@emilia-protocol/gate 0.14.0 → 0.15.1

package/CHANGELOG.md

@@ -4,7 +4,35 @@
 All notable changes to `@emilia-protocol/gate` are documented here.
 This package follows [Semantic Versioning](https://semver.org/).
 
-## 0.14.0 (2026-07-22)
+## 0.15.1 (2026-07-23)
+
+### Added
+
+- A tenant-authenticated `hasReplayFence()` observation on the durable AEB
+  consumption store. It reports an exact native replay unit as unavailable
+  when either a reserved or permanently consumed fence exists.
+- Durable accepted `EP-STATUS-v1` head custody, scoped by tenant, relying
+  party, and complete status target, with database-side compare-and-advance.
+- A tenant-authorized Proposal-to-Effect attempt lookup over the immutable
+  provider tuple and request digest, so a lost indeterminate HTTP response can
+  be rediscovered without invoking the effect again or rotating recovery
+  ownership.
+
+### Security
+
+- Proposal-to-Effect status verification can now obtain exact, server-side
+  replay state without granting direct table access. The observation is a
+  preflight check; the immediately following atomic reservation remains the
+  race-closing authority boundary.
+- Proposal-to-Effect no longer accepts a caller-configurable previous-head
+  resolver. Status candidates are verified against the relying party's stored
+  predecessor and admitted only if that head still wins an atomic comparison.
+- The production readiness contract proves distinct executor and recovery
+  session identities, exclusive tenant capabilities, exact role/RPC grants,
+  and the required replay, status-head, and attempt-store schema before
+  admitting traffic.
+
+## 0.15.0 (2026-07-22)
 
 ### Added
 
@@ -15,6 +43,23 @@ This package follows [Semantic Versioning](https://semver.org/).
 - An executable end-to-end example and profile vectors covering exact-action
   mutation, stale evidence, one-time replay, indeterminate effects, and
   post-effect commit failure.
+- `./aeb-consumption-store`, a tenant- and relying-party-namespaced PostgreSQL
+  store that atomically fences the AEB operation and all native replay units,
+  with opaque owner tokens and authorized restart recovery.
+- `./proposal-to-effect-status`, which verifies server-resolved
+  `EP-STATUS-v1` heads and separately requires authenticated local consumption
+  state before the atomic execution reservation.
+- `./proposal-to-effect-postgres`, a private-schema PostgreSQL store for
+  consequence attempts with HMAC-hidden owner capabilities, tenant/provider
+  namespaces, owner-fenced transitions, immutable terminal states, exact
+  provider-evidence reconciliation, database leases, disjoint executor and
+  recovery roles, tenant-principal bindings, and stale-only restart recovery.
+- Concrete Remedy Program evidence adapters for signed disputes,
+  authorizations, provider outcomes, Action Escrow state, and late revocation.
+- A heterogeneous remedy case-set coordinator that completes only after every
+  exact child state and signed remedy receipt verifies.
+- A PostgreSQL remedy case-set store with tenant RLS, immutable manifests,
+  append-only state events, database-clock custody, and owner/revision CAS.
 
 ### Security
 
@@ -25,6 +70,20 @@ This package follows [Semantic Versioning](https://semver.org/).
 - Once an effect may have executed, failed bookkeeping cannot release its AEB
   reservation. The operation remains frozen until authenticated provider
   evidence proves `COMMITTED` or `NOT_COMMITTED`.
+- A committed effect consumes AEB replay authority before its consequence row
+  becomes terminal. `repairAeb` converges legacy or crash-window terminal rows
+  without invoking an effect, and opaque attempt-owner capabilities are kept
+  out of enumerable results and errors.
+- A recovered worker receives a rotated owner capability; the stale worker can
+  no longer transition or reconcile the attempt. An in-flight attempt is
+  conservatively recovered as `INDETERMINATE`, never retried as unexecuted.
+- AEB production consumption state is RPC-only behind tenant-bound, no-bypass
+  executor and recovery roles with physically separate pools. Supabase
+  `service_role` and both runtime roles have no direct table authority;
+  in-memory stores remain test-only.
+- Remedy case-set state and append-only history are likewise RPC-only behind a
+  tenant-bound no-bypass executor; generic service credentials cannot rewrite
+  current or historical remedy state.
