@integrity-labs/cloud-broker 0.7.1 → 0.7.4

package/README.md

@@ -1,13 +1,18 @@
 # `@integrity-labs/cloud-broker`
 
-MCP server for the Augmented ephemeral cloud-access broker. Exposes the agent-facing tools (`aws_request_access`, `aws_poll_grant`, `aws_release_access`, `aws_describe_scope`, `aws_preview_request`, `aws_get_credentials`) that mint, poll, and release scoped, TTL-bounded cloud credentials for a single task.
+MCP server for the Augmented ephemeral cloud-access broker. Exposes per-cloud tool families that mint, poll, and release scoped, TTL-bounded credentials for a single task.
 
-**v1 ships AWS support** (STS AssumeRole under the hood; pair with the `aws-cli` toolkit or any AWS SDK as the consumer). All tools are namespaced `aws_*` so GCP, Azure, and Cloudflare can land in this same package as `gcp_*` / `azure_*` / `cf_*` siblings without colliding (ENG-4782).
+- **AWS** (STS `AssumeRole` under the hood — `aws_*` tools, paired with the `aws-cli` toolkit or any AWS SDK).
+- **GCP** (IAM Credentials `generateAccessToken` under the hood — `gcp_*` tools, paired with the `gcloud` toolkit). Added in ENG-5074.
 
-See the [PRD](../../docs/prds/aws-ephemeral-access.md) and the [toolkit doc](../../docs/toolkits/aws.md) for the full design.
+All tools are namespaced per cloud so additions are purely additive (ENG-4782). Azure / Cloudflare slots are reserved (`azure_*` / `cf_*`) but unimplemented.
+
+See the PRDs ([AWS](../../docs/prds/aws-ephemeral-access.md), [GCP](../../docs/prds/gcp-ephemeral-access.md)) and toolkit docs ([aws](../../docs/toolkits/aws.md), [gcloud](../../docs/toolkits/gcloud.md)) for the full design.
 
 ## Tools
 
+### AWS
+
 | Tool | Purpose |
 |---|---|
 | `aws_describe_scope` | Returns the team's resolved policy ceiling for an account — what the agent is allowed to ask for. Free, idempotent. |
@@ -16,6 +21,38 @@ See the [PRD](../../docs/prds/aws-ephemeral-access.md) and the [toolkit doc](../
 | `aws_poll_grant` | Single-shot status check. Escape hatch — the broker pushes resolution via direct-chat. |
 | `aws_get_credentials` | Fetch the AWS_* values for an active grant. Call after `aws_request_access` returns active or after the resolution-notification arrives. |
 | `aws_release_access` | Voluntarily release a grant before TTL. Idempotent. |
+| `aws_check_approval_channel` | Pre-flight Slack channel reachability check (ENG-4824). |
+| `aws_list_accounts` | Live inventory of enrolled AWS accounts (ENG-5048). |
+
+### GCP
+
+| Tool | Purpose |
+|---|---|
+| `gcp_describe_scope` | Resolved policy ceiling for a GCP project. Free, idempotent. |
+| `gcp_preview_request` | Dry-run a candidate request. Writes nothing. |
+| `gcp_request_access` | Mint or queue a grant. |
+| `gcp_poll_grant` | Single-shot status check. Escape hatch. |
+| `gcp_get_credentials` | Fetch the GCP access token for an active grant. |
+| `gcp_release_access` | Voluntarily release a grant before TTL. Idempotent. |
+| `gcp_check_approval_channel` | Pre-flight Slack channel reachability for the project's approval channel. |
+| `gcp_list_accounts` | Live inventory of enrolled GCP projects. |
+
+### Supabase
+
+Credentials returned are a short-lived **Supabase JWT** (+ `supabase_url`, `db_host`, `project_ref`), not a cloud IAM token. The agent uses it for PostgREST (`Authorization: Bearer …`) or `psql` via the session pooler.
+
+| Tool | Purpose |
+|---|---|
+| `supabase_describe_scope` | Resolved policy ceiling for a Supabase project (auto-approvable roles, schema ceiling, write gating). Free, idempotent. |
+| `supabase_preview_request` | Dry-run a candidate request. Writes nothing. |
+| `supabase_request_access` | Mint or queue a grant. `service_role` always routes to a human approver; privileged internal roles (`postgres`, `supabase_admin`, …) are hard-denied. |
+| `supabase_poll_grant` | Single-shot status check. Escape hatch. |
+| `supabase_get_credentials` | Fetch the JWT + connection details for an active grant. |
+| `supabase_release_access` | Voluntarily release a grant before TTL. Idempotent. **Note:** the JWT is stateless — release marks the grant revoked but the token stays valid until its `exp`. |
+| `supabase_check_approval_channel` | Pre-flight Slack channel reachability for the project's approval channel. |
+| `supabase_list_projects` | Live inventory of enrolled Supabase projects. |
+
+See **[`docs/runbooks/supabase-broker-enrollment.md`](../../docs/runbooks/supabase-broker-enrollment.md)** for operator enrollment, the `augmented` JWT-claim → RLS-policy enforcement guide, and the policy-ceiling shape.
 
 ## Environment
 
@@ -69,6 +106,102 @@ aws_release_access({ grant_id: "..." })
 
 If `aws_request_access` returns `status: "pending"`, a human approver was paged. The broker pushes the resolution to you via direct-chat — save the `grant_id`, return control, and resume when the inbound message arrives. On `denied`, the `denial_reason` field explains why. `aws_poll_grant` is an escape hatch for explicit re-checks.
 
+## Worked example (GCP)
+
+An agent reading one Cloud Storage object:
+
+```jsonc
+// 1. Inspect the envelope.
+gcp_describe_scope({ project_id: "my-gcp-project" })
+
+// 2. Dry-run.
+gcp_preview_request({
+  project_id: "my-gcp-project",
+  permissions: ["storage.objects.get", "storage.objects.list"],
+  resources:   ["projects/_/buckets/reports/objects/*", "projects/_/buckets/reports"],
+  ttl_seconds: 900
+})
+// → { "would": "auto_approve", "reason": null }
+
+// 3. Mint.
+gcp_request_access({
+  project_id: "my-gcp-project",
+  permissions: ["storage.objects.get", "storage.objects.list"],
+  resources:   ["projects/_/buckets/reports/objects/*", "projects/_/buckets/reports"],
+  ttl_seconds: 900,
+  reason: "fetch the daily reports CSV for the user"
+})
+// → { "grant_id": "...", "status": "active", "secret_ref": "secret_ref://gcp/runs/<run_id>/<grant_id>", "expires_at": "..." }
+
+// 4. Use the credentials. The runtime adapter resolves the secret_ref
+//    pointer to env vars at tool-call boundary — never substitute the
+//    raw token into shell history or logs.
+//    Inside an agent-spawned shell:  gcloud storage cp gs://reports/today.csv -
+//    (CLOUDSDK_AUTH_ACCESS_TOKEN / GOOGLE_OAUTH_ACCESS_TOKEN are populated by
+//    the runtime; gcloud, gsutil, and bq pick them up automatically.)
+//
+// If you genuinely need the raw token (e.g. for non-gcloud HTTP calls),
+// gcp_get_credentials({ grant_id: "..." }) returns it inline. The runtime
+// MUST NOT echo the token to shell history; use it via a transient env
+// only.
+
+// 5. (Optional) release early.
+gcp_release_access({ grant_id: "..." })
+```
+
+Same `pending` / direct-chat-push resolution semantics as AWS. The runtime resolves `secret_ref://gcp/runs/...` to `CLOUDSDK_AUTH_ACCESS_TOKEN` and `GOOGLE_OAUTH_ACCESS_TOKEN` at exec time, so `gcloud`, `gsutil`, and `bq` all pick it up automatically without the agent ever handling the raw token.
