@creatornader/agent-bridge 0.5.2 → 0.6.1

package/CHANGELOG.md

@@ -4,7 +4,63 @@ All notable changes to agent-bridge are documented in this file.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.6.1] - 2026-07-21
+
+### Added
+
+- Report the running package version and image Git revision through authenticated
+  gateway capabilities.
+- Add a release check that compares the live gateway with the intended version and
+  revision before the production proof starts.
+
+### Changed
+
+- Describe Agent Bridge first as a way for AI agents to message each other and hand
+  off work across tools, sessions, and machines. Keep mailbox and provider terms in
+  the technical sections where they explain behavior.
+- Record the source revision in production image builds and labels.
+
+## [0.6.0] - 2026-07-21
+
+### Added
+
+- Add `agent-bridge send --queue-only` for an explicit gateway outbox write that
+  makes no network request. A later manual or automatic sync publishes the same
+  immutable message from its original endpoint, workspace, and principal scope.
+
+### Changed
+
+- Describe Agent Bridge as messaging and work delivery across tools, sessions, and
+  machines. The npm package remains `@creatornader/agent-bridge`; npm rejects the
+  unscoped `agentbridge` name as confusingly similar to another package.
+- Limit runtime providers and generated capability contracts to local SQLite and the
+  authenticated gateway.
+
+### Removed
+
+- Remove the direct Supabase PostgREST runtime provider and its publishable-key
+  authorization model. Historical schema, migration 006 import, and the reconciliation
+  command remain available for upgrades.
+
+### Fixed
+
+- Make the production proof use the real gateway edge scope during its offline
+  phase. The proof now carries the configured workspace, uses an explicit stable
+  message ID for replay, and waits for rate-limited replays to deduplicate before
+  continuing.
+- Verify a Fly restart through a later successful machine `start` event instead of
+  requiring `instance_id` to change. Fly may retain that identifier across a plain
+  restart. Limit receipt value scanning to secret-bearing environment variables so
+  ordinary GitHub job identifiers cannot cause false leak reports. Permit GitHub to
+  reuse the sender host for the fresh-edge verifier while still requiring distinct
+  sender and receiver host evidence.
+- Preserve only Agent Bridge roles and relevant default privileges in PostgreSQL native
+  DR backups when a managed provider gives the schema owner privileges in unrelated
+  schemas.
+- Treat zero-valued Windows file IDs as unavailable during endpoint migration. Distinct
+  single-link edge files remain valid, while ambiguous hard-link cases still fail closed.
+- Give PostgreSQL integration tests enough time to create temporary databases and apply
+  migrations before Vitest advances to later tests and overlaps their cleanup.
 
 ## [0.5.2] - 2026-07-20
 

package/README.md

@@ -4,21 +4,23 @@
 [![test](https://github.com/creatornader/agent-bridge/actions/workflows/test.yml/badge.svg)](https://github.com/creatornader/agent-bridge/actions/workflows/test.yml)
 [![license](https://img.shields.io/github/license/creatornader/agent-bridge)](LICENSE)
 
-Agent Bridge is a durable, pull-first mailbox and work-delivery control plane for AI
-agents across runtimes, sessions, and machines. It gives coding agents, desktop agents,
-always-on workers, and agent frameworks a shared inbox that survives disconnection and
-restart. Start locally with SQLite, then use an operator-owned PostgreSQL gateway when
-agents need to communicate across machines.
+Agent Bridge lets AI agents message each other and hand off work across tools,
+sessions, and machines. Messages wait while an agent is offline and are still there
+after it restarts.
 
-It supports three operating modes:
+Use it through MCP, a CLI, a Node library, or an authenticated HTTPS gateway. Start
+locally with SQLite. Use PostgreSQL when agents need to communicate across machines.
+
+It supports two operating modes:
 
 | Mode | Store | Use case |
 | --- | --- | --- |
 | Local | SQLite WAL | One machine, no service or account |
 | Gateway | PostgreSQL plus a local SQLite edge store | Cross-machine messaging, offline sends, claims, retries, and presence |
-| Legacy Supabase | Existing `shared_context` table through PostgREST | Compatibility while a v1 deployment migrates |
 
-PostgreSQL remains the authority in gateway mode. SQLite holds local-only messages or gateway edge state. Supabase is one way to host PostgreSQL, not a protocol dependency.
+PostgreSQL is the authority in gateway mode. SQLite holds local-only messages or
+gateway edge state. Supabase can host PostgreSQL, but Agent Bridge does not depend on
+its client APIs. The direct Supabase runtime adapter was removed in 0.6.0.
 
 ## Quick start
 
@@ -63,7 +65,8 @@ a production TLS deployment. Read [the deployment guide](docs/deployment.md) bef
 exposing a gateway, changing network bindings, upgrading the schema, or relying on the
 named volume for persistent data.
 
