@emilia-protocol/gate 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -4,7 +4,7 @@
 All notable changes to `@emilia-protocol/gate` are documented here.
 This package follows [Semantic Versioning](https://semver.org/).
 
-## 0.14.0 (2026-07-22)
+## 0.15.0 (2026-07-22)
 
 ### Added
 
@@ -15,6 +15,23 @@ This package follows [Semantic Versioning](https://semver.org/).
 - An executable end-to-end example and profile vectors covering exact-action
   mutation, stale evidence, one-time replay, indeterminate effects, and
   post-effect commit failure.
+- `./aeb-consumption-store`, a tenant- and relying-party-namespaced PostgreSQL
+  store that atomically fences the AEB operation and all native replay units,
+  with opaque owner tokens and authorized restart recovery.
+- `./proposal-to-effect-status`, which verifies server-resolved
+  `EP-STATUS-v1` heads and separately requires authenticated local consumption
+  state before the atomic execution reservation.
+- `./proposal-to-effect-postgres`, a private-schema PostgreSQL store for
+  consequence attempts with HMAC-hidden owner capabilities, tenant/provider
+  namespaces, owner-fenced transitions, immutable terminal states, exact
+  provider-evidence reconciliation, database leases, disjoint executor and
+  recovery roles, tenant-principal bindings, and stale-only restart recovery.
+- Concrete Remedy Program evidence adapters for signed disputes,
+  authorizations, provider outcomes, Action Escrow state, and late revocation.
+- A heterogeneous remedy case-set coordinator that completes only after every
+  exact child state and signed remedy receipt verifies.
+- A PostgreSQL remedy case-set store with tenant RLS, immutable manifests,
+  append-only state events, database-clock custody, and owner/revision CAS.
 
 ### Security
 
@@ -25,6 +42,20 @@ This package follows [Semantic Versioning](https://semver.org/).
 - Once an effect may have executed, failed bookkeeping cannot release its AEB
   reservation. The operation remains frozen until authenticated provider
   evidence proves `COMMITTED` or `NOT_COMMITTED`.
+- A committed effect consumes AEB replay authority before its consequence row
+  becomes terminal. `repairAeb` converges legacy or crash-window terminal rows
+  without invoking an effect, and opaque attempt-owner capabilities are kept
+  out of enumerable results and errors.
+- A recovered worker receives a rotated owner capability; the stale worker can
+  no longer transition or reconcile the attempt. An in-flight attempt is
+  conservatively recovered as `INDETERMINATE`, never retried as unexecuted.
+- AEB production consumption state is RPC-only behind tenant-bound, no-bypass
+  executor and recovery roles with physically separate pools. Supabase
+  `service_role` and both runtime roles have no direct table authority;
+  in-memory stores remain test-only.
+- Remedy case-set state and append-only history are likewise RPC-only behind a
+  tenant-bound no-bypass executor; generic service credentials cannot rewrite
+  current or historical remedy state.
 
 ## 0.13.0 (2026-07-20)
 

package/README.md

@@ -68,9 +68,19 @@ format. The proposal is an unsigned, short-lived request; authority remains in
 
 ```js
 import { createProposalToEffect } from '@emilia-protocol/gate/proposal-to-effect';
+import { createProposalToEffectPostgresStore } from '@emilia-protocol/gate/proposal-to-effect-postgres';
 
 const controller = createProposalToEffect({
   gate,
+  proposal_integrity: { hmac_sha256_key: serverHeld32ByteKey },
+  consequence: {
+    tenant_id: tenantId,
+    provider_id: providerId,
+    provider_account_id: providerAccountId,
+    environment,
+    executor_id: executorId,
+    store: durableConsequenceAttemptStore,
+  },
   profiles: {
     'payment-release': {
       id: 'payment-release',
@@ -94,6 +104,8 @@ const controller = createProposalToEffect({
     adapters: pinnedAebAdapters,
     store: durableOperationStore,
     resolve_artifacts,
+    currentStatusResolver,
+    statusVerifier,
     verify_provider_evidence,
   },
 });
@@ -113,10 +125,29 @@ The controller re-verifies the signed AEB evaluation, runs Gate policy,
 reserves the operation before invoking the effect, and consumes it after
 success. An uncertain provider result remains reserved; only authenticated
 provider evidence bound to the same operation, CAID, and action digest can
-reconcile it. See
+reconcile it. Owner capabilities are not serialized in results or errors;
+same-process services retrieve them with `getReconciliationHandle(object)`,
+while restarted services use the PostgreSQL store's authorized recovery path.
+Production PostgreSQL wiring uses different executor and recovery pools. Each
+database login is explicitly bound to a tenant and receives only its matching
+non-login group role; `service_role` receives neither RPC surface. Recovery is
+possible only after the database lease is stale, rotates the owner capability,
+and preserves `INDETERMINATE` whenever provider execution may have started.
+`repairAeb()` converges a durable terminal attempt with a stranded AEB
+reservation without invoking the effect again. See
 [`docs/protocol/proposal-to-effect-profile-v1.md`](../../docs/protocol/proposal-to-effect-profile-v1.md)
 and run `node examples/proposal-to-effect/demo.mjs` from the repository root.
 
+The AEB consumption store has its own disjoint PostgreSQL credentials:
+`createPostgresAebDurableConsumptionStore()` requires an `ep_aeb_executor`
+pool and a physically distinct `ep_aeb_recovery` pool. Each login must be
+listed for the tenant in `ep_aeb_private.tenant_principals`. Neither runtime
+role receives table privileges; reserve, commit, release, and recovery claim
+are narrow security-definer functions. Supabase `service_role` receives no
+table, schema, or function authority. Remedy case sets use the same custody
+shape through a tenant-bound `ep_remedy_executor` login and
+`ep_remedy_private.tenant_principals`.