 
 ## 0.13.0 (2026-07-20)
 

package/README.md

@@ -68,9 +68,19 @@ format. The proposal is an unsigned, short-lived request; authority remains in
 
 ```js
 import { createProposalToEffect } from '@emilia-protocol/gate/proposal-to-effect';
+import { createProposalToEffectPostgresStore } from '@emilia-protocol/gate/proposal-to-effect-postgres';
 
 const controller = createProposalToEffect({
   gate,
+  proposal_integrity: { hmac_sha256_key: serverHeld32ByteKey },
+  consequence: {
+    tenant_id: tenantId,
+    provider_id: providerId,
+    provider_account_id: providerAccountId,
+    environment,
+    executor_id: executorId,
+    store: durableConsequenceAttemptStore,
+  },
   profiles: {
     'payment-release': {
       id: 'payment-release',
@@ -94,6 +104,8 @@ const controller = createProposalToEffect({
     adapters: pinnedAebAdapters,
     store: durableOperationStore,
     resolve_artifacts,
+    currentStatusResolver,
+    statusVerifier,
     verify_provider_evidence,
   },
 });
@@ -113,10 +125,29 @@ The controller re-verifies the signed AEB evaluation, runs Gate policy,
 reserves the operation before invoking the effect, and consumes it after
 success. An uncertain provider result remains reserved; only authenticated
 provider evidence bound to the same operation, CAID, and action digest can
-reconcile it. See
+reconcile it. Owner capabilities are not serialized in results or errors;
+same-process services retrieve them with `getReconciliationHandle(object)`,
+while restarted services use the PostgreSQL store's authorized recovery path.
+Production PostgreSQL wiring uses different executor and recovery pools. Each
+database login is explicitly bound to a tenant and receives only its matching
+non-login group role; `service_role` receives neither RPC surface. Recovery is
+possible only after the database lease is stale, rotates the owner capability,
+and preserves `INDETERMINATE` whenever provider execution may have started.
+`repairAeb()` converges a durable terminal attempt with a stranded AEB
+reservation without invoking the effect again. See
 [`docs/protocol/proposal-to-effect-profile-v1.md`](../../docs/protocol/proposal-to-effect-profile-v1.md)
 and run `node examples/proposal-to-effect/demo.mjs` from the repository root.
 
+The AEB consumption store has its own disjoint PostgreSQL credentials:
+`createPostgresAebDurableConsumptionStore()` requires an `ep_aeb_executor`
+pool and a physically distinct `ep_aeb_recovery` pool. Each login must be
+listed for the tenant in `ep_aeb_private.tenant_principals`. Neither runtime
+role receives table privileges; reserve, commit, release, and recovery claim
+are narrow security-definer functions. Supabase `service_role` receives no
+table, schema, or function authority. Remedy case sets use the same custody
+shape through a tenant-bound `ep_remedy_executor` login and
+`ep_remedy_private.tenant_principals`.
+
 ## Three-plane deployment
 
 High-consequence infrastructure separates three jobs instead of asking one

package/aeb-consumption-store.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+export * from './dist/aeb-consumption-store.js';
+export { default } from './dist/aeb-consumption-store.js';

package/dist/aeb-consumption-store.d.ts

@@ -0,0 +1,88 @@
+import type { AebDurableConsumptionStore } from '@emilia-protocol/verify/aeb-adapter-contract';
+export declare const AEB_PG_CONSUMPTION_STORE_VERSION = "EP-GATE-AEB-PG-CONSUMPTION-v1";
+export declare const AEB_CONSUMPTION_OPERATION_TABLE = "ep_aeb_consumption_operations";
+export declare const AEB_CONSUMPTION_REPLAY_TABLE = "ep_aeb_consumption_replay_fences";
+export declare const AEB_CONSUMPTION_EXECUTOR_ROLE = "ep_aeb_executor";
+export declare const AEB_CONSUMPTION_RECOVERY_ROLE = "ep_aeb_recovery";
+export declare const AEB_CONSUMPTION_OWNER_ROLE = "ep_aeb_store_owner";
+/** Exact schema required by createPostgresAebDurableConsumptionStore(). */