-The repository also maintains a provider-neutral Fly.io reference at
+The repository also maintains a Fly.io reference that does not depend on a specific
+database host. It lives at
 [`deploy/fly.toml`](deploy/fly.toml). It deliberately omits an app name and release
 command. Check the local contract before creating or changing any Fly resource:
 
@@ -101,12 +104,29 @@ The Fly gateway expects two secrets: the restricted runtime database URL and a
 base64-encoded PostgreSQL CA bundle. It decodes the CA in memory and verifies both the
 certificate chain and database hostname. It never needs a CA file inside the image.
 
-The manual `gateway production proof` workflow tests an existing gateway after its
-deployment gate has passed. GitHub must run it from `main` in the protected
+Build the production image with its source revision, then confirm the running gateway
+before moving clients or starting the full proof:
+
+```bash
+fly deploy --config deploy/fly.toml --app <app> \
+  --build-arg AGENT_BRIDGE_BUILD_REVISION="$(git rev-parse HEAD)"
+AGENT_BRIDGE_URL="https://<app>.fly.dev" AGENT_BRIDGE_TOKEN="..." \
+  npm run verify:gateway:release -- \
+  --version "$(node -p "require('./package.json').version")" \
+  --revision "$(git rev-parse HEAD)"
+```
+
+The authenticated check compares the running package and Git revision with the
+intended release. It also requires protocol 2.1, request authority, and row isolation.
+It prints no credential. A missing or different revision stops the rollout.
+
+The manual `gateway production proof` workflow tests an existing gateway after this
+deployment gate passes. GitHub must run it from `main` in the protected
 `agent-bridge-production-proof` environment. Separate sender and receiver jobs prove
 offline outbox replay, exact idempotency, claim, and acknowledgment. The workflow then
-restarts the single Fly machine, requires a new runtime instance ID, and verifies the
-message and settled delivery with a fresh receiver instance and a new SQLite edge file.
+restarts the single Fly machine, requires a later successful machine start event, and
+verifies the message and settled delivery with a fresh receiver instance and a new
+SQLite edge file.
 Its versioned receipts contain only identifiers, times, principal and workspace labels,
 the gateway origin, checks, and SHA-256 host evidence. They omit credentials, database
 URLs, message content, and SQLite files.
@@ -133,11 +153,16 @@ The accepted protocol and storage decisions live in [docs/architecture-v2.md](do
 
 The canonical v2 operation registry generates [JSON Schema](schemas/agent-bridge-v2.schema.json), [OpenAPI 3.1.2](openapi/agent-bridge-v2.openapi.json), and the [MCP manifest](schemas/agent-bridge-v2.mcp.json). Use `GET /v2/capabilities`, MCP `capabilities`, or CLI `agent-bridge capabilities` to discover the operations for that surface and provider. Capabilities distinguish the current, selected, and supported protocol versions.
 
+Authenticated gateway capabilities also report `implementationVersion`. Production
+images report `implementationRevision` when the operator supplies the Git revision at
+build time. These fields identify deployed code. They do not change protocol version
+negotiation.
+
 Protocol 2.1 uses a gateway-first rollout. An upgraded gateway continues to serve released 2.0 clients, including headerless requests and their direct or null delivery results. A 2.1 client probes before mutation and proceeds only when complete, consistent response headers select 2.1 and advertise 2.1 support. It rejects mutation against a headerless or 2.0 gateway instead of downgrading. Upgrade the gateway before installing or starting 2.1 clients.
 
 Two gateway-only HTTP 2.1 operations establish a short-lived endpoint-migration challenge. Initial preflight uses a direct predecessor and successor. After a cutover journal exists, the same active successor credential can issue at the retained source URL and consume at the target URL. Both calls require active transaction-bound authority and use the canonical credential and operation rate buckets. PostgreSQL stores only a domain-separated SHA-256 commitment. A challenge expires within 60 seconds and does not authorize endpoint cutover. Authenticated HTTP 2.1 capabilities include the credential's `grantedScopes`.
 
-The OpenAPI paths describe protocol 2.1. The embedded `x-agent-bridge-protocol-2.0` and `x-agent-bridge-schemas-2.0` vendor extensions contain frozen compatibility schema metadata for released 2.0 clients. They are not a second OpenAPI description. Gateway credentials enforce the operation scopes declared by the canonical registry. Local mode uses process identity, and legacy mode uses its configured key. Provider-neutral artifacts report this difference instead of claiming one authorization model for every backend.
+The OpenAPI paths describe protocol 2.1. The embedded `x-agent-bridge-protocol-2.0` and `x-agent-bridge-schemas-2.0` vendor extensions contain frozen compatibility schema metadata for released 2.0 clients. They are not a second OpenAPI description. Gateway credentials enforce the operation scopes declared by the canonical registry. Local mode uses process identity. Provider-neutral artifacts report this difference instead of claiming one authorization model for every backend.
 
 ## Architecture
 
@@ -229,7 +254,7 @@ for its relationship to MCP, A2A, agmsg, brokers, and agent runtimes.
 
