@adcp/sdk 14.0.0-rc.37 → 14.0.0-rc.39

package/dist/lib/reporting/ledger/managed.mjs

@@ -0,0 +1,633 @@
+import { createHash, randomUUID } from "node:crypto";
+import { ReportingDeliveryCapabilitiesSchema, ReportingMaterializationSchema } from "../../types/schemas.generated.mjs";
+import { canonicalize } from "../../utils/jcs.mjs";
+import { getSchemaValidatorByRef } from "../../validation/schema-loader.mjs";
+import {
+  isReportingAdjustmentReceiptEvidence,
+  isReportingReceiptEvidence,
+  isReportingVerificationEvidence
+} from "../evidence.mjs";
+import { AdcpError } from "../../server/decisioning/async-outcome.mjs";
+import { createReportingDeliveryHandler, createReportingStatusHandler } from "./handler.mjs";
+const DEFAULT_LEASE_MILLISECONDS = 65e3;
+const DEFAULT_DELIVERY_DEADLINE_MILLISECONDS = 6e4;
+const MINIMUM_SETTLEMENT_GRACE_MILLISECONDS = 5e3;
+const DEFAULT_RESOURCE_MAX_BYTES = 64 * 1024 * 1024;
+const MAX_DESCRIPTOR_BYTES = 1024 * 1024;
+const MAX_NODE_TIMER_DELAY_MILLISECONDS = 2147483647;
+const NANOSECONDS_PER_MILLISECOND = 1000000n;
+const MAX_RECEIPTS_PER_ARRAY = 100;
+const MAX_RECEIPT_RESULTS = 100;
+const MAX_RECEIPT_EVIDENCE_BYTES = 64 * 1024;
+async function createReportingManagedDeliveryRuntime(options) {
+  if (!await options.store.probe(options.coreStore)) {
+    throw new Error("Managed reporting store is not operational for the configured Core authority");
+  }
+  if (typeof options.store.adoptAdvertisedPolicies !== "function") {
+    throw new Error(
+      "Managed Delivery capability publication requires atomic durable adoption of every advertised policy"
+    );
+  }
+  nonnegativeInteger(options.automatedRecoveryWindowSeconds, "automatedRecoveryWindowSeconds");
+  positiveInteger(options.statusRetentionDays, "statusRetentionDays");
+  positiveInteger(options.resourceRetentionDays, "resourceRetentionDays");
+  nonnegativeInteger(options.authorizationRevocationSeconds, "authorizationRevocationSeconds");
+  if (typeof options.adapter.deliver !== "function" || typeof options.adapter.read !== "function" || typeof options.adapter.revoke !== "function" || options.adapter.revocationFencesDeliveryGenerations !== true) {
+    throw new Error(
+      "Managed Delivery requires delivery, resource-reader, and provider generation-fencing revocation components"
+    );
+  }
+  assertManagedOfferings(options.offerings);
+  if (!options.offerings.length || !options.offerings.some((offering) => offering.method !== void 0)) {
+    throw new Error("Managed Delivery requires at least one atomic managed offering");
+  }
+  const reconciledOfferings = options.offerings.filter((offering) => offering.reconciliation_mode === "consumer_receipt");
+  if (!options.adapter.verificationProfiles.length) {
+    throw new Error("Managed Delivery requires an installed verification profile");
+  }
+  if (reconciledOfferings.length > 0 && (options.resolveConsumerId === void 0 || !options.adapter.verificationProfiles.includes("canonical_digest"))) {
+    throw new Error(
+      "Consumer-receipt offerings require an authenticated receipt handler and canonical-digest verifier"
+    );
+  }
+  const reconciledBilling = reconciledOfferings.length > 0;
+  for (const offering of reconciledOfferings) {
+    const profile = offering.reporting_profile;
+    if (!profile.canonicalization_id || !profile.canonicalization_uri || !profile.canonicalization_sha256) {
