@creatornader/agent-bridge 0.5.2 → 0.6.1

package/dist/chunk-6ZOLE3E3.js

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+import {
+  ContractResponseError,
+  PROTOCOL_HEADER,
+  PROTOCOL_VERSION,
+  SUPPORTED_PROTOCOL_HEADER,
+  SUPPORTED_PROTOCOL_VERSIONS,
+  parseResponse
+} from "./chunk-63JKCBC6.js";
+
+// src/http-bridge-store.ts
+var BridgeHttpError = class extends Error {
+  constructor(status, code, requestId, details, message = `Agent Bridge request failed: ${code}`) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.requestId = requestId;
+    this.details = details;
+  }
+};
+var HttpBridgeStore = class {
+  constructor(options) {
+    this.options = options;
+    this.closeController = new AbortController();
+    this.closed = false;
+    const url = new URL(options.baseUrl);
+    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) && !options.allowInsecureRemoteHttp) {
+      throw new Error("Agent Bridge requires HTTPS for non-loopback gateways");
+    }
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  async initialize(options = {}) {
+    if (options.mode === "passive") return;
+    await this.request(void 0, "/readyz", { authenticated: false, signal: options.signal });
+    const status = await this.request("status", "/v2/status", { signal: options.signal });
+    this.assertBoundPrincipal(status);
+  }
+  assertBoundPrincipal(status) {
+    const principal = status?.principal;
+    if (!principal || principal.workspace !== this.options.principal.workspace || principal.agent !== this.options.principal.agent) {
+      throw new BridgeHttpError(403, "principal_mismatch");
+    }
+  }
+  async request(operationId, path, options = {}) {
+    if (options.method === "POST" && !options.skipProtocolProbe) await this.ensureProtocol(options.signal);
+    if (this.closed) throw new BridgeHttpError(0, "store_closed");
+    if (options.signal?.aborted) throw new BridgeHttpError(0, "request_cancelled");
+    const requestController = new AbortController();
+    const abort = () => requestController.abort(this.closeController.signal.reason);
+    const abortRequest = () => requestController.abort(options.signal?.reason);
+    this.closeController.signal.addEventListener("abort", abort, { once: true });
+    options.signal?.addEventListener("abort", abortRequest, { once: true });
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      requestController.abort(new Error("request timeout"));
+    }, this.options.timeoutMs ?? 1e4);
+    timeout.unref?.();
+    try {
+      const response = await this.fetchImpl(`${this.options.baseUrl.replace(/\/$/, "")}${path}`, {
+        method: options.method ?? "GET",
+        signal: requestController.signal,
+        headers: {
+          [PROTOCOL_HEADER]: this.selectedProtocolVersion ?? PROTOCOL_VERSION,
+          ...options.authenticated === false ? {} : { authorization: `Bearer ${this.options.token}` },
+          ...this.options.principal.instance ? { "x-agent-bridge-instance": this.options.principal.instance } : {},
+          ...options.body === void 0 ? {} : { "content-type": "application/json" }
+        },
+        body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
+      });
+      const requestId = response.headers.get("x-request-id") ?? void 0;
+      const selectedHeader = response.headers.get(PROTOCOL_HEADER);
+      const supportedHeader = response.headers.get(SUPPORTED_PROTOCOL_HEADER);
+      const supportedProtocols = supportedHeader?.split(",").map((value) => value.trim()).filter(Boolean) ?? [];
+      const inconsistentProtocol = selectedHeader === null || supportedHeader === null || !SUPPORTED_PROTOCOL_VERSIONS.includes(selectedHeader) || !supportedProtocols.includes(selectedHeader) || selectedHeader !== PROTOCOL_VERSION;
+      if (operationId && inconsistentProtocol) {
+        throw new BridgeHttpError(502, "protocol_mismatch", requestId, {
+          expected: PROTOCOL_VERSION,
+          selected: selectedHeader,
+          supported: supportedHeader
+        });
+      }
+      const contentType = response.headers.get("content-type") ?? "";
+      const payload = contentType.startsWith("application/json") ? await response.json().catch(() => ({})) : await response.text();
+      if (!response.ok) {
+        const envelope = payload && typeof payload === "object" ? payload.error : void 0;
+        throw new BridgeHttpError(
+          response.status,
+          envelope?.code ?? "request_failed",
+          envelope?.requestId ?? requestId,
+          envelope?.details ?? envelope,
+          envelope?.message ?? `Agent Bridge request failed: ${envelope?.code ?? "request_failed"}`
+        );
+      }
+      if (operationId) this.selectedProtocolVersion = PROTOCOL_VERSION;
+      if (!operationId) return payload;
+      return parseResponse(operationId, payload);
+    } catch (error) {
+      if (error instanceof BridgeHttpError) throw error;
+      if (error instanceof ContractResponseError) {
+        throw new BridgeHttpError(error.status, error.code, void 0, {
+          operation: error.operation,
+          issues: error.issues
+        }, error.message);
+      }
+      if (this.closed) throw new BridgeHttpError(0, "store_closed");
+      if (options.signal?.aborted) throw new BridgeHttpError(0, "request_cancelled");
+      if (timedOut) throw new BridgeHttpError(504, "request_timeout");
