@creatornader/agent-bridge 0.5.2 → 0.6.0

package/dist/chunk-AIALYLGQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/message-envelope.ts","../src/source-identity.ts"],"sourcesContent":["import { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport {\n  CallToolRequestSchema,\n  ErrorCode,\n  ListToolsRequestSchema,\n  McpError,\n} from \"@modelcontextprotocol/sdk/types.js\";\n\nimport { normalizeReceiptId } from \"./atrib-receipt.js\";\nimport {\n  buildMessageEnvelope,\n  mergeEnvelopeMetadata,\n} from \"./message-envelope.js\";\nimport { resolveAgentIdentity, resolvePostSource } from \"./source-identity.js\";\nimport { BridgeService } from \"./bridge-service.js\";\nimport {\n  BridgePrincipalMismatchError,\n  BridgeValidationError,\n  validateProject,\n  validateMessageDraft,\n  type BridgePrincipal,\n  type MessageDraft,\n} from \"./bridge-domain.js\";\nimport { createStore } from \"./client-runtime.js\";\nimport { legacyContextMetadata, legacyNumericMessageId } from \"./legacy-compat.js\";\nimport {\n  resolveClientConfig,\n  type ClientConfig,\n  type ClientEnvironment,\n  type ClientProvider,\n} from \"./client-config.js\";\nimport {\n  availableOperations,\n  capabilityDocument,\n  ContractValidationError,\n  parseResponse,\n  validateRequest,\n} from \"./contracts/registry.js\";\n\nexport interface AgentBridgeServerConfig {\n  agent?: string;\n  provider?: ClientProvider;\n  workspace?: string;\n  instance?: string;\n  databasePath?: string;\n  edgeDatabasePath?: string;\n  cursorPath?: string;\n  gatewayUrl?: string;\n  gatewayToken?: string;\n}\n\nexport const MCP_IMPLEMENTATION_VERSION = \"2.0.0\";\n\nexport interface AgentBridgeServerEnv {\n  AGENT_BRIDGE_URL?: string;\n  AGENT_BRIDGE_KEY?: string;\n  AGENT_BRIDGE_AGENT?: string;\n  AGENT_BRIDGE_CONFIG?: string;\n  HOME?: string;\n  AGENT_BRIDGE_PROVIDER?: string;\n  AGENT_BRIDGE_TOKEN?: string;\n  AGENT_BRIDGE_WORKSPACE?: string;\n  AGENT_BRIDGE_INSTANCE?: string;\n  AGENT_BRIDGE_DB?: string;\n}\n\nexport function configFromEnv(\n  env: AgentBridgeServerEnv = process.env,\n): AgentBridgeServerConfig {\n  const client = resolveClientConfig(env as ClientEnvironment);\n  return {\n    provider: client.provider,\n    agent: client.principal.agent,\n    workspace: client.principal.workspace,\n    instance: client.principal.instance,\n    databasePath: client.databasePath,\n    edgeDatabasePath: client.edgeDatabasePath,\n    cursorPath: client.cursorPath,\n    gatewayUrl: client.provider === \"gateway\" ? client.url : undefined,\n    gatewayToken: client.provider === \"gateway\" ? client.credential : undefined,\n  };\n}\n\nexport function createAgentBridgeServer(\n  config: AgentBridgeServerConfig,\n): Server {\n  const provider = config.provider ?? (config.gatewayToken ? \"gateway\" : \"local\");\n  const principal: BridgePrincipal | undefined = config.agent ? {\n    workspace: config.workspace ?? \"default\",\n    agent: config.agent,\n    instance: config.instance,\n  } : undefined;\n  const clientConfig: ClientConfig | undefined = principal ? {\n    provider, principal,\n    url: config.gatewayUrl, credential: config.gatewayToken,\n    databasePath: config.databasePath ?? \":memory:\", edgeDatabasePath: config.edgeDatabasePath ?? config.databasePath ?? \":memory:\", cursorPath: config.cursorPath ?? \"\", configPath: \"\",\n  } : undefined;\n  const store = clientConfig ? createStore(clientConfig) : undefined;\n  const service = store ? new BridgeService(store) : undefined;\n  const server = new Server(\n    { name: \"agent-bridge\", version: MCP_IMPLEMENTATION_VERSION },\n    { capabilities: { tools: {} } },\n  );\n\n  server.setRequestHandler(ListToolsRequestSchema, async () => {\n    const legacyTools = [\n      {\n        name: \"post_context\",\n        description:\n          \"Post a shared context entry visible to all agents. Categories: operational, config-change, goal-update, flag, bridge-meta (for suggesting improvements to the Agent Bridge itself).\",\n        inputSchema: {\n          type: \"object\" as const,\n          properties: {\n            source: {\n              type: \"string\",\n              description:\n                \"Optional posting agent. Defaults to AGENT_BRIDGE_AGENT when configured; an explicit value must match it.\",\n            },\n            category: {\n              type: \"string\",\n              description:\n                \"Entry type: operational | config-change | goal-update | flag | bridge-meta\",\n            },\n            content: {\n              type: \"string\",\n              description: \"The context message\",\n            },\n            priority: {\n              type: \"string\",\n              description: \"info (default) | high | urgent\",\n            },\n            project: {\n              type: \"string\",\n              description:\n                \"Optional immutable message label. Omit for an unlabeled message.\",\n            },\n            metadata: {\n              type: \"object\",\n              description: \"Arbitrary structured data\",\n            },\n            message_id: {\n              type: \"string\",\n              description:\n                \"Stable message id. Generated by the bridge when omitted.\",\n            },\n            target_agents: {\n              type: \"array\",\n              items: { type: \"string\" },\n              description:\n                \"Optional target agent names. Empty or omitted means broadcast.\",\n            },\n            thread_id: {\n              type: \"string\",\n              description: \"Optional conversation/thread id.\",\n            },\n            reply_to_id: {\n              type: \"string\",\n              description: \"Optional parent message id for reply threading.\",\n            },\n            kind: {\n              type: \"string\",\n              description:\n                \"Message kind: operational | config-change | goal-update | flag | bridge-meta | handoff | request | result\",\n            },\n            payload_mime: {\n              type: \"string\",\n              description:\n                \"Payload MIME type. Defaults to text/plain for the content column.\",\n            },\n            payload: {\n              anyOf: [\n                { type: \"object\" },\n                { type: \"array\" },\n                { type: \"string\" },\n                { type: \"number\" },\n                { type: \"boolean\" },\n                { type: \"null\" },\n              ],\n              description:\n                \"Optional structured payload stored in metadata.message_envelope.\",\n            },\n            payload_ref: {\n              type: \"string\",\n              description: \"Optional external blob pointer for large payloads.