@emilia-protocol/gate 0.14.0 → 0.15.1

package/dist/aeb-consumption-store.js

@@ -0,0 +1,471 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * PostgreSQL custody for AEB operation consumption and native replay fences.
+ *
+ * A reservation installs the operation key and every native replay key in one
+ * pinned transaction. Logical conflicts roll the transaction back; database
+ * errors propagate so callers fail closed. Commit and release are fenced by an
+ * opaque per-reservation token retained only by the store instance that won.
+ */
+import crypto from 'node:crypto';
+export const AEB_PG_CONSUMPTION_STORE_VERSION = 'EP-GATE-AEB-PG-CONSUMPTION-v1';
+export const AEB_CONSUMPTION_OPERATION_TABLE = 'ep_aeb_consumption_operations';
+export const AEB_CONSUMPTION_REPLAY_TABLE = 'ep_aeb_consumption_replay_fences';
+export const AEB_CONSUMPTION_EXECUTOR_ROLE = 'ep_aeb_executor';
+export const AEB_CONSUMPTION_RECOVERY_ROLE = 'ep_aeb_recovery';
+export const AEB_CONSUMPTION_OWNER_ROLE = 'ep_aeb_store_owner';
+/** Exact schema required by createPostgresAebDurableConsumptionStore(). */
+export const AEB_CONSUMPTION_DDL = `CREATE TABLE IF NOT EXISTS ${AEB_CONSUMPTION_OPERATION_TABLE} (
+  tenant_id        TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),
+  relying_party_id TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),
+  operation_key    TEXT NOT NULL CHECK (octet_length(operation_key) BETWEEN 1 AND 4096),
+  state            TEXT NOT NULL CHECK (state IN ('RESERVED', 'CONSUMED')),
+  owner_token      TEXT NULL CHECK (owner_token IS NULL OR octet_length(owner_token) BETWEEN 16 AND 512),
+  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+  consumed_at      TIMESTAMPTZ NULL,
+  PRIMARY KEY (tenant_id, relying_party_id, operation_key),
+  CHECK (
+    (state = 'RESERVED' AND owner_token IS NOT NULL AND consumed_at IS NULL)
+    OR (state = 'CONSUMED' AND owner_token IS NULL AND consumed_at IS NOT NULL)
+  )
+);
+CREATE TABLE IF NOT EXISTS ${AEB_CONSUMPTION_REPLAY_TABLE} (
+  tenant_id        TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),
+  relying_party_id TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),
+  replay_key       TEXT NOT NULL CHECK (octet_length(replay_key) BETWEEN 1 AND 4096),
+  operation_key    TEXT NOT NULL CHECK (octet_length(operation_key) BETWEEN 1 AND 4096),
+  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+  PRIMARY KEY (tenant_id, relying_party_id, replay_key),
+  FOREIGN KEY (tenant_id, relying_party_id, operation_key)
+    REFERENCES ${AEB_CONSUMPTION_OPERATION_TABLE} (tenant_id, relying_party_id, operation_key)
+    ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS ${AEB_CONSUMPTION_REPLAY_TABLE}_operation_idx
+  ON ${AEB_CONSUMPTION_REPLAY_TABLE} (tenant_id, relying_party_id, operation_key);
+DO $roles$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = '${AEB_CONSUMPTION_EXECUTOR_ROLE}') THEN
+    CREATE ROLE ${AEB_CONSUMPTION_EXECUTOR_ROLE} NOLOGIN
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = '${AEB_CONSUMPTION_RECOVERY_ROLE}') THEN
+    CREATE ROLE ${AEB_CONSUMPTION_RECOVERY_ROLE} NOLOGIN
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = '${AEB_CONSUMPTION_OWNER_ROLE}') THEN
+    CREATE ROLE ${AEB_CONSUMPTION_OWNER_ROLE} NOLOGIN
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+  END IF;
+END
+$roles$;
+GRANT ${AEB_CONSUMPTION_OWNER_ROLE} TO CURRENT_USER;
+CREATE SCHEMA IF NOT EXISTS ep_aeb_private;
+REVOKE ALL ON SCHEMA ep_aeb_private FROM PUBLIC, anon, authenticated, service_role;
+CREATE TABLE IF NOT EXISTS ep_aeb_private.tenant_principals (
+  principal_name NAME NOT NULL,
+  tenant_id TEXT NOT NULL CHECK (octet_length(tenant_id) BETWEEN 1 AND 512),
+  can_execute BOOLEAN NOT NULL DEFAULT FALSE,
+  can_recover BOOLEAN NOT NULL DEFAULT FALSE,
+  PRIMARY KEY (principal_name, tenant_id),
+  CHECK (can_execute OR can_recover)
+);
+ALTER SCHEMA ep_aeb_private OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER TABLE ep_aeb_private.tenant_principals OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER TABLE ${AEB_CONSUMPTION_OPERATION_TABLE} OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER TABLE ${AEB_CONSUMPTION_REPLAY_TABLE} OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER TABLE ep_aeb_private.tenant_principals ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ep_aeb_private.tenant_principals FORCE ROW LEVEL SECURITY;
+ALTER TABLE ${AEB_CONSUMPTION_OPERATION_TABLE} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ${AEB_CONSUMPTION_OPERATION_TABLE} FORCE ROW LEVEL SECURITY;