+      throw new Error("Reconciled Billing offerings require the pinned canonicalization contract");
+    }
+  }
+  const statusOptions = options.resolveConsumerId ? {
+    resolveConsumerId: options.resolveConsumerId,
+    ...options.consumerMismatchEscalation ? { consumerMismatchEscalation: options.consumerMismatchEscalation } : {}
+  } : void 0;
+  const getReportingStatus = createReportingStatusHandler(options.coreStore, statusOptions);
+  const getMediaBuyDelivery = createReportingDeliveryHandler(options.coreStore);
+  const syncReportingReceipts = reconciledBilling ? createSyncReportingReceiptsHandler(options.store, options.resolveConsumerId) : void 0;
+  const reportingDeliveryCapabilities = {
+    supported: true,
+    reliable_reporting_version: "1.0",
+    managed_delivery: true,
+    ...reconciledBilling ? { reconciled_billing: true, receipt_task: "sync_reporting_receipts" } : {},
+    configuration_task: "sync_accounts",
+    status_task: "get_reporting_status",
+    revision_content_task: "get_media_buy_delivery",
+    offerings: [...options.offerings],
+    automated_recovery_window_seconds: options.automatedRecoveryWindowSeconds,
+    status_retention_days: options.statusRetentionDays,
+    resource_retention_days: options.resourceRetentionDays,
+    authorization_revocation_seconds: options.authorizationRevocationSeconds
+  };
+  const parsedCapabilities = ReportingDeliveryCapabilitiesSchema.safeParse(reportingDeliveryCapabilities);
+  if (!parsedCapabilities.success) {
+    throw new Error(
+      `Managed Delivery capability wiring is invalid: ${parsedCapabilities.error.issues[0]?.message ?? "invalid"}`
+    );
+  }
+  const adoptedPolicy = await options.store.adoptAdvertisedPolicies({
+    automatedRecoveryWindowSeconds: options.automatedRecoveryWindowSeconds,
+    statusRetentionDays: options.statusRetentionDays,
+    resourceRetentionDays: options.resourceRetentionDays,
+    authorizationRevocationSeconds: options.authorizationRevocationSeconds
+  });
+  nonnegativeInteger(adoptedPolicy.automatedRecoveryWindowSeconds, "adopted automatedRecoveryWindowSeconds");
+  positiveInteger(adoptedPolicy.statusRetentionDays, "adopted statusRetentionDays");
+  positiveInteger(adoptedPolicy.resourceRetentionDays, "adopted resourceRetentionDays");
+  nonnegativeInteger(adoptedPolicy.authorizationRevocationSeconds, "adopted authorizationRevocationSeconds");
+  if (adoptedPolicy.automatedRecoveryWindowSeconds > options.automatedRecoveryWindowSeconds || adoptedPolicy.statusRetentionDays < options.statusRetentionDays || adoptedPolicy.resourceRetentionDays < options.resourceRetentionDays || adoptedPolicy.authorizationRevocationSeconds > options.authorizationRevocationSeconds) {
+    throw new Error("Managed Delivery policy adoption returned values weaker than the capability being published");
+  }
+  return {
+    reportingDeliveryCapabilities,
+    getReportingStatus,
+    getMediaBuyDelivery,
+    ...syncReportingReceipts ? { syncReportingReceipts } : {},
+    runWorker: (workerOptions) => runManagedDeliveryWorker(options.store, options.adapter, {
+      ...workerOptions,
+      minimumResourceRetentionDays: Math.max(
+        options.resourceRetentionDays,
+        adoptedPolicy.resourceRetentionDays,
+        workerOptions?.minimumResourceRetentionDays ?? 0
+      ),
+      // The capability block is the promise; the worker is what keeps it.
+      // A caller may only tighten the advertised window, never widen it.
