@integrity-labs/cloud-broker 0.7.7 → 0.7.9

package/dist/index.js

@@ -21602,7 +21602,7 @@ var supabaseListProjectsShape = supabaseListProjectsSchema.shape;
 // package.json
 var package_default = {
   name: "@integrity-labs/cloud-broker",
-  version: "0.7.7",
+  version: "0.7.9",
   description: "Cloud Access Broker \u2014 MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials \u2014 STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   type: "module",
   bin: {
@@ -22056,7 +22056,7 @@ server.tool(
 );
 server.tool(
   "supabase_get_credentials",
-  'Fetch the Supabase JWT for an active grant. Call AFTER supabase_request_access returns active OR after the resolution-notification arrives. Returns { grant_id, expires_at, credentials: { access_token, supabase_url, db_host, project_ref } }. Two usage patterns: (1) REST \u2014 curl -H "Authorization: Bearer <access_token>" <supabase_url>/rest/v1/<table>?select=*; (2) psql \u2014 psql "postgresql://postgres.<project_ref>:<access_token>@<db_host>:5432/postgres". The grant must still be active and unexpired \u2014 409 if already released, 410 if past expires_at. Safe to call multiple times within the TTL window. Call supabase_release_access when done.' + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  "Fetch the Supabase JWT for an active grant. Call AFTER supabase_request_access returns active OR after the resolution-notification arrives. Returns { grant_id, expires_at, credentials: { access_token, supabase_url, db_host, project_ref } }. IMPORTANT - access_token is a project-signed JWT for the PostgREST layer and is NOT a usable credential on its own: (1) REST requires BOTH headers - `apikey: <project anon or service key>` AND `Authorization: Bearer <access_token>`; a Bearer-only call fails with UNAUTHORIZED_INVALID_API_KEY. This broker does NOT return the apikey, so REST only works if you already hold the project anon key from elsewhere. (2) The JWT is NOT a Postgres password - a psql/pooler connection using it as the password (postgres.<ref>:<jwt>@host) is rejected on :5432 and :6543, because Supavisor authenticates the real DB password via SCRAM. So this credential cannot run raw SQL. (Scoped server-side query/describe tools that execute under your approved scope are coming - ENG-7326.) The grant must still be active and unexpired - 409 if already released, 410 if past expires_at. Safe to call multiple times within the TTL window. Call supabase_release_access when done." + NO_DIRECT_SUPABASE_HTTP_BLOCK,
   supabaseGetCredentialsShape,
   async (args) => {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/cloud-broker",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "Cloud Access Broker — MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials — STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   "type": "module",
   "bin": {