\",\n            },\n            payload_ciphertext: {\n              type: \"string\",\n              description:\n                \"Optional inline encrypted payload for small encrypted messages.\",\n            },\n            informed_by: {\n              type: \"array\",\n              items: { type: \"string\" },\n              description:\n                \"Optional atrib record hashes (sha256:<64-hex>) this message depends on.\",\n            },\n            expires_at: {\n              type: \"string\",\n              description: \"Optional ISO timestamp retention boundary.\",\n            },\n            atrib_receipt_id: {\n              type: \"string\",\n              description:\n                \"Optional. Signed atrib record receipt_id for the wrapper that signed this post_context call. Set automatically by an atrib-signing wrapper; consumers reading the row use this as the informed_by anchor for cross-process causal edges.\",\n            },\n          },\n          required: [\"category\", \"content\"],\n        },\n      },\n      {\n        name: \"get_context\",\n        description:\n          \"Read shared context entries, newest first. Filter by source, category, project, or unacknowledged entries.\",\n        inputSchema: {\n          type: \"object\" as const,\n          properties: {\n            since: {\n              type: \"string\",\n              description: \"ISO timestamp. Only entries after this time\",\n            },\n            source: {\n              type: \"string\",\n              description: \"Filter by posting agent\",\n            },\n            category: {\n              type: \"string\",\n              description: \"Filter by category\",\n            },\n            project: {\n              type: \"string\",\n              description: \"Filter by an exact project label\",\n            },\n            unacked_by: {\n              type: \"string\",\n              description:\n                \"Only entries NOT yet acknowledged by this agent name. Defaults to AGENT_BRIDGE_AGENT when configured.\",\n            },\n            limit: {\n              type: \"number\",\n              description: \"Max entries to return (default 20)\",\n              minimum: 1,\n              maximum: 200,\n            },\n            target_agent: {\n              type: \"string\",\n              description:\n                \"Return broadcast entries plus entries targeted to this agent.\",\n            },\n            thread_id: {\n              type: \"string\",\n              description: \"Filter by metadata.message_envelope.thread_id.\",\n            },\n            kind: {\n              type: \"string\",\n              description: \"Filter by metadata.message_envelope.kind.\",\n            },\n          },\n        },\n        outputSchema: {\n          type: \"object\" as const,\n          properties: {\n            entries: { type: \"array\", items: { type: \"object\", additionalProperties: true } },\n            source: { type: \"string\", enum: [\"remote\", \"cache\"] },\n            stale: { type: \"boolean\" }, degraded: { type: \"boolean\" },\n            acknowledgements: { type: \"string\", enum: [\"authoritative\", \"unknown\"] },\n            lastSyncedAt: { type: [\"string\", \"null\"] },\n          },\n          required: [\"entries\"],\n          additionalProperties: false,\n        },\n      },\n      {\n        name: \"ack_context\",\n        description:\n          \"Acknowledge context entries so they won't appear in unacked queries for this agent.\",\n        inputSchema: {\n          type: \"object\" as const,\n          properties: {\n            ids: {\n              type: \"array\",\n              items: { anyOf: [{ type: \"number\" }, { type: \"string\" }] },\n              description: \"Legacy numeric entry IDs or v2 UUID message IDs to acknowledge\",\n            },\n            agent: {\n              type: \"string\",\n              description:\n                \"Optional acknowledging agent. Defaults to AGENT_BRIDGE_AGENT when configured; an explicit value must match it.\",\n            },\n          },\n          required: [\"ids\"],\n        },\n      },\n    ];\n    const canonical = service ? availableOperations({ surface: \"mcp\", provider }).map((operation) => ({\n      name: operation.mcp!.name,\n      description: operation.summary,\n      inputSchema: operation.request,\n      outputSchema: operation.response,\n    })) : [];\n    return { tools: [...legacyTools, ...canonical] as any };\n  });\n\n  server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {\n    const { name, arguments: args } = request.params;\n    const canonicalResult = (operationId: string, value: unknown) => {\n      const parsed = parseResponse(operationId, value);\n      return {\n        content: [{ type: \"text\" as const, text: JSON.stringify(parsed) }],\n        ...(parsed !== null && typeof parsed === \"object\"\n          ? { structuredContent: parsed as Record<string, unknown> }\n          : {}),\n      };\n    };\n\n    try {\n      switch (name) {\n      case \"capabilities\": {\n        validateRequest(\"capabilities\", args ?? {});\n        return canonicalResult(\"capabilities\", capabilityDocument({ surface: \"mcp\", provider }));\n      }\n      case \"post_context\": {\n        let source: string | undefined;\n        try {\n          source = resolvePostSource(args?.source, config.agent);\n          if (!source) {\n            throw new Error(\n              \"source is required when AGENT_BRIDGE_AGENT is not configured\",\n            );\n          }\n        } catch (e) {\n          throw new McpError(\n            ErrorCode.InvalidParams,\n            e instanceof Error ? e.message : \"source identity mismatch\",\n          );\n        }\n        const project = validateProject(args?.project);\n        const postArgs = { ...