+      authorizationRevocationSeconds: Math.min(
+        options.authorizationRevocationSeconds,
+        adoptedPolicy.authorizationRevocationSeconds,
+        workerOptions?.authorizationRevocationSeconds ?? options.authorizationRevocationSeconds
+      )
+    }),
+    readResource: (input) => readManagedReportingResource(options.store, options.adapter, input)
+  };
+}
+function createSyncReportingReceiptsHandler(store, resolveConsumerId, now = () => /* @__PURE__ */ new Date()) {
+  return async (request, context) => {
+    const account_id = resolvedAccountId(context.account);
+    const consumer_id = await resolveConsumerId(context);
+    if (!consumer_id || consumer_id.length > 255) {
+      throw new TypeError("resolveConsumerId must return a durable authenticated principal of at most 255 characters");
+    }
+    if (request.receipts !== void 0 && !Array.isArray(request.receipts)) {
+      throw new AdcpError("VALIDATION_ERROR", { message: "sync_reporting_receipts receipts must be an array" });
+    }
+    if (request.adjustment_receipts !== void 0 && !Array.isArray(request.adjustment_receipts)) {
+      throw new AdcpError("VALIDATION_ERROR", {
+        message: "sync_reporting_receipts adjustment_receipts must be an array"
+      });
+    }
+    const revisionReceipts = request.receipts ?? [];
+    const adjustmentReceipts = request.adjustment_receipts ?? [];
+    if (!revisionReceipts.every(isRecord) || !adjustmentReceipts.every(isRecord)) {
+      throw new AdcpError("VALIDATION_ERROR", {
+        message: "sync_reporting_receipts entries must be objects"
+      });
+    }
+    if (revisionReceipts.length > MAX_RECEIPTS_PER_ARRAY || adjustmentReceipts.length > MAX_RECEIPTS_PER_ARRAY) {
+      throw new AdcpError("VALIDATION_ERROR", {
+        message: `sync_reporting_receipts accepts at most ${MAX_RECEIPTS_PER_ARRAY} receipts and ${MAX_RECEIPTS_PER_ARRAY} adjustment receipts per request`
+      });
+    }
+    if ([...revisionReceipts, ...adjustmentReceipts].some((receipt) => "received_at" in receipt)) {
+      throw new AdcpError("VALIDATION_ERROR", {
+        message: "sync_reporting_receipts receipts must not carry received_at; it is assigned by the server"
+      });
+    }
+    const entries = [
+      ...revisionReceipts.map((receipt) => ({ kind: "revision", receipt })),
+      ...adjustmentReceipts.map((receipt) => ({
+        kind: "adjustment",
+        receipt
+      }))
+    ];
+    if (entries.length > MAX_RECEIPT_RESULTS) {
+      throw new AdcpError("VALIDATION_ERROR", {
+        message: `sync_reporting_receipts can return at most ${MAX_RECEIPT_RESULTS} results, so a request may carry at most ${MAX_RECEIPT_RESULTS} receipts and adjustment receipts in total`
+      });
+    }
+    if (!entries.length) {
+      throw new AdcpError("VALIDATION_ERROR", {
+        message: "sync_reporting_receipts requires at least one receipt or adjustment receipt"
+      });
+    }
+    if (request.account && "account_id" in request.account && request.account.account_id !== account_id) {
+      return receiptBatchFailure(entries, "PERMISSION_DENIED", "Reporting receipt account is unavailable");
+    }
+    if (!/^[A-Za-z0-9_.:-]{16,255}$/.test(request.idempotency_key)) {
+      return receiptBatchFailure(entries, "VALIDATION_ERROR", "sync_reporting_receipts idempotency_key is invalid");
+    }
+    const submittedIds = entries.map(
+      (entry) => isRecord(entry.receipt) && typeof entry.receipt.reporting_receipt_id === "string" ? entry.receipt.reporting_receipt_id : ""
+    );
+    const duplicateSubmittedIds = new Set(
+      submittedIds.filter((value, index) => value !== "" && submittedIds.indexOf(value) !== index)
+    );
+    if (duplicateSubmittedIds.size) {
+      return receiptBatchFailure(
+        entries,
+        "VALIDATION_ERROR",
+        "sync_reporting_receipts receipt IDs must be unique across the batch"
+      );
+    }
+    const evidenceValid = entries.map(
+      (entry) => entry.kind === "revision" ? isReportingReceiptEvidence(entry.receipt) : isReportingAdjustmentReceiptEvidence(entry.receipt)
+    );
+    const oversized = entries.map(
+      (entry) => Buffer.byteLength(JSON.stringify(entry.receipt), "utf8") > MAX_RECEIPT_EVIDENCE_BYTES
+    );
+    const valid = entries.map((_, index) => evidenceValid[index] && !oversized[index]);
+    const validEntries = entries.filter((_, index) => valid[index]);
+    const request_fingerprint = sha256({ entries });
+    const stored = validEntries.length ? await store.syncReceiptBatch({
+      account_id,
+      consumer_id,
+      idempotency_key: request.idempotency_key,
