@emilia-protocol/gate 0.9.4 → 0.10.0

package/settlement.js

@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Deterministic evidence-completeness decision for settlement workflows.
+ *
+ * This is not a payment rail and does not decide legal liability. It answers a
+ * narrower question: does a relying-party-pinned profile have every verified,
+ * digest-joined artifact it required before its own settlement system acts?
+ */
+import { canonicalize, hashCanonical } from './execution-binding.js';
+import {
+  NETWORK_WITNESS_EVENTS,
+  acceptNetworkWitnessStatement,
+  networkWitnessDigest,
+  validateTrustedNetworkWitnessAcceptance,
+} from './network-witness.js';
+
+export const SETTLEMENT_PROFILE_VERSION = 'EP-GATE-SETTLEMENT-PROFILE-v1';
+export const SETTLEMENT_RESULT_VERSION = 'EP-GATE-SETTLEMENT-RESULT-v1';
+export const SETTLEMENT_VERDICTS = Object.freeze([
+  'eligible',
+  'refuse_profile_invalid',
+  'refuse_authorization',
+  'refuse_execution',
+  'refuse_witness',
+  'refuse_outcome',
+  'refuse_coverage',
+  'refuse_binding',
+]);
+
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+
+function isPlainObject(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function exactKeys(value, allowed) {
+  return isPlainObject(value) && Object.keys(value).every((key) => allowed.has(key));
+}
+
+function string(value, max = 512) {
+  return typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+}
+
+function digest(value) {
+  return typeof value === 'string' && DIGEST_RE.test(value);
+}
+
+function canonicalSnapshot(value) {
+  return JSON.parse(canonicalize(value));
+}
+
+function validateProfile(profile) {
+  if (!exactKeys(profile, new Set([
+    '@version', 'profile_id', 'require_witness', 'require_outcome', 'require_coverage',
+    'required_witness_event', 'required_witness_id', 'required_capture_point_id',
+    'required_coverage_state', 'required_surface_id',
+  ]))) return 'profile_shape_invalid';
+  if (profile['@version'] !== SETTLEMENT_PROFILE_VERSION || !string(profile.profile_id)) return 'profile_identity_invalid';
+  for (const field of ['require_witness', 'require_outcome', 'require_coverage']) {
+    if (profile[field] !== true && profile[field] !== false) return `profile_${field}_invalid`;
+  }
+  if (profile.require_witness && (!string(profile.required_witness_event)
+      || !NETWORK_WITNESS_EVENTS.includes(profile.required_witness_event)
+      || !string(profile.required_witness_id) || !string(profile.required_capture_point_id))) {
+    return 'profile_witness_binding_invalid';
+  }
+  if (!profile.require_witness && (profile.required_witness_event !== undefined
+      || profile.required_witness_id !== undefined || profile.required_capture_point_id !== undefined)) {
+    return 'profile_witness_fields_forbidden';
+  }
+  if (profile.require_coverage && (profile.required_coverage_state !== 'gated'
+      || !string(profile.required_surface_id))) return 'profile_coverage_binding_invalid';
+  if (!profile.require_coverage && (profile.required_coverage_state !== undefined
+      || profile.required_surface_id !== undefined)) return 'profile_coverage_fields_forbidden';
+  try { canonicalize(profile); } catch { return 'profile_canonicalization_invalid'; }
+  return null;
+}
+
+export function settlementProfileDigest(profile) {
+  const invalid = validateProfile(profile);
+  if (invalid) throw new TypeError(invalid);
+  return `sha256:${hashCanonical(profile)}`;
+}
+
+function refused(verdict, reason, profileHash, checks, actionDigest = null) {
+  const body = {
+    '@version': SETTLEMENT_RESULT_VERSION,
+    verdict,
+    eligible: false,
+    reason,
+    profile_hash: profileHash,
+    action_digest: actionDigest,
+    checks,
+    limitations: [
+      'This result is evidence-completeness input to a relying party; it is not a legal settlement instruction or warranty.',
+      'A valid evidence bundle does not establish physical truth beyond the separately verified outcome source.',
+    ],
+  };
+  return Object.freeze({ ...body, result_hash: `sha256:${hashCanonical(body)}` });
+}
+