+ALTER TABLE ${AEB_CONSUMPTION_REPLAY_TABLE} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ${AEB_CONSUMPTION_REPLAY_TABLE} FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS ep_aeb_principals_owner_only ON ep_aeb_private.tenant_principals;
+CREATE POLICY ep_aeb_principals_owner_only ON ep_aeb_private.tenant_principals
+  TO ${AEB_CONSUMPTION_OWNER_ROLE} USING (TRUE) WITH CHECK (TRUE);
+DROP POLICY IF EXISTS ep_aeb_operations_owner_only ON ${AEB_CONSUMPTION_OPERATION_TABLE};
+CREATE POLICY ep_aeb_operations_owner_only ON ${AEB_CONSUMPTION_OPERATION_TABLE}
+  TO ${AEB_CONSUMPTION_OWNER_ROLE} USING (TRUE) WITH CHECK (TRUE);
+DROP POLICY IF EXISTS ep_aeb_replay_owner_only ON ${AEB_CONSUMPTION_REPLAY_TABLE};
+CREATE POLICY ep_aeb_replay_owner_only ON ${AEB_CONSUMPTION_REPLAY_TABLE}
+  TO ${AEB_CONSUMPTION_OWNER_ROLE} USING (TRUE) WITH CHECK (TRUE);
+REVOKE ALL ON ep_aeb_private.tenant_principals FROM PUBLIC, anon, authenticated, service_role,
+  ${AEB_CONSUMPTION_EXECUTOR_ROLE}, ${AEB_CONSUMPTION_RECOVERY_ROLE};
+REVOKE ALL ON ${AEB_CONSUMPTION_OPERATION_TABLE} FROM PUBLIC, anon, authenticated, service_role,
+  ${AEB_CONSUMPTION_EXECUTOR_ROLE}, ${AEB_CONSUMPTION_RECOVERY_ROLE};
+REVOKE ALL ON ${AEB_CONSUMPTION_REPLAY_TABLE} FROM PUBLIC, anon, authenticated, service_role,
+  ${AEB_CONSUMPTION_EXECUTOR_ROLE}, ${AEB_CONSUMPTION_RECOVERY_ROLE};
+CREATE OR REPLACE FUNCTION ep_aeb_private.assert_tenant_principal(
+  p_tenant_id TEXT, p_recovery BOOLEAN
+) RETURNS VOID
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = ''
+AS $fn$
+DECLARE v_role_ok BOOLEAN; v_binding_ok BOOLEAN;
+BEGIN
+  v_role_ok := CASE WHEN p_recovery
+    THEN pg_catalog.pg_has_role(SESSION_USER, '${AEB_CONSUMPTION_RECOVERY_ROLE}', 'MEMBER')
+    ELSE pg_catalog.pg_has_role(SESSION_USER, '${AEB_CONSUMPTION_EXECUTOR_ROLE}', 'MEMBER')
+  END;
+  SELECT EXISTS (
+    SELECT 1 FROM ep_aeb_private.tenant_principals AS principals
+    WHERE principals.principal_name = SESSION_USER
+      AND principals.tenant_id = p_tenant_id
+      AND CASE WHEN p_recovery THEN principals.can_recover ELSE principals.can_execute END
+  ) INTO v_binding_ok;
+  IF v_role_ok IS NOT TRUE OR v_binding_ok IS NOT TRUE THEN
+    RAISE EXCEPTION 'AEB_TENANT_PRINCIPAL_REFUSED' USING ERRCODE = '42501';
+  END IF;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.reserve_operation(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT
+) RETURNS TABLE(operation_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY INSERT INTO public.${AEB_CONSUMPTION_OPERATION_TABLE}
+    (tenant_id, relying_party_id, operation_key, state, owner_token)
+    VALUES (p_tenant_id, p_relying_party_id, p_operation_key, 'RESERVED', p_owner_token)
+    ON CONFLICT ON CONSTRAINT ep_aeb_consumption_operations_pkey DO NOTHING
+    RETURNING ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.has_replay_fence(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_replay_key TEXT
+) RETURNS TABLE(fenced BOOLEAN)
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY SELECT EXISTS (
+    SELECT 1
+    FROM public.${AEB_CONSUMPTION_REPLAY_TABLE} AS fences
+    WHERE fences.tenant_id = p_tenant_id
+      AND fences.relying_party_id = p_relying_party_id
+      AND fences.replay_key = p_replay_key
+  );
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.reserve_replay_keys(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_replay_keys TEXT[]
+) RETURNS TABLE(replay_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY INSERT INTO public.${AEB_CONSUMPTION_REPLAY_TABLE}
+    (tenant_id, relying_party_id, replay_key, operation_key)
+    SELECT p_tenant_id, p_relying_party_id, requested.replay_key, p_operation_key
+    FROM pg_catalog.unnest(p_replay_keys) AS requested(replay_key)
+    ORDER BY requested.replay_key
+    ON CONFLICT ON CONSTRAINT ep_aeb_consumption_replay_fences_pkey DO NOTHING
+    RETURNING ${AEB_CONSUMPTION_REPLAY_TABLE}.replay_key;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.commit_operation(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT
+) RETURNS TABLE(operation_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY UPDATE public.${AEB_CONSUMPTION_OPERATION_TABLE}
+    SET state = 'CONSUMED', owner_token = NULL, consumed_at = pg_catalog.transaction_timestamp()
+    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id
+      AND ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key = p_operation_key
+      AND state = 'RESERVED' AND owner_token = p_owner_token
+    RETURNING ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.claim_operation(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT
+) RETURNS TABLE(operation_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, TRUE);
