@relaycast/engine 8.1.2 → 8.2.0

package/dist/engine/agentIdentity.d.ts

@@ -0,0 +1,49 @@
+import type { getDb } from '../db/index.js';
+type Db = ReturnType<typeof getDb>;
+export type AgentIdentityAuthority = 'current_agent_token' | 'origin_node' | 'work_unit_proof' | 'workspace_admin';
+export interface AgentIdentityTarget {
+    workspaceId: string;
+    agentId: string;
+    agentName: string;
+}
+export interface AgentIdentityAuditContext {
+    authority: AgentIdentityAuthority;
+    actor: string;
+    reason: string;
+    sessionRef?: string | null;
+    nodeId?: string | null;
+    originActor: string;
+}
+export declare function getRecoveryCredentialByProof(db: Db, rawProof: string): Promise<{
+    workspaceId: string;
+    agentId: string;
+    agentName: string;
+    workUnitId: string | null;
+} | null>;
+export declare function enrollRecoveryCredential(db: Db, target: Pick<AgentIdentityTarget, 'workspaceId' | 'agentId'>, input: {
+    verifierHash: string;
+    proofKind?: 'work_unit';
+    workUnitId?: string | null;
+}): Promise<void>;
+export declare function rotateAgentIdentity(db: Db, target: AgentIdentityTarget, audit: AgentIdentityAuditContext, action?: 'recover' | 'takeover', options?: {
+    requireAtomic?: boolean;
+    alreadyAtomic?: boolean;
+}): Promise<{
+    agent_id: string;
+    name: string;
+    token: string;
+    audit_id: string;
+}>;
+export declare function takeOverAgentIdentity(db: Db, target: AgentIdentityTarget, audit: Omit<AgentIdentityAuditContext, 'authority'>): Promise<{
+    agent_id: string;
+    name: string;
+    token: string;
+    audit_id: string;
+}>;
+export declare function revokeAgentIdentityTokens(db: Db, target: AgentIdentityTarget, audit: Omit<AgentIdentityAuditContext, 'authority'>): Promise<{
+    agent_id: string;
+    name: string;
+    audit_id: string;
+}>;
+export {};
+//# sourceMappingURL=agentIdentity.d.ts.map

package/dist/engine/agentIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentIdentity.d.ts","sourceRoot":"","sources":["../../src/engine/agentIdentity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAS5C,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAEnC,MAAM,MAAM,sBAAsB,GAC9B,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,sBAAsB,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AA6CD,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,IAAI,CAAC,CAgBR;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,aAAa,GAAG,SAAS,CAAC,EAC5D,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GACA,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,yBAAyB,EAChC,MAAM,GAAE,SAAS,GAAG,UAAsB,EAC1C,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACjE,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAiD9E;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,IAAI,CAAC,yBAAyB,EAAE,WAAW,CAAC,GAClD,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9E;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,IAAI,CAAC,yBAAyB,EAAE,WAAW,CAAC,GAClD,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoC/D"}

package/dist/engine/agentIdentity.js

@@ -0,0 +1,158 @@
+import { and, eq, ne, sql } from 'drizzle-orm';
+import { agentIdentityAudit, agentRecoveryCredentials, agents } from '../db/schema.js';
+import { randomHex, sha256Hex } from '../lib/crypto.js';
+import { codedError } from '../lib/httpError.js';
+import { runAtomicWrites } from '../ports/database.js';
+import { generateId } from './snowflake.js';
+import { AGENT_TOKEN_GRACE_MS } from './tokenRotate.js';
+import { RELEASED_AGENT_STATUS } from './agent.js';
+function targetPredicate(target) {
+    return and(eq(agents.workspaceId, target.workspaceId), eq(agents.id, target.agentId), eq(agents.name, target.agentName), ne(agents.status, RELEASED_AGENT_STATUS));
+}
+function auditInsertAfterTokenChange(writeDb, target, tokenHash, row) {
+    // The SELECT sees the token update earlier in the same transaction/batch.