+async function invokeVerifier(verifier, artifact, context) {
+  if (typeof verifier !== 'function') return { accepted: false, reason: 'pinned_verifier_missing' };
+  try {
+    const result = await verifier(artifact, Object.freeze({ ...context }));
+    if (!isPlainObject(result)) return { accepted: false, reason: 'verifier_result_invalid' };
+    return canonicalSnapshot(result);
+  } catch {
+    return { accepted: false, reason: 'pinned_verifier_error' };
+  }
+}
+
+/**
+ * Evaluate a raw evidence bundle. Authorization, execution, outcome, and
+ * coverage are interpreted only by verifier functions pinned in code by the
+ * relying party; no artifact may select its own verifier.
+ */
+export async function evaluateSettlementEligibility(bundle = {}, options = {}) {
+  let profileInput;
+  let profileInputInvalid = false;
+  try { profileInput = canonicalSnapshot(options.profile); } catch { profileInputInvalid = true; }
+  let verifyAuthorization;
+  let verifyExecution;
+  let verifyOutcome;
+  let verifyCoverage;
+  let pinnedWitnesses;
+  let trustedWitnessAcceptance = null;
+  let hasTrustedWitnessAcceptance = false;
+  let witnessSequenceStore;
+  let allowEphemeralWitnessStore = false;
+  let witnessNow;
+  let witnessMaxAgeSec;
+  let maxFutureSkewSec;
+  try {
+    verifyAuthorization = options.verifyAuthorization;
+    verifyExecution = options.verifyExecution;
+    verifyOutcome = options.verifyOutcome;
+    verifyCoverage = options.verifyCoverage;
+    pinnedWitnesses = options.pinnedWitnesses === undefined
+      ? undefined
+      : canonicalSnapshot(options.pinnedWitnesses);
+    hasTrustedWitnessAcceptance = Object.hasOwn(options, 'trustedWitnessAcceptance');
+    if (hasTrustedWitnessAcceptance) {
+      trustedWitnessAcceptance = canonicalSnapshot(options.trustedWitnessAcceptance);
+    }
+    witnessSequenceStore = options.witnessSequenceStore;
+    allowEphemeralWitnessStore = options.allowEphemeralWitnessStore === true;
+    witnessNow = options.now;
+    witnessMaxAgeSec = options.witnessMaxAgeSec;
+    maxFutureSkewSec = options.maxFutureSkewSec;
+  } catch {
+    pinnedWitnesses = [];
+    hasTrustedWitnessAcceptance = true;
+    trustedWitnessAcceptance = null;
+  }
+  let profile;
+  let invalid;
+  if (profileInputInvalid) {
+    invalid = 'profile_hostile_input';
+    profile = null;
+  } else {
+    invalid = validateProfile(profileInput);
+    profile = profileInput;
+  }
+  const baseChecks = {
+    profile: !invalid,
+    authorization: false,
+    execution: false,
+    witness: profile?.require_witness === false,
+    outcome: profile?.require_outcome === false,
+    coverage: profile?.require_coverage === false,
+    digest_join: false,
+  };
+  if (invalid) return refused('refuse_profile_invalid', invalid, null, baseChecks);
+  const profileHash = settlementProfileDigest(profile);
+  let evidence;
+  try {
+    evidence = JSON.parse(canonicalize(bundle));
+  } catch {
+    return refused('refuse_binding', 'evidence_bundle_not_canonical_json', profileHash, baseChecks);
+  }
+  const actionDigest = evidence.action_digest;
+  if (!digest(actionDigest)) {
+    return refused('refuse_binding', 'action_digest_invalid', profileHash, baseChecks);
+  }
+  const context = { action_digest: actionDigest, profile_hash: profileHash };
+
+  const authorization = await invokeVerifier(verifyAuthorization, evidence.authorization, context);
+  if (authorization.accepted !== true || authorization.action_digest !== actionDigest
+      || !digest(authorization.decision_digest)) {
+    return refused('refuse_authorization', authorization.reason ?? 'authorization_not_verified', profileHash, baseChecks, actionDigest);
+  }
+  baseChecks.authorization = true;
+
+  const execution = await invokeVerifier(verifyExecution, evidence.execution, {
+    ...context,
+    authorization_digest: authorization.decision_digest,
+  });
+  if (execution.accepted !== true || execution.outcome !== 'executed'
+      || execution.action_digest !== actionDigest || !digest(execution.execution_digest)) {