+export declare const AEB_CONSUMPTION_DDL = "CREATE TABLE IF NOT EXISTS ep_aeb_consumption_operations (\n  tenant_id        TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),\n  relying_party_id TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),\n  operation_key    TEXT NOT NULL CHECK (octet_length(operation_key) BETWEEN 1 AND 4096),\n  state            TEXT NOT NULL CHECK (state IN ('RESERVED', 'CONSUMED')),\n  owner_token      TEXT NULL CHECK (owner_token IS NULL OR octet_length(owner_token) BETWEEN 16 AND 512),\n  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),\n  consumed_at      TIMESTAMPTZ NULL,\n  PRIMARY KEY (tenant_id, relying_party_id, operation_key),\n  CHECK (\n    (state = 'RESERVED' AND owner_token IS NOT NULL AND consumed_at IS NULL)\n    OR (state = 'CONSUMED' AND owner_token IS NULL AND consumed_at IS NOT NULL)\n  )\n);\nCREATE TABLE IF NOT EXISTS ep_aeb_consumption_replay_fences (\n  tenant_id        TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),\n  relying_party_id TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),\n  replay_key       TEXT NOT NULL CHECK (octet_length(replay_key) BETWEEN 1 AND 4096),\n  operation_key    TEXT NOT NULL CHECK (octet_length(operation_key) BETWEEN 1 AND 4096),\n  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),\n  PRIMARY KEY (tenant_id, relying_party_id, replay_key),\n  FOREIGN KEY (tenant_id, relying_party_id, operation_key)\n    REFERENCES ep_aeb_consumption_operations (tenant_id, relying_party_id, operation_key)\n    ON DELETE CASCADE\n);\nCREATE INDEX IF NOT EXISTS ep_aeb_consumption_replay_fences_operation_idx\n  ON ep_aeb_consumption_replay_fences (tenant_id, relying_party_id, operation_key);\nDO $roles$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'ep_aeb_executor') THEN\n    CREATE ROLE ep_aeb_executor NOLOGIN\n      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'ep_aeb_recovery') THEN\n    CREATE ROLE ep_aeb_recovery NOLOGIN\n      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n  END IF;\n  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'ep_aeb_store_owner') THEN\n    CREATE ROLE ep_aeb_store_owner NOLOGIN\n      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;\n  END IF;\nEND\n$roles$;\nGRANT ep_aeb_store_owner TO CURRENT_USER;\nCREATE SCHEMA IF NOT EXISTS ep_aeb_private;\nREVOKE ALL ON SCHEMA ep_aeb_private FROM PUBLIC, anon, authenticated, service_role;\nCREATE TABLE IF NOT EXISTS ep_aeb_private.tenant_principals (\n  principal_name NAME NOT NULL,\n  tenant_id TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),\n  can_execute BOOLEAN NOT NULL DEFAULT FALSE,\n  can_recover BOOLEAN NOT NULL DEFAULT FALSE,\n  PRIMARY KEY (principal_name, tenant_id),\n  CHECK (can_execute OR can_recover)\n);\nALTER SCHEMA ep_aeb_private OWNER TO ep_aeb_store_owner;\nALTER TABLE ep_aeb_private.tenant_principals OWNER TO ep_aeb_store_owner;\nALTER TABLE ep_aeb_consumption_operations OWNER TO ep_aeb_store_owner;\nALTER TABLE ep_aeb_consumption_replay_fences OWNER TO ep_aeb_store_owner;\nALTER TABLE ep_aeb_private.tenant_principals ENABLE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_private.tenant_principals FORCE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_consumption_operations ENABLE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_consumption_operations FORCE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_consumption_replay_fences ENABLE ROW LEVEL SECURITY;\nALTER TABLE ep_aeb_consumption_replay_fences FORCE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS ep_aeb_principals_owner_only ON ep_aeb_private.tenant_principals;\nCREATE POLICY ep_aeb_principals_owner_only ON ep_aeb_private.tenant_principals\n  TO ep_aeb_store_owner USING (TRUE) WITH CHECK (TRUE);\nDROP POLICY IF EXISTS ep_aeb_operations_owner_only ON ep_aeb_consumption_operations;\nCREATE POLICY ep_aeb_operations_owner_only ON ep_aeb_consumption_operations\n  TO ep_aeb_store_owner USING (TRUE) WITH CHECK (TRUE);\nDROP POLICY IF EXISTS ep_aeb_replay_owner_only ON ep_aeb_consumption_replay_fences;\nCREATE POLICY ep_aeb_replay_owner_only ON ep_aeb_consumption_replay_fences\n  TO ep_aeb_store_owner USING (TRUE) WITH CHECK (TRUE);\nREVOKE ALL ON ep_aeb_private.tenant_principals FROM PUBLIC, anon, authenticated, service_role,\n  ep_aeb_executor, ep_aeb_recovery;\nREVOKE