@adcp/sdk 14.0.0-rc.37 → 14.0.0-rc.39

package/dist/lib/reporting/ledger/lifecycle.mjs

@@ -1,95 +1,302 @@
 import { createHash } from "node:crypto";
 import { canonicalJsonV1 } from "../source/index.mjs";
+import { moreSevereReportingHealthV1, projectManagedDelivery } from "./handler.mjs";
+import { compareReportingInstants } from "./instant.mjs";
 import { projectReportingObligationHealthV1 } from "./health.mjs";
-async function reconcileReportingStatusLifecycleV1(input) {
+async function resolveLedgerAsOf(input, attempt) {
+  const resolved = await input.store.readLedgerInstant?.() ?? (input.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+  if (input.ledgerAsOf === void 0) return resolved;
+  if (input.store.readLedgerInstant) {
+    return attempt === 0 && compareReportingInstants(input.ledgerAsOf, resolved) <= 0 ? input.ledgerAsOf : resolved;
+  }
+  if (attempt === 0) return input.ledgerAsOf;
+  return compareReportingInstants(resolved, input.ledgerAsOf) > 0 ? resolved : input.ledgerAsOf;
+}
+async function reconcileEachIsolated(input, obligationIds) {
+  assertNotificationModesCompatible(input.store, input.subscribers);
+  for (const reporting_obligation_id of obligationIds) {
+    try {
+      await reconcileReportingStatusLifecycleV1({
+        store: input.store,
+        reporting_obligation_id,
+        // Selection needs one instant; each reconcile resolves its own so the
+        // watermark it writes is the cutoff it actually read at. The sweep's
+        // instant is handed down only as a fallback clock, for a store that
+        // has none of its own — pinning it would put the sweep's cutoff into
+        // every watermark, which is the skew problem over again.
+        ...input.pinnedLedgerAsOf !== void 0 ? { ledgerAsOf: input.pinnedLedgerAsOf } : {},
+        now: () => new Date(input.ledgerAsOf),
+        subscribers: input.subscribers
+      });
+    } catch {
+      await input.store.recordLifecycleFailure?.({ reporting_obligation_id }).catch(() => void 0);
+    }
+  }
+  return obligationIds.length;
+}
+const MAX_LIFECYCLE_CAS_ATTEMPTS = 3;
+function assertNotificationModesCompatible(store, subscribers) {
+  if (store.transactionalNotificationActivity === true && (subscribers?.length ?? 0) > 0) {
+    throw new Error("Transactional reporting notification activity and legacy subscribers are mutually exclusive");
+  }
+}
+async function retryLifecycle(input, attempt) {
+  if (attempt + 1 >= MAX_LIFECYCLE_CAS_ATTEMPTS) {
+    await input.store.recordLifecycleFailure?.({ reporting_obligation_id: input.reporting_obligation_id }).catch(() => void 0);
+    return null;
+  }
+  return reconcileReportingStatusLifecycleV1(input, attempt + 1);
+}
+async function reconcileReportingStatusLifecycleV1(input, attempt = 0) {
   const obligation = await input.store.getObligation(input.reporting_obligation_id);
   if (!obligation) throw new Error("Reporting obligation is unavailable");
+  const transactionalNotifications = input.store.transactionalNotificationActivity === true;
+  assertNotificationModesCompatible(input.store, input.subscribers);
+  let ledgerAsOf = await resolveLedgerAsOf(input, attempt);
   const revisions = await input.store.listRevisions(obligation.reporting_obligation_id);
-  const projection = projectReportingObligationHealthV1(
+  let projected = revisions;
+  const projectCore = (at) => projectReportingObligationHealthV1(
+    obligation,
+    projected,
+    at,
+    compareReportingInstants(obligation.period.end, at) <= 0
+  );
+  let coreProjection = projectCore(ledgerAsOf);
+  let composed = await composeManagedLifecycleProjection(
+    { store: input.store, ledgerAsOf },
     obligation,
-    revisions,
-    input.ledgerAsOf,
-    Date.parse(obligation.period.end) <= Date.parse(input.ledgerAsOf)
+    projected,
+    coreProjection
   );
+  const visibleRevisionIds = composed.visibleRevisionIds;
+  const scoped = visibleRevisionIds ? revisions.filter((value) => visibleRevisionIds.includes(value.reporting_revision_id)) : revisions;
+  if (composed.resolvedLedgerAsOf !== void 0 && compareReportingInstants(composed.resolvedLedgerAsOf, ledgerAsOf) !== 0 || scoped.length !== projected.length) {