+    return refused('refuse_execution', execution.reason ?? 'execution_not_verified', profileHash, baseChecks, actionDigest);
+  }
+  baseChecks.execution = true;
+  if (execution.authorization_digest !== authorization.decision_digest) {
+    return refused('refuse_binding', 'execution_authorization_digest_mismatch', profileHash, baseChecks, actionDigest);
+  }
+
+  let witness = null;
+  if (profile.require_witness) {
+    const witnessOptions = {
+      expectedActionDigest: actionDigest,
+      expectedEvent: profile.required_witness_event,
+      maxAgeSec: witnessMaxAgeSec,
+      maxFutureSkewSec,
+      now: witnessNow,
+      allowEphemeralStore: allowEphemeralWitnessStore,
+    };
+    if (hasTrustedWitnessAcceptance) {
+      let expectedStatementDigest;
+      try { expectedStatementDigest = networkWitnessDigest(evidence.witness); } catch {
+        return refused('refuse_witness', 'witness_statement_digest_invalid', profileHash, baseChecks, actionDigest);
+      }
+      witness = validateTrustedNetworkWitnessAcceptance(trustedWitnessAcceptance, {
+        ...witnessOptions,
+        expectedStatementDigest,
+      });
+    } else {
+      witness = await acceptNetworkWitnessStatement(evidence.witness, {
+        ...witnessOptions,
+        pinnedWitnesses,
+        sequenceStore: witnessSequenceStore,
+      });
+    }
+    if (!witness.accepted) {
+      return refused('refuse_witness', witness.reason ?? 'witness_not_verified', profileHash, baseChecks, actionDigest);
+    }
+    if (witness.witness_id !== profile.required_witness_id
+        || witness.capture_point_id !== profile.required_capture_point_id) {
+      return refused('refuse_binding', 'witness_capture_point_mismatch', profileHash, baseChecks, actionDigest);
+    }
+    baseChecks.witness = true;
+  }
+
+  let outcome = null;
+  if (profile.require_outcome) {
+    outcome = await invokeVerifier(verifyOutcome, evidence.outcome, {
+      ...context,
+      execution_digest: execution.execution_digest,
+    });
+    if (outcome.accepted !== true || outcome.within_tolerance !== true
+        || outcome.action_digest !== actionDigest || !digest(outcome.outcome_digest)
+        || outcome.execution_digest !== execution.execution_digest) {
+      return refused('refuse_outcome', outcome.reason ?? 'outcome_not_verified', profileHash, baseChecks, actionDigest);
+    }
+    baseChecks.outcome = true;
+  }
+
+  let coverage = null;
+  if (profile.require_coverage) {
+    coverage = await invokeVerifier(verifyCoverage, evidence.coverage, context);
+    if (coverage.accepted !== true || coverage.state !== profile.required_coverage_state
+        || coverage.surface_id !== profile.required_surface_id || !digest(coverage.report_hash)) {
+      return refused('refuse_coverage', coverage.reason ?? 'coverage_not_verified', profileHash, baseChecks, actionDigest);
+    }
+    baseChecks.coverage = true;
+  }
+
+  baseChecks.digest_join = true;
+  const body = {
+    '@version': SETTLEMENT_RESULT_VERSION,
+    verdict: 'eligible',
+    eligible: true,
+    reason: null,
+    profile_hash: profileHash,
+    action_digest: actionDigest,
+    evidence: {
+      authorization_digest: authorization.decision_digest,
+      execution_digest: execution.execution_digest,
+      ...(witness ? { witness_digest: witness.statement_digest } : {}),
+      ...(outcome ? { outcome_digest: outcome.outcome_digest } : {}),
+      ...(coverage ? { coverage_report_hash: coverage.report_hash, surface_id: coverage.surface_id } : {}),
+    },
+    checks: baseChecks,
+    limitations: [
+      'Eligible means the relying party\'s pinned evidence profile was satisfied; the relying party still owns pricing, legal effect, and payment execution.',
+      'The witness proves observation, not authorization or physical outcome; those are separate verified rows.',
+    ],
+  };
+  return Object.freeze({ ...body, result_hash: `sha256:${hashCanonical(body)}` });
+}
+
+export default {
+  SETTLEMENT_PROFILE_VERSION,
+  SETTLEMENT_RESULT_VERSION,
+  SETTLEMENT_VERDICTS,
+  settlementProfileDigest,
+  evaluateSettlementEligibility,
+};