+      request_fingerprint,
+      entries: validEntries,
+      received_at: now().toISOString()
+    }) : [];
+    let storedIndex = 0;
+    return {
+      status: "completed",
+      results: entries.map((entry, index) => {
+        if (valid[index]) return stored[storedIndex++];
+        const field = entry.kind === "revision" ? `receipts[${index}]` : `adjustment_receipts[${index - revisionReceipts.length}]`;
+        return oversized[index] ? receiptFailure(
+          reflectableReceiptId(entry.receipt.reporting_receipt_id, index),
+          "VALIDATION_ERROR",
+          "Reporting receipt evidence exceeds the 64 KiB limit",
+          {
+            field,
+            suggestion: `Reduce ${field} to 64 KiB or less and retry.`
+          }
+        ) : receiptFailure(
+          reflectableReceiptId(entry.receipt.reporting_receipt_id, index),
+          "VALIDATION_ERROR",
+          "Reporting receipt evidence is malformed",
+          {
+            field,
+            suggestion: `Correct ${field} to satisfy the reporting receipt evidence schema and retry.`
+          }
+        );
+      })
+    };
+  };
+}
+function receiptBatchFailure(entries, code, message) {
+  return {
+    status: "completed",
+    results: entries.map(
+      (entry, index) => receiptFailure(reflectableReceiptId(entry.receipt.reporting_receipt_id, index), code, message)
+    )
+  };
+}
+const RECEIPT_ID_PATTERN = /^[A-Za-z0-9_.:-]{16,255}$/;
+function reflectableReceiptId(value, index) {
+  return typeof value === "string" && RECEIPT_ID_PATTERN.test(value) ? value : `unidentified-reporting-receipt-${String(index).padStart(3, "0")}`;
+}
+function receiptFailure(reporting_receipt_id, code, message, metadata = {}) {
+  return {
+    result: "failed",
+    reporting_receipt_id,
+    errors: [{ code, message, recovery: "correctable", ...metadata }]
+  };
+}
+async function runManagedDeliveryWorker(store, adapter, options = {}) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const maxIterations = options.maxIterations ?? 25;
+  const leaseMilliseconds = options.leaseMilliseconds ?? DEFAULT_LEASE_MILLISECONDS;
+  const deadlineMilliseconds = options.deliveryDeadlineMilliseconds ?? DEFAULT_DELIVERY_DEADLINE_MILLISECONDS;
+  const resourceMaxBytes = options.resourceMaxBytes ?? DEFAULT_RESOURCE_MAX_BYTES;
+  const minimumResourceRetentionDays = options.minimumResourceRetentionDays ?? 1;
+  positiveInteger(maxIterations, "maxIterations");
+  positiveInteger(leaseMilliseconds, "leaseMilliseconds");
+  positiveInteger(deadlineMilliseconds, "deliveryDeadlineMilliseconds");
+  positiveInteger(resourceMaxBytes, "resourceMaxBytes");
+  positiveInteger(minimumResourceRetentionDays, "minimumResourceRetentionDays");
+  if (leaseMilliseconds < deadlineMilliseconds + MINIMUM_SETTLEMENT_GRACE_MILLISECONDS) {
+    throw new RangeError("leaseMilliseconds must include at least 5 seconds of post-delivery settlement grace");
+  }
+  if (options.authorizationRevocationSeconds !== void 0) {
+    nonnegativeInteger(options.authorizationRevocationSeconds, "authorizationRevocationSeconds");
+  }
+  const revocationWindow = options.authorizationRevocationSeconds === void 0 ? void 0 : options.authorizationRevocationSeconds * 1e3;
+  const revocationLeaseMilliseconds = revocationWindow === void 0 ? leaseMilliseconds : Math.min(leaseMilliseconds, deadlineMilliseconds + MINIMUM_SETTLEMENT_GRACE_MILLISECONDS);
+  const owner = `managed-reporting-${randomUUID()}`;
+  const exhausted = await store.failExhaustedMaterializations?.({
+    ...options.account_id ? { account_id: options.account_id } : {}
+  }) ?? 0;
+  const counts = {
+    exhausted,
+    planned: await store.planMaterializations({ ...options.account_id ? { account_id: options.account_id } : {} }),
+    claimed: 0,
+    delivered: 0,
+    failed: 0,
+    revocationsCompleted: 0,
+    revocationsOverdue: 0
+  };
+  for (let index = 0; index < maxIterations; index += 1) {
+    options.signal?.throwIfAborted();
+    const revocation = await store.claimRevocation({
+      owner,
+      now: now().toISOString(),
+      lease_milliseconds: revocationLeaseMilliseconds,
+      ...options.account_id ? { account_id: options.account_id } : {},
+      ...options.authorizationRevocationSeconds !== void 0 ? {
+        authorization_revocation_seconds: options.authorizationRevocationSeconds,
+        // A holder is only displaced after it has had a full attempt's
+        // worth of time, which recovers a crashed worker without letting
+        // live workers steal from each other on an already-late grant.