+    ledgerAsOf = composed.resolvedLedgerAsOf ?? ledgerAsOf;
+    projected = scoped;
+    coreProjection = projectCore(ledgerAsOf);
+    composed = await composeManagedLifecycleProjection(
+      { store: input.store, ledgerAsOf },
+      obligation,
+      projected,
+      coreProjection
+    );
+  }
+  const projection = composed.projection;
   const transitions = await input.store.listTransitions(obligation.reporting_obligation_id);
-  for (const pending of transitions.filter((value) => !value.notifiedAt)) {
+  const pendingTransitions = transitions.filter((value) => !value.notifiedAt);
+  if (transactionalNotifications && pendingTransitions.length > 0) {
+    throw new Error(
+      "Drain or explicitly resolve legacy pending reporting transitions before enabling transactional notification activity"
+    );
+  }
+  for (const pending of pendingTransitions) {
+    if (pending.previousHealth === pending.health) {
+      await input.store.markTransitionNotified(pending.transitionId, ledgerAsOf);
+      continue;
+    }
     if (await notifyTransition(pending, obligation.account.account_id, input.subscribers)) {
-      await input.store.markTransitionNotified(pending.transitionId, input.ledgerAsOf);
+      await input.store.markTransitionNotified(pending.transitionId, ledgerAsOf);
     }
   }
   const latest = transitions.at(-1);
-  if (latest && Date.parse(input.ledgerAsOf) < Date.parse(latest.occurredAt)) return null;
+  if (latest && compareReportingInstants(ledgerAsOf, latest.occurredAt) < 0) return null;
   const previousHealth = latest?.health ?? "waiting";
+  const finality = observedFinality(projected);
+  const previousFinality = await resolveFinalityBaseline(
+    input.store,
+    obligation.reporting_obligation_id,
+    latest,
+    finality
+  );
   const nextIssueIds = new Set(projection.issues.map((issue) => issue.issueId));
-  const transition = previousHealth === projection.health ? void 0 : {
+  const transition = previousHealth === projection.health && previousFinality === finality ? void 0 : {
     transitionId: `rst_${createHash("sha256").update(
       canonicalJsonV1([
         obligation.reporting_obligation_id,
         previousHealth,
         projection.health,
+        previousFinality,
+        finality,
         [...nextIssueIds].sort(),
-        input.ledgerAsOf
+        ledgerAsOf
       ])
     ).digest("base64url").slice(0, 32)}`,
     reporting_obligation_id: obligation.reporting_obligation_id,
     previousHealth,
     health: projection.health,
+    previousFinality,
+    finality,
     issueIds: [...nextIssueIds].sort(),
-    occurredAt: input.ledgerAsOf
+    occurredAt: ledgerAsOf
   };
+  if (composed.obligatedConsumerRosterVersion !== void 0 && input.store.readObligatedConsumerRosterVersion) {
+    const current = await input.store.readObligatedConsumerRosterVersion({
+      reporting_obligation_id: obligation.reporting_obligation_id
+    });
+    if (current !== composed.obligatedConsumerRosterVersion) {
+      return retryLifecycle(input, attempt);
+    }
+  }
   const applied = await input.store.applyLifecycleProjection({
     reporting_obligation_id: obligation.reporting_obligation_id,
     expectedRevisionIds: revisions.map((value) => value.reporting_revision_id),
     expectedPreviousHealth: previousHealth,
+    expectedPreviousFinality: previousFinality,
     expectedObligationState: obligation.state,
     expectedAttemptCount: obligation.attemptCount,
     projectedIssues: projection.issues,
-    ledgerAsOf: input.ledgerAsOf,
-    ...transition ? { transition } : {}
+    ledgerAsOf,
+    ...transition ? { transition } : {},
+    ...composed.managedStateVersion !== void 0 ? {
+      expectedManagedStateVersion: composed.managedStateVersion,
+      processedManagedStateVersion: composed.managedStateVersion
+    } : {},
+    ...composed.obligatedConsumerRosterVersion !== void 0 ? {
+      processedObligatedConsumerRosterVersion: composed.obligatedConsumerRosterVersion,
+      // The re-check above is outside any transaction, so it leaves a
+      // window the store closes by fencing on the same value.
