@creatornader/agent-bridge 0.6.0 → 0.6.2

package/dist/client-runtime.js

@@ -2,14 +2,14 @@
 import {
   createClientRuntime,
   createStore
-} from "./chunk-IMJ47WO4.js";
-import "./chunk-WQ4I5XGF.js";
+} from "./chunk-IXNQG4SB.js";
+import "./chunk-6ZOLE3E3.js";
 import "./chunk-ZUZ7TCIH.js";
 import "./chunk-IVG4XWWS.js";
 import "./chunk-GTK4KOED.js";
 import "./chunk-VOQIDTCJ.js";
 import "./chunk-4V2PFJEF.js";
-import "./chunk-62C63PIE.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 export {
   createClientRuntime,

package/dist/contracts/generate.js

@@ -11,7 +11,7 @@ import {
   SUPPORTED_PROTOCOL_VERSIONS,
   capabilityDocument,
   operations
-} from "../chunk-62C63PIE.js";
+} from "../chunk-63JKCBC6.js";
 
 // src/contracts/generate.ts
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -175,6 +175,7 @@ var openapi = {
   openapi: "3.1.2",
   info: {
     title: "Agent Bridge Gateway",
+    description: "Let AI agents message each other and hand off work across tools, sessions, and machines.",
     version: PROTOCOL_VERSION,
     license: { name: "Apache-2.0", identifier: "Apache-2.0" }
   },