+
 ## Three-plane deployment
 
 High-consequence infrastructure separates three jobs instead of asking one

package/aeb-consumption-store.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+export * from './dist/aeb-consumption-store.js';
+export { default } from './dist/aeb-consumption-store.js';

package/dist/aeb-consumption-store.d.ts

@@ -0,0 +1,80 @@
+import type { AebDurableConsumptionStore } from '@emilia-protocol/verify/aeb-adapter-contract';
+export declare const AEB_PG_CONSUMPTION_STORE_VERSION = "EP-GATE-AEB-PG-CONSUMPTION-v1";
+export declare const AEB_CONSUMPTION_OPERATION_TABLE = "ep_aeb_consumption_operations";
+export declare const AEB_CONSUMPTION_REPLAY_TABLE = "ep_aeb_consumption_replay_fences";
+export declare const AEB_CONSUMPTION_EXECUTOR_ROLE = "ep_aeb_executor";
+export declare const AEB_CONSUMPTION_RECOVERY_ROLE = "ep_aeb_recovery";
+export declare const AEB_CONSUMPTION_OWNER_ROLE = "ep_aeb_store_owner";
+/** Exact schema required by createPostgresAebDurableConsumptionStore(). */
+export declare const AEB_CONSUMPTION_DDL = "CREATE TABLE IF NOT EXISTS ep_aeb_consumption_operations (\n  tenant_id        TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),\n  relying_party_id TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),\n  operation_key    TEXT NOT NULL CHECK (octet_length(operation_key) BETWEEN 1 AND 4096),\n  state            TEXT NOT NULL CHECK (state IN ('RESERVED', 'CONSUMED')),\n  owner_token      TEXT NULL CHECK (owner_token IS NULL OR octet_length(owner_token) BETWEEN 16 AND 512),\n  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),\n  consumed_at      TIMESTAMPTZ NULL,\n  PRIMARY KEY (tenant_id, relying_party_id, operation_key),\n  CHECK (\n    (state = 'RESERVED' AND owner_token IS NOT NULL AND consumed_at IS NULL)\n    OR (state = 'CONSUMED' AND owner_token IS NULL AND consumed_at IS NOT NULL)\n  )\n);\nCREATE TABLE IF NOT EXISTS ep_aeb_consumption_replay_fences (\n  tenant_id        TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),\n  relying_party_id TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),\n  replay_key       TEXT NOT NULL CHECK (octet_length(replay_key) BETWEEN 1 AND 4096),\n  operation_key    TEXT NOT NULL CHECK (octet_length(operation_key) BETWEEN 1 AND 4096),\n  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),\n  PRIMARY KEY (tenant_id, relying_party_id, replay_key),\n  FOREIGN KEY (tenant_id, relying_party_id, operation_key)\n    REFERENCES ep_aeb_consumption_operations (tenant_id, relying_party_id, operation_key)\n    ON DELETE CASCADE\n);\nCREATE INDEX IF NOT EXISTS ep_aeb_consumption_replay_fences_operation_idx\n  ON ep_aeb_consumption_replay_fences (tenant_id, relying_party_id, operation_key);\nDO $roles$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'ep_aeb_executor') THEN\n    CREATE ROLE ep_aeb_executor NOLOGIN\n      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'ep_aeb_recovery') THEN\n    CREATE ROLE ep_aeb_recovery NOLOGIN\n      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'ep_aeb_store_owner') THEN\n    CREATE ROLE ep_aeb_store_owner NOLOGIN\n      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n  END IF;\nEND\n$roles$;\nGRANT ep_aeb_store_owner TO CURRENT_USER;\nCREATE SCHEMA IF NOT EXISTS ep_aeb_private;\nREVOKE ALL ON SCHEMA ep_aeb_private FROM PUBLIC, anon, authenticated, service_role;\nCREATE TABLE IF NOT EXISTS ep_aeb_private.tenant_principals (\n  principal_name NAME NOT NULL,\n  tenant_id TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),\n  can_execute BOOLEAN NOT NULL DEFAULT FALSE,\n  can_recover BOOLEAN NOT NULL DEFAULT FALSE,\n  PRIMARY KEY (principal_name, tenant_id),\n  CHECK (can_execute OR can_recover)\n);\nALTER SCHEMA ep_aeb_private OWNER TO ep_aeb_store_owner;\nALTER TABLE ep_aeb_private.tenant_principals OWNER TO ep_aeb_store_owner;\nALTER TABLE ep_aeb_consumption_operations OWNER TO ep_aeb_store_owner;\nALTER TABLE ep_aeb_consumption_replay_fences OWNER TO ep_aeb_store_owner;\nALTER TABLE ep_aeb_private.tenant_principals ENABLE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_private.tenant_principals FORCE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_consumption_operations ENABLE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_consumption_operations FORCE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_consumption_replay_fences ENABLE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_consumption_replay_fences FORCE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS ep_aeb_principals_owner_only ON ep_aeb_private.tenant_principals;\nCREATE POLICY ep_aeb_principals_owner_only ON ep_aeb_private.tenant_principals\n  TO ep_aeb_store_owner USING (TRUE) WITH CHECK (TRUE);\nDROP POLICY IF EXISTS ep_aeb_operations_owner_only ON ep_aeb_consumption_operations;\nCREATE POLICY ep_aeb_operations_owner_only ON ep_aeb_consumption_operations\n  TO ep_aeb_store_owner USING (TRUE) WITH CHECK (TRUE);\nDROP POLICY IF EXISTS ep_aeb_replay_owner_only ON ep_aeb_consumption_replay_fences;\nCREATE POLICY ep_aeb_replay_owner_only ON ep_aeb_consumption_replay_fences\n  TO ep_aeb_store_owner USING (TRUE) WITH CHECK (TRUE);\nREVOKE ALL ON ep_aeb_private.tenant_principals FROM PUBLIC, anon, authenticated, service_role,\n  ep_aeb_executor, ep_aeb_recovery;\nREVOKE ALL