+      expectedObligatedConsumerRosterVersion: composed.obligatedConsumerRosterVersion
+    } : {}
   });
-  if (!applied.applied || !transition || !applied.transitionInserted) return null;
+  if (!applied.applied) return retryLifecycle(input, attempt);
+  if (!transition || !applied.transitionInserted) return null;
+  if (transactionalNotifications) return { ...transition, notifiedAt: ledgerAsOf };
+  if (transition.previousHealth === transition.health) {
+    await input.store.markTransitionNotified(transition.transitionId, ledgerAsOf);
+    return { ...transition, notifiedAt: ledgerAsOf };
+  }
   const notified = await notifyTransition(transition, obligation.account.account_id, input.subscribers);
-  if (notified) await input.store.markTransitionNotified(transition.transitionId, input.ledgerAsOf);
-  return notified ? { ...transition, notifiedAt: input.ledgerAsOf } : transition;
+  if (notified) await input.store.markTransitionNotified(transition.transitionId, ledgerAsOf);
+  return notified ? { ...transition, notifiedAt: ledgerAsOf } : transition;
+}
+const CONSUMER_SCOPED_RECEIPT_ISSUE_CODES = /* @__PURE__ */ new Set([
+  "RECEIPT_REQUIRED",
+  "RECEIPT_REJECTED",
+  "ADJUSTMENT_RECEIPT_REQUIRED",
+  "ADJUSTMENT_RECEIPT_REJECTED"
+]);
+async function composeManagedLifecycleProjection(input, obligation, revisions, coreProjection) {
+  if (!input.store.getManagedLifecycleProjection) return { projection: coreProjection };
+  const managed = await input.store.getManagedLifecycleProjection({
+    reporting_obligation_id: obligation.reporting_obligation_id,
+    ledgerAsOf: input.ledgerAsOf
+  });
+  if (!managed) return { projection: coreProjection };
+  const stored = await input.store.listAdjustments(obligation.reporting_obligation_id);
+  const visibleAdjustmentIds = managed.visibleAdjustmentIds;
+  const adjustments = visibleAdjustmentIds ? stored.filter((value) => visibleAdjustmentIds.includes(value.reporting_adjustment_id)) : stored.filter((value) => compareReportingInstants(value.createdAt, input.ledgerAsOf) <= 0);
+  const rosterAuthoritative = managed.obligatedConsumerRosterComplete === true && managed.receiptEvidenceComplete !== false;
+  const observed = rosterAuthoritative ? [] : managed.consumers;
+  const byConsumer = new Map(observed.map((value) => [value.consumer_id, value]));
+  for (const consumerId of managed.obligatedConsumerIds ?? []) {
+    if (!byConsumer.has(consumerId)) {
+      const submitted = managed.consumers.find((value) => value.consumer_id === consumerId);
+      byConsumer.set(consumerId, submitted ?? { consumer_id: consumerId, receipts: [], adjustmentReceipts: [] });
+    }
+  }
+  const consumers = [...byConsumer.values()];
+  if (!consumers.length || managed.binding.reconciliation_mode === "consumer_receipt" && !rosterAuthoritative) {
+    consumers.push({ receipts: [], adjustmentReceipts: [] });
+  }
+  let health = coreProjection.health;
+  let satisfied = coreProjection.satisfied;
+  let suppressedReceiptIssue = false;
+  const issues = new Map(coreProjection.issues.map((value) => [value.issueId, value]));
+  for (const consumer of consumers) {
+    const projected = projectManagedDelivery({
+      obligation,
+      binding: managed.binding,
+      revisions,
+      adjustments,
+      materializations: managed.materializations,
+      materializationHistory: managed.materializationHistory,
+      receipts: consumer.receipts,
+      adjustmentReceipts: consumer.adjustmentReceipts,
+      base: coreProjection,
+      ledgerAsOf: input.ledgerAsOf,
+      // Scoped to the consumer being projected. An acceptance A left behind
+      // must never settle the obligation for B, which would let a webhook go
+      // complete while B's own read still says action_required.