 Use the source install for development. The normal installation path is the published
 `@creatornader/agent-bridge` package shown in the quick start. The unscoped npm name
-belongs to another project.
+belongs to another project, and npm rejects `agentbridge` as confusingly similar.
 
 ```bash
 git clone https://github.com/creatornader/agent-bridge.git
@@ -900,6 +925,10 @@ When a send cannot reach the gateway:
 3. Long-lived MCP gateway clients retry due messages automatically with bounded exponential backoff. `agent-bridge sync` and the MCP `sync` tool trigger the same bounded replay and cache refresh manually. A permanently blocked message remains visible in diagnostics but does not stop later messages.
 4. An ambiguous retry is safe because the gateway enforces idempotency and rejects changed content under the same key.
 
+Pass `--queue-only` to `agent-bridge send` when you want to write to the gateway
+outbox without making a network request. The message stays under the configured
+gateway, workspace, and principal scope. Run `agent-bridge sync` to publish it later.
+
 Normal inbox and pending reads fall back to the local cache when the gateway is unreachable. Cached reads report `source: "cache"`, `stale: true`, and `degraded: true`. When a read requested an unacknowledged filter, cached rows are candidates rather than proof of unread state and report `acknowledgements: "unknown"`. Claims, lease changes, delivery settlement, presence, and read-receipt writes still require the gateway because replaying those operations after a lease or identity change is unsafe.
 
 ## CLI
@@ -912,6 +941,7 @@ agent-bridge doctor
 agent-bridge status
 agent-bridge pending
 agent-bridge send --type request --target worker "Run the task"
+agent-bridge send --queue-only --type request --target worker "Queue the task"
 agent-bridge post --category goal-update --project agent-bridge "Gateway is ready"
 agent-bridge inbox --limit 20
 agent-bridge sent --limit 20
@@ -939,7 +969,7 @@ agent-bridge watch
 dispatches a command. They are safe to use after a command name, including `archive`
 and `dr` commands.
 
-`--project` adds an optional immutable label to a message. It never selects a workspace or changes the active identity. Omit it on reads to include every project and unlabeled messages in the credential-bound workspace. Pass it to `get`, `inbox`, `history`, `pending`, or `watch` for an exact label match. Gateway callers may use `--workspace` only as an assertion. The CLI rejects a mismatch before sending a request. Local mode permits a per-command workspace override. The global legacy Supabase schema has no tenant workspace, so legacy mode fixes workspace to `*` and rejects other `--workspace` values.
+`--project` adds an optional immutable label to a message. It never selects a workspace or changes the active identity. Omit it on reads to include every project and unlabeled messages in the credential-bound workspace. Pass it to `get`, `inbox`, `history`, `pending`, or `watch` for an exact label match. Gateway callers may use `--workspace` only as an assertion. The CLI rejects a mismatch before sending a request. Local mode permits a per-command workspace override.
 
 History defaults to mailbox `inbox`: broadcasts plus messages targeted to the configured principal, exactly as prior releases did. `sent` selects messages whose source is that principal, and `all` is the union. `--receipt-state any|unread|read` is caller-relative and valid only with `inbox`. The deprecated `--unacked-by` option remains an identity assertion. The CLI rejects a mismatch before opening storage or contacting a gateway. Server surfaces reject it before querying message storage. Cursors bind workspace, principal, mailbox, and normalized filters. Version 1 cursors are temporarily accepted, while all new cursors are version 2.
 
@@ -951,24 +981,22 @@ recipient-visible delivery. The filter also scopes lease-expiry and exhaustion
 maintenance performed by that claim. Released HTTP 2.0 request shapes remain frozen
 and reject the field.
 
-The legacy Supabase adapter applies mailbox and receipt rules cooperatively. A holder of the legacy publishable key can bypass the adapter through PostgREST or its receipt RPC. Use the authenticated v2 gateway when the authorization boundary must be enforced.
-
 `agent-bridge pending` is a cheap shell gate for agent startup. It exits 0 when unread candidates or due delivery work are visible, 1 only for an authoritative empty result, and 2 when an empty remote state cannot be confirmed. Its JSON result separates unread context from executable delivery work and labels the state as `available`, `empty`, or `unknown`.
 