ON ep_aeb_consumption_operations FROM PUBLIC, anon, authenticated, service_role,\n  ep_aeb_executor, ep_aeb_recovery;\nREVOKE ALL ON ep_aeb_consumption_replay_fences FROM PUBLIC, anon, authenticated, service_role,\n  ep_aeb_executor, ep_aeb_recovery;\nCREATE OR REPLACE FUNCTION ep_aeb_private.assert_tenant_principal(\n  p_tenant_id TEXT, p_recovery BOOLEAN\n) RETURNS VOID\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = ''\nAS $fn$\nDECLARE v_role_ok BOOLEAN; v_binding_ok BOOLEAN;\nBEGIN\n  v_role_ok := CASE WHEN p_recovery\n    THEN pg_catalog.pg_has_role(SESSION_USER, 'ep_aeb_recovery', 'MEMBER')\n    ELSE pg_catalog.pg_has_role(SESSION_USER, 'ep_aeb_executor', 'MEMBER')\n  END;\n  SELECT EXISTS (\n    SELECT 1 FROM ep_aeb_private.tenant_principals AS principals\n    WHERE principals.principal_name = SESSION_USER\n      AND principals.tenant_id = p_tenant_id\n      AND CASE WHEN p_recovery THEN principals.can_recover ELSE principals.can_execute END\n  ) INTO v_binding_ok;\n  IF v_role_ok IS NOT TRUE OR v_binding_ok IS NOT TRUE THEN\n    RAISE EXCEPTION 'AEB_TENANT_PRINCIPAL_REFUSED' USING ERRCODE = '42501';\n  END IF;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.reserve_operation(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT\n) RETURNS TABLE(operation_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY INSERT INTO public.ep_aeb_consumption_operations\n    (tenant_id, relying_party_id, operation_key, state, owner_token)\n    VALUES (p_tenant_id, p_relying_party_id, p_operation_key, 'RESERVED', p_owner_token)\n    ON CONFLICT ON CONSTRAINT ep_aeb_consumption_operations_pkey DO NOTHING\n    RETURNING ep_aeb_consumption_operations.operation_key;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.reserve_replay_keys(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_replay_keys TEXT[]\n) RETURNS TABLE(replay_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY INSERT INTO public.ep_aeb_consumption_replay_fences\n    (tenant_id, relying_party_id, replay_key, operation_key)\n    SELECT p_tenant_id, p_relying_party_id, requested.replay_key, p_operation_key\n    FROM pg_catalog.unnest(p_replay_keys) AS requested(replay_key)\n    ORDER BY requested.replay_key\n    ON CONFLICT ON CONSTRAINT ep_aeb_consumption_replay_fences_pkey DO NOTHING\n    RETURNING ep_aeb_consumption_replay_fences.replay_key;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.commit_operation(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT\n) RETURNS TABLE(operation_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY UPDATE public.ep_aeb_consumption_operations\n    SET state = 'CONSUMED', owner_token = NULL, consumed_at = pg_catalog.transaction_timestamp()\n    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id\n      AND ep_aeb_consumption_operations.operation_key = p_operation_key\n      AND state = 'RESERVED' AND owner_token = p_owner_token\n    RETURNING ep_aeb_consumption_operations.operation_key;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.claim_operation(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT\n) RETURNS TABLE(operation_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, TRUE);\n  RETURN QUERY UPDATE public.ep_aeb_consumption_operations\n    SET owner_token = p_owner_token\n    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id\n      AND ep_aeb_consumption_operations.operation_key = p_operation_key\n      AND state = 'RESERVED'\n    RETURNING ep_aeb_consumption_operations.operation_key;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.release_operation(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT\n) RETURNS TABLE(operation_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY DELETE FROM public.ep_aeb_consumption_operations\n    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id\n      AND ep_aeb_consumption_operations.operation_key = p_operation_key\n      AND state = 'RESERVED' AND owner_token = p_owner_token\n    RETURNING ep_aeb_consumption_operations.operation_key;\nEND\n$fn$;\nALTER FUNCTION ep_aeb_private.assert_tenant_principal(TEXT, BOOLEAN)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.reserve_operation(TEXT, TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.reserve_replay_keys(TEXT, TEXT, TEXT, TEXT[])\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.commit_operation(TEXT, TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.claim_operation(TEXT, TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.release_operation(TEXT, TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nREVOKE ALL ON ALL FUNCTIONS IN SCHEMA ep_aeb_private\n  FROM PUBLIC, anon, authenticated, service_role;\nGRANT USAGE ON SCHEMA ep_aeb_private TO ep_aeb_executor, ep_aeb_recovery;\nGRANT EXECUTE ON FUNCTION ep_aeb_private.reserve_operation(TEXT, TEXT, TEXT, TEXT),\n  ep_aeb_private.reserve_replay_keys(TEXT, TEXT, TEXT, TEXT[]),\n  ep_aeb_private.commit_operation(TEXT, TEXT, TEXT, TEXT),\n  ep_aeb_private.release_operation(TEXT, TEXT, TEXT, TEXT)\n  TO ep_aeb_executor;\nGRANT EXECUTE ON FUNCTION ep_aeb_private.claim_operation(TEXT, TEXT, TEXT, TEXT)\n  TO ep_aeb_recovery;\nREVOKE ep_aeb_store_owner FROM CURRENT_USER;";
+/** Exact statements issued by the store, exported for audit and deterministic fakes. */
+export declare const AEB_CONSUMPTION_SQL: Readonly<{