(args ?? {}), source, project };\n        const receiptId = normalizeReceiptId(args?.atrib_receipt_id);\n        const envelope = buildMessageEnvelope(postArgs, receiptId);\n        const draft = validateMessageDraft({\n          id: String(envelope.message_id),\n          project,\n          type: String(args?.kind ?? args?.category),\n          content: String(args?.content ?? \"\"),\n          contentType: String(args?.payload_mime ?? \"text/plain\"),\n          data: args?.payload as MessageDraft[\"data\"],\n          targets: Array.isArray(args?.target_agents) ? args.target_agents.map(String) : [],\n          threadId: args?.thread_id as string | undefined,\n          replyToId: args?.reply_to_id as string | undefined,\n          priority: (args?.priority ?? \"info\") as MessageDraft[\"priority\"],\n          expiresAt: args?.expires_at as string | undefined,\n          atribReceiptId: receiptId,\n          informedBy: Array.isArray(args?.informed_by) ? args.informed_by.map(String) : [],\n          metadata: mergeEnvelopeMetadata(args?.metadata, envelope) as MessageDraft[\"metadata\"],\n        });\n        if (!service || !principal) throw new McpError(ErrorCode.InternalError, \"bridge provider is not configured\");\n        const result = await service.publish(principal, draft);\n        return { content: [{ type: \"text\", text: JSON.stringify(result) }], structuredContent: result as unknown as Record<string, unknown> };\n      }\n\n      case \"get_context\": {\n        const project = validateProject(args?.project);\n        const rawLimit = args?.limit;\n        if (\n          rawLimit !== undefined &&\n          (typeof rawLimit !== \"number\" || !Number.isSafeInteger(rawLimit) || rawLimit < 1 || rawLimit > 200)\n        ) {\n          throw new McpError(ErrorCode.InvalidParams, \"limit must be between 1 and 200\");\n        }\n        const requestedLimit = rawLimit ?? 20;\n        if (args?.unacked_by !== undefined && String(args.unacked_by) !== config.agent) {\n          throw new McpError(ErrorCode.InvalidParams, \"unacked_by must equal the configured principal\");\n        }\n        if (service && principal) {\n          if (!service || !principal) throw new McpError(ErrorCode.InternalError, \"bridge provider is not configured\");\n          if (args?.target_agent && String(args.target_agent) !== principal.agent) {\n            return { content: [{ type: \"text\", text: \"[]\" }], structuredContent: { entries: [] } };\n          }\n          const result = await service.history(principal, {\n            limit: requestedLimit,\n            types: args?.kind ? [String(args.kind)] : args?.category ? [String(args.category)] : undefined,\n            source: args?.source ? String(args.source) : undefined,\n            project,\n            since: args?.since ? String(args.since) : undefined,\n            receiptState: \"unread\",\n            threadId: args?.thread_id ? String(args.thread_id) : undefined,\n            latest: true,\n          });\n          const entries = result.messages\n            .slice(0, requestedLimit)\n            .map((message) => ({\n              id: message.id,\n              source: message.source,\n              category: message.type,\n              content: message.content,\n              priority: message.priority,\n              project: message.project ?? null,\n              metadata: legacyContextMetadata(message),\n              atrib_receipt_id: message.atribReceiptId ?? null,\n              created_at: message.createdAt,\n            }));\n          const cachedResult = result as typeof result & {\n            source?: \"remote\" | \"cache\";\n            stale?: boolean;\n            degraded?: boolean;\n            acknowledgements?: \"authoritative\" | \"unknown\";\n            lastSyncedAt?: string;\n          };\n          const cacheMetadata = cachedResult.source\n            ? {\n                source: cachedResult.source,\n                stale: Boolean(cachedResult.stale),\n                degraded: Boolean(cachedResult.degraded),\n                acknowledgements: cachedResult.acknowledgements ?? \"authoritative\",\n                lastSyncedAt: cachedResult.lastSyncedAt ?? null,\n              }\n            : {};\n          return {\n            content: [\n              { type: \"text\", text: JSON.stringify(entries, null, 2) },\n              ...(cachedResult.stale || cachedResult.degraded ? [{\n                type: \"text\" as const,\n                text: `WARNING: cached Agent Bridge context is ${cachedResult.stale ? \"stale\" : \"degraded\"}; acknowledgement authority is ${cachedResult.acknowledgements ?? \"unknown\"}.`,\n              }] : []),\n            ],\n            structuredContent: { entries, ...cacheMetadata },\n          };\n        }\n        throw new McpError(ErrorCode.InternalError, \"bridge provider is not configured\");\n      }\n\n      case \"ack_context\": {\n        const ids = args?.ids as unknown[];\n        let agent: string | undefined;\n        try {\n          agent = resolveAgentIdentity(args?.agent, config.agent);\n        } catch (e) {\n          throw new McpError(\n            ErrorCode.InvalidParams,\n            e instanceof Error ? e.message : \"agent identity mismatch\",\n          );\n        }\n        if (!ids?.length || !agent) {\n          throw new McpError(\n            ErrorCode.InvalidParams,\n            \"ids are required; agent is required when AGENT_BRIDGE_AGENT is not configured\",\n          );\n        }\n        if (service && principal) {\n          if (!service || !principal) throw new McpError(ErrorCode.InternalError, \"bridge provider is not configured\");\n          const acknowledged = await service.acknowledge(\n            principal,\n            ids.map((id) => legacyNumericMessageId(id as string | number)),\n          );\n          return { content: [{ type: \"text\", text: JSON.stringify({ acknowledged, agent }) }], structuredContent: { acknowledged, agent } };\n        }\n        throw new McpError(ErrorCode.InternalError, \"bridge provider is not configured\");\n      }\n\n      case \"send\": {\n        if (!service || !principal) throw new McpError(ErrorCode.InvalidParams, \"AGENT_BRIDGE_AGENT is required\");\n        const input = validateRequest(\"publish_message\", args ?? {});\n        try { resolvePostSource(input.source, principal.agent); } catch (error) { throw new McpError(ErrorCode.InvalidParams, error instanceof Error ? error.message : \"source identity mismatch\"); }\n        const { source: _source, ...draft } = input;\n        return canonicalResult(\"publish_message\", await service.publish(principal, draft as unknown as MessageDraft));\n      }\n      case \"history\": {\n        if (!service || !principal) throw new McpError(ErrorCode.InvalidParams, \"AGENT_BRIDGE_AGENT is required\");\n        const input = validateRequest(\"history\", args ?? {});\n        return canonicalResult(\"history\", await service.history(principal, input));\n      }\n      case \"sync\": {\n        if (!store?.sync) throw new McpError(ErrorCode.InvalidParams, \"sync is available only with the gateway provider\");\n        const input = validateRequest(\"sync\", args ?? {});\n        const result = await store.sync({\n          maxPush: input.maxPush as number | undefined,\n          maxPages: input.maxPages as number | undefined,\n          signal: extra.signal,\n        });\n        return canonicalResult(\"sync\", result);\n      }\n      case \"claim\": {\n        if (!service || !principal) throw new McpError(ErrorCode.InvalidParams, \"AGENT_BRIDGE_AGENT is required\");\n        const input = validateRequest(\"claim_delivery\", args ?? {});\n        const result = await service.claim(principal, {\n          leaseMs: input.leaseMs as number | undefined,\n          messageId: input.messageId as string | undefined,\n          maxAttempts: input.maxAttempts as number | undefined,\n        });\n        return canonicalResult(\"claim_delivery\", result ?? { delivery: null });\n      }\n      case \"list_deliveries\": case \"list_delivery_events\": case \"cancel_delivery\": case \"requeue_delivery\": {\n        if(!service||!principal) throw new McpError(ErrorCode.InvalidParams,\"AGENT_BRIDGE_AGENT is required\");\n        const operationId = name === \"list_deliveries\" ? \"list_deliveries\" : name === \"list_delivery_events\" ? \"list_delivery_events\" : name === \"cancel_delivery\" ? \"cancel_delivery\" : \"requeue_delivery\";\n        const input = validateRequest(operationId, args ?? {});\n        const result=name===\"list_deliveries\"?await service.deliveries(principal,input as any):name===\"list_delivery_events\"?await service.deliveryEvents(principal,String(input.deliveryId),input as any):name===\"cancel_delivery\"?await service.cancel(principal,String(input.deliveryId)):await service.requeue(principal,String(input.deliveryId));\n        return canonicalResult(operationId, name === \"list_deliveries\" || name === \"list_delivery_events\" ? result : { delivery: result });\n      }\n      case \"extend\": case \"acknowledge\": case \"negative_acknowledge\": {\n        if (!service || !principal) throw new McpError(ErrorCode.InvalidParams, \"AGENT_BRIDGE_AGENT is required\");\n        const operationId = name === \"extend\" ? \"extend_delivery\" : name === \"acknowledge\" ? \"acknowledge_delivery\" : \"negative_acknowledge_delivery\";\n        const input = validateRequest(operationId, args ?? {});\n        const id = String(input.deliveryId), token = String(input.leaseToken);\n        const result = name === \"extend\" ? await service.extend(principal, id, token, input.leaseMs as number | undefined)\n          : name === \"acknowledge\" ? await service.ack(principal, id, token)\n          : await service.nack(\n            principal,\n            id,\n            token,\n            input.error as string,\n            (input.disposition ?? input.dead ?? \"retry\") as \"retry\" | \"dead\" | boolean,\n            input.retryPolicy,\n          );\n        return canonicalResult(operationId, { delivery: result });\n      }\n      case \"heartbeat\": {\n        if (!service || !principal) throw new McpError(ErrorCode.InvalidParams, \"AGENT_BRIDGE_AGENT is required\");\n        const input = validateRequest(\"heartbeat\", args ?? {});\n        const result = await service.heartbeat(principal, {\n          leaseMs: input.leaseMs as number | undefined,\n          runtimeType: input.runtimeType as string | undefined,\n          capabilities: input.capabilities as string[] | undefined,\n        });\n        return canonicalResult(\"heartbeat\", result);\n      }\n      case \"presence\": {\n        if (!service || !principal) throw new McpError(ErrorCode.InvalidParams, \"AGENT_BRIDGE_AGENT is required\");\n        validateRequest(\"presence\", args ?? {});\n        const result = { agents: await service.presence(principal) };\n        return canonicalResult(\"presence\", result);\n      }\n\n      default:\n        throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);\n      }\n    } catch (error) {\n      if (error instanceof McpError) throw error;\n      if (error instanceof ContractValidationError || error instanceof BridgeValidationError || error instanceof BridgePrincipalMismatchError) {\n        throw new McpError(ErrorCode.InvalidParams, error.message);\n      }\n      throw error;\n    }\n  });\n\n  let initialization: Promise<void> | undefined;\n  const initializeStore = () => initialization ??= clientConfig?.provider === \"gateway\"\n    ? store?.initialize() ?? Promise.resolve()\n    : Promise.resolve();\n  let closure: Promise<void> | undefined;\n  const closeStore = () => closure ??= store?.close?.() ?? Promise.resolve();\n  const connect = server.connect.bind(server);\n  server.connect = async (transport) => {\n    await initializeStore();\n    await connect(transport);\n  };\n  const close = server.close.bind(server);\n  server.close = async () => {\n    let transportError: unknown;\n    try { await close(); } catch (error) { transportError = error; }\n    try { await closeStore(); } catch (error) {\n      if (transportError) throw Object.assign(new Error(\"failed to close Agent Bridge server\"), {\n        errors: [transportError, error],\n      });\n      throw error;\n    }\n    if (transportError) throw transportError;\n  };\n  server.onclose = () => {\n    void closeStore().catch((error) => server.onerror?.(error instanceof Error ? error : new Error(String(error))));\n  };\n\n  return server;\n}\n\nexport async function startServer(\n  config: AgentBridgeServerConfig = configFromEnv(),\n) {\n  const server = createAgentBridgeServer(config);\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n}\n","import { uuidv7 } from \"./bridge-domain.js\";\n\nexport const MESSAGE_ENVELOPE_SCHEMA = \"agent-bridge.message-envelope.v1\";\n\nconst RECORD_HASH_RE = /^sha256:[a-f0-9]{64}$/i;\n\ntype JsonRecord = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is JsonRecord {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction normalizeString(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed ? trimmed : undefined;\n}\n\nfunction normalizeStringList(value: unknown): string[] | undefined {\n  const raw = Array.isArray(value)\n    ? value\n    : typeof value === \"string\"\n      ? value.split(\",\")\n      : [];\n  const seen = new Set<string>();\n  for (const item of raw) {\n    const normalized = normalizeString(item);\n    if (normalized) seen.add(normalized);\n  }\n  return seen.size ? [...seen] : undefined;\n}\n\nfunction normalizeRecordHashes(value: unknown): string[] | undefined {\n  const raw = Array.isArray(value)\n    ? value\n    : typeof value === \"string\"\n      ? value.split(\",\")\n      : [];\n  const seen = new Set<string>();\n  for (const item of raw) {\n    const normalized = normalizeString(item);\n    if (normalized && RECORD_HASH_RE.test(normalized)) {\n      seen.add(normalized.toLowerCase());\n    }\n  }\n  return seen.size ? [...seen] : undefined;\n}\n\nfunction normalizeIsoTimestamp(value: unknown): string | undefined {\n  const text = normalizeString(value);\n  if (!text) return undefined;\n  const parsed = Date.parse(text);\n  