+      // The anonymous fail-safe consumer owns no acceptances. Matching every
+      // tombstone to it let one consumer's pruned acceptance satisfy the
+      // stand-in for "someone unknown may still owe a receipt", flipping an
+      // incomplete-roster obligation to complete while real consumers were
+      // still pending.
+      tombstonedAcceptedSubjects: consumer.consumer_id === void 0 ? [] : (managed.tombstonedAcceptedSubjects ?? []).filter((value) => value.consumerId === consumer.consumer_id),
+      tombstonedDeliveredRevisionIds: managed.tombstonedDeliveredRevisionIds
+    });
+    if (!projected) continue;
+    health = moreSevereReportingHealthV1(health, projected.projection.health);
+    satisfied = satisfied && projected.projection.satisfied;
+    for (const issue of projected.projection.issues) {
+      if (CONSUMER_SCOPED_RECEIPT_ISSUE_CODES.has(issue.code)) {
+        suppressedReceiptIssue = true;
+        continue;
+      }
+      issues.set(issue.issueId, issue);
+    }
+  }
+  if (suppressedReceiptIssue) {
+    const issueId = `reporting-issue.reconciliation-outstanding.${obligation.reporting_obligation_id}`;
+    issues.set(issueId, {
+      issueId,
+      reporting_obligation_id: obligation.reporting_obligation_id,
+      code: "RECEIPT_REQUIRED",
+      severity: "action_required",
+      responsibleParty: "buyer",
+      recommendedAction: "contact_buyer",
+      openedAt: obligation.expectedAt,
+      observedAt: input.ledgerAsOf
+    });
+  }
+  return {
+    projection: { ...coreProjection, health, satisfied, issues: [...issues.values()] },
+    ...managed.managedStateVersion !== void 0 ? { managedStateVersion: managed.managedStateVersion } : {},
+    ...managed.obligatedConsumerRosterVersion !== void 0 ? { obligatedConsumerRosterVersion: managed.obligatedConsumerRosterVersion } : {},
+    ...managed.resolvedLedgerAsOf !== void 0 ? { resolvedLedgerAsOf: managed.resolvedLedgerAsOf } : {},
+    ...managed.visibleRevisionIds !== void 0 ? { visibleRevisionIds: managed.visibleRevisionIds } : {}
+  };
+}
+async function resolveFinalityBaseline(store, reporting_obligation_id, latest, observed) {
+  if (!latest) return "none";
+  if (latest.finality) return latest.finality;
+  if (store.resolveTransitionFinalityBaseline) {
+    return store.resolveTransitionFinalityBaseline(reporting_obligation_id);
+  }
+  return observed;
+}
+function observedFinality(revisions) {
+  if (revisions.some((value) => value.finality === "official")) return "official";
+  return revisions.length > 0 ? "snapshot" : "none";
 }
 async function retryReportingStatusNotificationsV1(input) {
   const pending = await input.store.listPendingTransitions({
     ...input.account_id ? { account_id: input.account_id } : {},
     limit: input.limit ?? 100
   });
+  const ledgerAsOf = input.ledgerAsOf ?? await input.store.readLedgerInstant?.() ?? input.fallbackLedgerAsOf ?? (/* @__PURE__ */ new Date()).toISOString();
   const obligationIds = [...new Set(pending.map((value) => value.reporting_obligation_id))];
-  for (const reporting_obligation_id of obligationIds) {
-    await reconcileReportingStatusLifecycleV1({
-      store: input.store,
-      reporting_obligation_id,
-      ledgerAsOf: input.ledgerAsOf,
-      subscribers: input.subscribers
-    });
-  }
-  return obligationIds.length;
+  return reconcileEachIsolated({ ...input, ledgerAsOf, pinnedLedgerAsOf: input.ledgerAsOf }, obligationIds);
 }
 async function reconcileReportingStatusDeadlinesV1(input) {
   const limit = input.limit ?? 1e3;
   if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e3) throw new RangeError("limit must be 1..1000");
-  const asOf = Date.parse(input.ledgerAsOf);
-  if (!Number.isFinite(asOf)) throw new TypeError("ledgerAsOf must be an RFC 3339 instant");