package/dist/contracts/generate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/contracts/generate.ts","../../src/contracts/artifact-format.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { formatContractArtifact, normalizeContractArtifact } from \"./artifact-format.js\";\nimport {\n  capabilityDocument,\n  ErrorEnvelopeSchema,\n  LegacyDeliverySchema,\n  LegacyMessageDraftSchema,\n  LegacyMessageSchema,\n  LEGACY_PROTOCOL_VERSION,\n  operations,\n  PROTOCOL_HEADER,\n  PROTOCOL_VERSION,\n  SCOPE_ENFORCEMENT,\n  SUPPORTED_PROTOCOL_HEADER,\n  SUPPORTED_PROTOCOL_VERSIONS,\n} from \"./registry.js\";\n\nfunction clone<T>(value: T): T {\n  return JSON.parse(JSON.stringify(value)) as T;\n}\n\nfunction objectWithout(schema: Record<string, any>, excluded: ReadonlySet<string>): Record<string, any> {\n  const result = clone(schema);\n  if (!result.properties) return result;\n  result.properties = Object.fromEntries(Object.entries(result.properties).filter(([name]) => !excluded.has(name)));\n  if (Array.isArray(result.required)) {\n    result.required = result.required.filter((name: string) => !excluded.has(name));\n    if (!result.required.length) delete result.required;\n  }\n  return result;\n}\n\nconst scopeEnforcementByProvider = {\n  local: false,\n  gateway: SCOPE_ENFORCEMENT,\n};\n\nconst schemas = {\n  $schema: \"https://json-schema.org/draft/2020-12/schema\",\n  $id: \"https://agent-bridge.dev/schemas/v2/operations.json\",\n  title: \"Agent Bridge v2 operation contracts\",\n  protocolVersion: PROTOCOL_VERSION,\n  scopeEnforcementByProvider,\n  $defs: {\n    ErrorEnvelope: ErrorEnvelopeSchema,\n    legacy20MessageDraft: LegacyMessageDraftSchema,\n    legacy20Message: LegacyMessageSchema,\n    legacy20Delivery: LegacyDeliverySchema,\n    ...Object.fromEntries(operations.flatMap((operation) => [\n      [`${operation.id}Request`, operation.request],\n      [`${operation.id}Response`, operation.response],\n      ...(operation.cli ? [[`${operation.id}CliResponse`, operation.cli.response ?? operation.response] as const] : []),\n      ...(operation.cli?.variants?.map((variant) => [\n        `${operation.id}CliVariant${variant.command.replace(/(^|[-_])(\\w)/g, (_match, _separator, character: string) => character.toUpperCase())}Response`,\n        variant.response,\n      ] as const) ?? []),\n    ])),\n  },\n};\n\nconst protocolHeaders = {\n  [PROTOCOL_HEADER]: {\n    description: \"Selected Agent Bridge protocol version.\",\n    required: true,\n    schema: { type: \"string\", enum: [...SUPPORTED_PROTOCOL_VERSIONS] },\n  },\n  [SUPPORTED_PROTOCOL_HEADER]: {\n    description: \"Comma-separated protocol versions supported by this gateway.\",\n    required: true,\n    schema: { type: \"string\" },\n  },\n};\n\nfunction errorResponse(description: string) {\n  return {\n    description,\n    headers: protocolHeaders,\n    content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorEnvelope\" } } },\n  };\n}\n\nconst canonicalErrors = {\n  \"400\": errorResponse(\"The request does not match the operation contract.\"),\n  \"401\": errorResponse(\"The bearer credential is missing or invalid.\"),\n  \"403\": errorResponse(\"The credential cannot access the requested principal or origin.\"),\n  \"404\": errorResponse(\"The route or requested resource does not exist.\"),\n  \"409\": errorResponse(\"The request conflicts with current delivery or idempotency state.\"),\n  \"413\": errorResponse(\"The request body exceeds the configured limit.\"),\n  \"415\": errorResponse(\"The request content type is not application/json.\"),\n  \"426\": errorResponse(\"The requested protocol version is unsupported.\"),\n  \"429\": errorResponse(\"The gateway has rate-limited the request.\"),\n  \"500\": errorResponse(\"The gateway could not complete the request.\"),\n  \"502\": errorResponse(\"The upstream response does not match the selected protocol contract.\"),\n  \"503\": errorResponse(\"The backing service is unavailable.\"),\n  \"504\": errorResponse(\"The request exceeded the gateway deadline.\"),\n};\n\nconst paths: Record<string, Record<string, unknown>> = {};\nfor (const operation of operations.filter((entry) => entry.http)) {\n  const http = operation.http!;\n  const pathItem = paths[http.path] ??= {};\n  const pathNames = [...http.path.matchAll(/\\{([^}]+)\\}/g)].map((match) => match[1]!);\n  const pathSet = new Set(pathNames);\n  const request = clone(operation.request as Record<string, any>);\n  const parameters: Array<Record<string, unknown>> = [{\n    name: PROTOCOL_HEADER,\n    in: \"header\",\n    required: true,\n    description: \"This OpenAPI operation describes protocol 2.1. Headerless protocol 2.0 uses the separate schemas named by x-agent-bridge-protocol-2.0.\",\n    schema: { type: \"string\", enum: [PROTOCOL_VERSION] },\n  }, ...pathNames.map((name) => ({\n    name,\n    in: \"path\",\n    required: true,\n    schema: request.properties?.[name] ?? { type: \"string\" },\n  }))];\n\n  if (http.method === \"GET\" && request.properties) {\n    for (const [propertyName, propertySchema] of Object.entries(request.properties) as Array<[string, Record<string, any>]>) {\n      if (pathSet.has(propertyName)) continue;\n      const queryName = propertyName === \"types\" ? \"type\" : propertyName === \"states\" ? \"state\" : propertyName;\n      const repeated = propertySchema.type === \"array\";\n      parameters.push({\n        name: queryName,\n        in: \"query\",\n        required: request.required?.includes(propertyName) ?? false,\n        ...(repeated ? { style: \"form\", explode: true } : {}),\n        schema: propertySchema,\n      });\n      for (const alias of http.queryAliases?.[propertyName] ?? []) {\n        parameters.push({\n          name: alias,\n          in: \"query\",\n          required: false,\n          deprecated: true,\n          description: `Compatibility alias for ${queryName}.`,\n          schema: propertySchema,\n        });\n      }\n    }\n  }\n\n  const contentType = http.responseContentType ?? \"application/json\";\n  const successStatus = String(http.successStatus ?? 200);\n  const successResponse = {\n    description: \"Successful response.\",\n    headers: protocolHeaders,\n    content: { [contentType]: { schema: clone(operation.response) } },\n  };\n  const bodySchema = objectWithout(request, pathSet);\n  const hasBodyFields = Object.keys(bodySchema.properties ?? {}).length > 0;\n  const hasRequiredBodyFields = Array.isArray(bodySchema.required) && bodySchema.required.length > 0;\n  pathItem[http.method.toLowerCase()] = {\n    operationId: operation.id,\n    summary: operation.summary,\n    security: [{ bearerAuth: [] }],\n    \"x-agent-bridge-required-scopes\": [...operation.scopes],\n    \"x-agent-bridge-scope-enforcement\": SCOPE_ENFORCEMENT,\n    ...(parameters.length ? { parameters } : {}),\n    ...(http.method === \"POST\" && hasBodyFields ? {\n      requestBody: {\n        required: hasRequiredBodyFields,\n        content: { \"application/json\": { schema: bodySchema } },\n      },\n    } : {}),\n    responses: { [successStatus]: successResponse, ...canonicalErrors },\n  };\n}\n\nconst openapi = {\n  openapi: \"3.1.2\",\n  info: {\n    title: \"Agent Bridge Gateway\",\n    version: PROTOCOL_VERSION,\n    license: { name: \"Apache-2.0\", identifier: \"Apache-2.0\" },\n  },\n  servers: [{ url: \"/\" }],\n  \"x-agent-bridge-protocol-versions\": [...SUPPORTED_PROTOCOL_VERSIONS],\n  \"x-agent-bridge-openapi-protocol-version\": PROTOCOL_VERSION,\n  \"x-agent-bridge-protocol-2.0\": {\n    description: \"Limited schema metadata for the released headerless 0.2.0 compatibility contract derived from d8184fe. This is not a complete OpenAPI route description. It does not support project, deliveryPolicy, delivery management/listing, or current delivery bookkeeping fields.\",\n    requestSchemas: { publish_message: \"#/x-agent-bridge-schemas-2.0/MessageDraft\" },\n    responseSchemas: { message: \"#/x-agent-bridge-schemas-2.0/Message\", delivery: \"#/x-agent-bridge-schemas-2.0/Delivery\" },\n  },\n  \"x-agent-bridge-schemas-2.0\": {\n    MessageDraft: LegacyMessageDraftSchema,\n    Message: LegacyMessageSchema,\n    Delivery: LegacyDeliverySchema,\n  },\n  \"x-agent-bridge-scope-enforcement\": SCOPE_ENFORCEMENT,\n  paths,\n  components: {\n    schemas: { ErrorEnvelope: ErrorEnvelopeSchema },\n    securitySchemes: { bearerAuth: { type: \"http\", scheme: \"bearer\" } },\n  },\n};\n\nconst mcp = {\n  schemaVersion: \"agent-bridge-mcp-manifest-v1\",\n  protocolVersion: PROTOCOL_VERSION,\n  scopeEnforcementByProvider,\n  tools: operations.filter((entry) => entry.mcp).map((entry) => ({\n    name: entry.mcp!.name,\n    description: entry.summary,\n    inputSchema: entry.request,\n    outputSchema: entry.response,\n    requiredScopes: entry.scopes,\n    providers: entry.providers,\n  })),\n};\n\nconst root = resolve(dirname(fileURLToPath(import.meta.url)), \"../..\");\nconst outputs = new Map([\n  [resolve(root, \"schemas/agent-bridge-v2.schema.json\"), formatContractArtifact(schemas)],\n  [resolve(root, \"openapi/agent-bridge-v2.openapi.json\"), formatContractArtifact(openapi)],\n  [resolve(root, \"schemas/agent-bridge-v2.mcp.json\"), formatContractArtifact(mcp)],\n  [resolve(root, \"schemas/agent-bridge-v2.capabilities.json\"), formatContractArtifact(capabilityDocument())],\n]);\nconst check = process.argv.includes(\"--check\");\nconst drift: string[] = [];\nfor (const [path, contents] of outputs) {\n  if (check) {\n    let current = \"\";\n    try { current = readFileSync(path, \"utf8\"); } catch {}\n    if (normalizeContractArtifact(current) !== normalizeContractArtifact(contents)) {\n      drift.push(path.slice(root.length + 1));\n    }\n  } else {\n    mkdirSync(dirname(path), { recursive: true });\n    writeFileSync(path, contents);\n  }\n}\nif (drift.length) {\n  for (const path of drift) process.stderr.write(`ERROR contract artifact drift: ${path}\\n`);\n  process.exitCode = 1;\n} else {\n  process.stdout.write(`contracts ${check ? \"match\" : \"generated\"}: ${outputs.size} artifacts, ${operations.length} operations\\n`);\n}\n","export function formatContractArtifact(value: unknown): string {\n  return `${JSON.stringify(value, null, 2)}\\n`;\n}\n\nexport function normalizeContractArtifact(contents: string): string {\n  return contents.replace(/\\r\\n?/g, \"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,cAAc,qBAAqB;AACvD,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;;;ACFvB,SAAS,uBAAuB,OAAwB;AAC7D,SAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AAC1C;AAEO,SAAS,0BAA0B,UAA0B;AAClE,SAAO,SAAS,QAAQ,UAAU,IAAI;AACxC;;;ADaA,SAAS,MAAS,OAAa;AAC7B,SAAO,KAAK,MAAM,KAAK,UAAU,KAAK,CAAC;AACzC;AAEA,SAAS,cAAc,QAA6B,UAAoD;AACtG,QAAM,SAAS,MAAM,MAAM;AAC3B,MAAI,CAAC,OAAO,WAAY,QAAO;AAC/B,SAAO,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AAChH,MAAI,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAClC,WAAO,WAAW,OAAO,SAAS,OAAO,CAAC,SAAiB,CAAC,SAAS,IAAI,IAAI,CAAC;AAC9E,QAAI,CAAC,OAAO,SAAS,OAAQ,QAAO,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,IAAM,6BAA6B;AAAA,EACjC,OAAO;AAAA,EACP,SAAS;AACX;AAEA,IAAM,UAAU;AAAA,EACd,SAAS;AAAA,EACT,KAAK;AAAA,EACL,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB;AAAA,EACA,OAAO;AAAA,IACL,eAAe;AAAA,IACf,sBAAsB;AAAA,IACtB,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,GAAG,OAAO,YAAY,WAAW,QAAQ,CAAC,cAAc;AAAA,MACtD,CAAC,GAAG,UAAU,EAAE,WAAW,UAAU,OAAO;AAAA,MAC5C,CAAC,GAAG,UAAU,EAAE,YAAY,UAAU,QAAQ;AAAA,MAC9C,GAAI,UAAU,MAAM,CAAC,CAAC,GAAG,UAAU,EAAE,eAAe,UAAU,IAAI,YAAY,UAAU,QAAQ,CAAU,IAAI,CAAC;AAAA,MAC/G,GAAI,UAAU,KAAK,UAAU,IAAI,CAAC,YAAY;AAAA,QAC5C,GAAG,UAAU,EAAE,aAAa,QAAQ,QAAQ,QAAQ,iBAAiB,CAAC,QAAQ,YAAY,cAAsB,UAAU,YAAY,CAAC,CAAC;AAAA,QACxI,QAAQ;AAAA,MACV,CAAU,KAAK,CAAC;AAAA,IAClB,CAAC,CAAC;AAAA,EACJ;AACF;AAEA,IAAM,kBAAkB;AAAA,EACtB,CAAC,eAAe,GAAG;AAAA,IACjB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,2BAA2B,EAAE;AAAA,EACnE;AAAA,EACA,CAAC,yBAAyB,GAAG;AAAA,IAC3B,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE,MAAM,SAAS;AAAA,EAC3B;AACF;AAEA,SAAS,cAAc,aAAqB;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,IACT,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;AAAA,EAC5F;AACF;AAEA,IAAM,kBAAkB;AAAA,EACtB,OAAO,cAAc,oDAAoD;AAAA,EACzE,OAAO,cAAc,8CAA8C;AAAA,EACnE,OAAO,cAAc,iEAAiE;AAAA,EACtF,OAAO,cAAc,iDAAiD;AAAA,EACtE,OAAO,cAAc,mEAAmE;AAAA,EACxF,OAAO,cAAc,gDAAgD;AAAA,EACrE,OAAO,cAAc,mDAAmD;AAAA,EACxE,OAAO,cAAc,gDAAgD;AAAA,EACrE,OAAO,cAAc,2CAA2C;AAAA,EAChE,OAAO,cAAc,6CAA6C;AAAA,EAClE,OAAO,cAAc,sEAAsE;AAAA,EAC3F,OAAO,cAAc,qCAAqC;AAAA,EAC1D,OAAO,cAAc,4CAA4C;AACnE;AAEA,IAAM,QAAiD,CAAC;AAnGxD;AAoGA,WAAW,aAAa,WAAW,OAAO,CAAC,UAAU,MAAM,IAAI,GAAG;AAChE,QAAM,OAAO,UAAU;AACvB,QAAM,WAAW,WAAM,KAAK,UAAX,YAAqB,CAAC;AACvC,QAAM,YAAY,CAAC,GAAG,KAAK,KAAK,SAAS,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,CAAC,CAAE;AAClF,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,UAAU,MAAM,UAAU,OAA8B;AAC9D,QAAM,aAA6C,CAAC;AAAA,IAClD,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,gBAAgB,EAAE;AAAA,EACrD,GAAG,GAAG,UAAU,IAAI,CAAC,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QAAQ,QAAQ,aAAa,IAAI,KAAK,EAAE,MAAM,SAAS;AAAA,EACzD,EAAE,CAAC;AAEH,MAAI,KAAK,WAAW,SAAS,QAAQ,YAAY;AAC/C,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,QAAQ,UAAU,GAA2C;AACvH,UAAI,QAAQ,IAAI,YAAY,EAAG;AAC/B,YAAM,YAAY,iBAAiB,UAAU,SAAS,iBAAiB,WAAW,UAAU;AAC5F,YAAM,WAAW,eAAe,SAAS;AACzC,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU,QAAQ,UAAU,SAAS,YAAY,KAAK;AAAA,QACtD,GAAI,WAAW,EAAE,OAAO,QAAQ,SAAS,KAAK,IAAI,CAAC;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC;AACD,iBAAW,SAAS,KAAK,eAAe,YAAY,KAAK,CAAC,GAAG;AAC3D,mBAAW,KAAK;AAAA,UACd,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,aAAa,2BAA2B,SAAS;AAAA,UACjD,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,KAAK,uBAAuB;AAChD,QAAM,gBAAgB,OAAO,KAAK,iBAAiB,GAAG;AACtD,QAAM,kBAAkB;AAAA,IACtB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,SAAS,EAAE,CAAC,WAAW,GAAG,EAAE,QAAQ,MAAM,UAAU,QAAQ,EAAE,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,cAAc,SAAS,OAAO;AACjD,QAAM,gBAAgB,OAAO,KAAK,WAAW,cAAc,CAAC,CAAC,EAAE,SAAS;AACxE,QAAM,wBAAwB,MAAM,QAAQ,WAAW,QAAQ,KAAK,WAAW,SAAS,SAAS;AACjG,WAAS,KAAK,OAAO,YAAY,CAAC,IAAI;AAAA,IACpC,aAAa,UAAU;AAAA,IACvB,SAAS,UAAU;AAAA,IACnB,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;AAAA,IAC7B,kCAAkC,CAAC,GAAG,UAAU,MAAM;AAAA,IACtD,oCAAoC;AAAA,IACpC,GAAI,WAAW,SAAS,EAAE,WAAW,IAAI,CAAC;AAAA,IAC1C,GAAI,KAAK,WAAW,UAAU,gBAAgB;AAAA,MAC5C,aAAa;AAAA,QACX,UAAU;AAAA,QACV,SAAS,EAAE,oBAAoB,EAAE,QAAQ,WAAW,EAAE;AAAA,MACxD;AAAA,IACF,IAAI,CAAC;AAAA,IACL,WAAW,EAAE,CAAC,aAAa,GAAG,iBAAiB,GAAG,gBAAgB;AAAA,EACpE;AACF;AAEA,IAAM,UAAU;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,SAAS,EAAE,MAAM,cAAc,YAAY,aAAa;AAAA,EAC1D;AAAA,EACA,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,EACtB,oCAAoC,CAAC,GAAG,2BAA2B;AAAA,EACnE,2CAA2C;AAAA,EAC3C,+BAA+B;AAAA,IAC7B,aAAa;AAAA,IACb,gBAAgB,EAAE,iBAAiB,4CAA4C;AAAA,IAC/E,iBAAiB,EAAE,SAAS,wCAAwC,UAAU,wCAAwC;AAAA,EACxH;AAAA,EACA,8BAA8B;AAAA,IAC5B,cAAc;AAAA,IACd,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA,oCAAoC;AAAA,EACpC;AAAA,EACA,YAAY;AAAA,IACV,SAAS,EAAE,eAAe,oBAAoB;AAAA,IAC9C,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,QAAQ,SAAS,EAAE;AAAA,EACpE;AACF;AAEA,IAAM,MAAM;AAAA,EACV,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB;AAAA,EACA,OAAO,WAAW,OAAO,CAAC,UAAU,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW;AAAA,IAC7D,MAAM,MAAM,IAAK;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,gBAAgB,MAAM;AAAA,IACtB,WAAW,MAAM;AAAA,EACnB,EAAE;AACJ;AAEA,IAAM,OAAO,QAAQ,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,OAAO;AACrE,IAAM,UAAU,oBAAI,IAAI;AAAA,EACtB,CAAC,QAAQ,MAAM,qCAAqC,GAAG,uBAAuB,OAAO,CAAC;AAAA,EACtF,CAAC,QAAQ,MAAM,sCAAsC,GAAG,uBAAuB,OAAO,CAAC;AAAA,EACvF,CAAC,QAAQ,MAAM,kCAAkC,GAAG,uBAAuB,GAAG,CAAC;AAAA,EAC/E,CAAC,QAAQ,MAAM,2CAA2C,GAAG,uBAAuB,mBAAmB,CAAC,CAAC;AAC3G,CAAC;AACD,IAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS;AAC7C,IAAM,QAAkB,CAAC;AACzB,WAAW,CAAC,MAAM,QAAQ,KAAK,SAAS;AACtC,MAAI,OAAO;AACT,QAAI,UAAU;AACd,QAAI;AAAE,gBAAU,aAAa,MAAM,MAAM;AAAA,IAAG,QAAQ;AAAA,IAAC;AACrD,QAAI,0BAA0B,OAAO,MAAM,0BAA0B,QAAQ,GAAG;AAC9E,YAAM,KAAK,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC;AAAA,IACxC;AAAA,EACF,OAAO;AACL,cAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,kBAAc,MAAM,QAAQ;AAAA,EAC9B;AACF;AACA,IAAI,MAAM,QAAQ;AAChB,aAAW,QAAQ,MAAO,SAAQ,OAAO,MAAM,kCAAkC,IAAI;AAAA,CAAI;AACzF,UAAQ,WAAW;AACrB,OAAO;AACL,UAAQ,OAAO,MAAM,aAAa,QAAQ,UAAU,WAAW,KAAK,QAAQ,IAAI,eAAe,WAAW,MAAM;AAAA,CAAe;AACjI;","names":[]}