ALL ON ep_aeb_consumption_operations FROM PUBLIC, anon, authenticated, service_role,\n  ep_aeb_executor, ep_aeb_recovery;\nREVOKE ALL ON ep_aeb_consumption_replay_fences FROM PUBLIC, anon, authenticated, service_role,\n  ep_aeb_executor, ep_aeb_recovery;\nCREATE OR REPLACE FUNCTION ep_aeb_private.assert_tenant_principal(\n  p_tenant_id TEXT, p_recovery BOOLEAN\n) RETURNS VOID\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = ''\nAS $fn$\nDECLARE v_role_ok BOOLEAN; v_binding_ok BOOLEAN;\nBEGIN\n  v_role_ok := CASE WHEN p_recovery\n    THEN pg_catalog.pg_has_role(SESSION_USER, 'ep_aeb_recovery', 'MEMBER')\n    ELSE pg_catalog.pg_has_role(SESSION_USER, 'ep_aeb_executor', 'MEMBER')\n  END;\n  SELECT EXISTS (\n    SELECT 1 FROM ep_aeb_private.tenant_principals AS principals\n    WHERE principals.principal_name = SESSION_USER\n      AND principals.tenant_id = p_tenant_id\n      AND CASE WHEN p_recovery THEN principals.can_recover ELSE principals.can_execute END\n  ) INTO v_binding_ok;\n  IF v_role_ok IS NOT TRUE OR v_binding_ok IS NOT TRUE THEN\n    RAISE EXCEPTION 'AEB_TENANT_PRINCIPAL_REFUSED' USING ERRCODE = '42501';\n  END IF;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.reserve_operation(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT\n) RETURNS TABLE(operation_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY INSERT INTO public.ep_aeb_consumption_operations\n    (tenant_id, relying_party_id, operation_key, state, owner_token)\n    VALUES (p_tenant_id, p_relying_party_id, p_operation_key, 'RESERVED', p_owner_token)\n    ON CONFLICT ON CONSTRAINT ep_aeb_consumption_operations_pkey DO NOTHING\n    RETURNING ep_aeb_consumption_operations.operation_key;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.has_replay_fence(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_replay_key TEXT\n) RETURNS TABLE(fenced BOOLEAN)\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY SELECT EXISTS (\n    SELECT 1\n    FROM public.ep_aeb_consumption_replay_fences AS fences\n    WHERE fences.tenant_id = p_tenant_id\n      AND fences.relying_party_id = p_relying_party_id\n      AND fences.replay_key = p_replay_key\n  );\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.reserve_replay_keys(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_replay_keys TEXT[]\n) RETURNS TABLE(replay_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY INSERT INTO public.ep_aeb_consumption_replay_fences\n    (tenant_id, relying_party_id, replay_key, operation_key)\n    SELECT p_tenant_id, p_relying_party_id, requested.replay_key, p_operation_key\n    FROM pg_catalog.unnest(p_replay_keys) AS requested(replay_key)\n    ORDER BY requested.replay_key\n    ON CONFLICT ON CONSTRAINT ep_aeb_consumption_replay_fences_pkey DO NOTHING\n    RETURNING ep_aeb_consumption_replay_fences.replay_key;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.commit_operation(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT\n) RETURNS TABLE(operation_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY UPDATE public.ep_aeb_consumption_operations\n    SET state = 'CONSUMED', owner_token = NULL, consumed_at = pg_catalog.transaction_timestamp()\n    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id\n      AND ep_aeb_consumption_operations.operation_key = p_operation_key\n      AND state = 'RESERVED' AND owner_token = p_owner_token\n    RETURNING ep_aeb_consumption_operations.operation_key;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.claim_operation(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT\n) RETURNS TABLE(operation_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, TRUE);\n  RETURN QUERY UPDATE public.ep_aeb_consumption_operations\n    SET owner_token = p_owner_token\n    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id\n      AND ep_aeb_consumption_operations.operation_key = p_operation_key\n      AND state = 'RESERVED'\n    RETURNING ep_aeb_consumption_operations.operation_key;\nEND\n$fn$;\nCREATE OR REPLACE FUNCTION ep_aeb_private.release_operation(\n  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT\n) RETURNS