+    reserveOperation: "SELECT operation_key FROM ep_aeb_private.reserve_operation($1::text, $2::text, $3::text, $4::text)";
+    reserveReplayKeys: "SELECT replay_key FROM ep_aeb_private.reserve_replay_keys($1::text, $2::text, $3::text, $4::text[])";
+    commitOperation: "SELECT operation_key FROM ep_aeb_private.commit_operation($1::text, $2::text, $3::text, $4::text)";
+    claimOperation: "SELECT operation_key FROM ep_aeb_private.claim_operation($1::text, $2::text, $3::text, $4::text)";
+    releaseOperation: "SELECT operation_key FROM ep_aeb_private.release_operation($1::text, $2::text, $3::text, $4::text)";
+}>;
+type QueryResult = {
+    rowCount: number | null;
+    rows?: Record<string, unknown>[];
+};
+export type AebConsumptionPgClient = {
+    query: (text: string, params?: any[]) => Promise<QueryResult>;
+    release: () => void;
+};
+export type AebConsumptionPgPool = {
+    connect: () => Promise<AebConsumptionPgClient>;
+};
+export interface PostgresAebDurableConsumptionStoreOptions {
+    /** Pool authenticated as a tenant-bound member of ep_aeb_executor. */
+    pool?: AebConsumptionPgPool;
+    /** Distinct pool authenticated as a tenant-bound member of ep_aeb_recovery. */
+    recoveryPool?: AebConsumptionPgPool;
+    tenantId?: string;
+    relyingPartyId?: string;
+    /** Must return an unpredictable opaque string in production. */
+    ownerTokenFactory?: () => string;
+    /** Verify a caller credential bound to the exact reservation being claimed. */
+    authorizeRecoveryClaim?: AebRecoveryClaimAuthorizer;
+}
+export interface AebRecoveryClaimAuthorization {
+    authorization: unknown;
+    tenantId: string;
+    relyingPartyId: string;
+    operationKey: string;
+    requiredState: 'RESERVED';
+}
+export type AebRecoveryClaimAuthorizer = (claim: Readonly<AebRecoveryClaimAuthorization>) => boolean | Promise<boolean>;
+export interface PostgresAebDurableConsumptionStore extends AebDurableConsumptionStore {
+    recoveryClaimSupported: true;
+    /**
+     * Rotate ownership of an existing RESERVED row after external authorization.
+     * The stored and replacement owner tokens are never returned or passed to
+     * the authorizer.
+     */
+    claimReservation(key: string, authorization: unknown): Promise<boolean>;
+}
+/**
+ * Create the durable AEB store consumed by authorizeAebExecutionDurable().
+ * The pool must return a pinned node-postgres-style client for each transaction.
+ */
+export declare function createPostgresAebDurableConsumptionStore({ pool, recoveryPool, tenantId, relyingPartyId, ownerTokenFactory, authorizeRecoveryClaim, }?: PostgresAebDurableConsumptionStoreOptions): PostgresAebDurableConsumptionStore;
+declare const _default: {
+    AEB_PG_CONSUMPTION_STORE_VERSION: string;
+    AEB_CONSUMPTION_OPERATION_TABLE: string;
+    AEB_CONSUMPTION_REPLAY_TABLE: string;
+    AEB_CONSUMPTION_EXECUTOR_ROLE: string;
+    AEB_CONSUMPTION_RECOVERY_ROLE: string;
+    AEB_CONSUMPTION_DDL: string;
+    AEB_CONSUMPTION_SQL: Readonly<{
+        reserveOperation: "SELECT operation_key FROM ep_aeb_private.reserve_operation($1::text, $2::text, $3::text, $4::text)";
+        reserveReplayKeys: "SELECT replay_key FROM ep_aeb_private.reserve_replay_keys($1::text, $2::text, $3::text, $4::text[])";
+        commitOperation: "SELECT operation_key FROM ep_aeb_private.commit_operation($1::text, $2::text, $3::text, $4::text)";
+        claimOperation: "SELECT operation_key FROM ep_aeb_private.claim_operation($1::text, $2::text, $3::text, $4::text)";
+        releaseOperation: "SELECT operation_key FROM ep_aeb_private.release_operation($1::text, $2::text, $3::text, $4::text)";
+    }>;
+    createPostgresAebDurableConsumptionStore: typeof createPostgresAebDurableConsumptionStore;
+};
+export default _default;
+//# sourceMappingURL=aeb-consumption-store.d.ts.map

package/dist/aeb-consumption-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aeb-consumption-store.d.ts","sourceRoot":"","sources":["../src/aeb-consumption-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,0BAA0B,EAE3B,MAAM,8CAA8C,CAAC;AAEtD,eAAO,MAAM,gCAAgC,kCAAkC,CAAC;AAChF,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAC/E,eAAO,MAAM,4BAA4B,qCAAqC,CAAC;AAC/E,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAC/D,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,uxUAqMwB,CAAC;AAEzD,wFAAwF;AACxF,eAAO,MAAM,mBAAmB;;;;;;EAM9B,CAAC;AAEH,KAAK,WAAW,GAAG;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,WAAW,yCAAyC;IACxD,sEAAsE;IACtE,IAAI,CAAC,EAAE,oBAAoB,CAAC;IAC5B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,+EAA+E;IAC/E,sBAAsB,CAAC,EAAE,0BAA0B,CAAC;CACrD;AAED,MAAM,WAAW,6BAA6B;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,MAAM,0BAA0B,GAAG,CACvC,KAAK,EAAE,QAAQ,CAAC,6BAA6B,CAAC,KAC3C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,kCAAmC,SAAQ,0BAA0B;IACpF,sBAAsB,EAAE,IAAI,CAAC;IAC7B;;;;OAIG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAkDD;;;GAGG;AACH,wBAAgB,wCAAwC,CAAC,EACvD,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAqC,EACrC,sBAAsB,GACvB,GAAE,yCAA8C,GAAG,kCAAkC,CA0KrF;;;;;;;;;;;;;;;;;AAED,wBASE"}

package/dist/aeb-consumption-store.js

@@ -0,0 +1,430 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * PostgreSQL custody for AEB operation consumption and native replay fences.
