@creatornader/agent-bridge 0.5.2 → 0.6.1

package/dist/client-config.d.ts

@@ -1,6 +1,6 @@
 import { c as BridgePrincipal } from './bridge-domain-CBX3IVqC.js';
 
-type ClientProvider = "local" | "gateway" | "legacy-supabase";
+type ClientProvider = "local" | "gateway";
 interface ClientEnvironment extends NodeJS.ProcessEnv {
     AGENT_BRIDGE_PROVIDER?: string;
     AGENT_BRIDGE_URL?: string;

package/dist/client-config.js

@@ -2,7 +2,7 @@
 import {
   readClientConfigFile,
   resolveClientConfig
-} from "./chunk-2EVLG3YA.js";
+} from "./chunk-UKFRCP6X.js";
 export {
   readClientConfigFile,
   resolveClientConfig

package/dist/client-runtime.d.ts

@@ -1,6 +1,6 @@
-import { B as BridgeService } from './bridge-service-CNBKdYXh.js';
-import { a as BridgeStore } from './bridge-store-ByJ6CaJk.js';
-import { a as EdgeDrainLease } from './sqlite-edge-store-CdMIOrho.js';
+import { B as BridgeService } from './bridge-service-DjSYfjKt.js';
+import { a as BridgeStore } from './bridge-store-Bi_LCX8e.js';
+import { a as EdgeDrainLease } from './sqlite-edge-store-BAFUeysk.js';
 import { ClientConfig } from './client-config.js';
 import './bridge-domain-CBX3IVqC.js';
 

package/dist/client-runtime.js

@@ -2,14 +2,14 @@
 import {
   createClientRuntime,
   createStore
-} from "./chunk-QPC6JHA3.js";
-import "./chunk-Z6JP6MYD.js";
-import "./chunk-SN7PIVDF.js";
+} from "./chunk-IXNQG4SB.js";
+import "./chunk-6ZOLE3E3.js";
+import "./chunk-ZUZ7TCIH.js";
 import "./chunk-IVG4XWWS.js";
 import "./chunk-GTK4KOED.js";
 import "./chunk-VOQIDTCJ.js";
-import "./chunk-AWE3DFZV.js";
-import "./chunk-E4OWHGUE.js";
+import "./chunk-4V2PFJEF.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 export {
   createClientRuntime,

package/dist/contracts/generate.js

@@ -11,7 +11,7 @@ import {
   SUPPORTED_PROTOCOL_VERSIONS,
   capabilityDocument,
   operations
-} from "../chunk-E4OWHGUE.js";
+} from "../chunk-63JKCBC6.js";
 
 // src/contracts/generate.ts
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -43,8 +43,7 @@ function objectWithout(schema, excluded) {
 }
 var scopeEnforcementByProvider = {
   local: false,
-  gateway: SCOPE_ENFORCEMENT,
-  "legacy-supabase": false
+  gateway: SCOPE_ENFORCEMENT
 };
 var schemas = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
@@ -176,6 +175,7 @@ var openapi = {
   openapi: "3.1.2",
   info: {
     title: "Agent Bridge Gateway",
+    description: "Let AI agents message each other and hand off work across tools, sessions, and machines.",
     version: PROTOCOL_VERSION,
     license: { name: "Apache-2.0", identifier: "Apache-2.0" }
   },