-`watch` runs until interrupted unless `--polls` sets an explicit bound. Empty polls use capped backoff and jitter. Gateway and legacy network failures retry when the error is transient. Authentication and validation errors stop the watcher.
+`watch` runs until interrupted unless `--polls` sets an explicit bound. Empty polls use capped backoff and jitter. Gateway network failures retry when the error is transient. Authentication and validation errors stop the watcher.
 Each exact project filter gets its own local watch checkpoint. Switching between a filtered and unfiltered watch cannot advance the other checkpoint.
 
 Unknown flags and missing option values fail before a message can be sent. This prevents a misspelled target flag from becoming a broadcast.
 
 ## MCP tools
 
-All providers expose the v1 compatibility tools:
+Both providers expose the v1 compatibility tools:
 
 - `post_context`
 - `get_context`
 - `ack_context`
 
-Local and gateway providers also expose:
+They also expose:
 
 - `send`
 - `history`
@@ -983,8 +1011,6 @@ Local and gateway providers also expose:
 - `heartbeat`
 - `presence`
 
-Legacy Supabase does not advertise delivery or presence tools because its schema cannot enforce those operations.
-
 The acknowledgment names depend on the interface. MCP `ack_context` and CLI `acknowledge` write read receipts. MCP `acknowledge` and CLI `ack` settle claimed deliveries. A receipt never settles delivery work, and delivery settlement never creates a receipt.
 
 ## Identity and security
@@ -1018,23 +1044,20 @@ The acknowledgment names depend on the interface. MCP `ack_context` and CLI `ack
 - Errors expose stable codes without database URLs, tokens, or provider response bodies.
 - Delivery work is at least once, not exactly once. Consumers must make external side effects idempotent.
 
-## Legacy Supabase compatibility
-
-Existing deployments can continue using:
-
-```text
-AGENT_BRIDGE_PROVIDER=legacy-supabase
-AGENT_BRIDGE_URL=https://your-project.supabase.co
-AGENT_BRIDGE_KEY=<publishable key>
-```
+## Upgrading historical Supabase deployments
 
-Legacy mode keeps the v1 `shared_context` and `ack_context` RPC behavior. It adds bounded network calls, HTTPS enforcement, UUID mapping across CLI processes, newest-first reads, and the complete compatibility envelope. It cannot provide secure principal binding, delivery leases, presence, or an offline outbox. Use gateway mode for those features.
+Agent Bridge 0.6.0 removed the direct `legacy-supabase` runtime provider. Old provider
+names and key-only configurations now fail with a migration message instead of opening
+PostgREST. Configure local or gateway mode before upgrading a running client.
 
 When gateway migrations run in the same PostgreSQL database as `public.shared_context`, migration 006 imports legacy rows and receipts into the private v2 schema. It preserves valid envelope UUIDs, keeps the existing synthetic UUID mapping for ordinary numeric IDs, assigns deterministic UUIDs to larger IDs, maps projects to workspaces, rejects ID collisions, and verifies the imported count. It does not create executable deliveries for historical targeted rows because an upgrade must not replay old work.
 
 Migration 008 adds the optional project label without changing migration 006. A schema owner can preview correction of migration 006 rows into the canonical `agent-bridge` workspace with `agent-bridge reconcile-legacy-projects`. The command defaults to a dry run. Pass `--apply` to make the change in one transaction. The canonical workspace must already exist. Reconciliation preserves message IDs, timestamps, receipts, and total row counts. It creates no deliveries and is safe to repeat. It refuses changed source data, invalid labels, project or idempotency conflicts, and imported messages that already have a delivery.
 
-The original v1 schema remains in [`sql/setup.sql`](sql/setup.sql). Ordered gateway migrations live in [`sql/migrations/`](sql/migrations/).
+The original v1 schema remains in [`sql/setup.sql`](sql/setup.sql) as a migration
+fixture. Ordered gateway migrations live in [`sql/migrations/`](sql/migrations/).
+The retirement decision is recorded in
+[ADR-0005](docs/decisions/0005-retire-direct-supabase-runtime.md).
 
 ## Health and operations
 
@@ -1143,6 +1166,8 @@ durability behavior has not yet been proved on a dedicated Windows host.
 - [ADR-0001](docs/decisions/0001-protocol-layers-and-acknowledgment-semantics.md): protocol layers and acknowledgment semantics.
 - [ADR-0002](docs/decisions/0002-canonical-operation-contract-registry.md): canonical contracts, generated artifacts, discovery, and version negotiation.
 - [ADR-0003](docs/decisions/0003-host-adapters-and-consumer-instance-keys.md): host layers and consumer instance-key semantics.
+- [ADR-0004](docs/decisions/0004-client-lifecycle-and-endpoint-migration.md): managed client ownership and endpoint migration.