if (Number.isNaN(parsed)) return undefined;\n  return new Date(parsed).toISOString();\n}\n\nexport function normalizeMetadata(value: unknown): JsonRecord {\n  return isRecord(value) ? { ...value } : {};\n}\n\nexport function buildMessageEnvelope(\n  args: JsonRecord | undefined,\n  receiptId?: string\n): JsonRecord {\n  const source = normalizeString(args?.source) ?? \"unknown\";\n  const category = normalizeString(args?.category);\n  const kind = normalizeString(args?.kind) ?? category ?? \"operational\";\n  const messageId = normalizeString(args?.message_id) ?? uuidv7();\n\n  const envelope: JsonRecord = {\n    schema: MESSAGE_ENVELOPE_SCHEMA,\n    message_id: messageId,\n    source_agent: source,\n    kind,\n    priority: normalizeString(args?.priority) ?? \"info\",\n    payload_mime: normalizeString(args?.payload_mime) ?? \"text/plain\",\n  };\n\n  const targetAgents = normalizeStringList(args?.target_agents);\n  if (targetAgents) envelope.target_agents = targetAgents;\n\n  const project = normalizeString(args?.project);\n  if (project) envelope.project = project;\n\n  const threadId = normalizeString(args?.thread_id);\n  if (threadId) envelope.thread_id = threadId;\n\n  const replyToId = normalizeString(args?.reply_to_id);\n  if (replyToId) envelope.reply_to_id = replyToId;\n\n  if (Object.prototype.hasOwnProperty.call(args ?? {}, \"payload\")) {\n    envelope.payload = args?.payload;\n  }\n\n  const payloadRef = normalizeString(args?.payload_ref);\n  if (payloadRef) envelope.payload_ref = payloadRef;\n\n  const payloadCiphertext = normalizeString(args?.payload_ciphertext);\n  if (payloadCiphertext) envelope.payload_ciphertext = payloadCiphertext;\n\n  if (receiptId) envelope.atrib_receipt_id = receiptId;\n\n  const informedBy = normalizeRecordHashes(args?.informed_by);\n  if (informedBy) envelope.informed_by = informedBy;\n\n  const expiresAt = normalizeIsoTimestamp(args?.expires_at);\n  if (expiresAt) envelope.expires_at = expiresAt;\n\n  return envelope;\n}\n\nexport function mergeEnvelopeMetadata(\n  metadataInput: unknown,\n  envelope: JsonRecord\n): JsonRecord {\n  return {\n    ...normalizeMetadata(metadataInput),\n    message_envelope: envelope,\n  };\n}\n\nfunction getEnvelope(row: unknown): JsonRecord | undefined {\n  if (!isRecord(row)) return undefined;\n  const metadata = row.metadata;\n  if (!isRecord(metadata)) return undefined;\n  const envelope = metadata.message_envelope;\n  return isRecord(envelope) ? envelope : undefined;\n}\n\nexport function rowMatchesMessageFilters(\n  row: unknown,\n  filters: JsonRecord | undefined\n): boolean {\n  const targetAgent = normalizeString(filters?.target_agent);\n  const threadId = normalizeString(filters?.thread_id);\n  const kind = normalizeString(filters?.kind);\n\n  if (!targetAgent && !threadId && !kind) return true;\n\n  const envelope = getEnvelope(row);\n  if (!envelope) {\n    return !threadId && !kind;\n  }\n\n  if (targetAgent) {\n    const targets = normalizeStringList(envelope.target_agents);\n    if (targets && !targets.includes(targetAgent)) return false;\n  }\n\n  if (threadId && normalizeString(envelope.thread_id) !== threadId) {\n    return false;\n  }\n\n  if (kind && normalizeString(envelope.kind) !== kind) {\n    return false;\n  }\n\n  return true;\n}\n\nexport function filterContextRows(\n  rows: unknown,\n  filters: JsonRecord | undefined,\n  limit: number\n): unknown {\n  if (!Array.isArray(rows)) return rows;\n  return rows.filter((row) => rowMatchesMessageFilters(row, filters)).slice(0, limit);\n}\n","function normalizeSource(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed ? trimmed : undefined;\n}\n\nexport function resolveAgentIdentity(\n  requestedAgent: unknown,\n  configuredAgent: unknown,\n  field = \"agent\",\n): string | undefined {\n  const requested = normalizeSource(requestedAgent);\n  const configured = normalizeSource(configuredAgent);\n\n  if (requested && configured && requested !== configured) {\n    throw new Error(\n      `${field} must match AGENT_BRIDGE_AGENT (${configured}); got ${requested}`,\n    );\n  }\n\n  return requested ?? configured;\n}\n\nexport function resolvePostSource(\n  requestedSource: unknown,\n  configuredAgent: unknown,\n): string | undefined {\n  return resolveAgentIdentity(requestedSource, configuredAgent, \"source\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACLA,IAAM,0BAA0B;AAEvC,IAAM,iBAAiB;AAIvB,SAAS,SAAS,OAAqC;AACrD,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,UAAU,UAAU;AAC7B;AAEA,SAAS,oBAAoB,OAAsC;AACjE,QAAM,MAAM,MAAM,QAAQ,KAAK,IAC3B,QACA,OAAO,UAAU,WACf,MAAM,MAAM,GAAG,IACf,CAAC;AACP,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,KAAK;AACtB,UAAM,aAAa,gBAAgB,IAAI;AACvC,QAAI,WAAY,MAAK,IAAI,UAAU;AAAA,EACrC;AACA,SAAO,KAAK,OAAO,CAAC,GAAG,IAAI,IAAI;AACjC;AAEA,SAAS,sBAAsB,OAAsC;AACnE,QAAM,MAAM,MAAM,QAAQ,KAAK,IAC3B,QACA,OAAO,UAAU,WACf,MAAM,MAAM,GAAG,IACf,CAAC;AACP,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,KAAK;AACtB,UAAM,aAAa,gBAAgB,IAAI;AACvC,QAAI,cAAc,eAAe,KAAK,UAAU,GAAG;AACjD,WAAK,IAAI,WAAW,YAAY,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO,KAAK,OAAO,CAAC,GAAG,IAAI,IAAI;AACjC;AAEA,SAAS,sBAAsB,OAAoC;AACjE,QAAM,OAAO,gBAAgB,KAAK;AAClC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,MAAM,MAAM,EAAG,QAAO;AACjC,SAAO,IAAI,KAAK,MAAM,EAAE,YAAY;AACtC;AAEO,SAAS,kBAAkB,OAA4B;AAC5D,SAAO,SAAS,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC;AAC3C;AAEO,SAAS,qBACd,MACA,WACY;AACZ,QAAM,SAAS,gBAAgB,MAAM,MAAM,KAAK;AAChD,QAAM,WAAW,gBAAgB,MAAM,QAAQ;AAC/C,QAAM,OAAO,gBAAgB,MAAM,IAAI,KAAK,YAAY;AACxD,QAAM,YAAY,gBAAgB,MAAM,UAAU,KAAK,OAAO;AAE9D,QAAM,WAAuB;AAAA,IAC3B,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,cAAc;AAAA,IACd;AAAA,IACA,UAAU,gBAAgB,MAAM,QAAQ,KAAK;AAAA,IAC7C,cAAc,gBAAgB,MAAM,YAAY,KAAK;AAAA,EACvD;AAEA,QAAM,eAAe,oBAAoB,MAAM,aAAa;AAC5D,MAAI,aAAc,UAAS,gBAAgB;AAE3C,QAAM,UAAU,gBAAgB,MAAM,OAAO;AAC7C,MAAI,QAAS,UAAS,UAAU;AAEhC,QAAM,WAAW,gBAAgB,MAAM,SAAS;AAChD,MAAI,SAAU,UAAS,YAAY;AAEnC,QAAM,YAAY,gBAAgB,MAAM,WAAW;AACnD,MAAI,UAAW,UAAS,cAAc;AAEtC,MAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,CAAC,GAAG,SAAS,GAAG;AAC/D,aAAS,UAAU,MAAM;AAAA,EAC3B;AAEA,QAAM,aAAa,gBAAgB,MAAM,WAAW;AACpD,MAAI,WAAY,UAAS,cAAc;AAEvC,QAAM,oBAAoB,gBAAgB,MAAM,kBAAkB;AAClE,MAAI,kBAAmB,UAAS,qBAAqB;AAErD,MAAI,UAAW,UAAS,mBAAmB;AAE3C,QAAM,aAAa,sBAAsB,MAAM,WAAW;AAC1D,MAAI,WAAY,UAAS,cAAc;AAEvC,QAAM,YAAY,sBAAsB,MAAM,UAAU;AACxD,MAAI,UAAW,UAAS,aAAa;AAErC,SAAO;AACT;AAEO,SAAS,sBACd,eACA,UACY;AACZ,SAAO;AAAA,IACL,GAAG,kBAAkB,aAAa;AAAA,IAClC,kBAAkB;AAAA,EACpB;AACF;;;ACvHA,SAAS,gBAAgB,OAAoC;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,UAAU,UAAU;AAC7B;AAEO,SAAS,qBACd,gBACA,iBACA,QAAQ,SACY;AACpB,QAAM,YAAY,gBAAgB,cAAc;AAChD,QAAM,aAAa,gBAAgB,eAAe;AAElD,MAAI,aAAa,cAAc,cAAc,