package/dist/contracts/generate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/contracts/generate.ts","../../src/contracts/artifact-format.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { formatContractArtifact, normalizeContractArtifact } from \"./artifact-format.js\";\nimport {\n  capabilityDocument,\n  ErrorEnvelopeSchema,\n  LegacyDeliverySchema,\n  LegacyMessageDraftSchema,\n  LegacyMessageSchema,\n  LEGACY_PROTOCOL_VERSION,\n  operations,\n  PROTOCOL_HEADER,\n  PROTOCOL_VERSION,\n  SCOPE_ENFORCEMENT,\n  SUPPORTED_PROTOCOL_HEADER,\n  SUPPORTED_PROTOCOL_VERSIONS,\n} from \"./registry.js\";\n\nfunction clone<T>(value: T): T {\n  return JSON.parse(JSON.stringify(value)) as T;\n}\n\nfunction objectWithout(schema: Record<string, any>, excluded: ReadonlySet<string>): Record<string, any> {\n  const result = clone(schema);\n  if (!result.properties) return result;\n  result.properties = Object.fromEntries(Object.entries(result.properties).filter(([name]) => !excluded.has(name)));\n  if (Array.isArray(result.required)) {\n    result.required = result.required.filter((name: string) => !excluded.has(name));\n    if (!result.required.length) delete result.required;\n  }\n  return result;\n}\n\nconst scopeEnforcementByProvider = {\n  local: false,\n  gateway: SCOPE_ENFORCEMENT,\n  \"legacy-supabase\": false,\n};\n\nconst schemas = {\n  $schema: \"https://json-schema.org/draft/2020-12/schema\",\n  $id: \"https://agent-bridge.dev/schemas/v2/operations.json\",\n  title: \"Agent Bridge v2 operation contracts\",\n  protocolVersion: PROTOCOL_VERSION,\n  scopeEnforcementByProvider,\n  $defs: {\n    ErrorEnvelope: ErrorEnvelopeSchema,\n    legacy20MessageDraft: LegacyMessageDraftSchema,\n    legacy20Message: LegacyMessageSchema,\n    legacy20Delivery: LegacyDeliverySchema,\n    ...Object.fromEntries(operations.flatMap((operation) => [\n      [`${operation.id}Request`, operation.request],\n      [`${operation.id}Response`, operation.response],\n      ...(operation.cli ? [[`${operation.id}CliResponse`, operation.cli.response ?? operation.response] as const] : []),\n      ...(operation.cli?.variants?.map((variant) => [\n        `${operation.id}CliVariant${variant.command.replace(/(^|[-_])(\\w)/g, (_match, _separator, character: string) => character.toUpperCase())}Response`,\n        variant.response,\n      ] as const) ?? []),\n    ])),\n  },\n};\n\nconst protocolHeaders = {\n  [PROTOCOL_HEADER]: {\n    description: \"Selected Agent Bridge protocol version.\",\n    required: true,\n    schema: { type: \"string\", enum: [...SUPPORTED_PROTOCOL_VERSIONS] },\n  },\n  [SUPPORTED_PROTOCOL_HEADER]: {\n    description: \"Comma-separated protocol versions supported by this gateway.\",\n    required: true,\n    schema: { type: \"string\" },\n  },\n};\n\nfunction errorResponse(description: string) {\n  return {\n    description,\n    headers: protocolHeaders,\n    content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorEnvelope\" } } },\n  };\n}\n\nconst canonicalErrors = {\n  \"400\": errorResponse(\"The request does not match the operation contract.\"),\n  \"401\": errorResponse(\"The bearer credential is missing or invalid.\"),\n  \"403\": errorResponse(\"The credential cannot access the requested principal or origin.\"),\n  \"404\": errorResponse(\"The route or requested resource does not exist.\"),\n  \"409\": errorResponse(\"The request conflicts with current delivery or idempotency state.\"),\n  \"413\": errorResponse(\"The request body exceeds the configured limit.\"),\n  \"415\": errorResponse(\"The request content type is not application/json.\"),\n  \"426\": errorResponse(\"The requested protocol version is unsupported.\"),\n  \"429\": errorResponse(\"The gateway has rate-limited the request.\"),\n  \"500\": errorResponse(\"The gateway could not complete the request.\"),\n  \"502\": errorResponse(\"The upstream response does not match the selected protocol contract.\"),\n  \"503\": errorResponse(\"The backing service is unavailable.\"),\n  \"504\": errorResponse(\"The request exceeded the gateway deadline.\"),\n};\n\nconst paths: Record<string, Record<string, unknown>> = {};\nfor (const operation of operations.filter((entry) => entry.http)) {\n  const http = operation.http!;\n  const pathItem = paths[http.path] ??= {};\n  const pathNames = [...http.path.matchAll(/\\{([^}]+)\\}/g)].map((match) => match[1]!);\n  const pathSet = new Set(pathNames);\n  const request = clone(operation.request as Record<string, any>);\n  const parameters: Array<Record<string, unknown>> = [{\n    name: PROTOCOL_HEADER,\n    in: \"header\",\n    required: true,\n    description: \"This OpenAPI operation describes protocol 2.1. Headerless protocol 2.0 uses the separate schemas named by x-agent-bridge-protocol-2.0.\",\n    schema: { type: \"string\", enum: [PROTOCOL_VERSION] },\n  }, ...pathNames.map((name) => ({\n    name,\n    in: \"path\",\n    required: true,\n    schema: request.properties?.[name] ?? { type: \"string\" },\n  }))];\n\n  if (http.method === \"GET\" && request.properties) {\n    for (const [propertyName, propertySchema] of Object.entries(request.properties) as Array<[string, Record<string, any>]>) {\n      if (pathSet.has(propertyName)) continue;\n      const queryName = propertyName === \"types\" ? \"type\" : propertyName === \"states\" ? \"state\" : propertyName;\n      const repeated = propertySchema.type === \"array\";\n      parameters.push({\n        name: queryName,\n        in: \"query\",\n        required: request.required?.includes(propertyName) ?? false,\n        ...(repeated ? { style: \"form\", explode: true } : {}),\n        schema: propertySchema,\n      });\n      for (const alias of http.queryAliases?.[propertyName] ?? []) {\n        parameters.push({\n          name: alias,\n          in: \"query\",\n          required: false,\n          deprecated: true,\n          description: `Compatibility alias for ${queryName}.`,\n          schema: propertySchema,\n        });\n      }\n    }\n  }\n\n  const contentType = http.responseContentType ?? \"application/json\";\n  const successStatus = String(http.successStatus ?? 200);\n  const successResponse = {\n    description: \"Successful response.\",\n    headers: protocolHeaders,\n    content: { [contentType]: { schema: clone(operation.response) } },\n  };\n  const bodySchema = objectWithout(request, pathSet);\n  const hasBodyFields = Object.keys(bodySchema.properties ?? {}).length > 0;\n  const hasRequiredBodyFields = Array.isArray(bodySchema.required) && bodySchema.required.length > 0;\n  pathItem[http.method.toLowerCase()] = {\n    operationId: operation.id,\n    summary: operation.summary,\n    security: [{ bearerAuth: [] }],\n    \"x-agent-bridge-required-scopes\": [...operation.scopes],\n    \"x-agent-bridge-scope-enforcement\": SCOPE_ENFORCEMENT,\n    ...(parameters.length ? { parameters } : {}),\n    ...(http.method === \"POST\" && hasBodyFields ? {\n      requestBody: {\n        required: hasRequiredBodyFields,\n        content: { \"application/json\": { schema: bodySchema } },\n      },\n    } : {}),\n    responses: { [successStatus]: successResponse, ...canonicalErrors },\n  };\n}\n\nconst openapi = {\n  openapi: \"3.1.2\",\n  info: {\n    title: \"Agent Bridge Gateway\",\n    version: PROTOCOL_VERSION,\n    license: { name: \"Apache-2.0\", identifier: \"Apache-2.0\" },\n  },\n  servers: [{ url: \"/\" }],\n  \"x-agent-bridge-protocol-versions\": [...SUPPORTED_PROTOCOL_VERSIONS],\n  \"x-agent-bridge-openapi-protocol-version\": PROTOCOL_VERSION,\n  \"x-agent-bridge-protocol-2.0\": {\n    description: \"Limited schema metadata for the released headerless 0.2.0 compatibility contract derived from d8184fe. This is not a complete OpenAPI route description. It does not support project, deliveryPolicy, delivery management/listing, or current delivery bookkeeping fields.\",\n    requestSchemas: { publish_message: \"#/x-agent-bridge-schemas-2.0/MessageDraft\" },\n    responseSchemas: { message: \"#/x-agent-bridge-schemas-2.0/Message\", delivery: \"#/x-agent-bridge-schemas-2.0/Delivery\" },\n  },\n  \"x-agent-bridge-schemas-2.0\": {\n    MessageDraft: LegacyMessageDraftSchema,\n    Message: LegacyMessageSchema,\n    Delivery: LegacyDeliverySchema,\n  },\n  \"x-agent-bridge-scope-enforcement\": SCOPE_ENFORCEMENT,\n  paths,\n  components: {\n    schemas: { ErrorEnvelope: ErrorEnvelopeSchema },\n    securitySchemes: { bearerAuth: { type: \"http\", scheme: \"bearer\" } },\n  },\n};\n\nconst mcp = {\n  schemaVersion: \"agent-bridge-mcp-manifest-v1\",\n  protocolVersion: PROTOCOL_VERSION,\n  scopeEnforcementByProvider,\n  tools: operations.filter((entry) => entry.mcp).map((entry) => ({\n    name: entry.mcp!.name,\n    description: entry.summary,\n    inputSchema: entry.request,\n    outputSchema: entry.response,\n    requiredScopes: entry.scopes,\n    providers: entry.providers,\n  })),\n};\n\nconst root = resolve(dirname(fileURLToPath(import.meta.url)), \"../..\");\nconst outputs = new Map([\n  [resolve(root, \"schemas/agent-bridge-v2.schema.json\"), formatContractArtifact(schemas)],\n  [resolve(root, \"openapi/agent-bridge-v2.openapi.json\"), formatContractArtifact(openapi)],\n  [resolve(root, \"schemas/agent-bridge-v2.mcp.json\"), formatContractArtifact(mcp)],\n  [resolve(root, \"schemas/agent-bridge-v2.capabilities.json\"), formatContractArtifact(capabilityDocument())],\n]);\nconst check = process.argv.includes(\"--check\");\nconst drift: string[] = [];\nfor (const [path, contents] of outputs) {\n  if (check) {\n    let current = \"\";\n    try { current = readFileSync(path, \"utf8\"); } catch {}\n    if (normalizeContractArtifact(current) !== normalizeContractArtifact(contents)) {\n      drift.push(path.slice(root.length + 1));\n    }\n  } else {\n    mkdirSync(dirname(path), { recursive: true });\n    writeFileSync(path, contents);\n  }\n}\nif (drift.length) {\n  for (const path of drift) process.stderr.write(`ERROR contract artifact drift: ${path}\\n`);\n  process.exitCode = 1;\n} else {\n  process.stdout.write(`contracts ${check ? \"match\" : \"generated\"}: ${outputs.size} artifacts, ${operations.length} operations\\n`);\n}\n","export function formatContractArtifact(value: unknown): string {\n  return `${JSON.stringify(value, null, 2)}\\n`;\n}\n\nexport function normalizeContractArtifact(contents: string): string {\n  return contents.replace(/\\r\\n?/g, \"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,cAAc,qBAAqB;AACvD,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;;;ACFvB,SAAS,uBAAuB,OAAwB;AAC7D,SAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AAC1C;AAEO,SAAS,0BAA0B,UAA0B;AAClE,SAAO,SAAS,QAAQ,UAAU,IAAI;AACxC;;;ADaA,SAAS,MAAS,OAAa;AAC7B,SAAO,KAAK,MAAM,KAAK,UAAU,KAAK,CAAC;AACzC;AAEA,SAAS,cAAc,QAA6B,UAAoD;AACtG,QAAM,SAAS,MAAM,MAAM;AAC3B,MAAI,CAAC,OAAO,WAAY,QAAO;AAC/B,SAAO,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AAChH,MAAI,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAClC,WAAO,WAAW,OAAO,SAAS,OAAO,CAAC,SAAiB,CAAC,SAAS,IAAI,IAAI,CAAC;AAC9E,QAAI,CAAC,OAAO,SAAS,OAAQ,QAAO,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,IAAM,6BAA6B;AAAA,EACjC,OAAO;AAAA,EACP,SAAS;AAAA,EACT,mBAAmB;AACrB;AAEA,IAAM,UAAU;AAAA,EACd,SAAS;AAAA,EACT,KAAK;AAAA,EACL,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB;AAAA,EACA,OAAO;AAAA,IACL,eAAe;AAAA,IACf,sBAAsB;AAAA,IACtB,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,GAAG,OAAO,YAAY,WAAW,QAAQ,CAAC,cAAc;AAAA,MACtD,CAAC,GAAG,UAAU,EAAE,WAAW,UAAU,OAAO;AAAA,MAC5C,CAAC,GAAG,UAAU,EAAE,YAAY,UAAU,QAAQ;AAAA,MAC9C,GAAI,UAAU,MAAM,CAAC,CAAC,GAAG,UAAU,EAAE,eAAe,UAAU,IAAI,YAAY,UAAU,QAAQ,CAAU,IAAI,CAAC;AAAA,MAC/G,GAAI,UAAU,KAAK,UAAU,IAAI,CAAC,YAAY;AAAA,QAC5C,GAAG,UAAU,EAAE,aAAa,QAAQ,QAAQ,QAAQ,iBAAiB,CAAC,QAAQ,YAAY,cAAsB,UAAU,YAAY,CAAC,CAAC;AAAA,QACxI,QAAQ;AAAA,MACV,CAAU,KAAK,CAAC;AAAA,IAClB,CAAC,CAAC;AAAA,EACJ;AACF;AAEA,IAAM,kBAAkB;AAAA,EACtB,CAAC,eAAe,GAAG;AAAA,IACjB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,2BAA2B,EAAE;AAAA,EACnE;AAAA,EACA,CAAC,yBAAyB,GAAG;AAAA,IAC3B,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE,MAAM,SAAS;AAAA,EAC3B;AACF;AAEA,SAAS,cAAc,aAAqB;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,IACT,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;AAAA,EAC5F;AACF;AAEA,IAAM,kBAAkB;AAAA,EACtB,OAAO,cAAc,oDAAoD;AAAA,EACzE,OAAO,cAAc,8CAA8C;AAAA,EACnE,OAAO,cAAc,iEAAiE;AAAA,EACtF,OAAO,cAAc,iDAAiD;AAAA,EACtE,OAAO,cAAc,mEAAmE;AAAA,EACxF,OAAO,cAAc,gDAAgD;AAAA,EACrE,OAAO,cAAc,mDAAmD;AAAA,EACxE,OAAO,cAAc,gDAAgD;AAAA,EACrE,OAAO,cAAc,2CAA2C;AAAA,EAChE,OAAO,cAAc,6CAA6C;AAAA,EAClE,OAAO,cAAc,sEAAsE;AAAA,EAC3F,OAAO,cAAc,qCAAqC;AAAA,EAC1D,OAAO,cAAc,4CAA4C;AACnE;AAEA,IAAM,QAAiD,CAAC;AApGxD;AAqGA,WAAW,aAAa,WAAW,OAAO,CAAC,UAAU,MAAM,IAAI,GAAG;AAChE,QAAM,OAAO,UAAU;AACvB,QAAM,WAAW,WAAM,KAAK,UAAX,YAAqB,CAAC;AACvC,QAAM,YAAY,CAAC,GAAG,KAAK,KAAK,SAAS,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,CAAC,CAAE;AAClF,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,UAAU,MAAM,UAAU,OAA8B;AAC9D,QAAM,aAA6C,CAAC;AAAA,IAClD,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,gBAAgB,EAAE;AAAA,EACrD,GAAG,GAAG,UAAU,IAAI,CAAC,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QAAQ,QAAQ,aAAa,IAAI,KAAK,EAAE,MAAM,SAAS;AAAA,EACzD,EAAE,CAAC;AAEH,MAAI,KAAK,WAAW,SAAS,QAAQ,YAAY;AAC/C,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,QAAQ,UAAU,GAA2C;AACvH,UAAI,QAAQ,IAAI,YAAY,EAAG;AAC/B,YAAM,YAAY,iBAAiB,UAAU,SAAS,iBAAiB,WAAW,UAAU;AAC5F,YAAM,WAAW,eAAe,SAAS;AACzC,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU,QAAQ,UAAU,SAAS,YAAY,KAAK;AAAA,QACtD,GAAI,WAAW,EAAE,OAAO,QAAQ,SAAS,KAAK,IAAI,CAAC;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC;AACD,iBAAW,SAAS,KAAK,eAAe,YAAY,KAAK,CAAC,GAAG;AAC3D,mBAAW,KAAK;AAAA,UACd,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,aAAa,2BAA2B,SAAS;AAAA,UACjD,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,KAAK,uBAAuB;AAChD,QAAM,gBAAgB,OAAO,KAAK,iBAAiB,GAAG;AACtD,QAAM,kBAAkB;AAAA,IACtB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,SAAS,EAAE,CAAC,WAAW,GAAG,EAAE,QAAQ,MAAM,UAAU,QAAQ,EAAE,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,cAAc,SAAS,OAAO;AACjD,QAAM,gBAAgB,OAAO,KAAK,WAAW,cAAc,CAAC,CAAC,EAAE,SAAS;AACxE,QAAM,wBAAwB,MAAM,QAAQ,WAAW,QAAQ,KAAK,WAAW,SAAS,SAAS;AACjG,WAAS,KAAK,OAAO,YAAY,CAAC,IAAI;AAAA,IACpC,aAAa,UAAU;AAAA,IACvB,SAAS,UAAU;AAAA,IACnB,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;AAAA,IAC7B,kCAAkC,CAAC,GAAG,UAAU,MAAM;AAAA,IACtD,oCAAoC;AAAA,IACpC,GAAI,WAAW,SAAS,EAAE,WAAW,IAAI,CAAC;AAAA,IAC1C,GAAI,KAAK,WAAW,UAAU,gBAAgB;AAAA,MAC5C,aAAa;AAAA,QACX,UAAU;AAAA,QACV,SAAS,EAAE,oBAAoB,EAAE,QAAQ,WAAW,EAAE;AAAA,MACxD;AAAA,IACF,IAAI,CAAC;AAAA,IACL,WAAW,EAAE,CAAC,aAAa,GAAG,iBAAiB,GAAG,gBAAgB;AAAA,EACpE;AACF;AAEA,IAAM,UAAU;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,SAAS,EAAE,MAAM,cAAc,YAAY,aAAa;AAAA,EAC1D;AAAA,EACA,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,EACtB,oCAAoC,CAAC,GAAG,2BAA2B;AAAA,EACnE,2CAA2C;AAAA,EAC3C,+BAA+B;AAAA,IAC7B,aAAa;AAAA,IACb,gBAAgB,EAAE,iBAAiB,4CAA4C;AAAA,IAC/E,iBAAiB,EAAE,SAAS,wCAAwC,UAAU,wCAAwC;AAAA,EACxH;AAAA,EACA,8BAA8B;AAAA,IAC5B,cAAc;AAAA,IACd,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA,oCAAoC;AAAA,EACpC;AAAA,EACA,YAAY;AAAA,IACV,SAAS,EAAE,eAAe,oBAAoB;AAAA,IAC9C,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,QAAQ,SAAS,EAAE;AAAA,EACpE;AACF;AAEA,IAAM,MAAM;AAAA,EACV,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB;AAAA,EACA,OAAO,WAAW,OAAO,CAAC,UAAU,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW;AAAA,IAC7D,MAAM,MAAM,IAAK;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,gBAAgB,MAAM;AAAA,IACtB,WAAW,MAAM;AAAA,EACnB,EAAE;AACJ;AAEA,IAAM,OAAO,QAAQ,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,OAAO;AACrE,IAAM,UAAU,oBAAI,IAAI;AAAA,EACtB,CAAC,QAAQ,MAAM,qCAAqC,GAAG,uBAAuB,OAAO,CAAC;AAAA,EACtF,CAAC,QAAQ,MAAM,sCAAsC,GAAG,uBAAuB,OAAO,CAAC;AAAA,EACvF,CAAC,QAAQ,MAAM,kCAAkC,GAAG,uBAAuB,GAAG,CAAC;AAAA,EAC/E,CAAC,QAAQ,MAAM,2CAA2C,GAAG,uBAAuB,mBAAmB,CAAC,CAAC;AAC3G,CAAC;AACD,IAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS;AAC7C,IAAM,QAAkB,CAAC;AACzB,WAAW,CAAC,MAAM,QAAQ,KAAK,SAAS;AACtC,MAAI,OAAO;AACT,QAAI,UAAU;AACd,QAAI;AAAE,gBAAU,aAAa,MAAM,MAAM;AAAA,IAAG,QAAQ;AAAA,IAAC;AACrD,QAAI,0BAA0B,OAAO,MAAM,0BAA0B,QAAQ,GAAG;AAC9E,YAAM,KAAK,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC;AAAA,IACxC;AAAA,EACF,OAAO;AACL,cAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,kBAAc,MAAM,QAAQ;AAAA,EAC9B;AACF;AACA,IAAI,MAAM,QAAQ;AAChB,aAAW,QAAQ,MAAO,SAAQ,OAAO,MAAM,kCAAkC,IAAI;AAAA,CAAI;AACzF,UAAQ,WAAW;AACrB,OAAO;AACL,UAAQ,OAAO,MAAM,aAAa,QAAQ,UAAU,WAAW,KAAK,QAAQ,IAAI,eAAe,WAAW,MAAM;AAAA,CAAe;AACjI;","names":[]}