+      if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError")) {
+        throw new BridgeHttpError(504, "request_timeout");
+      }
+      throw new BridgeHttpError(0, "network_error");
+    } finally {
+      clearTimeout(timeout);
+      this.closeController.signal.removeEventListener("abort", abort);
+      options.signal?.removeEventListener("abort", abortRequest);
+    }
+  }
+  ensureProtocol(signal) {
+    if (this.selectedProtocolVersion) return Promise.resolve(this.selectedProtocolVersion);
+    if (!this.protocolProbe) {
+      this.protocolProbe = this.request("status", "/v2/status", { signal, skipProtocolProbe: true }).then(() => this.selectedProtocolVersion).finally(() => {
+        this.protocolProbe = void 0;
+      });
+    }
+    return this.protocolProbe;
+  }
+  async capabilities() {
+    return this.request("capabilities", "/v2/capabilities");
+  }
+  assertPrincipal(principal, includeInstance = true) {
+    const expected = this.options.principal;
+    if (principal.workspace !== expected.workspace || principal.agent !== expected.agent || includeInstance && principal.instance !== expected.instance) {
+      throw new BridgeHttpError(403, "principal_mismatch");
+    }
+  }
+  async insertMessage(message, options = {}) {
+    this.assertPrincipal({ workspace: message.workspace, agent: message.source }, false);
+    await this.ensureProtocol(options.signal);
+    const { workspace: _workspace, source: _source, ...draft } = message;
+    return this.request("publish_message", "/v2/messages", { method: "POST", body: draft, signal: options.signal });
+  }
+  async listMessages(principal, query = {}, options = {}) {
+    this.assertPrincipal(principal);
+    const requestQuery = query;
+    const params = new URLSearchParams();
+    if (requestQuery.cursor) params.set("cursor", requestQuery.cursor);
+    if (requestQuery.mailbox) params.set("mailbox", requestQuery.mailbox);
+    if (requestQuery.receiptState) params.set("receiptState", requestQuery.receiptState);
+    if (requestQuery.limit) params.set("limit", String(requestQuery.limit));
+    if (requestQuery.includeExpired) params.set("includeExpired", "true");
+    if (requestQuery.source) params.set("source", requestQuery.source);
+    if (requestQuery.project) params.set("project", requestQuery.project);
+    if (requestQuery.since) params.set("since", requestQuery.since);
+    if (requestQuery.threadId) params.set("threadId", requestQuery.threadId);
+    if (requestQuery.latest) params.set("latest", "true");
+    for (const type of requestQuery.types ?? []) params.append("type", type);
+    return this.request("history", `/v2/history${params.size ? `?${params}` : ""}`, { signal: options.signal });
+  }
+  async recordReceipt(principal, ids) {
+    this.assertPrincipal(principal, false);
+    return (await this.request("record_receipt", "/v2/receipts", { method: "POST", body: { messageIds: ids } })).recorded;
+  }
+  async diagnostics(principal) {
+    this.assertPrincipal(principal);
+    const status = await this.request("status", "/v2/status");
+    this.assertBoundPrincipal(status);
+    return status;
+  }
+  async claimDelivery(principal, options) {
+    this.assertPrincipal(principal);
+    return (await this.request("claim_delivery", "/v2/deliveries/claim", { method: "POST", body: options }))?.delivery ?? null;
+  }
+  async listDeliveries(principal, query = {}) {
+    this.assertPrincipal(principal);
+    const params = new URLSearchParams();
+    if (query.cursor) params.set("cursor", query.cursor);
+    if (query.limit) params.set("limit", String(query.limit));
+    if (query.role) params.set("role", query.role);
+    if (query.messageId) params.set("messageId", query.messageId);
+    if (query.recipient) params.set("recipient", query.recipient);
+    for (const state of query.states ?? []) params.append("state", state);
+    return this.request("list_deliveries", `/v2/deliveries${params.size ? `?${params}` : ""}`);
+  }
+  async listDeliveryEvents(principal, id, query = {}) {
+    this.assertPrincipal(principal);
+    const params = new URLSearchParams();
+    if (query.cursor) params.set("cursor", query.cursor);
+    if (query.limit) params.set("limit", String(query.limit));
+    return this.request("list_delivery_events", `/v2/deliveries/${id}/events${params.size ? `?${params}` : ""}`);
+  }
+  async cancelDelivery(principal, id) {
+    this.assertPrincipal(principal);
+    return (await this.request("cancel_delivery", `/v2/deliveries/${id}/cancel`, { method: "POST", body: {} })).delivery;
+  }
+  async requeueDelivery(principal, id) {
+    this.assertPrincipal(principal);
+    return (await this.request("requeue_delivery", `/v2/deliveries/${id}/requeue`, { method: "POST", body: {} })).delivery;
+  }
+  async renewDelivery(principal, id, token, leaseMs) {
+    this.assertPrincipal(principal);
+    try {
+      return (await this.request("extend_delivery", `/v2/deliveries/${id}/extend`, { method: "POST", body: { leaseToken: token, leaseMs } })).delivery;
+    } catch (error) {
+      if (error instanceof BridgeHttpError && error.status === 409) return null;
+      throw error;
+    }
+  }
+  async settleDelivery(principal, id, token, state, error, _retryPolicy) {
+    this.assertPrincipal(principal);
+    await this.ensureProtocol();
+    const action = state === "acked" ? "ack" : "nack";
+    try {