+{"version":3,"sources":["../../src/contracts/generate.ts","../../src/contracts/artifact-format.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { formatContractArtifact, normalizeContractArtifact } from \"./artifact-format.js\";\nimport {\n  capabilityDocument,\n  ErrorEnvelopeSchema,\n  LegacyDeliverySchema,\n  LegacyMessageDraftSchema,\n  LegacyMessageSchema,\n  LEGACY_PROTOCOL_VERSION,\n  operations,\n  PROTOCOL_HEADER,\n  PROTOCOL_VERSION,\n  SCOPE_ENFORCEMENT,\n  SUPPORTED_PROTOCOL_HEADER,\n  SUPPORTED_PROTOCOL_VERSIONS,\n} from \"./registry.js\";\n\nfunction clone<T>(value: T): T {\n  return JSON.parse(JSON.stringify(value)) as T;\n}\n\nfunction objectWithout(schema: Record<string, any>, excluded: ReadonlySet<string>): Record<string, any> {\n  const result = clone(schema);\n  if (!result.properties) return result;\n  result.properties = Object.fromEntries(Object.entries(result.properties).filter(([name]) => !excluded.has(name)));\n  if (Array.isArray(result.required)) {\n    result.required = result.required.filter((name: string) => !excluded.has(name));\n    if (!result.required.length) delete result.required;\n  }\n  return result;\n}\n\nconst scopeEnforcementByProvider = {\n  local: false,\n  gateway: SCOPE_ENFORCEMENT,\n};\n\nconst schemas = {\n  $schema: \"https://json-schema.org/draft/2020-12/schema\",\n  $id: \"https://agent-bridge.dev/schemas/v2/operations.json\",\n  title: \"Agent Bridge v2 operation contracts\",\n  protocolVersion: PROTOCOL_VERSION,\n  scopeEnforcementByProvider,\n  $defs: {\n    ErrorEnvelope: ErrorEnvelopeSchema,\n    legacy20MessageDraft: LegacyMessageDraftSchema,\n    legacy20Message: LegacyMessageSchema,\n    legacy20Delivery: LegacyDeliverySchema,\n    ...Object.fromEntries(operations.flatMap((operation) => [\n      [`${operation.id}Request`, operation.request],\n      [`${operation.id}Response`, operation.response],\n      ...(operation.cli ? [[`${operation.id}CliResponse`, operation.cli.response ?? operation.response] as const] : []),\n      ...(operation.cli?.variants?.map((variant) => [\n        `${operation.id}CliVariant${variant.command.replace(/(^|[-_])(\\w)/g, (_match, _separator, character: string) => character.toUpperCase())}Response`,\n        variant.response,\n      ] as const) ?? []),\n    ])),\n  },\n};\n\nconst protocolHeaders = {\n  [PROTOCOL_HEADER]: {\n    description: \"Selected Agent Bridge protocol version.\",\n    required: true,\n    schema: { type: \"string\", enum: [...SUPPORTED_PROTOCOL_VERSIONS] },\n  },\n  [SUPPORTED_PROTOCOL_HEADER]: {\n    description: \"Comma-separated protocol versions supported by this gateway.\",\n    required: true,\n    schema: { type: \"string\" },\n  },\n};\n\nfunction errorResponse(description: string) {\n  return {\n    description,\n    headers: protocolHeaders,\n    content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorEnvelope\" } } },\n  };\n}\n\nconst canonicalErrors = {\n  \"400\": errorResponse(\"The request does not match the operation contract.\"),\n  \"401\": errorResponse(\"The bearer credential is missing or invalid.\"),\n  \"403\": errorResponse(\"The credential cannot access the requested principal or origin.\"),\n  \"404\": errorResponse(\"The route or requested resource does not exist.\"),\n  \"409\": errorResponse(\"The request conflicts with current delivery or idempotency state.\"),\n  \"413\": errorResponse(\"The request body exceeds the configured limit.\"),\n  \"415\": errorResponse(\"The request content type is not application/json.\"),\n  \"426\": errorResponse(\"The requested protocol version is unsupported.\"),\n  \"429\": errorResponse(\"The gateway has rate-limited the request.\"),\n  \"500\": errorResponse(\"The gateway could not complete the request.\"),\n  \"502\": errorResponse(\"The upstream response does not match the selected protocol contract.\"),\n  \"503\": errorResponse(\"The backing service is unavailable.\"),\n  \"504\": errorResponse(\"The request exceeded the gateway deadline.\"),\n};\n\nconst paths: Record<string, Record<string, unknown>> = {};\nfor (const operation of operations.filter((entry) => entry.http)) {\n  const http = operation.http!;\n  const pathItem = paths[http.path] ??= {};\n  const pathNames = [...http.path.matchAll(/\\{([^}]+)\\}/g)].map((match) => match[1]!);\n  const pathSet = new Set(pathNames);\n  const request = clone(operation.request as Record<string, any>);\n  const parameters: Array<Record<string, unknown>> = [{\n    name: PROTOCOL_HEADER,\n    in: \"header\",\n    required: true,\n    description: \"This OpenAPI operation describes protocol 2.1. Headerless protocol 2.0 uses the separate schemas named by x-agent-bridge-protocol-2.0.\",\n    schema: { type: \"string\", enum: [PROTOCOL_VERSION] },\n  }, ...pathNames.map((name) => ({\n    name,\n    in: \"path\",\n    required: true,\n    schema: request.properties?.[name] ?? { type: \"string\" },\n  }))];\n\n  if (http.method === \"GET\" && request.properties) {\n    for (const [propertyName, propertySchema] of Object.entries(request.properties) as Array<[string, Record<string, any>]>) {\n      if (pathSet.has(propertyName)) continue;\n      const queryName = propertyName === \"types\" ? \"type\" : propertyName === \"states\" ? \"state\" : propertyName;\n      const repeated = propertySchema.type === \"array\";\n      parameters.push({\n        name: queryName,\n        in: \"query\",\n        required: request.required?.includes(propertyName) ?? false,\n        ...(repeated ? { style: \"form\", explode: true } : {}),\n        schema: propertySchema,\n      });\n      for (const alias of http.queryAliases?.[propertyName] ?? []) {\n        parameters.push({\n          name: alias,\n          in: \"query\",\n          required: false,\n          deprecated: true,\n          description: `Compatibility alias for ${queryName}.`,\n          schema: propertySchema,\n        });\n      }\n    }\n  }\n\n  const contentType = http.responseContentType ?? \"application/json\";\n  const successStatus = String(http.successStatus ?? 200);\n  const successResponse = {\n    description: \"Successful response.\",\n    headers: protocolHeaders,\n    content: { [contentType]: { schema: clone(operation.response) } },\n  };\n  const bodySchema = objectWithout(request, pathSet);\n  const hasBodyFields = Object.keys(bodySchema.properties ?? {}).length > 0;\n  const hasRequiredBodyFields = Array.isArray(bodySchema.required) && bodySchema.required.length > 0;\n  pathItem[http.method.toLowerCase()] = {\n    operationId: operation.id,\n    summary: operation.summary,\n    security: [{ bearerAuth: [] }],\n    \"x-agent-bridge-required-scopes\": [...operation.scopes],\n    \"x-agent-bridge-scope-enforcement\": SCOPE_ENFORCEMENT,\n    ...(parameters.length ? { parameters } : {}),\n    ...(http.method === \"POST\" && hasBodyFields ? {\n      requestBody: {\n        required: hasRequiredBodyFields,\n        content: { \"application/json\": { schema: bodySchema } },\n      },\n    } : {}),\n    responses: { [successStatus]: successResponse, ...canonicalErrors },\n  };\n}\n\nconst openapi = {\n  openapi: \"3.1.2\",\n  info: {\n    title: \"Agent Bridge Gateway\",\n    description: \"Let AI agents message each other and hand off work across tools, sessions, and machines.\",\n    version: PROTOCOL_VERSION,\n    license: { name: \"Apache-2.0\", identifier: \"Apache-2.0\" },\n  },\n  servers: [{ url: \"/\" }],\n  \"x-agent-bridge-protocol-versions\": [...SUPPORTED_PROTOCOL_VERSIONS],\n  \"x-agent-bridge-openapi-protocol-version\": PROTOCOL_VERSION,\n  \"x-agent-bridge-protocol-2.0\": {\n    description: \"Limited schema metadata for the released headerless 0.2.0 compatibility contract derived from d8184fe. This is not a complete OpenAPI route description. It does not support project, deliveryPolicy, delivery management/listing, or current delivery bookkeeping fields.\",\n    requestSchemas: { publish_message: \"#/x-agent-bridge-schemas-2.0/MessageDraft\" },\n    responseSchemas: { message: \"#/x-agent-bridge-schemas-2.0/Message\", delivery: \"#/x-agent-bridge-schemas-2.0/Delivery\" },\n  },\n  \"x-agent-bridge-schemas-2.0\": {\n    MessageDraft: LegacyMessageDraftSchema,\n    Message: LegacyMessageSchema,\n    Delivery: LegacyDeliverySchema,\n  },\n  \"x-agent-bridge-scope-enforcement\": SCOPE_ENFORCEMENT,\n  paths,\n  components: {\n    schemas: { ErrorEnvelope: ErrorEnvelopeSchema },\n    securitySchemes: { bearerAuth: { type: \"http\", scheme: \"bearer\" } },\n  },\n};\n\nconst mcp = {\n  schemaVersion: \"agent-bridge-mcp-manifest-v1\",\n  protocolVersion: PROTOCOL_VERSION,\n  scopeEnforcementByProvider,\n  tools: operations.filter((entry) => entry.mcp).map((entry) => ({\n    name: entry.mcp!.name,\n    description: entry.summary,\n    inputSchema: entry.request,\n    outputSchema: entry.response,\n    requiredScopes: entry.scopes,\n    providers: entry.providers,\n  })),\n};\n\nconst root = resolve(dirname(fileURLToPath(import.meta.url)), \"../..\");\nconst outputs = new Map([\n  [resolve(root, \"schemas/agent-bridge-v2.schema.json\"), formatContractArtifact(schemas)],\n  [resolve(root, \"openapi/agent-bridge-v2.openapi.json\"), formatContractArtifact(openapi)],\n  [resolve(root, \"schemas/agent-bridge-v2.mcp.json\"), formatContractArtifact(mcp)],\n  [resolve(root, \"schemas/agent-bridge-v2.capabilities.json\"), formatContractArtifact(capabilityDocument())],\n]);\nconst check = process.argv.includes(\"--check\");\nconst drift: string[] = [];\nfor (const [path, contents] of outputs) {\n  if (check) {\n    let current = \"\";\n    try { current = readFileSync(path, \"utf8\"); } catch {}\n    if (normalizeContractArtifact(current) !== normalizeContractArtifact(contents)) {\n      drift.push(path.slice(root.length + 1));\n    }\n  } else {\n    mkdirSync(dirname(path), { recursive: true });\n    writeFileSync(path, contents);\n  }\n}\nif (drift.length) {\n  for (const path of drift) process.stderr.write(`ERROR contract artifact drift: ${path}\\n`);\n  process.exitCode = 1;\n} else {\n  process.stdout.write(`contracts ${check ? \"match\" : \"generated\"}: ${outputs.size} artifacts, ${operations.length} operations\\n`);\n}\n","export function formatContractArtifact(value: unknown): string {\n  return `${JSON.stringify(value, null, 2)}\\n`;\n}\n\nexport function normalizeContractArtifact(contents: string): string {\n  return contents.replace(/\\r\\n?/g, \"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,cAAc,qBAAqB;AACvD,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;;;ACFvB,SAAS,uBAAuB,OAAwB;AAC7D,SAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AAC1C;AAEO,SAAS,0BAA0B,UAA0B;AAClE,SAAO,SAAS,QAAQ,UAAU,IAAI;AACxC;;;ADaA,SAAS,MAAS,OAAa;AAC7B,SAAO,KAAK,MAAM,KAAK,UAAU,KAAK,CAAC;AACzC;AAEA,SAAS,cAAc,QAA6B,UAAoD;AACtG,QAAM,SAAS,MAAM,MAAM;AAC3B,MAAI,CAAC,OAAO,WAAY,QAAO;AAC/B,SAAO,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AAChH,MAAI,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAClC,WAAO,WAAW,OAAO,SAAS,OAAO,CAAC,SAAiB,CAAC,SAAS,IAAI,IAAI,CAAC;AAC9E,QAAI,CAAC,OAAO,SAAS,OAAQ,QAAO,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,IAAM,6BAA6B;AAAA,EACjC,OAAO;AAAA,EACP,SAAS;AACX;AAEA,IAAM,UAAU;AAAA,EACd,SAAS;AAAA,EACT,KAAK;AAAA,EACL,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB;AAAA,EACA,OAAO;AAAA,IACL,eAAe;AAAA,IACf,sBAAsB;AAAA,IACtB,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,GAAG,OAAO,YAAY,WAAW,QAAQ,CAAC,cAAc;AAAA,MACtD,CAAC,GAAG,UAAU,EAAE,WAAW,UAAU,OAAO;AAAA,MAC5C,CAAC,GAAG,UAAU,EAAE,YAAY,UAAU,QAAQ;AAAA,MAC9C,GAAI,UAAU,MAAM,CAAC,CAAC,GAAG,UAAU,EAAE,eAAe,UAAU,IAAI,YAAY,UAAU,QAAQ,CAAU,IAAI,CAAC;AAAA,MAC/G,GAAI,UAAU,KAAK,UAAU,IAAI,CAAC,YAAY;AAAA,QAC5C,GAAG,UAAU,EAAE,aAAa,QAAQ,QAAQ,QAAQ,iBAAiB,CAAC,QAAQ,YAAY,cAAsB,UAAU,YAAY,CAAC,CAAC;AAAA,QACxI,QAAQ;AAAA,MACV,CAAU,KAAK,CAAC;AAAA,IAClB,CAAC,CAAC;AAAA,EACJ;AACF;AAEA,IAAM,kBAAkB;AAAA,EACtB,CAAC,eAAe,GAAG;AAAA,IACjB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,2BAA2B,EAAE;AAAA,EACnE;AAAA,EACA,CAAC,yBAAyB,GAAG;AAAA,IAC3B,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE,MAAM,SAAS;AAAA,EAC3B;AACF;AAEA,SAAS,cAAc,aAAqB;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,IACT,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;AAAA,EAC5F;AACF;AAEA,IAAM,kBAAkB;AAAA,EACtB,OAAO,cAAc,oDAAoD;AAAA,EACzE,OAAO,cAAc,8CAA8C;AAAA,EACnE,OAAO,cAAc,iEAAiE;AAAA,EACtF,OAAO,cAAc,iDAAiD;AAAA,EACtE,OAAO,cAAc,mEAAmE;AAAA,EACxF,OAAO,cAAc,gDAAgD;AAAA,EACrE,OAAO,cAAc,mDAAmD;AAAA,EACxE,OAAO,cAAc,gDAAgD;AAAA,EACrE,OAAO,cAAc,2CAA2C;AAAA,EAChE,OAAO,cAAc,6CAA6C;AAAA,EAClE,OAAO,cAAc,sEAAsE;AAAA,EAC3F,OAAO,cAAc,qCAAqC;AAAA,EAC1D,OAAO,cAAc,4CAA4C;AACnE;AAEA,IAAM,QAAiD,CAAC;AAnGxD;AAoGA,WAAW,aAAa,WAAW,OAAO,CAAC,UAAU,MAAM,IAAI,GAAG;AAChE,QAAM,OAAO,UAAU;AACvB,QAAM,WAAW,WAAM,KAAK,UAAX,YAAqB,CAAC;AACvC,QAAM,YAAY,CAAC,GAAG,KAAK,KAAK,SAAS,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,CAAC,CAAE;AAClF,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,UAAU,MAAM,UAAU,OAA8B;AAC9D,QAAM,aAA6C,CAAC;AAAA,IAClD,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,gBAAgB,EAAE;AAAA,EACrD,GAAG,GAAG,UAAU,IAAI,CAAC,UAAU;AAAA,IAC7B;AAAA,IACA,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QAAQ,QAAQ,aAAa,IAAI,KAAK,EAAE,MAAM,SAAS;AAAA,EACzD,EAAE,CAAC;AAEH,MAAI,KAAK,WAAW,SAAS,QAAQ,YAAY;AAC/C,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,QAAQ,UAAU,GAA2C;AACvH,UAAI,QAAQ,IAAI,YAAY,EAAG;AAC/B,YAAM,YAAY,iBAAiB,UAAU,SAAS,iBAAiB,WAAW,UAAU;AAC5F,YAAM,WAAW,eAAe,SAAS;AACzC,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU,QAAQ,UAAU,SAAS,YAAY,KAAK;AAAA,QACtD,GAAI,WAAW,EAAE,OAAO,QAAQ,SAAS,KAAK,IAAI,CAAC;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC;AACD,iBAAW,SAAS,KAAK,eAAe,YAAY,KAAK,CAAC,GAAG;AAC3D,mBAAW,KAAK;AAAA,UACd,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,aAAa,2BAA2B,SAAS;AAAA,UACjD,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,KAAK,uBAAuB;AAChD,QAAM,gBAAgB,OAAO,KAAK,iBAAiB,GAAG;AACtD,QAAM,kBAAkB;AAAA,IACtB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,SAAS,EAAE,CAAC,WAAW,GAAG,EAAE,QAAQ,MAAM,UAAU,QAAQ,EAAE,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,cAAc,SAAS,OAAO;AACjD,QAAM,gBAAgB,OAAO,KAAK,WAAW,cAAc,CAAC,CAAC,EAAE,SAAS;AACxE,QAAM,wBAAwB,MAAM,QAAQ,WAAW,QAAQ,KAAK,WAAW,SAAS,SAAS;AACjG,WAAS,KAAK,OAAO,YAAY,CAAC,IAAI;AAAA,IACpC,aAAa,UAAU;AAAA,IACvB,SAAS,UAAU;AAAA,IACnB,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;AAAA,IAC7B,kCAAkC,CAAC,GAAG,UAAU,MAAM;AAAA,IACtD,oCAAoC;AAAA,IACpC,GAAI,WAAW,SAAS,EAAE,WAAW,IAAI,CAAC;AAAA,IAC1C,GAAI,KAAK,WAAW,UAAU,gBAAgB;AAAA,MAC5C,aAAa;AAAA,QACX,UAAU;AAAA,QACV,SAAS,EAAE,oBAAoB,EAAE,QAAQ,WAAW,EAAE;AAAA,MACxD;AAAA,IACF,IAAI,CAAC;AAAA,IACL,WAAW,EAAE,CAAC,aAAa,GAAG,iBAAiB,GAAG,gBAAgB;AAAA,EACpE;AACF;AAEA,IAAM,UAAU;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,SAAS,EAAE,MAAM,cAAc,YAAY,aAAa;AAAA,EAC1D;AAAA,EACA,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,EACtB,oCAAoC,CAAC,GAAG,2BAA2B;AAAA,EACnE,2CAA2C;AAAA,EAC3C,+BAA+B;AAAA,IAC7B,aAAa;AAAA,IACb,gBAAgB,EAAE,iBAAiB,4CAA4C;AAAA,IAC/E,iBAAiB,EAAE,SAAS,wCAAwC,UAAU,wCAAwC;AAAA,EACxH;AAAA,EACA,8BAA8B;AAAA,IAC5B,cAAc;AAAA,IACd,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA,oCAAoC;AAAA,EACpC;AAAA,EACA,YAAY;AAAA,IACV,SAAS,EAAE,eAAe,oBAAoB;AAAA,IAC9C,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,QAAQ,SAAS,EAAE;AAAA,EACpE;AACF;AAEA,IAAM,MAAM;AAAA,EACV,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB;AAAA,EACA,OAAO,WAAW,OAAO,CAAC,UAAU,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW;AAAA,IAC7D,MAAM,MAAM,IAAK;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,gBAAgB,MAAM;AAAA,IACtB,WAAW,MAAM;AAAA,EACnB,EAAE;AACJ;AAEA,IAAM,OAAO,QAAQ,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,OAAO;AACrE,IAAM,UAAU,oBAAI,IAAI;AAAA,EACtB,CAAC,QAAQ,MAAM,qCAAqC,GAAG,uBAAuB,OAAO,CAAC;AAAA,EACtF,CAAC,QAAQ,MAAM,sCAAsC,GAAG,uBAAuB,OAAO,CAAC;AAAA,EACvF,CAAC,QAAQ,MAAM,kCAAkC,GAAG,uBAAuB,GAAG,CAAC;AAAA,EAC/E,CAAC,QAAQ,MAAM,2CAA2C,GAAG,uBAAuB,mBAAmB,CAAC,CAAC;AAC3G,CAAC;AACD,IAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS;AAC7C,IAAM,QAAkB,CAAC;AACzB,WAAW,CAAC,MAAM,QAAQ,KAAK,SAAS;AACtC,MAAI,OAAO;AACT,QAAI,UAAU;AACd,QAAI;AAAE,gBAAU,aAAa,MAAM,MAAM;AAAA,IAAG,QAAQ;AAAA,IAAC;AACrD,QAAI,0BAA0B,OAAO,MAAM,0BAA0B,QAAQ,GAAG;AAC9E,YAAM,KAAK,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC;AAAA,IACxC;AAAA,EACF,OAAO;AACL,cAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,kBAAc,MAAM,QAAQ;AAAA,EAC9B;AACF;AACA,IAAI,MAAM,QAAQ;AAChB,aAAW,QAAQ,MAAO,SAAQ,OAAO,MAAM,kCAAkC,IAAI;AAAA,CAAI;AACzF,UAAQ,WAAW;AACrB,OAAO;AACL,UAAQ,OAAO,MAAM,aAAa,QAAQ,UAAU,WAAW,KAAK,QAAQ,IAAI,eAAe,WAAW,MAAM;AAAA,CAAe;AACjI;","names":[]}