TABLE(operation_key TEXT)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = ''\nAS $fn$\nBEGIN\n  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);\n  RETURN QUERY DELETE FROM public.ep_aeb_consumption_operations\n    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id\n      AND ep_aeb_consumption_operations.operation_key = p_operation_key\n      AND state = 'RESERVED' AND owner_token = p_owner_token\n    RETURNING ep_aeb_consumption_operations.operation_key;\nEND\n$fn$;\nALTER FUNCTION ep_aeb_private.assert_tenant_principal(TEXT, BOOLEAN)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.reserve_operation(TEXT, TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.has_replay_fence(TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.reserve_replay_keys(TEXT, TEXT, TEXT, TEXT[])\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.commit_operation(TEXT, TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.claim_operation(TEXT, TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nALTER FUNCTION ep_aeb_private.release_operation(TEXT, TEXT, TEXT, TEXT)\n  OWNER TO ep_aeb_store_owner;\nREVOKE ALL ON ALL FUNCTIONS IN SCHEMA ep_aeb_private\n  FROM PUBLIC, anon, authenticated, service_role;\nGRANT USAGE ON SCHEMA ep_aeb_private TO ep_aeb_executor, ep_aeb_recovery;\nGRANT EXECUTE ON FUNCTION ep_aeb_private.has_replay_fence(TEXT, TEXT, TEXT),\n  ep_aeb_private.reserve_operation(TEXT, TEXT, TEXT, TEXT),\n  ep_aeb_private.reserve_replay_keys(TEXT, TEXT, TEXT, TEXT[]),\n  ep_aeb_private.commit_operation(TEXT, TEXT, TEXT, TEXT),\n  ep_aeb_private.release_operation(TEXT, TEXT, TEXT, TEXT)\n  TO ep_aeb_executor;\nGRANT EXECUTE ON FUNCTION ep_aeb_private.claim_operation(TEXT, TEXT, TEXT, TEXT)\n  TO ep_aeb_recovery;\nREVOKE ep_aeb_store_owner FROM CURRENT_USER;";
+/** Exact statements issued by the store, exported for audit and deterministic fakes. */
+export declare const AEB_CONSUMPTION_SQL: Readonly<{
+    hasReplayFence: "SELECT fenced FROM ep_aeb_private.has_replay_fence($1::text, $2::text, $3::text)";
+    reserveOperation: "SELECT operation_key FROM ep_aeb_private.reserve_operation($1::text, $2::text, $3::text, $4::text)";
+    reserveReplayKeys: "SELECT replay_key FROM ep_aeb_private.reserve_replay_keys($1::text, $2::text, $3::text, $4::text[])";
+    commitOperation: "SELECT operation_key FROM ep_aeb_private.commit_operation($1::text, $2::text, $3::text, $4::text)";
+    claimOperation: "SELECT operation_key FROM ep_aeb_private.claim_operation($1::text, $2::text, $3::text, $4::text)";
+    releaseOperation: "SELECT operation_key FROM ep_aeb_private.release_operation($1::text, $2::text, $3::text, $4::text)";
+}>;
+type QueryResult = {
+    rowCount: number | null;
+    rows?: Record<string, unknown>[];
+};
+export type AebConsumptionPgClient = {
+    query: (text: string, params?: any[]) => Promise<QueryResult>;
+    release: () => void;
+};
+export type AebConsumptionPgPool = {
+    connect: () => Promise<AebConsumptionPgClient>;
+};
+export interface PostgresAebDurableConsumptionStoreOptions {
+    /** Pool authenticated as a tenant-bound member of ep_aeb_executor. */
+    pool?: AebConsumptionPgPool;
+    /** Distinct pool authenticated as a tenant-bound member of ep_aeb_recovery. */
+    recoveryPool?: AebConsumptionPgPool;
+    tenantId?: string;
+    relyingPartyId?: string;
+    /** Must return an unpredictable opaque string in production. */
+    ownerTokenFactory?: () => string;
+    /** Verify a caller credential bound to the exact reservation being claimed. */
+    authorizeRecoveryClaim?: AebRecoveryClaimAuthorizer;
+}
+export interface AebRecoveryClaimAuthorization {
+    authorization: unknown;
+    tenantId: string;
+    relyingPartyId: string;
+    operationKey: string;
+    requiredState: 'RESERVED';
+}
+export type AebRecoveryClaimAuthorizer = (claim: Readonly<AebRecoveryClaimAuthorization>) => boolean | Promise<boolean>;
+export interface PostgresAebDurableConsumptionStore extends AebDurableConsumptionStore {
+    recoveryClaimSupported: true;
+    /**
+     * Authenticated pre-reservation observation for one exact native replay key.