+      const operationId = action === "ack" ? "acknowledge_delivery" : "negative_acknowledge_delivery";
+      const nackBody = { leaseToken: token, error, disposition: state === "dead" ? "dead" : "retry" };
+      return (await this.request(operationId, `/v2/deliveries/${id}/${action}`, { method: "POST", body: action === "ack" ? { leaseToken: token } : nackBody })).delivery;
+    } catch (caught) {
+      if (caught instanceof BridgeHttpError && caught.status === 409) return null;
+      throw caught;
+    }
+  }
+  async heartbeat(principal, leaseMs, runtimeType, capabilities = []) {
+    this.assertPrincipal(principal);
+    return this.request("heartbeat", "/v2/presence/heartbeat", { method: "POST", body: { leaseMs, runtimeType, capabilities } });
+  }
+  async listPresence(principal) {
+    this.assertPrincipal(principal);
+    return (await this.request("presence", "/v2/presence")).agents;
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.closeController.abort(new Error("store closed"));
+  }
+};
+
+export {
+  BridgeHttpError,
+  HttpBridgeStore
+};
+//# sourceMappingURL=chunk-6ZOLE3E3.js.map

package/dist/chunk-6ZOLE3E3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/http-bridge-store.ts"],"sourcesContent":["import type { AgentPresence, BridgeDelivery, BridgeMessage, BridgePrincipal } from \"./bridge-domain.js\";\nimport type { BridgeDiagnostics, BridgeStore, ClaimOptions, InsertMessageResult, MessagePage, MessageQuery } from \"./bridge-store.js\";\nimport {\n  ContractResponseError,\n  parseResponse,\n  PROTOCOL_HEADER,\n  PROTOCOL_VERSION,\n  SUPPORTED_PROTOCOL_HEADER,\n  SUPPORTED_PROTOCOL_VERSIONS,\n  type OperationId,\n} from \"./contracts/registry.js\";\n\nexport interface HttpBridgeStoreOptions {\n  baseUrl: string;\n  token: string;\n  principal: BridgePrincipal;\n  timeoutMs?: number;\n  allowInsecureRemoteHttp?: boolean;\n  fetch?: typeof fetch;\n}\n\nexport class BridgeHttpError extends Error {\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    readonly requestId?: string,\n    readonly details?: unknown,\n    message = `Agent Bridge request failed: ${code}`,\n  ) {\n    super(message);\n  }\n}\n\nexport class HttpBridgeStore implements BridgeStore {\n  private readonly fetchImpl: typeof fetch;\n  private readonly closeController = new AbortController();\n  private closed = false;\n  private selectedProtocolVersion?: string;\n  private protocolProbe?: Promise<string>;\n  constructor(private readonly options: HttpBridgeStoreOptions) {\n    const url = new URL(options.baseUrl);\n    const loopback = url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\" || url.hostname === \"[::1]\";\n    if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && loopback) && !options.allowInsecureRemoteHttp) {\n      throw new Error(\"Agent Bridge requires HTTPS for non-loopback gateways\");\n    }\n    this.fetchImpl = options.fetch ?? fetch;\n  }\n  async initialize(options: { signal?: AbortSignal; mode?: \"active\" | \"passive\" } = {}): Promise<void> {\n    if (options.mode === \"passive\") return;\n    await this.request(undefined, \"/readyz\", { authenticated: false, signal: options.signal });\n    const status = await this.request(\"status\", \"/v2/status\", { signal: options.signal });\n    this.assertBoundPrincipal(status);\n  }\n\n  private assertBoundPrincipal(status: any): void {\n    const principal = status?.principal;\n    if (\n      !principal ||\n      principal.workspace !== this.options.principal.workspace ||\n      principal.agent !== this.options.principal.agent\n    ) {\n      throw new BridgeHttpError(403, \"principal_mismatch\");\n    }\n  }\n\n  private async request(operationId: OperationId | undefined, path: string, options: { method?: string; body?: unknown; authenticated?: boolean; signal?: AbortSignal; skipProtocolProbe?: boolean } = {}): Promise<any> {\n    if (options.method === \"POST\" && !options.skipProtocolProbe) await this.ensureProtocol(options.signal);\n    if (this.closed) throw new BridgeHttpError(0, \"store_closed\");\n    if (options.signal?.aborted) throw new BridgeHttpError(0, \"request_cancelled\");\n    const requestController = new AbortController();\n    const abort = () => requestController.abort(this.closeController.signal.reason);\n    const abortRequest = () => requestController.abort(options.signal?.reason);\n    this.closeController.signal.addEventListener(\"abort\", abort, { once: true });\n    options.signal?.addEventListener(\"abort\", abortRequest, { once: true });\n    let timedOut = false;\n    const timeout = setTimeout(() => {\n      timedOut = true;\n      requestController.abort(new Error(\"request timeout\"));\n    }, this.options.timeoutMs ?? 10_000);\n    timeout.unref?.();\n    try {\n      const response = await this.fetchImpl(`${this.options.baseUrl.replace(/\\/$/, \"\")}${path}`, {\n        method: options.method ?? \"GET\", signal: requestController.signal,\n        headers: {\n          [PROTOCOL_HEADER]: this.selectedProtocolVersion ?? PROTOCOL_VERSION,\n          ...(options.authenticated === false ? {} : { authorization: `Bearer ${this.options.token}` }),\n          ...(this.options.principal.instance ? { \"x-agent-bridge-instance\": this.options.principal.instance } : {}),\n          ...