+    // If the target predicate matched no live agent, it produces no row, so D1
+    // cannot commit a successful-looking audit entry for a failed mutation.
+    return writeDb.insert(agentIdentityAudit).select(writeDb
+        .select({
+        id: sql `${row.id}`.as('id'),
+        workspaceId: sql `${row.workspaceId}`.as('workspace_id'),
+        agentId: sql `${row.agentId}`.as('agent_id'),
+        agentName: sql `${row.agentName}`.as('agent_name'),
+        action: sql `${row.action}`.as('action'),
+        authority: sql `${row.authority}`.as('authority'),
+        actor: sql `${row.actor}`.as('actor'),
+        reason: sql `${row.reason}`.as('reason'),
+        sessionRef: sql `${row.sessionRef ?? null}`.as('session_ref'),
+        nodeId: sql `${row.nodeId ?? null}`.as('node_id'),
+        originActor: sql `${row.originActor}`.as('origin_actor'),
+        createdAt: sql `unixepoch()`.as('created_at'),
+    })
+        .from(agents)
+        .where(and(targetPredicate(target), eq(agents.tokenHash, tokenHash))));
+}
+function firstReturnedRow(result) {
+    return Array.isArray(result) ? result[0] : undefined;
+}
+export async function getRecoveryCredentialByProof(db, rawProof) {
+    const verifierHash = await sha256Hex(rawProof);
+    const [row] = await db
+        .select({
+        workspaceId: agentRecoveryCredentials.workspaceId,
+        agentId: agentRecoveryCredentials.agentId,
+        agentName: agents.name,
+        workUnitId: agentRecoveryCredentials.workUnitId,
+    })
+        .from(agentRecoveryCredentials)
+        .innerJoin(agents, and(eq(agents.workspaceId, agentRecoveryCredentials.workspaceId), eq(agents.id, agentRecoveryCredentials.agentId)))
+        .where(eq(agentRecoveryCredentials.verifierHash, verifierHash));
+    return row ?? null;
+}
+export async function enrollRecoveryCredential(db, target, input) {
+    const now = new Date();
+    await db
+        .insert(agentRecoveryCredentials)
+        .values({
+        id: `arc_${generateId()}`,
+        workspaceId: target.workspaceId,
+        agentId: target.agentId,
+        proofKind: input.proofKind ?? 'work_unit',
+        verifierHash: input.verifierHash,
+        workUnitId: input.workUnitId ?? null,
+        createdAt: now,
+        updatedAt: now,
+    })
+        .onConflictDoUpdate({
+        target: [agentRecoveryCredentials.workspaceId, agentRecoveryCredentials.agentId],
+        set: {
+            proofKind: input.proofKind ?? 'work_unit',
+            verifierHash: input.verifierHash,
+            workUnitId: input.workUnitId ?? null,
+            updatedAt: now,
+        },
+    });
+}
+export async function rotateAgentIdentity(db, target, audit, action = 'recover', options = {}) {
+    const token = `at_live_${randomHex(16)}`;
+    const tokenHash = await sha256Hex(token);
+    const auditId = `aid_${generateId()}`;
+    const graceExpiresAtSeconds = Math.floor((Date.now() + AGENT_TOKEN_GRACE_MS) / 1000);
+    const buildWrites = (writeDb) => [
+        writeDb
+            .update(agents)
+            .set({
+            previousTokenHash: sql `${agents.tokenHash}`,
+            previousTokenExpiresAt: sql `${graceExpiresAtSeconds}`,
+            tokenHash,
+        })
+            .where(targetPredicate(target))
+            .returning({ id: agents.id }),
+        auditInsertAfterTokenChange(writeDb, target, tokenHash, {
+            id: auditId,
+            workspaceId: target.workspaceId,
+            agentId: target.agentId,
+            agentName: target.agentName,
+            action,
+            authority: audit.authority,
+            actor: audit.actor,
+            reason: audit.reason,
+            sessionRef: audit.sessionRef ?? null,
+            nodeId: audit.nodeId ?? null,
+            originActor: audit.originActor,
+        }),
+    ];
+    let results;
+    if (options.alreadyAtomic) {
+        results = [];
+        for (const write of buildWrites(db))