+  RETURN QUERY UPDATE public.${AEB_CONSUMPTION_OPERATION_TABLE}
+    SET owner_token = p_owner_token
+    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id
+      AND ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key = p_operation_key
+      AND state = 'RESERVED'
+    RETURNING ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key;
+END
+$fn$;
+CREATE OR REPLACE FUNCTION ep_aeb_private.release_operation(
+  p_tenant_id TEXT, p_relying_party_id TEXT, p_operation_key TEXT, p_owner_token TEXT
+) RETURNS TABLE(operation_key TEXT)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+BEGIN
+  PERFORM ep_aeb_private.assert_tenant_principal(p_tenant_id, FALSE);
+  RETURN QUERY DELETE FROM public.${AEB_CONSUMPTION_OPERATION_TABLE}
+    WHERE tenant_id = p_tenant_id AND relying_party_id = p_relying_party_id
+      AND ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key = p_operation_key
+      AND state = 'RESERVED' AND owner_token = p_owner_token
+    RETURNING ${AEB_CONSUMPTION_OPERATION_TABLE}.operation_key;
+END
+$fn$;
+ALTER FUNCTION ep_aeb_private.assert_tenant_principal(TEXT, BOOLEAN)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.reserve_operation(TEXT, TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.has_replay_fence(TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.reserve_replay_keys(TEXT, TEXT, TEXT, TEXT[])
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.commit_operation(TEXT, TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.claim_operation(TEXT, TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+ALTER FUNCTION ep_aeb_private.release_operation(TEXT, TEXT, TEXT, TEXT)
+  OWNER TO ${AEB_CONSUMPTION_OWNER_ROLE};
+REVOKE ALL ON ALL FUNCTIONS IN SCHEMA ep_aeb_private
+  FROM PUBLIC, anon, authenticated, service_role;
+GRANT USAGE ON SCHEMA ep_aeb_private TO ${AEB_CONSUMPTION_EXECUTOR_ROLE}, ${AEB_CONSUMPTION_RECOVERY_ROLE};
+GRANT EXECUTE ON FUNCTION ep_aeb_private.has_replay_fence(TEXT, TEXT, TEXT),
+  ep_aeb_private.reserve_operation(TEXT, TEXT, TEXT, TEXT),
+  ep_aeb_private.reserve_replay_keys(TEXT, TEXT, TEXT, TEXT[]),
+  ep_aeb_private.commit_operation(TEXT, TEXT, TEXT, TEXT),
+  ep_aeb_private.release_operation(TEXT, TEXT, TEXT, TEXT)
+  TO ${AEB_CONSUMPTION_EXECUTOR_ROLE};
+GRANT EXECUTE ON FUNCTION ep_aeb_private.claim_operation(TEXT, TEXT, TEXT, TEXT)
+  TO ${AEB_CONSUMPTION_RECOVERY_ROLE};
+REVOKE ${AEB_CONSUMPTION_OWNER_ROLE} FROM CURRENT_USER;`;
+/** Exact statements issued by the store, exported for audit and deterministic fakes. */
+export const AEB_CONSUMPTION_SQL = Object.freeze({
+    hasReplayFence: `SELECT fenced FROM ep_aeb_private.has_replay_fence($1::text, $2::text, $3::text)`,
+    reserveOperation: `SELECT operation_key FROM ep_aeb_private.reserve_operation($1::text, $2::text, $3::text, $4::text)`,
+    reserveReplayKeys: `SELECT replay_key FROM ep_aeb_private.reserve_replay_keys($1::text, $2::text, $3::text, $4::text[])`,
+    commitOperation: `SELECT operation_key FROM ep_aeb_private.commit_operation($1::text, $2::text, $3::text, $4::text)`,
+    claimOperation: `SELECT operation_key FROM ep_aeb_private.claim_operation($1::text, $2::text, $3::text, $4::text)`,
+    releaseOperation: `SELECT operation_key FROM ep_aeb_private.release_operation($1::text, $2::text, $3::text, $4::text)`,
+});
+const BEGIN_WRITE = 'BEGIN ISOLATION LEVEL READ COMMITTED READ WRITE';
+const COMMIT = 'COMMIT';
+const ROLLBACK = 'ROLLBACK';
+class ReservationConflict extends Error {
+    result;
+    constructor(result) {
+        super(result);
+        this.result = result;
+    }
+}
+function defaultOwnerToken() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+function assertText(value, label, maximumBytes) {
+    if (typeof value !== 'string'
+        || Buffer.byteLength(value, 'utf8') < 1
+        || Buffer.byteLength(value, 'utf8') > maximumBytes
+        || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new TypeError(`AEB consumption ${label} is invalid`);
+    }
+}
+function assertOwnerToken(value) {
+    if (typeof value !== 'string'
+        || Buffer.byteLength(value, 'utf8') < 16
+        || Buffer.byteLength(value, 'utf8') > 512
+        || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new TypeError('AEB consumption ownerTokenFactory must return an opaque string of 16 to 512 bytes');
+    }
+}
+function exactRowCount(result, operation) {
+    if (!result
+        || !Number.isSafeInteger(result.rowCount)
+        || result.rowCount < 0) {
+        throw new Error(`${operation}: malformed PostgreSQL result`);
+    }
+    return result.rowCount;
+}
+/**
+ * Create the durable AEB store consumed by authorizeAebExecutionDurable().