+{"version":3,"sources":["../../src/contracts/generate.ts","../../src/contracts/artifact-format.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { formatContractArtifact, normalizeContractArtifact } from \"./artifact-format.js\";\nimport {\n  capabilityDocument,\n  ErrorEnvelopeSchema,\n  LegacyDeliverySchema,\n  LegacyMessageDraftSchema,\n  LegacyMessageSchema,\n  LEGACY_PROTOCOL_VERSION,\n  operations,\n  PROTOCOL_HEADER,\n  PROTOCOL_VERSION,\n  SCOPE_ENFORCEMENT,\n  SUPPORTED_PROTOCOL_HEADER,\n  SUPPORTED_PROTOCOL_VERSIONS,\n} from \"./registry.js\";\n\nfunction clone<T>(value: T): T {\n  return JSON.parse(JSON.stringify(value)) as T;\n}\n\nfunction objectWithout(schema: Record<string, any>, excluded: ReadonlySet<string>): Record<string, any> {\n  const result = clone(schema);\n  if (!result.properties) return result;\n  result.properties = Object.fromEntries(Object.entries(result.properties).filter(([name]) => !excluded.has(name)));\n  if (Array.isArray(result.required)) {\n    result.required = result.required.filter((name: string) => !excluded.has(name));\n    if (!result.required.length) delete result.required;\n  }\n  return result;\n}\n\nconst scopeEnforcementByProvider = {\n  local: false,\n  gateway: SCOPE_ENFORCEMENT,\n};\n\nconst schemas = {\n  $schema: \"https://json-schema.org/draft/2020-12/schema\",\n  $id: \"https://agent-bridge.dev/schemas/v2/operations.json\",\n  title: \"Agent Bridge v2 operation contracts\",\n  protocolVersion: PROTOCOL_VERSION,\n  scopeEnforcementByProvider,\n  $defs: {\n    ErrorEnvelope: ErrorEnvelopeSchema,\n    legacy20MessageDraft: LegacyMessageDraftSchema,\n    legacy20Message: LegacyMessageSchema,\n    legacy20Delivery: LegacyDeliverySchema,\n    ...Object.fromEntries(operations.flatMap((operation) => [\n      [`${operation.id}Request`, operation.request],\n      [`${operation.id}Response`, operation.response],\n      ...(operation.cli ? [[`${operation.id}CliResponse`, operation.cli.response ?? operation.response] as const] : []),\n      ...(operation.cli?.variants?.map((variant) => [\n        `${operation.id}CliVariant${variant.command.replace(/(^|[-_])(\\w)/g, (_match, _separator, character: string) => character.toUpperCase())}Response`,\n        variant.response,\n      ] as const) ?? []),\n    ])),\n  },\n};\n\nconst protocolHeaders = {\n  [PROTOCOL_HEADER]: {\n    description: \"Selected Agent Bridge protocol version.\",\n    required: true,\n    schema: { type: \"string\", enum: [...SUPPORTED_PROTOCOL_VERSIONS] },\n  },\n  [SUPPORTED_PROTOCOL_HEADER]: {\n    description: \"Comma-separated protocol versions supported by this gateway.\",\n    required: true,\n    schema: { type: \"string\" },\n  },\n};\n\nfunction errorResponse(description: string) {\n  return {\n    description,\n    headers: protocolHeaders,\n    content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorEnvelope\" } } },\n  };\n}\n\nconst canonicalErrors = {\n  \"400\": errorResponse(\"The request does not match the operation contract.\"),\n  \"401\": errorResponse(\"The bearer credential is missing or invalid.\"),\n  \"403\": errorResponse(\"The credential cannot access the requested principal or origin.\"),\n  \"404\": errorResponse(\"The route or requested resource does not exist.\"),\n  \"409\": errorResponse(\"The request conflicts with current delivery or idempotency state.\"),\n  \"413\": errorResponse(\"The request body exceeds the configured limit.\"),\n  \"415\": errorResponse(\"The request content type is not application/json.\"),\n  \"426\": errorResponse(\"The requested protocol version is unsupported.\"),\n  \"429\": errorResponse(\"The gateway has rate-limited the request.\"),\n  \"500\": errorResponse(\"The gateway could not complete the request.\"),\n  \"502\": errorResponse(\"The upstream response does not match the selected protocol contract.\"),\n  \"503\": errorResponse(\"The backing service is unavailable.\"),\n  \"504\": errorResponse(\"The request exceeded the gateway deadline.\"),\n};\n\nconst paths: Record<string, Record<string, unknown>> = {};\nfor (const operation of operations.filter((entry) => entry.http)) {\n  const http = operation.http!;\n  const pathItem = paths[http.path] ??= {};\n  const pathNames = [...http.path.matchAll(/\\{([^}]+)\\}/g)].map((match) => match[1]!);\n  const pathSet = new Set(pathNames);\n  const request = clone(operation.request as Record<string, any>);\n  const parameters: Array<Record<string, unknown>> = [{\n    name: PROTOCOL_HEADER,\n    in: \"header\",\n    required: true,\n    description: \"This OpenAPI operation describes protocol 2.1. Headerless protocol 2.0 uses the separate schemas named by x-agent-bridge-protocol-2.0.\",\n    schema: { type: \"string\", enum: [PROTOCOL_VERSION] },\n  }, ...pathNames.map((name) => ({\n    name,\n    in: \"path\",\n    required: true,\n    schema: request.properties?.[name] ?? { type: \"string\" },\n  }))];\n\n  if (http.method === \"GET\" && request.properties) {\n    for (const [propertyName, propertySchema] of Object.entries(request.properties) as Array<[string, Record<string, any>]>) {\n      if (pathSet.has(propertyName)) continue;\n      const queryName = propertyName === \"types\" ? \"type\" : propertyName === \"states\" ? \"state\" : propertyName;\n      const repeated = propertySchema.type === \"array\";\n      parameters.push({\n        name: queryName,\n        in: \"query\",\n        required: request.required?.includes(propertyName) ?? false,\n        ...(repeated ? { style: \"form\", explode: true } : {}),\n        schema: propertySchema,\n      });\n      for (const alias of http.queryAliases?.[propertyName] ?? []) {\n        parameters.push({\n          name: alias,\n          in: \"query\",\n          required: false,\n          deprecated: true,\n          description: `Compatibility alias for ${queryName}.`,\n          schema: propertySchema,\n        });\n      }\n    }\n  }\n\n  const contentType = http.responseContentType ?? \"application/json\";\n  const successStatus = String(http.successStatus ?? 200);\n  const successResponse = {\n    description: \"Successful response.\",\n    headers: protocolHeaders,\n    content: { [contentType]: { schema: clone(operation.response) } },\n  };\n  const bodySchema = objectWithout(request, pathSet);\n  const hasBodyFields = Object.keys(bodySchema.properties ?? {}).length > 0;\n  const hasRequiredBodyFields = Array.isArray(bodySchema.required) && bodySchema.required.length > 0;\n  pathItem[http.method.toLowerCase()] = {\n    operationId: operation.id,\n    summary: operation.summary,\n    security: [{ bearerAuth: [] }],\n    \"x-agent-bridge-required-scopes\": [...operation.scopes],\n    \"x-agent-bridge-scope-enforcement\": SCOPE_ENFORCEMENT,\n    ...(parameters.length ? { parameters } : {}),\n    ...(http.method === \"POST\" && hasBodyFields ? {\n      requestBody: {\n        required: hasRequiredBodyFields,\n        content: { \"application/json\": { schema: bodySchema } },\n      },\n    } : {}),\n    responses: { [successStatus]: successResponse, ...canonicalErrors },\n  };\n}\n\nconst openapi = {\n  openapi: \"3.1.2\",\n  info: {\n    title: \"Agent Bridge Gateway\",\n    description: \"Let AI agents message each other and hand off work across tools, sessions, and machines.\",\n    version: PROTOCOL_VERSION,\n    license: { name: \"Apache-2.0\", identifier: \"Apache-2.0\" },\n  },\n  servers: [{ url: \"/\" }],\n  \"x-agent-bridge-protocol-versions\": [...SUPPORTED_PROTOCOL_VERSIONS],\n  \"x-agent-bridge-openapi-protocol-version\": PROTOCOL_VERSION,\n  \"x-agent-bridge-protocol-2.0\": {\n    description: \"Limited schema metadata for the released headerless 0.2.0 compatibility contract derived from d8184fe. This is not a complete OpenAPI route description. It does not support project, deliveryPolicy, delivery management/listing, or current delivery bookkeeping fields.\",\n    requestSchemas: { publish_message: \"#/x-agent-bridge-schemas-2.0/MessageDraft\" },\n    responseSchemas: { message: \"#/x-agent-bridge-schemas-2.0/Message\", delivery: \"#/x-agent-bridge-schemas-2.0/Delivery\" },\n  },\n  \"x-agent-bridge-schemas-2.0\": {\n    MessageDraft: LegacyMessageDraftSchema,\n    Message: LegacyMessageSchema,\n    Delivery: LegacyDeliverySchema,\n  },\n  \"x-agent-bridge-scope-enforcement\": SCOPE_ENFORCEMENT,\n  paths,\n  components: {\n    schemas: { ErrorEnvelope: ErrorEnvelopeSchema },\n    securitySchemes: { bearerAuth: { type: \"http\", scheme: \"bearer\" } },\n  },\n};\n\nconst mcp = {\n  schemaVersion: \"agent-bridge-mcp-manifest-v1\",\n  protocolVersion: PROTOCOL_VERSION,\n  scopeEnforcementByProvider,\n  tools: operations.filter((entry) => entry.mcp).map((entry) => ({\n    name: entry.mcp!.name,\n    description: entry.summary,\n    inputSchema: entry.request,\n    outputSchema: entry.response,\n    requiredScopes: entry.scopes,\n    providers: entry.providers,\n  })),\n};\n\nconst root = resolve(dirname(fileURLToPath(import.meta.url)), \"../..\");\nconst outputs = new Map([\n  [resolve(root, \"schemas/agent-bridge-v2.schema.json\"), formatContractArtifact(schemas)],\n  [resolve(root, \"openapi/agent-bridge-v2.openapi.json\"), formatContractArtifact(openapi)],\n  [resolve(root, \"schemas/agent-bridge-v2.mcp.json\"), formatContractArtifact(mcp)],\n  [resolve(root, \"schemas/agent-bridge-v2.capabilities.json\"), formatContractArtifact(capabilityDocument())],\n]);\nconst check = process.argv.includes(\"--check\");\nconst drift: string[] = [];\nfor (const [path, contents] of outputs) {\n  if (check) {\n    let current = \"\";\n    try { current = readFileSync(path, \"utf8\"); } catch {}\n    if (normalizeContractArtifact(current) !== normalizeContractArtifact(contents)) {\n      drift.push(path.slice(root.length + 1));\n    }\n  } else {\n    mkdirSync(dirname(path), { recursive: true });\n    writeFileSync(path, contents);\n  }\n}\nif (drift.length) {\n  for (const path of drift) process.stderr.write(`ERROR contract artifact drift: ${path}\\n`);\n  process.exitCode = 1;\n} else {\n  process.stdout.write(`contracts ${check ? \"match\" : \"generated\"}: ${outputs.size} artifacts, ${operations.length} operations\\n`);\n}\n","export function formatContractArtifact(value: unknown): string {\n  return `${JSON.stringify(value, null, 2)}\\n`;\n}\n\nexport function normalizeContractArtifact(contents: string): string {\n  return contents.replace(/\\r\\n?/g, \"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,cAAc,qBAAqB;AACvD,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;;;ACFvB,SAAS,uBAAuB,OAAwB;AAC7D,SAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AAC1C;AAEO,SAAS,0BAA0B,UAA0B;AAClE,SAAO,SAAS,QAAQ,UAAU,IAAI;AACxC;;;ADaA,SAAS,MAAS,OAAa;AAC7B,SAAO,KAAK,MAAM,KAAK,UAAU,KAAK,CAAC;AACzC;AAEA,SAAS,cAAc,QAA6B,UAAoD;AACtG,QAAM,SAAS,MAAM,MAAM;AAC3B,MAAI,CAAC,OAAO,WAAY,QAAO;AAC/B,SAAO,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AAChH,MAAI,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAClC,WAAO,WAAW,OAAO,SAAS,OAAO,CAAC,SAAiB,CAAC,SAAS,IAAI,IAAI,CAAC;AAC9E,QAAI,CAAC,OAAO,SAAS,OAAQ,QAAO,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,IAAM,6BAA6B;AAAA,EACjC,OAAO;AAAA,EACP,SAAS;AACX;AAEA,IAAM,UAAU;AAAA,EACd,SAAS;AAAA,EACT,KAAK;AAAA,EACL,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB;AAAA,EACA,OAAO;AAAA,IACL,eAAe;AAAA,IACf,sBAAsB;AAAA,IACtB,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,GAAG,OAAO,YAAY,WAAW,QAAQ,CAAC,cAAc;AAAA,MACtD,CAAC,GAAG,UAAU,EAAE,WAAW,UAAU,OAAO;AAAA,MAC5C,CAAC,GAAG,UAAU,EAAE,YAAY,UAAU,QAAQ;AAAA,MAC9C,GAAI,UAAU,MAAM,CAAC,CAAC,GAAG,UAAU,EAAE,eAAe,UAAU,IAAI,YAAY,UAAU,QAAQ,CAAU,IAAI,CAAC;AAAA,MAC/G,GAAI,UAAU,KAAK,UAAU,IAAI,CAAC,YAAY;AAAA,QAC5C,GAAG,UAAU,EAAE,aAAa,QAAQ,QAAQ,QAAQ,iBAAiB,CAAC,QAAQ,YAAY,cAAsB,UAAU,YAAY,CAAC,CAAC;AAAA,QACxI,QAAQ;AAAA,MACV,CAAU,KAAK,CAAC;AAAA,IAClB,CAAC,CAAC;AAAA,EACJ;AACF;AAEA,IAAM,kBAAkB;AAAA,EACtB,CAAC,eAAe,GAAG;AAAA,IACjB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,2BAA2B,EAAE;AAAA,EACnE;AAAA,EACA,CAAC,yBAAyB,GAAG;AAAA,IAC3B,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE,MAAM,SAAS;AAAA,EAC3B;AACF;AAEA,SAAS,cAAc,aAAqB;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,IACT,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;AAAA,EAC5F;AACF;AAEA,IAAM,kBAAkB;AAAA,EACtB,OAAO,cAAc,oDAAoD;AAAA,EACzE,OAAO,cAAc,8CAA8C;AAAA,EACnE,OAAO,cAAc,iEAAiE;AAAA,EACtF,OAAO,cAAc,iDAAiD;AAAA,EACtE,OAAO,cAAc,mEAAmE;AAAA,EACxF,OAAO,cAAc,gDAAgD;AAAA,EACrE,OAAO,cAAc,mDAAmD;AAAA,EACxE,OAAO,cAAc,gDAAgD;AAAA,EACrE,OAAO,cAAc,2CAA2C;AAAA,EAChE,OAAO,cAAc,6CAA6C;AAAA,EAClE,OAAO,cAAc,sEAAsE;AAAA,EAC3F,OAAO,cAAc,qCAAqC;AAAA,EAC1D,OAAO,cAAc,4CAA4C;AACnE;AAEA,IAAM,QAAiD,CAAC;AAnGxD;AAoGA,WAAW,aAAa,WAAW,OAAO,CAAC,UAAU,MAAM,IAAI,GAAG;AAChE,QAAM,OAAO,UAAU;AACvB,QAAM,WAAW,WAAM,KAAK,UAAX,YAAqB,CAAC;AACvC,QAAM,YAAY,CAAC,GAAG,KAAK,KAAK,SAAS,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,CAAC,CAAE;AAClF,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,UAAU,MAAM,UAAU,OAA8B;AAC9D,QAAM,aAA6C,CAAC;AAAA,IAClD,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,gBAAgB,EAAE;AAAA,EACrD,GAAG,GAAG,UAAU,IAAI,CAAC,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QAAQ,QAAQ,aAAa,IAAI,KAAK,EAAE,MAAM,SAAS;AAAA,EACzD,EAAE,CAAC;AAEH,MAAI,KAAK,WAAW,SAAS,QAAQ,YAAY;AAC/C,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,QAAQ,UAAU,GAA2C;AACvH,UAAI,QAAQ,IAAI,YAAY,EAAG;AAC/B,YAAM,YAAY,iBAAiB,UAAU,SAAS,iBAAiB,WAAW,UAAU;AAC5F,YAAM,WAAW,eAAe,SAAS;AACzC,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU,QAAQ,UAAU,SAAS,YAAY,KAAK;AAAA,QACtD,GAAI,WAAW,EAAE,OAAO,QAAQ,SAAS,KAAK,IAAI,CAAC;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC;AACD,iBAAW,SAAS,KAAK,eAAe,YAAY,KAAK,CAAC,GAAG;AAC3D,mBAAW,KAAK;AAAA,UACd,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,aAAa,2BAA2B,SAAS;AAAA,UACjD,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,KAAK,uBAAuB;AAChD,QAAM,gBAAgB,OAAO,KAAK,iBAAiB,GAAG;AACtD,QAAM,kBAAkB;AAAA,IACtB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,SAAS,EAAE,CAAC,WAAW,GAAG,EAAE,QAAQ,MAAM,UAAU,QAAQ,EAAE,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,cAAc,SAAS,OAAO;AACjD,QAAM,gBAAgB,OAAO,KAAK,WAAW,cAAc,CAAC,CAAC,EAAE,SAAS;AACxE,QAAM,wBAAwB,MAAM,QAAQ,WAAW,QAAQ,KAAK,WAAW,SAAS,SAAS;AACjG,WAAS,KAAK,OAAO,YAAY,CAAC,IAAI;AAAA,IACpC,aAAa,UAAU;AAAA,IACvB,SAAS,UAAU;AAAA,IACnB,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;AAAA,IAC7B,kCAAkC,CAAC,GAAG,UAAU,MAAM;AAAA,IACtD,oCAAoC;AAAA,IACpC,GAAI,WAAW,SAAS,EAAE,WAAW,IAAI,CAAC;AAAA,IAC1C,GAAI,KAAK,WAAW,UAAU,gBAAgB;AAAA,MAC5C,aAAa;AAAA,QACX,UAAU;AAAA,QACV,SAAS,EAAE,oBAAoB,EAAE,QAAQ,WAAW,EAAE;AAAA,MACxD;AAAA,IACF,IAAI,CAAC;AAAA,IACL,WAAW,EAAE,CAAC,aAAa,GAAG,iBAAiB,GAAG,gBAAgB;AAAA,EACpE;AACF;AAEA,IAAM,UAAU;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,SAAS,EAAE,MAAM,cAAc,YAAY,aAAa;AAAA,EAC1D;AAAA,EACA,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,EACtB,oCAAoC,CAAC,GAAG,2BAA2B;AAAA,EACnE,2CAA2C;AAAA,EAC3C,+BAA+B;AAAA,IAC7B,aAAa;AAAA,IACb,gBAAgB,EAAE,iBAAiB,4CAA4C;AAAA,IAC/E,iBAAiB,EAAE,SAAS,wCAAwC,UAAU,wCAAwC;AAAA,EACxH;AAAA,EACA,8BAA8B;AAAA,IAC5B,cAAc;AAAA,IACd,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA,oCAAoC;AAAA,EACpC;AAAA,EACA,YAAY;AAAA,IACV,SAAS,EAAE,eAAe,oBAAoB;AAAA,IAC9C,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,QAAQ,SAAS,EAAE;AAAA,EACpE;AACF;AAEA,IAAM,MAAM;AAAA,EACV,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB;AAAA,EACA,OAAO,WAAW,OAAO,CAAC,UAAU,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW;AAAA,IAC7D,MAAM,MAAM,IAAK;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,gBAAgB,MAAM;AAAA,IACtB,WAAW,MAAM;AAAA,EACnB,EAAE;AACJ;AAEA,IAAM,OAAO,QAAQ,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,OAAO;AACrE,IAAM,UAAU,oBAAI,IAAI;AAAA,EACtB,CAAC,QAAQ,MAAM,qCAAqC,GAAG,uBAAuB,OAAO,CAAC;AAAA,EACtF,CAAC,QAAQ,MAAM,sCAAsC,GAAG,uBAAuB,OAAO,CAAC;AAAA,EACvF,CAAC,QAAQ,MAAM,kCAAkC,GAAG,uBAAuB,GAAG,CAAC;AAAA,EAC/E,CAAC,QAAQ,MAAM,2CAA2C,GAAG,uBAAuB,mBAAmB,CAAC,CAAC;AAC3G,CAAC;AACD,IAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS;AAC7C,IAAM,QAAkB,CAAC;AACzB,WAAW,CAAC,MAAM,QAAQ,KAAK,SAAS;AACtC,MAAI,OAAO;AACT,QAAI,UAAU;AACd,QAAI;AAAE,gBAAU,aAAa,MAAM,MAAM;AAAA,IAAG,QAAQ;AAAA,IAAC;AACrD,QAAI,0BAA0B,OAAO,MAAM,0BAA0B,QAAQ,GAAG;AAC9E,YAAM,KAAK,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC;AAAA,IACxC;AAAA,EACF,OAAO;AACL,cAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,kBAAc,MAAM,QAAQ;AAAA,EAC9B;AACF;AACA,IAAI,MAAM,QAAQ;AAChB,aAAW,QAAQ,MAAO,SAAQ,OAAO,MAAM,kCAAkC,IAAI;AAAA,CAAI;AACzF,UAAQ,WAAW;AACrB,OAAO;AACL,UAAQ,OAAO,MAAM,aAAa,QAAQ,UAAU,WAAW,KAAK,QAAQ,IAAI,eAAe,WAAW,MAAM;AAAA,CAAe;AACjI;","names":[]}