(options.body === undefined ? {} : { \"content-type\": \"application/json\" }),\n        },\n        body: options.body === undefined ? undefined : JSON.stringify(options.body),\n      });\n      const requestId = response.headers.get(\"x-request-id\") ?? undefined;\n      const selectedHeader = response.headers.get(PROTOCOL_HEADER);\n      const supportedHeader = response.headers.get(SUPPORTED_PROTOCOL_HEADER);\n      const supportedProtocols = supportedHeader?.split(\",\").map((value) => value.trim()).filter(Boolean) ?? [];\n      const inconsistentProtocol = (\n        selectedHeader === null || supportedHeader === null ||\n        !(SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(selectedHeader) ||\n        !supportedProtocols.includes(selectedHeader) ||\n        selectedHeader !== PROTOCOL_VERSION\n      );\n      if (operationId && inconsistentProtocol) {\n        throw new BridgeHttpError(502, \"protocol_mismatch\", requestId, {\n          expected: PROTOCOL_VERSION,\n          selected: selectedHeader,\n          supported: supportedHeader,\n        });\n      }\n      const contentType = response.headers.get(\"content-type\") ?? \"\";\n      const payload = contentType.startsWith(\"application/json\")\n        ? await response.json().catch(() => ({}))\n        : await response.text();\n      if (!response.ok) {\n        const envelope = payload && typeof payload === \"object\" ? (payload as any).error : undefined;\n        throw new BridgeHttpError(\n          response.status,\n          envelope?.code ?? \"request_failed\",\n          envelope?.requestId ?? requestId,\n          envelope?.details ?? envelope,\n          envelope?.message ?? `Agent Bridge request failed: ${envelope?.code ?? \"request_failed\"}`,\n        );\n      }\n      if (operationId) this.selectedProtocolVersion = PROTOCOL_VERSION;\n      if (!operationId) return payload;\n      return parseResponse(operationId, payload);\n    } catch (error) {\n      if (error instanceof BridgeHttpError) throw error;\n      if (error instanceof ContractResponseError) {\n        throw new BridgeHttpError(error.status, error.code, undefined, {\n          operation: error.operation,\n          issues: error.issues,\n        }, error.message);\n      }\n      if (this.closed) throw new BridgeHttpError(0, \"store_closed\");\n      if (options.signal?.aborted) throw new BridgeHttpError(0, \"request_cancelled\");\n      if (timedOut) throw new BridgeHttpError(504, \"request_timeout\");\n      if (error instanceof Error && (error.name === \"TimeoutError\" || error.name === \"AbortError\")) {\n        throw new BridgeHttpError(504, \"request_timeout\");\n      }\n      throw new BridgeHttpError(0, \"network_error\");\n    } finally {\n      clearTimeout(timeout);\n      this.closeController.signal.removeEventListener(\"abort\", abort);\n      options.signal?.removeEventListener(\"abort\", abortRequest);\n    }\n  }\n\n  private ensureProtocol(signal?: AbortSignal): Promise<string> {\n    if (this.selectedProtocolVersion) return Promise.resolve(this.selectedProtocolVersion);\n    if (!this.protocolProbe) {\n      this.protocolProbe = this.request(\"status\", \"/v2/status\", { signal, skipProtocolProbe: true })\n        .then(() => this.selectedProtocolVersion!)\n        .finally(() => { this.protocolProbe = undefined; });\n    }\n    return this.protocolProbe;\n  }\n  async capabilities(): Promise<unknown> { return this.request(\"capabilities\", \"/v2/capabilities\"); }\n\n  private assertPrincipal(principal: BridgePrincipal, includeInstance = true): void {\n    const expected = this.options.principal;\n    if (\n      principal.workspace !== expected.workspace ||\n      principal.agent !== expected.agent ||\n      (includeInstance && principal.instance !== expected.instance)\n    ) {\n      throw new BridgeHttpError(403, \"principal_mismatch\");\n    }\n  }\n\n  async insertMessage(message: Omit<BridgeMessage, \"sequence\" | \"createdAt\">, options: { signal?: AbortSignal } = {}): Promise<InsertMessageResult> {\n    this.assertPrincipal({ workspace: message.workspace, agent: message.source }, false);\n    await this.ensureProtocol(options.signal);\n    const { workspace: _workspace, source: _source, ...draft } = message;\n    return this.request(\"publish_message\", \"/v2/messages\", { method: \"POST\", body: draft, signal: options.signal });\n  }\n  async listMessages(principal: BridgePrincipal, query: MessageQuery = {}, options: { signal?: AbortSignal } = {}): Promise<MessagePage> {\n    this.assertPrincipal(principal);\n    const requestQuery = query;\n    const params = new URLSearchParams();\n    if (requestQuery.cursor) params.set(\"cursor\", requestQuery.cursor);\n    if (requestQuery.mailbox) params.set(\"mailbox\", requestQuery.mailbox);\n    if (requestQuery.receiptState) params.set(\"receiptState\", requestQuery.receiptState);\n    if (requestQuery.limit) params.set(\"limit\", String(requestQuery.limit));\n    if (requestQuery.includeExpired) params.set(\"includeExpired\", \"true\");\n    if (requestQuery.source) params.set(\"source\", requestQuery.source);\n    if (requestQuery.project) params.set(\"project\", requestQuery.project);\n    if (requestQuery.since) params.set(\"since\", requestQuery.since);\n    if (requestQuery.threadId) params.set(\"threadId\", requestQuery.threadId);\n    if (requestQuery.latest) params.set(\"latest\", \"true\");\n    for (const type of requestQuery.types ?? []) params.append(\"type\", type);\n    return this.request(\"history\", `/v2/history${params.size ? `?