+  const ledgerAsOf = input.ledgerAsOf ?? await input.store.readLedgerInstant?.() ?? input.fallbackLedgerAsOf ?? (/* @__PURE__ */ new Date()).toISOString();
+  if (!Number.isFinite(Date.parse(ledgerAsOf))) throw new TypeError("ledgerAsOf must be an RFC 3339 instant");
+  await input.store.refreshObligatedConsumerRosterVersions?.({
+    ...input.account_id ? { account_id: input.account_id } : {},
+    limit
+  });
   const due = (await input.store.listLifecycleDueObligations({
-    ledgerAsOf: input.ledgerAsOf,
+    ledgerAsOf,
     ...input.account_id ? { account_id: input.account_id } : {},
     limit
   })).map((value) => value.reporting_obligation_id);
-  for (const reporting_obligation_id of due) {
-    await reconcileReportingStatusLifecycleV1({
-      store: input.store,
-      reporting_obligation_id,
-      ledgerAsOf: input.ledgerAsOf,
-      subscribers: input.subscribers
-    });
-  }
-  return due.length;
+  return reconcileEachIsolated({ ...input, ledgerAsOf, pinnedLedgerAsOf: input.ledgerAsOf }, due);
 }
 async function notifyTransition(transition, accountId, configured) {
   const subscribers = (configured ?? []).filter((value) => value.account_id === accountId);
+  if (subscribers.length === 0) return true;
   if (subscribers.length > 64) throw new Error("Reporting status subscriber fanout exceeds 64");
   const results = await Promise.allSettled(
     subscribers.map(

package/dist/lib/reporting/ledger/managed-postgres.d.mts

@@ -0,0 +1,231 @@
+import type { ReportingMaterialization, SyncReportingReceiptsResponse } from '../../types/index.mjs';
+import type { ReportingPgPool } from './postgres.mjs';
+import type { ReportingManagedDeliveryBindingV1, ReportingLedgerStore } from './types.mjs';
+import { type ReportingDestinationAuthorizationV1, type ReportingDestinationRevocationLeaseV1, type ReportingManagedDeliveryLeaseV1, type ReportingManagedDeliveryAdvertisedPoliciesV1, type ReportingManagedDeliveryStore, type ReportingReceiptBatchInputV1 } from './managed.mjs';
+/**
+ * Additive migration owned by #2944. It intentionally does not alter the Core
+ * tables so the #2943 notification/activity bridge can evolve that schema
+ * independently. Apply after REPORTING_LEDGER_MIGRATION in the same schema.
+ */
+export declare const REPORTING_MANAGED_DELIVERY_MIGRATION: string;
+export interface PostgresReportingManagedDeliveryStoreOptions {
+    /**
+     * The `automated_recovery_window_seconds` this deployment advertises.
+     *
+     * The capability is agent-wide and immutable once published, while bindings
+     * arrive over time, so validating only at startup leaves the window open:
+     * an agent advertising 60s starts clean and a 900s binding installed an hour
+     * later silently makes the published promise false until the next restart.
+     * Set here, `installBinding` refuses any Core configuration whose recovery
+     * window exceeds the advertised bound, inside the same transaction that
+     * checks binding eligibility. `createReportingManagedDeliveryRuntime` adopts
+     * its own advertised value into the store at wiring time, so setting it
+     * explicitly is only needed when bindings are installed without a runtime.
+     */
+    advertisedRecoveryWindowSeconds?: number;
+    /**
+     * The `status_retention_days` this deployment advertises.
+     *
+     * Supply it together with `evidenceRetentionDays` so the store can refuse a
+     * retention shorter than a horizon you have already promised. Pruning
+     * evidence the capability document still says is queryable is a broken
+     * promise, not a capacity optimisation.
+     */
+    statusRetentionDays?: number;
+    /**
+     * Days of managed evidence an account is still accountable for.