+            results.push(await write);
+    }
+    else {
+        results = await runAtomicWrites(db, buildWrites, {
+            requireAtomic: options.requireAtomic ?? true,
+        });
+    }
+    if (!firstReturnedRow(results[0])) {
+        throw codedError(`Agent "${target.agentName}" changed before identity recovery completed`, 'agent_identity_conflict', 409);
+    }
+    return { agent_id: target.agentId, name: target.agentName, token, audit_id: auditId };
+}
+export async function takeOverAgentIdentity(db, target, audit) {
+    return rotateAgentIdentity(db, target, {
+        ...audit,
+        authority: 'workspace_admin',
+    }, 'takeover');
+}
+export async function revokeAgentIdentityTokens(db, target, audit) {
+    const replacementHash = await sha256Hex(`revoked:${target.agentId}:${randomHex(16)}`);
+    const auditId = `aid_${generateId()}`;
+    const results = await runAtomicWrites(db, (writeDb) => [
+        writeDb
+            .update(agents)
+            .set({
+            tokenHash: replacementHash,
+            previousTokenHash: null,
+            previousTokenExpiresAt: null,
+        })
+            .where(targetPredicate(target))
+            .returning({ id: agents.id }),
+        auditInsertAfterTokenChange(writeDb, target, replacementHash, {
+            id: auditId,
+            workspaceId: target.workspaceId,
+            agentId: target.agentId,
+            agentName: target.agentName,
+            action: 'revoke',
+            authority: 'workspace_admin',
+            actor: audit.actor,
+            reason: audit.reason,
+            sessionRef: audit.sessionRef ?? null,
+            nodeId: audit.nodeId ?? null,
+            originActor: audit.originActor,
+        }),
+    ], { requireAtomic: true });
+    if (!firstReturnedRow(results[0])) {
+        throw codedError(`Agent "${target.agentName}" changed before revocation completed`, 'agent_identity_conflict', 409);
+    }
+    return { agent_id: target.agentId, name: target.agentName, audit_id: auditId };
+}
+//# sourceMappingURL=agentIdentity.js.map

package/dist/engine/agentIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentIdentity.js","sourceRoot":"","sources":["../../src/engine/agentIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAyBnD,SAAS,eAAe,CAAC,MAA2B;IAClD,OAAO,GAAG,CACR,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,EAC1C,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAC7B,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EACjC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAW,EACX,MAA2B,EAC3B,SAAiB,EACjB,GAA2C;IAE3C,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAC9C,OAAO;SACJ,MAAM,CAAC;QACN,EAAE,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACnC,WAAW,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC;QAC/D,OAAO,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC;QACnD,SAAS,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC;QACzD,MAAM,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC;QAC/C,SAAS,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC;QACxD,KAAK,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC;QAC5C,MAAM,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC;QAC/C,UAAU,EAAE,GAAG,CAAe,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC;QAC3E,MAAM,EAAE,GAAG,CAAe,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;QAC/D,WAAW,EAAE,GAAG,CAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC;QAC/D,SAAS,EAAE,GAAG,CAAM,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC;KACnD,CAAC;SACD,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAI,MAAe;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAM,EACN,QAAgB;IAOhB,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,WAAW,EAAE,wBAAwB,CAAC,WAAW;QACjD,OAAO,EAAE,wBAAwB,CAAC,OAAO;QACzC,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,UAAU,EAAE,wBAAwB,CAAC,UAAU;KAChD,CAAC;SACD,IAAI,CAAC,wBAAwB,CAAC;SAC9B,SAAS,CAAC,MAAM,EAAE,GAAG,CACpB,