@adcp/sdk 14.0.0-rc.37 → 14.0.0-rc.39

package/dist/lib/reporting/service/index.mjs

@@ -0,0 +1,787 @@
+import { scanArgsForCredentials } from "../../server/credential-policy.mjs";
+import { canonicalize } from "../../utils/jcs.mjs";
+import { redactCredentialPatterns } from "../../utils/redact-credential-patterns.mjs";
+import { ReportingDeliveryOfferingSchema } from "../../types/schemas.generated.mjs";
+import {
+  REPORTING_LEDGER_MIGRATION,
+  assertReportingConsumerMismatchEscalation,
+  reportingConsumerStatusCapabilityV1,
+  reportingEffectiveConsumerMismatchEscalationV1,
+  createReportingDeliveryHandler,
+  createReportingProducer,
+  createReportingStatusHandler,
+  createSyncReportingStatusHandler
+} from "../ledger/index.mjs";
+import {
+  ReportingCoverageConstituentIdentityV1Schema,
+  SOURCE_BATCH_MANIFEST_MAX_METRIC_AVAILABILITY_V1,
+  ReportingSourceOfferingV1Schema,
+  ReportingSourceScopeV1Schema,
+  reportingIsSourceLocalMidnightV1,
+  reportingScheduleOriginV1,
+  reportingUtcOffsetMinutesV1,
+  createInlineReportingSourceExecutor,
+  reportingIsoDurationMillisecondsV1,
+  reportingSourceCapabilitiesV1
+} from "../source/index.mjs";
+const ADAPTER_SCOPE_KEY = "_adcp_reporting_adapter";
+function createReliableReportingService(options) {
+  const adapterEntries = Object.entries(options.adapters);
+  if (adapterEntries.length === 0) throw new TypeError("Reliable reporting requires at least one adapter");
+  positiveInteger(options.automatedRecoveryWindowSeconds, "automatedRecoveryWindowSeconds");
+  const sources = /* @__PURE__ */ new Map();
+  const adapterOfferings = /* @__PURE__ */ new Map();
+  const offerings = /* @__PURE__ */ new Map();
+  const deliveryOfferings = [];
+  for (const [adapterId, adapter] of adapterEntries) {
+    if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(adapterId)) throw new TypeError("Reporting adapter IDs must be bounded IDs");
+    const sourceOffering = ReportingSourceOfferingV1Schema.parse(structuredClone(adapter.sourceOffering));
+    const deliveryOffering = ReportingDeliveryOfferingSchema.parse(
+      structuredClone(adapter.deliveryOffering)
+    );
+    if (offerings.has(sourceOffering.offeringId)) throw new TypeError("Reporting offering IDs must be unique");
+    if (adapter.fetchSlice === void 0 === (adapter.executor === void 0)) {
+      throw new TypeError("Each reporting adapter requires exactly one of fetchSlice or executor");
+    }
+    const source = adapter.executor ?? createInlineReportingSourceExecutor(adapter.fetchSlice, sourceOffering, {
+      ...adapter.inlineReplayRetention ? { replayRetention: adapter.inlineReplayRetention } : {}
+    });
+    const routed = source.capabilities.offerings.filter(
+      (candidate) => candidate.offeringId === sourceOffering.offeringId
+    );
+    if (routed.length !== 1) {
+      throw new TypeError("Reporting adapter executor must expose exactly one offering with its declared ID");
+    }
+    const routedOffering = routed[0];
+    if (canonicalize(routedOffering.contract) !== canonicalize(sourceOffering.contract)) {
+      throw new TypeError("Reporting adapter executor offering contract differs from its declared source offering");
