@agentlogin/rp-store-postgres 0.0.0-stage → 0.2.0-beta.2

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,115 @@
-# Temporary Holding Version
+# PostgreSQL RP callback store
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`@agentlogin/rp-store-postgres` implements `CallbackStateStore` from `@agentlogin/rp` for applications running on
+several hosts. Login can start on one replica and return to another; concurrent callbacks compete for one durable
+claim before either can exchange the authorization code. PostgreSQL 17 is exercised by the integration suite.
+
+This is separate from the issuer's `@agentlogin/store-postgres`. The callback table contains only opaque HMAC
+state digests, expiry times and consumption flags. Pending cookies, PKCE verifiers, authorization codes, issuer
+records, application accounts and application sessions are not stored here. The
+[Hono example](../../examples/rp-hono/README.md) demonstrates separate PostgreSQL account and session tables, using
+the same bounded connection pool while keeping callback and session lifecycles independent.
+
+```ts
+import { createHandlers, RelyingParty } from '@agentlogin/rp';
+import { PostgresCallbackStateStore } from '@agentlogin/rp-store-postgres';
+
+const callbackStore = new PostgresCallbackStateStore({
+  connectionString: process.env.RP_DATABASE_URL!,
+  schema: 'agentlogin_rp', // Optional; this is the default.
+});
+await callbackStore.verifySchema(); // Migrate separately before serving requests.
+const rp = new RelyingParty({
+  clientId: 'https://app.example/client-metadata.json',
+  redirectUri: 'https://app.example/auth/agent/callback',
+  issuers: ['https://issuer.example'],
+  stateSecret: process.env.STATE_SECRET!, // Stable and shared by every application replica.
+});
+const auth = createHandlers(rp, { callbackStore, onSignIn });
+// Wire auth.login and auth.callback to your framework; onSignIn creates your application session.
+// Periodically await callbackStore.cleanup(1000).
+// Drain requests and maintenance jobs, then await callbackStore.close() at shutdown.
+```
+
+## Setup and connection ownership
+
+The installed package provides `agentlogin-rp-migrate`; in this repository run `npm run rp:migrate`. Both require
+`RP_DATABASE_URL` and accept `RP_DATABASE_SCHEMA` (default `agentlogin_rp`). Run migrations with a deployment role;
+normal application startup calls `verifySchema()` and ordinary operations perform no DDL. The programmatic
+equivalent for migration tooling is `await callbackStore.migrate()`.
+
+Schema names are lowercase SQL identifiers of at most 63 characters and cannot begin with `pg_`. Migrations are
+transactional and use a migration-only advisory lock; request operations do not take that lock.
+
+Use a dedicated schema and a runtime role limited to the schema usage, table DML, metadata reads and clock
+function execution it needs. Keep schema creation and alteration privileges with the migration role. Verify the
+schema before exposing the application to traffic, and do not change it underneath a running incompatible version.
+
+Supply exactly one of `connectionString` or an externally configured `pg.Pool` as `pool`. An external pool is
+useful for custom authenticated TLS, observability and connection policy; its caller owns and closes it. The
+adapter closes only pools it creates. Its own pool defaults to ten connections; budget the sum of replica pools
+against PostgreSQL's connection limit. External pools need bounded acquisition and connection timeouts too.
+Use the authoritative primary, not a read replica or cache, for every callback operation.
+
+Defaults are five seconds for connection acquisition and lock waits, ten seconds per statement and thirty seconds
+for idle transactions. Configure them through `connectionTimeoutMs`, `lockTimeoutMs`, `statementTimeoutMs` and
+`idleTransactionTimeoutMs`; `maxConnections` sets the owned pool's size. External pools retain their own connection
+settings. `onPoolError` can report idle connection failures; redact driver errors before logging them.