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC,WAAW,CAAC,EAC5D,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAChD,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,MAA4D,EAC5D,KAIC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE;SACL,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC;QACN,EAAE,EAAE,OAAO,UAAU,EAAE,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,WAAW;QACzC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,wBAAwB,CAAC,WAAW,EAAE,wBAAwB,CAAC,OAAO,CAAC;QAChF,GAAG,EAAE;YACH,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,WAAW;YACzC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,SAAS,EAAE,GAAG;SACf;KACF,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,MAA2B,EAC3B,KAAgC,EAChC,SAAiC,SAAS,EAC1C,UAAgE,EAAE;IAElE,MAAM,KAAK,GAAG,WAAW,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,UAAU,EAAE,EAAE,CAAC;IACtC,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC,GAAG,IAAI,CAAC,CAAC;IAErF,MAAM,WAAW,GAAG,CAAC,OAAW,EAAE,EAAE,CAAC;QACnC,OAAO;aACJ,MAAM,CAAC,MAAM,CAAC;aACd,GAAG,CAAC;YACH,iBAAiB,EAAE,GAAG,CAAA,GAAG,MAAM,CAAC,SAAS,EAAE;YAC3C,sBAAsB,EAAE,GAAG,CAAA,GAAG,qBAAqB,EAAE;YACrD,SAAS;SACV,CAAC;aACD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;aAC9B,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QAC/B,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;YACtD,EAAE,EAAE,OAAO;YACX,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;KACM,CAAC;IACX,IAAI,OAAkB,CAAC;IACvB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE;YAC/C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAiB,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,CACd,UAAU,MAAM,CAAC,SAAS,8CAA8C,EACxE,yBAAyB,EACzB,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAM,EACN,MAA2B,EAC3B,KAAmD;IAEnD,OAAO,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,GAAG,KAAK;QACR,SAAS,EAAE,iBAAiB;KAC7B,EAAE,UAAU,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAM,EACN,MAA2B,EAC3B,KAAmD;IAEnD,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,WAAW,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,OAAO,UAAU,EAAE,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,OAAO;aACJ,MAAM,CAAC,MAAM,CAAC;aACd,GAAG,CAAC;YACH,SAAS,EAAE,eAAe;YAC1B,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,IAAI;SAC7B,CAAC;aACD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;aAC9B,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QAC/B,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE;YAC5D,EAAE,EAAE,OAAO;YACX,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,iBAAiB;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;KACH,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5B,IAAI,CAAC,gBAAgB,CAAiB,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,CACd,UAAU,MAAM,CAAC,SAAS,uCAAuC,EACjE,yBAAyB,EACzB,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACjF,CAAC"}

package/dist/engine/node.d.ts

@@ -1,4 +1,4 @@
-import type { FleetAgentRegisterMessage, FleetCapabilityAcceptance, FleetInventoryAgent, FleetNodeHeartbeatMessage, FleetNodeRegisterMessage, FleetProviderIdentity, FleetCapability, AgentRegisterReplyData } from '@relaycast/types';
+import type { FleetAgentRecoverMessage, FleetAgentRegisterMessage, FleetCapabilityAcceptance, FleetInventoryAgent, FleetNodeHeartbeatMessage, FleetNodeRegisterMessage, FleetProviderIdentity, FleetCapability, AgentRegisterReplyData } from '@relaycast/types';
 import type { getDb } from '../db/index.js';
 import { agents, nodes } from '../db/schema.js';
 import type { EngineDb } from '../ports/database.js';
@@ -328,6 +328,14 @@ export declare function listNodeAgents(db: Db, workspaceId: string, nodeName: st
 export declare function registerAgentViaNode(db: Db, workspaceId: string, nodeId: string, providerName: string, message: FleetAgentRegisterMessage, options?: {
     deliveryCursorSupported?: boolean;
 }): Promise<AgentRegisterReplyData>;
+/**
+ * Recover an existing agent using the authenticated node as the authority.