+ * The pool must return a pinned node-postgres-style client for each transaction.
+ */
+export function createPostgresAebDurableConsumptionStore({ pool, recoveryPool, tenantId, relyingPartyId, ownerTokenFactory = defaultOwnerToken, authorizeRecoveryClaim, } = {}) {
+    if (!pool || typeof pool.connect !== 'function') {
+        throw new TypeError('createPostgresAebDurableConsumptionStore requires an ep_aeb_executor pg pool');
+    }
+    if (!recoveryPool || typeof recoveryPool.connect !== 'function' || recoveryPool === pool) {
+        throw new TypeError('AEB consumption requires a distinct ep_aeb_recovery pg pool');
+    }
+    assertText(tenantId, 'tenantId', 512);
+    assertText(relyingPartyId, 'relyingPartyId', 512);
+    if (typeof ownerTokenFactory !== 'function') {
+        throw new TypeError('AEB consumption ownerTokenFactory must be a function');
+    }
+    if (typeof authorizeRecoveryClaim !== 'function') {
+        throw new TypeError('AEB consumption requires an authorizeRecoveryClaim callback');
+    }
+    async function transaction(activePool, work) {
+        const client = await activePool.connect();
+        if (!client || typeof client.query !== 'function' || typeof client.release !== 'function') {
+            throw new TypeError('AEB consumption pg pool returned an invalid client');
+        }
+        let began = false;
+        try {
+            await client.query(BEGIN_WRITE);
+            began = true;
+            const result = await work(client);
+            await client.query(COMMIT);
+            began = false;
+            return result;
+        }
+        catch (error) {
+            if (began) {
+                try {
+                    await client.query(ROLLBACK);
+                }
+                catch (rollbackError) {
+                    throw new AggregateError([error, rollbackError], 'AEB consumption transaction and rollback both failed');
+                }
+            }
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+    const ownedReservations = new Map();
+    const store = {
+        durable: true,
+        ownershipFenced: true,
+        permanentConsumption: true,
+        atomicReplayFenced: true,
+        recoveryClaimSupported: true,
+        async hasReplayFence(replayKey) {
+            assertText(replayKey, 'native replay key', 4096);
+            const client = await pool.connect();
+            if (!client || typeof client.query !== 'function' || typeof client.release !== 'function') {
+                throw new TypeError('AEB consumption pg pool returned an invalid client');
+            }
+            try {
+                const result = await client.query(AEB_CONSUMPTION_SQL.hasReplayFence, [
+                    tenantId, relyingPartyId, replayKey,
+                ]);
+                const rows = exactRowCount(result, 'lookup replay fence');
+                const fenced = result.rows?.[0]?.fenced;
+                if (rows !== 1 || result.rows?.length !== 1 || typeof fenced !== 'boolean') {
+                    throw new Error('lookup replay fence: malformed PostgreSQL result');
+                }
+                return fenced;
+            }
+            finally {
+                client.release();
+            }
+        },
+        async reserve(key, replayKeys = []) {
+            assertText(key, 'operation key', 4096);
+            if (!Array.isArray(replayKeys)) {
+                throw new TypeError('AEB consumption replay keys must be an array');
+            }
+            for (const replayKey of replayKeys)
+                assertText(replayKey, 'native replay key', 4096);
+            // Stable lock acquisition order avoids crossed replay-key insert order
+            // becoming a preventable PostgreSQL deadlock under concurrency.
+            const uniqueReplayKeys = [...new Set(replayKeys)].sort();
+            const ownerToken = ownerTokenFactory();
+            assertOwnerToken(ownerToken);
+            try {
+                await transaction(pool, async (client) => {
+                    const operationRows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.reserveOperation, [
+                        tenantId, relyingPartyId, key, ownerToken,
+                    ]), 'reserve operation');
+                    if (operationRows === 0)
+                        throw new ReservationConflict('CONSUMPTION_CONFLICT');
+                    if (operationRows !== 1)
+                        throw new Error('reserve operation: unexpected PostgreSQL row count');
+                    const replayRows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.reserveReplayKeys, [
+                        tenantId, relyingPartyId, key, uniqueReplayKeys,
+                    ]), 'reserve native replay keys');
+                    if (replayRows !== uniqueReplayKeys.length) {
+                        throw new ReservationConflict('NATIVE_REPLAY_CONFLICT');
+                    }
+                });
+            }
+            catch (error) {
+                if (error instanceof ReservationConflict)
+                    return error.result;
+                throw error;
+            }
+            ownedReservations.set(key, ownerToken);
+            return 'RESERVED';
+        },
+        async claimReservation(key, authorization) {
+            assertText(key, 'operation key', 4096);
+            // Recovery is a restart boundary, not an in-place owner rotation. The
+            // base AEB store API fences ownership by store instance (commit/release
+            // take only the operation key), so replacing a token already owned by
+            // this instance would let its stale caller inherit the new token.