+     *
+     * MAX_MATERIALIZATIONS_PER_ACCOUNT and MAX_RECEIPTS_PER_CONSUMER are
+     * lifetime counts. Left unbounded they are a one-way door: a long-lived
+     * account eventually reaches them and then stops planning materializations
+     * and refuses every receipt, permanently, with no operator-visible way back
+     * — evidence is immutable, so nothing ever frees capacity.
+     *
+     * Setting this makes the caps active-scope: only evidence recorded inside
+     * the window counts against them, and `pruneExpiredEvidence` can delete what
+     * falls outside it. Choose a value at least as long as the
+     * `status_retention_days` you advertise, since that is the period you
+     * promised the metadata stays queryable. Omit it to keep the previous
+     * lifetime accounting with no pruning.
+     */
+    evidenceRetentionDays?: number;
+}
+export declare class PostgresReportingManagedDeliveryStore implements ReportingManagedDeliveryStore {
+    private readonly pool;
+    private readonly evidenceRetentionDays;
+    private readonly statusRetentionDays;
+    private readonly pendingRecoveryWindowSeconds;
+    private policyRegistered;
+    /**
+     * Durably records the agent-wide advertised recovery window.
+     *
+     * Written to the database, not held in memory: the promise is agent-wide,
+     * so a second store instance — in this process or another replica — must be
+     * held to the same value, and `installBinding` must read it inside its own
+     * transaction rather than trusting whatever the local object happens to
+     * know. Multiple replicas monotonically retain the smallest registered
+     * maximum: a shorter recovery promise is stronger and can never be widened
+     * by a later runtime.
+     */
+    adoptAdvertisedRecoveryWindowSeconds(seconds: number): Promise<void>;
+    /**
+     * Durably records the advertised `status_retention_days`.
+     *
+     * Retention is enforced against the widest promise any runtime registered
+     * over this database, so a store configured with a short evidence retention
+     * cannot prune inside a horizon a differently configured runtime published.
+     */
+    adoptAdvertisedStatusRetentionDays(days: number): Promise<void>;
+    /** Registers the complete capability policy under one lock and transaction. */
+    adoptAdvertisedPolicies(policy: ReportingManagedDeliveryAdvertisedPoliciesV1): Promise<ReportingManagedDeliveryAdvertisedPoliciesV1>;
+    /**
+     * Flushes constructor-supplied promises into the durable registry.
+     *
+     * Called from every entry point that depends on them, so a store built with
+     * options behaves identically to one a runtime adopted into.
+     */
+    private ensurePolicyRegistered;
+    private upsertPolicy;
+    private upsertPolicies;
+    private validateRecoveryWindow;
+    private readPolicyRow;
+    private readPolicy;
+    constructor(pool: ReportingPgPool, options?: PostgresReportingManagedDeliveryStoreOptions);
+    /** SQL fragment scoping a count to the active retention window, if one is set. */
+    private activeScope;
+    /**
+     * Deletes managed evidence that has aged out of `evidenceRetentionDays`.
+     *
+     * Only ever removes evidence the deployment no longer promises: nothing
+     * inside the retention window, nothing still `pending` or leased, and no
+     * receipt batch inside its own replay retention. Immutable evidence stays
+     * immutable while it is retained — this frees capacity at the far end of the
+     * window rather than rewriting anything. Returns what it removed so a
+     * scheduler can page through with `limit`.
+     */
+    pruneExpiredEvidence(input: {
+        account_id: string;
+        limit?: number;
+    }): Promise<{
+        materializations: number;
+        receipts: number;
+        batches: number;
+    }>;
+    probe(coreStore: ReportingLedgerStore): Promise<boolean>;
+    listInstalledRecoveryWindowSeconds(): Promise<number[]>;
+    authorizeDestination(input: Omit<ReportingDestinationAuthorizationV1, 'revoked_at' | 'cleanup_completed_at'>): Promise<void>;
+    revokeDestination(input: {
+        account_id: string;
+        destination_ref: string;
+        generation: number;
+        revoked_at: string;
+    }): Promise<boolean>;
+    installBinding(binding: ReportingManagedDeliveryBindingV1): Promise<{
+        inserted: boolean;
+    }>;
+    planMaterializations(input?: {
+        account_id?: string;
+        limit?: number;
+    }): Promise<number>;
+    claimMaterialization(input: {
+        owner: string;
+        now: string;
+        lease_milliseconds: number;
+        account_id?: string;
+    }): Promise<ReportingManagedDeliveryLeaseV1 | null>;
+    /**
+     * Fails materializations that have used every delivery attempt.