package/dist/dr.d.ts

@@ -299,6 +299,10 @@ declare class PostgresNativeDrError extends Error {
         restoreCompleted?: boolean;
         recoveryPaths?: string[];
         causeCode?: string;
+        roleMemberships?: Array<{
+            role: string;
+            member: string;
+        }>;
     };
     constructor(code: string, message: string, details?: {
         residualRoleShells?: string[];
@@ -307,6 +311,10 @@ declare class PostgresNativeDrError extends Error {
         restoreCompleted?: boolean;
         recoveryPaths?: string[];
         causeCode?: string;
+        roleMemberships?: Array<{
+            role: string;
+            member: string;
+        }>;
     });
 }
 declare function createPostgresDrLibpqFiles(connectionUrl: string, directory: string): PostgresDrLibpqFiles;

package/dist/dr.js

@@ -39,7 +39,7 @@ import {
   verifyNativeDrBundle,
   verifyPostgresNativeDrArtifacts,
   writeNativeDrBundle
-} from "./chunk-7VJI2MXI.js";
+} from "./chunk-IF5OKPBK.js";
 import {
   EDGE_SQLITE_APPLICATION_ID,
   EDGE_SQLITE_SCHEMA_CONTRACTS,

package/dist/{gateway-CW-61lvs.d.ts → gateway-DWZ3pX48.d.ts}

@@ -1,8 +1,8 @@
 import * as node_http from 'node:http';
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { a as BridgeStore } from './bridge-store-ByJ6CaJk.js';
+import { a as BridgeStore } from './bridge-store-Bi_LCX8e.js';
 import { c as BridgePrincipal } from './bridge-domain-CBX3IVqC.js';
-import { P as PgQueryable, b as PostgresBridgeStore } from './postgres-bridge-store-C9KG9Z69.js';
+import { P as PgQueryable, b as PostgresBridgeStore } from './postgres-bridge-store-ChoOuFEY.js';
 
 declare const AUTHORIZATION_SCOPES: readonly ["deliveries:claim", "deliveries:manage", "deliveries:read", "deliveries:settle", "gateway:metrics", "messages:read", "messages:write", "presence:read", "presence:write", "receipts:write", "status:read"];
 type AuthorizationScope = typeof AUTHORIZATION_SCOPES[number];
@@ -96,6 +96,11 @@ interface GatewayOptions {
     rowIsolationReady?: () => Promise<boolean>;
     /** Production PostgreSQL request authority. Other providers omit this. */
     requestAuthority?: RequestAuthority;
+    /** Package and source revision for deployment drift checks. */
+    implementation?: {
+        version: string;
+        revision?: string;
+    };
 }
 declare function createGateway(options: GatewayOptions): node_http.Server<typeof IncomingMessage, typeof ServerResponse>;
 

package/dist/gateway-main.js

@@ -2,6 +2,10 @@
 import {
   PostgresBridgeStore
 } from "./chunk-CVZAJ7TP.js";
+import {
+  buildRevision,
+  packageVersion
+} from "./chunk-7B3XRRNI.js";
 import {
   loadMigrationPlan,
   migrationsReady,
@@ -12,9 +16,9 @@ import "./chunk-VOQIDTCJ.js";
 import {
   PostgresCredentialResolver,
   createGateway
-} from "./chunk-JUTJRAMA.js";
-import "./chunk-AWE3DFZV.js";
-import "./chunk-E4OWHGUE.js";
+} from "./chunk-LF37B6KL.js";
+import "./chunk-4V2PFJEF.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 
 // src/gateway-main.ts
@@ -315,6 +319,10 @@ async function main() {
   if (!databaseUrl) {
     throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway");
   }
+  const implementation = {
+    version: packageVersion(),
+    revision: buildRevision(process.env.AGENT_BRIDGE_BUILD_REVISION)
+  };
   const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 1e4, "request deadline");
   const databaseTimeout = integer(
     process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,
@@ -388,6 +396,7 @@ async function main() {
     allowedOrigins,
     bodyLimitBytes,
     requestDeadlineMs: deadline,
+    implementation,
     ready: schemaReady,
     rowIsolationReady: schemaReady
   });