package/dist/{gateway-BqmcKam8.d.ts → gateway-DWZ3pX48.d.ts}

@@ -96,6 +96,11 @@ interface GatewayOptions {
     rowIsolationReady?: () => Promise<boolean>;
     /** Production PostgreSQL request authority. Other providers omit this. */
     requestAuthority?: RequestAuthority;
+    /** Package and source revision for deployment drift checks. */
+    implementation?: {
+        version: string;
+        revision?: string;
+    };
 }
 declare function createGateway(options: GatewayOptions): node_http.Server<typeof IncomingMessage, typeof ServerResponse>;
 

package/dist/gateway-main.js

@@ -2,6 +2,10 @@
 import {
   PostgresBridgeStore
 } from "./chunk-CVZAJ7TP.js";
+import {
+  buildRevision,
+  packageVersion
+} from "./chunk-7B3XRRNI.js";
 import {
   loadMigrationPlan,
   migrationsReady,
@@ -12,9 +16,9 @@ import "./chunk-VOQIDTCJ.js";
 import {
   PostgresCredentialResolver,
   createGateway
-} from "./chunk-FGERNG4X.js";
+} from "./chunk-LF37B6KL.js";
 import "./chunk-4V2PFJEF.js";
-import "./chunk-62C63PIE.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 
 // src/gateway-main.ts
@@ -315,6 +319,10 @@ async function main() {
   if (!databaseUrl) {
     throw new Error("AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway");
   }
+  const implementation = {
+    version: packageVersion(),
+    revision: buildRevision(process.env.AGENT_BRIDGE_BUILD_REVISION)
+  };
   const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 1e4, "request deadline");
   const databaseTimeout = integer(
     process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,
@@ -388,6 +396,7 @@ async function main() {
     allowedOrigins,
     bodyLimitBytes,
     requestDeadlineMs: deadline,
+    implementation,
     ready: schemaReady,
     rowIsolationReady: schemaReady
   });