${params}` : \"\"}`, { signal: options.signal });\n  }\n  async recordReceipt(principal: BridgePrincipal, ids: string[]): Promise<number> {\n    this.assertPrincipal(principal, false);\n    return (await this.request(\"record_receipt\", \"/v2/receipts\", { method: \"POST\", body: { messageIds: ids } })).recorded;\n  }\n  async diagnostics(principal: BridgePrincipal): Promise<BridgeDiagnostics> {\n    this.assertPrincipal(principal);\n    const status = await this.request(\"status\", \"/v2/status\");\n    this.assertBoundPrincipal(status);\n    return status;\n  }\n  async claimDelivery(principal: BridgePrincipal, options: ClaimOptions): Promise<BridgeDelivery | null> {\n    this.assertPrincipal(principal);\n    return (await this.request(\"claim_delivery\", \"/v2/deliveries/claim\", { method: \"POST\", body: options }))?.delivery ?? null;\n  }\n  async listDeliveries(principal: BridgePrincipal, query: import(\"./bridge-store.js\").DeliveryQuery = {}) {\n    this.assertPrincipal(principal); const params=new URLSearchParams(); if(query.cursor)params.set(\"cursor\",query.cursor);if(query.limit)params.set(\"limit\",String(query.limit));if(query.role)params.set(\"role\",query.role);if(query.messageId)params.set(\"messageId\",query.messageId);if(query.recipient)params.set(\"recipient\",query.recipient);for(const state of query.states??[])params.append(\"state\",state);return this.request(\"list_deliveries\",`/v2/deliveries${params.size?`?${params}`:\"\"}`);\n  }\n  async listDeliveryEvents(principal: BridgePrincipal,id:string,query:{cursor?:string;limit?:number}={}) { this.assertPrincipal(principal);const params=new URLSearchParams();if(query.cursor)params.set(\"cursor\",query.cursor);if(query.limit)params.set(\"limit\",String(query.limit));return this.request(\"list_delivery_events\",`/v2/deliveries/${id}/events${params.size?`?${params}`:\"\"}`); }\n  async cancelDelivery(principal:BridgePrincipal,id:string){this.assertPrincipal(principal);return (await this.request(\"cancel_delivery\",`/v2/deliveries/${id}/cancel`,{method:\"POST\",body:{}})).delivery;}\n  async requeueDelivery(principal:BridgePrincipal,id:string){this.assertPrincipal(principal);return (await this.request(\"requeue_delivery\",`/v2/deliveries/${id}/requeue`,{method:\"POST\",body:{}})).delivery;}\n  async renewDelivery(principal: BridgePrincipal, id: string, token: string, leaseMs: number): Promise<BridgeDelivery | null> {\n    this.assertPrincipal(principal);\n    try {\n      return (await this.request(\"extend_delivery\", `/v2/deliveries/${id}/extend`, { method: \"POST\", body: { leaseToken: token, leaseMs } })).delivery;\n    } catch (error) {\n      if (error instanceof BridgeHttpError && error.status === 409) return null;\n      throw error;\n    }\n  }\n  async settleDelivery(principal: BridgePrincipal, id: string, token: string, state: \"acked\" | \"retrying\" | \"dead\", error?: string, _retryPolicy?: import(\"./bridge-domain.js\").RetryPolicy): Promise<BridgeDelivery | null> {\n    this.assertPrincipal(principal);\n    await this.ensureProtocol();\n    const action = state === \"acked\" ? \"ack\" : \"nack\";\n    try {\n      const operationId = action === \"ack\" ? \"acknowledge_delivery\" : \"negative_acknowledge_delivery\";\n      const nackBody = { leaseToken: token, error, disposition: state === \"dead\" ? \"dead\" : \"retry\" };\n      return (await this.request(operationId, `/v2/deliveries/${id}/${action}`, { method: \"POST\", body: action === \"ack\" ? { leaseToken: token } : nackBody })).delivery;\n    } catch (caught) {\n      if (caught instanceof BridgeHttpError && caught.status === 409) return null;\n      throw caught;\n    }\n  }\n  async heartbeat(principal: BridgePrincipal, leaseMs: number, runtimeType?: string, capabilities: string[] = []): Promise<AgentPresence> {\n    this.assertPrincipal(principal);\n    return this.request(\"heartbeat\", \"/v2/presence/heartbeat\", { method: \"POST\", body: { leaseMs, runtimeType, capabilities } });\n  }\n  async listPresence(principal: BridgePrincipal): Promise<AgentPresence[]> {\n    this.assertPrincipal(principal);\n    return (await this.request(\"presence\", \"/v2/presence\")).agents;\n  }\n  async close(): Promise<void> {\n    if (this.closed) return;\n    this.closed = true;\n    this.closeController.abort(new Error(\"store closed\"));\n  }\n}\n"],"mappings":";;;;;;;;;;;AAqBO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YACW,QACA,MACA,WACA,SACT,UAAU,gCAAgC,IAAI,IAC9C;AACA,UAAM,OAAO;AANJ;AACA;AACA;AACA;AAAA,EAIX;AACF;AAEO,IAAM,kBAAN,MAA6C;AAAA,EAMlD,YAA6B,SAAiC;AAAjC;AAJ7B,SAAiB,kBAAkB,IAAI,gBAAgB;AACvD,SAAQ,SAAS;AAIf,UAAM,MAAM,IAAI,IAAI,QAAQ,OAAO;AACnC,UAAM,WAAW,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,aAAa;AAClG,QAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,aAAa,CAAC,QAAQ,yBAAyB;AAC5G,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AACA,SAAK,YAAY,QAAQ,SAAS;AAAA,EACpC;AAAA,EACA,MAAM,WAAW,UAAiE,CAAC,GAAkB;AACnG,QAAI,QAAQ,SAAS,UAAW;AAChC,UAAM,KAAK,QAAQ,QAAW,WAAW,EAAE,eAAe,OAAO,QAAQ,QAAQ,OAAO,CAAC;AACzF,UAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,cAAc,EAAE,QAAQ,QAAQ,OAAO,CAAC;AACpF,SAAK,qBAAqB,MAAM;AAAA,EAClC;AAAA,EAEQ,qBAAqB,QAAmB;AAC9C,UAAM,YAAY,QAAQ;AAC1B,QACE,CAAC,aACD,UAAU,cAAc,KAAK,QAAQ,UAAU,aAC/C,UAAU,UAAU,KAAK,QAAQ,UAAU,OAC3C;AACA,YAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAAA,IACrD;AAAA,EACF;AAAA,EAEA,MAAc,QAAQ,aAAsC,MAAc,UAA2H,CAAC,GAAiB;AACrN,QAAI,QAAQ,WAAW,UAAU,CAAC,QAAQ,kBAAmB,OAAM,KAAK,eAAe,QAAQ,MAAM;AACrG,QAAI,KAAK,OAAQ,OAAM,IAAI,gBAAgB,GAAG,cAAc;AAC5D,QAAI,QAAQ,QAAQ,QAAS,OAAM,IAAI,gBAAgB,GAAG,mBAAmB;AAC7E,UAAM,oBAAoB,IAAI,gBAAgB;AAC9C,UAAM,QAAQ,MAAM,kBAAkB,MAAM,KAAK,gBAAgB,OAAO,MAAM;AAC9E,UAAM,eAAe,MAAM,kBAAkB,MAAM,QAAQ,QAAQ,MAAM;AACzE,SAAK,gBAAgB,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAC3E,YAAQ,QAAQ,iBAAiB,SAAS,cAAc,EAAE,MAAM,KAAK,CAAC;AACtE,QAAI,WAAW;AACf,UAAM,UAAU,WAAW,MAAM;AAC/B,iBAAW;AACX,wBAAkB,MAAM,IAAI,MAAM,iBAAiB,CAAC;AAAA,IACtD,GAAG,KAAK,QAAQ,aAAa,GAAM;AACnC,YAAQ,QAAQ;AAChB,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,QAAQ,QAAQ,OAAO,EAAE,CAAC,GAAG,IAAI,IAAI;AAAA,QACzF,QAAQ,QAAQ,UAAU;AAAA,QAAO,QAAQ,kBAAkB;AAAA,QAC3D,SAAS;AAAA,UACP,CAAC,eAAe,GAAG,KAAK,2BAA2B;AAAA,UACnD,GAAI,QAAQ,kBAAkB,QAAQ,CAAC,IAAI,EAAE,eAAe,UAAU,KAAK,QAAQ,KAAK,GAAG;AAAA,UAC3F,GAAI,KAAK,QAAQ,UAAU,WAAW,EAAE,2BAA2B,KAAK,QAAQ,UAAU,SAAS,IAAI,CAAC;AAAA,UACxG,GAAI,QAAQ,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,QAC7E;AAAA,QACA,MAAM,QAAQ,SAAS,SAAY,SAAY,KAAK,UAAU,QAAQ,IAAI;AAAA,MAC5E,CAAC;AACD,YAAM,YAAY,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC1D,YAAM,iBAAiB,SAAS,QAAQ,IAAI,eAAe;AAC3D,YAAM,kBAAkB,SAAS,QAAQ,IAAI,yBAAyB;AACtE,YAAM,qBAAqB,iBAAiB,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,KAAK,CAAC;AACxG,YAAM,uBACJ,mBAAmB,QAAQ,oBAAoB,QAC/C,CAAE,4BAAkD,SAAS,cAAc,KAC3E,CAAC,mBAAmB,SAAS,cAAc,KAC3C,mBAAmB;AAErB,UAAI,eAAe,sBAAsB;AACvC,cAAM,IAAI,gBAAgB,KAAK,qBAAqB,WAAW;AAAA,UAC7D,UAAU;AAAA,UACV,UAAU;AAAA,UACV,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,YAAM,UAAU,YAAY,WAAW,kBAAkB,IACrD,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,IACtC,MAAM,SAAS,KAAK;AACxB,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,WAAW,WAAW,OAAO,YAAY,WAAY,QAAgB,QAAQ;AACnF,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT,UAAU,QAAQ;AAAA,UAClB,UAAU,aAAa;AAAA,UACvB,UAAU,WAAW;AAAA,UACrB,UAAU,WAAW,gCAAgC,UAAU,QAAQ,gBAAgB;AAAA,QACzF;AAAA,MACF;AACA,UAAI,YAAa,MAAK,0BAA0B;AAChD,UAAI,CAAC,YAAa,QAAO;AACzB,aAAO,cAAc,aAAa,OAAO;AAAA,IAC3C,SAAS,OAAO;AACd,UAAI,iBAAiB,gBAAiB,OAAM;AAC5C,UAAI,iBAAiB,uBAAuB;AAC1C,cAAM,IAAI,gBAAgB,MAAM,QAAQ,MAAM,MAAM,QAAW;AAAA,UAC7D,WAAW,MAAM;AAAA,UACjB,QAAQ,MAAM;AAAA,QAChB,GAAG,MAAM,OAAO;AAAA,MAClB;AACA,UAAI,KAAK,OAAQ,OAAM,IAAI,gBAAgB,GAAG,cAAc;AAC5D,UAAI,QAAQ,QAAQ,QAAS,OAAM,IAAI,gBAAgB,GAAG,mBAAmB;AAC7E,UAAI,SAAU,OAAM,IAAI,gBAAgB,KAAK,iBAAiB;AAC9D,UAAI,iBAAiB,UAAU,MAAM,SAAS,kBAAkB,MAAM,SAAS,eAAe;AAC5F,cAAM,IAAI,gBAAgB,KAAK,iBAAiB;AAAA,MAClD;AACA,YAAM,IAAI,gBAAgB,GAAG,eAAe;AAAA,IAC9C,UAAE;AACA,mBAAa,OAAO;AACpB,WAAK,gBAAgB,OAAO,oBAAoB,SAAS,KAAK;AAC9D,cAAQ,QAAQ,oBAAoB,SAAS,YAAY;AAAA,IAC3D;AAAA,EACF;AAAA,EAEQ,eAAe,QAAuC;AAC5D,QAAI,KAAK,wBAAyB,QAAO,QAAQ,QAAQ,KAAK,uBAAuB;AACrF,QAAI,CAAC,KAAK,eAAe;AACvB,WAAK,gBAAgB,KAAK,QAAQ,UAAU,cAAc,EAAE,QAAQ,mBAAmB,KAAK,CAAC,EAC1F,KAAK,MAAM,KAAK,uBAAwB,EACxC,QAAQ,MAAM;AAAE,aAAK,gBAAgB;AAAA,MAAW,CAAC;AAAA,IACtD;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EACA,MAAM,eAAiC;AAAE,WAAO,KAAK,QAAQ,gBAAgB,kBAAkB;AAAA,EAAG;AAAA,EAE1F,gBAAgB,WAA4B,kBAAkB,MAAY;AAChF,UAAM,WAAW,KAAK,QAAQ;AAC9B,QACE,UAAU,cAAc,SAAS,aACjC,UAAU,UAAU,SAAS,SAC5B,mBAAmB,UAAU,aAAa,SAAS,UACpD;AACA,YAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAAA,IACrD;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,SAAwD,UAAoC,CAAC,GAAiC;AAChJ,SAAK,gBAAgB,EAAE,WAAW,QAAQ,WAAW,OAAO,QAAQ,OAAO,GAAG,KAAK;AACnF,UAAM,KAAK,eAAe,QAAQ,MAAM;AACxC,UAAM,EAAE,WAAW,YAAY,QAAQ,SAAS,GAAG,MAAM,IAAI;AAC7D,WAAO,KAAK,QAAQ,mBAAmB,gBAAgB,EAAE,QAAQ,QAAQ,MAAM,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAChH;AAAA,EACA,MAAM,aAAa,WAA4B,QAAsB,CAAC,GAAG,UAAoC,CAAC,GAAyB;AACrI,SAAK,gBAAgB,SAAS;AAC9B,UAAM,eAAe;AACrB,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,aAAa,OAAQ,QAAO,IAAI,UAAU,aAAa,MAAM;AACjE,QAAI,aAAa,QAAS,QAAO,IAAI,WAAW,aAAa,OAAO;AACpE,QAAI,aAAa,aAAc,QAAO,IAAI,gBAAgB,aAAa,YAAY;AACnF,QAAI,aAAa,MAAO,QAAO,IAAI,SAAS,OAAO,aAAa,KAAK,CAAC;AACtE,QAAI,aAAa,eAAgB,QAAO,IAAI,kBAAkB,MAAM;AACpE,QAAI,aAAa,OAAQ,QAAO,IAAI,UAAU,aAAa,MAAM;AACjE,QAAI,aAAa,QAAS,QAAO,IAAI,WAAW,aAAa,OAAO;AACpE,QAAI,aAAa,MAAO,QAAO,IAAI,SAAS,aAAa,KAAK;AAC9D,QAAI,aAAa,SAAU,QAAO,IAAI,YAAY,aAAa,QAAQ;AACvE,QAAI,aAAa,OAAQ,QAAO,IAAI,UAAU,MAAM;AACpD,eAAW,QAAQ,aAAa,SAAS,CAAC,EAAG,QAAO,OAAO,QAAQ,IAAI;AACvE,WAAO,KAAK,QAAQ,WAAW,cAAc,OAAO,OAAO,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAC5G;AAAA,EACA,MAAM,cAAc,WAA4B,KAAgC;AAC9E,SAAK,gBAAgB,WAAW,KAAK;AACrC,YAAQ,MAAM,KAAK,QAAQ,kBAAkB,gBAAgB,EAAE,QAAQ,QAAQ,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,GAAG;AAAA,EAC/G;AAAA,EACA,MAAM,YAAY,WAAwD;AACxE,SAAK,gBAAgB,SAAS;AAC9B,UAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,YAAY;AACxD,SAAK,qBAAqB,MAAM;AAChC,WAAO;AAAA,EACT;AAAA,EACA,MAAM,cAAc,WAA4B,SAAuD;AACrG,SAAK,gBAAgB,SAAS;AAC9B,YAAQ,MAAM,KAAK,QAAQ,kBAAkB,wBAAwB,EAAE,QAAQ,QAAQ,MAAM,QAAQ,CAAC,IAAI,YAAY;AAAA,EACxH;AAAA,EACA,MAAM,eAAe,WAA4B,QAAmD,CAAC,GAAG;AACtG,SAAK,gBAAgB,SAAS;AAAG,UAAM,SAAO,IAAI,gBAAgB;AAAG,QAAG,MAAM,OAAO,QAAO,IAAI,UAAS,MAAM,MAAM;AAAE,QAAG,MAAM,MAAM,QAAO,IAAI,SAAQ,OAAO,MAAM,KAAK,CAAC;AAAE,QAAG,MAAM,KAAK,QAAO,IAAI,QAAO,MAAM,IAAI;AAAE,QAAG,MAAM,UAAU,QAAO,IAAI,aAAY,MAAM,SAAS;AAAE,QAAG,MAAM,UAAU,QAAO,IAAI,aAAY,MAAM,SAAS;AAAE,eAAU,SAAS,MAAM,UAAQ,CAAC,EAAE,QAAO,OAAO,SAAQ,KAAK;AAAE,WAAO,KAAK,QAAQ,mBAAkB,iBAAiB,OAAO,OAAK,IAAI,MAAM,KAAG,EAAE,EAAE;AAAA,EACve;AAAA,EACA,MAAM,mBAAmB,WAA2B,IAAU,QAAqC,CAAC,GAAG;AAAE,SAAK,gBAAgB,SAAS;AAAE,UAAM,SAAO,IAAI,gBAAgB;AAAE,QAAG,MAAM,OAAO,QAAO,IAAI,UAAS,MAAM,MAAM;AAAE,QAAG,MAAM,MAAM,QAAO,IAAI,SAAQ,OAAO,MAAM,KAAK,CAAC;AAAE,WAAO,KAAK,QAAQ,wBAAuB,kBAAkB,EAAE,UAAU,OAAO,OAAK,IAAI,MAAM,KAAG,EAAE,EAAE;AAAA,EAAG;AAAA,EAC9X,MAAM,eAAe,WAA0B,IAAU;AAAC,SAAK,gBAAgB,SAAS;AAAE,YAAQ,MAAM,KAAK,QAAQ,mBAAkB,kBAAkB,EAAE,WAAU,EAAC,QAAO,QAAO,MAAK,CAAC,EAAC,CAAC,GAAG;AAAA,EAAS;AAAA,EACxM,MAAM,gBAAgB,WAA0B,IAAU;AAAC,SAAK,gBAAgB,SAAS;AAAE,YAAQ,MAAM,KAAK,QAAQ,oBAAmB,kBAAkB,EAAE,YAAW,EAAC,QAAO,QAAO,MAAK,CAAC,EAAC,CAAC,GAAG;AAAA,EAAS;AAAA,EAC3M,MAAM,cAAc,WAA4B,IAAY,OAAe,SAAiD;AAC1H,SAAK,gBAAgB,SAAS;AAC9B,QAAI;AACF,cAAQ,MAAM,KAAK,QAAQ,mBAAmB,kBAAkB,EAAE,WAAW,EAAE,QAAQ,QAAQ,MAAM,EAAE,YAAY,OAAO,QAAQ,EAAE,CAAC,GAAG;AAAA,IAC1I,SAAS,OAAO;AACd,UAAI,iBAAiB,mBAAmB,MAAM,WAAW,IAAK,QAAO;AACrE,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,eAAe,WAA4B,IAAY,OAAe,OAAsC,OAAgB,cAAyF;AACzN,SAAK,gBAAgB,SAAS;AAC9B,UAAM,KAAK,eAAe;AAC1B,UAAM,SAAS,UAAU,UAAU,QAAQ;AAC3C,QAAI;AACF,YAAM,cAAc,WAAW,QAAQ,yBAAyB;AAChE,YAAM,WAAW,EAAE,YAAY,OAAO,OAAO,aAAa,UAAU,SAAS,SAAS,QAAQ;AAC9F,cAAQ,MAAM,KAAK,QAAQ,aAAa,kBAAkB,EAAE,IAAI,MAAM,IAAI,EAAE,QAAQ,QAAQ,MAAM,WAAW,QAAQ,EAAE,YAAY,MAAM,IAAI,SAAS,CAAC,GAAG;AAAA,IAC5J,SAAS,QAAQ;AACf,UAAI,kBAAkB,mBAAmB,OAAO,WAAW,IAAK,QAAO;AACvE,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,UAAU,WAA4B,SAAiB,aAAsB,eAAyB,CAAC,GAA2B;AACtI,SAAK,gBAAgB,SAAS;AAC9B,WAAO,KAAK,QAAQ,aAAa,0BAA0B,EAAE,QAAQ,QAAQ,MAAM,EAAE,SAAS,aAAa,aAAa,EAAE,CAAC;AAAA,EAC7H;AAAA,EACA,MAAM,aAAa,WAAsD;AACvE,SAAK,gBAAgB,SAAS;AAC9B,YAAQ,MAAM,KAAK,QAAQ,YAAY,cAAc,GAAG;AAAA,EAC1D;AAAA,EACA,MAAM,QAAuB;AAC3B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS;AACd,SAAK,gBAAgB,MAAM,IAAI,MAAM,cAAc,CAAC;AAAA,EACtD;AACF;","names":[]}

package/dist/chunk-7B3XRRNI.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+// src/package-metadata.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+function packageVersion() {
+  const manifest = JSON.parse(
+    readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8")
+  );
+  if (typeof manifest.version !== "string" || !manifest.version) {
+    throw new Error("package version is unavailable");
+  }
+  return manifest.version;
+}
+function buildRevision(value) {
+  if (value === void 0 || value === "") return void 0;
+  if (!/^[0-9a-f]{7,40}$/u.test(value)) {
+    throw new Error("AGENT_BRIDGE_BUILD_REVISION must be a lowercase Git commit hash");
+  }
+  return value;
+}
+
+export {
+  packageVersion,
+  buildRevision
+};
+//# sourceMappingURL=chunk-7B3XRRNI.js.map

package/dist/chunk-7B3XRRNI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/package-metadata.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\nexport function packageVersion(): string {\n  const manifest = JSON.parse(\n    readFileSync(fileURLToPath(new URL(\"../package.json\", import.meta.url)), \"utf8\"),\n  ) as { version?: unknown };\n  if (typeof manifest.version !== \"string\" || !manifest.version) {\n    throw new Error(\"package version is unavailable\");\n  }\n  return manifest.version;\n}\n\nexport function buildRevision(value: string | undefined): string | undefined {\n  if (value === undefined || value === \"\") return undefined;\n  if (!/^[0-9a-f]{7,40}$/u.test(value)) {\n    throw new Error(\"AGENT_BRIDGE_BUILD_REVISION must be a lowercase Git commit hash\");\n  }\n  return value;\n}\n"],"mappings":";;;AAAA,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAEvB,SAAS,iBAAyB;AACvC,QAAM,WAAW,KAAK;AAAA,IACpB,aAAa,cAAc,IAAI,IAAI,mBAAmB,YAAY,GAAG,CAAC,GAAG,MAAM;AAAA,EACjF;AACA,MAAI,OAAO,SAAS,YAAY,YAAY,CAAC,SAAS,SAAS;AAC7D,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AACA,SAAO,SAAS;AAClB;AAEO,SAAS,cAAc,OAA+C;AAC3E,MAAI,UAAU,UAAa,UAAU,GAAI,QAAO;AAChD,MAAI,CAAC,oBAAoB,KAAK,KAAK,GAAG;AACpC,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-7VJI2MXI.js → chunk-IF5OKPBK.js}

@@ -1301,21 +1301,24 @@ async function collectPostgresRoleInventory(client, databaseName) {
         CROSS JOIN LATERAL pg_catalog.aclexplode(type.typacl) acl WHERE namespace.nspname='agent_bridge' AND acl.grantee<>0
       UNION SELECT defaults.defaclrole, 'object-role' FROM pg_catalog.pg_default_acl defaults
         LEFT JOIN pg_catalog.pg_namespace namespace ON namespace.oid=defaults.defaclnamespace
-        WHERE namespace.nspname='agent_bridge' OR defaults.defaclrole=(
-          SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge')
+        WHERE namespace.nspname='agent_bridge' OR (
+          defaults.defaclnamespace=0 AND defaults.defaclrole=(
+            SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge'))
           OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(SELECT oid FROM pg_catalog.pg_roles
             WHERE rolname='agent_bridge_control_owner_'||substr(pg_catalog.md5(pg_catalog.current_database()),1,16)))
       UNION SELECT acl.grantor, 'object-role' FROM pg_catalog.pg_default_acl defaults
         LEFT JOIN pg_catalog.pg_namespace namespace ON namespace.oid=defaults.defaclnamespace
         CROSS JOIN LATERAL pg_catalog.aclexplode(defaults.defaclacl) acl WHERE namespace.nspname='agent_bridge'
-          OR defaults.defaclrole=(SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge')
+          OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(
+            SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge'))
           OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(SELECT oid FROM pg_catalog.pg_roles
             WHERE rolname='agent_bridge_control_owner_'||substr(pg_catalog.md5(pg_catalog.current_database()),1,16)))
       UNION SELECT acl.grantee, 'object-role' FROM pg_catalog.pg_default_acl defaults
         LEFT JOIN pg_catalog.pg_namespace namespace ON namespace.oid=defaults.defaclnamespace
         CROSS JOIN LATERAL pg_catalog.aclexplode(defaults.defaclacl) acl WHERE acl.grantee<>0 AND (
-          namespace.nspname='agent_bridge' OR defaults.defaclrole=(
-            SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge')
+          namespace.nspname='agent_bridge' OR (
+            defaults.defaclnamespace=0 AND defaults.defaclrole=(
+              SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge'))
           OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(SELECT oid FROM pg_catalog.pg_roles
             WHERE rolname='agent_bridge_control_owner_'||substr(pg_catalog.md5(pg_catalog.current_database()),1,16))))
     ), base_roles AS (
@@ -1325,12 +1328,19 @@ async function collectPostgresRoleInventory(client, databaseName) {
       UNION
       SELECT role.oid, 'derived' FROM pg_catalog.pg_roles role
       WHERE role.rolname IN (SELECT name FROM derived_names)
+    ), canonical_base_roles AS (
+      SELECT oid, CASE WHEN bool_or(kind='schema-owner') THEN 'schema-owner'
+        WHEN bool_or(kind='derived') THEN 'derived'
+        ELSE 'object-role' END AS kind
+      FROM base_roles GROUP BY oid
     ), related_roles AS (
-      SELECT oid, kind FROM base_roles
+      SELECT oid, kind FROM canonical_base_roles
       UNION SELECT membership.roleid, 'external-principal' FROM pg_catalog.pg_auth_members membership
-        WHERE membership.member IN (SELECT oid FROM base_roles)
+        WHERE membership.member IN (
+          SELECT oid FROM canonical_base_roles WHERE kind<>'schema-owner')
       UNION SELECT membership.member, 'external-principal' FROM pg_catalog.pg_auth_members membership
-        WHERE membership.roleid IN (SELECT oid FROM base_roles)
+        WHERE membership.roleid IN (
+          SELECT oid FROM canonical_base_roles WHERE kind<>'schema-owner')
     )
     SELECT role.rolname AS name,
       CASE WHEN bool_or(related.kind='schema-owner') THEN 'schema-owner'
@@ -1340,6 +1350,7 @@ async function collectPostgresRoleInventory(client, databaseName) {
     FROM related_roles related JOIN pg_catalog.pg_roles role ON role.oid=related.oid
     GROUP BY role.rolname ORDER BY role.rolname`);
   const names = roleRows.rows.map((row) => row.name);
+  const schemaOwnerNames = roleRows.rows.filter((row) => row.kind === "schema-owner").map((row) => row.name);
   const membershipRows = names.length === 0 ? { rows: [], rowCount: 0 } : await client.query(`
     SELECT granted.rolname AS role, member.rolname AS member,
       bool_or(membership.admin_option) AS "adminOption",
@@ -1353,15 +1364,21 @@ async function collectPostgresRoleInventory(client, databaseName) {
     ORDER BY granted.rolname,member.rolname`, [names]);
   if (names.length > 0) {
     const boundary = await client.query(`
-      SELECT 1 AS found FROM pg_catalog.pg_auth_members membership
+      SELECT granted.rolname AS role, member.rolname AS member
+      FROM pg_catalog.pg_auth_members membership
       JOIN pg_catalog.pg_roles granted ON granted.oid=membership.roleid
       JOIN pg_catalog.pg_roles member ON member.oid=membership.member
       WHERE (granted.rolname=ANY($1::text[])) <> (member.rolname=ANY($1::text[]))
-      LIMIT 1`, [names]);
+        AND NOT (
+          granted.rolname=ANY($1::text[]) AND granted.rolname=ANY($2::text[])
+          OR member.rolname=ANY($1::text[]) AND member.rolname=ANY($2::text[])
+        )
+      ORDER BY granted.rolname,member.rolname LIMIT 10`, [names, schemaOwnerNames]);
     if (boundary.rows.length > 0) {
       throw new PostgresNativeDrError(
         "TRANSITIVE_ROLE_MEMBERSHIP_UNSUPPORTED",
-        "PostgreSQL role inventory has a transitive external membership outside the bounded restore graph"
+        "PostgreSQL role inventory has a transitive external membership outside the bounded restore graph",
+        { roleMemberships: boundary.rows }
       );
     }
   }
@@ -1380,8 +1397,9 @@ async function collectPostgresRoleInventory(client, databaseName) {
     LEFT JOIN LATERAL pg_catalog.aclexplode(defaults.defaclacl) acl ON true
     LEFT JOIN pg_catalog.pg_roles grantor ON grantor.oid=acl.grantor
     LEFT JOIN pg_catalog.pg_roles grantee ON grantee.oid=acl.grantee
-    WHERE namespace.nspname='agent_bridge' OR defaults.defaclrole=(
-      SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge')
+    WHERE namespace.nspname='agent_bridge' OR (
+      defaults.defaclnamespace=0 AND defaults.defaclrole=(
+        SELECT nspowner FROM pg_catalog.pg_namespace WHERE nspname='agent_bridge'))
       OR (defaults.defaclnamespace=0 AND defaults.defaclrole=(SELECT oid FROM pg_catalog.pg_roles
         WHERE rolname='agent_bridge_control_owner_'||substr(pg_catalog.md5(pg_catalog.current_database()),1,16)))
     ORDER BY owner.rolname,namespace.nspname NULLS FIRST,defaults.defaclobjtype,
@@ -2668,4 +2686,4 @@ export {
   restoreLocalSqlite,
   SQLITE_EDGE_APPLICATION_ID
 };
-//# sourceMappingURL=chunk-7VJI2MXI.js.map
+//# sourceMappingURL=chunk-IF5OKPBK.js.map