+
+## Registration, claims and time
+
+`register(key, expiresAt)` accepts the opaque digest supplied by the RP handlers and an absolute Unix timestamp in
+milliseconds. It inserts only if the key is absent; `false` means an existing record was preserved, whether used,
+unused or expired but not yet cleaned up. Reusing a key never renews its stored expiry or resets its consumption.
+
+`claim(key)` returns `claimed` to one request, `duplicate` for a live consumed record, or `missing` when absent or
+expired. It acquires the table lock needed for a write and locks that callback row, reads the database clock after
+those waits, and changes an unused live row to used in the same transaction. The table lock is compatible with
+ordinary readers and writers; other keys can proceed independently. No network request to an issuer or
+application callback runs while that transaction is open.
+
+The adapter uses `READ COMMITTED` with an explicit row lock and one checked-out connection per transaction, as
+described by [PostgreSQL row locking](https://www.postgresql.org/docs/17/explicit-locking.html#LOCKING-ROWS) and
+[node-postgres transactions](https://node-postgres.com/features/transactions). Expiry uses a SQL wrapper around
+[`clock_timestamp()`](https://www.postgresql.org/docs/17/functions-datetime.html#FUNCTIONS-DATETIME-CURRENT),
+which advances during a transaction. A timestamp captured before a lock wait cannot authorize a late claim.
+
+The RP handlers choose the pending cookie's expiry using the application's clock; the database enforces the
+registered deadline with its clock. Keep both synchronized and monitor clock drift. The test suite changes the
+clock function only inside disposable schemas; production requests cannot supply a replacement clock.
+
+## Failures and retention
+
+The adapter does not automatically retry operations. Errors fail closed: the handlers return `state_store_failed`
+without exchanging a code. An uncertain commit discards the connection; it never turns a later reread of
+`used` into proof that this request won. After an uncertain claim or token exchange, start a new sign-in. Never
+release a claim after token validation or session creation fails.
+
+Call `cleanup(limit)` from controlled maintenance, with a default batch of 1,000 and a maximum of 10,000 rows.
+Cleanup uses the expiry index and skips locked records; it deletes only expired records and does not make expiry
+effective. Overlapping jobs are safe, but avoid scheduling more database work than your deployment needs. Monitor
+retained rows and increase maintenance frequency when sign-in volume outgrows the deletion rate. Never evict live
+records to reclaim space.
+
+Acknowledged claims must survive failover. Configure PostgreSQL durability and replication to preserve them before
+another primary serves callbacks; this adapter cannot repair a database rollback. Restoring older data can restore
+an unused state whose code was already exchanged. Before serving traffic after a restore or any failover that
+might lose acknowledged claims, rotate `stateSecret` across every replica and reject cookies using the old secret.
+Do not keep the old secret as a decryption fallback. This ends pending sign-ins; it does not replace application
+session recovery. Protect database access, backups and TLS credentials, and do not log pending cookies or secrets.
+
+## Protocol boundary and tests
+
+[Core Section 5.7](https://github.com/agentlogin/spec/blob/main/agent-login-core.md#57-id-token-validation) requires
+response and session/issuer validation before state consumption and keeps state consumed after a failed or
+uncertain exchange. It recommends atomic coordination across serving instances; this adapter provides that
+coordination for the existing handlers. The store does not replace their PKCE, nonce or issuer checks. Those
+checks follow [RFC 9700](https://www.rfc-editor.org/rfc/rfc9700.html#section-2.1) and
+[RFC 9207 Section 2.4](https://www.rfc-editor.org/rfc/rfc9207.html#section-2.4).
+
+Run `npm test` for the repository suite or `npm run test:postgres` for both PostgreSQL packages. Database tests use
+the explicit `AGENTLOGIN_TEST_POSTGRES_URL`, isolate their schemas, and skip when it is absent. Set
+`REQUIRE_POSTGRES_TESTS=1` to fail on missing configuration, as CI does. Concurrency and failure tests provide
+correctness evidence; they do not establish deployment capacity. Load testing, application session policy,
+rate limiting and operational recovery remain application responsibilities. The Hono example supplies shared
+session storage; other applications may integrate their existing session system.