package/dist/gateway-main.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/gateway-main.ts","../src/gateway-security.ts","../src/postgres-request-authority.ts","../src/postgres-runtime-connection.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport pg from \"pg\";\nimport { PostgresCredentialResolver } from \"./gateway-auth.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\nimport { createGateway } from \"./gateway.js\";\nimport {\n  loadMigrationPlan,\n  migrationsReady,\n  runMigrations,\n  runtimeSchemaReady,\n} from \"./migrations.js\";\nimport { PostgresBridgeStore } from \"./postgres-bridge-store.js\";\nimport { PostgresRequestAuthority } from \"./postgres-request-authority.js\";\nimport { runtimePostgresConnectionConfig } from \"./postgres-runtime-connection.js\";\n\nfunction integer(value: string | undefined, fallback: number, name: string): number {\n  if (value === undefined) return fallback;\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${name} must be a positive integer`);\n  return parsed;\n}\n\nasync function main(): Promise<void> {\n  const migrationsDirectory = fileURLToPath(new URL(\"../sql/migrations\", import.meta.url));\n  if (process.argv.includes(\"--migrate-only\")) {\n    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;\n    if (!databaseUrl) throw new Error(\"AGENT_BRIDGE_DATABASE_URL is required for migrations\");\n    const migrationPool = new pg.Pool({\n      connectionString: databaseUrl,\n      max: 1,\n      application_name: \"agent-bridge-migrator\",\n    });\n    try {\n      await runMigrations(migrationPool, migrationsDirectory);\n    } finally {\n      await migrationPool.end();\n    }\n    return;\n  }\n  if (process.env.AGENT_BRIDGE_MIGRATE === \"1\") {\n    throw new Error(\"AGENT_BRIDGE_MIGRATE is not supported; run agent-bridge migrate separately\");\n  }\n  const databaseUrl = process.env.AGENT_BRIDGE_RUNTIME_DATABASE_URL;\n  if (!databaseUrl) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway\");\n  }\n\n  const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 10_000, \"request deadline\");\n  const databaseTimeout = integer(\n    process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,\n    Math.max(1, Math.floor(deadline / 3)),\n    \"database timeout\",\n  );\n  const poolSize = integer(process.env.AGENT_BRIDGE_DATABASE_POOL_SIZE, 10, \"database pool size\");\n  const bodyLimitBytes = integer(\n    process.env.AGENT_BRIDGE_BODY_LIMIT_BYTES,\n    128 * 1024,\n    \"body limit\",\n  );\n  const host = process.env.AGENT_BRIDGE_HOST ?? \"127.0.0.1\";\n  const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, \"gateway port\");\n  const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  const migrationPlan = await loadMigrationPlan(migrationsDirectory);\n  const runtimeConnection = runtimePostgresConnectionConfig(\n    databaseUrl,\n    process.env.AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64,\n  );\n  const pool = new pg.Pool({\n    ...runtimeConnection,\n    max: poolSize,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway\",\n  });\n  const readinessPool = new pg.Pool({\n    ...runtimeConnection,\n    max: 1,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway-readiness\",\n  });\n\n  const store = new PostgresBridgeStore(pool);\n  let readinessCheckedAt = 0;\n  let readinessValue = false;\n  let readinessInFlight: Promise<boolean> | undefined;\n  const probeSchema = async () =>\n    await migrationsReady(readinessPool, migrationPlan) && await runtimeSchemaReady(readinessPool);\n  const schemaReady = (force = false): Promise<boolean> => {\n    if (!force && Date.now() - readinessCheckedAt < 1_000) {\n      return Promise.resolve(readinessValue);\n    }\n    if (readinessInFlight) return readinessInFlight;\n    let current: Promise<boolean>;\n    current = probeSchema()\n      .then((ready) => {\n        readinessValue = ready;\n        readinessCheckedAt = Date.now();\n        return ready;\n      })\n      .finally(() => {\n        if (readinessInFlight === current) readinessInFlight = undefined;\n      });\n    readinessInFlight = current;\n    return current;\n  };\n  try {\n    if (!await schemaReady(true)) {\n      throw new Error(\"runtime database is not ready for enforced row isolation\");\n    }\n  } catch (error) {\n    await Promise.allSettled([pool.end(), readinessPool.end()]);\n    throw error;\n  }\n  const gateway = createGateway({\n    store,\n    credentials: new PostgresCredentialResolver(pool),\n    security: new PostgresGatewaySecurity(pool),\n    requestAuthority: new PostgresRequestAuthority(pool),\n    allowedOrigins,\n    bodyLimitBytes,\n    requestDeadlineMs: deadline,\n    ready: schemaReady,\n    rowIsolationReady: schemaReady,\n  });\n\n  gateway.listen(port, host, () => {\n    process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}\\n`);\n  });\n\n  let stopping = false;\n  async function shutdown(): Promise<void> {\n    if (stopping) return;\n    stopping = true;\n    await new Promise<void>((resolve, reject) => {\n      gateway.close((error) => error ? reject(error) : resolve());\n    });\n    await Promise.all([pool.end(), readinessPool.end()]);\n  }\n\n  process.once(\"SIGINT\", () => void shutdown());\n  process.once(\"SIGTERM\", () => void shutdown());\n}\n\nvoid main().catch((error) => {\n  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n  process.exitCode = 1;\n});\n","import type { PgQueryable } from \"./postgres-bridge-store.js\";\nimport type { OperationId } from \"./contracts/registry.js\";\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  policyId: string | null;\n  limit: number;\n  remaining: number;\n  retryAfterSeconds: number;\n}\n\nexport interface GatewaySecurity {\n  recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void>;\n  consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision>;\n}\n\nexport class PostgresGatewaySecurity implements GatewaySecurity {\n  constructor(private readonly db: PgQueryable) {}\n\n  private functionName(bound: string, unbound: string): string {\n    return this.db.inTransaction ? bound : unbound;\n  }\n\n  async recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    if (signal?.aborted) throw signal.reason;\n    await this.db.query(\n      `SELECT agent_bridge.${this.functionName(\"record_scope_denial\", \"record_scope_denial_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n  }\n\n  async consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      allowed: boolean;\n      limit_value: string | number;\n      remaining_value: string | number;\n      retry_after_seconds: string | number;\n      denied_policy_id: string | null;\n    }>(\n      `SELECT allowed, limit_value, remaining_value, retry_after_seconds, denied_policy_id\n       FROM agent_bridge.${this.functionName(\"consume_rate_limit\", \"consume_rate_limit_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n    const row = result.rows[0];\n    if (!row) throw new Error(\"rate limit policy is missing\");\n    return {\n      allowed: row.allowed,\n      policyId: row.denied_policy_id,\n      limit: Math.max(0, Number(row.limit_value)),\n      remaining: Math.max(0, Number(row.remaining_value)),\n      retryAfterSeconds: Math.max(0, Number(row.retry_after_seconds)),\n    };\n  }\n}\n","import type pg from \"pg\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport { PostgresBridgeStore, type PgQueryable } from \"./postgres-bridge-store.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\n\nexport interface RequestAuthorityContext {\n  gatewayAuthorityId: string;\n  credential: { id: string; principal: BridgePrincipal; scopes: readonly AuthorizationScope[] };\n  store: PostgresBridgeStore;\n  security: PostgresGatewaySecurity;\n  /** Establishes the savepoint separating durable security accounting from domain work. */\n  beginDomainWork(): Promise<void>;\n  endpointMigrationChallenges?: {\n    issue(input: { challenge: string; expectedGatewayAuthorityId: string; verifierCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string }>;\n    consume(input: { challenge: string; expectedGatewayAuthorityId: string; issuerCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string | null; consumed: boolean }>;\n  };\n}\n\nexport interface RequestAuthority {\n  run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T>;\n}\n\ntype AuthorityRow = {\n  gateway_authority_id: string;\n  credential_id: string;\n  workspace_id: string;\n  principal: string;\n  scopes: AuthorizationScope[];\n};\n\nfunction timestamp(value: unknown): string {\n  if (value instanceof Date) return value.toISOString();\n  return String(value);\n}\n\nfunction endpointMigrationFailure(error: unknown): never {\n  const sqlstate = typeof error === \"object\" && error !== null && \"code\" in error\n    ? String((error as { code?: unknown }).code ?? \"\")\n    : \"\";\n  if (sqlstate === \"28000\") {\n    throw Object.assign(new Error(\"endpoint migration binding was rejected\"), {\n      status: 409,\n      code: \"endpoint_migration_binding_rejected\",\n    });\n  }\n  if (sqlstate === \"23505\") {\n    throw Object.assign(new Error(\"endpoint migration challenge conflicts with existing state\"), {\n      status: 409,\n      code: \"endpoint_migration_challenge_conflict\",\n    });\n  }\n  throw error;\n}\n\nexport class MutationOutcomeUnknownError extends Error {\n  readonly status = 503;\n  readonly code = \"mutation_outcome_unknown\";\n  constructor() { super(\"The database commit outcome is unknown\"); }\n}\n\nexport class PostgresRequestAuthority implements RequestAuthority {\n  constructor(private readonly pool: Pick<pg.Pool, \"connect\">) {}\n\n  async run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T> {\n    if (signal.aborted) throw signal.reason;\n    const client = await this.pool.connect();\n    const db: PgQueryable = { inTransaction: true, query: (sql, values) => client.query(sql, values) };\n    let transactionOpen = false;\n    let domainSavepoint = false;\n    let commitDispatched = false;\n    let commitCompleted = false;\n    let discard: Error | undefined;\n    try {\n      if (signal.aborted) throw signal.reason;\n      await client.query(\"BEGIN\");\n      transactionOpen = true;\n      const opened = await client.query<AuthorityRow>(\n        `SELECT gateway_authority_id,credential_id,workspace_id,principal,scopes\n         FROM agent_bridge.open_request_authority_bound($1::uuid,$2::text,$3::uuid)`,\n        [credentialId, credentialHash, requestId],\n      );\n      const row = opened.rows[0];\n      if (!row) {\n        await client.query(\"ROLLBACK\");\n        transactionOpen = false;\n        throw Object.assign(new Error(\"Credential is not active\"), { status: 401, code: \"unauthorized\" });\n      }\n      if (signal.aborted) throw signal.reason;\n      const context: RequestAuthorityContext = {\n        gatewayAuthorityId: row.gateway_authority_id,\n        credential: { id: row.credential_id, principal: { workspace: row.workspace_id, agent: row.principal }, scopes: row.scopes },\n        store: new PostgresBridgeStore(db),\n        security: new PostgresGatewaySecurity(db),\n        beginDomainWork: async () => {\n          if (domainSavepoint) return;\n          if (signal.aborted) throw signal.reason;\n          await client.query(\"SAVEPOINT agent_bridge_domain_work\");\n          if (signal.aborted) throw signal.reason;\n          domainSavepoint = true;\n        },\n        endpointMigrationChallenges: {\n          issue: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at\n                 FROM agent_bridge.issue_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.verifierCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be issued\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: timestamp(row.expires_at),\n            };\n          },\n          consume: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date | null;\n                consumed: boolean;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at,consumed\n                 FROM agent_bridge.consume_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.issuerCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be consumed\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: row.expires_at === null ? null : timestamp(row.expires_at),\n              consumed: row.consumed,\n            };\n          },\n        },\n      };\n      try {\n        const result = await work(context);\n        if (signal.aborted) throw signal.reason;\n        await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        return result;\n      } catch (error) {\n        if (commitDispatched) throw new MutationOutcomeUnknownError();\n        if (signal.aborted) throw error;\n        try {\n          if (domainSavepoint) {\n            await client.query(\"ROLLBACK TO SAVEPOINT agent_bridge_domain_work\");\n          }\n          await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        } catch {\n          try {\n            await client.query(\"ROLLBACK\");\n          } catch (rollbackError) {\n            discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));\n          }\n          transactionOpen = false;\n          throw error;\n        }\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        throw error;\n      }\n    } catch (error) {\n      if (commitDispatched && !commitCompleted) {\n        discard = error instanceof Error ? error : new Error(String(error));\n        throw error instanceof MutationOutcomeUnknownError ? error : new MutationOutcomeUnknownError();\n      }\n      if (transactionOpen) {\n        try { await client.query(\"ROLLBACK\"); transactionOpen = false; }\n        catch (rollbackError) { discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError)); }\n      }\n      throw error;\n    } finally {\n      client.release(discard);\n    }\n  }\n\n}\n","import type { PoolConfig } from \"pg\";\n\nconst MAX_CA_PEM_BYTES = 256 * 1024;\nconst BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;\nconst CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]+-----END CERTIFICATE-----/u;\nconst CLIENT_CERTIFICATE_PARAMETERS = [\n  \"sslcert\",\n  \"sslkey\",\n  \"sslpassword\",\n] as const;\n\nfunction decodeCaPem(encoded: string): string {\n  const value = encoded.trim();\n  if (!value) throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be empty\");\n  if (!BASE64_PATTERN.test(value)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  const bytes = Buffer.from(value, \"base64\");\n  if (bytes.toString(\"base64\") !== value) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  if (bytes.byteLength > MAX_CA_PEM_BYTES) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 exceeds 256 KiB after decoding\");\n  }\n  const pem = bytes.toString(\"utf8\").trim();\n  if (pem.includes(\"\\0\") || !CERTIFICATE_PATTERN.test(pem)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must decode to a PEM certificate bundle\");\n  }\n  return pem;\n}\n\nexport function runtimePostgresConnectionConfig(\n  connectionString: string,\n  caBase64: string | undefined,\n): Pick<PoolConfig, \"connectionString\" | \"ssl\"> {\n  if (caBase64 === undefined) return { connectionString };\n\n  let parsed: URL;\n  try {\n    parsed = new URL(connectionString);\n  } catch {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must be a valid PostgreSQL URL\");\n  }\n  if (parsed.protocol !== \"postgresql:\" && parsed.protocol !