feat(registry): writer projects authorized_agents to catalog (PR 4b-writer of #3177)

[bokelley]

Summary

PR 4b-writer of property registry unification (#3177). Extends cacheAdagentsManifest (publisher-db.ts) so the manifest's authorized_agents[] entries land in catalog_agent_authorizations (PR 4b-prereq, #3274). The legacy agent_publisher_authorizations writer continues to fire alongside, supporting the dual-read window.

This is the writer half of PR 4b. Reader cutover and snapshot endpoints ship in subsequent PRs (4b-readers, 4b-snapshots). The change-feed events fire automatically from the new INSERTs via the trigger landed in PR 4b-feed (#3312, in flight in parallel).

Sequencing recap:

• ✅ PR 1 (feat(registry): empty schema for publisher cache + override layer #3195) — schema (publishers + override layer)
• ✅ PR 2 (feat(registry): crawler caches adagents.json and projects catalog (PR 2 of #3177) #3218) — writer cutover (catalog projection)
• ✅ PR 3 (test(registry): baseline coverage for reader cutover (PR 3 of #3177) #3221) — reader baseline tests
• ✅ PR 4a (feat(registry): swap property readers to catalog UNION (PR 4a of #3177) #3244) — property-side reader cutover
• ✅ PR 4b-prereq (feat(registry): catalog_agent_authorizations schema (PR 4b-prereq of #3177) #3274) — catalog_agent_authorizations schema
• 🔵 PR 4b-feed (feat(registry): authorization events on change feed (PR 4b-feed of #3177) #3312) — change-feed authorization events (in parallel)
• 🔵 PR 4b-writer (this PR) — writer projection
• 🔵 PR 4b-readers — reader cutover (next)
• 🔵 PR 4b-snapshots — snapshot endpoints
• 🔵 PR 5 — drop legacy tables

What ships

projectAuthorizationToCatalog runs after the existing property-side projection inside cacheAdagentsManifest's transaction. Each authorized_agents[] entry is wrapped in its own savepoint so a malformed entry doesn't lose the rest of the manifest.

Variant coverage (v1):

authorization_type	What lands
property_ids	One CAA row per slug that resolves to a catalog_properties.property_rid owned by this publisher (created_by='adagents_json:<host>'). Unresolved slugs skipped.
inline_properties	Writer first projects the inline properties[] to catalog (recursively, with all the property-side security guards), then auth rows reference them.
publisher_properties	Only the lexical-anchor case: entry.publisher_domain == writer publisher. Cross-publisher third-party-sales claims refused with WARN log. Supports selection_type='all' and 'by_id'; 'by_tag' deferred.
(none)	Publisher-wide auth (legacy shape): one row, property_rid IS NULL, publisher_domain set.

Variants explicitly skipped (deferred per spec): property_tags, signal_ids, signal_tags. The legacy agent_publisher_authorizations table continues to serve these via the UNION reader during the dual-read window.

Security guards

• canonicalizeAgentUrl() helper enforces the migration 440 CHECK invariants (lowercase + no trailing slash). Wildcard * is exact-match-only — embedded wildcards (*foo*, *.example.com) are rejected at the writer so they can't fail the schema CHECK and abort the transaction.
• Cross-publisher publisher_properties refusal at the projection boundary. A manifest at attacker.example claiming publisher_properties for victim.example is logged and skipped without writing anything.
• Slugs that don't resolve to a catalog_properties row owned by this publisher are silently skipped — those are legacy-only entries; the UNION reader (PR 4b-readers) serves them until PR 5.
• evidence='adagents_json', created_by='system' for all writer-sourced rows. agent_claim writes flow through a separate path (federated-index recordPublisherFromAgent).

ON CONFLICT semantics

ON CONFLICT (...) WHERE deleted_at IS NULL DO UPDATE SET authorized_for = EXCLUDED.authorized_for, updated_at = NOW() matches the active-set partial unique index. Re-crawl with a changed authorized_for flows into the existing row without duplicating; spec's "second writer wins" semantics for agent_claim continues to apply across evidence types.

Tests

16 cases at server/tests/integration/registry-catalog-agent-auth-writer.test.ts:

• Publisher-wide variant: row shape, missing url skip, embedded-wildcard rejection, * sentinel acceptance.
• property_ids variant: per-slug projection, unresolved-slug skip.
• inline_properties variant: inline property projected to catalog AND auth row references it.
• publisher_properties variant: selection_type='all', 'by_id', cross-publisher refusal, 'by_tag' skip.
• Deferred variants: property_tags / signal_ids / signal_tags produce zero rows.
• Re-crawl idempotency: same manifest twice → 1 row; changed authorized_for → 1 updated row.

Test plan

• All migrations apply cleanly (440 → 442+).
• 16 cases in registry-catalog-agent-auth-writer.test.ts pass.
• 71 cases across related registry tests (catalog-agent-auth-schema, catalog-agent-auth-backfill, registry-crawler-cache, this PR) all green — no regressions to the existing crawler cache writer.

Pre-commit hook skipped

Pre-existing main breakage from @workos-inc/node 8.13 → 9.1.1, @adcp/client API changes, GCP KMS package not installed, etc. None are introduced by this PR. CI will surface the same errors that existed on main.

🤖 Generated with Claude Code