package/bin/agentlogin-rp-migrate.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+// Keep the entry point available before workspace TypeScript compilation.
+import '../dist/migrate.js';

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { PostgresCallbackStateStore, UncertainCommitError, type PostgresCallbackStateStoreOptions, type CallbackStoreCheckpoint, } from './postgres-callback-store.js';

package/dist/index.js

@@ -0,0 +1,2 @@
+export { PostgresCallbackStateStore, UncertainCommitError, } from './postgres-callback-store.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAGrB,MAAM,8BAA8B,CAAC"}

package/dist/migrate.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/migrate.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { PostgresCallbackStateStore } from './postgres-callback-store.js';
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+    console.log(`agentlogin-rp-migrate - install the Agent Login RP callback schema
+
+Usage: RP_DATABASE_URL=postgresql://... agentlogin-rp-migrate
+
+Environment:
+  RP_DATABASE_URL      Required connection string for a DDL-capable migration role
+  RP_DATABASE_SCHEMA   Schema name (default: agentlogin_rp)
+
+Applications verify the installed schema at startup; callback requests never migrate it.`);
+}
+else if (!process.env.RP_DATABASE_URL) {
+    console.error('RP_DATABASE_URL is required to migrate RP callback storage. RP_DATABASE_SCHEMA defaults to agentlogin_rp.');
+    process.exitCode = 1;
+}
+else {
+    let store;
+    try {
+        store = new PostgresCallbackStateStore({
+            connectionString: process.env.RP_DATABASE_URL,
+            schema: process.env.RP_DATABASE_SCHEMA,
+            maxConnections: 1,
+        });
+        await store.migrate();
+        await store.verifySchema();
+        console.log(`RP callback PostgreSQL schema ${store.schema} is ready.`);
+    }
+    catch (error) {
+        const code = error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' && /^[A-Z0-9_]+$/.test(error.code) ? error.code : undefined;
+        console.error('RP callback migration failed. Check connectivity, DDL privileges, and RP_DATABASE_SCHEMA configuration.', { code });
+        process.exitCode = 1;
+    }
+    finally {
+        try {
+            await store?.close();
+        }
+        catch {
+            console.error('Unable to close the migration connection pool.');
+            process.exitCode = 1;
+        }
+    }
+}
+//# sourceMappingURL=migrate.js.map

package/dist/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC;;;;;;;;yFAQ2E,CAAC,CAAC;AAC3F,CAAC;KAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;IACxC,OAAO,CAAC,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC3H,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;KAAM,CAAC;IACN,IAAI,KAA6C,CAAC;IAClD,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,0BAA0B,CAAC;YACrC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;YAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;YACtC,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,CAAC,MAAM,YAAY,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjK,OAAO,CAAC,KAAK,CAAC,yGAAyG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnI,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAC7B,MAAM,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QAAC,CAAC;IAClG,CAAC;AACH,CAAC"}

package/dist/postgres-callback-store.d.ts

@@ -0,0 +1,60 @@
+import type { CallbackClaim, CallbackStateStore } from '@agentlogin/rp';
+import { Pool, type PoolClient } from 'pg';
+type Operation = 'register' | 'claim' | 'cleanup' | 'migrate' | 'verifySchema';
+export interface CallbackStoreCheckpoint {
+    operation: Operation;
+    phase: 'after-lock' | 'before-commit' | 'after-commit';
+    client: PoolClient;
+}
+export interface PostgresCallbackStateStoreOptions {
+    /** Supply exactly one connection source, connected to the authoritative primary. */
+    connectionString?: string;
+    /** Externally managed pool: its owner controls pool limits and connection acquisition timeouts. */
+    pool?: Pool;
+    schema?: string;
+    maxConnections?: number;
+    connectionTimeoutMs?: number;
+    statementTimeoutMs?: number;
+    lockTimeoutMs?: number;
+    idleTransactionTimeoutMs?: number;
+    /** Fault injection / scheduling only. Never log query values or perform application work here. */
+    onCheckpoint?: (event: CallbackStoreCheckpoint) => Promise<void> | void;
+    /** Optional reporting for idle pool errors. Raw driver errors may contain sensitive data. */
+    onPoolError?: (error: Error) => void;
+}
+/** The callback must fail closed. A second attempt cannot establish ownership of an earlier claim. */
+export declare class UncertainCommitError extends Error {
+    readonly operation: Operation;
+    constructor(operation: Operation, cause: unknown);
+}
+/**
+ * Durable one-use callbacks shared across RP instances. Each operation uses one connection and one transaction.