+ *
+ * A reservation installs the operation key and every native replay key in one
+ * pinned transaction. Logical conflicts roll the transaction back; database
+ * errors propagate so callers fail closed. Commit and release are fenced by an
+ * opaque per-reservation token retained only by the store instance that won.
+ */
+import crypto from 'node:crypto';
+export const AEB_PG_CONSUMPTION_STORE_VERSION = 'EP-GATE-AEB-PG-CONSUMPTION-v1';
+export const AEB_CONSUMPTION_OPERATION_TABLE = 'ep_aeb_consumption_operations';
+export const AEB_CONSUMPTION_REPLAY_TABLE = 'ep_aeb_consumption_replay_fences';
+export const AEB_CONSUMPTION_EXECUTOR_ROLE = 'ep_aeb_executor';
+export const AEB_CONSUMPTION_RECOVERY_ROLE = 'ep_aeb_recovery';
+export const AEB_CONSUMPTION_OWNER_ROLE = 'ep_aeb_store_owner';
+/** Exact schema required by createPostgresAebDurableConsumptionStore(). */
+export const AEB_CONSUMPTION_DDL = `CREATE TABLE IF NOT EXISTS ${AEB_CONSUMPTION_OPERATION_TABLE} (
+  tenant_id        TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),
+  relying_party_id TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),
+  operation_key    TEXT NOT NULL CHECK (octet_length(operation_key) BETWEEN 1 AND 4096),
+  state            TEXT NOT NULL CHECK (state IN ('RESERVED', 'CONSUMED')),
+  owner_token      TEXT NULL CHECK (owner_token IS NULL OR octet_length(owner_token) BETWEEN 16 AND 512),
+  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+  consumed_at      TIMESTAMPTZ NULL,
+  PRIMARY KEY (tenant_id, relying_party_id, operation_key),
+  CHECK (
+    (state = 'RESERVED' AND owner_token IS NOT NULL AND consumed_at IS NULL)
+    OR (state = 'CONSUMED' AND owner_token IS NULL AND consumed_at IS NOT NULL)
+  )
+);
+CREATE TABLE IF NOT EXISTS ${AEB_CONSUMPTION_REPLAY_TABLE} (
+  tenant_id        TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),
+  relying_party_id TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),
+  replay_key       TEXT NOT NULL CHECK (octet_length(replay_key) BETWEEN 1 AND 4096),
+  operation_key    TEXT NOT NULL CHECK (octet_length(operation_key) BETWEEN 1 AND 4096),
+  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+  PRIMARY KEY (tenant_id, relying_party_id, replay_key),
+  FOREIGN KEY (tenant_id, relying_party_id, operation_key)
+    REFERENCES ${AEB_CONSUMPTION_OPERATION_TABLE} (tenant_id, relying_party_id, operation_key)
+    ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS ${AEB_CONSUMPTION_REPLAY_TABLE}_operation_idx
+  ON ${AEB_CONSUMPTION_REPLAY_TABLE} (tenant_id, relying_party_id, operation_key);
+DO $roles$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = '${AEB_CONSUMPTION_EXECUTOR_ROLE}') THEN
+    CREATE ROLE ${AEB_CONSUMPTION_EXECUTOR_ROLE} NOLOGIN
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = '${AEB_CONSUMPTION_RECOVERY_ROLE}') THEN
+    CREATE ROLE ${AEB_CONSUMPTION_RECOVERY_ROLE} NOLOGIN
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = '${AEB_CONSUMPTION_OWNER_ROLE}') THEN
+    CREATE ROLE ${AEB_CONSUMPTION_OWNER_ROLE} NOLOGIN
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+  END IF;
+END
+$roles$;
+GRANT ${AEB_CONSUMPTION_OWNER_ROLE} TO CURRENT_USER;
+CREATE SCHEMA IF NOT EXISTS ep_aeb_private;
+REVOKE ALL ON SCHEMA ep_aeb_private FROM PUBLIC, anon, authenticated, service_role;
+CREATE TABLE IF NOT EXISTS ep_aeb_private.tenant_principals (
+  principal_name NAME NOT NULL,
+  tenant_id TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),
+  can_execute BOOLEAN NOT NULL DEFAULT FALSE,
+  can_recover BOOLEAN NOT NULL DEFAULT FALSE,
+  PRIMARY KEY (principal_name, tenant_id),
+  CHECK (can_execute OR can_recover)
+);
+ALTER SCHEMA ep_aeb_private OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER TABLE ep_aeb_private.tenant_principals OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER TABLE ${AEB_CONSUMPTION_OPERATION_TABLE} OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER TABLE ${AEB_CONSUMPTION_REPLAY_TABLE} OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER TABLE ep_aeb_private.tenant_principals ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ep_aeb_private.tenant_principals FORCE ROW LEVEL SECURITY;
+ALTER TABLE ${AEB_CONSUMPTION_OPERATION_TABLE} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ${AEB_CONSUMPTION_OPERATION_TABLE} FORCE ROW LEVEL SECURITY;