YAAY;AACvD,UAAM,IAAI;AAAA,MACR,GAAG,KAAK,mCAAmC,UAAU,UAAU,SAAS;AAAA,IAC1E;AAAA,EACF;AAEA,SAAO,aAAa;AACtB;AAEO,SAAS,kBACd,iBACA,iBACoB;AACpB,SAAO,qBAAqB,iBAAiB,iBAAiB,QAAQ;AACxE;;;AFwBO,IAAM,6BAA6B;AAenC,SAAS,cACd,MAA4B,QAAQ,KACX;AACzB,QAAM,SAAS,oBAAoB,GAAwB;AAC3D,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO,UAAU;AAAA,IACxB,WAAW,OAAO,UAAU;AAAA,IAC5B,UAAU,OAAO,UAAU;AAAA,IAC3B,cAAc,OAAO;AAAA,IACrB,kBAAkB,OAAO;AAAA,IACzB,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO,aAAa,YAAY,OAAO,MAAM;AAAA,IACzD,cAAc,OAAO,aAAa,YAAY,OAAO,aAAa;AAAA,EACpE;AACF;AAEO,SAAS,wBACd,QACQ;AACR,QAAM,WAAW,OAAO,aAAa,OAAO,eAAe,YAAY;AACvE,QAAM,YAAyC,OAAO,QAAQ;AAAA,IAC5D,WAAW,OAAO,aAAa;AAAA,IAC/B,OAAO,OAAO;AAAA,IACd,UAAU,OAAO;AAAA,EACnB,IAAI;AACJ,QAAM,eAAyC,YAAY;AAAA,IACzD;AAAA,IAAU;AAAA,IACV,KAAK,OAAO;AAAA,IAAY,YAAY,OAAO;AAAA,IAC3C,cAAc,OAAO,gBAAgB;AAAA,IAAY,kBAAkB,OAAO,oBAAoB,OAAO,gBAAgB;AAAA,IAAY,YAAY,OAAO,cAAc;AAAA,IAAI,YAAY;AAAA,EACpL,IAAI;AACJ,QAAM,QAAQ,eAAe,YAAY,YAAY,IAAI;AACzD,QAAM,UAAU,QAAQ,IAAI,cAAc,KAAK,IAAI;AACnD,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,gBAAgB,SAAS,2BAA2B;AAAA,IAC5D,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AAEA,SAAO,kBAAkB,wBAAwB,YAAY;AAC3D,UAAM,cAAc;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,QACF,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,UAAU;AAAA,cACR,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,SAAS;AAAA,cACP,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,UAAU;AAAA,cACR,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,SAAS;AAAA,cACP,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,UAAU;AAAA,cACR,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,YAAY;AAAA,cACV,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,eAAe;AAAA,cACb,MAAM;AAAA,cACN,OAAO,EAAE,MAAM,SAAS;AAAA,cACxB,aACE;AAAA,YACJ;AAAA,YACA,WAAW;AAAA,cACT,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,aAAa;AAAA,cACX,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,MAAM;AAAA,cACJ,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,cAAc;AAAA,cACZ,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,SAAS;AAAA,cACP,OAAO;AAAA,gBACL,EAAE,MAAM,SAAS;AAAA,gBACjB,EAAE,MAAM,QAAQ;AAAA,gBAChB,EAAE,MAAM,SAAS;AAAA,gBACjB,EAAE,MAAM,SAAS;AAAA,gBACjB,EAAE,MAAM,UAAU;AAAA,gBAClB,EAAE,MAAM,OAAO;AAAA,cACjB;AAAA,cACA,aACE;AAAA,YACJ;AAAA,YACA,aAAa;AAAA,cACX,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,oBAAoB;AAAA,cAClB,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,aAAa;AAAA,cACX,MAAM;AAAA,cACN,OAAO,EAAE,MAAM,SAAS;AAAA,cACxB,aACE;AAAA,YACJ;AAAA,YACA,YAAY;AAAA,cACV,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,kBAAkB;AAAA,cAChB,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,UACF;AAAA,UACA,UAAU,CAAC,YAAY,SAAS;AAAA,QAClC;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,QACF,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,OAAO;AAAA,cACL,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,UAAU;AAAA,cACR,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,SAAS;AAAA,cACP,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,YAAY;AAAA,cACV,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,OAAO;AAAA,cACL,MAAM;AAAA,cACN,aAAa;AAAA,cACb,SAAS;AAAA,cACT,SAAS;AAAA,YACX;AAAA,YACA,cAAc;AAAA,cACZ,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,YACA,WAAW;AAAA,cACT,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,YACA,MAAM;AAAA,cACJ,MAAM;AAAA,cACN,aAAa;AAAA,YACf;AAAA,UACF;AAAA,QACF;AAAA,QACA,cAAc;AAAA,UACZ,MAAM;AAAA,UACN,YAAY;AAAA,YACV,SAAS,EAAE,MAAM,SAAS,OAAO,EAAE,MAAM,UAAU,sBAAsB,KAAK,EAAE;AAAA,YAChF,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,UAAU,OAAO,EAAE;AAAA,YACpD,OAAO,EAAE,MAAM,UAAU;AAAA,YAAG,UAAU,EAAE,MAAM,UAAU;AAAA,YACxD,kBAAkB,EAAE,MAAM,UAAU,MAAM,CAAC,iBAAiB,SAAS,EAAE;AAAA,YACvE,cAAc,EAAE,MAAM,CAAC,UAAU,MAAM,EAAE;AAAA,UAC3C;AAAA,UACA,UAAU,CAAC,SAAS;AAAA,UACpB,sBAAsB;AAAA,QACxB;AAAA,MACF;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,aACE;AAAA,QACF,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,KAAK;AAAA,cACH,MAAM;AAAA,cACN,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,SAAS,GAAG,EAAE,MAAM,SAAS,CAAC,EAAE;AAAA,cACzD,aAAa;AAAA,YACf;AAAA,YACA,OAAO;AAAA,cACL,MAAM;AAAA,cACN,aACE;AAAA,YACJ;AAAA,UACF;AAAA,UACA,UAAU,CAAC,KAAK;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,UAAU,oBAAoB,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE,IAAI,CAAC,eAAe;AAAA,MAChG,MAAM,UAAU,IAAK;AAAA,MACrB,aAAa,UAAU;AAAA,MACvB,aAAa,UAAU;AAAA,MACvB,cAAc,UAAU;AAAA,IAC1B,EAAE,IAAI,CAAC;AACP,WAAO,EAAE,OAAO,CAAC,GAAG,aAAa,GAAG,SAAS,EAAS;AAAA,EACxD,CAAC;AAED,SAAO,kBAAkB,uBAAuB,OAAO,SAAS,UAAU;AACxE,UAAM,EAAE,MAAM,WAAW,KAAK,IAAI,QAAQ;AAC1C,UAAM,kBAAkB,CAAC,aAAqB,UAAmB;AAC/D,YAAM,SAAS,cAAc,aAAa,KAAK;AAC/C,aAAO;AAAA,QACL,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,KAAK,UAAU,MAAM,EAAE,CAAC;AAAA,QACjE,GAAI,WAAW,QAAQ,OAAO,WAAW,WACrC,EAAE,mBAAmB,OAAkC,IACvD,CAAC;AAAA,MACP;AAAA,IACF;AAEA,QAAI;AACF,cAAQ,MAAM;AAAA,QACd,KAAK,gBAAgB;AACnB,0BAAgB,gBAAgB,QAAQ,CAAC,CAAC;AAC1C,iBAAO,gBAAgB,gBAAgB,mBAAmB,EAAE,SAAS,OAAO,SAAS,CAAC,CAAC;AAAA,QACzF;AAAA,QACA,KAAK,gBAAgB;AACnB,cAAI;AACJ,cAAI;AACF,qBAAS,kBAAkB,MAAM,QAAQ,OAAO,KAAK;AACrD,gBAAI,CAAC,QAAQ;AACX,oBAAM,IAAI;AAAA,gBACR;AAAA,cACF;AAAA,YACF;AAAA,UACF,SAAS,GAAG;AACV,kBAAM,IAAI;AAAA,cACR,UAAU;AAAA,cACV,aAAa,QAAQ,EAAE,UAAU;AAAA,YACnC;AAAA,UACF;AACA,gBAAM,UAAU,gBAAgB,MAAM,OAAO;AAC7C,gBAAM,WAAW,EAAE,GAAI,QAAQ,CAAC,GAAI,QAAQ,QAAQ;AACpD,gBAAM,YAAY,mBAAmB,MAAM,gBAAgB;AAC3D,gBAAM,WAAW,qBAAqB,UAAU,SAAS;AACzD,gBAAM,QAAQ,qBAAqB;AAAA,YACjC,IAAI,OAAO,SAAS,UAAU;AAAA,YAC9B;AAAA,YACA,MAAM,OAAO,MAAM,QAAQ,MAAM,QAAQ;AAAA,YACzC,SAAS,OAAO,MAAM,WAAW,EAAE;AAAA,YACnC,aAAa,OAAO,MAAM,gBAAgB,YAAY;AAAA,YACtD,MAAM,MAAM;AAAA,YACZ,SAAS,MAAM,QAAQ,MAAM,aAAa,IAAI,KAAK,cAAc,IAAI,MAAM,IAAI,CAAC;AAAA,YAChF,UAAU,MAAM;AAAA,YAChB,WAAW,MAAM;AAAA,YACjB,UAAW,MAAM,YAAY;AAAA,YAC7B,WAAW,MAAM;AAAA,YACjB,gBAAgB;AAAA,YAChB,YAAY,MAAM,QAAQ,MAAM,WAAW,IAAI,KAAK,YAAY,IAAI,MAAM,IAAI,CAAC;AAAA,YAC/E,UAAU,sBAAsB,MAAM,UAAU,QAAQ;AAAA,UAC1D,CAAC;AACD,cAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,mCAAmC;AAC3G,gBAAM,SAAS,MAAM,QAAQ,QAAQ,WAAW,KAAK;AACrD,iBAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,MAAM,EAAE,CAAC,GAAG,mBAAmB,OAA6C;AAAA,QACtI;AAAA,QAEA,KAAK,eAAe;AAClB,gBAAM,UAAU,gBAAgB,MAAM,OAAO;AAC7C,gBAAM,WAAW,MAAM;AACvB,cACE,aAAa,WACZ,OAAO,aAAa,YAAY,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,KAAK,WAAW,MAC/F;AACA,kBAAM,IAAI,SAAS,UAAU,eAAe,iCAAiC;AAAA,UAC/E;AACA,gBAAM,iBAAiB,YAAY;AACnC,cAAI,MAAM,eAAe,UAAa,OAAO,KAAK,UAAU,MAAM,OAAO,OAAO;AAC9E,kBAAM,IAAI,SAAS,UAAU,eAAe,gDAAgD;AAAA,UAC9F;AACA,cAAI,WAAW,WAAW;AACxB,gBAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,mCAAmC;AAC3G,gBAAI,MAAM,gBAAgB,OAAO,KAAK,YAAY,MAAM,UAAU,OAAO;AACvE,qBAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,CAAC,GAAG,mBAAmB,EAAE,SAAS,CAAC,EAAE,EAAE;AAAA,YACvF;AACA,kBAAM,SAAS,MAAM,QAAQ,QAAQ,WAAW;AAAA,cAC9C,OAAO;AAAA,cACP,OAAO,MAAM,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI;AAAA,cACrF,QAAQ,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI;AAAA,cAC7C;AAAA,cACA,OAAO,MAAM,QAAQ,OAAO,KAAK,KAAK,IAAI;AAAA,cAC1C,cAAc;AAAA,cACd,UAAU,MAAM,YAAY,OAAO,KAAK,SAAS,IAAI;AAAA,cACrD,QAAQ;AAAA,YACV,CAAC;AACD,kBAAM,UAAU,OAAO,SACpB,MAAM,GAAG,cAAc,EACvB,IAAI,CAAC,aAAa;AAAA,cACjB,IAAI,QAAQ;AAAA,cACZ,QAAQ,QAAQ;AAAA,cAChB,UAAU,QAAQ;AAAA,cAClB,SAAS,QAAQ;AAAA,cACjB,UAAU,QAAQ;AAAA,cAClB,SAAS,QAAQ,WAAW;AAAA,cAC5B,UAAU,sBAAsB,OAAO;AAAA,cACvC,kBAAkB,QAAQ,kBAAkB;AAAA,cAC5C,YAAY,QAAQ;AAAA,YACtB,EAAE;AACJ,kBAAM,eAAe;AAOrB,kBAAM,gBAAgB,aAAa,SAC/B;AAAA,cACE,QAAQ,aAAa;AAAA,cACrB,OAAO,QAAQ,aAAa,KAAK;AAAA,cACjC,UAAU,QAAQ,aAAa,QAAQ;AAAA,cACvC,kBAAkB,aAAa,oBAAoB;AAAA,cACnD,cAAc,aAAa,gBAAgB;AAAA,YAC7C,IACA,CAAC;AACL,mBAAO;AAAA,cACL,SAAS;AAAA,gBACP,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE;AAAA,gBACvD,GAAI,aAAa,SAAS,aAAa,WAAW,CAAC;AAAA,kBACjD,MAAM;AAAA,kBACN,MAAM,2CAA2C,aAAa,QAAQ,UAAU,UAAU,kCAAkC,aAAa,oBAAoB,SAAS;AAAA,gBACxK,CAAC,IAAI,CAAC;AAAA,cACR;AAAA,cACA,mBAAmB,EAAE,SAAS,GAAG,cAAc;AAAA,YACjD;AAAA,UACF;AACA,gBAAM,IAAI,SAAS,UAAU,eAAe,mCAAmC;AAAA,QACjF;AAAA,QAEA,KAAK,eAAe;AAClB,gBAAM,MAAM,MAAM;AAClB,cAAI;AACJ,cAAI;AACF,oBAAQ,qBAAqB,MAAM,OAAO,OAAO,KAAK;AAAA,UACxD,SAAS,GAAG;AACV,kBAAM,IAAI;AAAA,cACR,UAAU;AAAA,cACV,aAAa,QAAQ,EAAE,UAAU;AAAA,YACnC;AAAA,UACF;AACA,cAAI,CAAC,KAAK,UAAU,CAAC,OAAO;AAC1B,kBAAM,IAAI;AAAA,cACR,UAAU;AAAA,cACV;AAAA,YACF;AAAA,UACF;AACA,cAAI,WAAW,WAAW;AACxB,gBAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,mCAAmC;AAC3G,kBAAM,eAAe,MAAM,QAAQ;AAAA,cACjC;AAAA,cACA,IAAI,IAAI,CAAC,OAAO,uBAAuB,EAAqB,CAAC;AAAA,YAC/D;AACA,mBAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,EAAE,cAAc,MAAM,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,cAAc,MAAM,EAAE;AAAA,UAClI;AACA,gBAAM,IAAI,SAAS,UAAU,eAAe,mCAAmC;AAAA,QACjF;AAAA,QAEA,KAAK,QAAQ;AACX,cAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,gCAAgC;AACxG,gBAAM,QAAQ,gBAAgB,mBAAmB,QAAQ,CAAC,CAAC;AAC3D,cAAI;AAAE,8BAAkB,MAAM,QAAQ,UAAU,KAAK;AAAA,UAAG,SAAS,OAAO;AAAE,kBAAM,IAAI,SAAS,UAAU,eAAe,iBAAiB,QAAQ,MAAM,UAAU,0BAA0B;AAAA,UAAG;AAC5L,gBAAM,EAAE,QAAQ,SAAS,GAAG,MAAM,IAAI;AACtC,iBAAO,gBAAgB,mBAAmB,MAAM,QAAQ,QAAQ,WAAW,KAAgC,CAAC;AAAA,QAC9G;AAAA,QACA,KAAK,WAAW;AACd,cAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,gCAAgC;AACxG,gBAAM,QAAQ,gBAAgB,WAAW,QAAQ,CAAC,CAAC;AACnD,iBAAO,gBAAgB,WAAW,MAAM,QAAQ,QAAQ,WAAW,KAAK,CAAC;AAAA,QAC3E;AAAA,QACA,KAAK,QAAQ;AACX,cAAI,CAAC,OAAO,KAAM,OAAM,IAAI,SAAS,UAAU,eAAe,kDAAkD;AAChH,gBAAM,QAAQ,gBAAgB,QAAQ,QAAQ,CAAC,CAAC;AAChD,gBAAM,SAAS,MAAM,MAAM,KAAK;AAAA,YAC9B,SAAS,MAAM;AAAA,YACf,UAAU,MAAM;AAAA,YAChB,QAAQ,MAAM;AAAA,UAChB,CAAC;AACD,iBAAO,gBAAgB,QAAQ,MAAM;AAAA,QACvC;AAAA,QACA,KAAK,SAAS;AACZ,cAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,gCAAgC;AACxG,gBAAM,QAAQ,gBAAgB,kBAAkB,QAAQ,CAAC,CAAC;AAC1D,gBAAM,SAAS,MAAM,QAAQ,MAAM,WAAW;AAAA,YAC5C,SAAS,MAAM;AAAA,YACf,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,UACrB,CAAC;AACD,iBAAO,gBAAgB,kBAAkB,UAAU,EAAE,UAAU,KAAK,CAAC;AAAA,QACvE;AAAA,QACA,KAAK;AAAA,QAAmB,KAAK;AAAA,QAAwB,KAAK;AAAA,QAAmB,KAAK,oBAAoB;AACpG,cAAG,CAAC,WAAS,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAc,gCAAgC;AACpG,gBAAM,cAAc,SAAS,oBAAoB,oBAAoB,SAAS,yBAAyB,yBAAyB,SAAS,oBAAoB,oBAAoB;AACjL,gBAAM,QAAQ,gBAAgB,aAAa,QAAQ,CAAC,CAAC;AACrD,gBAAM,SAAO,SAAO,oBAAkB,MAAM,QAAQ,WAAW,WAAU,KAAY,IAAE,SAAO,yBAAuB,MAAM,QAAQ,eAAe,WAAU,OAAO,MAAM,UAAU,GAAE,KAAY,IAAE,SAAO,oBAAkB,MAAM,QAAQ,OAAO,WAAU,OAAO,MAAM,UAAU,CAAC,IAAE,MAAM,QAAQ,QAAQ,WAAU,OAAO,MAAM,UAAU,CAAC;AAC7U,iBAAO,gBAAgB,aAAa,SAAS,qBAAqB,SAAS,yBAAyB,SAAS,EAAE,UAAU,OAAO,CAAC;AAAA,QACnI;AAAA,QACA,KAAK;AAAA,QAAU,KAAK;AAAA,QAAe,KAAK,wBAAwB;AAC9D,cAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,gCAAgC;AACxG,gBAAM,cAAc,SAAS,WAAW,oBAAoB,SAAS,gBAAgB,yBAAyB;AAC9G,gBAAM,QAAQ,gBAAgB,aAAa,QAAQ,CAAC,CAAC;AACrD,gBAAM,KAAK,OAAO,MAAM,UAAU,GAAG,QAAQ,OAAO,MAAM,UAAU;AACpE,gBAAM,SAAS,SAAS,WAAW,MAAM,QAAQ,OAAO,WAAW,IAAI,OAAO,MAAM,OAA6B,IAC7G,SAAS,gBAAgB,MAAM,QAAQ,IAAI,WAAW,IAAI,KAAK,IAC/D,MAAM,QAAQ;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA,MAAM;AAAA,YACL,MAAM,eAAe,MAAM,QAAQ;AAAA,YACpC,MAAM;AAAA,UACR;AACF,iBAAO,gBAAgB,aAAa,EAAE,UAAU,OAAO,CAAC;AAAA,QAC1D;AAAA,QACA,KAAK,aAAa;AAChB,cAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,gCAAgC;AACxG,gBAAM,QAAQ,gBAAgB,aAAa,QAAQ,CAAC,CAAC;AACrD,gBAAM,SAAS,MAAM,QAAQ,UAAU,WAAW;AAAA,YAChD,SAAS,MAAM;AAAA,YACf,aAAa,MAAM;AAAA,YACnB,cAAc,MAAM;AAAA,UACtB,CAAC;AACD,iBAAO,gBAAgB,aAAa,MAAM;AAAA,QAC5C;AAAA,QACA,KAAK,YAAY;AACf,cAAI,CAAC,WAAW,CAAC,UAAW,OAAM,IAAI,SAAS,UAAU,eAAe,gCAAgC;AACxG,0BAAgB,YAAY,QAAQ,CAAC,CAAC;AACtC,gBAAM,SAAS,EAAE,QAAQ,MAAM,QAAQ,SAAS,SAAS,EAAE;AAC3D,iBAAO,gBAAgB,YAAY,MAAM;AAAA,QAC3C;AAAA,QAEA;AACE,gBAAM,IAAI,SAAS,UAAU,gBAAgB,iBAAiB,IAAI,EAAE;AAAA,MACtE;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAU,OAAM;AACrC,UAAI,iBAAiB,2BAA2B,iBAAiB,yBAAyB,iBAAiB,8BAA8B;AACvI,cAAM,IAAI,SAAS,UAAU,eAAe,MAAM,OAAO;AAAA,MAC3D;AACA,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AAED,MAAI;AACJ,QAAM,kBAAkB,MAAM,oCAAmB,cAAc,aAAa,YACxE,OAAO,WAAW,KAAK,QAAQ,QAAQ,IACvC,QAAQ,QAAQ;AACpB,MAAI;AACJ,QAAM,aAAa,MAAM,sBAAY,OAAO,QAAQ,KAAK,QAAQ,QAAQ;AACzE,QAAM,UAAU,OAAO,QAAQ,KAAK,MAAM;AAC1C,SAAO,UAAU,OAAO,cAAc;AACpC,UAAM,gBAAgB;AACtB,UAAM,QAAQ,SAAS;AAAA,EACzB;AACA,QAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;AACtC,SAAO,QAAQ,YAAY;AACzB,QAAI;AACJ,QAAI;AAAE,YAAM,MAAM;AAAA,IAAG,SAAS,OAAO;AAAE,uBAAiB;AAAA,IAAO;AAC/D,QAAI;AAAE,YAAM,WAAW;AAAA,IAAG,SAAS,OAAO;AACxC,UAAI,eAAgB,OAAM,OAAO,OAAO,IAAI,MAAM,qCAAqC,GAAG;AAAA,QACxF,QAAQ,CAAC,gBAAgB,KAAK;AAAA,MAChC,CAAC;AACD,YAAM;AAAA,IACR;AACA,QAAI,eAAgB,OAAM;AAAA,EAC5B;AACA,SAAO,UAAU,MAAM;AACrB,SAAK,WAAW,EAAE,MAAM,CAAC,UAAU,OAAO,UAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EAChH;AAEA,SAAO;AACT;AAEA,eAAsB,YACpB,SAAkC,cAAc,GAChD;AACA,QAAM,SAAS,wBAAwB,MAAM;AAC7C,QAAM,YAAY,IAAI,qBAAqB;AAC3C,QAAM,OAAO,QAAQ,SAAS;AAChC;","names":[]}

package/dist/{chunk-JUTJRAMA.js → chunk-FGERNG4X.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   BridgeService
-} from "./chunk-AWE3DFZV.js";
+} from "./chunk-4V2PFJEF.js";
 import {
   ContractResponseError,
   ContractValidationError,
@@ -16,7 +16,7 @@ import {
   parseResponse,
   validateRequest,
   validateRequestForProtocol
-} from "./chunk-E4OWHGUE.js";
+} from "./chunk-62C63PIE.js";
 import {
   BridgePrincipalMismatchError,
   BridgeValidationError
@@ -598,4 +598,4 @@ export {
   safeTokenHashEqual,
   createGateway
 };
-//# sourceMappingURL=chunk-JUTJRAMA.js.map
+//# sourceMappingURL=chunk-FGERNG4X.js.map

package/dist/{chunk-7VJI2MXI.js → chunk-IF5OKPBK.js}

@@ -1301,21 +1301,24 @@ async function collectPostgresRoleInventory(client, databaseName) {