+            if (ownedReservations.has(key))
+                return false;
+            const claim = Object.freeze({
+                authorization,
+                tenantId,
+                relyingPartyId,
+                operationKey: key,
+                requiredState: 'RESERVED',
+            });
+            if (await authorizeRecoveryClaim(claim) !== true)
+                return false;
+            const ownerToken = ownerTokenFactory();
+            assertOwnerToken(ownerToken);
+            const changed = await transaction(recoveryPool, async (client) => {
+                const rows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.claimOperation, [
+                    tenantId, relyingPartyId, key, ownerToken,
+                ]), 'claim operation');
+                if (rows > 1)
+                    throw new Error('claim operation: unexpected PostgreSQL row count');
+                return rows === 1;
+            });
+            if (changed)
+                ownedReservations.set(key, ownerToken);
+            return changed;
+        },
+        async commit(key) {
+            assertText(key, 'operation key', 4096);
+            const ownerToken = ownedReservations.get(key);
+            if (ownerToken === undefined)
+                return false;
+            const changed = await transaction(pool, async (client) => {
+                const rows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.commitOperation, [
+                    tenantId, relyingPartyId, key, ownerToken,
+                ]), 'commit operation');
+                if (rows > 1)
+                    throw new Error('commit operation: unexpected PostgreSQL row count');
+                return rows === 1;
+            });
+            ownedReservations.delete(key);
+            return changed;
+        },
+        async release(key) {
+            assertText(key, 'operation key', 4096);
+            const ownerToken = ownedReservations.get(key);
+            if (ownerToken === undefined)
+                return false;
+            const changed = await transaction(pool, async (client) => {
+                const rows = exactRowCount(await client.query(AEB_CONSUMPTION_SQL.releaseOperation, [
+                    tenantId, relyingPartyId, key, ownerToken,
+                ]), 'release operation');
+                if (rows > 1)
+                    throw new Error('release operation: unexpected PostgreSQL row count');
+                return rows === 1;
+            });
+            ownedReservations.delete(key);
+            return changed;
+        },
+    };
+    return Object.freeze(store);
+}
+export default {
+    AEB_PG_CONSUMPTION_STORE_VERSION,
+    AEB_CONSUMPTION_OPERATION_TABLE,
+    AEB_CONSUMPTION_REPLAY_TABLE,
+    AEB_CONSUMPTION_EXECUTOR_ROLE,
+    AEB_CONSUMPTION_RECOVERY_ROLE,
+    AEB_CONSUMPTION_DDL,
+    AEB_CONSUMPTION_SQL,
+    createPostgresAebDurableConsumptionStore,
+};
+//# sourceMappingURL=aeb-consumption-store.js.map

package/dist/aeb-consumption-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aeb-consumption-store.js","sourceRoot":"","sources":["../src/aeb-consumption-store.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;GAOG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAMjC,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,+BAA+B,GAAG,+BAA+B,CAAC;AAC/E,MAAM,CAAC,MAAM,4BAA4B,GAAG,kCAAkC,CAAC;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,8BAA8B,+BAA+B;;;;;;;;;;;;;;6BAcnE,4BAA4B;;;;;;;;iBAQxC,+BAA+B;;;6BAGnB,4BAA4B;OAClD,4BAA4B;;;sEAGmC,6BAA6B;kBACjF,6BAA6B;;;sEAGuB,6BAA6B;kBACjF,6BAA6B;;;sEAGuB,0BAA0B;kBAC9E,0BAA0B;;;;;QAKpC,0BAA0B;;;;;;;;;;;uCAWK,0BAA0B;wDACT,0BAA0B;cACpE,+BAA+B,aAAa,0BAA0B;cACtE,4BAA4B,aAAa,0BAA0B;;;cAGnE,+BAA+B;cAC/B,+BAA+B;cAC/B,4BAA4B;cAC5B,4BAA4B;;;OAGnC,0BAA0B;wDACuB,+BAA+B;gDACvC,+BAA+B;OACxE,0BAA0B;oDACmB,4BAA4B;4CACpC,4BAA4B;OACjE,0BAA0B;;IAE7B,6BAA6B,KAAK,6BAA6B;gBACnD,+BAA+B;IAC3C,6BAA6B,KAAK,6BAA6B;gBACnD,4BAA4B;IACxC,6BAA6B,KAAK,6BAA6B;;;;;;;;;iDASlB,6BAA6B;iDAC7B,6BAA6B;;;;;;;;;;;;;;;;;;;;oCAoB1C,+BAA+B;;;;gBAInD,+BAA+B;;;;;;;;;;;;kBAY7B,4BAA4B;;;;;;;;;;;;;;oCAcV,4BAA4B;;;;;;gBAMhD,4BAA4B;;;;;;;;;;+BAUb,+BAA+B;;;YAGlD,+BAA+B;;gBAE3B,+BAA+B;;;;;;;;;;+BAUhB,+BAA+B;;;YAGlD,+BAA+B;;gBAE3B,+BAA+B;;;;;;;;;;oCAUX,+BAA+B;;YAEvD,+BAA+B;;gBAE3B,+BAA+B;;;;aAIlC,0BAA0B;;aAE1B,0BAA0B;;aAE1B,0BAA0B;;aAE1B,0BAA0B;;aAE1B,0BAA0B;;aAE1B,0BAA0B;;aAE1B,0BAA0B;;;0CAGG,6BAA6B,KAAK,6BAA6B;;;;;;OAMlG,6BAA6B;;OAE7B,6BAA6B;SAC3B,0BAA0B,qBAAqB,CAAC;AAEzD,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,cAAc,EAAE,kFAAkF;IAClG,gBAAgB,EAAE,oGAAoG;IACtH,iBAAiB,EAAE,qGAAqG;IACxH,eAAe,EAAE,mGAAmG;IACpH,cAAc,EAAE,kGAAkG;IAClH,gBAAgB,EAAE,oGAAoG;CACvH,CAAC,CAAC;AAyDH,MAAM,WAAW,GAAG,iDAAiD,CAAC;AACtE,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B,MAAM,mBAAoB,SAAQ,KAAK;IAC5B,MAAM,CAA4C;IAE3D,YAAY,MAAiD;QAC3D,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,iBAAiB;IACxB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CACjB,KAAc,EACd,KAAa,EACb,YAAoB;IAEpB,IAAI,OAAO,KAAK,KAAK,QAAQ;WACtB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;WACpC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY;WAC/C,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,mBAAmB,KAAK,aAAa,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