package/dist/gateway-main.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/gateway-main.ts","../src/gateway-security.ts","../src/postgres-request-authority.ts","../src/postgres-runtime-connection.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport pg from \"pg\";\nimport { PostgresCredentialResolver } from \"./gateway-auth.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\nimport { createGateway } from \"./gateway.js\";\nimport {\n  loadMigrationPlan,\n  migrationsReady,\n  runMigrations,\n  runtimeSchemaReady,\n} from \"./migrations.js\";\nimport { PostgresBridgeStore } from \"./postgres-bridge-store.js\";\nimport { PostgresRequestAuthority } from \"./postgres-request-authority.js\";\nimport { runtimePostgresConnectionConfig } from \"./postgres-runtime-connection.js\";\n\nfunction integer(value: string | undefined, fallback: number, name: string): number {\n  if (value === undefined) return fallback;\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${name} must be a positive integer`);\n  return parsed;\n}\n\nasync function main(): Promise<void> {\n  const migrationsDirectory = fileURLToPath(new URL(\"../sql/migrations\", import.meta.url));\n  if (process.argv.includes(\"--migrate-only\")) {\n    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;\n    if (!databaseUrl) throw new Error(\"AGENT_BRIDGE_DATABASE_URL is required for migrations\");\n    const migrationPool = new pg.Pool({\n      connectionString: databaseUrl,\n      max: 1,\n      application_name: \"agent-bridge-migrator\",\n    });\n    try {\n      await runMigrations(migrationPool, migrationsDirectory);\n    } finally {\n      await migrationPool.end();\n    }\n    return;\n  }\n  if (process.env.AGENT_BRIDGE_MIGRATE === \"1\") {\n    throw new Error(\"AGENT_BRIDGE_MIGRATE is not supported; run agent-bridge migrate separately\");\n  }\n  const databaseUrl = process.env.AGENT_BRIDGE_RUNTIME_DATABASE_URL;\n  if (!databaseUrl) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway\");\n  }\n\n  const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 10_000, \"request deadline\");\n  const databaseTimeout = integer(\n    process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,\n    Math.max(1, Math.floor(deadline / 3)),\n    \"database timeout\",\n  );\n  const poolSize = integer(process.env.AGENT_BRIDGE_DATABASE_POOL_SIZE, 10, \"database pool size\");\n  const bodyLimitBytes = integer(\n    process.env.AGENT_BRIDGE_BODY_LIMIT_BYTES,\n    128 * 1024,\n    \"body limit\",\n  );\n  const host = process.env.AGENT_BRIDGE_HOST ?? \"127.0.0.1\";\n  const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, \"gateway port\");\n  const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  const migrationPlan = await loadMigrationPlan(migrationsDirectory);\n  const runtimeConnection = runtimePostgresConnectionConfig(\n    databaseUrl,\n    process.env.AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64,\n  );\n  const pool = new pg.Pool({\n    ...runtimeConnection,\n    max: poolSize,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway\",\n  });\n  const readinessPool = new pg.Pool({\n    ...runtimeConnection,\n    max: 1,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway-readiness\",\n  });\n\n  const store = new PostgresBridgeStore(pool);\n  let readinessCheckedAt = 0;\n  let readinessValue = false;\n  let readinessInFlight: Promise<boolean> | undefined;\n  const probeSchema = async () =>\n    await migrationsReady(readinessPool, migrationPlan) && await runtimeSchemaReady(readinessPool);\n  const schemaReady = (force = false): Promise<boolean> => {\n    if (!force && Date.now() - readinessCheckedAt < 1_000) {\n      return Promise.resolve(readinessValue);\n    }\n    if (readinessInFlight) return readinessInFlight;\n    let current: Promise<boolean>;\n    current = probeSchema()\n      .then((ready) => {\n        readinessValue = ready;\n        readinessCheckedAt = Date.now();\n        return ready;\n      })\n      .finally(() => {\n        if (readinessInFlight === current) readinessInFlight = undefined;\n      });\n    readinessInFlight = current;\n    return current;\n  };\n  try {\n    if (!await schemaReady(true)) {\n      throw new Error(\"runtime database is not ready for enforced row isolation\");\n    }\n  } catch (error) {\n    await Promise.allSettled([pool.end(), readinessPool.end()]);\n    throw error;\n  }\n  const gateway = createGateway({\n    store,\n    credentials: new PostgresCredentialResolver(pool),\n    security: new PostgresGatewaySecurity(pool),\n    requestAuthority: new PostgresRequestAuthority(pool),\n    allowedOrigins,\n    bodyLimitBytes,\n    requestDeadlineMs: deadline,\n    ready: schemaReady,\n    rowIsolationReady: schemaReady,\n  });\n\n  gateway.listen(port, host, () => {\n    process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}\\n`);\n  });\n\n  let stopping = false;\n  async function shutdown(): Promise<void> {\n    if (stopping) return;\n    stopping = true;\n    await new Promise<void>((resolve, reject) => {\n      gateway.close((error) => error ? reject(error) : resolve());\n    });\n    await Promise.all([pool.end(), readinessPool.end()]);\n  }\n\n  process.once(\"SIGINT\", () => void shutdown());\n  process.once(\"SIGTERM\", () => void shutdown());\n}\n\nvoid main().catch((error) => {\n  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n  process.exitCode = 1;\n});\n","import type { PgQueryable } from \"./postgres-bridge-store.js\";\nimport type { OperationId } from \"./contracts/registry.js\";\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  policyId: string | null;\n  limit: number;\n  remaining: number;\n  retryAfterSeconds: number;\n}\n\nexport interface GatewaySecurity {\n  recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void>;\n  consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision>;\n}\n\nexport class PostgresGatewaySecurity implements GatewaySecurity {\n  constructor(private readonly db: PgQueryable) {}\n\n  private functionName(bound: string, unbound: string): string {\n    return this.db.inTransaction ? bound : unbound;\n  }\n\n  async recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    if (signal?.aborted) throw signal.reason;\n    await this.db.query(\n      `SELECT agent_bridge.${this.functionName(\"record_scope_denial\", \"record_scope_denial_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n  }\n\n  async consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      allowed: boolean;\n      limit_value: string | number;\n      remaining_value: string | number;\n      retry_after_seconds: string | number;\n      denied_policy_id: string | null;\n    }>(\n      `SELECT allowed, limit_value, remaining_value, retry_after_seconds, denied_policy_id\n       FROM agent_bridge.${this.functionName(\"consume_rate_limit\", \"consume_rate_limit_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n    const row = result.rows[0];\n    if (!row) throw new Error(\"rate limit policy is missing\");\n    return {\n      allowed: row.allowed,\n      policyId: row.denied_policy_id,\n      limit: Math.max(0, Number(row.limit_value)),\n      remaining: Math.max(0, Number(row.remaining_value)),\n      retryAfterSeconds: Math.max(0, Number(row.retry_after_seconds)),\n    };\n  }\n}\n","import type pg from \"pg\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport { PostgresBridgeStore, type PgQueryable } from \"./postgres-bridge-store.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\n\nexport interface RequestAuthorityContext {\n  gatewayAuthorityId: string;\n  credential: { id: string; principal: BridgePrincipal; scopes: readonly AuthorizationScope[] };\n  store: PostgresBridgeStore;\n  security: PostgresGatewaySecurity;\n  /** Establishes the savepoint separating durable security accounting from domain work. */\n  beginDomainWork(): Promise<void>;\n  endpointMigrationChallenges?: {\n    issue(input: { challenge: string; expectedGatewayAuthorityId: string; verifierCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string }>;\n    consume(input: { challenge: string; expectedGatewayAuthorityId: string; issuerCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string | null; consumed: boolean }>;\n  };\n}\n\nexport interface RequestAuthority {\n  run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T>;\n}\n\ntype AuthorityRow = {\n  gateway_authority_id: string;\n  credential_id: string;\n  workspace_id: string;\n  principal: string;\n  scopes: AuthorizationScope[];\n};\n\nfunction timestamp(value: unknown): string {\n  if (value instanceof Date) return value.toISOString();\n  return String(value);\n}\n\nfunction endpointMigrationFailure(error: unknown): never {\n  const sqlstate = typeof error === \"object\" && error !== null && \"code\" in error\n    ? String((error as { code?: unknown }).code ?? \"\")\n    : \"\";\n  if (sqlstate === \"28000\") {\n    throw Object.assign(new Error(\"endpoint migration binding was rejected\"), {\n      status: 409,\n      code: \"endpoint_migration_binding_rejected\",\n    });\n  }\n  if (sqlstate === \"23505\") {\n    throw Object.assign(new Error(\"endpoint migration challenge conflicts with existing state\"), {\n      status: 409,\n      code: \"endpoint_migration_challenge_conflict\",\n    });\n  }\n  throw error;\n}\n\nexport class MutationOutcomeUnknownError extends Error {\n  readonly status = 503;\n  readonly code = \"mutation_outcome_unknown\";\n  constructor() { super(\"The database commit outcome is unknown\"); }\n}\n\nexport class PostgresRequestAuthority implements RequestAuthority {\n  constructor(private readonly pool: Pick<pg.Pool, \"connect\">) {}\n\n  async run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T> {\n    if (signal.aborted) throw signal.reason;\n    const client = await this.pool.connect();\n    const db: PgQueryable = { inTransaction: true, query: (sql, values) => client.query(sql, values) };\n    let transactionOpen = false;\n    let domainSavepoint = false;\n    let commitDispatched = false;\n    let commitCompleted = false;\n    let discard: Error | undefined;\n    try {\n      if (signal.aborted) throw signal.reason;\n      await client.query(\"BEGIN\");\n      transactionOpen = true;\n      const opened = await client.query<AuthorityRow>(\n        `SELECT gateway_authority_id,credential_id,workspace_id,principal,scopes\n         FROM agent_bridge.open_request_authority_bound($1::uuid,$2::text,$3::uuid)`,\n        [credentialId, credentialHash, requestId],\n      );\n      const row = opened.rows[0];\n      if (!row) {\n        await client.query(\"ROLLBACK\");\n        transactionOpen = false;\n        throw Object.assign(new Error(\"Credential is not active\"), { status: 401, code: \"unauthorized\" });\n      }\n      if (signal.aborted) throw signal.reason;\n      const context: RequestAuthorityContext = {\n        gatewayAuthorityId: row.gateway_authority_id,\n        credential: { id: row.credential_id, principal: { workspace: row.workspace_id, agent: row.principal }, scopes: row.scopes },\n        store: new PostgresBridgeStore(db),\n        security: new PostgresGatewaySecurity(db),\n        beginDomainWork: async () => {\n          if (domainSavepoint) return;\n          if (signal.aborted) throw signal.reason;\n          await client.query(\"SAVEPOINT agent_bridge_domain_work\");\n          if (signal.aborted) throw signal.reason;\n          domainSavepoint = true;\n        },\n        endpointMigrationChallenges: {\n          issue: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at\n                 FROM agent_bridge.issue_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.verifierCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be issued\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: timestamp(row.expires_at),\n            };\n          },\n          consume: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date | null;\n                consumed: boolean;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at,consumed\n                 FROM agent_bridge.consume_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.issuerCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be consumed\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: row.expires_at === null ? null : timestamp(row.expires_at),\n              consumed: row.consumed,\n            };\n          },\n        },\n      };\n      try {\n        const result = await work(context);\n        if (signal.aborted) throw signal.reason;\n        await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        return result;\n      } catch (error) {\n        if (commitDispatched) throw new MutationOutcomeUnknownError();\n        if (signal.aborted) throw error;\n        try {\n          if (domainSavepoint) {\n            await client.query(\"ROLLBACK TO SAVEPOINT agent_bridge_domain_work\");\n          }\n          await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        } catch {\n          try {\n            await client.query(\"ROLLBACK\");\n          } catch (rollbackError) {\n            discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));\n          }\n          transactionOpen = false;\n          throw error;\n        }\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        throw error;\n      }\n    } catch (error) {\n      if (commitDispatched && !commitCompleted) {\n        discard = error instanceof Error ? error : new Error(String(error));\n        throw error instanceof MutationOutcomeUnknownError ? error : new MutationOutcomeUnknownError();\n      }\n      if (transactionOpen) {\n        try { await client.query(\"ROLLBACK\"); transactionOpen = false; }\n        catch (rollbackError) { discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError)); }\n      }\n      throw error;\n    } finally {\n      client.release(discard);\n    }\n  }\n\n}\n","import type { PoolConfig } from \"pg\";\n\nconst MAX_CA_PEM_BYTES = 256 * 1024;\nconst BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;\nconst CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]+-----END CERTIFICATE-----/u;\nconst CLIENT_CERTIFICATE_PARAMETERS = [\n  \"sslcert\",\n  \"sslkey\",\n  \"sslpassword\",\n] as const;\n\nfunction decodeCaPem(encoded: string): string {\n  const value = encoded.trim();\n  if (!value) throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be empty\");\n  if (!BASE64_PATTERN.test(value)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  const bytes = Buffer.from(value, \"base64\");\n  if (bytes.toString(\"base64\") !== value) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  if (bytes.byteLength > MAX_CA_PEM_BYTES) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 exceeds 256 KiB after decoding\");\n  }\n  const pem = bytes.toString(\"utf8\").trim();\n  if (pem.includes(\"\\0\") || !CERTIFICATE_PATTERN.test(pem)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must decode to a PEM certificate bundle\");\n  }\n  return pem;\n}\n\nexport function runtimePostgresConnectionConfig(\n  connectionString: string,\n  caBase64: string | undefined,\n): Pick<PoolConfig, \"connectionString\" | \"ssl\"> {\n  if (caBase64 === undefined) return { connectionString };\n\n  let parsed: URL;\n  try {\n    parsed = new URL(connectionString);\n  } catch {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must be a valid PostgreSQL URL\");\n  }\n  if (parsed.protocol !== \"postgresql:\" && parsed.protocol !