+ * The immutable id and server-owned `origin_node_id` must both match; name,
+ * presence, silence, and the synthetic direct-node convention grant nothing.
+ */
+export declare function recoverAgentViaNode(db: Db, workspaceId: string, nodeId: string, providerName: string, message: FleetAgentRecoverMessage, options?: {
+    deliveryCursorSupported?: boolean;
+}): Promise<AgentRegisterReplyData>;
 export declare function deregisterAgentViaNode(db: Db, workspaceId: string, nodeId: string, message: {
     agent_id?: string;
     name?: string;

package/dist/engine/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/engine/node.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,yBAAyB,EAEzB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAqB,MAAM,EAA8D,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAI/H,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAsBjG,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG7F,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AACnC,KAAK,OAAO,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AACzC,KAAK,QAAQ,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC;AAC3C,KAAK,QAAQ,GAAG,IAAI,GAAG,WAAW,GAAG,MAAM,CAAC;AAC5C,KAAK,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpC,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAUD,KAAK,cAAc,GAAG,MAAM,GAAG,eAAe,CAAC;AAE/C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AA+CD,iBAAS,UAAU,CAAC,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAqB/B;AAyDD,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;;;;;;;;;;;;;;;;;;;;;;;;;GA8FF;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAO5E;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM5E;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMzC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACpC,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,MAAM,EAC3B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAwF7B;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;UAkFnC;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,wBAAwB,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,iBAiD1E;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,uBAAuB,EAAE,OAAO,EAChC,IAAI,CAAC,EAAE,wBAAwB,iBAsBhC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,wBAAwB,iBAgDhC;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAgHD,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,gBAAgB,CAAC,EACvD,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;UAG7E;AA+ID,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,iBAahB;AAgCD,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;GA0D9D;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,oBA6BzG;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;YA2BjF;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,yBAAyB,EAClC,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,sBAAsB,CAAC,CAuIjC;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,CAAC,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;UAmDhC;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,mBAAmB,EAAE,EACtC,cAAc,CAAC,EAAE,wBAAwB;;;;;;;;;GAiN1C;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;KAOrD;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;UAG5E;AA0CD,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,4BAA4B,iBAsThF"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/engine/node.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAEzB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAqB,MAAM,EAA8D,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAI/H,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAuBjG,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG7F,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AACnC,KAAK,OAAO,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AACzC,KAAK,QAAQ,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC;AAC3C,KAAK,QAAQ,GAAG,IAAI,GAAG,WAAW,GAAG,MAAM,CAAC;AAC5C,KAAK,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpC,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAUD,KAAK,cAAc,GAAG,MAAM,GAAG,eAAe,CAAC;AAE/C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AA+CD,iBAAS,UAAU,CAAC,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAqB/B;AAyDD,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;;;;;;;;;;;;;;;;;;;;;;;;;GA8FF;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAO5E;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM5E;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMzC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACpC,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,MAAM,EAC3B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAwF7B;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;UAkFnC;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,wBAAwB,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,iBAiD1E;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,uBAAuB,EAAE,OAAO,EAChC,IAAI,CAAC,EAAE,wBAAwB,iBAsBhC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,wBAAwB,iBAgDhC;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAgHD,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,gBAAgB,CAAC,EACvD,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;UAG7E;AA+ID,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,iBAahB;AAgCD,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;GA0D9D;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,oBA6BzG;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;YA2BjF;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,yBAAyB,EAClC,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,sBAAsB,CAAC,CAgFjC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,sBAAsB,CAAC,CA8HjC;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,CAAC,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;UAmDhC;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,mBAAmB,EAAE,EACtC,cAAc,CAAC,EAAE,wBAAwB;;;;;;;;;GAiN1C;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;KAOrD;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;UAG5E;AA0CD,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,4BAA4B,iBAuVhF"}

package/dist/engine/node.js

@@ -1,4 +1,4 @@
-import { and, eq, inArray, lt, ne, or, sql } from 'drizzle-orm';
+import { and, eq, inArray, ne, or, sql } from 'drizzle-orm';
 import { FLEET_DELIVERY_CURSOR_CAPABILITY, parseFleetBrokerToRelaycastMessage, } from '@relaycast/types';
 import { actionInvocations, agents, agentNodeBindings, channelMembers, channels, nodeProviders, nodes } from '../db/schema.js';
 import { randomHex, sha256Hex } from '../lib/crypto.js';
@@ -6,7 +6,8 @@ import { codedError } from '../lib/httpError.js';
 import { runAtomic } from '../ports/database.js';
 import { isProviderAgentDeliveryReady } from '../ports/realtime.js';
 import { generateId } from './snowflake.js';
-import { AGENT_RECLAIM_GRACE_MS, assertRegistrableAgentName } from './agent.js';
+import { assertRegistrableAgentName } from './agent.js';
+import { rotateAgentIdentity } from './agentIdentity.js';
 import { isNodeLive, nodeHasCapability } from './placement.js';
 import { DEFAULT_PROVIDER_NAME, capabilityKind, heartbeatProvider, markProviderOffline, materializeProviderActions, recomputeNodeAggregate, removeProvider, upsertProvider, } from './nodeProvider.js';
 import { serializeNodeOp } from './nodeLock.js';
@@ -914,11 +915,6 @@ export async function registerAgentViaNode(db, workspaceId, nodeId, providerName
         const token = `at_live_${randomHex(16)}`;
         const tokenHash = await sha256Hex(token);
         const now = new Date().toISOString();
-        const fleetMetadata = sql `json_object(
-      'node_id', ${nodeId},
-      'invocation_id', ${message.invocation_id ?? null},
-      'registered_at', ${now}
-    )`;
         const [result] = await tx
             .insert(agents)
             .values({
@@ -938,55 +934,10 @@ export async function registerAgentViaNode(db, workspaceId, nodeId, providerName
             resumable: message.resumable ?? false,
             sessionRef: message.session_ref ?? null,
         })
-            .onConflictDoUpdate({
-            target: [agents.workspaceId, agents.name],
-            set: {
-                tokenHash,
-                status: 'active',
-                lastSeen: new Date(),
-                metadata: sql `json_patch(COALESCE(${agents.metadata}, '{}'), ${fleetMetadata})`,
-                locationType: 'via_node',
-                locationNodeId: nodeId,
-                providerName,
-                originNodeId: sql `COALESCE(${agents.originNodeId}, ${nodeId})`,
-                resumable: message.resumable ?? false,
-                sessionRef: message.session_ref ?? null,
-            },
-            // Who may take this name and be issued a token for it.
-            //
-            // The first disjunct gates on OBSERVED SILENCE (`last_seen`), not on
-            // the `status` column. Those are not the same question and must not
-            // share a field. `status` is maintained by `sweepStaleAgents`, which
-            // runs on every roster read — so while identity was gated on it, an
-            // `agent list` flipped records to 'offline' and thereby moved them
-            // from "reclaimable only by their own node" to "reclaimable by any
-            // node, on name alone, with a `token_hash` overwrite". A read must
-            // never widen who may claim an identity.
-            //
-            // Precisely: the sweep's status update cannot affect this gate at all
-            // any more. The sweep does also clamp a FUTURE `last_seen` back to the
-            // server clock, which is a write — but it can only move the reclaim
-            // moment later-or-equal relative to that bogus timestamp, never make a
-            // row claimable now, since the clamped value is `now` and this
-            // predicate needs `now - AGENT_RECLAIM_GRACE_MS`. That clamp exists so
-            // a client with a skewed clock cannot make its name permanently
-            // unreclaimable; it is deliberate, and it is the only path by which a
-            // read touches this column.