+        steal_after_milliseconds: deadlineMilliseconds + MINIMUM_SETTLEMENT_GRACE_MILLISECONDS
+      } : {}
+    });
+    if (!revocation) break;
+    const remaining = revocation.remaining_milliseconds ?? remainingRevocationMilliseconds(revocation, revocationWindow, now());
+    const overdue = revocation.overdue ?? (remaining !== void 0 && remaining <= 0);
+    if (overdue) counts.revocationsOverdue += 1;
+    const attemptDeadline = remaining !== void 0 && remaining > 0 ? Math.min(deadlineMilliseconds, remaining) : deadlineMilliseconds;
+    try {
+      await withinDeadline(
+        (signal) => adapter.revoke({ authorization: revocation.authorization }, { signal }),
+        attemptDeadline,
+        "Reporting revocation deadline elapsed",
+        options.signal
+      );
+      if (await store.completeRevocation({ lease: revocation, completed_at: now().toISOString() })) {
+        counts.revocationsCompleted += 1;
+      }
+    } catch {
+      await store.releaseRevocation({ lease: revocation });
+    }
+  }
+  for (let index = 0; index < maxIterations; index += 1) {
+    options.signal?.throwIfAborted();
+    const lease = await store.claimMaterialization({
+      owner,
+      now: now().toISOString(),
+      lease_milliseconds: leaseMilliseconds,
+      ...options.account_id ? { account_id: options.account_id } : {}
+    });
+    if (!lease) break;
+    counts.claimed += 1;
+    try {
+      const outcome = await withinDeadline(
+        (signal) => adapter.deliver(
+          {
+            materialization: lease.materialization,
+            binding: lease.binding,
+            obligation: lease.obligation,
+            revision: lease.revision,
+            maxBytes: resourceMaxBytes
+          },
+          { signal }
+        ),
+        deadlineMilliseconds,
+        "Reporting delivery deadline elapsed",
+        options.signal
+      );
+      assertMaterializationOutcome(lease, outcome, now().toISOString(), minimumResourceRetentionDays);
+      if (await store.settleMaterialization({
+        lease,
+        now: now().toISOString(),
+        outcome,
+        minimum_resource_retention_days: Math.max(
+          lease.binding.resource_retention_days,
+          minimumResourceRetentionDays
+        )
+      }))
+        counts.delivered += 1;
+      else counts.failed += 1;
+    } catch {
+      await store.settleMaterialization({
+        lease,
+        now: now().toISOString(),
+        outcome: { status: "failed", failure_code: "DELIVERY_FAILED" }
+      });
+      counts.failed += 1;
+    }
+  }
+  return counts;
+}
+function remainingRevocationMilliseconds(revocation, revocationWindow, now) {
+  if (revocationWindow === void 0) return void 0;
+  const revokedAt = revocation.authorization.revoked_at;
+  if (!revokedAt) return void 0;
+  const revoked = Date.parse(revokedAt);
+  if (!Number.isFinite(revoked)) return void 0;
+  return revoked + revocationWindow - now.getTime();
+}
+async function readManagedReportingResource(store, adapter, input) {
+  const maxBytes = input.maxBytes ?? DEFAULT_RESOURCE_MAX_BYTES;
+  const deadlineMilliseconds = input.deadlineMilliseconds ?? DEFAULT_DELIVERY_DEADLINE_MILLISECONDS;
+  positiveInteger(maxBytes, "maxBytes");
+  positiveInteger(deadlineMilliseconds, "deadlineMilliseconds");
+  const selected = await store.getReadableResource(input);
+  const resource = selected?.materialization.resource;
+  if (!selected || !resource) return null;
+  const { binding, materialization } = selected;
+  const bytes = await withinDeadline(
+    // Adapter failure messages are provider strings: they vary by SDK version
+    // and can carry endpoint or credential detail. Callers get one stable
+    // sentence; the provider error stays reachable as `cause` for seller logs.