== \"postgres:\") {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must use postgresql:// or postgres://\");\n  }\n\n  if (CLIENT_CERTIFICATE_PARAMETERS.some((parameter) => parsed.searchParams.has(parameter))) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with client certificate URL parameters\",\n    );\n  }\n  if (parsed.searchParams.has(\"ssl\")) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with the ssl URL parameter\",\n    );\n  }\n  parsed.searchParams.delete(\"sslmode\");\n  parsed.searchParams.delete(\"sslrootcert\");\n  return {\n    connectionString: parsed.toString(),\n    ssl: {\n      ca: decodeCaPem(caBase64),\n      rejectUnauthorized: true,\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,QAAQ;;;ACyBR,IAAM,0BAAN,MAAyD;AAAA,EAC9D,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAEvC,aAAa,OAAe,SAAyB;AAC3D,WAAO,KAAK,GAAG,gBAAgB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAM,kBACJ,cACA,aACA,WACA,QACe;AACf,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,KAAK,GAAG;AAAA,MACZ,uBAAuB,KAAK,aAAa,uBAAuB,iCAAiC,CAAC;AAAA,MAClG,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAAA,EACpC;AAAA,EAEA,MAAM,QACJ,cACA,aACA,WACA,QAC4B;AAC5B,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAO3B;AAAA,2BACqB,KAAK,aAAa,sBAAsB,gCAAgC,CAAC;AAAA,MAC9F,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8BAA8B;AACxD,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,MAC1C,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,eAAe,CAAC;AAAA,MAClD,mBAAmB,KAAK,IAAI,GAAG,OAAO,IAAI,mBAAmB,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;AC7CA,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,yBAAyB,OAAuB;AACvD,QAAM,WAAW,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACtE,OAAQ,MAA6B,QAAQ,EAAE,IAC/C;AACJ,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,yCAAyC,GAAG;AAAA,MACxE,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,4DAA4D,GAAG;AAAA,MAC3F,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM;AACR;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,cAAc;AAAE,UAAM,wCAAwC;AAF9D,SAAS,SAAS;AAClB,SAAS,OAAO;AAAA,EACiD;AACnE;AAEO,IAAM,2BAAN,MAA2D;AAAA,EAChE,YAA6B,MAAgC;AAAhC;AAAA,EAAiC;AAAA,EAE9D,MAAM,IAAO,cAAsB,gBAAwB,WAAmB,QAAqB,MAAoE;AACrK,QAAI,OAAO,QAAS,OAAM,OAAO;AACjC,UAAM,SAAS,MAAM,KAAK,KAAK,QAAQ;AACvC,UAAM,KAAkB,EAAE,eAAe,MAAM,OAAO,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,MAAM,EAAE;AACjG,QAAI,kBAAkB;AACtB,QAAI,kBAAkB;AACtB,QAAI,mBAAmB;AACvB,QAAI,kBAAkB;AACtB,QAAI;AACJ,QAAI;AACF,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,OAAO,MAAM,OAAO;AAC1B,wBAAkB;AAClB,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B;AAAA;AAAA,QAEA,CAAC,cAAc,gBAAgB,SAAS;AAAA,MAC1C;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,KAAK;AACR,cAAM,OAAO,MAAM,UAAU;AAC7B,0BAAkB;AAClB,cAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG,EAAE,QAAQ,KAAK,MAAM,eAAe,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,UAAmC;AAAA,QACvC,oBAAoB,IAAI;AAAA,QACxB,YAAY,EAAE,IAAI,IAAI,eAAe,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU,GAAG,QAAQ,IAAI,OAAO;AAAA,QAC1H,OAAO,IAAI,oBAAoB,EAAE;AAAA,QACjC,UAAU,IAAI,wBAAwB,EAAE;AAAA,QACxC,iBAAiB,YAAY;AAC3B,cAAI,gBAAiB;AACrB,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,gBAAM,OAAO,MAAM,oCAAoC;AACvD,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,4BAAkB;AAAA,QACpB;AAAA,QACA,6BAA6B;AAAA,UAC3B,OAAO,OAAO,UAAU;AACtB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAMpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,sBAAsB,MAAM,SAAS;AAAA,cAChF;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,kDAAkD;AAC5E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAW,UAAUA,KAAI,UAAU;AAAA,YACrC;AAAA,UACF;AAAA,UACA,SAAS,OAAO,UAAU;AACxB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAOpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,oBAAoB,MAAM,SAAS;AAAA,cAC9E;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,oDAAoD;AAC9E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAWA,KAAI,eAAe,OAAO,OAAO,UAAUA,KAAI,UAAU;AAAA,cACpE,UAAUA,KAAI;AAAA,YAChB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,cAAM,OAAO,MAAM,+CAA+C;AAClE,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAkB,OAAM,IAAI,4BAA4B;AAC5D,YAAI,OAAO,QAAS,OAAM;AAC1B,YAAI;AACF,cAAI,iBAAiB;AACnB,kBAAM,OAAO,MAAM,gDAAgD;AAAA,UACrE;AACA,gBAAM,OAAO,MAAM,+CAA+C;AAAA,QACpE,QAAQ;AACN,cAAI;AACF,kBAAM,OAAO,MAAM,UAAU;AAAA,UAC/B,SAAS,eAAe;AACtB,sBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,UAC5F;AACA,4BAAkB;AAClB,gBAAM;AAAA,QACR;AACA,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,cAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAO;AACd,UAAI,oBAAoB,CAAC,iBAAiB;AACxC,kBAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAClE,cAAM,iBAAiB,8BAA8B,QAAQ,IAAI,4BAA4B;AAAA,MAC/F;AACA,UAAI,iBAAiB;AACnB,YAAI;AAAE,gBAAM,OAAO,MAAM,UAAU;AAAG,4BAAkB;AAAA,QAAO,SACxD,eAAe;AAAE,oBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,QAAG;AAAA,MACvH;AACA,YAAM;AAAA,IACR,UAAE;AACA,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AAEF;;;AC3MA,IAAM,mBAAmB,MAAM;AAC/B,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,YAAY,SAAyB;AAC5C,QAAM,QAAQ,QAAQ,KAAK;AAC3B,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yDAAyD;AACrF,MAAI,CAAC,eAAe,KAAK,KAAK,GAAG;AAC/B,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ;AACzC,MAAI,MAAM,SAAS,QAAQ,MAAM,OAAO;AACtC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,MAAM,aAAa,kBAAkB;AACvC,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,MAAM,MAAM,SAAS,MAAM,EAAE,KAAK;AACxC,MAAI,IAAI,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,GAAG,GAAG;AACxD,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AACA,SAAO;AACT;AAEO,SAAS,gCACd,kBACA,UAC8C;AAC9C,MAAI,aAAa,OAAW,QAAO,EAAE,iBAAiB;AAEtD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,gBAAgB;AAAA,EACnC,QAAQ;AACN,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,OAAO,aAAa,iBAAiB,OAAO,aAAa,aAAa;AACxE,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AAEA,MAAI,8BAA8B,KAAK,CAAC,cAAc,OAAO,aAAa,IAAI,SAAS,CAAC,GAAG;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,aAAa,IAAI,KAAK,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,OAAO,SAAS;AACpC,SAAO,aAAa,OAAO,aAAa;AACxC,SAAO;AAAA,IACL,kBAAkB,OAAO,SAAS;AAAA,IAClC,KAAK;AAAA,MACH,IAAI,YAAY,QAAQ;AAAA,MACxB,oBAAoB;AAAA,IACtB;AAAA,EACF;AACF;;;AHnDA,SAAS,QAAQ,OAA2B,UAAkB,MAAsB;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACrG,SAAO;AACT;AAEA,eAAe,OAAsB;AACnC,QAAM,sBAAsB,cAAc,IAAI,IAAI,qBAAqB,YAAY,GAAG,CAAC;AACvF,MAAI,QAAQ,KAAK,SAAS,gBAAgB,GAAG;AAC3C,UAAMC,eAAc,QAAQ,IAAI;AAChC,QAAI,CAACA,aAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,MAChC,kBAAkBA;AAAA,MAClB,KAAK;AAAA,MACL,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI;AACF,YAAM,cAAc,eAAe,mBAAmB;AAAA,IACxD,UAAE;AACA,YAAM,cAAc,IAAI;AAAA,IAC1B;AACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,yBAAyB,KAAK;AAC5C,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,kCAAkC,KAAQ,kBAAkB;AACjG,QAAM,kBAAkB;AAAA,IACtB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,QAAQ,IAAI,iCAAiC,IAAI,oBAAoB;AAC9F,QAAM,iBAAiB;AAAA,IACrB,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,IAAI,qBAAqB;AAC9C,QAAM,OAAO,QAAQ,QAAQ,IAAI,mBAAmB,MAAM,cAAc;AACxE,QAAM,iBAAiB,QAAQ,IAAI,8BAC/B,MAAM,GAAG,EACV,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AACjB,QAAM,gBAAgB,MAAM,kBAAkB,mBAAmB;AACjE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ,IAAI;AAAA,EACd;AACA,QAAM,OAAO,IAAI,GAAG,KAAK;AAAA,IACvB,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IAChC,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,QAAQ,IAAI,oBAAoB,IAAI;AAC1C,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AACrB,MAAI;AACJ,QAAM,cAAc,YAClB,MAAM,gBAAgB,eAAe,aAAa,KAAK,MAAM,mBAAmB,aAAa;AAC/F,QAAM,cAAc,CAAC,QAAQ,UAA4B;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,qBAAqB,KAAO;AACrD,aAAO,QAAQ,QAAQ,cAAc;AAAA,IACvC;AACA,QAAI,kBAAmB,QAAO;AAC9B,QAAI;AACJ,cAAU,YAAY,EACnB,KAAK,CAAC,UAAU;AACf,uBAAiB;AACjB,2BAAqB,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,sBAAsB,QAAS,qBAAoB;AAAA,IACzD,CAAC;AACH,wBAAoB;AACpB,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,CAAC,MAAM,YAAY,IAAI,GAAG;AAC5B,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAC1D,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA,aAAa,IAAI,2BAA2B,IAAI;AAAA,IAChD,UAAU,IAAI,wBAAwB,IAAI;AAAA,IAC1C,kBAAkB,IAAI,yBAAyB,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,OAAO;AAAA,IACP,mBAAmB;AAAA,EACrB,CAAC;AAED,UAAQ,OAAO,MAAM,MAAM,MAAM;AAC/B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AAED,MAAI,WAAW;AACf,iBAAe,WAA0B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAQ,MAAM,CAAC,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,IAC5D,CAAC;AACD,UAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAAA,EACrD;AAEA,UAAQ,KAAK,UAAU,MAAM,KAAK,SAAS,CAAC;AAC5C,UAAQ,KAAK,WAAW,MAAM,KAAK,SAAS,CAAC;AAC/C;AAEA,KAAK,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3B,UAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AAClF,UAAQ,WAAW;AACrB,CAAC;","names":["row","databaseUrl"]}
+{"version":3,"sources":["../src/gateway-main.ts","../src/gateway-security.ts","../src/postgres-request-authority.ts","../src/postgres-runtime-connection.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport pg from \"pg\";\nimport { PostgresCredentialResolver } from \"./gateway-auth.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\nimport { createGateway } from \"./gateway.js\";\nimport {\n  loadMigrationPlan,\n  migrationsReady,\n  runMigrations,\n  runtimeSchemaReady,\n} from \"./migrations.js\";\nimport { PostgresBridgeStore } from \"./postgres-bridge-store.js\";\nimport { PostgresRequestAuthority } from \"./postgres-request-authority.js\";\nimport { runtimePostgresConnectionConfig } from \"./postgres-runtime-connection.js\";\nimport { buildRevision, packageVersion } from \"./package-metadata.js\";\n\nfunction integer(value: string | undefined, fallback: number, name: string): number {\n  if (value === undefined) return fallback;\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${name} must be a positive integer`);\n  return parsed;\n}\n\nasync function main(): Promise<void> {\n  const migrationsDirectory = fileURLToPath(new URL(\"../sql/migrations\", import.meta.url));\n  if (process.argv.includes(\"--migrate-only\")) {\n    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;\n    if (!databaseUrl) throw new Error(\"AGENT_BRIDGE_DATABASE_URL is required for migrations\");\n    const migrationPool = new pg.Pool({\n      connectionString: databaseUrl,\n      max: 1,\n      application_name: \"agent-bridge-migrator\",\n    });\n    try {\n      await runMigrations(migrationPool, migrationsDirectory);\n    } finally {\n      await migrationPool.end();\n    }\n    return;\n  }\n  if (process.env.AGENT_BRIDGE_MIGRATE === \"1\") {\n    throw new Error(\"AGENT_BRIDGE_MIGRATE is not supported; run agent-bridge migrate separately\");\n  }\n  const databaseUrl = process.env.AGENT_BRIDGE_RUNTIME_DATABASE_URL;\n  if (!databaseUrl) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway\");\n  }\n  const implementation = {\n    version: packageVersion(),\n    revision: buildRevision(process.env.AGENT_BRIDGE_BUILD_REVISION),\n  };\n\n  const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 10_000, \"request deadline\");\n  const databaseTimeout = integer(\n    process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,\n    Math.max(1, Math.floor(deadline / 3)),\n    \"database timeout\",\n  );\n  const poolSize = integer(process.env.AGENT_BRIDGE_DATABASE_POOL_SIZE, 10, \"database pool size\");\n  const bodyLimitBytes = integer(\n    process.env.AGENT_BRIDGE_BODY_LIMIT_BYTES,\n    128 * 1024,\n    \"body limit\",\n  );\n  const host = process.env.AGENT_BRIDGE_HOST ?? \"127.0.0.1\";\n  const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, \"gateway port\");\n  const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  const migrationPlan = await loadMigrationPlan(migrationsDirectory);\n  const runtimeConnection = runtimePostgresConnectionConfig(\n    databaseUrl,\n    process.env.AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64,\n  );\n  const pool = new pg.Pool({\n    ...runtimeConnection,\n    max: poolSize,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway\",\n  });\n  const readinessPool = new pg.Pool({\n    ...runtimeConnection,\n    max: 1,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway-readiness\",\n  });\n\n  const store = new PostgresBridgeStore(pool);\n  let readinessCheckedAt = 0;\n  let readinessValue = false;\n  let readinessInFlight: Promise<boolean> | undefined;\n  const probeSchema = async () =>\n    await migrationsReady(readinessPool, migrationPlan) && await runtimeSchemaReady(readinessPool);\n  const schemaReady = (force = false): Promise<boolean> => {\n    if (!force && Date.now() - readinessCheckedAt < 1_000) {\n      return Promise.resolve(readinessValue);\n    }\n    if (readinessInFlight) return readinessInFlight;\n    let current: Promise<boolean>;\n    current = probeSchema()\n      .then((ready) => {\n        readinessValue = ready;\n        readinessCheckedAt = Date.now();\n        return ready;\n      })\n      .finally(() => {\n        if (readinessInFlight === current) readinessInFlight = undefined;\n      });\n    readinessInFlight = current;\n    return current;\n  };\n  try {\n    if (!await schemaReady(true)) {\n      throw new Error(\"runtime database is not ready for enforced row isolation\");\n    }\n  } catch (error) {\n    await Promise.allSettled([pool.end(), readinessPool.end()]);\n    throw error;\n  }\n  const gateway = createGateway({\n    store,\n    credentials: new PostgresCredentialResolver(pool),\n    security: new PostgresGatewaySecurity(pool),\n    requestAuthority: new PostgresRequestAuthority(pool),\n    allowedOrigins,\n    bodyLimitBytes,\n    requestDeadlineMs: deadline,\n    implementation,\n    ready: schemaReady,\n    rowIsolationReady: schemaReady,\n  });\n\n  gateway.listen(port, host, () => {\n    process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}\\n`);\n  });\n\n  let stopping = false;\n  async function shutdown(): Promise<void> {\n    if (stopping) return;\n    stopping = true;\n    await new Promise<void>((resolve, reject) => {\n      gateway.close((error) => error ? reject(error) : resolve());\n    });\n    await Promise.all([pool.end(), readinessPool.end()]);\n  }\n\n  process.once(\"SIGINT\", () => void shutdown());\n  process.once(\"SIGTERM\", () => void shutdown());\n}\n\nvoid main().catch((error) => {\n  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n  process.exitCode = 1;\n});\n","import type { PgQueryable } from \"./postgres-bridge-store.js\";\nimport type { OperationId } from \"./contracts/registry.js\";\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  policyId: string | null;\n  limit: number;\n  remaining: number;\n  retryAfterSeconds: number;\n}\n\nexport interface GatewaySecurity {\n  recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void>;\n  consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision>;\n}\n\nexport class PostgresGatewaySecurity implements GatewaySecurity {\n  constructor(private readonly db: PgQueryable) {}\n\n  private functionName(bound: string, unbound: string): string {\n    return this.db.inTransaction ? bound : unbound;\n  }\n\n  async recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    if (signal?.aborted) throw signal.reason;\n    await this.db.query(\n      `SELECT agent_bridge.${this.functionName(\"record_scope_denial\", \"record_scope_denial_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n  }\n\n  async consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      allowed: boolean;\n      limit_value: string | number;\n      remaining_value: string | number;\n      retry_after_seconds: string | number;\n      denied_policy_id: string | null;\n    }>(\n      `SELECT allowed, limit_value, remaining_value, retry_after_seconds, denied_policy_id\n       FROM agent_bridge.${this.functionName(\"consume_rate_limit\", \"consume_rate_limit_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n    const row = result.rows[0];\n    if (!row) throw new Error(\"rate limit policy is missing\");\n    return {\n      allowed: row.allowed,\n      policyId: row.denied_policy_id,\n      limit: Math.max(0, Number(row.limit_value)),\n      remaining: Math.max(0, Number(row.remaining_value)),\n      retryAfterSeconds: Math.max(0, Number(row.retry_after_seconds)),\n    };\n  }\n}\n","import type pg from \"pg\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport { PostgresBridgeStore, type PgQueryable } from \"./postgres-bridge-store.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\n\nexport interface RequestAuthorityContext {\n  gatewayAuthorityId: string;\n  credential: { id: string; principal: BridgePrincipal; scopes: readonly AuthorizationScope[] };\n  store: PostgresBridgeStore;\n  security: PostgresGatewaySecurity;\n  /** Establishes the savepoint separating durable security accounting from domain work. */\n  beginDomainWork(): Promise<void>;\n  endpointMigrationChallenges?: {\n    issue(input: { challenge: string; expectedGatewayAuthorityId: string; verifierCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string }>;\n    consume(input: { challenge: string; expectedGatewayAuthorityId: string; issuerCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string | null; consumed: boolean }>;\n  };\n}\n\nexport interface RequestAuthority {\n  run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T>;\n}\n\ntype AuthorityRow = {\n  gateway_authority_id: string;\n  credential_id: string;\n  workspace_id: string;\n  principal: string;\n  scopes: AuthorizationScope[];\n};\n\nfunction timestamp(value: unknown): string {\n  if (value instanceof Date) return value.toISOString();\n  return String(value);\n}\n\nfunction endpointMigrationFailure(error: unknown): never {\n  const sqlstate = typeof error === \"object\" && error !