+ * No application, network, or token exchange work belongs inside these transactions. Claims are never released.
+ */
+export declare class PostgresCallbackStateStore implements CallbackStateStore {
+    readonly schema: string;
+    private readonly pool;
+    private readonly ownedPool;
+    private readonly statementTimeoutMs;
+    private readonly lockTimeoutMs;
+    private readonly idleTransactionTimeoutMs;
+    private readonly hook?;
+    private readonly poolErrorHandler;
+    private closed;
+    constructor(options: PostgresCallbackStateStoreOptions);
+    private name;
+    private checkpoint;
+    private now;
+    private transaction;
+    register(key: string, expiresAt: number): Promise<boolean>;
+    claim(key: string): Promise<CallbackClaim>;
+    /** Remove only expired rows in a bounded indexed batch. Schedule separately from login and callback requests. */
+    cleanup(limit?: number): Promise<number>;
+    /** Deployment operation using a DDL-capable role; ordinary requests never create database objects. */
+    migrate(): Promise<void>;
+    /** Startup check: requires schema usage, function execute, callback-table DML and migration-version SELECT. */
+    verifySchema(): Promise<void>;
+    /** Drain application requests before closing. An external pool retains its owner-controlled lifecycle. */
+    close(): Promise<void>;
+}
+export {};

package/dist/postgres-callback-store.js

@@ -0,0 +1,249 @@
+import { Pool } from 'pg';
+/** The callback must fail closed. A second attempt cannot establish ownership of an earlier claim. */
+export class UncertainCommitError extends Error {
+    operation;
+    constructor(operation, cause) {
+        super(`The commit outcome for ${operation} is uncertain; abandon this sign-in instead of repeating the operation`, { cause });
+        this.name = 'UncertainCommitError';
+        this.operation = operation;
+    }
+}
+const SCHEMA_VERSION = 1;
+const MAX_KEY_BYTES = 1024;
+const MAX_SAFE_TIME = Number.MAX_SAFE_INTEGER;
+const quote = (identifier) => `"${identifier}"`;
+function integer(value, fallback, name, max = 2_147_483_647) {
+    const actual = value ?? fallback;
+    if (!Number.isSafeInteger(actual) || actual < 1 || actual > max)
+        throw new RangeError(`${name} must be an integer from 1 to ${max}`);
+    return actual;
+}
+function validateKey(key) {
+    if (typeof key !== 'string' || key.length === 0 || key.includes('\0') || Buffer.byteLength(key, 'utf8') > MAX_KEY_BYTES) {
+        throw new TypeError('Callback state key must be nonempty UTF-8 text of at most 1024 bytes, without NUL');
+    }
+}
+function sqlState(error) {
+    return error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
+}
+/**
+ * Durable one-use callbacks shared across RP instances. Each operation uses one connection and one transaction.
+ * No application, network, or token exchange work belongs inside these transactions. Claims are never released.