         CROSS JOIN LATERAL pg_catalog.aclexplode(type.typacl) acl WHERE namespace.nspname='agent_bridge' AND acl.grantee<>0
       UNION SELECT defaults.defaclrole, 'object-role' FROM pg_catalog.pg_default_acl defaults
         LEFT JOIN pg_catalog.pg_namespace namespace ON namespace.oid=defaults.defaclnamespace
-        WHERE namespace.nspname='agent_bridge' OR defaults.defaclrole=(
-          SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge')
+        WHERE namespace.nspname='agent_bridge' OR (
+          defaults.defaclnamespace=0 AND defaults.defaclrole=(
+            SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge'))
           OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(SELECT oid FROM pg_catalog.pg_roles
             WHERE rolname='agent_bridge_control_owner_'||substr(pg_catalog.md5(pg_catalog.current_database()),1,16)))
       UNION SELECT acl.grantor, 'object-role' FROM pg_catalog.pg_default_acl defaults
         LEFT JOIN pg_catalog.pg_namespace namespace ON namespace.oid=defaults.defaclnamespace
         CROSS JOIN LATERAL pg_catalog.aclexplode(defaults.defaclacl) acl WHERE namespace.nspname='agent_bridge'
-          OR defaults.defaclrole=(SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge')
+          OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(
+            SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge'))
           OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(SELECT oid FROM pg_catalog.pg_roles
             WHERE rolname='agent_bridge_control_owner_'||substr(pg_catalog.md5(pg_catalog.current_database()),1,16)))
       UNION SELECT acl.grantee, 'object-role' FROM pg_catalog.pg_default_acl defaults
         LEFT JOIN pg_catalog.pg_namespace namespace ON namespace.oid=defaults.defaclnamespace
         CROSS JOIN LATERAL pg_catalog.aclexplode(defaults.defaclacl) acl WHERE acl.grantee<>0 AND (
-          namespace.nspname='agent_bridge' OR defaults.defaclrole=(
-            SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge')
+          namespace.nspname='agent_bridge' OR (
+            defaults.defaclnamespace=0 AND defaults.defaclrole=(
+              SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge'))
           OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(SELECT oid FROM pg_catalog.pg_roles
             WHERE rolname='agent_bridge_control_owner_'||substr(pg_catalog.md5(pg_catalog.current_database()),1,16))))
     ), base_roles AS (
@@ -1325,12 +1328,19 @@ async function collectPostgresRoleInventory(client, databaseName) {
       UNION
       SELECT role.oid, 'derived' FROM pg_catalog.pg_roles role
       WHERE role.rolname IN (SELECT name FROM derived_names)
+    ), canonical_base_roles AS (
+      SELECT oid, CASE WHEN bool_or(kind='schema-owner') THEN 'schema-owner'
+        WHEN bool_or(kind='derived') THEN 'derived'
+        ELSE 'object-role' END AS kind
+      FROM base_roles GROUP BY oid
     ), related_roles AS (
-      SELECT oid, kind FROM base_roles
+      SELECT oid, kind FROM canonical_base_roles
       UNION SELECT membership.roleid, 'external-principal' FROM pg_catalog.pg_auth_members membership
-        WHERE membership.member IN (SELECT oid FROM base_roles)
+        WHERE membership.member IN (
+          SELECT oid FROM canonical_base_roles WHERE kind<>'schema-owner')
       UNION SELECT membership.member, 'external-principal' FROM pg_catalog.pg_auth_members membership
-        WHERE membership.roleid IN (SELECT oid FROM base_roles)
+        WHERE membership.roleid IN (
+          SELECT oid FROM canonical_base_roles WHERE kind<>'schema-owner')
     )
     SELECT role.rolname AS name,
       CASE WHEN bool_or(related.kind='schema-owner') THEN 'schema-owner'
@@ -1340,6 +1350,7 @@ async function collectPostgresRoleInventory(client, databaseName) {
     FROM related_roles related JOIN pg_catalog.pg_roles role ON role.oid=related.oid
     GROUP BY role.rolname ORDER BY role.rolname`);
   const names = roleRows.rows.map((row) => row.name);
+  const schemaOwnerNames = roleRows.rows.filter((row) => row.kind === "schema-owner").map((row) => row.name);
   const membershipRows = names.length === 0 ? { rows: [], rowCount: 0 } : await client.query(`
     SELECT granted.rolname AS role, member.rolname AS member,
       bool_or(membership.admin_option) AS "adminOption",
@@ -1353,15 +1364,21 @@ async function collectPostgresRoleInventory(client, databaseName) {
     ORDER BY granted.rolname,member.rolname`, [names]);
   if (names.length > 0) {
     const boundary = await client.query(`
-      SELECT 1 AS found FROM pg_catalog.pg_auth_members membership
+      SELECT granted.rolname AS role, member.rolname AS member
+      FROM pg_catalog.pg_auth_members membership
       JOIN pg_catalog.pg_roles granted ON granted.oid=membership.roleid
       JOIN pg_catalog.pg_roles member ON member.oid=membership.member
       WHERE (granted.rolname=ANY($1::text[])) <> (member.rolname=ANY($1::text[]))
-      LIMIT 1`, [names]);
+        AND NOT (
+          granted.rolname=ANY($1::text[]) AND granted.rolname=ANY($2::text[])
+          OR member.rolname=ANY($1::text[]) AND member.rolname=ANY($2::text[])
+        )
+      ORDER BY granted.rolname,member.rolname LIMIT 10`, [names, schemaOwnerNames]);
     if (boundary.rows.length > 0) {
       throw new PostgresNativeDrError(
         "TRANSITIVE_ROLE_MEMBERSHIP_UNSUPPORTED",
-        "PostgreSQL role inventory has a transitive external membership outside the bounded restore graph"
+        "PostgreSQL role inventory has a transitive external membership outside the bounded restore graph",
+        { roleMemberships: boundary.rows }
       );
     }
   }
@@ -1380,8 +1397,9 @@ async function collectPostgresRoleInventory(client, databaseName) {
     LEFT JOIN LATERAL pg_catalog.aclexplode(defaults.defaclacl) acl ON true
     LEFT JOIN pg_catalog.pg_roles grantor ON grantor.oid=acl.grantor
     LEFT JOIN pg_catalog.pg_roles grantee ON grantee.oid=acl.grantee
-    WHERE namespace.nspname='agent_bridge' OR defaults.defaclrole=(
-      SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge')
+    WHERE namespace.nspname='agent_bridge' OR (
+      defaults.defaclnamespace=0 AND defaults.defaclrole=(
+        SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge'))
       OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(SELECT oid FROM pg_catalog.pg_roles
         WHERE rolname='agent_bridge_control_owner_'||substr(pg_catalog.md5(pg_catalog.current_database()),1,16)))
     ORDER BY owner.rolname,namespace.nspname NULLS FIRST,defaults.defaclobjtype,
@@ -2668,4 +2686,4 @@ export {
   restoreLocalSqlite,
   SQLITE_EDGE_APPLICATION_ID
 };
-//# sourceMappingURL=chunk-7VJI2MXI.js.map
+//# sourceMappingURL=chunk-IF5OKPBK.js.map