+
+## Worked example (Supabase)
+
+An agent that needs read-only access to two tables in `public`:
+
+```jsonc
+// 1. Inspect the envelope — which roles auto-approve, the schema ceiling, write gating.
+supabase_describe_scope({ project_ref: "abcdefghijklmnopqrst" })
+
+// 2. Dry-run.
+supabase_preview_request({
+  project_ref: "abcdefghijklmnopqrst",
+  role: "authenticated",
+  allowed_schemas: ["public"],
+  allowed_tables: ["public.agents", "public.runs"], // optional — absent = all tables in allowed_schemas
+  read_only: true,
+  ttl_seconds: 900
+})
+// → { "would": "auto_approve", "reason": null }
+
+// 3. Mint.
+supabase_request_access({
+  project_ref: "abcdefghijklmnopqrst",
+  role: "authenticated",
+  allowed_schemas: ["public"],
+  allowed_tables: ["public.agents", "public.runs"],
+  read_only: true,
+  ttl_seconds: 900,
+  reason: "read the agents + runs tables to answer the user's status question"
+})
+// → { "grant_id": "...", "status": "active", "secret_ref": "supabase:jwt:<grant_id>", "expires_at": "..." }
+//    `service_role` or write access (read_only:false, unless the project allows writes)
+//    returns "pending" instead and pages a human approver.
+
+// 4. Fetch the JWT + connection details.
+supabase_get_credentials({ grant_id: "..." })
+// → { "grant_id": "...", "expires_at": "...",
+//     "credentials": { "access_token": "<JWT>", "supabase_url": "https://<ref>.supabase.co",
+//                      "db_host": "aws-0-<region>.pooler.supabase.com", "project_ref": "<ref>" } }
+//
+//    REST (PostgREST):
+//      curl "$supabase_url/rest/v1/agents?select=*" \
+//        -H "apikey: <JWT>" -H "Authorization: Bearer <JWT>"
+//    psql (session pooler):
+//      psql "postgresql://postgres.<project_ref>:<JWT>@<db_host>:5432/postgres"
+
+// 5. (Optional) release early.
+supabase_release_access({ grant_id: "..." })
+```
+
+The grant's scope (`allowed_schemas` / `allowed_tables` / `read_only`) is carried in the JWT's `augmented` claim and is **only enforced if the project's RLS policies read that claim** — see the [enrollment runbook](../../docs/runbooks/supabase-broker-enrollment.md#enforcing-the-grant-scope-with-rls) for the policy patterns. Same `pending` / direct-chat-push resolution semantics as AWS.
+
 ## Running locally
 
 ```bash

package/dist/index.js

@@ -21182,6 +21182,160 @@ var BrokerClient = class {
       { query: this.agentId ? { agent_id: this.agentId } : void 0 }
     );
   }
+  // ──────────────────────────────── GCP (ENG-5077) ────────────────────────
+  // Parallel surface to the AWS methods above. Same JWT, same agent_id /
+  // run_id auto-fill, same error envelope. Hits /gcp/* endpoints on the
+  // broker API. Grant_id is provider-agnostic — `gcp_get_credentials`
+  // returns a GCP access_token instead of an AWS triple, but the rest of
+  // the lifecycle (poll, release, status) is identical in shape.
+  gcpDescribeScope(args) {
+    if (!this.agentId) {
+      throw makeBrokerError(400, "BrokerClient.gcpDescribeScope requires agentId \u2014 pass it in BrokerClientConfig");
+    }
+    return this.request(
+      "GET",
+      "/gcp/scope",
+      { query: { project_id: args.project_id, agent_id: this.agentId } }
+    );
+  }
+  gcpPreviewRequest(args) {
+    if (!this.agentId) {
+      throw makeBrokerError(400, "BrokerClient.gcpPreviewRequest requires agentId \u2014 pass it in BrokerClientConfig");
+    }
+    const body = { ...args };
+    if (body.agent_id === void 0) body.agent_id = this.agentId;
+    return this.request(
+      "POST",
+      "/gcp/scope/preview",
+      { body }
+    );
+  }
+  async gcpRequestAccess(args) {
+    const agentId = args.agent_id ?? this.agentId;
+    const runId = args.run_id ?? this.runId;
+    if (!agentId) {
+      throw makeBrokerError(400, "BrokerClient.gcpRequestAccess requires agent_id (pass it in args, or set agentId on BrokerClientConfig)");
+    }
+    if (!runId) {
+      throw makeBrokerError(400, "BrokerClient.gcpRequestAccess requires run_id (pass it in args, or set runId on BrokerClientConfig)");
+    }
+    const body = { ...args, agent_id: agentId, run_id: runId };
+    return this.request("POST", "/gcp/grants", { body });
+  }
+  gcpPollGrant(args) {
+    return this.request("GET", `/gcp/grants/${encodeURIComponent(args.grant_id)}`);
+  }
+  gcpCheckApprovalChannel(args) {
+    if (!this.agentId) {
+      throw makeBrokerError(400, "BrokerClient.gcpCheckApprovalChannel requires agentId \u2014 pass it in BrokerClientConfig");
+    }
+    return this.request(
+      "GET",
+      "/gcp/approval-channel-status",
+      { query: { project_id: args.project_id, agent_id: this.agentId } }
+    );
+  }
+  gcpReleaseAccess(args) {
+    return this.request(
+      "POST",
+      `/gcp/grants/${encodeURIComponent(args.grant_id)}/release`
+    );
+  }
+  gcpListInventory() {
+    if (!this.agentId) {
+      throw makeBrokerError(400, "BrokerClient.gcpListInventory requires agentId \u2014 pass it in BrokerClientConfig");
+    }
+    return this.request(
+      "GET",
+      "/gcp/inventory",
+      { query: { agent_id: this.agentId } }
+    );
+  }
+  gcpGetCredentials(args) {
+    return this.request(
+      "POST",
+      `/gcp/grants/${encodeURIComponent(args.grant_id)}/credentials`
+    );
+  }
+  // ──────────────────────────────── Supabase ────────────────────────────────
+  // Short-lived Supabase JWT tokens for querying enrolled Supabase projects.
+  // Prod projects always route_to_approver (HITL); dev/staging can be
+  // configured for auto_approve via policy_ceiling.auto_approved_roles.