+    // `Promise.resolve().then` rather than calling and chaining `.catch`: an
+    // adapter that throws synchronously — a bad credential resolved eagerly,
+    // a client constructed inside `read` — never produced a promise to attach
+    // the handler to, so its raw provider message escaped this boundary.
+    (signal) => Promise.resolve().then(() => adapter.read({ materialization, binding, resource, maxBytes }, { signal })).catch((cause) => {
+      throw new Error("Managed reporting resource read failed", { cause });
+    }),
+    deadlineMilliseconds,
+    "Reporting resource read deadline elapsed",
+    input.signal
+  );
+  if (bytes.byteLength > maxBytes) throw new RangeError("Managed reporting resource exceeds maxBytes");
+  if (!await store.isAuthorizationCurrent({
+    account_id: input.account_id,
+    destination_ref: binding.destination_ref,
+    generation: binding.authorization_generation
+  })) {
+    return null;
+  }
+  return bytes;
+}
+function assertMaterializationOutcome(lease, outcome, now, minimumResourceRetentionDays = lease.binding.resource_retention_days) {
+  const parsed = ReportingMaterializationSchema.safeParse({
+    ...lease.materialization,
+    status: outcome.status,
+    ready_at: now,
+    resource: outcome.resource,
+    verification: outcome.verification
+  });
+  if (!parsed.success) {
+    throw new Error(`Managed materialization evidence is invalid: ${parsed.error.issues[0]?.message ?? "invalid"}`);
+  }
+  if (Buffer.byteLength(JSON.stringify(outcome), "utf8") > MAX_DESCRIPTOR_BYTES) {
+    throw new RangeError("Managed materialization descriptor exceeds 1 MiB");
+  }
+  if (outcome.verification.verification_profile !== lease.binding.verification_profile) {
+    throw new Error("Materialization verification profile differs from the installed binding");
+  }
+  if (outcome.verification.row_count !== lease.revision.binding.rowCount) {
+    throw new Error("Materialization verification row count differs from the Core revision");
+  }
+  if (!isReportingVerificationEvidence(outcome.verification)) {
+    throw new Error("Materialization is missing evidence required by its verification profile");
+  }
+  if (canonicalJson(outcome.verification.control_totals) !== canonicalJson(lease.revision.wireRevision.control_totals)) {
+    throw new Error("Materialization verification control totals differ from the Core revision");
+  }
+  if (lease.binding.feed_purpose === "billing" && lease.binding.verification_profile !== "canonical_digest") {
+    throw new Error("Billing materializations require canonical-digest verification");
+  }
+  if (lease.binding.method === "file_transfer" && outcome.resource.kind !== "manifest" || lease.binding.method === "dataset_share" && (outcome.resource.kind !== "dataset" || outcome.verification.verification_path !== "representative_consumer") || lease.binding.method === "warehouse_materialization" && (outcome.resource.kind !== "warehouse_relation" || outcome.verification.verification_path !== "destination")) {
+    throw new Error("Materialization resource or verification path differs from its delivery method");
+  }
+  if (lease.binding.method === "file_transfer" && !outcome.verification.physical_checksums?.length) {
+    throw new Error("File-transfer materializations require physical checksums");
+  }
+  if (outcome.resource.kind === "manifest" && (outcome.resource.manifest_version !== "1.0" || !outcome.resource.manifest_sha256)) {
+    throw new Error("Manifest resources require immutable version and digest metadata");
+  }
+  const native = outcome.verification.native_commit_evidence;
+  if (native !== void 0) {
+    if (native.native_version_ref !== outcome.resource.native_version_ref || native.observed_through !== outcome.verification.verification_path) {
+      throw new Error("Native commit evidence does not match the retained resource and verification path");
+    }
+  }
+  void minimumResourceRetentionDays;
+  if (outcome.verification.canonical_content_digest !== void 0) {
+    const expected = lease.revision.wireRevision.canonical_content_digest;
+    if (!expected || canonicalJson(outcome.verification.canonical_content_digest) !== canonicalJson(expected)) {
+      throw new Error("Canonical materialization evidence does not match the official Core revision");