+    }
+    validateDeliveryOffering(routedOffering, deliveryOffering);
+    sources.set(adapterId, source);
+    adapterOfferings.set(adapterId, routedOffering);
+    offerings.set(routedOffering.offeringId, routedOffering);
+    deliveryOfferings.push(deliveryOffering);
+  }
+  const routedSource = createRoutedSource(sources, offerings);
+  const producer = createReportingProducer({
+    store: options.store,
+    source: routedSource,
+    offerings: [...offerings.values()],
+    contact: options.contact,
+    ...options.subscribers ? { subscribers: options.subscribers } : {}
+  });
+  const hasConsumerStatus = options.resolveConsumerId !== void 0;
+  if (options.consumerMismatchEscalation && !hasConsumerStatus) {
+    throw new TypeError("consumerMismatchEscalation requires resolveConsumerId");
+  }
+  const effectiveConsumerMismatchEscalation = assertReportingConsumerMismatchEscalation(
+    reportingEffectiveConsumerMismatchEscalationV1(
+      options.consumerMismatchEscalation,
+      options.store,
+      "createReliableReportingService"
+    )
+  );
+  const advertisedConsumerMismatchEscalation = hasConsumerStatus ? effectiveConsumerMismatchEscalation : void 0;
+  if (hasConsumerStatus) assertConsumerStatusStore(options.store);
+  const retentionDays = options.statusRetentionDays;
+  positiveInteger(retentionDays, "statusRetentionDays");
+  const capabilities = deepFreeze({
+    supported: true,
+    reliable_reporting_version: "1.0",
+    configuration_task: "sync_accounts",
+    status_task: "get_reporting_status",
+    ...hasConsumerStatus ? { consumer_status_task: "sync_reporting_status" } : {},
+    revision_content_task: "get_media_buy_delivery",
+    offerings: deliveryOfferings,
+    automated_recovery_window_seconds: options.automatedRecoveryWindowSeconds,
+    status_retention_days: retentionDays,
+    ...advertisedConsumerMismatchEscalation ? reportingConsumerStatusCapabilityV1(advertisedConsumerMismatchEscalation) : {}
+  });
+  const getReportingStatus = options.resolveConsumerId ? createReportingStatusHandler(options.store, {
+    resolveConsumerId: options.resolveConsumerId,
+    ...effectiveConsumerMismatchEscalation ? { consumerMismatchEscalation: effectiveConsumerMismatchEscalation } : {}
+  }) : createReportingStatusHandler(options.store);
+  const getMediaBuyDelivery = createReportingDeliveryHandler(options.store);
+  const syncReportingStatus = options.resolveConsumerId ? createSyncReportingStatusHandler(options.store, {
+    resolveConsumerId: options.resolveConsumerId
+  }) : void 0;
+  const reportingPlatform = {
+    capabilities,
+    getReportingStatus: (request, context) => getReportingStatus(request, context),
+    getMediaBuyDelivery: (request, context) => getMediaBuyDelivery(request, context),
+    ...syncReportingStatus && {
+      syncReportingStatus: (request, context) => syncReportingStatus(request, context),
+      // Published so `createAdcpServerFromPlatform` can scope replay by the
+      // identity the receipt is actually recorded under, rather than by the
+      // caller's credential.