+- [ADR-0005](docs/decisions/0005-retire-direct-supabase-runtime.md): direct Supabase runtime retirement and historical migration support.
 - [docs/architecture-v2.md](docs/architecture-v2.md): protocol and storage decisions.
 - [SKILL.md](SKILL.md): runtime-neutral agent operating instructions.
 - [llms.txt](llms.txt): compact machine-readable project map.

package/ROADMAP.md

@@ -1,7 +1,8 @@
 # Agent Bridge roadmap
 
-Agent Bridge is working toward one specific role: durable messaging and work delivery
-between agent runtimes that do not share a process, vendor, session, or machine.
+Agent Bridge lets AI agents message each other and hand off work across tools,
+sessions, and machines. This roadmap tracks the reliability, compatibility, and
+operating work needed to make that simple promise hold under real failures.
 
 This roadmap separates released behavior from code that has not reached a public
 release. A merged implementation is not considered shipped until the package is
@@ -114,27 +115,83 @@ The published npm version is the authority for whether this package line has shi
 - Optional exact-message delivery claims in HTTP 2.1, MCP, and the CLI. HTTP 2.0 keeps
   the released claim-next contract.
 
-### Post-release validation and adoption
-
-- Move the project's own normal traffic to the authenticated gateway while retaining a
-  tested legacy rollback path.
-- Prove cross-machine claim, settlement, offline replay, and restart behavior against
-  the published package and a deployed v2 gateway. The historical 0.3.0 live release
-  check covered startup, private mailbox sends, caller-scoped history, receipts, and
-  client restart through the legacy compatibility backend. It did not prove
-  gateway-only behavior.
-- Run the manual Fly proof against an operator-owned app and retain its sender,
-  receiver, machine-cycle, and verifier receipts. The repository harness is ready,
-  but the external proof remains incomplete until an approved workflow run succeeds.
-- Replace remaining direct legacy table pollers with the v2 cursor protocol.
-- Confirm the README, npm metadata, GitHub metadata, release notes, and package contents
-  match the released artifact.
+### 0.5.1 and 0.5.2 package contents
+
+- Runtime PostgreSQL connections can load a base64-encoded CA bundle from the secret
+  environment without writing the certificate to the gateway image or filesystem.
+- The gateway rejects URL parameters that could replace the explicit CA policy.
+- Legacy rows whose ancestry column is SQL `NULL` map to an omitted optional field
+  instead of an invalid protocol value.
+- `/healthz` reports process liveness without database work. `/readyz` remains the
+  database, migration, role, and protected-catalog readiness gate.
+
+### 0.6.0 package contents
+
+- `send --queue-only` records an immutable gateway publication in the local outbox
+  without making a network request.
+- The production proof uses the configured edge scope, an explicit stable message ID,
+  and a real Fly stop and start cycle. Separate sender and receiver runners prove
+  offline replay, idempotency, exact claim and settlement, and recovery from a fresh
+  receiver edge.
+- PostgreSQL native DR supports managed-provider role graphs without importing
+  unrelated provider roles or default privileges from schemas outside Agent Bridge.
+- The direct Supabase runtime provider is removed. Historical schema, import, and
+  reconciliation paths remain for upgrades. Runtime contracts now expose only local
+  and gateway providers.
+- Public package language leads with cross-tool, cross-session, and cross-machine
+  messaging and work handoff.
+
+### 0.6.1 package contents
+
+- Authenticated gateway capabilities identify the running package version and Git
+  revision.
+- The Fly deployment procedure records the source revision in the image. A release
+  check compares the deployed version and revision with the intended release before
+  the production proof starts.
+- Public descriptions explain what an agent can do before introducing protocol and
+  storage terminology.
+
+### Production validation and adoption
+
+Completed through the published and deployed 0.6.0 package:
+
+- Migrated the project authority from the legacy Supabase schema to the canonical
+  PostgreSQL schema after a write freeze, exact-major backup, and restore drill. The
+  gateway uses a restricted runtime login. Legacy writes remain frozen, and the final
+  backup remains available for recovery.
+- Deployed the maintained image to an operator-owned Fly app. Authenticated readiness,
+  capabilities, status, history, publication, exact claim, and settlement checks passed
+  against the live gateway.