-            //
-            // The grace window is far longer than the presence TTL: an agent goes
-            // 'offline' on the roster after 5 minutes of silence, but its name is
-            // not reclaimable by a stranger until AGENT_RECLAIM_GRACE_MS. Between
-            // those two points the agent reads as away and its identity is still
-            // its own.
-            //
-            // The second disjunct is unchanged: the agent's own node may always
-            // re-register it, so a node restart or reconnect is never blocked by
-            // the grace window.
-            setWhere: or(lt(agents.lastSeen, new Date(Date.now() - AGENT_RECLAIM_GRACE_MS)), and(eq(agents.locationType, 'via_node'), or(eq(agents.locationNodeId, nodeId), sql `${agents.locationNodeId} = 'node_direct_' || ${agents.id}`))),
-        })
+            .onConflictDoNothing({ target: [agents.workspaceId, agents.name] })
             .returning();
         if (!result) {
-            throw codedError(`Agent "${message.name}" already has an active location`, 'agent_location_conflict', 409);
+            throw codedError(`Agent "${message.name}" already exists; use agent.recover with proof of the immutable id`, 'agent_already_exists', 409);
         }
         await autoJoinGeneral(tx, workspaceId, result.id);
         const activeNodeIds = await activeBindingNodeIdsForAgent(tx, workspaceId, result.id);
@@ -1017,6 +968,108 @@ export async function registerAgentViaNode(db, workspaceId, nodeId, providerName
         };
     });
 }
+/**
+ * Recover an existing agent using the authenticated node as the authority.
+ * The immutable id and server-owned `origin_node_id` must both match; name,
+ * presence, silence, and the synthetic direct-node convention grant nothing.
+ */
+export async function recoverAgentViaNode(db, workspaceId, nodeId, providerName, message, options = {}) {
+    assertRegistrableAgentName(message.name);
+    const hasInteractiveTransaction = typeof db.withTransaction === 'function';
+    return runAtomic(db, async (tx) => {
+        const [node] = await tx
+            .select()
+            .from(nodes)
+            .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
+        if (!node)
+            throw codedError(`Node "${nodeId}" not found`, 'node_not_found', 404);
+        const [provider] = await tx
+            .select({ capabilities: nodeProviders.capabilities })
+            .from(nodeProviders)
+            .where(and(eq(nodeProviders.workspaceId, workspaceId), eq(nodeProviders.nodeId, nodeId), eq(nodeProviders.name, providerName)));
+        const cursorHandshake = (options.deliveryCursorSupported ?? true) && (provider?.capabilities?.some((capability) => capability.name === FLEET_DELIVERY_CURSOR_CAPABILITY) ?? false);
+        const [target] = await tx
+            .select()
+            .from(agents)
+            .where(and(eq(agents.workspaceId, workspaceId), eq(agents.name, message.name)));
+        if (!target) {
+            throw codedError(`Agent "${message.name}" not found`, 'agent_not_found', 404);
+        }
+        if (target.id !== message.expected_agent_id || target.originNodeId !== nodeId) {
+            throw codedError(`Node "${nodeId}" does not own expected agent "${message.expected_agent_id}"`, 'agent_recovery_not_authorized', 403);
+        }
+        const activeNodeIds = await activeBindingNodeIdsForAgent(tx, workspaceId, target.id);
+        const targetWasActive = activeNodeIds.includes(nodeId);
+        let reservedTargetSlot = false;
+        // D1 has no interactive transaction, so capacity must be acquired before
+        // any agent/location mutation. A full node now fails with the incumbent
+        // row and bindings untouched; a later failure releases this reservation.