+ALTER TABLE ${AEB_CONSUMPTION_REPLAY_TABLE} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ${AEB_CONSUMPTION_REPLAY_TABLE} FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS ep_aeb_principals_owner_only ON ep_aeb_private.tenant_principals;
+CREATE POLICY ep_aeb_principals_owner_only ON ep_aeb_private.tenant_principals
+  TO ${AEB_CONSUMPTION_OWNER_ROLE} USING (TRUE) WITH CHECK (TRUE);
+DROP POLICY IF EXISTS ep_aeb_operations_owner_only ON ${AEB_CONSUMPTION_OPERATION_TABLE};
+CREATE POLICY ep_aeb_operations_owner_only ON ${AEB_CONSUMPTION_OPERATION_TABLE}
+  TO ${AEB_CONSUMPTION_OWNER_ROLE} USING (TRUE) WITH CHECK (TRUE);
+DROP POLICY IF EXISTS ep_aeb_replay_owner_only ON ${AEB_CONSUMPTION_REPLAY_TABLE};
+CREATE POLICY ep_aeb_replay_owner_only ON ${AEB_CONSUMPTION_REPLAY_TABLE}
+  TO ${AEB_CONSUMPTION_OWNER_ROLE} USING (TRUE) WITH CHECK (TRUE);
+REVOKE ALL ON ep_aeb_private.tenant_principals FROM PUBLIC, anon, authenticated, service_role,
+  ${AEB_CONSUMPTION_EXECUTOR_ROLE}, ${AEB_CONSUMPTION_RECOVERY_ROLE};
+REVOKE ALL ON ${AEB_CONSUMPTION_OPERATION_TABLE} FROM PUBLIC, anon, authenticated, service_role,
+  ${AEB_CONSUMPTION_EXECUTOR_ROLE}, ${AEB_CONSUMPTION_RECOVERY_ROLE};
+REVOKE ALL ON ${AEB_CONSUMPTION_REPLAY_TABLE} FROM PUBLIC, anon, authenticated, service_role,
+  ${AEB_CONSUMPTION_EXECUTOR_ROLE}, ${AEB_CONSUMPTION_RECOVERY_ROLE};
+CREATE OR REPLACE FUNCTION ep_aeb_private.assert_tenant_principal(
+  p_tenant_id TEXT, p_recovery BOOLEAN
+) RETURNS VOID
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = ''
+AS $fn$
+DECLARE v_role_ok BOOLEAN; v_binding_ok BOOLEAN;
+BEGIN
+  v_role_ok := CASE WHEN p_recovery
+    THEN pg_catalog.pg_has_role(SESSION_USER, '${AEB_CONSUMPTION_RECOVERY_ROLE}', 'MEMBER')
+    ELSE pg_catalog.pg_has_role(SESSION_USER, '${AEB_CONSUMPTION_EXECUTOR_ROLE}', 'MEMBER')
+  END;
+  SELECT EXISTS (
+    SELECT 1 FROM ep_aeb_private.tenant_principals AS principals
+    WHERE principals.principal_name = SESSION_USER
+      AND principals.tenant_id = p_tenant_id
+      AND CASE WHEN p_recovery THEN principals.can_recover ELSE principals.can_execute END
+  ) INTO v_binding_ok;
+  IF v_role_ok IS NOT TRUE OR v_binding_ok IS NOT TRUE THEN
+    RAISE EXCEPTION 'AEB_TENANT_PRINCIPAL_REFUSED' USING ERRCODE = '42501';
+  END IF;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.reserve_operation(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT
+) RETURNS TABLE(operation_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY INSERT INTO public.${AEB_CONSUMPTION_OPERATION_TABLE}
+    (tenant_id, relying_party_id, operation_key, state, owner_token)
+    VALUES (p_tenant_id, p_relying_party_id, p_operation_key, 'RESERVED', p_owner_token)
+    ON CONFLICT ON CONSTRAINT ep_aeb_consumption_operations_pkey DO NOTHING
+    RETURNING ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.reserve_replay_keys(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_replay_keys TEXT[]
+) RETURNS TABLE(replay_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY INSERT INTO public.${AEB_CONSUMPTION_REPLAY_TABLE}
+    (tenant_id, relying_party_id, replay_key, operation_key)
+    SELECT p_tenant_id, p_relying_party_id, requested.replay_key, p_operation_key
+    FROM pg_catalog.unnest(p_replay_keys) AS requested(replay_key)
+    ORDER BY requested.replay_key
+    ON CONFLICT ON CONSTRAINT ep_aeb_consumption_replay_fences_pkey DO NOTHING
+    RETURNING ${AEB_CONSUMPTION_REPLAY_TABLE}.replay_key;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.commit_operation(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT
+) RETURNS TABLE(operation_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY UPDATE public.${AEB_CONSUMPTION_OPERATION_TABLE}
+    SET state = 'CONSUMED', owner_token = NULL, consumed_at = pg_catalog.transaction_timestamp()
+    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id
+      AND ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key = p_operation_key
+      AND state = 'RESERVED' AND owner_token = p_owner_token
+    RETURNING ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.claim_operation(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT
+) RETURNS TABLE(operation_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, TRUE);