package/store-postgres.js

@@ -53,6 +53,10 @@ CREATE INDEX IF NOT EXISTS ${CONSUMPTION_TABLE}_expires_idx
 /** The exact statements the backend issues — exported for transparency and so
  * a fake client can implement them without parsing SQL. */
 export const CONSUMPTION_SQL = {
+  health: `SELECT
+  to_regclass('public.${CONSUMPTION_TABLE}') IS NOT NULL AS table_ready,
+  CASE WHEN to_regclass('public.${CONSUMPTION_TABLE}') IS NULL THEN FALSE
+    ELSE has_table_privilege(current_user, to_regclass('public.${CONSUMPTION_TABLE}'), 'SELECT,INSERT,UPDATE,DELETE') END AS can_use`,
   /** $1 key, $2 state, $3 consumed_at ms, $4 expires_at ms|null. rowCount 1 = consumed, 0 = replay. */
   addIfAbsent: `INSERT INTO ${CONSUMPTION_TABLE} (consumption_key, state, consumed_at, expires_at) `
     + 'VALUES ($1, $2, $3, $4) ON CONFLICT (consumption_key) DO NOTHING',
@@ -101,6 +105,16 @@ export function createPostgresBackend({ query, now = Date.now } = {}) {
 
   return {
     durable: true,
+    async health() {
+      const res = await query(CONSUMPTION_SQL.health, []);
+      if (!res || res.rowCount !== 1 || !Array.isArray(res.rows) || res.rows.length !== 1) {
+        throw new Error('consumption health: malformed Postgres result');
+      }
+      return {
+        ok: res.rows[0].table_ready === true && res.rows[0].can_use === true,
+        version: PG_CONSUMPTION_VERSION,
+      };
+    },
     /** True iff THIS call inserted the row — the atomic consumed-vs-replay decision. */
     async addIfAbsent(key, value, opt) {
       const res = await query(CONSUMPTION_SQL.addIfAbsent, [key, value, nowMs(), expiryFor(opt)]);

package/store.js

@@ -4,8 +4,8 @@
  *
  * A receipt authorizes ONE action, once. The gate consumes a receipt's
  * identifier the first time it is used; any later presentation of the same
- * receipt is a replay and is refused. The default store is in-memory; fleets
- * use the ownership-fenced durable contract below.
+ * receipt is a replay and is refused. The in-memory store is an explicit
+ * test/demo opt-in; security-bearing gates use the durable contract below.
  */
 export class MemoryConsumptionStore {
   constructor() {
@@ -30,14 +30,14 @@ export class MemoryConsumptionStore {
     return true;
   }
 
-  /** Commit a reserved id after the action succeeds. */
+  /** Commit a reserved id after an external-effect attempt begins. */
   async commit(key) {
     this.reserved.delete(key);
     this.seen.add(key);
     return true;
   }
 
-  /** Release a reserved id after the action fails; approval stays retryable. */
+  /** Release only when the caller can prove the external effect never began. */
   async release(key) {
     this.reserved.delete(key);
     return true;
@@ -54,6 +54,17 @@ export class MemoryConsumptionStore {
 
 export const DURABLE_CONSUMPTION_VERSION = 'EP-GATE-DURABLE-CONSUMPTION-v2';
 
+/** Capability contract required by security-bearing Gate execution paths. */
+export function isSecureConsumptionStore(store) {
+  if (!store || typeof store !== 'object') return false;
+  return store.durable === true
+    && store.ownershipFenced === true
+    && store.permanentConsumption === true
+    && typeof store.consume === 'function'
+    && typeof store.reserve === 'function'
+    && typeof store.commit === 'function';
+}
+
 const COMMITTED_VALUE = 'committed:v2';
 const RESERVED_PREFIX = 'reserved:v2:';
 