+  supabaseDescribeScope(args) {
+    if (!this.agentId) {
+      throw makeBrokerError(400, "BrokerClient.supabaseDescribeScope requires agentId \u2014 pass it in BrokerClientConfig");
+    }
+    return this.request(
+      "GET",
+      "/supabase/scope",
+      { query: { project_ref: args.project_ref, agent_id: this.agentId } }
+    );
+  }
+  supabasePreviewRequest(args) {
+    if (!this.agentId) {
+      throw makeBrokerError(400, "BrokerClient.supabasePreviewRequest requires agentId \u2014 pass it in BrokerClientConfig");
+    }
+    const body = { ...args };
+    if (body.agent_id === void 0) body.agent_id = this.agentId;
+    return this.request(
+      "POST",
+      "/supabase/scope/preview",
+      { body }
+    );
+  }
+  async supabaseRequestAccess(args) {
+    const agentId = args.agent_id ?? this.agentId;
+    const runId = args.run_id ?? this.runId;
+    if (!agentId) {
+      throw makeBrokerError(400, "BrokerClient.supabaseRequestAccess requires agent_id (pass it in args, or set agentId on BrokerClientConfig)");
+    }
+    if (!runId) {
+      throw makeBrokerError(400, "BrokerClient.supabaseRequestAccess requires run_id (pass it in args, or set runId on BrokerClientConfig)");
+    }
+    const body = { ...args, agent_id: agentId, run_id: runId };
+    return this.request("POST", "/supabase/grants", { body });
+  }
+  supabasePollGrant(args) {
+    return this.request(
+      "GET",
+      `/supabase/grants/${encodeURIComponent(args.grant_id)}`,
+      { query: this.agentId ? { agent_id: this.agentId } : void 0 }
+    );
+  }
+  supabaseCheckApprovalChannel(args) {
+    if (!this.agentId) {
+      throw makeBrokerError(400, "BrokerClient.supabaseCheckApprovalChannel requires agentId \u2014 pass it in BrokerClientConfig");
+    }
+    return this.request(
+      "GET",
+      "/supabase/approval-channel-status",
+      { query: { project_ref: args.project_ref, agent_id: this.agentId } }
+    );
+  }
+  supabaseReleaseAccess(args) {
+    return this.request(
+      "POST",
+      `/supabase/grants/${encodeURIComponent(args.grant_id)}/release`,
+      { query: this.agentId ? { agent_id: this.agentId } : void 0 }
+    );
+  }
+  supabaseListInventory() {
+    if (!this.agentId) {
+      throw makeBrokerError(400, "BrokerClient.supabaseListInventory requires agentId \u2014 pass it in BrokerClientConfig");
+    }
+    return this.request(
+      "GET",
+      "/supabase/inventory",
+      { query: { agent_id: this.agentId } }
+    );
+  }
+  supabaseGetCredentials(args) {
+    return this.request(
+      "POST",
+      `/supabase/grants/${encodeURIComponent(args.grant_id)}/credentials`,
+      { query: this.agentId ? { agent_id: this.agentId } : void 0 }
+    );
+  }
 };
 
 // src/inventory.ts
@@ -21201,6 +21355,36 @@ function renderInventoryBlock(accounts) {
 Available accounts for this team (use the 12-digit account_id, NEVER invent one):
 ${lines.join("\n")}${truncated}`;
 }
+function renderGcpInventoryBlock(projects) {
+  if (projects.length === 0) return "";
+  const shown = projects.slice(0, INVENTORY_RENDER_LIMIT);
+  const lines = shown.map((p) => {
+    const sa = p.service_account_email ? ` (sa: ${p.service_account_email})` : "";
+    return `  - \`${p.project_id}\` \u2014 ${p.display_name}${sa}`;
+  });
+  const truncated = projects.length > INVENTORY_RENDER_LIMIT ? `
+
+  \u2026and ${projects.length - INVENTORY_RENDER_LIMIT} more \u2014 call \`gcp_describe_scope\` for any unlisted project.` : "";
+  return `
+
+Available GCP projects for this team (use the project_id, NEVER invent one):
+${lines.join("\n")}${truncated}`;
+}
+function renderSupabaseInventoryBlock(projects) {
+  if (projects.length === 0) return "";
+  const shown = projects.slice(0, INVENTORY_RENDER_LIMIT);
+  const lines = shown.map((p) => {
+    const url = p.supabase_url ? ` (${p.supabase_url})` : "";
+    return `  - \`${p.project_ref}\` \u2014 ${p.display_name}${url}`;
+  });
+  const truncated = projects.length > INVENTORY_RENDER_LIMIT ? `
+
+  \u2026and ${projects.length - INVENTORY_RENDER_LIMIT} more \u2014 call \`supabase_describe_scope\` for any unlisted project.` : "";
+  return `
+
+Available Supabase projects for this team (use the project_ref, NEVER invent one):
+${lines.join("\n")}${truncated}`;
+}
 
 // src/tool-schemas.ts
 var accountIdSchema = external_exports.string().regex(/^\d{12}$/, "AWS account_id must be a 12-digit string");
@@ -21274,11 +21458,123 @@ var releaseAccessShape = releaseAccessSchema.shape;
 var getCredentialsShape = getCredentialsSchema.shape;
 var checkApprovalChannelShape = checkApprovalChannelSchema.shape;
 var listAccountsShape = listAccountsSchema.shape;
+var projectIdSchema = external_exports.string().regex(
+  /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/,
+  "GCP project_id must be 6\u201330 chars, lowercase letters/digits/hyphens, starting with a letter and not ending with a hyphen"
+);
+var permissionListSchema = external_exports.array(external_exports.string().min(1)).min(1, "At least one permission is required").describe(
+  'GCP IAM permissions to allow, e.g. ["storage.objects.get", "storage.objects.list"]. See https://cloud.google.com/iam/docs/permissions-reference for the canonical list.'
+);
+var gcpResourceListSchema = external_exports.array(external_exports.string().min(1)).min(1, "At least one resource is required").describe(
+  'GCP resource names (e.g. "projects/_/buckets/reports/objects/*", "projects/<project>/zones/us-central1-a/instances/*"). Must be inside the enrolled project.'
+);
+var gcpDescribeScopeSchema = external_exports.object({
+  project_id: projectIdSchema
+});
+var gcpPreviewRequestSchema = external_exports.object({
+  project_id: projectIdSchema,
+  permissions: permissionListSchema,
+  resources: gcpResourceListSchema,
+  ttl_seconds: ttlSecondsSchema
+});
+var gcpRequestAccessSchema = external_exports.object({
+  agent_id: external_exports.string().uuid("agent_id must be a UUID").optional().describe(
+    "Optional. Defaults to the host MCP env (AGT_AGENT_ID). Pass explicitly only to attribute the grant to a different agent."
+  ),
+  run_id: external_exports.string().uuid("run_id must be a UUID").optional().describe(
+    "Optional. Defaults to the host MCP env (AGT_RUN_ID). Pass explicitly only to attribute the grant to a different run."
+  ),
+  project_id: projectIdSchema,
+  permissions: permissionListSchema,
+  resources: gcpResourceListSchema,
+  ttl_seconds: ttlSecondsSchema,
+  task_id: external_exports.string().min(1).optional().describe("Optional Augmented task identifier (e.g. kanban:task-7842)."),
+  reason: external_exports.string().min(1).max(500).optional().describe(
+    "One-sentence rationale shown to a human approver. Must be safe to render \u2014 never contains credentials."
+  ),
+  source_context: sourceContextSchema.optional().describe(
+    "Optional. Inbound conversation that triggered this request. Persisted on the grant so the resolution notification can thread the answer back to the original channel/thread instead of dead-ending in direct-chat."