+    }
+  }
+  if (outcome.resource.immutability === "native_version" && !outcome.resource.native_version_ref) {
+    throw new Error("Native-version materializations require an exact native_version_ref");
+  }
+  assertCredentialFreeReportingResourceLocationV1(outcome.resource.location);
+}
+function receiptEvidenceMatches(receipt, materialization) {
+  const verification = materialization.verification;
+  const resource = materialization.resource;
+  if (!verification || !resource || !isReportingReceiptEvidence(receipt)) return false;
+  return receipt.verification_profile === verification.verification_profile && receipt.observed_row_count === verification.row_count && canonicalJson(receipt.observed_control_totals) === canonicalJson(verification.control_totals) && canonicalJson(receipt.observed_canonical_content_digest) === canonicalJson(verification.canonical_content_digest) && (verification.verification_profile !== "manifest_checksums" || receipt.observed_manifest_sha256 === resource.manifest_sha256) && (verification.verification_profile !== "native_commit" || receipt.observed_native_version_ref === resource.native_version_ref);
+}
+function adjustmentReceiptEvidenceMatches(receipt, adjustment) {
+  return isReportingAdjustmentReceiptEvidence(receipt) && receipt.adjusts_reporting_revision_id === adjustment.adjusts_reporting_revision_id && receipt.observed_adjustment_sha256 === adjustment.wireAdjustment.canonical_adjustment_sha256;
+}
+function resolvedAccountId(account) {
+  if (!account || typeof account !== "object") throw new Error("Reporting receipts require a resolved account");
+  const value = account;
+  const id = typeof value.id === "string" ? value.id : typeof value.account_id === "string" ? value.account_id : "";
+  if (!id) throw new Error("Reporting receipts require a resolved account");
+  return id;
+}
+function sha256(value) {
+  return createHash("sha256").update(canonicalJson(value)).digest("hex");
+}
+function canonicalJson(value) {
+  return canonicalize(value === void 0 ? null : value);
+}
+function positiveInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be a positive safe integer`);
+}
+function nonnegativeInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${name} must be a non-negative safe integer`);
+}
+function assertManagedOfferings(offerings) {
+  const validateOffering = getSchemaValidatorByRef("core/reporting-delivery-offering.json");
+  if (!validateOffering) throw new Error("The installed AdCP bundle cannot validate reporting delivery offerings");
+  const ids = /* @__PURE__ */ new Set();
+  for (const offering of offerings) {
+    if (!validateOffering(offering)) {
+      throw new Error("Managed Delivery offering does not satisfy the complete installed RC3 schema");
+    }
+    if (ids.has(offering.offering_id)) throw new Error("Managed Delivery offering_id values must be unique");
+    ids.add(offering.offering_id);
+    const method = offering.method;
+    if (method !== void 0) {
+      if (!isRecord(method)) throw new Error("Managed Delivery offering method is invalid");
+      const pattern = method.pattern;
+      if (!["file_transfer", "dataset_share", "warehouse_materialization"].includes(String(pattern)) || typeof method.transport !== "string" || !["producer_managed", "consumer_managed"].includes(String(method.orchestration)) || !Array.isArray(method.destination_modes) || method.destination_modes.length === 0 || !isRecord(method.provider) || typeof method.provider.domain !== "string" || pattern === "file_transfer" && typeof method.format !== "string" || pattern === "dataset_share" && typeof method.access_mode !== "string") {
+        throw new Error("Managed Delivery offering method omits RC3-required delivery fields");
+      }
+    }
+    if (offering.feed_purpose === "billing" && offering.reconciliation_mode !== "consumer_receipt") {
+      throw new Error("Billing offerings require consumer-receipt reconciliation");
+    }
+    const profile = offering.reporting_profile;
+    if (offering.reconciliation_mode === "consumer_receipt") {
+      if (method === void 0 || profile.canonicalization_contract_version !== "1.0" || profile.canonicalization_media_type !== "application/vnd.adcp.reporting-canonicalization+json" || !profile.canonicalization_id || !profile.canonicalization_uri || !profile.canonicalization_sha256) {