@@ -121,6 +132,10 @@ export function createDurableConsumptionStore(backend, { ttlSeconds, reservation
     ownershipFenced: true,
     permanentConsumption: ttlSeconds === undefined || ttlSeconds === null,
     retentionSeconds: ttlSeconds ?? null,
+    async health() {
+      if (typeof backend.health !== 'function') return { ok: false, reason: 'backend_health_unavailable' };
+      return backend.health();
+    },
     async reserve(key) {
       const token = reservationTokenFactory();
       if (typeof token !== 'string' || token.length < 16) {
@@ -174,4 +189,10 @@ export function createMemoryBackend() {
   };
 }
 
-export default { MemoryConsumptionStore, createDurableConsumptionStore, createMemoryBackend, DURABLE_CONSUMPTION_VERSION };
+export default {
+  MemoryConsumptionStore,
+  createDurableConsumptionStore,
+  createMemoryBackend,
+  isSecureConsumptionStore,
+  DURABLE_CONSUMPTION_VERSION,
+};

package/strict-json.js

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: Apache-2.0
+// Duplicate-name and Unicode-scalar gate for signed nested JSON such as
+// WebAuthn clientDataJSON. JSON.parse remains the syntax gate.
+
+export const MAX_JSON_DEPTH = 64;
+
+export function strictJsonGate(raw) {
+  if (typeof raw !== 'string') return { ok: false, reason: 'JSON input must be text' };
+  try { JSON.parse(raw); } catch { return { ok: false, reason: 'invalid JSON syntax' }; }
+  let index = 0;
+  const stack = [];
+  let reason = null;
+  const escapes = { '"': '"', '\\': '\\', '/': '/', b: '\b', f: '\f', n: '\n', r: '\r', t: '\t' };
+
+  function readString() {
+    index += 1;
+    let output = '';
+    while (index < raw.length) {
+      const character = raw[index];
+      if (character === '"') { index += 1; return output; }
+      if (character !== '\\') { output += character; index += 1; continue; }
+      const escape = raw[index + 1];
+      if (escape !== 'u') {
+        output += escapes[escape] ?? '';
+        index += 2;
+        continue;
+      }
+      const first = Number.parseInt(raw.slice(index + 2, index + 6), 16);
+      index += 6;
+      if (first >= 0xd800 && first <= 0xdbff) {
+        if (raw[index] === '\\' && raw[index + 1] === 'u') {
+          const second = Number.parseInt(raw.slice(index + 2, index + 6), 16);
+          if (second >= 0xdc00 && second <= 0xdfff) {
+            output += String.fromCharCode(first, second);
+            index += 6;
+            continue;
+          }
+        }
+        reason = 'unpaired high surrogate escape';
+        return null;
+      }
+      if (first >= 0xdc00 && first <= 0xdfff) {
+        reason = 'unpaired low surrogate escape';
+        return null;
+      }
+      output += String.fromCharCode(first);
+    }
+    reason = 'unterminated string';
+    return null;
+  }
+
+  while (index < raw.length) {
+    const character = raw[index];
+    if (character === '{') {
+      stack.push({ object: true, keys: new Set(), expectsKey: true });
+      if (stack.length > MAX_JSON_DEPTH) return { ok: false, reason: `nesting depth exceeds ${MAX_JSON_DEPTH}` };
+      index += 1;
+    } else if (character === '[') {
+      stack.push({ object: false });
+      if (stack.length > MAX_JSON_DEPTH) return { ok: false, reason: `nesting depth exceeds ${MAX_JSON_DEPTH}` };
+      index += 1;
+    } else if (character === '}' || character === ']') {
+      stack.pop();
+      index += 1;
+    } else if (character === ',') {
+      const top = stack.at(-1);
+      if (top?.object) top.expectsKey = true;
+      index += 1;
+    } else if (character === '"') {
+      const top = stack.at(-1);
+      const isKey = Boolean(top?.object && top.expectsKey);
+      const value = readString();
+      if (reason) return { ok: false, reason };
+      if (isKey) {
+        if (top.keys.has(value)) return { ok: false, reason: 'duplicate object member name' };
+        top.keys.add(value);
+        top.expectsKey = false;
+      }
+    } else {
+      index += 1;
+    }
+  }
+  return { ok: true };
+}
+
+export default { strictJsonGate, MAX_JSON_DEPTH };