== null && \"code\" in error\n    ? String((error as { code?: unknown }).code ?? \"\")\n    : \"\";\n  if (sqlstate === \"28000\") {\n    throw Object.assign(new Error(\"endpoint migration binding was rejected\"), {\n      status: 409,\n      code: \"endpoint_migration_binding_rejected\",\n    });\n  }\n  if (sqlstate === \"23505\") {\n    throw Object.assign(new Error(\"endpoint migration challenge conflicts with existing state\"), {\n      status: 409,\n      code: \"endpoint_migration_challenge_conflict\",\n    });\n  }\n  throw error;\n}\n\nexport class MutationOutcomeUnknownError extends Error {\n  readonly status = 503;\n  readonly code = \"mutation_outcome_unknown\";\n  constructor() { super(\"The database commit outcome is unknown\"); }\n}\n\nexport class PostgresRequestAuthority implements RequestAuthority {\n  constructor(private readonly pool: Pick<pg.Pool, \"connect\">) {}\n\n  async run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T> {\n    if (signal.aborted) throw signal.reason;\n    const client = await this.pool.connect();\n    const db: PgQueryable = { inTransaction: true, query: (sql, values) => client.query(sql, values) };\n    let transactionOpen = false;\n    let domainSavepoint = false;\n    let commitDispatched = false;\n    let commitCompleted = false;\n    let discard: Error | undefined;\n    try {\n      if (signal.aborted) throw signal.reason;\n      await client.query(\"BEGIN\");\n      transactionOpen = true;\n      const opened = await client.query<AuthorityRow>(\n        `SELECT gateway_authority_id,credential_id,workspace_id,principal,scopes\n         FROM agent_bridge.open_request_authority_bound($1::uuid,$2::text,$3::uuid)`,\n        [credentialId, credentialHash, requestId],\n      );\n      const row = opened.rows[0];\n      if (!row) {\n        await client.query(\"ROLLBACK\");\n        transactionOpen = false;\n        throw Object.assign(new Error(\"Credential is not active\"), { status: 401, code: \"unauthorized\" });\n      }\n      if (signal.aborted) throw signal.reason;\n      const context: RequestAuthorityContext = {\n        gatewayAuthorityId: row.gateway_authority_id,\n        credential: { id: row.credential_id, principal: { workspace: row.workspace_id, agent: row.principal }, scopes: row.scopes },\n        store: new PostgresBridgeStore(db),\n        security: new PostgresGatewaySecurity(db),\n        beginDomainWork: async () => {\n          if (domainSavepoint) return;\n          if (signal.aborted) throw signal.reason;\n          await client.query(\"SAVEPOINT agent_bridge_domain_work\");\n          if (signal.aborted) throw signal.reason;\n          domainSavepoint = true;\n        },\n        endpointMigrationChallenges: {\n          issue: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at\n                 FROM agent_bridge.issue_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.verifierCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be issued\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: timestamp(row.expires_at),\n            };\n          },\n          consume: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date | null;\n                consumed: boolean;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at,consumed\n                 FROM agent_bridge.consume_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.issuerCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be consumed\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: row.expires_at === null ? null : timestamp(row.expires_at),\n              consumed: row.consumed,\n            };\n          },\n        },\n      };\n      try {\n        const result = await work(context);\n        if (signal.aborted) throw signal.reason;\n        await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        return result;\n      } catch (error) {\n        if (commitDispatched) throw new MutationOutcomeUnknownError();\n        if (signal.aborted) throw error;\n        try {\n          if (domainSavepoint) {\n            await client.query(\"ROLLBACK TO SAVEPOINT agent_bridge_domain_work\");\n          }\n          await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        } catch {\n          try {\n            await client.query(\"ROLLBACK\");\n          } catch (rollbackError) {\n            discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));\n          }\n          transactionOpen = false;\n          throw error;\n        }\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        throw error;\n      }\n    } catch (error) {\n      if (commitDispatched && !commitCompleted) {\n        discard = error instanceof Error ? error : new Error(String(error));\n        throw error instanceof MutationOutcomeUnknownError ? error : new MutationOutcomeUnknownError();\n      }\n      if (transactionOpen) {\n        try { await client.query(\"ROLLBACK\"); transactionOpen = false; }\n        catch (rollbackError) { discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError)); }\n      }\n      throw error;\n    } finally {\n      client.release(discard);\n    }\n  }\n\n}\n","import type { PoolConfig } from \"pg\";\n\nconst MAX_CA_PEM_BYTES = 256 * 1024;\nconst BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;\nconst CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]+-----END CERTIFICATE-----/u;\nconst CLIENT_CERTIFICATE_PARAMETERS = [\n  \"sslcert\",\n  \"sslkey\",\n  \"sslpassword\",\n] as const;\n\nfunction decodeCaPem(encoded: string): string {\n  const value = encoded.trim();\n  if (!value) throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be empty\");\n  if (!BASE64_PATTERN.test(value)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  const bytes = Buffer.from(value, \"base64\");\n  if (bytes.toString(\"base64\") !== value) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  if (bytes.byteLength > MAX_CA_PEM_BYTES) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 exceeds 256 KiB after decoding\");\n  }\n  const pem = bytes.toString(\"utf8\").trim();\n  if (pem.includes(\"\\0\") || !CERTIFICATE_PATTERN.test(pem)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must decode to a PEM certificate bundle\");\n  }\n  return pem;\n}\n\nexport function runtimePostgresConnectionConfig(\n  connectionString: string,\n  caBase64: string | undefined,\n): Pick<PoolConfig, \"connectionString\" | \"ssl\"> {\n  if (caBase64 === undefined) return { connectionString };\n\n  let parsed: URL;\n  try {\n    parsed = new URL(connectionString);\n  } catch {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must be a valid PostgreSQL URL\");\n  }\n  if (parsed.protocol !== \"postgresql:\" && parsed.protocol !== \"postgres:\") {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must use postgresql:// or postgres://\");\n  }\n\n  if (CLIENT_CERTIFICATE_PARAMETERS.some((parameter) => parsed.searchParams.has(parameter))) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with client certificate URL parameters\",\n    );\n  }\n  if (parsed.searchParams.has(\"ssl\")) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with the ssl URL parameter\",\n    );\n  }\n  parsed.searchParams.delete(\"sslmode\");\n  parsed.searchParams.delete(\"sslrootcert\");\n  return {\n    connectionString: parsed.toString(),\n    ssl: {\n      ca: decodeCaPem(caBase64),\n      rejectUnauthorized: true,\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,QAAQ;;;ACyBR,IAAM,0BAAN,MAAyD;AAAA,EAC9D,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAEvC,aAAa,OAAe,SAAyB;AAC3D,WAAO,KAAK,GAAG,gBAAgB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAM,kBACJ,cACA,aACA,WACA,QACe;AACf,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,KAAK,GAAG;AAAA,MACZ,uBAAuB,KAAK,aAAa,uBAAuB,iCAAiC,CAAC;AAAA,MAClG,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAAA,EACpC;AAAA,EAEA,MAAM,QACJ,cACA,aACA,WACA,QAC4B;AAC5B,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAO3B;AAAA,2BACqB,KAAK,aAAa,sBAAsB,gCAAgC,CAAC;AAAA,MAC9F,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8BAA8B;AACxD,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,MAC1C,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,eAAe,CAAC;AAAA,MAClD,mBAAmB,KAAK,IAAI,GAAG,OAAO,IAAI,mBAAmB,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;AC7CA,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,yBAAyB,OAAuB;AACvD,QAAM,WAAW,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACtE,OAAQ,MAA6B,QAAQ,EAAE,IAC/C;AACJ,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,yCAAyC,GAAG;AAAA,MACxE,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,4DAA4D,GAAG;AAAA,MAC3F,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM;AACR;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,cAAc;AAAE,UAAM,wCAAwC;AAF9D,SAAS,SAAS;AAClB,SAAS,OAAO;AAAA,EACiD;AACnE;AAEO,IAAM,2BAAN,MAA2D;AAAA,EAChE,YAA6B,MAAgC;AAAhC;AAAA,EAAiC;AAAA,EAE9D,MAAM,IAAO,cAAsB,gBAAwB,WAAmB,QAAqB,MAAoE;AACrK,QAAI,OAAO,QAAS,OAAM,OAAO;AACjC,UAAM,SAAS,MAAM,KAAK,KAAK,QAAQ;AACvC,UAAM,KAAkB,EAAE,eAAe,MAAM,OAAO,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,MAAM,EAAE;AACjG,QAAI,kBAAkB;AACtB,QAAI,kBAAkB;AACtB,QAAI,mBAAmB;AACvB,QAAI,kBAAkB;AACtB,QAAI;AACJ,QAAI;AACF,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,OAAO,MAAM,OAAO;AAC1B,wBAAkB;AAClB,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B;AAAA;AAAA,QAEA,CAAC,cAAc,gBAAgB,SAAS;AAAA,MAC1C;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,KAAK;AACR,cAAM,OAAO,MAAM,UAAU;AAC7B,0BAAkB;AAClB,cAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG,EAAE,QAAQ,KAAK,MAAM,eAAe,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,UAAmC;AAAA,QACvC,oBAAoB,IAAI;AAAA,QACxB,YAAY,EAAE,IAAI,IAAI,eAAe,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU,GAAG,QAAQ,IAAI,OAAO;AAAA,QAC1H,OAAO,IAAI,oBAAoB,EAAE;AAAA,QACjC,UAAU,IAAI,wBAAwB,EAAE;AAAA,QACxC,iBAAiB,YAAY;AAC3B,cAAI,gBAAiB;AACrB,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,gBAAM,OAAO,MAAM,oCAAoC;AACvD,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,4BAAkB;AAAA,QACpB;AAAA,QACA,6BAA6B;AAAA,UAC3B,OAAO,OAAO,UAAU;AACtB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAMpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,sBAAsB,MAAM,SAAS;AAAA,cAChF;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,kDAAkD;AAC5E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAW,UAAUA,KAAI,UAAU;AAAA,YACrC;AAAA,UACF;AAAA,UACA,SAAS,OAAO,UAAU;AACxB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAOpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,oBAAoB,MAAM,SAAS;AAAA,cAC9E;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,oDAAoD;AAC9E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAWA,KAAI,eAAe,OAAO,OAAO,UAAUA,KAAI,UAAU;AAAA,cACpE,UAAUA,KAAI;AAAA,YAChB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,cAAM,OAAO,MAAM,+CAA+C;AAClE,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAkB,OAAM,IAAI,4BAA4B;AAC5D,YAAI,OAAO,QAAS,OAAM;AAC1B,YAAI;AACF,cAAI,iBAAiB;AACnB,kBAAM,OAAO,MAAM,gDAAgD;AAAA,UACrE;AACA,gBAAM,OAAO,MAAM,+CAA+C;AAAA,QACpE,QAAQ;AACN,cAAI;AACF,kBAAM,OAAO,MAAM,UAAU;AAAA,UAC/B,SAAS,eAAe;AACtB,sBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,UAC5F;AACA,4BAAkB;AAClB,gBAAM;AAAA,QACR;AACA,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,cAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAO;AACd,UAAI,oBAAoB,CAAC,iBAAiB;AACxC,kBAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAClE,cAAM,iBAAiB,8BAA8B,QAAQ,IAAI,4BAA4B;AAAA,MAC/F;AACA,UAAI,iBAAiB;AACnB,YAAI;AAAE,gBAAM,OAAO,MAAM,UAAU;AAAG,4BAAkB;AAAA,QAAO,SACxD,eAAe;AAAE,oBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,QAAG;AAAA,MACvH;AACA,YAAM;AAAA,IACR,UAAE;AACA,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AAEF;;;AC3MA,IAAM,mBAAmB,MAAM;AAC/B,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,YAAY,SAAyB;AAC5C,QAAM,QAAQ,QAAQ,KAAK;AAC3B,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yDAAyD;AACrF,MAAI,CAAC,eAAe,KAAK,KAAK,GAAG;AAC/B,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ;AACzC,MAAI,MAAM,SAAS,QAAQ,MAAM,OAAO;AACtC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,MAAM,aAAa,kBAAkB;AACvC,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,MAAM,MAAM,SAAS,MAAM,EAAE,KAAK;AACxC,MAAI,IAAI,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,GAAG,GAAG;AACxD,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AACA,SAAO;AACT;AAEO,SAAS,gCACd,kBACA,UAC8C;AAC9C,MAAI,aAAa,OAAW,QAAO,EAAE,iBAAiB;AAEtD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,gBAAgB;AAAA,EACnC,QAAQ;AACN,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,OAAO,aAAa,iBAAiB,OAAO,aAAa,aAAa;AACxE,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AAEA,MAAI,8BAA8B,KAAK,CAAC,cAAc,OAAO,aAAa,IAAI,SAAS,CAAC,GAAG;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,aAAa,IAAI,KAAK,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,OAAO,SAAS;AACpC,SAAO,aAAa,OAAO,aAAa;AACxC,SAAO;AAAA,IACL,kBAAkB,OAAO,SAAS;AAAA,IAClC,KAAK;AAAA,MACH,IAAI,YAAY,QAAQ;AAAA,MACxB,oBAAoB;AAAA,IACtB;AAAA,EACF;AACF;;;AHlDA,SAAS,QAAQ,OAA2B,UAAkB,MAAsB;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACrG,SAAO;AACT;AAEA,eAAe,OAAsB;AACnC,QAAM,sBAAsB,cAAc,IAAI,IAAI,qBAAqB,YAAY,GAAG,CAAC;AACvF,MAAI,QAAQ,KAAK,SAAS,gBAAgB,GAAG;AAC3C,UAAMC,eAAc,QAAQ,IAAI;AAChC,QAAI,CAACA,aAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,MAChC,kBAAkBA;AAAA,MAClB,KAAK;AAAA,MACL,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI;AACF,YAAM,cAAc,eAAe,mBAAmB;AAAA,IACxD,UAAE;AACA,YAAM,cAAc,IAAI;AAAA,IAC1B;AACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,yBAAyB,KAAK;AAC5C,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,iBAAiB;AAAA,IACrB,SAAS,eAAe;AAAA,IACxB,UAAU,cAAc,QAAQ,IAAI,2BAA2B;AAAA,EACjE;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,kCAAkC,KAAQ,kBAAkB;AACjG,QAAM,kBAAkB;AAAA,IACtB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,QAAQ,IAAI,iCAAiC,IAAI,oBAAoB;AAC9F,QAAM,iBAAiB;AAAA,IACrB,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,IAAI,qBAAqB;AAC9C,QAAM,OAAO,QAAQ,QAAQ,IAAI,mBAAmB,MAAM,cAAc;AACxE,QAAM,iBAAiB,QAAQ,IAAI,8BAC/B,MAAM,GAAG,EACV,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AACjB,QAAM,gBAAgB,MAAM,kBAAkB,mBAAmB;AACjE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ,IAAI;AAAA,EACd;AACA,QAAM,OAAO,IAAI,GAAG,KAAK;AAAA,IACvB,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IAChC,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,QAAQ,IAAI,oBAAoB,IAAI;AAC1C,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AACrB,MAAI;AACJ,QAAM,cAAc,YAClB,MAAM,gBAAgB,eAAe,aAAa,KAAK,MAAM,mBAAmB,aAAa;AAC/F,QAAM,cAAc,CAAC,QAAQ,UAA4B;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,qBAAqB,KAAO;AACrD,aAAO,QAAQ,QAAQ,cAAc;AAAA,IACvC;AACA,QAAI,kBAAmB,QAAO;AAC9B,QAAI;AACJ,cAAU,YAAY,EACnB,KAAK,CAAC,UAAU;AACf,uBAAiB;AACjB,2BAAqB,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,sBAAsB,QAAS,qBAAoB;AAAA,IACzD,CAAC;AACH,wBAAoB;AACpB,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,CAAC,MAAM,YAAY,IAAI,GAAG;AAC5B,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAC1D,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA,aAAa,IAAI,2BAA2B,IAAI;AAAA,IAChD,UAAU,IAAI,wBAAwB,IAAI;AAAA,IAC1C,kBAAkB,IAAI,yBAAyB,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA,OAAO;AAAA,IACP,mBAAmB;AAAA,EACrB,CAAC;AAED,UAAQ,OAAO,MAAM,MAAM,MAAM;AAC/B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AAED,MAAI,WAAW;AACf,iBAAe,WAA0B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAQ,MAAM,CAAC,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,IAC5D,CAAC;AACD,UAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAAA,EACrD;AAEA,UAAQ,KAAK,UAAU,MAAM,KAAK,SAAS,CAAC;AAC5C,UAAQ,KAAK,WAAW,MAAM,KAAK,SAAS,CAAC;AAC/C;AAEA,KAAK,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3B,UAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AAClF,UAAQ,WAAW;AACrB,CAAC;","names":["row","databaseUrl"]}