+     *
+     * The claim predicate stops handing them out, so without this they would
+     * stay `pending` — invisible to the planner, which skips an obligation with
+     * any pending row, and so never retried or replanned.
+     */
+    failExhaustedMaterializations(input?: {
+        account_id?: string;
+        limit?: number;
+    }): Promise<number>;
+    settleMaterialization(input: {
+        lease: ReportingManagedDeliveryLeaseV1;
+        now: string;
+        /** Retention the database must see satisfied, not just the worker. */
+        minimum_resource_retention_days?: number;
+        outcome: {
+            status: 'available' | 'delivered';
+            resource: NonNullable<ReportingMaterialization['resource']>;
+            verification: NonNullable<ReportingMaterialization['verification']>;
+        } | {
+            status: 'failed';
+            failure_code: string;
+        };
+    }): Promise<boolean>;
+    claimRevocation(input: {
+        owner: string;
+        now: string;
+        lease_milliseconds: number;
+        account_id?: string;
+        authorization_revocation_seconds?: number;
+        steal_after_milliseconds?: number;
+    }): Promise<ReportingDestinationRevocationLeaseV1 | null>;
+    completeRevocation(input: {
+        lease: ReportingDestinationRevocationLeaseV1;
+        completed_at: string;
+    }): Promise<boolean>;
+    releaseRevocation(input: {
+        lease: ReportingDestinationRevocationLeaseV1;
+        backoff_milliseconds?: number;
+    }): Promise<boolean>;
+    getReadableResource(input: {
+        account_id: string;
+        resource_ref: string;
+    }): Promise<{
+        materialization: {
+            reporting_materialization_id: string;
+            reporting_revision_id: string;
+            reporting_obligation_id: string;
+            delivery_config_id: string;
+            delivery_config_version: number;
+            destination_ref: string;
+            feed_purpose: import("../../types/tools.generated.mjs").ReportingFeedPurpose;
+            method: "file_transfer" | "dataset_share" | "warehouse_materialization";
+            transport?: string;
+            attempt: number;
+            status: "pending" | "available" | "delivered" | "failed";
+            ready_at?: string;
+            failed_at?: string;
+            failure_code?: string;
+            resource?: import("../../types/index.mjs").ReportingResource;
+            verification?: import("../../types/index.mjs").ReportingVerification;
+            created_at: string;
+        };
+        binding: ReportingManagedDeliveryBindingV1;
+    } | null>;
+    isAuthorizationCurrent(input: {
+        account_id: string;
+        destination_ref: string;
+        generation: number;
+    }): Promise<boolean>;
+    syncReceiptBatch(input: ReportingReceiptBatchInputV1): Promise<SyncReportingReceiptsResponse['results']>;
+    /**
+     * Rebuilds a prior batch response from the compact replay record plus the
+     * append-only receipt rows, re-checking authorization exactly as the first
+     * call did so a revoked destination cannot be replayed back into disclosure.
+     */
+    /**
+     * Replays a prior batch response exactly.
+     *
+     * An exact same-key replay is side-effect free and returns the caller its own
+     * previously recorded verdict, so later revocation of the destination does
+     * not change it. Downgrading a replay to `failed` once authorization ended
+     * broke the protocol-wide rule that a replayed idempotency key returns the
+     * same response, and bought nothing: the body is the caller's own receipt
+     * echoed back with the verdict it already received, so a revoked caller
+     * learns nothing it did not already hold. Fail-closed still governs every
+     * path that *accepts* new evidence — `loadReceiptEvidence` joins
+     * `revoked_at IS NULL` — and nothing here reads another consumer's rows.
+     */
+    private replayReceiptBatch;
+    private recordReceipt;
+    private loadReceiptEvidence;
+    private transaction;
+    private query;
+}