package/witness-postgres.js

@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Tenant-scoped Postgres sequence store for EP-GATE-NETWORK-WITNESS-v1.
+ *
+ * The migration owns synchronization and authorization. Runtime callers get
+ * EXECUTE on one SECURITY DEFINER function, not INSERT/UPDATE privileges on the
+ * checkpoint table. Database ambiguity is allowed to throw so the witness
+ * ingestion kernel can fail closed as `sequence_store_unavailable`.
+ */
+
+export const PG_WITNESS_SEQUENCE_VERSION = 'EP-GATE-PG-WITNESS-SEQUENCE-v1';
+export const WITNESS_CHECKPOINT_FUNCTION = 'emilia_gate_evidence.advance_network_witness_checkpoint';
+
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+const CLOSED_REASONS = new Set(['statement_replay', 'sequence_rollback', 'sequence_equivocation']);
+
+export const WITNESS_SEQUENCE_SQL = Object.freeze({
+  advance: `SELECT accepted, reason
+FROM ${WITNESS_CHECKPOINT_FUNCTION}($1, $2, $3::bytea, $4::bigint, $5)`,
+});
+
+function scopedId(value, label) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > 256
+      || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`${label} must be a non-empty control-free string of at most 256 characters`);
+  }
+  return value;
+}
+
+function streamBytes(value) {
+  if (typeof value !== 'string' || value.length > 513) {
+    throw new Error('witness streamId is invalid');
+  }
+  const parts = value.split('\0');
+  if (parts.length !== 2 || parts.some((part) => part.length === 0 || part.length > 256
+      || /[\u0000-\u001f\u007f]/.test(part))) {
+    throw new Error('witness streamId must contain one witness-id/capture-point separator');
+  }
+  return Buffer.from(value, 'utf8');
+}
+
+function definitiveRow(result) {
+  if (!result || result.rowCount !== 1 || !Array.isArray(result.rows)
+      || result.rows.length !== 1 || typeof result.rows[0]?.accepted !== 'boolean') {
+    throw new Error('witness checkpoint outcome is unproven');
+  }
+  const { accepted, reason } = result.rows[0];
+  if (accepted) {
+    if (reason !== null && reason !== undefined && reason !== '') {
+      throw new Error('accepted witness checkpoint carried a refusal reason');
+    }
+    return { accepted: true, reason: null };
+  }
+  if (!CLOSED_REASONS.has(reason)) {
+    throw new Error('witness checkpoint returned an unknown refusal reason');
+  }
+  return { accepted: false, reason };
+}
+
+/**
+ * Create the durable store expected by acceptNetworkWitnessStatement().
+ * `query` is a node-postgres style function such as pool.query.bind(pool).
+ */
+export function createPostgresWitnessSequenceStore({ query, tenantId, gateId } = {}) {
+  if (typeof query !== 'function') {
+    throw new Error('createPostgresWitnessSequenceStore: query must be an async pg-style function');
+  }
+  const tenant = scopedId(tenantId, 'tenantId');
+  const gate = scopedId(gateId, 'gateId');
+  return Object.freeze({
+    durable: true,
+    scope: Object.freeze({ tenantId: tenant, gateId: gate }),
+    async advance(streamId, sequence, statementDigest) {
+      if (!Number.isSafeInteger(sequence) || sequence < 0) {
+        throw new Error('witness sequence must be a non-negative safe integer');
+      }
+      if (typeof statementDigest !== 'string' || !DIGEST_RE.test(statementDigest)) {
+        throw new Error('witness statement digest is invalid');
+      }
+      const result = await query(WITNESS_SEQUENCE_SQL.advance, [
+        tenant,
+        gate,
+        streamBytes(streamId),
+        sequence,
+        statementDigest,
+      ]);
+      return definitiveRow(result);
+    },
+  });
+}
+
+export default {
+  PG_WITNESS_SEQUENCE_VERSION,
+  WITNESS_CHECKPOINT_FUNCTION,
+  WITNESS_SEQUENCE_SQL,
+  createPostgresWitnessSequenceStore,
+};