+  RETURN QUERY UPDATE public.${AEB_CONSUMPTION_OPERATION_TABLE}
+    SET owner_token = p_owner_token
+    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id
+      AND ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key = p_operation_key
+      AND state = 'RESERVED'
+    RETURNING ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.release_operation(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT
+) RETURNS TABLE(operation_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY DELETE FROM public.${AEB_CONSUMPTION_OPERATION_TABLE}
+    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id
+      AND ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key = p_operation_key
+      AND state = 'RESERVED' AND owner_token = p_owner_token
+    RETURNING ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key;
+END
+$fn$;
+ALTER FUNCTION ep_aeb_private.assert_tenant_principal(TEXT, BOOLEAN)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.reserve_operation(TEXT, TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.reserve_replay_keys(TEXT, TEXT, TEXT, TEXT[])
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.commit_operation(TEXT, TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.claim_operation(TEXT, TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.release_operation(TEXT, TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+REVOKE ALL ON ALL FUNCTIONS IN SCHEMA ep_aeb_private
+  FROM PUBLIC, anon, authenticated, service_role;
+GRANT USAGE ON SCHEMA ep_aeb_private TO ${AEB_CONSUMPTION_EXECUTOR_ROLE}, ${AEB_CONSUMPTION_RECOVERY_ROLE};
+GRANT EXECUTE ON FUNCTION ep_aeb_private.reserve_operation(TEXT, TEXT, TEXT, TEXT),
+  ep_aeb_private.reserve_replay_keys(TEXT, TEXT, TEXT, TEXT[]),
+  ep_aeb_private.commit_operation(TEXT, TEXT, TEXT, TEXT),
+  ep_aeb_private.release_operation(TEXT, TEXT, TEXT, TEXT)
+  TO ${AEB_CONSUMPTION_EXECUTOR_ROLE};
+GRANT EXECUTE ON FUNCTION ep_aeb_private.claim_operation(TEXT, TEXT, TEXT, TEXT)
+  TO ${AEB_CONSUMPTION_RECOVERY_ROLE};
+REVOKE ${AEB_CONSUMPTION_OWNER_ROLE} FROM CURRENT_USER;`;
+/** Exact statements issued by the store, exported for audit and deterministic fakes. */
+export const AEB_CONSUMPTION_SQL = Object.freeze({
+    reserveOperation: `SELECT operation_key FROM ep_aeb_private.reserve_operation($1::text, $2::text, $3::text, $4::text)`,
+    reserveReplayKeys: `SELECT replay_key FROM ep_aeb_private.reserve_replay_keys($1::text, $2::text, $3::text, $4::text[])`,
+    commitOperation: `SELECT operation_key FROM ep_aeb_private.commit_operation($1::text, $2::text, $3::text, $4::text)`,
+    claimOperation: `SELECT operation_key FROM ep_aeb_private.claim_operation($1::text, $2::text, $3::text, $4::text)`,
+    releaseOperation: `SELECT operation_key FROM ep_aeb_private.release_operation($1::text, $2::text, $3::text, $4::text)`,
+});
+const BEGIN_WRITE = 'BEGIN ISOLATION LEVEL READ COMMITTED READ WRITE';
+const COMMIT = 'COMMIT';
+const ROLLBACK = 'ROLLBACK';
+class ReservationConflict extends Error {
+    result;
+    constructor(result) {
+        super(result);
+        this.result = result;
+    }
+}
+function defaultOwnerToken() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+function assertText(value, label, maximumBytes) {
+    if (typeof value !== 'string'
+        || Buffer.byteLength(value, 'utf8') < 1
+        || Buffer.byteLength(value, 'utf8') > maximumBytes
+        || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new TypeError(`AEB consumption ${label} is invalid`);
+    }
+}
+function assertOwnerToken(value) {
+    if (typeof value !== 'string'
+        || Buffer.byteLength(value, 'utf8') < 16
+        || Buffer.byteLength(value, 'utf8') > 512
+        || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new TypeError('AEB consumption ownerTokenFactory must return an opaque string of 16 to 512 bytes');
+    }
+}
+function exactRowCount(result, operation) {
+    if (!result
+        || !Number.isSafeInteger(result.rowCount)
+        || result.rowCount < 0) {
+        throw new Error(`${operation}: malformed PostgreSQL result`);
+    }
+    return result.rowCount;
+}
+/**
+ * Create the durable AEB store consumed by authorizeAebExecutionDurable().
+ * The pool must return a pinned node-postgres-style client for each transaction.
