAAO,EAAE,YAAY,QAAQ,WAAW,WAAW,SAAS,OAAO,mBAAmB,OAAO,EAAE,WAAW,KAAK,WAAW,IAAI,KAAK,GAAG,CAAC,IAAI,OAAU;AAAA,EACvJ;AAAA,EAEA,MAAM,mBAAmB,WAA4B,IAAY,QAA6C,CAAC,GAAG;AAChH,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,MAAM,SAAS,IAAI,CAAC,GAAG,GAAG;AAC1D,UAAM,QAAQ,kBAAkB,mBAAmB,WAAW,EAAE,YAAY,GAAG,CAAC;AAChF,UAAM,WAAW,4BAA4B,mBAAmB,MAAM,QAAQ,KAAK,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,UAAU,WAAW,IAAI,YAAY,KAAK,UAAU,OAAO,KAAK;AAAA,IACnE;AACA,UAAM,SAAS,OAAO,KAAK,IAAI,eAAe;AAC9C,UAAM,OAAO,OAAO,OAAO,SAAS,CAAC;AACrC,WAAO,EAAE,QAAQ,QAAQ,OAAO,WAAW,SAAS,OAAO,mBAAmB,OAAO,KAAK,QAAQ,IAAI,OAAU;AAAA,EAClH;AAAA,EAEA,MAAM,eAAe,WAA4B,IAAY;AAC3D,WAAO,YAAY,KAAK,IAAI,OAAO,OAAO;AACxC,YAAM,UAAU,MAAM,GAAG;AAAA,QACvB;AAAA;AAAA;AAAA,QAGA,CAAC,IAAI,UAAU,WAAW,UAAU,KAAK;AAAA,MAC3C;AACA,YAAM,UAAU,QAAQ,KAAK,CAAC;AAC9B,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,QAAQ,UAAU,YAAa,QAAO,WAAW,OAAO;AAC5D,UAAI,CAAC,CAAC,WAAW,YAAY,SAAS,EAAE,SAAS,QAAQ,KAAK,GAAG;AAC/D,cAAM,IAAI,2BAA2B,mBAAmB,QAAQ,KAAK,WAAW;AAAA,MAClF;AACA,YAAM,SAAS,MAAM,GAAG;AAAA,QACtB;AAAA;AAAA;AAAA,QAGA,CAAC,UAAU,OAAO,EAAE;AAAA,MACtB;AACA,aAAO,WAAW,OAAO,KAAK,CAAC,CAAE;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gBAAgB,WAA4B,IAAY;AAC5D,WAAO,YAAY,KAAK,IAAI,OAAO,OAAO;AACxC,YAAM,UAAU,MAAM,GAAG;AAAA,QACvB;AAAA;AAAA;AAAA;AAAA,QAIA,CAAC,IAAI,UAAU,WAAW,UAAU,KAAK;AAAA,MAC3C;AACA,YAAM,UAAU,QAAQ,KAAK,CAAC;AAC9B,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,CAAC,CAAC,QAAQ,WAAW,EAAE,SAAS,QAAQ,KAAK,GAAG;AAClD,cAAM,IAAI,2BAA2B,oBAAoB,QAAQ,KAAK,WAAW;AAAA,MACnF;AACA,UAAI,QAAQ,cAAc,IAAI,KAAK,QAAQ,UAAU,EAAE,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC9E,cAAM,IAAI,2BAA2B,mCAAmC;AAAA,MAC1E;AACA,YAAM,SAAS,MAAM,GAAG;AAAA,QACtB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,CAAC,QAAQ,qBAAqB,UAAU,OAAO,EAAE;AAAA,MACnD;AACA,aAAO,WAAW,OAAO,KAAK,CAAC,CAAE;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,WAAwD;AACxE,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,UAAU,WAAW,UAAU,KAAK;AAAA,IACvC;AACA,UAAM,QAAQ,OAAO,KAAK,CAAC,KAAK,CAAC;AACjC,WAAO;AAAA,MACL,eAAe;AAAA,MACf,mBAAmB;AAAA,MACnB,SAAS,OAAO,MAAM,WAAW,CAAC;AAAA,MAClC,SAAS,OAAO,MAAM,WAAW,CAAC;AAAA,MAClC,UAAU,OAAO,MAAM,YAAY,CAAC;AAAA,MACpC,MAAM,OAAO,MAAM,QAAQ,CAAC;AAAA,MAC5B,WAAW,OAAO,MAAM,aAAa,CAAC;AAAA,MACtC,mBAAmB,YAAY,MAAM,gBAAgB;AAAA,MACrD,KAAK,OAAO,MAAM,OAAO,CAAC;AAAA,MAC1B,WAAW,OAAO,MAAM,aAAa,CAAC;AAAA,MACtC,eAAe,OAAO,MAAM,kBAAkB,CAAC;AAAA,MAC/C,aAAa,YAAY,MAAM,UAAU;AAAA,MACzC,YAAY,OAAO,MAAM,gBAAgB,CAAC;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,WAA4B,SAAiB,aAAsB,eAAyB,CAAC,GAA2B;AACtI,UAAM,KAAK,GAAG;AAAA,MACZ;AAAA,MACA,CAAC,UAAU,SAAS;AAAA,IACtB;AACA,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAmBA,CAAC,UAAU,WAAW,UAAU,OAAO,UAAU,UAAU,eAAe,MAAM,KAAK,UAAU,YAAY,GAAG,OAAO;AAAA,IACvH;AACA,QAAI,CAAC,OAAO,KAAK,CAAC,GAAG;AACnB,YAAM,OAAO,OAAO,IAAI,MAAM,+BAA+B,GAAG;AAAA,QAC9D,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,WAAO,WAAW,OAAO,KAAK,CAAC,CAAE;AAAA,EACnC;AAAA,EAEA,MAAM,aAAa,WAAsD;AACvE,UAAM,KAAK,GAAG;AAAA,MACZ;AAAA,MACA,CAAC,UAAU,SAAS;AAAA,IACtB;AACA,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAC3B;AAAA,MACA,CAAC,UAAU,SAAS;AAAA,IACtB;AACA,WAAO,OAAO,KAAK,IAAI,UAAU;AAAA,EACnC;AAEF;","names":[]}