+ */
+export class PostgresCallbackStateStore {
+    schema;
+    pool;
+    ownedPool;
+    statementTimeoutMs;
+    lockTimeoutMs;
+    idleTransactionTimeoutMs;
+    hook;
+    poolErrorHandler;
+    closed = false;
+    constructor(options) {
+        if (!options || (!!options.pool === (options.connectionString !== undefined))) {
+            throw new TypeError('Supply exactly one of pool or connectionString');
+        }
+        if (options.connectionString !== undefined && (typeof options.connectionString !== 'string' || options.connectionString.trim() === '')) {
+            throw new TypeError('connectionString must be nonempty');
+        }
+        this.schema = options.schema ?? 'agentlogin_rp';
+        if (typeof this.schema !== 'string' || !/^[a-z_][a-z0-9_]{0,62}$/.test(this.schema) || this.schema.startsWith('pg_')) {
+            throw new TypeError('PostgreSQL schema must be a lowercase SQL identifier of at most 63 characters, outside pg_*');
+        }
+        this.statementTimeoutMs = integer(options.statementTimeoutMs, 10_000, 'statementTimeoutMs');
+        this.lockTimeoutMs = integer(options.lockTimeoutMs, 5_000, 'lockTimeoutMs');
+        this.idleTransactionTimeoutMs = integer(options.idleTransactionTimeoutMs, 30_000, 'idleTransactionTimeoutMs');
+        const max = integer(options.maxConnections, 10, 'maxConnections', 1000);
+        const connectionTimeoutMillis = integer(options.connectionTimeoutMs, 5_000, 'connectionTimeoutMs');
+        this.ownedPool = !options.pool;
+        this.pool = options.pool ?? new Pool({ connectionString: options.connectionString, max, connectionTimeoutMillis, idleTimeoutMillis: 30_000 });
+        this.hook = options.onCheckpoint;
+        this.poolErrorHandler = (error) => { options.onPoolError?.(error); };
+        this.pool.on('error', this.poolErrorHandler);
+    }
+    name(name) {
+        return `${quote(this.schema)}.${quote(name)}`;
+    }
+    async checkpoint(client, operation, phase) {
+        await this.hook?.({ client, operation, phase });
+    }
+    async now(client) {
+        const result = await client.query(`SELECT ${this.name('app_now_ms')}() AS now`);
+        const raw = result.rows[0]?.now;
+        const now = raw === null || raw === undefined ? NaN : Number(raw);
+        if (!Number.isSafeInteger(now) || now < 0)
+            throw new Error('app_now_ms() must return a nonnegative safe integer Unix time in milliseconds');
+        return now;
+    }
+    async transaction(operation, action, readOnly = false) {
+        if (this.closed)
+            throw new Error('PostgreSQL callback store is closed');
+        const client = await this.pool.connect();
+        let committing = false;
+        let committed = false;
+        let discard = false;
+        let connectionError;
+        // pg-pool handles idle connections only. A checked-out client emits errors independently of query rejection.
+        const onClientError = (error) => { connectionError = error; discard = true; };
+        client.on('error', onClientError);
+        try {
+            await client.query(`BEGIN ISOLATION LEVEL READ COMMITTED ${readOnly ? 'READ ONLY' : 'READ WRITE'}`);
+            await client.query(`SELECT
+        set_config('statement_timeout', $1, true),
+        set_config('lock_timeout', $2, true),
+        set_config('idle_in_transaction_session_timeout', $3, true),
+        set_config('search_path', 'pg_catalog', true),
+        set_config('synchronous_commit', 'on', true)`, [
+                String(this.statementTimeoutMs), String(this.lockTimeoutMs), String(this.idleTransactionTimeoutMs),
+            ]);
+            const result = await action(client);
+            await this.checkpoint(client, operation, 'before-commit');
+            if (connectionError)
+                throw connectionError;
+            committing = true;
+            const commit = await client.query('COMMIT');
+            if (commit.command !== 'COMMIT') {
+                committing = false;
+                throw new Error('PostgreSQL rolled back the callback transaction instead of committing');
+            }
+            committed = true;
+            await this.checkpoint(client, operation, 'after-commit');
+            if (connectionError)
+                throw connectionError;
+            return result;
+        }
+        catch (error) {
+            // Never replay a mutation whose commit may have reached PostgreSQL. In particular, used=true is not proof
+            // that this caller won. A hook after COMMIT models a lost acknowledgement after a durable claim.