+ */
+export function createPostgresAebDurableConsumptionStore({ pool, recoveryPool, tenantId, relyingPartyId, ownerTokenFactory = defaultOwnerToken, authorizeRecoveryClaim, } = {}) {
+    if (!pool || typeof pool.connect !== 'function') {
+        throw new TypeError('createPostgresAebDurableConsumptionStore requires an ep_aeb_executor pg pool');
+    }
+    if (!recoveryPool || typeof recoveryPool.connect !== 'function' || recoveryPool === pool) {
+        throw new TypeError('AEB consumption requires a distinct ep_aeb_recovery pg pool');
+    }
+    assertText(tenantId, 'tenantId', 512);
+    assertText(relyingPartyId, 'relyingPartyId', 512);
+    if (typeof ownerTokenFactory !== 'function') {
+        throw new TypeError('AEB consumption ownerTokenFactory must be a function');
+    }
+    if (typeof authorizeRecoveryClaim !== 'function') {
+        throw new TypeError('AEB consumption requires an authorizeRecoveryClaim callback');
+    }
+    async function transaction(activePool, work) {
+        const client = await activePool.connect();
+        if (!client || typeof client.query !== 'function' || typeof client.release !== 'function') {
+            throw new TypeError('AEB consumption pg pool returned an invalid client');
+        }
+        let began = false;
+        try {
+            await client.query(BEGIN_WRITE);
+            began = true;
+            const result = await work(client);
+            await client.query(COMMIT);
+            began = false;
+            return result;
+        }
+        catch (error) {
+            if (began) {
+                try {
+                    await client.query(ROLLBACK);
+                }
+                catch (rollbackError) {
+                    throw new AggregateError([error, rollbackError], 'AEB consumption transaction and rollback both failed');
+                }
+            }
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+    const ownedReservations = new Map();
+    const store = {
+        durable: true,
+        ownershipFenced: true,
+        permanentConsumption: true,
+        atomicReplayFenced: true,
+        recoveryClaimSupported: true,
+        async reserve(key, replayKeys = []) {
+            assertText(key, 'operation key', 4096);
+            if (!Array.isArray(replayKeys)) {
+                throw new TypeError('AEB consumption replay keys must be an array');
+            }
+            for (const replayKey of replayKeys)
+                assertText(replayKey, 'native replay key', 4096);
+            // Stable lock acquisition order avoids crossed replay-key insert order
+            // becoming a preventable PostgreSQL deadlock under concurrency.
+            const uniqueReplayKeys = [...new Set(replayKeys)].sort();
+            const ownerToken = ownerTokenFactory();
+            assertOwnerToken(ownerToken);
+            try {
+                await transaction(pool, async (client) => {
+                    const operationRows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.reserveOperation, [
+                        tenantId, relyingPartyId, key, ownerToken,
+                    ]), 'reserve operation');
+                    if (operationRows === 0)
+                        throw new ReservationConflict('CONSUMPTION_CONFLICT');
+                    if (operationRows !== 1)
+                        throw new Error('reserve operation: unexpected PostgreSQL row count');
+                    const replayRows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.reserveReplayKeys, [
+                        tenantId, relyingPartyId, key, uniqueReplayKeys,
+                    ]), 'reserve native replay keys');
+                    if (replayRows !== uniqueReplayKeys.length) {
+                        throw new ReservationConflict('NATIVE_REPLAY_CONFLICT');
+                    }
+                });
+            }
+            catch (error) {
+                if (error instanceof ReservationConflict)
+                    return error.result;
+                throw error;
+            }
+            ownedReservations.set(key, ownerToken);
+            return 'RESERVED';
+        },
+        async claimReservation(key, authorization) {
+            assertText(key, 'operation key', 4096);
+            // Recovery is a restart boundary, not an in-place owner rotation. The
+            // base AEB store API fences ownership by store instance (commit/release
+            // take only the operation key), so replacing a token already owned by
+            // this instance would let its stale caller inherit the new token.
+            if (ownedReservations.has(key))
+                return false;
+            const claim = Object.freeze({
+                authorization,
+                tenantId,
+                relyingPartyId,
+                operationKey: key,
+                requiredState: 'RESERVED',
+            });
+            if (await authorizeRecoveryClaim(claim) !== true)
+                return false;
+            const ownerToken = ownerTokenFactory();
+            assertOwnerToken(ownerToken);
+            const changed = await transaction(recoveryPool, async (client) => {
+                const rows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.claimOperation, [
+                    tenantId, relyingPartyId, key, ownerToken,
+                ]), 'claim operation');
+                if (rows > 1)
+                    throw new Error('claim operation: unexpected PostgreSQL row count');
+                return rows === 1;
+            });
+            if (changed)
+                ownedReservations.set(key, ownerToken);
+            return changed;
+        },
+        async commit(key) {
+            assertText(key, 'operation key', 4096);
+            const ownerToken = ownedReservations.get(key);
+            if (ownerToken === undefined)
+                return false;
+            const changed = await transaction(pool, async (client) => {
+                const rows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.commitOperation, [
+                    tenantId, relyingPartyId, key, ownerToken,
+                ]), 'commit operation');
+                if (rows > 1)
+                    throw new Error('commit operation: unexpected PostgreSQL row count');
+                return rows === 1;
+            });
+            ownedReservations.delete(key);
+            return changed;
+        },
+        async release(key) {
+            assertText(key, 'operation key', 4096);
+            const ownerToken = ownedReservations.get(key);
+            if (ownerToken === undefined)
+                return false;
+            const changed = await transaction(pool, async (client) => {
+                const rows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.releaseOperation, [
+                    tenantId, relyingPartyId, key, ownerToken,
+                ]), 'release operation');
+                if (rows > 1)
+                    throw new Error('release operation: unexpected PostgreSQL row count');
+                return rows === 1;
+            });
+            ownedReservations.delete(key);
+            return changed;
+        },
+    };
+    return Object.freeze(store);
+}
+export default {
+    AEB_PG_CONSUMPTION_STORE_VERSION,
+    AEB_CONSUMPTION_OPERATION_TABLE,
+    AEB_CONSUMPTION_REPLAY_TABLE,
+    AEB_CONSUMPTION_EXECUTOR_ROLE,
+    AEB_CONSUMPTION_RECOVERY_ROLE,
+    AEB_CONSUMPTION_DDL,
+    AEB_CONSUMPTION_SQL,
+    createPostgresAebDurableConsumptionStore,
+};
+//# sourceMappingURL=aeb-consumption-store.js.map