+      resolveConsumerId: options.resolveConsumerId
+    }
+  };
+  let schedulerAbort;
+  let schedulerPromise;
+  const service = {
+    setup: Object.freeze({
+      component: "reliable-reporting-core",
+      migrations: Object.freeze([REPORTING_LEDGER_MIGRATION]),
+      requiresIsolatedLedgerDatabaseAcknowledgement: true
+    }),
+    capabilities,
+    producer,
+    platform: reportingPlatform,
+    get running() {
+      return schedulerPromise !== void 0;
+    },
+    async installConfiguration(configuration, context) {
+      if (!context?.account?.id) throw new TypeError("Reporting configuration requires a framework-resolved account");
+      assertNoUntrustedLineageFields(configuration);
+      if (Object.prototype.hasOwnProperty.call(configuration.sourceSettings, "currency")) {
+        throw new TypeError("Reporting configuration must not supply trusted lineage field sourceSettings.currency");
+      }
+      const frozenInput = structuredClone(configuration);
+      const offering = offerings.get(configuration.offeringId);
+      if (!offering) throw new TypeError("Reporting configuration selected an unknown offering");
+      const deliveryOffering = deliveryOfferings.find((value) => value.offering_id === offering.offeringId);
+      validateConfigurationAgainstDeliveryOffering(
+        frozenInput,
+        deliveryOffering,
+        options.automatedRecoveryWindowSeconds
+      );
+      const [route, currency, coverage] = await Promise.all([
+        options.resolveSource(context.account, frozenInput),
+        options.resolveCurrency(context.account, frozenInput),
+        options.resolveCoverage(context.account, frozenInput)
+      ]);
+      if (!route || typeof route !== "object" || !route.sourceScope || typeof route.sourceScope !== "object") {
+        throw new TypeError("resolveSource must return an adapter, sourceScope, and sourceTimezone");
+      }
+      const source = sources.get(route.adapterId);
+      const adapterOffering = adapterOfferings.get(route.adapterId);
+      if (!source || !adapterOffering) throw new TypeError("resolveSource selected an unknown reporting adapter");
+      if (adapterOffering.offeringId !== offering.offeringId) {
+        throw new TypeError("Resolved reporting adapter does not provide the selected offering");
+      }
+      if (canonicalize(adapterOffering.contract) !== canonicalize(offering.contract)) {
+        throw new TypeError("Resolved reporting adapter contract differs from the selected offering");
+      }
+      const normalizedCurrency = trustedCurrency(currency);
+      const normalizedTimezone = trustedTimezone(route.sourceTimezone);
+      if (configuration.expectedCurrency !== void 0 && configuration.expectedCurrency !== normalizedCurrency) {
+        throw new TypeError("Trusted reporting currency conflicts with the configuration currency assertion");
+      }
+      if (configuration.expectedSourceTimezone !== void 0 && configuration.expectedSourceTimezone !== normalizedTimezone) {
+        throw new TypeError("Trusted reporting timezone conflicts with the configuration timezone assertion");
+      }
+      assertSupportedScheduleSemantics(frozenInput.schedule, deliveryOffering, normalizedTimezone);
+      const { constituents, mediaBuyIds } = trustedCoverage(coverage, frozenInput.requestedMetrics);
+      if (configuration.expectedMediaBuyIds !== void 0 && !sameIdMembers(configuration.expectedMediaBuyIds, mediaBuyIds)) {
+        throw new TypeError("Trusted reporting coverage conflicts with the configuration media-buy assertion");
+      }
+      if (Object.prototype.hasOwnProperty.call(route.sourceScope, ADAPTER_SCOPE_KEY)) {
+        throw new TypeError("Reporting sourceScope contains an SDK-reserved key");
+      }
+      const credentialPaths = scanArgsForCredentials(route.sourceScope);
+      if (credentialPaths.length > 0 || containsContextMetadata(route.sourceScope)) {
+        throw new TypeError("Reporting sourceScope must contain non-secret routing identifiers only");
+      }
+      const routedScope = ReportingSourceScopeV1Schema.parse({
+        ...structuredClone(route.sourceScope),
+        [ADAPTER_SCOPE_KEY]: route.adapterId
+      });
+      const predecessor = await predecessorGeneration(options.store, context.account.id, frozenInput);
+      const sourceScope = keylessPredecessorScope(predecessor, route.sourceScope, sources.size) ?? routedScope;
+      const scheduleIdentity = predecessor && predecessor.schedule.alignment === void 0 ? {} : {
+        periodDuration: deliveryOffering.schedule.period_duration,
+        deliverySlaDuration: deliveryOffering.schedule.delivery_sla,
+        alignment: deliveryOffering.schedule.alignment,
+        ...deliveryOffering.schedule.alignment === "utc" ? {} : { periodTimezone: normalizedTimezone }