+  )
+});
+var gcpPollGrantSchema = external_exports.object({
+  grant_id: external_exports.string().uuid("grant_id must be a UUID")
+});
+var gcpReleaseAccessSchema = external_exports.object({
+  grant_id: external_exports.string().uuid("grant_id must be a UUID")
+});
+var gcpGetCredentialsSchema = external_exports.object({
+  grant_id: external_exports.string().uuid("grant_id must be a UUID")
+});
+var gcpCheckApprovalChannelSchema = external_exports.object({
+  project_id: projectIdSchema
+});
+var gcpListAccountsSchema = external_exports.object({});
+var gcpDescribeScopeShape = gcpDescribeScopeSchema.shape;
+var gcpPreviewRequestShape = gcpPreviewRequestSchema.shape;
+var gcpRequestAccessShape = gcpRequestAccessSchema.shape;
+var gcpPollGrantShape = gcpPollGrantSchema.shape;
+var gcpReleaseAccessShape = gcpReleaseAccessSchema.shape;
+var gcpGetCredentialsShape = gcpGetCredentialsSchema.shape;
+var gcpCheckApprovalChannelShape = gcpCheckApprovalChannelSchema.shape;
+var gcpListAccountsShape = gcpListAccountsSchema.shape;
+var supabaseProjectRefSchema = external_exports.string().regex(/^[a-z0-9]{20}$/, "Supabase project_ref must be exactly 20 lowercase alphanumeric characters");
+var schemaListSchema = external_exports.array(external_exports.string().min(1)).min(1, "At least one schema is required").describe(`Postgres schemas to access, e.g. ["public"]. Must be within the team's allowed_schemas ceiling.`);
+var supabaseDescribeScopeSchema = external_exports.object({
+  project_ref: supabaseProjectRefSchema
+});
+var supabasePreviewRequestSchema = external_exports.object({
+  project_ref: supabaseProjectRefSchema,
+  role: external_exports.string().min(1).describe('Postgres role for the JWT (e.g. "authenticated"). "service_role" always routes to approver.'),
+  allowed_schemas: schemaListSchema,
+  allowed_tables: external_exports.array(external_exports.string().min(1)).optional().describe('Optional schema.table allowlist (e.g. ["public.agents", "public.runs"]). Absent = all tables in allowed_schemas.'),
+  read_only: external_exports.boolean().describe("True if only SELECT access is needed. Surfaced as a JWT claim for RLS enforcement."),
+  ttl_seconds: ttlSecondsSchema
+});
+var supabaseRequestAccessSchema = external_exports.object({
+  agent_id: external_exports.string().uuid("agent_id must be a UUID").optional().describe(
+    "Optional. Defaults to the host MCP env (AGT_AGENT_ID)."
+  ),
+  run_id: external_exports.string().uuid("run_id must be a UUID").optional().describe(
+    "Optional. Defaults to the host MCP env (AGT_RUN_ID)."
+  ),
+  project_ref: supabaseProjectRefSchema,
+  role: external_exports.string().min(1).describe('Postgres role for the JWT (e.g. "authenticated"). "service_role" always routes to approver.'),
+  allowed_schemas: schemaListSchema,
+  allowed_tables: external_exports.array(external_exports.string().min(1)).optional().describe("Optional schema.table allowlist. Absent = all tables in allowed_schemas."),
+  read_only: external_exports.boolean().describe("True if only SELECT access is needed."),
+  ttl_seconds: ttlSecondsSchema,
+  task_id: external_exports.string().min(1).optional().describe("Optional Augmented task identifier."),
+  reason: external_exports.string().min(1).max(500).optional().describe("One-sentence rationale shown to a human approver."),
+  source_context: sourceContextSchema.optional().describe(
+    "Optional. Inbound conversation that triggered this request. Persisted so the resolution notification can thread back to the original channel."
+  )
+});
+var supabasePollGrantSchema = external_exports.object({
+  grant_id: external_exports.string().uuid("grant_id must be a UUID")
+});
+var supabaseReleaseAccessSchema = external_exports.object({
+  grant_id: external_exports.string().uuid("grant_id must be a UUID")
+});
+var supabaseGetCredentialsSchema = external_exports.object({
+  grant_id: external_exports.string().uuid("grant_id must be a UUID")
+});
+var supabaseCheckApprovalChannelSchema = external_exports.object({
+  project_ref: supabaseProjectRefSchema
+});
+var supabaseListProjectsSchema = external_exports.object({});
+var supabaseDescribeScopeShape = supabaseDescribeScopeSchema.shape;
+var supabasePreviewRequestShape = supabasePreviewRequestSchema.shape;
+var supabaseRequestAccessShape = supabaseRequestAccessSchema.shape;
+var supabasePollGrantShape = supabasePollGrantSchema.shape;
+var supabaseReleaseAccessShape = supabaseReleaseAccessSchema.shape;
+var supabaseGetCredentialsShape = supabaseGetCredentialsSchema.shape;
+var supabaseCheckApprovalChannelShape = supabaseCheckApprovalChannelSchema.shape;
+var supabaseListProjectsShape = supabaseListProjectsSchema.shape;
 
 // package.json
 var package_default = {
   name: "@integrity-labs/cloud-broker",
-  version: "0.7.1",
+  version: "0.7.4",
   description: "Cloud Access Broker \u2014 MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials \u2014 STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   type: "module",
   bin: {
@@ -21305,7 +21601,9 @@ var package_default = {
     test: "vitest run",
     clean: "rm -rf dist",
     "publish:templates": "bash cloudformation/publish.sh",
-    "check-published": "bash cloudformation/check-published.sh"
+    "check-published": "bash cloudformation/check-published.sh",
+    "publish:terraform": "bash terraform/publish.sh",
+    "check-published-terraform": "bash terraform/check-published.sh"
   },
   dependencies: {
     "@modelcontextprotocol/sdk": "1.27.1",
@@ -21385,9 +21683,59 @@ async function loadInventoryBlock() {
   }
 }
 var inventoryBlock = await loadInventoryBlock();
+var NO_DIRECT_HTTP_BLOCK = "\n\nUse this MCP tool \u2014 never call /aws/* or /cloud/aws/* HTTP endpoints directly. The broker client handles JWT refresh, slug disambiguation, secret_ref redirection, and per-call audit context that direct HTTP loses.";
+async function loadGcpInventoryBlock() {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), INVENTORY_FETCH_TIMEOUT_MS);
+  try {
+    const result = await Promise.race([
+      broker.gcpListInventory(),
+      new Promise((_, reject) => {
+        ctl.signal.addEventListener(
+          "abort",
+          () => reject(new Error(`gcp_inventory_lookup timed out after ${INVENTORY_FETCH_TIMEOUT_MS}ms`))
+        );
+      })
+    ]);
+    return renderGcpInventoryBlock(result.projects);
+  } catch (err) {
+    console.error(
+      `cloud-broker: gcp_inventory_lookup_failed (non-fatal \u2014 tool descriptions render project-agnostic): ${formatBrokerError(err)}`
+    );
+    return "";
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var gcpInventoryBlock = await loadGcpInventoryBlock();
+async function loadSupabaseInventoryBlock() {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), INVENTORY_FETCH_TIMEOUT_MS);
+  try {
+    const result = await Promise.race([
+      broker.supabaseListInventory(),
+      new Promise((_, reject) => {
+        ctl.signal.addEventListener(
+          "abort",
+          () => reject(new Error(`supabase_inventory_lookup timed out after ${INVENTORY_FETCH_TIMEOUT_MS}ms`))
+        );
+      })
+    ]);
+    return renderSupabaseInventoryBlock(result.projects);
+  } catch (err) {
+    console.error(
+      `cloud-broker: supabase_inventory_lookup_failed (non-fatal): ${formatBrokerError(err)}`
+    );
+    return "";
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var supabaseInventoryBlock = await loadSupabaseInventoryBlock();
+var NO_DIRECT_SUPABASE_HTTP_BLOCK = "\n\nUse this MCP tool \u2014 never call /supabase/* HTTP endpoints directly. The broker client handles JWT refresh, slug disambiguation, secret_ref redirection, and per-call audit context that direct HTTP loses.";
 server.tool(
   "aws_describe_scope",
-  "Return the team's resolved AWS policy ceiling for an account: max_ttl_seconds, allowed_regions, auto_approved_actions, and the action denylist. Call this before aws_request_access if you're not sure what you're allowed to ask for \u2014 it's free, idempotent, and writes nothing." + inventoryBlock,
+  "Return the team's resolved AWS policy ceiling for an account: max_ttl_seconds, allowed_regions, auto_approved_actions, and the action denylist. Call this before aws_request_access if you're not sure what you're allowed to ask for \u2014 it's free, idempotent, and writes nothing." + inventoryBlock + NO_DIRECT_HTTP_BLOCK,
   describeScopeShape,
   async (args) => {
     try {
@@ -21400,7 +21748,7 @@ server.tool(
 );
 server.tool(
   "aws_preview_request",