;WACtB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;WACrC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG;WACtC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,mFAAmF,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,SAAiB;IAC3D,IAAI,CAAC,MAAM;WACJ,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;WACrC,MAAM,CAAC,QAAmB,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,+BAA+B,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,QAAkB,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CAAC,EACvD,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAiB,GAAG,iBAAiB,EACrC,sBAAsB,MACuB,EAAE;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,8EAA8E,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,CAAC,OAAO,KAAK,UAAU,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACzF,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACtC,UAAU,CAAC,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,sBAAsB,KAAK,UAAU,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,UAAgC,EAChC,IAAoD;QAEpD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC1F,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAChC,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3B,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,aAAa,EAAE,CAAC;oBACvB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,aAAa,CAAC,EACtB,sDAAsD,CACvD,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,MAAM,KAAK,GAAuC;QAChD,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,IAAI;QACrB,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,IAAI;QACxB,sBAAsB,EAAE,IAAI;QAE5B,KAAK,CAAC,cAAc,CAAC,SAAS;YAC5B,UAAU,CAAC,SAAS,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC1F,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,cAAc,EAAE;oBACpE,QAAQ,EAAE,cAAc,EAAE,SAAS;iBACpC,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;gBACxC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC3E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE;YAChC,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;YACtE,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,UAAU;gBAAE,UAAU,CAAC,SAAS,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;YACrF,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACvC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAE7B,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACvC,MAAM,aAAa,GAAG,aAAa,CACjC,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,EAAE;wBACvD,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU;qBAC1C,CAAC,EACF,mBAAmB,CACpB,CAAC;oBACF,IAAI,aAAa,KAAK,CAAC;wBAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;oBAC/E,IAAI,aAAa,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;oBAE/F,MAAM,UAAU,GAAG,aAAa,CAC9B,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,iBAAiB,EAAE;wBACxD,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,gBAAgB;qBAChD,CAAC,EACF,4BAA4B,CAC7B,CAAC;oBACF,IAAI,UAAU,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;wBAC3C,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;oBAC1D,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,mBAAmB;oBAAE,OAAO,KAAK,CAAC,MAAM,CAAC;gBAC9D,MAAM,KAAK,CAAC;YACd,CAAC;YAED,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACvC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa;YACvC,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACvC,sEAAsE;YACtE,wEAAwE;YACxE,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC1B,aAAa;gBACb,QAAQ;gBACR,cAAc;gBACd,YAAY,EAAE,GAAG;gBACjB,aAAa,EAAE,UAAmB;aACnC,CAAC,CAAC;YACH,IAAI,MAAM,sBAAsB,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAE/D,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACvC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBAC/D,MAAM,IAAI,GAAG,aAAa,CACxB,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,cAAc,EAAE;oBACrD,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU;iBAC1C,CAAC,EACF,iBAAiB,CAClB,CAAC;gBACF,IAAI,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBAClF,OAAO,IAAI,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACvD,MAAM,IAAI,GAAG,aAAa,CACxB,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,eAAe,EAAE;oBACtD,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU;iBAC1C,CAAC,EACF,kBAAkB,CACnB,CAAC;gBACF,IAAI,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACnF,OAAO,IAAI,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACvD,MAAM,IAAI,GAAG,aAAa,CACxB,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,EAAE;oBACvD,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU;iBAC1C,CAAC,EACF,mBAAmB,CACpB,CAAC;gBACF,IAAI,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACpF,OAAO,IAAI,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,eAAe;IACb,gCAAgC;IAChC,+BAA+B;IAC/B,4BAA4B;IAC5B,6BAA6B;IAC7B,6BAA6B;IAC7B,mBAAmB;IACnB,mBAAmB;IACnB,wCAAwC;CACzC,CAAC"}

package/dist/capability-receipt.d.ts

@@ -212,6 +212,11 @@ export declare function splitCapabilitySecret(secret: any, threshold: any, { ran
 }): string[];
 /** Reconstruct a capability secret from at least m unique shares. */
 export declare function reconstructCapabilitySecret(shares: any, threshold: any): Buffer<ArrayBuffer>;
+/**
+ * Production capability-store contract. Methods alone are insufficient: an
+ * adapter must explicitly assert durable custody and reconciliation support.