== \"postgres:\") {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must use postgresql:// or postgres://\");\n  }\n\n  if (CLIENT_CERTIFICATE_PARAMETERS.some((parameter) => parsed.searchParams.has(parameter))) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with client certificate URL parameters\",\n    );\n  }\n  if (parsed.searchParams.has(\"ssl\")) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with the ssl URL parameter\",\n    );\n  }\n  parsed.searchParams.delete(\"sslmode\");\n  parsed.searchParams.delete(\"sslrootcert\");\n  return {\n    connectionString: parsed.toString(),\n    ssl: {\n      ca: decodeCaPem(caBase64),\n      rejectUnauthorized: true,\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,QAAQ;;;ACyBR,IAAM,0BAAN,MAAyD;AAAA,EAC9D,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAEvC,aAAa,OAAe,SAAyB;AAC3D,WAAO,KAAK,GAAG,gBAAgB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAM,kBACJ,cACA,aACA,WACA,QACe;AACf,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,KAAK,GAAG;AAAA,MACZ,uBAAuB,KAAK,aAAa,uBAAuB,iCAAiC,CAAC;AAAA,MAClG,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAAA,EACpC;AAAA,EAEA,MAAM,QACJ,cACA,aACA,WACA,QAC4B;AAC5B,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAO3B;AAAA,2BACqB,KAAK,aAAa,sBAAsB,gCAAgC,CAAC;AAAA,MAC9F,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8BAA8B;AACxD,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,MAC1C,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,eAAe,CAAC;AAAA,MAClD,mBAAmB,KAAK,IAAI,GAAG,OAAO,IAAI,mBAAmB,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;AC7CA,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,yBAAyB,OAAuB;AACvD,QAAM,WAAW,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACtE,OAAQ,MAA6B,QAAQ,EAAE,IAC/C;AACJ,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,yCAAyC,GAAG;AAAA,MACxE,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,4DAA4D,GAAG;AAAA,MAC3F,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM;AACR;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,cAAc;AAAE,UAAM,wCAAwC;AAF9D,SAAS,SAAS;AAClB,SAAS,OAAO;AAAA,EACiD;AACnE;AAEO,IAAM,2BAAN,MAA2D;AAAA,EAChE,YAA6B,MAAgC;AAAhC;AAAA,EAAiC;AAAA,EAE9D,MAAM,IAAO,cAAsB,gBAAwB,WAAmB,QAAqB,MAAoE;AACrK,QAAI,OAAO,QAAS,OAAM,OAAO;AACjC,UAAM,SAAS,MAAM,KAAK,KAAK,QAAQ;AACvC,UAAM,KAAkB,EAAE,eAAe,MAAM,OAAO,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,MAAM,EAAE;AACjG,QAAI,kBAAkB;AACtB,QAAI,kBAAkB;AACtB,QAAI,mBAAmB;AACvB,QAAI,kBAAkB;AACtB,QAAI;AACJ,QAAI;AACF,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,OAAO,MAAM,OAAO;AAC1B,wBAAkB;AAClB,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B;AAAA;AAAA,QAEA,CAAC,cAAc,gBAAgB,SAAS;AAAA,MAC1C;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,KAAK;AACR,cAAM,OAAO,MAAM,UAAU;AAC7B,0BAAkB;AAClB,cAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG,EAAE,QAAQ,KAAK,MAAM,eAAe,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,UAAmC;AAAA,QACvC,oBAAoB,IAAI;AAAA,QACxB,YAAY,EAAE,IAAI,IAAI,eAAe,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU,GAAG,QAAQ,IAAI,OAAO;AAAA,QAC1H,OAAO,IAAI,oBAAoB,EAAE;AAAA,QACjC,UAAU,IAAI,wBAAwB,EAAE;AAAA,QACxC,iBAAiB,YAAY;AAC3B,cAAI,gBAAiB;AACrB,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,gBAAM,OAAO,MAAM,oCAAoC;AACvD,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,4BAAkB;AAAA,QACpB;AAAA,QACA,6BAA6B;AAAA,UAC3B,OAAO,OAAO,UAAU;AACtB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAMpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,sBAAsB,MAAM,SAAS;AAAA,cAChF;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,kDAAkD;AAC5E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAW,UAAUA,KAAI,UAAU;AAAA,YACrC;AAAA,UACF;AAAA,UACA,SAAS,OAAO,UAAU;AACxB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAOpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,oBAAoB,MAAM,SAAS;AAAA,cAC9E;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,oDAAoD;AAC9E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAWA,KAAI,eAAe,OAAO,OAAO,UAAUA,KAAI,UAAU;AAAA,cACpE,UAAUA,KAAI;AAAA,YAChB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,cAAM,OAAO,MAAM,+CAA+C;AAClE,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAkB,OAAM,IAAI,4BAA4B;AAC5D,YAAI,OAAO,QAAS,OAAM;AAC1B,YAAI;AACF,cAAI,iBAAiB;AACnB,kBAAM,OAAO,MAAM,gDAAgD;AAAA,UACrE;AACA,gBAAM,OAAO,MAAM,+CAA+C;AAAA,QACpE,QAAQ;AACN,cAAI;AACF,kBAAM,OAAO,MAAM,UAAU;AAAA,UAC/B,SAAS,eAAe;AACtB,sBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,UAC5F;AACA,4BAAkB;AAClB,gBAAM;AAAA,QACR;AACA,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,cAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAO;AACd,UAAI,oBAAoB,CAAC,iBAAiB;AACxC,kBAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAClE,cAAM,iBAAiB,8BAA8B,QAAQ,IAAI,4BAA4B;AAAA,MAC/F;AACA,UAAI,iBAAiB;AACnB,YAAI;AAAE,gBAAM,OAAO,MAAM,UAAU;AAAG,4BAAkB;AAAA,QAAO,SACxD,eAAe;AAAE,oBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,QAAG;AAAA,MACvH;AACA,YAAM;AAAA,IACR,UAAE;AACA,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AAEF;;;AC3MA,IAAM,mBAAmB,MAAM;AAC/B,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,YAAY,SAAyB;AAC5C,QAAM,QAAQ,QAAQ,KAAK;AAC3B,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yDAAyD;AACrF,MAAI,CAAC,eAAe,KAAK,KAAK,GAAG;AAC/B,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ;AACzC,MAAI,MAAM,SAAS,QAAQ,MAAM,OAAO;AACtC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,MAAM,aAAa,kBAAkB;AACvC,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,MAAM,MAAM,SAAS,MAAM,EAAE,KAAK;AACxC,MAAI,IAAI,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,GAAG,GAAG;AACxD,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AACA,SAAO;AACT;AAEO,SAAS,gCACd,kBACA,UAC8C;AAC9C,MAAI,aAAa,OAAW,QAAO,EAAE,iBAAiB;AAEtD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,gBAAgB;AAAA,EACnC,QAAQ;AACN,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,OAAO,aAAa,iBAAiB,OAAO,aAAa,aAAa;AACxE,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AAEA,MAAI,8BAA8B,KAAK,CAAC,cAAc,OAAO,aAAa,IAAI,SAAS,CAAC,GAAG;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,aAAa,IAAI,KAAK,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,OAAO,SAAS;AACpC,SAAO,aAAa,OAAO,aAAa;AACxC,SAAO;AAAA,IACL,kBAAkB,OAAO,SAAS;AAAA,IAClC,KAAK;AAAA,MACH,IAAI,YAAY,QAAQ;AAAA,MACxB,oBAAoB;AAAA,IACtB;AAAA,EACF;AACF;;;AHnDA,SAAS,QAAQ,OAA2B,UAAkB,MAAsB;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACrG,SAAO;AACT;AAEA,eAAe,OAAsB;AACnC,QAAM,sBAAsB,cAAc,IAAI,IAAI,qBAAqB,YAAY,GAAG,CAAC;AACvF,MAAI,QAAQ,KAAK,SAAS,gBAAgB,GAAG;AAC3C,UAAMC,eAAc,QAAQ,IAAI;AAChC,QAAI,CAACA,aAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,MAChC,kBAAkBA;AAAA,MAClB,KAAK;AAAA,MACL,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI;AACF,YAAM,cAAc,eAAe,mBAAmB;AAAA,IACxD,UAAE;AACA,YAAM,cAAc,IAAI;AAAA,IAC1B;AACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,yBAAyB,KAAK;AAC5C,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,kCAAkC,KAAQ,kBAAkB;AACjG,QAAM,kBAAkB;AAAA,IACtB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,QAAQ,IAAI,iCAAiC,IAAI,oBAAoB;AAC9F,QAAM,iBAAiB;AAAA,IACrB,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,IAAI,qBAAqB;AAC9C,QAAM,OAAO,QAAQ,QAAQ,IAAI,mBAAmB,MAAM,cAAc;AACxE,QAAM,iBAAiB,QAAQ,IAAI,8BAC/B,MAAM,GAAG,EACV,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AACjB,QAAM,gBAAgB,MAAM,kBAAkB,mBAAmB;AACjE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ,IAAI;AAAA,EACd;AACA,QAAM,OAAO,IAAI,GAAG,KAAK;AAAA,IACvB,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IAChC,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,QAAQ,IAAI,oBAAoB,IAAI;AAC1C,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AACrB,MAAI;AACJ,QAAM,cAAc,YAClB,MAAM,gBAAgB,eAAe,aAAa,KAAK,MAAM,mBAAmB,aAAa;AAC/F,QAAM,cAAc,CAAC,QAAQ,UAA4B;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,qBAAqB,KAAO;AACrD,aAAO,QAAQ,QAAQ,cAAc;AAAA,IACvC;AACA,QAAI,kBAAmB,QAAO;AAC9B,QAAI;AACJ,cAAU,YAAY,EACnB,KAAK,CAAC,UAAU;AACf,uBAAiB;AACjB,2BAAqB,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,sBAAsB,QAAS,qBAAoB;AAAA,IACzD,CAAC;AACH,wBAAoB;AACpB,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,CAAC,MAAM,YAAY,IAAI,GAAG;AAC5B,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAC1D,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA,aAAa,IAAI,2BAA2B,IAAI;AAAA,IAChD,UAAU,IAAI,wBAAwB,IAAI;AAAA,IAC1C,kBAAkB,IAAI,yBAAyB,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,OAAO;AAAA,IACP,mBAAmB;AAAA,EACrB,CAAC;AAED,UAAQ,OAAO,MAAM,MAAM,MAAM;AAC/B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AAED,MAAI,WAAW;AACf,iBAAe,WAA0B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAQ,MAAM,CAAC,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,IAC5D,CAAC;AACD,UAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAAA,EACrD;AAEA,UAAQ,KAAK,UAAU,MAAM,KAAK,SAAS,CAAC;AAC5C,UAAQ,KAAK,WAAW,MAAM,KAAK,SAAS,CAAC;AAC/C;AAEA,KAAK,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3B,UAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AAClF,UAAQ,WAAW;AACrB,CAAC;","names":["row","databaseUrl"]}
+{"version":3,"sources":["../src/gateway-main.ts","../src/gateway-security.ts","../src/postgres-request-authority.ts","../src/postgres-runtime-connection.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport pg from \"pg\";\nimport { PostgresCredentialResolver } from \"./gateway-auth.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\nimport { createGateway } from \"./gateway.js\";\nimport {\n  loadMigrationPlan,\n  migrationsReady,\n  runMigrations,\n  runtimeSchemaReady,\n} from \"./migrations.js\";\nimport { PostgresBridgeStore } from \"./postgres-bridge-store.js\";\nimport { PostgresRequestAuthority } from \"./postgres-request-authority.js\";\nimport { runtimePostgresConnectionConfig } from \"./postgres-runtime-connection.js\";\nimport { buildRevision, packageVersion } from \"./package-metadata.js\";\n\nfunction integer(value: string | undefined, fallback: number, name: string): number {\n  if (value === undefined) return fallback;\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${name} must be a positive integer`);\n  return parsed;\n}\n\nasync function main(): Promise<void> {\n  const migrationsDirectory = fileURLToPath(new URL(\"../sql/migrations\", import.meta.url));\n  if (process.argv.includes(\"--migrate-only\")) {\n    const databaseUrl = process.env.AGENT_BRIDGE_DATABASE_URL;\n    if (!databaseUrl) throw new Error(\"AGENT_BRIDGE_DATABASE_URL is required for migrations\");\n    const migrationPool = new pg.Pool({\n      connectionString: databaseUrl,\n      max: 1,\n      application_name: \"agent-bridge-migrator\",\n    });\n    try {\n      await runMigrations(migrationPool, migrationsDirectory);\n    } finally {\n      await migrationPool.end();\n    }\n    return;\n  }\n  if (process.env.AGENT_BRIDGE_MIGRATE === \"1\") {\n    throw new Error(\"AGENT_BRIDGE_MIGRATE is not supported; run agent-bridge migrate separately\");\n  }\n  const databaseUrl = process.env.AGENT_BRIDGE_RUNTIME_DATABASE_URL;\n  if (!databaseUrl) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL is required for the gateway\");\n  }\n  const implementation = {\n    version: packageVersion(),\n    revision: buildRevision(process.env.AGENT_BRIDGE_BUILD_REVISION),\n  };\n\n  const deadline = integer(process.env.AGENT_BRIDGE_REQUEST_DEADLINE_MS, 10_000, \"request deadline\");\n  const databaseTimeout = integer(\n    process.env.AGENT_BRIDGE_DATABASE_TIMEOUT_MS,\n    Math.max(1, Math.floor(deadline / 3)),\n    \"database timeout\",\n  );\n  const poolSize = integer(process.env.AGENT_BRIDGE_DATABASE_POOL_SIZE, 10, \"database pool size\");\n  const bodyLimitBytes = integer(\n    process.env.AGENT_BRIDGE_BODY_LIMIT_BYTES,\n    128 * 1024,\n    \"body limit\",\n  );\n  const host = process.env.AGENT_BRIDGE_HOST ?? \"127.0.0.1\";\n  const port = integer(process.env.AGENT_BRIDGE_PORT, 8787, \"gateway port\");\n  const allowedOrigins = process.env.AGENT_BRIDGE_ALLOWED_ORIGINS\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  const migrationPlan = await loadMigrationPlan(migrationsDirectory);\n  const runtimeConnection = runtimePostgresConnectionConfig(\n    databaseUrl,\n    process.env.AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64,\n  );\n  const pool = new pg.Pool({\n    ...runtimeConnection,\n    max: poolSize,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway\",\n  });\n  const readinessPool = new pg.Pool({\n    ...runtimeConnection,\n    max: 1,\n    connectionTimeoutMillis: databaseTimeout,\n    query_timeout: databaseTimeout,\n    statement_timeout: databaseTimeout,\n    application_name: \"agent-bridge-gateway-readiness\",\n  });\n\n  const store = new PostgresBridgeStore(pool);\n  let readinessCheckedAt = 0;\n  let readinessValue = false;\n  let readinessInFlight: Promise<boolean> | undefined;\n  const probeSchema = async () =>\n    await migrationsReady(readinessPool, migrationPlan) && await runtimeSchemaReady(readinessPool);\n  const schemaReady = (force = false): Promise<boolean> => {\n    if (!force && Date.now() - readinessCheckedAt < 1_000) {\n      return Promise.resolve(readinessValue);\n    }\n    if (readinessInFlight) return readinessInFlight;\n    let current: Promise<boolean>;\n    current = probeSchema()\n      .then((ready) => {\n        readinessValue = ready;\n        readinessCheckedAt = Date.now();\n        return ready;\n      })\n      .finally(() => {\n        if (readinessInFlight === current) readinessInFlight = undefined;\n      });\n    readinessInFlight = current;\n    return current;\n  };\n  try {\n    if (!await schemaReady(true)) {\n      throw new Error(\"runtime database is not ready for enforced row isolation\");\n    }\n  } catch (error) {\n    await Promise.allSettled([pool.end(), readinessPool.end()]);\n    throw error;\n  }\n  const gateway = createGateway({\n    store,\n    credentials: new PostgresCredentialResolver(pool),\n    security: new PostgresGatewaySecurity(pool),\n    requestAuthority: new PostgresRequestAuthority(pool),\n    allowedOrigins,\n    bodyLimitBytes,\n    requestDeadlineMs: deadline,\n    implementation,\n    ready: schemaReady,\n    rowIsolationReady: schemaReady,\n  });\n\n  gateway.listen(port, host, () => {\n    process.stderr.write(`Agent Bridge gateway listening on ${host}:${port}\\n`);\n  });\n\n  let stopping = false;\n  async function shutdown(): Promise<void> {\n    if (stopping) return;\n    stopping = true;\n    await new Promise<void>((resolve, reject) => {\n      gateway.close((error) => error ? reject(error) : resolve());\n    });\n    await Promise.all([pool.end(), readinessPool.end()]);\n  }\n\n  process.once(\"SIGINT\", () => void shutdown());\n  process.once(\"SIGTERM\", () => void shutdown());\n}\n\nvoid main().catch((error) => {\n  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n  process.exitCode = 1;\n});\n","import type { PgQueryable } from \"./postgres-bridge-store.js\";\nimport type { OperationId } from \"./contracts/registry.js\";\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  policyId: string | null;\n  limit: number;\n  remaining: number;\n  retryAfterSeconds: number;\n}\n\nexport interface GatewaySecurity {\n  recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void>;\n  consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision>;\n}\n\nexport class PostgresGatewaySecurity implements GatewaySecurity {\n  constructor(private readonly db: PgQueryable) {}\n\n  private functionName(bound: string, unbound: string): string {\n    return this.db.inTransaction ? bound : unbound;\n  }\n\n  async recordScopeDenial(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    if (signal?.aborted) throw signal.reason;\n    await this.db.query(\n      `SELECT agent_bridge.${this.functionName(\"record_scope_denial\", \"record_scope_denial_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n  }\n\n  async consume(\n    credentialId: string,\n    operationId: OperationId,\n    requestId: string,\n    signal?: AbortSignal,\n  ): Promise<RateLimitDecision> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      allowed: boolean;\n      limit_value: string | number;\n      remaining_value: string | number;\n      retry_after_seconds: string | number;\n      denied_policy_id: string | null;\n    }>(\n      `SELECT allowed, limit_value, remaining_value, retry_after_seconds, denied_policy_id\n       FROM agent_bridge.${this.functionName(\"consume_rate_limit\", \"consume_rate_limit_unbound_011\")}($1::uuid, $2::text, $3::uuid)`,\n      [credentialId, operationId, requestId],\n    );\n    if (signal?.aborted) throw signal.reason;\n    const row = result.rows[0];\n    if (!row) throw new Error(\"rate limit policy is missing\");\n    return {\n      allowed: row.allowed,\n      policyId: row.denied_policy_id,\n      limit: Math.max(0, Number(row.limit_value)),\n      remaining: Math.max(0, Number(row.remaining_value)),\n      retryAfterSeconds: Math.max(0, Number(row.retry_after_seconds)),\n    };\n  }\n}\n","import type pg from \"pg\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport { PostgresBridgeStore, type PgQueryable } from \"./postgres-bridge-store.js\";\nimport { PostgresGatewaySecurity } from \"./gateway-security.js\";\n\nexport interface RequestAuthorityContext {\n  gatewayAuthorityId: string;\n  credential: { id: string; principal: BridgePrincipal; scopes: readonly AuthorizationScope[] };\n  store: PostgresBridgeStore;\n  security: PostgresGatewaySecurity;\n  /** Establishes the savepoint separating durable security accounting from domain work. */\n  beginDomainWork(): Promise<void>;\n  endpointMigrationChallenges?: {\n    issue(input: { challenge: string; expectedGatewayAuthorityId: string; verifierCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string }>;\n    consume(input: { challenge: string; expectedGatewayAuthorityId: string; issuerCredentialId: string }): Promise<{ gatewayAuthorityId: string; issuerCredentialId: string; verifierCredentialId: string; expiresAt: string | null; consumed: boolean }>;\n  };\n}\n\nexport interface RequestAuthority {\n  run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T>;\n}\n\ntype AuthorityRow = {\n  gateway_authority_id: string;\n  credential_id: string;\n  workspace_id: string;\n  principal: string;\n  scopes: AuthorizationScope[];\n};\n\nfunction timestamp(value: unknown): string {\n  if (value instanceof Date) return value.toISOString();\n  return String(value);\n}\n\nfunction endpointMigrationFailure(error: unknown): never {\n  const sqlstate = typeof error === \"object\" && error !