+- Moved the managed Codex, Claude Code, and Claude Desktop registrations to separate
+  principal-bound gateway backends. All three passed `doctor`, remote history, empty
+  outbox, and empty delivery-queue checks. Fresh MCP launches exposed 17 tools for each
+  supported adapter. A client process started before cutover keeps its old backend until
+  that host restarts.
+- Verified the published npm version, provenance, immutable GitHub release, package
+  contents, and public repository metadata.
+- Ran the approval-protected production workflow on the canonical gateway with
+  distinct sender and receiver runners, an offline sender outbox, a real Fly machine
+  cycle, and a fresh verifier edge. The retained receipts prove replay, exact
+  idempotency, claim, settlement, and recovery after restart.
+- Took and verified a canonical native PostgreSQL backup after the proof. Removed the
+  obsolete public v1 table and receipt function from the live database without changing
+  the canonical PostgreSQL authority.
+- Moved the shared config to the gateway and rechecked the Codex, Claude Code, and
+  Claude Desktop managed backends. All three passed active gateway diagnostics.
+
+The production proof is repeatable release evidence, not a permanent certification.
+Every gateway release must match its package version and source revision before the
+workflow runs with disposable credentials.
 
 ## Near-term work
 
 ### Installation and operations
 
 - Publish a maintained client compatibility matrix.
+- Run dedicated Windows-host acceptance for native ACLs, SQLite sidecars, operation
+  journals, archive publication, and directory durability boundaries.
+- Fence independent PostgreSQL authorities so a restored clone cannot serve writes
+  while the original authority remains active.
 
 ### Storage lifecycle and observability
 

package/SECURITY.md

@@ -120,12 +120,13 @@ stores a domain-separated SHA-256 commitment, never the raw challenge, and exclu
 live challenge rows from native DR data dumps. The challenge proves an active direct
 credential replacement on one authority. It does not authorize endpoint cutover.
 
-### Legacy Supabase mode
+### Historical Supabase migrations
 
-The legacy adapter keeps existing v1 deployments working, but its publishable key can
-call the underlying PostgREST table and receipt RPC directly. Adapter checks therefore
-provide cooperative behavior, not the same workspace and principal isolation as the
-authenticated gateway. Do not use legacy mode as a hostile multi-tenant boundary.
+Agent Bridge 0.6.0 removed the direct Supabase runtime adapter. The checked-in v1
+schema and migration 006 remain so trusted operators can import historical deployments
+into the private PostgreSQL schema. Back up the source first, run the migration with
+schema-owner authority, and move clients to local or gateway mode. The permissive v1
+row policies are not a supported runtime security boundary.
 
 ### Archives and disaster recovery
 

package/SKILL.md

@@ -1,10 +1,13 @@
 ---
 name: agent-bridge
-description: Share context and reliable work between agents across runtimes and machines.
+description: Message other AI agents and hand off work across tools, sessions, and machines.
 ---
 
 # Agent Bridge
 
+Agent Bridge lets AI agents message each other and hand off work across tools,
+sessions, and machines. Messages wait through offline periods and restarts.
+
 Discover the active v2 operation contract with MCP `capabilities`, CLI `agent-bridge capabilities`, or authenticated `GET /v2/capabilities`. Released 2.0 clients continue to work after the gateway is upgraded. A new 2.1 client must receive complete, consistent negotiation headers that select and advertise 2.1 before it mutates remote state. If the probe is headerless, selects 2.0, or returns partial or contradictory headers, do not mutate. Upgrade the gateway first instead of downgrading the client.
 
 An authenticated PostgreSQL gateway status response can include `gatewayAuthorityId`

package/dist/archive.d.ts

@@ -1,6 +1,6 @@
 import { J as JsonValue, i as MessagePriority, f as DeliveryPolicy } from './bridge-domain-CBX3IVqC.js';
-import { P as PgQueryable } from './postgres-bridge-store-C9KG9Z69.js';
-import './bridge-store-ByJ6CaJk.js';
+import { P as PgQueryable } from './postgres-bridge-store-ChoOuFEY.js';
+import './bridge-store-Bi_LCX8e.js';
 
 interface PortableArchiveMessage {
     id: string;

package/dist/{bridge-service-CNBKdYXh.d.ts → bridge-service-DjSYfjKt.d.ts}

@@ -1,4 +1,4 @@
-import { a as BridgeStore, I as InsertMessageResult, d as MessageQuery, M as MessagePage, c as DeliveryQuery, b as DeliveryPage, D as DeliveryEventPage } from './bridge-store-ByJ6CaJk.js';
+import { a as BridgeStore, I as InsertMessageResult, d as MessageQuery, M as MessagePage, c as DeliveryQuery, b as DeliveryPage, D as DeliveryEventPage } from './bridge-store-Bi_LCX8e.js';