-  'Dry-run a candidate request. Returns one of "auto_approve", "route_to_approver", or "hard_deny" without dispatching anything or writing audit_log. Useful for letting the agent self-tighten its scope before triggering a human approval.',
+  'Dry-run a candidate request. Returns one of "auto_approve", "route_to_approver", or "hard_deny" without dispatching anything or writing audit_log. Useful for letting the agent self-tighten its scope before triggering a human approval.' + NO_DIRECT_HTTP_BLOCK,
   previewRequestShape,
   async (args) => {
     try {
@@ -21413,7 +21761,7 @@ server.tool(
 );
 server.tool(
   "aws_check_approval_channel",
-  `Verify the agent's Slack bot can post to the AWS-approval channel for an account BEFORE calling aws_request_access. Returns { ok, channel?, bot_user_handle?, reason? }. When ok=false, branch on reason: "channel_not_found" or "not_in_channel" \u2192 tell the user "I need to be invited to the approvals channel before I can request access \u2014 please run \`/invite @<bot_user_handle>\` in your AWS-approvals channel and let me know when done"; "archived" \u2192 tell the user the configured channel is archived and an admin needs to repoint it in Team Settings; "no_approval_channel_configured" \u2192 tell the user no approval channel is set up for this AWS account and ask them to configure one in Team Settings; "agent_slack_not_configured" \u2192 escalate to operator (you have no Slack bot at all, so /invite won't help); "auth_failed" or "unknown" \u2192 escalate to operator with raw_error. ALWAYS call this on the FIRST aws_request_access for a given account_id in a session \u2014 once you've gotten ok=true once, you can skip subsequent pre-checks. If ok=false, DO NOT call aws_request_access \u2014 surface the user-facing message above and wait. Same jargon-free, no-mechanics rules as aws_request_access: never expose "broker", "grant", "MCP", "Slack channel ID", etc to the user \u2014 talk about the AWS account and the invite action.` + inventoryBlock,
+  `Verify the agent's Slack bot can post to the AWS-approval channel for an account BEFORE calling aws_request_access. Returns { ok, channel?, bot_user_handle?, reason? }. When ok=false, branch on reason: "channel_not_found" or "not_in_channel" \u2192 tell the user "I need to be invited to the approvals channel before I can request access \u2014 please run \`/invite @<bot_user_handle>\` in your AWS-approvals channel and let me know when done"; "archived" \u2192 tell the user the configured channel is archived and an admin needs to repoint it in Team Settings; "no_approval_channel_configured" \u2192 tell the user no approval channel is set up for this AWS account and ask them to configure one in Team Settings; "agent_slack_not_configured" \u2192 escalate to operator (you have no Slack bot at all, so /invite won't help); "auth_failed" or "unknown" \u2192 escalate to operator with raw_error. ALWAYS call this on the FIRST aws_request_access for a given account_id in a session \u2014 once you've gotten ok=true once, you can skip subsequent pre-checks. If ok=false, DO NOT call aws_request_access \u2014 surface the user-facing message above and wait. Same jargon-free, no-mechanics rules as aws_request_access: never expose "broker", "grant", "MCP", "Slack channel ID", etc to the user \u2014 talk about the AWS account and the invite action.` + inventoryBlock + NO_DIRECT_HTTP_BLOCK,
   checkApprovalChannelShape,
   async (args) => {
     try {
@@ -21430,7 +21778,7 @@ server.tool(
   // accounts inline with the tool that consumes account_id. This is the
   // call site where a wrong/invented account_id would actually do harm
   // (route to a nonexistent enrolment → 404 → confusing failure mode).
-  'Request scoped, TTL-bounded AWS credentials for the current task. CALL aws_check_approval_channel FIRST on the FIRST request for a given account_id in a session \u2014 if it returns ok=false, DO NOT call this tool, surface the invite-the-bot message instead. agent_id and run_id are optional \u2014 the broker fills them from the host MCP env (AGT_AGENT_ID / AGT_RUN_ID). source_context is optional but you SHOULD pass it whenever the request was triggered by an inbound channel message: extract { channel_type, channel_id, thread_ts? } from the `<channel>` tag in the conversation that triggered this. Slack: channel_type="slack", channel_id=tag\'s `channel`, thread_ts=tag\'s `thread_ts`. Telegram: channel_type="telegram", channel_id=tag\'s `chat_id`. Direct-chat: channel_type="direct-chat", channel_id=tag\'s `session_id`. Without source_context the resolution notification dead-ends in your direct-chat instead of threading back to the original conversation. Returns { grant_id, status, secret_ref?, expires_at?, denial_reason?, notification_status?, notification_failure_reason?, notification_channel_name?, notification_channel_id?, notification_permalink?, notification_bot_user_handle? }. status="active" means credentials are ready, use them now. status="denied" means the request was rejected (denial_reason explains). status="pending" means approval is still outstanding \u2014 DO NOT poll. Post a brief, jargon-free acknowledgement to the user first. When notification_channel_name is populated, QUOTE IT VERBATIM in the acknowledgement (e.g. "Requesting access to the <aws_account_name> account so I can <do the task> \u2014 pinged an admin in #<notification_channel_name> to approve, will resume the moment it lands"); NEVER invent or guess a channel name from training (e.g. "#aws-approvals" is wrong if the configured channel is "#agt-approvals"). When notification_permalink is populated, you MAY append it as a markdown link (e.g. "[approval card](<notification_permalink>)") so the user can jump straight to it; otherwise omit. When notification_channel_name is absent, fall back to the channel-agnostic phrasing ("pinged an admin to approve"). Then save the grant_id and return control. NEVER expose broker mechanics to the user \u2014 phrases like "firing a broker grant", "requesting a grant", "broker grant", "grant_id", "secret_ref", "STS", "AssumeRole", or any aws_* tool name must not appear in user-facing messages. Also NEVER paste the grant UUID into user-facing prose (e.g. "request c7a0b7be-5e09-\u2026 is queued") \u2014 it is operator-only metadata and reads as noise to the user. Talk about the task and the AWS account, not the plumbing. The broker pushes the resolution to you via direct-chat the moment a human approves or denies. The notification body will include an "Original conversation:" line naming the channel/thread to reply in \u2014 when it arrives, post a one-line acknowledgement there in the same jargon-free style ("Approval came through for <aws_account_name> \u2014 kicking off <the task> now" on active; "Couldn\'t get access to <aws_account_name> for <the task>: <paraphrased reason> \u2014 let me know how you\'d like to proceed" on denied) BEFORE calling aws_get_credentials or doing the work, then complete the user\'s task in that same channel/thread (not direct-chat). Going silent between the request and the work loses the human-in-the-loop signal. Only check notification_status if you need to flag a setup issue to the user: "sent" means a human was paged; "failed" or "not_attempted" means no human was paged (typically channel_not_found because the approval-bot is not a member of the configured channel). When notification_status is "failed" and notification_bot_user_handle + notification_channel_name are populated, name them specifically in the user message: "I queued the access request for <aws_account_name> but couldn\'t notify the approver \u2014 please run `/invite @<notification_bot_user_handle>` in #<notification_channel_name> and let me know when done so I can re-fire". When the handle/channel-name aren\'t populated, fall back to the generic version: "I couldn\'t reach an approver for the <aws_account_name> account (the approval bot isn\'t in the configured channel) \u2014 please ping an admin manually, or fix the AWS approval channel in Team Settings". Keep the user-facing text jargon-free and paraphrased. grant_id and notification_failure_reason are operator/escalation-only metadata; if and only if you are escalating to an operator, append "(reference: <grant_id>, failure: <notification_failure_reason>)" to the operator-facing escalation note. aws_poll_grant exists as an escape hatch for explicit re-checks but the autonomous flow does not need it.' + inventoryBlock,