+      };
+      const {
+        expectedCurrency: _currency,
+        expectedSourceTimezone: _timezone,
+        expectedMediaBuyIds: _mediaBuyIds,
+        sourceSettings,
+        ...ledgerInput
+      } = frozenInput;
+      void _currency;
+      void _timezone;
+      void _mediaBuyIds;
+      return producer.installConfiguration({
+        ...ledgerInput,
+        schedule: { ...ledgerInput.schedule, ...scheduleIdentity },
+        account: { account_id: context.account.id },
+        sourceScope,
+        sourceTimezone: normalizedTimezone,
+        sourceSettings: { ...sourceSettings, currency: normalizedCurrency },
+        contract: structuredClone(offering.contract),
+        constituents,
+        mediaBuyIds
+      });
+    },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    install(platform) {
+      if (typeof platform.accounts.upsert !== "function") {
+        throw new TypeError(
+          "Reliable reporting requires accounts.upsert so the advertised sync_accounts configuration task is installed"
+        );
+      }
+      if (platform.reporting && platform.reporting !== reportingPlatform) {
+        throw new TypeError("DecisioningPlatform already has a reporting lifecycle installed");
+      }
+      if (!platform.reporting) {
+        Object.defineProperty(platform, "reporting", {
+          value: reportingPlatform,
+          enumerable: true,
+          configurable: false,
+          writable: false
+        });
+      }
+      return platform;
+    },
+    async runCycle(cycle) {
+      const accountId = cycleAccountId(cycle);
+      const planningNow = cycle.now ?? /* @__PURE__ */ new Date();
+      cycle.signal?.throwIfAborted();
+      const planned = await producer.planObligations(planningNow.toISOString(), {
+        ...accountId !== void 0 ? { account_id: accountId } : {},
+        ...cycle.maxObligations !== void 0 ? { maxObligations: cycle.maxObligations } : {}
+      });
+      cycle.signal?.throwIfAborted();
+      const result = await producer.runWorker({
+        ...cycle.signal ? { signal: cycle.signal } : {},
+        ...cycle.now ? { now: () => cycle.now } : {},
+        ...accountId !== void 0 ? { account_id: accountId } : {},
+        ...cycle.maxWorkerIterations !== void 0 ? { maxIterations: cycle.maxWorkerIterations } : {},
+        ...cycle.retryDelayMilliseconds !== void 0 ? { retryDelayMilliseconds: cycle.retryDelayMilliseconds } : {},
+        ...cycle.executionDeadlineMilliseconds !== void 0 ? { executionDeadlineMilliseconds: cycle.executionDeadlineMilliseconds } : {},
+        ...cycle.settlementGraceMilliseconds !== void 0 ? { settlementGraceMilliseconds: cycle.settlementGraceMilliseconds } : {}
+      });
+      return { planned: planned.length, ...result };
+    },
+    start(scheduler) {
+      if (schedulerPromise) throw new Error("Reliable reporting scheduler is already running");
+      positiveInteger(scheduler.intervalMilliseconds, "intervalMilliseconds");
+      schedulerAbort = new AbortController();
+      const signal = schedulerAbort.signal;
+      schedulerPromise = schedulerLoop(service, scheduler, signal, options.store).finally(() => {
+        schedulerPromise = void 0;
+        schedulerAbort = void 0;
+      });
+    },
+    async stop() {
+      const running = schedulerPromise;
+      schedulerAbort?.abort();
+      if (running) await running;
+    }
+  };
+  return service;
+}
+function createRoutedSource(sources, offerings) {
+  const capabilities = reportingSourceCapabilitiesV1([...offerings.values()], "reliable-reporting-service-v1");
+  return {
+    capabilities,
+    execute(request, context) {
+      return routeSource(sources, request.sourceScope).execute(request, context);
+    },
+    read(input) {
+      return routeSource(sources, input.sourceScope).read(input);
+    }
+  };
+}
+function routeSource(sources, sourceScope) {
+  const adapterId = sourceScope[ADAPTER_SCOPE_KEY];
+  const source = typeof adapterId === "string" ? sources.get(adapterId) : sources.size === 1 ? sources.values().next().value : void 0;
+  if (!source) throw new TypeError("Reporting sourceScope has no installed adapter route");
+  return source;
+}
+async function schedulerLoop(service, options, signal, store) {
+  let rotation = 0;
+  while (!signal.aborted) {
+    let accountIds = [];
+    try {
+      accountIds = options.deploymentWide ? (
+        // A single deployment-wide sweep shares one budget across every
+        // tenant, so whichever account the ledger returns first can consume
+        // it — the producer's own default cap starves the rest just as an
+        // explicit per-account cap would. Enumerate the roster so each tenant
+        // gets its own bounded cycle, and rotate the starting point each pass.