 import { c as BridgePrincipal, M as MessageDraft, B as BridgeDelivery, A as AgentPresence } from './bridge-domain-CBX3IVqC.js';
 
 type PublicMessageQuery = MessageQuery & {
@@ -7,7 +7,9 @@ type PublicMessageQuery = MessageQuery & {
 declare class BridgeService {
     private readonly store;
     constructor(store: BridgeStore);
-    publish(principalInput: BridgePrincipal, draftInput: MessageDraft): Promise<InsertMessageResult>;
+    publish(principalInput: BridgePrincipal, draftInput: MessageDraft, options?: {
+        queueOnly?: boolean;
+    }): Promise<InsertMessageResult>;
     history(principalInput: BridgePrincipal, query?: PublicMessageQuery): Promise<MessagePage>;
     acknowledge(principalInput: BridgePrincipal, messageIds: string[]): Promise<number>;
     claim(principalInput: BridgePrincipal, options?: {

package/dist/{bridge-store-ByJ6CaJk.d.ts → bridge-store-Bi_LCX8e.d.ts}

@@ -22,7 +22,7 @@ interface MessagePage {
     cursor?: string;
 }
 interface BridgeDiagnostics {
-    schemaVersion: "local-v2" | "postgres-v2" | "legacy-v1";
+    schemaVersion: "local-v2" | "postgres-v2";
     deliverySupported: boolean;
     pending: number | null;
     claimed: number | null;
@@ -72,6 +72,10 @@ interface BridgeStore {
     insertMessage(message: Omit<BridgeMessage, "sequence" | "createdAt">, options?: {
         signal?: AbortSignal;
     }): Promise<InsertMessageResult>;
+    enqueueMessage?(message: Omit<BridgeMessage, "sequence" | "createdAt">): Promise<InsertMessageResult & {
+        disposition: "queued";
+        authoritative: false;
+    }>;
     listMessages(principal: BridgePrincipal, query?: MessageQuery, options?: {
         signal?: AbortSignal;
     }): Promise<MessagePage>;

package/dist/bridge.d.ts

@@ -1,43 +1,15 @@
-import { b as BridgeMessage, c as BridgePrincipal, B as BridgeDelivery, R as RetryPolicy, A as AgentPresence } from './bridge-domain-CBX3IVqC.js';
+import { c as BridgePrincipal, b as BridgeMessage, B as BridgeDelivery, R as RetryPolicy, A as AgentPresence } from './bridge-domain-CBX3IVqC.js';
 export { a as BridgeDeliveryEvent, d as BridgePrincipalMismatchError, e as BridgeValidationError, D as DeliveryAction, f as DeliveryPolicy, g as DeliveryState, h as DeliveryStateConflictError, J as JsonValue, L as LeasedDeliveryPolicy, M as MessageDraft, i as MessagePriority, j as cursorScope, k as decodeCursor, l as decodeScopedCursor, m as encodeCursor, n as encodeScopedCursor, s as scopedCursorScope, u as uuidv7, v as validateDeliveryCursorPosition, o as validateDeliveryPolicy, p as validateEventCursorPosition, q as validateLeasedDeliveryPolicy, r as validateMessageDraft, t as validatePrincipal, w as validateProject, x as validateUuid } from './bridge-domain-CBX3IVqC.js';
-import { a as BridgeStore, I as InsertMessageResult, d as MessageQuery, M as MessagePage, C as ClaimOptions, B as BridgeDiagnostics, c as DeliveryQuery } from './bridge-store-ByJ6CaJk.js';
-export { D as DeliveryEventPage, b as DeliveryPage } from './bridge-store-ByJ6CaJk.js';
-export { B as BridgeService, P as PublicMessageQuery } from './bridge-service-CNBKdYXh.js';
-import { P as PgQueryable } from './postgres-bridge-store-C9KG9Z69.js';
-export { a as PgTransactionClient, b as PostgresBridgeStore } from './postgres-bridge-store-C9KG9Z69.js';
-export { A as AuthenticatedCredential, C as CredentialResolver, G as GatewayOptions, P as PostgresCredentialResolver, b as bearerToken, c as createGateway, h as hashCredential, s as safeTokenHashEqual } from './gateway-CW-61lvs.js';
-export { E as EdgeConflictError, a as EdgeDrainLease, b as EdgeEnqueueResult, c as EdgeMigrationDrainingError, d as EdgeMigrationGate, e as EdgeMigrationGateState, f as EdgeMigrationLeaseError, g as EdgeMigrationRetiredError, h as EdgeOutboxRecord, i as EdgeReadOnlyInspection, j as EdgeScope, k as EdgeStats, P as PendingMessage, S as SQLiteEdgeStore, l as edgeMessageFingerprint, m as edgeScopeKey, n as inspectEdgeScopeReadOnly, s as stableIdempotency } from './sqlite-edge-store-CdMIOrho.js';
+import { a as BridgeStore, I as InsertMessageResult, d as MessageQuery, M as MessagePage, B as BridgeDiagnostics, C as ClaimOptions, c as DeliveryQuery } from './bridge-store-Bi_LCX8e.js';
+export { D as DeliveryEventPage, b as DeliveryPage } from './bridge-store-Bi_LCX8e.js';
+export { B as BridgeService, P as PublicMessageQuery } from './bridge-service-DjSYfjKt.js';
+import { P as PgQueryable } from './postgres-bridge-store-ChoOuFEY.js';
+export { a as PgTransactionClient, b as PostgresBridgeStore } from './postgres-bridge-store-ChoOuFEY.js';
+export { A as AuthenticatedCredential, C as CredentialResolver, G as GatewayOptions, P as PostgresCredentialResolver, b as bearerToken, c as createGateway, h as hashCredential, s as safeTokenHashEqual } from './gateway-DWZ3pX48.js';