+            if (committed || committing) {
+                discard = true;
+                throw new UncertainCommitError(operation, error);
+            }
+            try {
+                await client.query('ROLLBACK');
+            }
+            catch {
+                discard = true;
+            }
+            throw error;
+        }
+        finally {
+            try {
+                client.release(discard);
+            }
+            finally {
+                client.removeListener('error', onClientError);
+            }
+        }
+    }
+    async register(key, expiresAt) {
+        validateKey(key);
+        if (!Number.isSafeInteger(expiresAt) || expiresAt <= 0)
+            throw new TypeError('Callback expiry must be a positive safe integer Unix time in milliseconds');
+        return this.transaction('register', async (client) => {
+            const inserted = await client.query(`INSERT INTO ${this.name('callback_states')} (key, expires_at) VALUES ($1, $2) ON CONFLICT (key) DO NOTHING`, [key, expiresAt]);
+            await this.checkpoint(client, 'register', 'after-lock');
+            // Uniqueness checks can wait on another transaction. An expiry sampled before that wait is insufficient.
+            if (expiresAt <= await this.now(client))
+                throw new Error('Callback state registration has expired');
+            return inserted.rowCount === 1;
+        });
+    }
+    async claim(key) {
+        validateKey(key);
+        return this.transaction('claim', async (client) => {
+            // Acquire the UPDATE's table lock before sampling time. It is compatible with other ordinary readers and
+            // writers, but prevents a later lock upgrade waiting behind maintenance after the expiry decision.
+            await client.query(`LOCK TABLE ${this.name('callback_states')} IN ROW EXCLUSIVE MODE`);
+            // Do not put expiry in this predicate: a lock-only blocker can outlast expiry without changing the row.
+            const found = await client.query(`SELECT expires_at, used FROM ${this.name('callback_states')} WHERE key = $1 FOR UPDATE`, [key]);
+            await this.checkpoint(client, 'claim', 'after-lock');
+            const now = await this.now(client);
+            const row = found.rows[0];
+            if (!row || Number(row.expires_at) <= now)
+                return 'missing';
+            if (row.used)
+                return 'duplicate';
+            await client.query(`UPDATE ${this.name('callback_states')} SET used = true WHERE key = $1`, [key]);
+            return 'claimed';
+        });
+    }
+    /** Remove only expired rows in a bounded indexed batch. Schedule separately from login and callback requests. */
+    async cleanup(limit = 1000) {
+        if (typeof limit !== 'number')
+            throw new TypeError('cleanup limit must be a number');
+        integer(limit, 1000, 'cleanup limit', 10_000);
+        return this.transaction('cleanup', async (client) => {
+            const now = await this.now(client);
+            const selected = await client.query(`SELECT key FROM ${this.name('callback_states')} WHERE expires_at <= $1
+         ORDER BY expires_at, key LIMIT $2 FOR UPDATE SKIP LOCKED`, [now, limit]);
+            await this.checkpoint(client, 'cleanup', 'after-lock');
+            if (!selected.rows.length)
+                return 0;
+            const deleted = await client.query(`DELETE FROM ${this.name('callback_states')} WHERE key = ANY($1::text[]) AND expires_at <= $2`, [selected.rows.map((row) => row.key), await this.now(client)]);
+            return deleted.rowCount ?? 0;
+        });
+    }
+    /** Deployment operation using a DDL-capable role; ordinary requests never create database objects. */
+    async migrate() {
+        await this.transaction('migrate', async (client) => {
+            await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [`agentlogin-rp-store-postgres:${this.schema}`]);
+            await this.checkpoint(client, 'migrate', 'after-lock');
+            await client.query(`CREATE SCHEMA IF NOT EXISTS ${quote(this.schema)}`);
+            await client.query(`CREATE TABLE IF NOT EXISTS ${this.name('schema_migrations')} (
+        version integer PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT clock_timestamp()
+      )`);
+            const found = await client.query(`SELECT version FROM ${this.name('schema_migrations')} ORDER BY version DESC LIMIT 1`);
+            const version = found.rows[0]?.version ?? 0;
+            if (version === SCHEMA_VERSION)
+                return;
+            if (version !== 0)