+        rotate(await deploymentWideAccountIds(store), rotation)
+      ) : rotate(
+        validateAccountIds(
+          typeof options.accountIds === "function" ? await options.accountIds() : options.accountIds
+        ),
+        rotation
+      );
+    } catch (error) {
+      await reportSchedulerError(options, signal, error, { phase: "roster" });
+    }
+    rotation += 1;
+    for (const accountId of accountIds) {
+      if (signal.aborted) break;
+      try {
+        await service.runCycle({
+          ...accountId === void 0 ? { deploymentWide: true } : { accountId },
+          signal,
+          ...options.maxObligationsPerAccount !== void 0 ? { maxObligations: options.maxObligationsPerAccount } : {},
+          ...options.maxWorkerIterationsPerAccount !== void 0 ? { maxWorkerIterations: options.maxWorkerIterationsPerAccount } : {},
+          ...options.retryDelayMilliseconds !== void 0 ? { retryDelayMilliseconds: options.retryDelayMilliseconds } : {},
+          ...options.executionDeadlineMilliseconds !== void 0 ? { executionDeadlineMilliseconds: options.executionDeadlineMilliseconds } : {},
+          ...options.settlementGraceMilliseconds !== void 0 ? { settlementGraceMilliseconds: options.settlementGraceMilliseconds } : {}
+        });
+      } catch (error) {
+        await reportSchedulerError(options, signal, error, { phase: "cycle", accountId });
+      }
+    }
+    if (!signal.aborted) await abortableDelay(options.intervalMilliseconds, signal);
+  }
+}
+async function reportSchedulerError(options, signal, error, site) {
+  if (signal.aborted) return;
+  if (options.onError) {
+    try {
+      await options.onError(error);
+    } catch (observerError) {
+      warnSchedulerFailure(options, site, error, observerError);
+    }
+    return;
+  }
+  warnSchedulerFailure(options, site, error);
+}
+function warnSchedulerFailure(options, site, error, observerError) {
+  const where = site.phase === "roster" ? "could not resolve its account roster, so this pass ran no tenants" : site.accountId === void 0 ? "deployment-wide cycle failed; the scheduler continues" : `cycle failed for account ${site.accountId}; later tenants continue`;
+  const observed = observerError === void 0 ? "" : ` (the configured onError also threw: ${safeMessage(observerError)})`;
+  const message = `[adcp/reporting] scheduler ${where}: ${safeMessage(error)}${observed}`;
+  const logger = options.logger;
+  try {
+    if (logger !== void 0) logger.warn(message);
+    else defaultSchedulerWarn(message);
+  } catch {
+  }
+}
+function defaultSchedulerWarn(message) {
+  console.warn(message);
+}
+const MAX_SCHEDULER_MESSAGE_CHARS = 512;
+const MAX_SCHEDULER_SCAN_CHARS = 8192;
+const UNREPORTABLE_SCHEDULER_ERROR = "<unreportable error>";
+function safeMessage(error) {
+  try {
+    const raw = rawMessage(error);
+    const redacted = redactCredentialPatterns(raw.slice(0, MAX_SCHEDULER_SCAN_CHARS));
+    const text = typeof redacted === "string" && redacted.length > 0 ? redacted : UNREPORTABLE_SCHEDULER_ERROR;
+    return text.length > MAX_SCHEDULER_MESSAGE_CHARS ? `${text.slice(0, MAX_SCHEDULER_MESSAGE_CHARS)}\u2026` : text;
+  } catch {
+    return UNREPORTABLE_SCHEDULER_ERROR;
+  }
+}
+function rawMessage(error) {
+  switch (typeof error) {
+    case "string":
+      return error;
+    case "number":
+    case "boolean":
+    case "bigint":
+      return String(error);
+    case "undefined":
+      return "undefined";
+    case "symbol":
+      return error.description ?? "symbol";
+    default:
+      break;
+  }
+  if (error === null) return "null";
+  const message = error.message;
+  return typeof message === "string" ? message : "non-Error scheduler failure";
+}