+        throw new Error("Reconciled Billing offerings require the complete pinned RC3 canonicalization contract");
+      }
+    }
+  }
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function assertCredentialFreeReportingResourceLocationV1(location) {
+  const refuse = () => {
+    throw new Error("Managed reporting resource locations must not contain credentials");
+  };
+  if (/\r|\n|-----BEGIN|\bbearer\s|(?:token|password|secret|signature)=/i.test(location)) refuse();
+  if (/[?#]/.test(location)) refuse();
+  if (hasColonSeparatedUserinfo(location)) refuse();
+  try {
+    const parsed = new URL(location);
+    if (parsed.password || parsed.search || parsed.hash) refuse();
+    if (parsed.username && (parsed.protocol === "http:" || parsed.protocol === "https:")) refuse();
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("must not contain credentials")) throw error;
+  }
+}
+function hasColonSeparatedUserinfo(location) {
+  let scanningCandidate = true;
+  let sawColon = false;
+  let previousWasSlash = false;
+  for (let index = 0; index < location.length; index += 1) {
+    const code = location.charCodeAt(index);
+    if (scanningCandidate) {
+      if (code === 64) {
+        if (sawColon) return true;
+        scanningCandidate = false;
+      } else if (code === 58) {
+        sawColon = true;
+      } else if (code === 47 || code === 63 || code === 35 || isLocationWhitespace(code)) {
+        scanningCandidate = false;
+      }
+    }
+    const startsAuthorityCandidate = code === 47 && previousWasSlash;
+    previousWasSlash = code === 47;
+    if (startsAuthorityCandidate) {
+      scanningCandidate = true;
+      sawColon = false;
+    }
+  }
+  return false;
+}
+function isLocationWhitespace(code) {
+  return code >= 9 && code <= 13 || code === 32 || code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288 || code === 65279;
+}
+async function withinDeadline(operation, milliseconds, message, outerSignal) {
+  outerSignal?.throwIfAborted();
+  const controller = new AbortController();
+  const signal = outerSignal ? AbortSignal.any([outerSignal, controller.signal]) : controller.signal;
+  let cancelTimer;
+  try {
+    return await Promise.race([
+      operation(signal),
+      new Promise((_resolve, reject) => {
+        cancelTimer = scheduleDeadline(milliseconds, () => {
+          const error = new Error(message);
+          controller.abort(error);
+          reject(error);
+        });
+      })
+    ]);
+  } finally {
+    cancelTimer?.();
+  }
+}
+function scheduleDeadline(milliseconds, onElapsed) {
+  const normalizedMilliseconds = Math.ceil(milliseconds);
+  if (milliseconds < 0 || !Number.isSafeInteger(normalizedMilliseconds)) {
+    throw new RangeError("Reporting deadline must be a finite non-negative safe number of milliseconds");
+  }
+  const expiresAt = process.hrtime.bigint() + BigInt(normalizedMilliseconds) * NANOSECONDS_PER_MILLISECOND;
+  let cancelled = false;
+  let timer;
+  const scheduleRemaining = () => {
+    if (cancelled) return;
+    const remainingNanoseconds = expiresAt - process.hrtime.bigint();
+    if (remainingNanoseconds <= 0n) {
+      onElapsed();
+      return;
+    }
+    const remainingMilliseconds = Number(
+      (remainingNanoseconds + NANOSECONDS_PER_MILLISECOND - 1n) / NANOSECONDS_PER_MILLISECOND
+    );
+    timer = setTimeout(scheduleRemaining, Math.min(remainingMilliseconds, MAX_NODE_TIMER_DELAY_MILLISECONDS));
+  };
+  scheduleRemaining();
+  return () => {
+    cancelled = true;
+    if (timer) clearTimeout(timer);
+  };
+}
+function reportingManagedDeliveryBindingV1(input) {
+  const created_at = input.created_at ?? (/* @__PURE__ */ new Date()).toISOString();
+  const { semantic_fingerprint: _predecessor, ...semantic } = input;
+  const semantic_fingerprint = sha256({ ...semantic, created_at: void 0 });
+  return { ...semantic, created_at, semantic_fingerprint };
+}
+export {
+  adjustmentReceiptEvidenceMatches,
+  assertCredentialFreeReportingResourceLocationV1,
+  assertMaterializationOutcome,
+  createReportingManagedDeliveryRuntime,
+  createSyncReportingReceiptsHandler,
+  readManagedReportingResource,
+  receiptEvidenceMatches,
+  reportingManagedDeliveryBindingV1,
+  runManagedDeliveryWorker
+};