package/dist/gateway.d.ts

@@ -1,5 +1,5 @@
 import 'node:http';
-import './bridge-store-ByJ6CaJk.js';
-export { G as GatewayOptions, c as createGateway } from './gateway-CW-61lvs.js';
+import './bridge-store-Bi_LCX8e.js';
+export { G as GatewayOptions, c as createGateway } from './gateway-DWZ3pX48.js';
 import './bridge-domain-CBX3IVqC.js';
-import './postgres-bridge-store-C9KG9Z69.js';
+import './postgres-bridge-store-ChoOuFEY.js';

package/dist/gateway.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   createGateway
-} from "./chunk-JUTJRAMA.js";
-import "./chunk-AWE3DFZV.js";
-import "./chunk-E4OWHGUE.js";
+} from "./chunk-LF37B6KL.js";
+import "./chunk-4V2PFJEF.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 export {
   createGateway

package/dist/index.js

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
 import {
   startServer
-} from "./chunk-HUHG7XTB.js";
-import "./chunk-2EVLG3YA.js";
-import "./chunk-QPC6JHA3.js";
-import "./chunk-Z6JP6MYD.js";
-import "./chunk-SN7PIVDF.js";
+} from "./chunk-JIRNR75D.js";
+import "./chunk-23UDQZMT.js";
+import "./chunk-UKFRCP6X.js";
+import "./chunk-IXNQG4SB.js";
+import "./chunk-6ZOLE3E3.js";
+import "./chunk-ZUZ7TCIH.js";
 import "./chunk-IVG4XWWS.js";
 import "./chunk-GTK4KOED.js";
 import "./chunk-VOQIDTCJ.js";
-import "./chunk-AWE3DFZV.js";
-import "./chunk-E4OWHGUE.js";
+import "./chunk-4V2PFJEF.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 
 // src/index.ts

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { startServer } from \"./server.js\";\n\nstartServer().catch((err) => {\n  console.error(\"Failed to start agent-bridge MCP server:\", err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;AAEA,YAAY,EAAE,MAAM,CAAC,QAAQ;AAC3B,UAAQ,MAAM,4CAA4C,GAAG;AAC7D,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { startServer } from \"./server.js\";\n\nstartServer().catch((err) => {\n  console.error(\"Failed to start agent-bridge MCP server:\", err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AAEA,YAAY,EAAE,MAAM,CAAC,QAAQ;AAC3B,UAAQ,MAAM,4CAA4C,GAAG;AAC7D,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}

package/dist/{postgres-bridge-store-C9KG9Z69.d.ts → postgres-bridge-store-ChoOuFEY.d.ts}

@@ -1,5 +1,5 @@
 import { b as BridgeMessage, c as BridgePrincipal, B as BridgeDelivery, R as RetryPolicy, a as BridgeDeliveryEvent, A as AgentPresence } from './bridge-domain-CBX3IVqC.js';
-import { a as BridgeStore, I as InsertMessageResult, d as MessageQuery, M as MessagePage, C as ClaimOptions, c as DeliveryQuery, B as BridgeDiagnostics } from './bridge-store-ByJ6CaJk.js';
+import { a as BridgeStore, I as InsertMessageResult, d as MessageQuery, M as MessagePage, C as ClaimOptions, c as DeliveryQuery, B as BridgeDiagnostics } from './bridge-store-Bi_LCX8e.js';
 
 interface PgQueryable {
     query<T extends Record<string, unknown> = Record<string, unknown>>(sql: string, values?: unknown[]): Promise<{

package/dist/server.d.ts

@@ -3,8 +3,6 @@ import { ClientProvider } from './client-config.js';
 import './bridge-domain-CBX3IVqC.js';
 
 interface AgentBridgeServerConfig {
-    supabaseUrl?: string;
-    supabaseKey?: string;
     agent?: string;
     provider?: ClientProvider;
     workspace?: string;

package/dist/server.js

@@ -4,16 +4,17 @@ import {
   configFromEnv,
   createAgentBridgeServer,
   startServer
-} from "./chunk-HUHG7XTB.js";
-import "./chunk-2EVLG3YA.js";
-import "./chunk-QPC6JHA3.js";
-import "./chunk-Z6JP6MYD.js";
-import "./chunk-SN7PIVDF.js";
+} from "./chunk-JIRNR75D.js";
+import "./chunk-23UDQZMT.js";
+import "./chunk-UKFRCP6X.js";
+import "./chunk-IXNQG4SB.js";
+import "./chunk-6ZOLE3E3.js";
+import "./chunk-ZUZ7TCIH.js";
 import "./chunk-IVG4XWWS.js";
 import "./chunk-GTK4KOED.js";
 import "./chunk-VOQIDTCJ.js";
-import "./chunk-AWE3DFZV.js";
-import "./chunk-E4OWHGUE.js";
+import "./chunk-4V2PFJEF.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 export {
   MCP_IMPLEMENTATION_VERSION,

package/dist/{sqlite-edge-store-CdMIOrho.d.ts → sqlite-edge-store-BAFUeysk.d.ts}

@@ -1,5 +1,5 @@
 import { b as BridgeMessage, c as BridgePrincipal } from './bridge-domain-CBX3IVqC.js';
-import { d as MessageQuery, M as MessagePage } from './bridge-store-ByJ6CaJk.js';
+import { d as MessageQuery, M as MessagePage } from './bridge-store-Bi_LCX8e.js';
 
 type PendingMessage = Omit<BridgeMessage, "sequence" | "createdAt">;
 interface EdgeScope {

package/dist/sqlite.d.ts

@@ -1,7 +1,7 @@
 import { c as BridgePrincipal, B as BridgeDelivery, g as DeliveryState, R as RetryPolicy, A as AgentPresence, b as BridgeMessage, a as BridgeDeliveryEvent } from './bridge-domain-CBX3IVqC.js';
-import { M as MessagePage, B as BridgeDiagnostics, I as InsertMessageResult, a as BridgeStore, d as MessageQuery, C as ClaimOptions, c as DeliveryQuery, b as DeliveryPage, D as DeliveryEventPage } from './bridge-store-ByJ6CaJk.js';
-import { e as EdgeMigrationGateState, S as SQLiteEdgeStore, a as EdgeDrainLease, P as PendingMessage } from './sqlite-edge-store-CdMIOrho.js';
-export { E as EdgeConflictError, b as EdgeEnqueueResult, c as EdgeMigrationDrainingError, d as EdgeMigrationGate, f as EdgeMigrationLeaseError, g as EdgeMigrationRetiredError, h as EdgeOutboxRecord, i as EdgeReadOnlyInspection, j as EdgeScope, k as EdgeStats, l as edgeMessageFingerprint, m as edgeScopeKey, n as inspectEdgeScopeReadOnly, s as stableIdempotency } from './sqlite-edge-store-CdMIOrho.js';
+import { M as MessagePage, B as BridgeDiagnostics, I as InsertMessageResult, a as BridgeStore, d as MessageQuery, C as ClaimOptions, c as DeliveryQuery, b as DeliveryPage, D as DeliveryEventPage } from './bridge-store-Bi_LCX8e.js';
+import { e as EdgeMigrationGateState, S as SQLiteEdgeStore, a as EdgeDrainLease, P as PendingMessage } from './sqlite-edge-store-BAFUeysk.js';
+export { E as EdgeConflictError, b as EdgeEnqueueResult, c as EdgeMigrationDrainingError, d as EdgeMigrationGate, f as EdgeMigrationLeaseError, g as EdgeMigrationRetiredError, h as EdgeOutboxRecord, i as EdgeReadOnlyInspection, j as EdgeScope, k as EdgeStats, l as edgeMessageFingerprint, m as edgeScopeKey, n as inspectEdgeScopeReadOnly, s as stableIdempotency } from './sqlite-edge-store-BAFUeysk.js';
 
 interface SyncInsertResult extends InsertMessageResult {
     disposition: "committed" | "queued";
@@ -110,6 +110,10 @@ declare class SyncingBridgeStore implements BridgeStore {
     private cancelled;
     private flushOne;
     insertMessage(message: PendingMessage): Promise<SyncInsertResult>;
+    enqueueMessage(message: PendingMessage): Promise<SyncInsertResult & {
+        disposition: "queued";
+        authoritative: false;
+    }>;
     private pull;
     sync(options?: {
         maxPush?: number;

package/dist/sqlite.js

@@ -11,7 +11,7 @@ import {
   inspectEdgeScopeReadOnly,
   isRetryableSyncError,
   stableIdempotency
-} from "./chunk-SN7PIVDF.js";
+} from "./chunk-ZUZ7TCIH.js";
 import {
   SQLiteBridgeStore
 } from "./chunk-IVG4XWWS.js";