+                throw new Error('PostgreSQL callback schema version is not supported by this adapter');
+            await client.query(`
+        CREATE FUNCTION ${this.name('app_now_ms')}() RETURNS bigint LANGUAGE sql VOLATILE
+          SET search_path = pg_catalog
+          AS 'SELECT floor(extract(epoch FROM clock_timestamp()) * 1000)::bigint';
+        CREATE TABLE ${this.name('callback_states')} (
+          key text PRIMARY KEY CHECK (octet_length(key) BETWEEN 1 AND ${MAX_KEY_BYTES}),
+          expires_at bigint NOT NULL CHECK (expires_at BETWEEN 1 AND ${MAX_SAFE_TIME}),
+          used boolean NOT NULL DEFAULT false
+        );
+        CREATE INDEX callback_states_expiry ON ${this.name('callback_states')} (expires_at, key);
+        INSERT INTO ${this.name('schema_migrations')} (version) VALUES (${SCHEMA_VERSION});
+      `);
+        });
+    }
+    /** Startup check: requires schema usage, function execute, callback-table DML and migration-version SELECT. */
+    async verifySchema() {
+        try {
+            await this.transaction('verifySchema', async (client) => {
+                const found = await client.query(`SELECT version FROM ${this.name('schema_migrations')} ORDER BY version DESC LIMIT 1`);
+                if (found.rows[0]?.version !== SCHEMA_VERSION)
+                    throw new Error('PostgreSQL callback schema version is not supported by this adapter');
+                await client.query(`SELECT key, expires_at, used FROM ${this.name('callback_states')} LIMIT 0`);
+                await this.now(client);
+            }, true);
+        }
+        catch (error) {
+            if (['42P01', '3F000', '42883'].includes(sqlState(error) ?? '')) {
+                throw new Error('PostgreSQL callback schema is not initialized. Run agentlogin-rp-migrate before serving callbacks.', { cause: error });
+            }
+            throw error;
+        }
+    }
+    /** Drain application requests before closing. An external pool retains its owner-controlled lifecycle. */
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        try {
+            if (this.ownedPool)
+                await this.pool.end();
+        }
+        finally {
+            this.pool.removeListener('error', this.poolErrorHandler);
+        }
+    }
+}
+//# sourceMappingURL=postgres-callback-store.js.map

package/dist/postgres-callback-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-callback-store.js","sourceRoot":"","sources":["../src/postgres-callback-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AA2B3C,sGAAsG;AACtG,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,SAAS,CAAY;IAC9B,YAAY,SAAoB,EAAE,KAAc;QAC9C,KAAK,CAAC,0BAA0B,SAAS,wEAAwE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9H,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAC9C,MAAM,KAAK,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,IAAI,UAAU,GAAG,CAAC;AAEhE,SAAS,OAAO,CAAC,KAAyB,EAAE,QAAgB,EAAE,IAAY,EAAE,GAAG,GAAG,aAAa;IAC7F,MAAM,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,iCAAiC,GAAG,EAAE,CAAC,CAAC;IACrI,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;QACxH,MAAM,IAAI,SAAS,CAAC,mFAAmF,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1H,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IAC5B,MAAM,CAAS;IACP,IAAI,CAAO;IACX,SAAS,CAAU;IACnB,kBAAkB,CAAS;IAC3B,aAAa,CAAS;IACtB,wBAAwB,CAAS;IACjC,IAAI,CAAqD;IACzD,gBAAgB,CAAyB;IAClD,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,OAA0C;QACpD,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACvI,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;QAChD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACrH,MAAM,IAAI,SAAS,CAAC,6FAA6F,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC5F,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;QAC9G,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;QACnG,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9I,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAEO,IAAI,CAAC,IAA4D;QACvE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAkB,EAAE,SAAoB,EAAE,KAAuC;QACxG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,MAAkB;QAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAkB,UAAU,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACjG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAC5I,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CAAI,SAAoB,EAAE,MAA0C,EAAE,QAAQ,GAAG,KAAK;QAC7G,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,eAAkC,CAAC;QACvC,6GAA6G;QAC7G,MAAM,aAAa,GAAG,CAAC,KAAY,EAAQ,EAAE,GAAG,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,wCAAwC