+  'Request scoped, TTL-bounded AWS credentials for the current task. CALL aws_check_approval_channel FIRST on the FIRST request for a given account_id in a session \u2014 if it returns ok=false, DO NOT call this tool, surface the invite-the-bot message instead. agent_id and run_id are optional \u2014 the broker fills them from the host MCP env (AGT_AGENT_ID / AGT_RUN_ID). source_context is optional but you SHOULD pass it whenever the request was triggered by an inbound channel message: extract { channel_type, channel_id, thread_ts? } from the `<channel>` tag in the conversation that triggered this. Slack: channel_type="slack", channel_id=tag\'s `channel`, thread_ts=tag\'s `thread_ts`. Telegram: channel_type="telegram", channel_id=tag\'s `chat_id`. Direct-chat: channel_type="direct-chat", channel_id=tag\'s `session_id`. Without source_context the resolution notification dead-ends in your direct-chat instead of threading back to the original conversation. Returns { grant_id, status, secret_ref?, expires_at?, denial_reason?, notification_status?, notification_failure_reason?, notification_channel_name?, notification_channel_id?, notification_permalink?, notification_bot_user_handle? }. status="active" means credentials are ready, use them now. status="denied" means the request was rejected (denial_reason explains). status="pending" means approval is still outstanding \u2014 DO NOT poll. Post a brief, jargon-free acknowledgement to the user first. When notification_channel_name is populated, QUOTE IT VERBATIM in the acknowledgement (e.g. "Requesting access to the <aws_account_name> account so I can <do the task> \u2014 pinged an admin in #<notification_channel_name> to approve, will resume the moment it lands"); NEVER invent or guess a channel name from training (e.g. "#aws-approvals" is wrong if the configured channel is "#agt-approvals"). When notification_permalink is populated, you MAY append it as a markdown link (e.g. "[approval card](<notification_permalink>)") so the user can jump straight to it; otherwise omit. When notification_channel_name is absent, fall back to the channel-agnostic phrasing ("pinged an admin to approve"). Then save the grant_id and return control. NEVER expose broker mechanics to the user \u2014 phrases like "firing a broker grant", "requesting a grant", "broker grant", "grant_id", "secret_ref", "STS", "AssumeRole", or any aws_* tool name must not appear in user-facing messages. Also NEVER paste the grant UUID into user-facing prose (e.g. "request c7a0b7be-5e09-\u2026 is queued") \u2014 it is operator-only metadata and reads as noise to the user. Talk about the task and the AWS account, not the plumbing. The broker pushes the resolution to you via direct-chat the moment a human approves or denies. The notification body will include an "Original conversation:" line naming the channel/thread to reply in \u2014 when it arrives, post a one-line acknowledgement there in the same jargon-free style ("Approval came through for <aws_account_name> \u2014 kicking off <the task> now" on active; "Couldn\'t get access to <aws_account_name> for <the task>: <paraphrased reason> \u2014 let me know how you\'d like to proceed" on denied) BEFORE calling aws_get_credentials or doing the work, then complete the user\'s task in that same channel/thread (not direct-chat). Going silent between the request and the work loses the human-in-the-loop signal. Only check notification_status if you need to flag a setup issue to the user: "sent" means a human was paged; "failed" or "not_attempted" means no human was paged (typically channel_not_found because the approval-bot is not a member of the configured channel). When notification_status is "failed" and notification_bot_user_handle + notification_channel_name are populated, name them specifically in the user message: "I queued the access request for <aws_account_name> but couldn\'t notify the approver \u2014 please run `/invite @<notification_bot_user_handle>` in #<notification_channel_name> and let me know when done so I can re-fire". When the handle/channel-name aren\'t populated, fall back to the generic version: "I couldn\'t reach an approver for the <aws_account_name> account (the approval bot isn\'t in the configured channel) \u2014 please ping an admin manually, or fix the AWS approval channel in Team Settings". Keep the user-facing text jargon-free and paraphrased. grant_id and notification_failure_reason are operator/escalation-only metadata; if and only if you are escalating to an operator, append "(reference: <grant_id>, failure: <notification_failure_reason>)" to the operator-facing escalation note. aws_poll_grant exists as an escape hatch for explicit re-checks but the autonomous flow does not need it. RETRY CONTRACT (ENG-5166) \u2014 if you have a cached grant_id from a prior aws_request_access in this conversation and the user asks you again to do work that needs AWS access (retry, continue, "try again", or any new task on the same account), DO NOT short-circuit on "I already have a request in flight": ALWAYS call aws_poll_grant({grant_id}) FIRST to re-validate. If aws_poll_grant returns status="pending", keep waiting and tell the user "the previous access request is still pending an approver \u2014 will resume the moment it lands". If status="active" and expires_at is still in the future, reuse the existing grant (skip straight to aws_get_credentials). If status="denied", "expired", "failed", "revoked", or "active" past its expires_at, DROP the cached grant_id entirely and call aws_request_access AGAIN with a fresh request; surface "the previous access request was denied/expired/was revoked/expired \u2014 submitting a fresh one" to the user (paraphrase to match the terminal status, jargon-free, no grant_id leakage). NEVER claim "request already in flight" without having just polled and confirmed a genuinely-pending or unexpired-active status. The dispatcher considers status terminal once it leaves the pending state, so a cached grant_id is only trustworthy after a fresh poll.' + inventoryBlock + NO_DIRECT_HTTP_BLOCK,
   requestAccessShape,
   async (args) => {
     try {
@@ -21444,7 +21792,7 @@ server.tool(
 );
 server.tool(
   "aws_poll_grant",
-  "Single-shot status check for a grant. The broker pushes resolution updates to you via direct-chat automatically \u2014 you do NOT need to poll in the normal flow. Use this only as an escape hatch: explicit re-check after a notification, or if you suspect a notification was lost (e.g. you got `aws_request_access` returning pending more than ~5 minutes ago and have heard nothing). Returns { grant_id, status, secret_ref?, expires_at?, denial_reason? }.",
+  "Single-shot status check for a grant. The broker pushes resolution updates to you via direct-chat automatically \u2014 you do NOT need to poll in the normal flow. Use this only as an escape hatch: explicit re-check after a notification, or if you suspect a notification was lost (e.g. you got `aws_request_access` returning pending more than ~5 minutes ago and have heard nothing). Returns { grant_id, status, secret_ref?, expires_at?, denial_reason? }." + NO_DIRECT_HTTP_BLOCK,
   pollGrantShape,
   async (args) => {
     try {
@@ -21457,7 +21805,7 @@ server.tool(
 );
 server.tool(
   "aws_release_access",
-  "Voluntarily release a grant before its TTL expires. Idempotent \u2014 safe to call on already-revoked or already-expired grants. Returns { grant_id, status }.",
+  "Voluntarily release a grant before its TTL expires. Idempotent \u2014 safe to call on already-revoked or already-expired grants. Returns { grant_id, status }." + NO_DIRECT_HTTP_BLOCK,
   releaseAccessShape,
   async (args) => {
     try {
@@ -21470,7 +21818,7 @@ server.tool(
 );
 server.tool(
   "aws_get_credentials",
-  "Fetch the AWS credentials for an active grant. Call this AFTER aws_request_access returns active (auto-approve) OR after the resolution-notification arrives (route_to_approver). Returns { grant_id, expires_at, credentials: { access_key_id, secret_access_key, session_token } }. Use them by prefixing your bash invocation, e.g. `AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... AWS_SESSION_TOKEN=... aws ec2 describe-instances`. The grant must still be active and unexpired \u2014 409 if already released, 410 if past expires_at. Safe to call multiple times within the TTL window; the credentials don't change. Call aws_release_access when done.",