+export { E as EdgeConflictError, a as EdgeDrainLease, b as EdgeEnqueueResult, c as EdgeMigrationDrainingError, d as EdgeMigrationGate, e as EdgeMigrationGateState, f as EdgeMigrationLeaseError, g as EdgeMigrationRetiredError, h as EdgeOutboxRecord, i as EdgeReadOnlyInspection, j as EdgeScope, k as EdgeStats, P as PendingMessage, S as SQLiteEdgeStore, l as edgeMessageFingerprint, m as edgeScopeKey, n as inspectEdgeScopeReadOnly, s as stableIdempotency } from './sqlite-edge-store-BAFUeysk.js';
 export { CachedMessagePage, SQLiteBridgeStore, SyncDiagnostics, SyncInsertResult, SyncReport, SyncingBridgeStore, SyncingBridgeStoreOptions, isRetryableSyncError } from './sqlite.js';
 import 'node:http';
 
-declare class LegacySupabaseError extends Error {
-    readonly status: number;
-    readonly code: string;
-    constructor(status: number, code: string);
-}
-declare class LegacySupabaseRestStore implements BridgeStore {
-    private readonly url;
-    private readonly key;
-    private readonly fetchImpl;
-    private readonly timeoutMs;
-    private readonly legacyIds;
-    private initialized;
-    constructor(url: string, key: string, fetchImpl?: typeof fetch, timeoutMs?: number);
-    initialize(options?: {
-        mode?: "active" | "passive";
-    }): Promise<void>;
-    private request;
-    private visibleReceiptIds;
-    insertMessage(input: Omit<BridgeMessage, "sequence" | "createdAt">): Promise<InsertMessageResult>;
-    listMessages(principal: BridgePrincipal, query?: MessageQuery): Promise<MessagePage>;
-    recordReceipt(principal: BridgePrincipal, ids: string[]): Promise<number>;
-    recordLegacyReceipt(ids: string[], principal: string): Promise<number>;
-    claimDelivery(_principal: BridgePrincipal, _options: ClaimOptions): Promise<BridgeDelivery | null>;
-    renewDelivery(_principal: BridgePrincipal, _deliveryId: string, _leaseToken: string, _leaseMs: number): Promise<BridgeDelivery | null>;
-    settleDelivery(_principal: BridgePrincipal, _deliveryId: string, _leaseToken: string, _state: "acked" | "retrying" | "dead", _error?: string, _retryPolicy?: RetryPolicy): Promise<BridgeDelivery | null>;
-    diagnostics(_principal: BridgePrincipal): Promise<BridgeDiagnostics>;
-}
-
 interface HttpBridgeStoreOptions {
     baseUrl: string;
     token: string;
@@ -175,4 +147,4 @@ declare function runtimeSchemaReady(db: PgQueryable, options?: {
 }): Promise<boolean>;
 declare function runMigrations(db: PgQueryable, directory: string): Promise<AppliedMigration[]>;
 
-export { AgentPresence, type AppliedMigration, BridgeDelivery, BridgeDiagnostics, BridgeHttpError, BridgeMessage, BridgePrincipal, BridgeStore, ClaimOptions, DeliveryQuery, HttpBridgeStore, type HttpBridgeStoreOptions, InsertMessageResult, LegacySupabaseError, LegacySupabaseRestStore, MessagePage, MessageQuery, type MigrationPlanEntry, NATIVE_DR_ADVISORY_LOCK_KEY, PgQueryable, REQUIRED_MIGRATIONS, RetryPolicy, loadMigrationPlan, migrationRecordMatches, migrationsReady, rowIsolationReady, runMigrations, runtimeSchemaReady };
+export { AgentPresence, type AppliedMigration, BridgeDelivery, BridgeDiagnostics, BridgeHttpError, BridgeMessage, BridgePrincipal, BridgeStore, ClaimOptions, DeliveryQuery, HttpBridgeStore, type HttpBridgeStoreOptions, InsertMessageResult, MessagePage, MessageQuery, type MigrationPlanEntry, NATIVE_DR_ADVISORY_LOCK_KEY, PgQueryable, REQUIRED_MIGRATIONS, RetryPolicy, loadMigrationPlan, migrationRecordMatches, migrationsReady, rowIsolationReady, runMigrations, runtimeSchemaReady };

package/dist/bridge.js

@@ -1,10 +1,8 @@
 #!/usr/bin/env node
 import {
   BridgeHttpError,
-  HttpBridgeStore,
-  LegacySupabaseError,
-  LegacySupabaseRestStore
-} from "./chunk-Z6JP6MYD.js";
+  HttpBridgeStore
+} from "./chunk-6ZOLE3E3.js";
 import {
   EdgeConflictError,
   EdgeMigrationDrainingError,
@@ -17,7 +15,7 @@ import {
   inspectEdgeScopeReadOnly,
   isRetryableSyncError,
   stableIdempotency
-} from "./chunk-SN7PIVDF.js";
+} from "./chunk-ZUZ7TCIH.js";
 import {
   SQLiteBridgeStore
 } from "./chunk-IVG4XWWS.js";
@@ -42,11 +40,11 @@ import {
   createGateway,
   hashCredential,
   safeTokenHashEqual
-} from "./chunk-JUTJRAMA.js";
+} from "./chunk-LF37B6KL.js";
 import {
   BridgeService
-} from "./chunk-AWE3DFZV.js";
-import "./chunk-E4OWHGUE.js";
+} from "./chunk-4V2PFJEF.js";
+import "./chunk-63JKCBC6.js";
 import {
   BridgePrincipalMismatchError,
   BridgeValidationError,
@@ -78,8 +76,6 @@ export {
   EdgeMigrationLeaseError,
   EdgeMigrationRetiredError,
   HttpBridgeStore,
-  LegacySupabaseError,
-  LegacySupabaseRestStore,
   NATIVE_DR_ADVISORY_LOCK_KEY,
   PostgresBridgeStore,
   PostgresCredentialResolver,