+        if (!targetWasActive) {
+            await reserveNodeAgentSlot(tx, workspaceId, node);
+            reservedTargetSlot = true;
+        }
+        try {
+            const now = new Date().toISOString();
+            const fleetMetadata = sql `json_object(
+        'node_id', ${nodeId},
+        'invocation_id', ${message.invocation_id ?? null},
+        'registered_at', ${now}
+      )`;
+            const [result] = await tx
+                .update(agents)
+                .set({
+                status: 'active',
+                lastSeen: new Date(),
+                metadata: sql `json_patch(COALESCE(${agents.metadata}, '{}'), ${fleetMetadata})`,
+                locationType: 'via_node',
+                locationNodeId: nodeId,
+                providerName,
+                resumable: message.resumable ?? false,
+                sessionRef: message.session_ref ?? null,
+            })
+                .where(and(eq(agents.workspaceId, workspaceId), eq(agents.id, message.expected_agent_id), eq(agents.name, message.name), eq(agents.originNodeId, nodeId)))
+                .returning();
+            if (!result) {
+                throw codedError(`Agent "${message.name}" changed during node recovery`, 'agent_identity_conflict', 409);
+            }
+            await autoJoinGeneral(tx, workspaceId, result.id);
+            await upsertAgentNodeBinding(tx, workspaceId, result, nodeId, {
+                sessionRef: message.session_ref ?? null,
+                deactivateExisting: true,
+            });
+            await releaseNodeAgentSlots(tx, workspaceId, activeNodeIds.filter((activeNodeId) => activeNodeId !== nodeId));
+            // Rotate only after every fallible routing/capacity mutation. On Node the
+            // surrounding transaction still makes the whole recovery atomic; on D1
+            // the rotation+audit pair remains one atomic batch.
+            const rotated = await rotateAgentIdentity(tx, {
+                workspaceId,
+                agentId: target.id,
+                agentName: target.name,
+            }, {
+                authority: 'origin_node',
+                actor: `node:${node.name}`,
+                reason: 'explicit node identity recovery',
+                sessionRef: message.session_ref ?? target.sessionRef,
+                nodeId,
+                originActor: 'node-control/agent.recover',
+            }, 'recover', {
+                requireAtomic: !hasInteractiveTransaction,
+                alreadyAtomic: hasInteractiveTransaction,
+            });
+            return {
+                agent_id: result.id,
+                name: result.name,
+                token: rotated.token,
+                ...(cursorHandshake ? { delivery_ack_seq: result.deliveryAckSeq } : {}),
+            };
+        }
+        catch (err) {
+            if (reservedTargetSlot)
+                await releaseNodeAgentSlots(tx, workspaceId, [nodeId]);
+            throw err;
+        }
+    });
+}
 export async function deregisterAgentViaNode(db, workspaceId, nodeId, message, deps) {
     const conditions = [
         eq(agents.workspaceId, workspaceId),
@@ -1445,6 +1498,21 @@ export async function handleNodeControlMessage(args) {
                     await deliverPendingToNode(args.db, args.registry, args.workspaceId, args.nodeId, { providerName: frameProviderName, agentIds: [registered.agent_id] });
                     return;
                 }
+                case 'agent.recover': {
+                    const recovered = await recoverAgentViaNode(args.db, args.workspaceId, args.nodeId, frameProviderName, message, { deliveryCursorSupported: supportsProviderDeliveryReadiness(args.registry) });
+                    const replySent = sendControl(args.socket, {
+                        v: 1,
+                        id: requestId(message),
+                        type: 'reply',
+                        ok: true,
+                        data: recovered,
+                    });
+                    if (!replySent)
+                        return;
+                    args.registry.markProviderAgentsDeliveryReady?.(args.workspaceId, args.nodeId, frameProviderName, args.connectionId, [recovered.agent_id]);
+                    await deliverPendingToNode(args.db, args.registry, args.workspaceId, args.nodeId, { providerName: frameProviderName, agentIds: [recovered.agent_id] });
+                    return;
+                }
                 case 'agent.deregister':
                     await deregisterAgentViaNode(args.db, args.workspaceId, args.nodeId, message, args.completionDeps);
                     return;