+  "Fetch the AWS credentials for an active grant. Call this AFTER aws_request_access returns active (auto-approve) OR after the resolution-notification arrives (route_to_approver). Returns { grant_id, expires_at, credentials: { access_key_id, secret_access_key, session_token } }. Use them by prefixing your bash invocation, e.g. `AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... AWS_SESSION_TOKEN=... aws ec2 describe-instances`. The grant must still be active and unexpired \u2014 409 if already released, 410 if past expires_at. Safe to call multiple times within the TTL window; the credentials don't change. Call aws_release_access when done." + NO_DIRECT_HTTP_BLOCK,
   getCredentialsShape,
   async (args) => {
     try {
@@ -21483,7 +21831,7 @@ server.tool(
 );
 server.tool(
   "aws_list_accounts",
-  `List the AWS accounts your team currently has enrolled with the broker. Returns { accounts: [{ account_id, display_name, description?, default_region?, allowed_regions? }] }. The boot-time inventory injected into aws_request_access's description is frozen for this MCP process \u2014 call this tool when an account you expect to see is missing (e.g. an operator just re-enrolled one), when you want to confirm the canonical display_name / default_region / allowed_regions before firing aws_request_access, or to recover from "no enrolment" errors that hint the inventory may be stale. No arguments \u2014 agent_id is filled from the host MCP env (AGT_AGENT_ID). Cheap and idempotent; calls the same /aws/inventory endpoint that boots the description block.`,
+  `List the AWS accounts your team currently has enrolled with the broker. Returns { accounts: [{ account_id, display_name, description?, default_region?, allowed_regions? }] }. The boot-time inventory injected into aws_request_access's description is frozen for this MCP process \u2014 call this tool when an account you expect to see is missing (e.g. an operator just re-enrolled one), when you want to confirm the canonical display_name / default_region / allowed_regions before firing aws_request_access, or to recover from "no enrolment" errors that hint the inventory may be stale. No arguments \u2014 agent_id is filled from the host MCP env (AGT_AGENT_ID). Cheap and idempotent; calls the same /aws/inventory endpoint that boots the description block.` + NO_DIRECT_HTTP_BLOCK,
   listAccountsShape,
   async () => {
     try {
@@ -21494,6 +21842,216 @@ server.tool(
     }
   }
 );
+server.tool(
+  "gcp_describe_scope",
+  "Return the team's resolved GCP policy ceiling for a project: max_ttl_seconds, auto-approved permissions, allowed resource patterns, and the permission denylist. Call before gcp_request_access if you're not sure what you're allowed to ask for \u2014 free, idempotent, writes nothing." + gcpInventoryBlock + NO_DIRECT_HTTP_BLOCK,
+  gcpDescribeScopeShape,
+  async (args) => {
+    try {
+      const result = await broker.gcpDescribeScope(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "gcp_preview_request",
+  'Dry-run a candidate GCP access request. Returns "auto_approve" / "route_to_approver" / "hard_deny" without dispatching anything or writing audit_log. Lets the agent self-tighten scope before triggering a human approval.' + NO_DIRECT_HTTP_BLOCK,
+  gcpPreviewRequestShape,
+  async (args) => {
+    try {
+      const result = await broker.gcpPreviewRequest(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "gcp_check_approval_channel",
+  'Verify the agent\'s Slack bot can post to the GCP-approval channel for a project BEFORE calling gcp_request_access. Returns { ok, channel?, bot_user_handle?, reason? }. Same failure-mode taxonomy as aws_check_approval_channel \u2014 branch on reason: "channel_not_found"/"not_in_channel" \u2192 ask user to `/invite @<bot_user_handle>` in the approvals channel; "archived" \u2192 ask admin to repoint; "no_approval_channel_configured" \u2192 ask user to configure one in Team Settings; "agent_slack_not_configured" \u2192 escalate to operator; "auth_failed"/"unknown" \u2192 escalate. ALWAYS call this on the FIRST gcp_request_access for a given project_id in a session. If ok=false, DO NOT call gcp_request_access. Same jargon-free, no-mechanics rules as gcp_request_access \u2014 talk about the GCP project and the invite action, never "broker", "grant", "MCP".' + gcpInventoryBlock + NO_DIRECT_HTTP_BLOCK,
+  gcpCheckApprovalChannelShape,
+  async (args) => {
+    try {
+      const result = await broker.gcpCheckApprovalChannel(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "gcp_request_access",
+  'Request scoped, TTL-bounded GCP credentials for the current task. CALL gcp_check_approval_channel FIRST on the FIRST request for a given project_id in a session \u2014 if it returns ok=false, do not call this tool, surface the invite-the-bot message instead. agent_id and run_id default from the host MCP env. Pass source_context whenever an inbound channel triggered the request so the resolution notification threads back to the original conversation. Returns { grant_id, status, secret_ref?, expires_at?, denial_reason?, notification_status?, notification_failure_reason?, notification_channel_name?, notification_channel_id?, notification_permalink?, notification_bot_user_handle? }. status="active" \u2192 credentials are ready, call gcp_get_credentials. status="denied" \u2192 request rejected, denial_reason explains. status="pending" \u2192 DO NOT poll, the broker pushes resolution via direct-chat. Post a brief jargon-free acknowledgement first. Quote notification_channel_name VERBATIM when populated ("pinged an admin in #<notification_channel_name> to approve, will resume the moment it lands"); never invent a channel name. Append the notification_permalink as a markdown link when present. Save the grant_id and return control. NEVER expose broker mechanics ("grant", "secret_ref", "IAM Credentials", "generateAccessToken", "MCP", any gcp_* tool name) in user-facing prose \u2014 talk about the task and the GCP project. When the resolution lands via direct-chat, post a one-line acknowledgement in the original channel/thread before calling gcp_get_credentials or starting the work; complete the task in that same channel/thread. Same notification_status branching as aws_request_access: "sent" \u2192 human paged; "failed"/"not_attempted" \u2192 no human paged, surface specific invite message when bot_user_handle + channel_name populated, generic recovery otherwise.' + gcpInventoryBlock + NO_DIRECT_HTTP_BLOCK,
+  gcpRequestAccessShape,
+  async (args) => {
+    try {
+      const result = await broker.gcpRequestAccess(args);
+      const safe = { ...result, credentials: void 0 };
+      return { content: [{ type: "text", text: JSON.stringify(safe, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "gcp_poll_grant",
+  "Single-shot status check for a GCP grant. The broker pushes resolution updates via direct-chat automatically \u2014 you do NOT need to poll in the normal flow. Escape hatch only: explicit re-check after a notification, or if you suspect a notification was lost. Returns { grant_id, status, secret_ref?, expires_at?, denial_reason? }." + NO_DIRECT_HTTP_BLOCK,
+  gcpPollGrantShape,
+  async (args) => {
+    try {
+      const result = await broker.gcpPollGrant(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "gcp_release_access",
+  "Voluntarily release a GCP grant before its TTL expires. Idempotent \u2014 safe on already-revoked or already-expired grants. Returns { grant_id, status }. Note: in v1 this marks the grant revoked in the broker DB and tears down the secret_ref; the already-issued access_token remains valid in GCP until expires_at. For true in-flight kill, an operator can disable the agent service account via the team kill switch (see PRD \xA76.5)." + NO_DIRECT_HTTP_BLOCK,
+  gcpReleaseAccessShape,
+  async (args) => {
+    try {
+      const result = await broker.gcpReleaseAccess(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "gcp_get_credentials",
+  "Fetch the GCP access token for an active grant. Call AFTER gcp_request_access returns active OR after the resolution-notification arrives. Returns { grant_id, expires_at, credentials: { access_token } }. Use by prefixing your bash invocation, e.g. `CLOUDSDK_AUTH_ACCESS_TOKEN=... gcloud storage ls gs://reports/` \u2014 gcloud, gsutil, and bq all pick it up automatically. The grant must still be active and unexpired \u2014 409 if already released, 410 if past expires_at. Safe to call multiple times within the TTL window. Call gcp_release_access when done." + NO_DIRECT_HTTP_BLOCK,
+  gcpGetCredentialsShape,
+  async (args) => {
+    try {