== null && \"code\" in error\n    ? String((error as { code?: unknown }).code ?? \"\")\n    : \"\";\n  if (sqlstate === \"28000\") {\n    throw Object.assign(new Error(\"endpoint migration binding was rejected\"), {\n      status: 409,\n      code: \"endpoint_migration_binding_rejected\",\n    });\n  }\n  if (sqlstate === \"23505\") {\n    throw Object.assign(new Error(\"endpoint migration challenge conflicts with existing state\"), {\n      status: 409,\n      code: \"endpoint_migration_challenge_conflict\",\n    });\n  }\n  throw error;\n}\n\nexport class MutationOutcomeUnknownError extends Error {\n  readonly status = 503;\n  readonly code = \"mutation_outcome_unknown\";\n  constructor() { super(\"The database commit outcome is unknown\"); }\n}\n\nexport class PostgresRequestAuthority implements RequestAuthority {\n  constructor(private readonly pool: Pick<pg.Pool, \"connect\">) {}\n\n  async run<T>(credentialId: string, credentialHash: string, requestId: string, signal: AbortSignal, work: (context: RequestAuthorityContext) => Promise<T>): Promise<T> {\n    if (signal.aborted) throw signal.reason;\n    const client = await this.pool.connect();\n    const db: PgQueryable = { inTransaction: true, query: (sql, values) => client.query(sql, values) };\n    let transactionOpen = false;\n    let domainSavepoint = false;\n    let commitDispatched = false;\n    let commitCompleted = false;\n    let discard: Error | undefined;\n    try {\n      if (signal.aborted) throw signal.reason;\n      await client.query(\"BEGIN\");\n      transactionOpen = true;\n      const opened = await client.query<AuthorityRow>(\n        `SELECT gateway_authority_id,credential_id,workspace_id,principal,scopes\n         FROM agent_bridge.open_request_authority_bound($1::uuid,$2::text,$3::uuid)`,\n        [credentialId, credentialHash, requestId],\n      );\n      const row = opened.rows[0];\n      if (!row) {\n        await client.query(\"ROLLBACK\");\n        transactionOpen = false;\n        throw Object.assign(new Error(\"Credential is not active\"), { status: 401, code: \"unauthorized\" });\n      }\n      if (signal.aborted) throw signal.reason;\n      const context: RequestAuthorityContext = {\n        gatewayAuthorityId: row.gateway_authority_id,\n        credential: { id: row.credential_id, principal: { workspace: row.workspace_id, agent: row.principal }, scopes: row.scopes },\n        store: new PostgresBridgeStore(db),\n        security: new PostgresGatewaySecurity(db),\n        beginDomainWork: async () => {\n          if (domainSavepoint) return;\n          if (signal.aborted) throw signal.reason;\n          await client.query(\"SAVEPOINT agent_bridge_domain_work\");\n          if (signal.aborted) throw signal.reason;\n          domainSavepoint = true;\n        },\n        endpointMigrationChallenges: {\n          issue: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at\n                 FROM agent_bridge.issue_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.verifierCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be issued\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: timestamp(row.expires_at),\n            };\n          },\n          consume: async (input) => {\n            let result;\n            try {\n              result = await client.query<{\n                gateway_authority_id: string;\n                issuer_credential_id: string;\n                verifier_credential_id: string;\n                expires_at: string | Date | null;\n                consumed: boolean;\n              }>(\n                `SELECT gateway_authority_id,issuer_credential_id,verifier_credential_id,expires_at,consumed\n                 FROM agent_bridge.consume_endpoint_migration_challenge($1::uuid,$2::uuid,$3::text)`,\n                [input.expectedGatewayAuthorityId, input.issuerCredentialId, input.challenge],\n              );\n            } catch (error) {\n              endpointMigrationFailure(error);\n            }\n            const row = result.rows[0];\n            if (!row) throw new Error(\"endpoint migration challenge could not be consumed\");\n            return {\n              gatewayAuthorityId: row.gateway_authority_id,\n              issuerCredentialId: row.issuer_credential_id,\n              verifierCredentialId: row.verifier_credential_id,\n              expiresAt: row.expires_at === null ? null : timestamp(row.expires_at),\n              consumed: row.consumed,\n            };\n          },\n        },\n      };\n      try {\n        const result = await work(context);\n        if (signal.aborted) throw signal.reason;\n        await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        return result;\n      } catch (error) {\n        if (commitDispatched) throw new MutationOutcomeUnknownError();\n        if (signal.aborted) throw error;\n        try {\n          if (domainSavepoint) {\n            await client.query(\"ROLLBACK TO SAVEPOINT agent_bridge_domain_work\");\n          }\n          await client.query(\"SELECT agent_bridge.close_request_authority()\");\n        } catch {\n          try {\n            await client.query(\"ROLLBACK\");\n          } catch (rollbackError) {\n            discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));\n          }\n          transactionOpen = false;\n          throw error;\n        }\n        if (signal.aborted) throw signal.reason;\n        commitDispatched = true;\n        await client.query(\"COMMIT\");\n        commitCompleted = true;\n        transactionOpen = false;\n        throw error;\n      }\n    } catch (error) {\n      if (commitDispatched && !commitCompleted) {\n        discard = error instanceof Error ? error : new Error(String(error));\n        throw error instanceof MutationOutcomeUnknownError ? error : new MutationOutcomeUnknownError();\n      }\n      if (transactionOpen) {\n        try { await client.query(\"ROLLBACK\"); transactionOpen = false; }\n        catch (rollbackError) { discard = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError)); }\n      }\n      throw error;\n    } finally {\n      client.release(discard);\n    }\n  }\n\n}\n","import type { PoolConfig } from \"pg\";\n\nconst MAX_CA_PEM_BYTES = 256 * 1024;\nconst BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;\nconst CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]+-----END CERTIFICATE-----/u;\nconst CLIENT_CERTIFICATE_PARAMETERS = [\n  \"sslcert\",\n  \"sslkey\",\n  \"sslpassword\",\n] as const;\n\nfunction decodeCaPem(encoded: string): string {\n  const value = encoded.trim();\n  if (!value) throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be empty\");\n  if (!BASE64_PATTERN.test(value)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  const bytes = Buffer.from(value, \"base64\");\n  if (bytes.toString(\"base64\") !== value) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must be canonical base64\");\n  }\n  if (bytes.byteLength > MAX_CA_PEM_BYTES) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 exceeds 256 KiB after decoding\");\n  }\n  const pem = bytes.toString(\"utf8\").trim();\n  if (pem.includes(\"\\0\") || !CERTIFICATE_PATTERN.test(pem)) {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 must decode to a PEM certificate bundle\");\n  }\n  return pem;\n}\n\nexport function runtimePostgresConnectionConfig(\n  connectionString: string,\n  caBase64: string | undefined,\n): Pick<PoolConfig, \"connectionString\" | \"ssl\"> {\n  if (caBase64 === undefined) return { connectionString };\n\n  let parsed: URL;\n  try {\n    parsed = new URL(connectionString);\n  } catch {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must be a valid PostgreSQL URL\");\n  }\n  if (parsed.protocol !== \"postgresql:\" && parsed.protocol !== \"postgres:\") {\n    throw new Error(\"AGENT_BRIDGE_RUNTIME_DATABASE_URL must use postgresql:// or postgres://\");\n  }\n\n  if (CLIENT_CERTIFICATE_PARAMETERS.some((parameter) => parsed.searchParams.has(parameter))) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with client certificate URL parameters\",\n    );\n  }\n  if (parsed.searchParams.has(\"ssl\")) {\n    throw new Error(\n      \"AGENT_BRIDGE_RUNTIME_DATABASE_CA_BASE64 cannot be combined with the ssl URL parameter\",\n    );\n  }\n  parsed.searchParams.delete(\"sslmode\");\n  parsed.searchParams.delete(\"sslrootcert\");\n  return {\n    connectionString: parsed.toString(),\n    ssl: {\n      ca: decodeCaPem(caBase64),\n      rejectUnauthorized: true,\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,QAAQ;;;ACyBR,IAAM,0BAAN,MAAyD;AAAA,EAC9D,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAEvC,aAAa,OAAe,SAAyB;AAC3D,WAAO,KAAK,GAAG,gBAAgB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAM,kBACJ,cACA,aACA,WACA,QACe;AACf,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,KAAK,GAAG;AAAA,MACZ,uBAAuB,KAAK,aAAa,uBAAuB,iCAAiC,CAAC;AAAA,MAClG,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAAA,EACpC;AAAA,EAEA,MAAM,QACJ,cACA,aACA,WACA,QAC4B;AAC5B,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAO3B;AAAA,2BACqB,KAAK,aAAa,sBAAsB,gCAAgC,CAAC;AAAA,MAC9F,CAAC,cAAc,aAAa,SAAS;AAAA,IACvC;AACA,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8BAA8B;AACxD,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,MAC1C,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,eAAe,CAAC;AAAA,MAClD,mBAAmB,KAAK,IAAI,GAAG,OAAO,IAAI,mBAAmB,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;AC7CA,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,yBAAyB,OAAuB;AACvD,QAAM,WAAW,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACtE,OAAQ,MAA6B,QAAQ,EAAE,IAC/C;AACJ,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,yCAAyC,GAAG;AAAA,MACxE,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,OAAO,IAAI,MAAM,4DAA4D,GAAG;AAAA,MAC3F,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM;AACR;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,cAAc;AAAE,UAAM,wCAAwC;AAF9D,SAAS,SAAS;AAClB,SAAS,OAAO;AAAA,EACiD;AACnE;AAEO,IAAM,2BAAN,MAA2D;AAAA,EAChE,YAA6B,MAAgC;AAAhC;AAAA,EAAiC;AAAA,EAE9D,MAAM,IAAO,cAAsB,gBAAwB,WAAmB,QAAqB,MAAoE;AACrK,QAAI,OAAO,QAAS,OAAM,OAAO;AACjC,UAAM,SAAS,MAAM,KAAK,KAAK,QAAQ;AACvC,UAAM,KAAkB,EAAE,eAAe,MAAM,OAAO,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,MAAM,EAAE;AACjG,QAAI,kBAAkB;AACtB,QAAI,kBAAkB;AACtB,QAAI,mBAAmB;AACvB,QAAI,kBAAkB;AACtB,QAAI;AACJ,QAAI;AACF,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,OAAO,MAAM,OAAO;AAC1B,wBAAkB;AAClB,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B;AAAA;AAAA,QAEA,CAAC,cAAc,gBAAgB,SAAS;AAAA,MAC1C;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,KAAK;AACR,cAAM,OAAO,MAAM,UAAU;AAC7B,0BAAkB;AAClB,cAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG,EAAE,QAAQ,KAAK,MAAM,eAAe,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAS,OAAM,OAAO;AACjC,YAAM,UAAmC;AAAA,QACvC,oBAAoB,IAAI;AAAA,QACxB,YAAY,EAAE,IAAI,IAAI,eAAe,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU,GAAG,QAAQ,IAAI,OAAO;AAAA,QAC1H,OAAO,IAAI,oBAAoB,EAAE;AAAA,QACjC,UAAU,IAAI,wBAAwB,EAAE;AAAA,QACxC,iBAAiB,YAAY;AAC3B,cAAI,gBAAiB;AACrB,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,gBAAM,OAAO,MAAM,oCAAoC;AACvD,cAAI,OAAO,QAAS,OAAM,OAAO;AACjC,4BAAkB;AAAA,QACpB;AAAA,QACA,6BAA6B;AAAA,UAC3B,OAAO,OAAO,UAAU;AACtB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAMpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,sBAAsB,MAAM,SAAS;AAAA,cAChF;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,kDAAkD;AAC5E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAW,UAAUA,KAAI,UAAU;AAAA,YACrC;AAAA,UACF;AAAA,UACA,SAAS,OAAO,UAAU;AACxB,gBAAI;AACJ,gBAAI;AACF,uBAAS,MAAM,OAAO;AAAA,gBAOpB;AAAA;AAAA,gBAEA,CAAC,MAAM,4BAA4B,MAAM,oBAAoB,MAAM,SAAS;AAAA,cAC9E;AAAA,YACF,SAAS,OAAO;AACd,uCAAyB,KAAK;AAAA,YAChC;AACA,kBAAMA,OAAM,OAAO,KAAK,CAAC;AACzB,gBAAI,CAACA,KAAK,OAAM,IAAI,MAAM,oDAAoD;AAC9E,mBAAO;AAAA,cACL,oBAAoBA,KAAI;AAAA,cACxB,oBAAoBA,KAAI;AAAA,cACxB,sBAAsBA,KAAI;AAAA,cAC1B,WAAWA,KAAI,eAAe,OAAO,OAAO,UAAUA,KAAI,UAAU;AAAA,cACpE,UAAUA,KAAI;AAAA,YAChB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,cAAM,OAAO,MAAM,+CAA+C;AAClE,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAkB,OAAM,IAAI,4BAA4B;AAC5D,YAAI,OAAO,QAAS,OAAM;AAC1B,YAAI;AACF,cAAI,iBAAiB;AACnB,kBAAM,OAAO,MAAM,gDAAgD;AAAA,UACrE;AACA,gBAAM,OAAO,MAAM,+CAA+C;AAAA,QACpE,QAAQ;AACN,cAAI;AACF,kBAAM,OAAO,MAAM,UAAU;AAAA,UAC/B,SAAS,eAAe;AACtB,sBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,UAC5F;AACA,4BAAkB;AAClB,gBAAM;AAAA,QACR;AACA,YAAI,OAAO,QAAS,OAAM,OAAO;AACjC,2BAAmB;AACnB,cAAM,OAAO,MAAM,QAAQ;AAC3B,0BAAkB;AAClB,0BAAkB;AAClB,cAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAO;AACd,UAAI,oBAAoB,CAAC,iBAAiB;AACxC,kBAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAClE,cAAM,iBAAiB,8BAA8B,QAAQ,IAAI,4BAA4B;AAAA,MAC/F;AACA,UAAI,iBAAiB;AACnB,YAAI;AAAE,gBAAM,OAAO,MAAM,UAAU;AAAG,4BAAkB;AAAA,QAAO,SACxD,eAAe;AAAE,oBAAU,yBAAyB,QAAQ,gBAAgB,IAAI,MAAM,OAAO,aAAa,CAAC;AAAA,QAAG;AAAA,MACvH;AACA,YAAM;AAAA,IACR,UAAE;AACA,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AAEF;;;AC3MA,IAAM,mBAAmB,MAAM;AAC/B,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,YAAY,SAAyB;AAC5C,QAAM,QAAQ,QAAQ,KAAK;AAC3B,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yDAAyD;AACrF,MAAI,CAAC,eAAe,KAAK,KAAK,GAAG;AAC/B,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ;AACzC,MAAI,MAAM,SAAS,QAAQ,MAAM,OAAO;AACtC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,MAAM,aAAa,kBAAkB;AACvC,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,MAAM,MAAM,SAAS,MAAM,EAAE,KAAK;AACxC,MAAI,IAAI,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,GAAG,GAAG;AACxD,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AACA,SAAO;AACT;AAEO,SAAS,gCACd,kBACA,UAC8C;AAC9C,MAAI,aAAa,OAAW,QAAO,EAAE,iBAAiB;AAEtD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,gBAAgB;AAAA,EACnC,QAAQ;AACN,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,OAAO,aAAa,iBAAiB,OAAO,aAAa,aAAa;AACxE,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AAEA,MAAI,8BAA8B,KAAK,CAAC,cAAc,OAAO,aAAa,IAAI,SAAS,CAAC,GAAG;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,aAAa,IAAI,KAAK,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,OAAO,SAAS;AACpC,SAAO,aAAa,OAAO,aAAa;AACxC,SAAO;AAAA,IACL,kBAAkB,OAAO,SAAS;AAAA,IAClC,KAAK;AAAA,MACH,IAAI,YAAY,QAAQ;AAAA,MACxB,oBAAoB;AAAA,IACtB;AAAA,EACF;AACF;;;AHlDA,SAAS,QAAQ,OAA2B,UAAkB,MAAsB;AAClF,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACrG,SAAO;AACT;AAEA,eAAe,OAAsB;AACnC,QAAM,sBAAsB,cAAc,IAAI,IAAI,qBAAqB,YAAY,GAAG,CAAC;AACvF,MAAI,QAAQ,KAAK,SAAS,gBAAgB,GAAG;AAC3C,UAAMC,eAAc,QAAQ,IAAI;AAChC,QAAI,CAACA,aAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,MAChC,kBAAkBA;AAAA,MAClB,KAAK;AAAA,MACL,kBAAkB;AAAA,IACpB,CAAC;AACD,QAAI;AACF,YAAM,cAAc,eAAe,mBAAmB;AAAA,IACxD,UAAE;AACA,YAAM,cAAc,IAAI;AAAA,IAC1B;AACA;AAAA,EACF;AACA,MAAI,QAAQ,IAAI,yBAAyB,KAAK;AAC5C,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,iBAAiB;AAAA,IACrB,SAAS,eAAe;AAAA,IACxB,UAAU,cAAc,QAAQ,IAAI,2BAA2B;AAAA,EACjE;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,kCAAkC,KAAQ,kBAAkB;AACjG,QAAM,kBAAkB;AAAA,IACtB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,QAAQ,IAAI,iCAAiC,IAAI,oBAAoB;AAC9F,QAAM,iBAAiB;AAAA,IACrB,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,IAAI,qBAAqB;AAC9C,QAAM,OAAO,QAAQ,QAAQ,IAAI,mBAAmB,MAAM,cAAc;AACxE,QAAM,iBAAiB,QAAQ,IAAI,8BAC/B,MAAM,GAAG,EACV,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AACjB,QAAM,gBAAgB,MAAM,kBAAkB,mBAAmB;AACjE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ,IAAI;AAAA,EACd;AACA,QAAM,OAAO,IAAI,GAAG,KAAK;AAAA,IACvB,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IAChC,GAAG;AAAA,IACH,KAAK;AAAA,IACL,yBAAyB;AAAA,IACzB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,QAAQ,IAAI,oBAAoB,IAAI;AAC1C,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AACrB,MAAI;AACJ,QAAM,cAAc,YAClB,MAAM,gBAAgB,eAAe,aAAa,KAAK,MAAM,mBAAmB,aAAa;AAC/F,QAAM,cAAc,CAAC,QAAQ,UAA4B;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,qBAAqB,KAAO;AACrD,aAAO,QAAQ,QAAQ,cAAc;AAAA,IACvC;AACA,QAAI,kBAAmB,QAAO;AAC9B,QAAI;AACJ,cAAU,YAAY,EACnB,KAAK,CAAC,UAAU;AACf,uBAAiB;AACjB,2BAAqB,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,sBAAsB,QAAS,qBAAoB;AAAA,IACzD,CAAC;AACH,wBAAoB;AACpB,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,CAAC,MAAM,YAAY,IAAI,GAAG;AAC5B,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAC1D,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA,aAAa,IAAI,2BAA2B,IAAI;AAAA,IAChD,UAAU,IAAI,wBAAwB,IAAI;AAAA,IAC1C,kBAAkB,IAAI,yBAAyB,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA,OAAO;AAAA,IACP,mBAAmB;AAAA,EACrB,CAAC;AAED,UAAQ,OAAO,MAAM,MAAM,MAAM;AAC/B,YAAQ,OAAO,MAAM,qCAAqC,IAAI,IAAI,IAAI;AAAA,CAAI;AAAA,EAC5E,CAAC;AAED,MAAI,WAAW;AACf,iBAAe,WAA0B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAQ,MAAM,CAAC,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,IAC5D,CAAC;AACD,UAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC;AAAA,EACrD;AAEA,UAAQ,KAAK,UAAU,MAAM,KAAK,SAAS,CAAC;AAC5C,UAAQ,KAAK,WAAW,MAAM,KAAK,SAAS,CAAC;AAC/C;AAEA,KAAK,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3B,UAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AAClF,UAAQ,WAAW;AACrB,CAAC;","names":["row","databaseUrl"]}