+     * A true result includes both RESERVED and CONSUMED fences. Atomic reserve
+     * remains the race-closing operation.
+     */
+    hasReplayFence(replayKey: string): Promise<boolean>;
+    /**
+     * Rotate ownership of an existing RESERVED row after external authorization.
+     * The stored and replacement owner tokens are never returned or passed to
+     * the authorizer.
+     */
+    claimReservation(key: string, authorization: unknown): Promise<boolean>;
+}
+/**
+ * Create the durable AEB store consumed by authorizeAebExecutionDurable().
+ * The pool must return a pinned node-postgres-style client for each transaction.
+ */
+export declare function createPostgresAebDurableConsumptionStore({ pool, recoveryPool, tenantId, relyingPartyId, ownerTokenFactory, authorizeRecoveryClaim, }?: PostgresAebDurableConsumptionStoreOptions): PostgresAebDurableConsumptionStore;
+declare const _default: {
+    AEB_PG_CONSUMPTION_STORE_VERSION: string;
+    AEB_CONSUMPTION_OPERATION_TABLE: string;
+    AEB_CONSUMPTION_REPLAY_TABLE: string;
+    AEB_CONSUMPTION_EXECUTOR_ROLE: string;
+    AEB_CONSUMPTION_RECOVERY_ROLE: string;
+    AEB_CONSUMPTION_DDL: string;
+    AEB_CONSUMPTION_SQL: Readonly<{
+        hasReplayFence: "SELECT fenced FROM ep_aeb_private.has_replay_fence($1::text, $2::text, $3::text)";
+        reserveOperation: "SELECT operation_key FROM ep_aeb_private.reserve_operation($1::text, $2::text, $3::text, $4::text)";
+        reserveReplayKeys: "SELECT replay_key FROM ep_aeb_private.reserve_replay_keys($1::text, $2::text, $3::text, $4::text[])";
+        commitOperation: "SELECT operation_key FROM ep_aeb_private.commit_operation($1::text, $2::text, $3::text, $4::text)";
+        claimOperation: "SELECT operation_key FROM ep_aeb_private.claim_operation($1::text, $2::text, $3::text, $4::text)";
+        releaseOperation: "SELECT operation_key FROM ep_aeb_private.release_operation($1::text, $2::text, $3::text, $4::text)";
+    }>;
+    createPostgresAebDurableConsumptionStore: typeof createPostgresAebDurableConsumptionStore;
+};
+export default _default;
+//# sourceMappingURL=aeb-consumption-store.d.ts.map

package/dist/aeb-consumption-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aeb-consumption-store.d.ts","sourceRoot":"","sources":["../src/aeb-consumption-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,0BAA0B,EAE3B,MAAM,8CAA8C,CAAC;AAEtD,eAAO,MAAM,gCAAgC,kCAAkC,CAAC;AAChF,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAC/E,eAAO,MAAM,4BAA4B,qCAAqC,CAAC;AAC/E,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAC/D,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,++VAwNwB,CAAC;AAEzD,wFAAwF;AACxF,eAAO,MAAM,mBAAmB;;;;;;;EAO9B,CAAC;AAEH,KAAK,WAAW,GAAG;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,WAAW,yCAAyC;IACxD,sEAAsE;IACtE,IAAI,CAAC,EAAE,oBAAoB,CAAC;IAC5B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,+EAA+E;IAC/E,sBAAsB,CAAC,EAAE,0BAA0B,CAAC;CACrD;AAED,MAAM,WAAW,6BAA6B;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,MAAM,0BAA0B,GAAG,CACvC,KAAK,EAAE,QAAQ,CAAC,6BAA6B,CAAC,KAC3C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,kCAAmC,SAAQ,0BAA0B;IACpF,sBAAsB,EAAE,IAAI,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD;;;;OAIG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAkDD;;;GAGG;AACH,wBAAgB,wCAAwC,CAAC,EACvD,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAqC,EACrC,sBAAsB,GACvB,GAAE,yCAA8C,GAAG,kCAAkC,CA+LrF;;;;;;;;;;;;;;;;;;AAED,wBASE"}