+ */
+export declare function isSecureCapabilityStore(store: any): boolean;
 /**
  * An in-memory atomic reference store. It is intentionally marked non-durable
  * and is suitable only for tests; production callers must use an implementation
@@ -219,6 +224,7 @@ export declare function reconstructCapabilitySecret(shares: any, threshold: any)
  */
 export declare function createMemoryCapabilityStore(): {
     durable: boolean;
+    reconciliationCapable: boolean;
     registerCapability(capabilityReceipt: any): boolean;
     reserveSpend({ capabilityId, capabilityFingerprint, operationId, actionDigest, amount, currency, now }: ReserveSpendOptions): Promise<{
         ok: boolean;
@@ -286,6 +292,7 @@ export declare function createPostgresCapabilityStore({ transaction }?: {
     transaction?: (callback: (query: Function) => any) => any;
 }): {
     durable: boolean;
+    reconciliationCapable: boolean;
     registerCapability(capabilityReceipt: any): Promise<any>;
     reserveSpend({ capabilityId, capabilityFingerprint, operationId, actionDigest, amount, currency, now }: ReserveSpendOptions): Promise<any>;
     commitSpend({ capabilityId, operationId, reservationToken, outcome, now }?: CommitSpendOptions): Promise<any>;
@@ -592,6 +599,7 @@ declare const _default: {
     reconstructCapabilitySecret: typeof reconstructCapabilitySecret;
     createMemoryCapabilityStore: typeof createMemoryCapabilityStore;
     createPostgresCapabilityStore: typeof createPostgresCapabilityStore;
+    isSecureCapabilityStore: typeof isSecureCapabilityStore;
     executeWithCapability: typeof executeWithCapability;
     executeWithThreshold: typeof executeWithThreshold;
     reconcileCapabilityOperation: typeof reconcileCapabilityOperation;

package/dist/capability-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-receipt.d.ts","sourceRoot":"","sources":["../src/capability-receipt.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,WAAW,EAKX,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAGrB,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AACrE,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,wBAAwB,0CAA0C,CAAC;AAChF,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAa5E,KAAK,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAC/C,KAAK,gBAAgB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAI7D,KAAK,mBAAmB,GAAG;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC/B,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC/B,CAAC;AACF,KAAK,qBAAqB,GAAG;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC/B,CAAC;AACF,KAAK,4BAA4B,GAAG;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,aAAa,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAC5C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC;IACrD,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC;IAC5C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AA8FF,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,MAAM,KAAA,UAE5C;AAsCD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,KAAA,EAAE,MAAM,KAAA,EAAE,WAAW,KAAA,EAAE,EAAE,WAAkB,EAAE,GAAE;IAAE,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqClJ;AAsCD,wBAAgB,2BAA2B,CAAC,OAAO,KAAA,UAElD;AAqGD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,KAAA,EAAE,EACjD,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,SAA0B,EAC1B,KAAK,EACL,eAAoB,EACpB,YAA2B,EAC3B,MAAgC,GACjC,GAAE;IACD,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCL;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,iBAAiB,KAAA,EAAE,EACzD,iBAAsB,EACtB,oBAA4B,GAC7B,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;EAmBvE;AAkDD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,KAAA,EAAE,SAAS,KAAA,EAAE,EAAE,aAA2B,EAAE;;CAAK,YAgB5F;AAaD,qEAAqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,KAAA,EAAE,SAAS,KAAA,uBAiB5D;AAaD;;;;GAIG;AACH,wBAAgB,2BAA2B;;;4GAmBkF,mBAAmB;;;;;;;;;;;;;gFAmBnC,kBAAkB;;;;;;;;;;;;;+FAaH,qBAAqB;;;;;;;;;;;;;EA2BhJ;AAED,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AACrE,eAAO,MAAM,oBAAoB,wpDA+BwF,CAAC;AAE1H,eAAO,MAAM,cAAc;;;;;;;;;EASzB,CAAC;AAEH;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,WAAW,EAAE,GAAE;IAAE,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,GAAG,KAAK,GAAG,CAAA;CAAO;;;4GAmBJ,mBAAmB;gFAsBnC,kBAAkB;+FAiBH,qBAAqB;EAgChJ;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,iBAAiB,EACjB,MAAM,EACN,MAAM,EACN,KAAK,EACL,aAAa,EACb,IAAW,EACX,QAAa,EACb,cAAqB,EACrB,iBAAsB,EACtB,iBAAwB,EACxB,WAAkB,EAClB,WAAkB,EAClB,GAAc,EACd,uBAA+B,GAChC,GAAE,4BAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FnC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,GAAE,4BAA4B,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAS9I;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,KAAK,EACL,YAAY,EACZ,WAAW,EACX,MAAM,EACN,QAAQ,EACR,cAAc,EACd,GAAc,GACf,GAAE;IACD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC1B;;;;;;;;;;;;;;GAyCL;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,SAA0B,EAC1B,KAAY,EACZ,UAAU,EACV,YAA2B,EAC3B,MAAgC,EAChC,KAAK,EACL,iBAAsB,EACtB,WAAkB,EAClB,GAAc,GACf,GAAE;IACD,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,wBAqBE"}