+      const result = await broker.gcpGetCredentials(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "gcp_list_accounts",
+  `List the GCP projects your team currently has enrolled with the broker. Returns { projects: [{ project_id, display_name, description?, service_account_email? }] }. The boot-time inventory injected into gcp_request_access's description is frozen for this MCP process \u2014 call this tool when a project you expect to see is missing (e.g. an operator just re-enrolled one), to confirm the canonical display_name before firing gcp_request_access, or to recover from "no enrolment" errors that hint the inventory may be stale. No arguments \u2014 agent_id is filled from the host MCP env. Cheap and idempotent.` + NO_DIRECT_HTTP_BLOCK,
+  gcpListAccountsShape,
+  async () => {
+    try {
+      const result = await broker.gcpListInventory();
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "supabase_describe_scope",
+  "Return the team's resolved Supabase policy ceiling for a project: max_ttl_seconds, auto_approved_roles, allowed_schemas, and allow_write. Call before supabase_request_access if you're not sure what you're allowed to ask for \u2014 free, idempotent, writes nothing." + supabaseInventoryBlock + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabaseDescribeScopeShape,
+  async (args) => {
+    try {
+      const result = await broker.supabaseDescribeScope(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "supabase_preview_request",
+  'Dry-run a candidate Supabase access request. Returns "auto_approve" / "route_to_approver" / "hard_deny" without dispatching anything or writing audit_log. Lets the agent self-tighten scope before triggering a human approval.' + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabasePreviewRequestShape,
+  async (args) => {
+    try {
+      const result = await broker.supabasePreviewRequest(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "supabase_check_approval_channel",
+  'Verify the agent\'s Slack bot can post to the Supabase-approval channel for a project BEFORE calling supabase_request_access. Returns { ok, channel?, bot_user_handle?, reason? }. Same failure-mode taxonomy as aws_check_approval_channel \u2014 branch on reason: "channel_not_found"/"not_in_channel" \u2192 ask user to `/invite @<bot_user_handle>` in the approvals channel; "archived" \u2192 ask admin to repoint; "no_approval_channel_configured" \u2192 ask user to configure one in Team Settings; "agent_slack_not_configured" \u2192 escalate to operator; "auth_failed"/"unknown" \u2192 escalate. ALWAYS call this on the FIRST supabase_request_access for a given project_ref in a session. If ok=false, DO NOT call supabase_request_access. Same jargon-free, no-mechanics rules \u2014 talk about the Supabase project and the invite action, never "broker", "grant", "MCP".' + supabaseInventoryBlock + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabaseCheckApprovalChannelShape,
+  async (args) => {
+    try {
+      const result = await broker.supabaseCheckApprovalChannel(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "supabase_request_access",
+  `Request a short-lived Supabase JWT to query a Supabase project. CALL supabase_check_approval_channel FIRST on the FIRST request for a given project_ref in a session \u2014 if ok=false, surface the invite-the-bot message instead. "service_role" always routes to a human approver; "authenticated" may auto-approve if in the team's policy ceiling. agent_id and run_id default from host MCP env. Pass source_context so the resolution notification threads back to the original conversation. Returns { grant_id, status, expires_at?, credentials?, denial_reason?, notification_status?, notification_channel_name?, notification_permalink? }. status="active" \u2192 credentials are ready, call supabase_get_credentials. status="denied" \u2192 request rejected. status="pending" \u2192 DO NOT poll; broker pushes resolution via direct-chat. Post a brief jargon-free acknowledgement first; quote notification_channel_name VERBATIM if present ("pinged an admin in #<notification_channel_name> to approve"). Save grant_id and return control. NEVER expose broker mechanics ("grant", "JWT", "MCP", any supabase_* tool name) in user-facing prose \u2014 talk about the task and the Supabase project. When resolution lands via direct-chat, post a one-line acknowledgement in the original channel/thread BEFORE calling supabase_get_credentials. RETRY CONTRACT: if you have a cached grant_id, ALWAYS call supabase_poll_grant first to re-validate before claiming "request in flight".` + supabaseInventoryBlock + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabaseRequestAccessShape,
+  async (args) => {
+    try {
+      const result = await broker.supabaseRequestAccess(args);
+      const safe = { ...result, credentials: void 0 };
+      return { content: [{ type: "text", text: JSON.stringify(safe, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "supabase_poll_grant",
+  "Single-shot status check for a Supabase grant. The broker pushes resolution via direct-chat automatically \u2014 you do NOT need to poll in the normal flow. Escape hatch only. Returns { grant_id, status, expires_at?, denial_reason? }." + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabasePollGrantShape,
+  async (args) => {
+    try {
+      const result = await broker.supabasePollGrant(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "supabase_release_access",
+  "Voluntarily release a Supabase grant before its TTL expires. Idempotent \u2014 safe on already-revoked or already-expired grants. Returns { grant_id, status }. Note: the already-issued JWT remains cryptographically valid until its exp claim \u2014 revocation marks it in the broker DB and prevents supabase_get_credentials from returning it again, but does not invalidate it at Supabase's JWT verification layer. Call this when done to signal intent; the TTL is the hard expiry." + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabaseReleaseAccessShape,
+  async (args) => {
+    try {
+      const result = await broker.supabaseReleaseAccess(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "supabase_get_credentials",
+  'Fetch the Supabase JWT for an active grant. Call AFTER supabase_request_access returns active OR after the resolution-notification arrives. Returns { grant_id, expires_at, credentials: { access_token, supabase_url, db_host, project_ref } }. Two usage patterns: (1) REST \u2014 curl -H "Authorization: Bearer <access_token>" <supabase_url>/rest/v1/<table>?select=*; (2) psql \u2014 psql "postgresql://postgres.<project_ref>:<access_token>@<db_host>:5432/postgres". The grant must still be active and unexpired \u2014 409 if already released, 410 if past expires_at. Safe to call multiple times within the TTL window. Call supabase_release_access when done.' + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabaseGetCredentialsShape,
+  async (args) => {
+    try {
+      const result = await broker.supabaseGetCredentials(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
+server.tool(
+  "supabase_list_projects",
+  `List the Supabase projects your team currently has enrolled with the broker. Returns { projects: [{ project_ref, display_name, description?, supabase_url? }] }. The boot-time inventory injected into supabase_request_access's description is frozen for this MCP process \u2014 call this tool when a project you expect to see is missing, to confirm the canonical display_name, or to recover from "no enrolment" errors. No arguments \u2014 agent_id is filled from the host MCP env. Cheap and idempotent.` + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabaseListProjectsShape,
+  async () => {
+    try {
+      const result = await broker.supabaseListInventory();
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/cloud-broker",
-  "version": "0.7.1",
+  "version": "0.7.4",
   "description": "Cloud Access Broker — MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials — STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   "type": "module",
   "bin": {
@@ -27,7 +27,9 @@
     "test": "vitest run",
     "clean": "rm -rf dist",
     "publish:templates": "bash cloudformation/publish.sh",
-    "check-published": "bash cloudformation/check-published.sh"
+    "check-published": "bash cloudformation/check-published.sh",
+    "publish:terraform": "bash terraform/publish.sh",
+    "check-published-terraform": "bash terraform/check-published.sh"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.27.1",