package/dist/gateway.d.ts

@@ -1,5 +1,5 @@
 import 'node:http';
 import './bridge-store-Bi_LCX8e.js';
-export { G as GatewayOptions, c as createGateway } from './gateway-BqmcKam8.js';
+export { G as GatewayOptions, c as createGateway } from './gateway-DWZ3pX48.js';
 import './bridge-domain-CBX3IVqC.js';
 import './postgres-bridge-store-ChoOuFEY.js';

package/dist/gateway.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   createGateway
-} from "./chunk-FGERNG4X.js";
+} from "./chunk-LF37B6KL.js";
 import "./chunk-4V2PFJEF.js";
-import "./chunk-62C63PIE.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 export {
   createGateway

package/dist/index.js

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import {
   startServer
-} from "./chunk-AIALYLGQ.js";
+} from "./chunk-JIRNR75D.js";
 import "./chunk-23UDQZMT.js";
 import "./chunk-UKFRCP6X.js";
-import "./chunk-IMJ47WO4.js";
-import "./chunk-WQ4I5XGF.js";
+import "./chunk-IXNQG4SB.js";
+import "./chunk-6ZOLE3E3.js";
 import "./chunk-ZUZ7TCIH.js";
 import "./chunk-IVG4XWWS.js";
 import "./chunk-GTK4KOED.js";
 import "./chunk-VOQIDTCJ.js";
 import "./chunk-4V2PFJEF.js";
-import "./chunk-62C63PIE.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 
 // src/index.ts

package/dist/server.js

@@ -4,17 +4,17 @@ import {
   configFromEnv,
   createAgentBridgeServer,
   startServer
-} from "./chunk-AIALYLGQ.js";
+} from "./chunk-JIRNR75D.js";
 import "./chunk-23UDQZMT.js";
 import "./chunk-UKFRCP6X.js";
-import "./chunk-IMJ47WO4.js";
-import "./chunk-WQ4I5XGF.js";
+import "./chunk-IXNQG4SB.js";
+import "./chunk-6ZOLE3E3.js";
 import "./chunk-ZUZ7TCIH.js";
 import "./chunk-IVG4XWWS.js";
 import "./chunk-GTK4KOED.js";
 import "./chunk-VOQIDTCJ.js";
 import "./chunk-4V2PFJEF.js";
-import "./chunk-62C63PIE.js";
+import "./chunk-63JKCBC6.js";
 import "./chunk-BZLMF5O5.js";
 export {
   MCP_IMPLEMENTATION_VERSION,

package/docs/architecture-v2.md

@@ -4,9 +4,9 @@ Status: living architecture for the 0.6.x package line.
 
 ## Product boundary
 
-Agent Bridge lets agents exchange messages and hand off work across clients, processes,
-sessions, and machines. It supports two operating modes: local SQLite and the
-authenticated PostgreSQL gateway.
+Agent Bridge lets AI agents message each other and hand off work across clients,
+processes, sessions, and machines. It supports two operating modes: local SQLite and
+the authenticated PostgreSQL gateway.
 
 History visibility is caller-relative. `inbox` is the default and preserves broadcast-plus-targeted visibility; `sent` is source equal to the caller; `all` is their union. Receipt state (`any`, `unread`, `read`) is valid only for inbox and is always evaluated for the authenticated caller. Opaque v2 cursors bind workspace, caller, mailbox, and normalized filters. Readers temporarily accept v1 sequence cursors but emit only v2. After an edge cache contract upgrade, the gateway resets the authoritative pull cursor and replays `all` visibility; the publication outbox is never treated as sent history.
 
@@ -17,6 +17,10 @@ These authorization guarantees apply to local v2 and the authenticated gateway.
 
 The protocol must support informational context and executable work without treating them as the same thing. A2A and application task semantics sit above Agent Bridge. MCP, CLI, HTTPS, and the Node library are access surfaces. Agent harnesses and host applications use those surfaces through host adapters or direct integration. Optional transports may sit below the core, but they cannot replace authoritative cursor replay or durable delivery state.
 
+Authenticated gateway capabilities identify the running package version. Production
+images also report the Git revision supplied at build time. Deployment checks compare
+both values with the intended release before client rollout or production proof.
+
 [ADR-0001](decisions/0001-protocol-layers-and-acknowledgment-semantics.md) defines these layers and the distinct meanings of receipts, claims, leases, delivery settlement, and external task completion.
 
 [ADR-0002](decisions/0002-canonical-operation-contract-registry.md) defines the canonical cross-surface operation contract, deterministic artifacts, capability discovery, and protocol negotiation.

package/docs/decisions/0002-canonical-operation-contract-registry.md

@@ -32,6 +32,11 @@ declared by the registry, while local mode uses process identity and reports sco
 enforcement as false. [ADR-0005](0005-retire-direct-supabase-runtime.md) removed the
 legacy runtime provider from this contract.
 
+Authenticated gateway capability documents may also identify the running package
+version and image Git revision. These implementation fields are independent of the
+HTTP protocol version. Deployment gates compare them with the intended release so a
+healthy but stale gateway cannot pass release proof.
+
 Package version, MCP implementation version, Agent Bridge protocol version, and migration version remain independent. The MCP server reports the explicit `MCP_IMPLEMENTATION_VERSION` constant instead of the npm package version.
 
 ## Consequences

package/docs/deployment.md

@@ -229,11 +229,29 @@ repository does not perform them:
    match the recorded runtime contract. It never adopts a restored `NOLOGIN` shell.
 6. Construct the restricted runtime URL. Import it and the base64-encoded PostgreSQL CA
    as the two runtime secrets shown above, then run the app-aware read-only preflight.
-7. Deploy the immutable image with `fly deploy --config deploy/fly.toml --app <app>`.
+7. Deploy the immutable image with its source revision:
+
+   ```bash
+   fly deploy --config deploy/fly.toml --app <app> \
+     --build-arg AGENT_BRIDGE_BUILD_REVISION="$(git rev-parse HEAD)"
+   ```
+
    Require `/readyz` before routing clients.
-8. Run authenticated capability and status probes, then publish, pull, claim, and
+8. Check the running package and source revision with a principal-bound credential:
+
+   ```bash
+   AGENT_BRIDGE_URL="https://<app>.fly.dev" AGENT_BRIDGE_TOKEN="..." \
+     npm run verify:gateway:release -- \
+     --version "$(node -p "require('./package.json').version")" \
+     --revision "$(git rev-parse HEAD)"
+   ```
+
+   The check also requires protocol 2.1, request authority, and row isolation. It
+   fails if the deployed image omits its revision or differs from the intended
+   release.
+9. Run authenticated status, publication, pull, claim, and
    settle a disposable targeted delivery.
-9. Move clients only after the gateway proof passes. Preserve every source edge store
+10. Move clients only after the gateway proof passes. Preserve every source edge store
    until its outbox is empty.
 
 App creation, database provisioning, secret writes, migration, bootstrap, deployment,
@@ -257,9 +275,12 @@ The manual `gateway production proof` GitHub Actions workflow runs this acceptan
 proof against an existing HTTPS gateway. GitHub restricts it to `main`, and every job
 uses the approval-protected `agent-bridge-production-proof` environment. Configure
 `PROOF_SENDER_TOKEN`, `PROOF_RECEIVER_TOKEN`, `PROOF_HOST_SALT`, and `FLY_API_TOKEN` as
-environment secrets. The sender and receiver credentials must bind the requested
-workspace to the dedicated `proof-sender` and `proof-receiver` principals. The
-sender credential needs `messages:write` and `messages:read`. The receiver needs
+environment secrets. Use a release-specific proof workspace for every run. Owner
+provisioning refuses a second agent with the same principal in one workspace, and a
+revoked credential cannot serve as a rotation predecessor. The sender and receiver
+credentials must bind the requested workspace to the dedicated `proof-sender` and
+`proof-receiver` principals. The sender credential needs `messages:write` and
+`messages:read`. The receiver needs
 `messages:read`, `deliveries:claim`, `deliveries:settle`, and `deliveries:read`.
 
 Run the workflow only when the Fly app has exactly one gateway machine. The cycle job
@@ -318,8 +339,9 @@ owner-control state, or security events.
 5. Stop schema-changing jobs other than the selected migration job.
 6. Run the new image's migration command once with schema-owner authority.
 7. Run the runtime bootstrap with separate runtime-login credentials.
-8. Start the new gateway and require `/readyz`, an authenticated capability probe, and
-   an authenticated status probe.
+8. Start the new gateway and require `/readyz`. Run
+   `npm run verify:gateway:release` against the expected package version and Git
+   revision, then run an authenticated status probe.
 9. Send, read, claim, and settle a disposable targeted delivery.
 10. Roll clients forward only after the gateway proof passes.
 11. Keep the previous authority available but inactive until the observation window

package/docs/ecosystem.md

@@ -1,7 +1,7 @@
 # Agent Bridge in the agent ecosystem
 
-Agent Bridge lets agents exchange messages and hand off work across tools, sessions,
-and machines. It preserves each inbox through disconnections and restarts. It stores
+Agent Bridge lets AI agents message each other and hand off work across tools,
+sessions, and machines. Messages wait through disconnections and restarts. It stores
 immutable messages, read receipts, delivery claims, leases, retries, and replay state.
 It does not own the full agent stack.
 

package/llms.txt

@@ -3,7 +3,7 @@
 Repository: https://github.com/creatornader/agent-bridge
 Package: @creatornader/agent-bridge
 
-Agent Bridge lets AI agents send messages and hand off work across tools, sessions, and machines. Messages survive restarts and offline periods, and each agent resumes from its own inbox.
+Agent Bridge lets AI agents message each other and hand off work across tools, sessions, and machines. Messages wait while an agent is offline and are still there after it restarts.
 History uses mailbox `inbox` (default), `sent`, or `all`. Receipt state is `any` (default), `unread`, or `read`; it is caller-relative and inbox-only. CLI: `inbox`, `sent`, and `history --mailbox/--receipt-state`. Deprecated unacked-principal arguments must equal the configured identity.
 
 ## Install
@@ -122,7 +122,7 @@ one logical authority across restore but does not fence a live clone.
 
 ## MCP tools
 
-- `capabilities`: return operations, required scopes, provider-specific enforcement, and supported protocol versions. Gateway access needs an active credential but no named scope for this operation.
+- `capabilities`: return operations, required scopes, provider-specific enforcement, supported protocol versions, and optional implementation version and revision metadata. Gateway access needs an active credential but no named scope for this operation.
 - Production gateway capabilities report `requestAuthority: true` and `rowIsolation: true` only after the migration and live catalog, role, policy, privilege, and function checks pass. PostgreSQL forces RLS on messages, receipts, deliveries, delivery events, and presence. Lease transitions and target-to-delivery membership remain service-enforced.
 - Authenticated gateway `/v2/status` returns optional `gatewayAuthorityId` and
   `credentialId` fields when PostgreSQL request authority is active. They are additive

package/openapi/agent-bridge-v2.openapi.json

@@ -2,6 +2,7 @@
   "openapi": "3.1.2",
   "info": {
     "title": "Agent Bridge Gateway",
+    "description": "Let AI agents message each other and hand off work across tools, sessions, and machines.",
     "version": "2.1",
     "license": {
       "name": "Apache-2.0",
@@ -347,6 +348,13 @@
                         "gateway"
                       ]
                     },
+                    "implementationVersion": {
+                      "type": "string"
+                    },
+                    "implementationRevision": {
+                      "type": "string",
+                      "pattern": "^[0-9a-f]{7,40}$"
+                    },
                     "grantedScopes": {
                       "type": "array",
                       "items": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@creatornader/agent-bridge",
-  "version": "0.6.0",
-  "description": "Messaging and work delivery for AI agents across tools, sessions, and machines.",
+  "version": "0.6.2",
+  "description": "Let AI agents message each other and hand off work across tools, sessions, and machines.",
   "type": "module",
   "license": "Apache-2.0",
   "author": "Nader Helmy",
@@ -29,6 +29,7 @@
     "schemas",
     "openapi",
     "docs",
+    "scripts/gateway-release-check.mjs",
     "sql/migrations",
     "sql/setup.sql",
     "llms.txt",
@@ -93,6 +94,7 @@
     "preflight:postgres:production": "npm run build --silent && node dist/postgres-production-preflight.js",
     "preflight:fly": "node scripts/fly-production-preflight.mjs",
     "proof:gateway:production": "node scripts/gateway-production-proof.mjs",
+    "verify:gateway:release": "node scripts/gateway-release-check.mjs",
     "test:gateway:production-proof": "vitest run test/gateway-production-proof.test.ts",
     "test:windows:contract": "vitest run test/private-path.test.ts test/windows-native-smoke.test.ts --maxWorkers=1 --testTimeout=180000 -t \"applies and verifies native Windows file and directory ACLs|recovers an (enrollment|client-operation) subsystem lock\" && vitest run test/client-maintenance.test.ts --maxWorkers=1 --testTimeout=180000",
     "typecheck": "tsc --noEmit",

package/schemas/agent-bridge-v2.capabilities.json

@@ -86,6 +86,13 @@
                 "gateway"
               ]
             },
+            "implementationVersion": {
+              "type": "string"
+            },
+            "implementationRevision": {
+              "type": "string",
+              "pattern": "^[0-9a-f]{7,40}$"
+            },
             "grantedScopes": {
               "type": "array",
               "items": {

package/schemas/agent-bridge-v2.mcp.json

@@ -74,6 +74,13 @@
               "gateway"
             ]
           },
+          "implementationVersion": {
+            "type": "string"
+          },
+          "implementationRevision": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{7,40}$"
+          },
           "grantedScopes": {
             "type": "array",
             "items": {

package/schemas/agent-bridge-v2.schema.json

@@ -335,6 +335,13 @@
             "gateway"
           ]
         },
+        "implementationVersion": {
+          "type": "string"
+        },
+        "implementationRevision": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{7,40}$"
+        },
         "grantedScopes": {
           "type": "array",
           "items": {
@@ -433,6 +440,13 @@
             "gateway"
           ]
         },
+        "implementationVersion": {
+          "type": "string"
+        },
+        "implementationRevision": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{7,40}$"
+        },
         "grantedScopes": {
           "type": "array",
           "items": {