+{"version":3,"file":"capability-receipt.d.ts","sourceRoot":"","sources":["../src/capability-receipt.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,WAAW,EAKX,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAGrB,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AACrE,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,wBAAwB,0CAA0C,CAAC;AAChF,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAa5E,KAAK,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAC/C,KAAK,gBAAgB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAI7D,KAAK,mBAAmB,GAAG;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC/B,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC/B,CAAC;AACF,KAAK,qBAAqB,GAAG;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC/B,CAAC;AACF,KAAK,4BAA4B,GAAG;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,aAAa,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAC5C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC;IACrD,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC;IAC5C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AA8FF,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,MAAM,KAAA,UAE5C;AAsCD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,KAAA,EAAE,MAAM,KAAA,EAAE,WAAW,KAAA,EAAE,EAAE,WAAkB,EAAE,GAAE;IAAE,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqClJ;AAsCD,wBAAgB,2BAA2B,CAAC,OAAO,KAAA,UAElD;AAqGD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,KAAA,EAAE,EACjD,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,SAA0B,EAC1B,KAAK,EACL,eAAoB,EACpB,YAA2B,EAC3B,MAAgC,GACjC,GAAE;IACD,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCL;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,iBAAiB,KAAA,EAAE,EACzD,iBAAsB,EACtB,oBAA4B,GAC7B,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;EAmBvE;AAkDD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,KAAA,EAAE,SAAS,KAAA,EAAE,EAAE,aAA2B,EAAE;;CAAK,YAgB5F;AAaD,qEAAqE;AACrE,wBAAgB,2BAA2B,CAAC,MAAM,KAAA,EAAE,SAAS,KAAA,uBAiB5D;AAaD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,KAAA,WAQ5C;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B;;;;4GAoBkF,mBAAmB;;;;;;;;;;;;;gFAmBnC,kBAAkB;;;;;;;;;;;;;+FAaH,qBAAqB;;;;;;;;;;;;;EA2BhJ;AAED,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AACrE,eAAO,MAAM,oBAAoB,wpDA+BwF,CAAC;AAE1H,eAAO,MAAM,cAAc;;;;;;;;;EASzB,CAAC;AAEH;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,WAAW,EAAE,GAAE;IAAE,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,GAAG,KAAK,GAAG,CAAA;CAAO;;;;4GAoBJ,mBAAmB;gFAsBnC,kBAAkB;+FAiBH,qBAAqB;EAgChJ;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,iBAAiB,EACjB,MAAM,EACN,MAAM,EACN,KAAK,EACL,aAAa,EACb,IAAW,EACX,QAAa,EACb,cAAqB,EACrB,iBAAsB,EACtB,iBAAwB,EACxB,WAAkB,EAClB,WAAkB,EAClB,GAAc,EACd,uBAA+B,GAChC,GAAE,4BAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FnC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,GAAE,4BAA4B,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAS9I;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,KAAK,EACL,YAAY,EACZ,WAAW,EACX,MAAM,EACN,QAAQ,EACR,cAAc,EACd,GAAc,GACf,GAAE;IACD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC1B;;;;;;;;;;;;;;GAyCL;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,SAA0B,EAC1B,KAAY,EACZ,UAAU,EACV,YAA2B,EAC3B,MAAgC,EAChC,KAAK,EACL,iBAAsB,EACtB,WAAkB,EAClB,GAAc,GACf,GAAE;IACD,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,wBAsBE"}

package/dist/capability-receipt.js

@@ -537,6 +537,20 @@ function capabilityStateFromEnvelope(capabilityReceipt) {
         expires_at: Date.parse(c.expiry),
     };
 }
+/**
+ * Production capability-store contract. Methods alone are insufficient: an
+ * adapter must explicitly assert durable custody and reconciliation support.
+ */
+export function isSecureCapabilityStore(store) {
+    if (!store || typeof store !== 'object')
+        return false;
+    return store.durable === true
+        && store.reconciliationCapable === true
+        && typeof store.registerCapability === 'function'
+        && typeof store.reserveSpend === 'function'
+        && typeof store.commitSpend === 'function'
+        && typeof store.reconcileSpend === 'function';
+}
 /**
  * An in-memory atomic reference store. It is intentionally marked non-durable
  * and is suitable only for tests; production callers must use an implementation
@@ -547,6 +561,7 @@ export function createMemoryCapabilityStore() {
     const operations = new Map();
     return {
         durable: false,
+        reconciliationCapable: true,
         registerCapability(capabilityReceipt) {
             const verified = verifyCapabilityReceipt(capabilityReceipt, { allowUntrustedIssuer: true });
             if (!verified.ok)
@@ -693,6 +708,7 @@ export function createPostgresCapabilityStore({ transaction } = {}) {
         throw new TypeError('createPostgresCapabilityStore requires a transaction(callback) function');
     return {
         durable: true,
+        reconciliationCapable: true,
         async registerCapability(capabilityReceipt) {
             const verified = verifyCapabilityReceipt(capabilityReceipt, { allowUntrustedIssuer: true });
             if (!verified.ok)
@@ -1169,6 +1185,7 @@ export default {
     reconstructCapabilitySecret,
     createMemoryCapabilityStore,
     createPostgresCapabilityStore,
+    isSecureCapabilityStore,
     executeWithCapability,
     executeWithThreshold,
     reconcileCapabilityOperation,