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;YACpG,MAAM,MAAM,CAAC,KAAK,CAAC;;;;;qDAK4B,EAAE;gBAC/C,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;aACnG,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;YAC1D,IAAI,eAAe;gBAAE,MAAM,eAAe,CAAC;YAC3C,UAAU,GAAG,IAAI,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,UAAU,GAAG,KAAK,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC3F,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YACzD,IAAI,eAAe;gBAAE,MAAM,eAAe,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0GAA0G;YAC1G,iGAAiG;YACjG,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;gBAC5B,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,IAAI,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;YACjE,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;oBACxB,CAAC;gBAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,SAAiB;QAC3C,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,2EAA2E,CAAC,CAAC;QACzJ,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,eAAe,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,iEAAiE,EAC5G,CAAC,GAAG,EAAE,SAAS,CAAC,CACjB,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YACxD,yGAAyG;YACzG,IAAI,SAAS,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACpG,OAAO,QAAQ,CAAC,QAAQ,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAChD,yGAAyG;YACzG,mGAAmG;YACnG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACvF,wGAAwG;YACxG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,gCAAgC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,4BAA4B,EAAE,CAAC,GAAG,CAAC,CAChG,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC5D,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,WAAW,CAAC;YACjC,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,iCAAiC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACnG,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACrF,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,mBAAmB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;kEACW,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CACzE,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,eAAe,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,mDAAmD,EAC9F,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC;YACF,OAAO,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sGAAsG;IACtG,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC7H,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,CAAC,KAAK,CAAC,8BAA8B,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;;QAE7E,CAAC,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB,uBAAuB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,gCAAgC,CAAC,CAAC;YAC7I,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,cAAc;gBAAE,OAAO;YACvC,IAAI,OAAO,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YAC1G,MAAM,MAAM,CAAC,KAAK,CAAC;0BACC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;;;uBAG1B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;wEACqB,aAAa;uEACd,aAAa;;;iDAGnC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;sBACvD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,cAAc;OACjF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACtD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB,uBAAuB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,gCAAgC,CAAC,CAAC;gBAC7I,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,cAAc;oBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;gBACtI,MAAM,MAAM,CAAC,KAAK,CAAC,qCAAqC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBAChG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,KAAK,CAAC,oGAAoG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1I,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YAAC,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC;gBAC1C,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAAC,CAAC;IACvE,CAAC;CACF"}

package/package.json

@@ -1,6 +1,44 @@
 {
   "name": "@agentlogin/rp-store-postgres",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0-beta.2",
+  "description": "Shared PostgreSQL callback state for Agent Login relying parties",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "bin": {
+    "agentlogin-rp-migrate": "bin/agentlogin-rp-migrate.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/agentlogin/reference.git",
+    "directory": "packages/rp-store-postgres"
+  },
+  "dependencies": {
+    "@agentlogin/rp": "0.2.0-beta.2",
+    "pg": "^8.16.3"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.23.1"
+  },
+  "scripts": {
+    "prepack": "tsc -b"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "beta",
+    "registry": "https://registry.npmjs.org/"
+  }
+}