+const MAX_TIMER_DELAY_MILLISECONDS = 2147483647;
+async function abortableDelay(milliseconds, signal) {
+  let remaining = milliseconds;
+  while (remaining > 0 && !signal.aborted) {
+    const chunk = Math.min(remaining, MAX_TIMER_DELAY_MILLISECONDS);
+    await abortableTimeout(chunk, signal);
+    remaining -= chunk;
+  }
+}
+function abortableTimeout(milliseconds, signal) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(done, milliseconds);
+    function done() {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    }
+    signal.addEventListener("abort", done, { once: true });
+  });
+}
+function rotate(values, by) {
+  if (values.length < 2) return [...values];
+  const offset = (by % values.length + values.length) % values.length;
+  return [...values.slice(offset), ...values.slice(0, offset)];
+}
+async function deploymentWideAccountIds(store) {
+  const configurations = await store.listConfigurations();
+  return [...new Set(configurations.map((value) => value.account.account_id))].sort();
+}
+function validateAccountIds(values) {
+  if (!Array.isArray(values)) {
+    throw new TypeError("Reporting scheduler accountIds resolver must return an array");
+  }
+  const unique = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (typeof value !== "string" || value.length === 0 || value.length > 255) {
+      throw new TypeError("Reporting scheduler accountIds must contain bounded non-empty strings");
+    }
+    unique.add(value);
+  }
+  return [...unique];
+}
+function cycleAccountId(cycle) {
+  const requested = cycle.accountId;
+  if (cycle.deploymentWide === true) {
+    if (requested !== void 0) {
+      throw new TypeError("Reliable reporting cycles cannot combine deploymentWide with an accountId");
+    }
+    return void 0;
+  }
+  if (typeof requested !== "string" || requested.length === 0 || requested.length > 255) {
+    throw new TypeError("Reliable reporting cycles require deploymentWide: true or a bounded non-empty accountId");
+  }
+  return requested;
+}
+async function predecessorGeneration(store, accountId, configuration) {
+  return (await store.listConfigurations(accountId)).find(
+    (value) => value.delivery_config_id === configuration.delivery_config_id && value.delivery_config_version === configuration.delivery_config_version
+  );
+}
+function keylessPredecessorScope(predecessor, resolvedScope, adapterCount) {
+  if (!predecessor || Object.prototype.hasOwnProperty.call(predecessor.sourceScope, ADAPTER_SCOPE_KEY)) {
+    return void 0;
+  }
+  if (adapterCount > 1) {
+    throw new TypeError(
+      "Reporting configuration generation predates the adapter route key and cannot be routed with multiple adapters installed; install a new generation with an explicit adapter route"
+    );
+  }
+  if (canonicalize(predecessor.sourceScope) !== canonicalize(resolvedScope)) return void 0;
+  return structuredClone(predecessor.sourceScope);
+}
+function validateDeliveryOffering(source, delivery) {
+  if (delivery.offering_id !== source.offeringId) throw new TypeError("Source and delivery offering IDs differ");
+  if (delivery.report_definition_id !== source.contract.report_definition_id) {
+    throw new TypeError("Source and delivery report definitions differ");
+  }
+  if (delivery.report_definition_uri !== source.contract.reportDefinitionUri || delivery.report_definition_sha256 !== source.contract.reportDefinitionSha256 || delivery.reporting_profile.id !== source.contract.reportingProfile || delivery.reporting_profile.version !== source.contract.schemaVersion || delivery.reporting_profile.schema_uri !== source.contract.schemaUri || delivery.reporting_profile.schema_sha256 !== source.contract.schemaSha256 || delivery.reporting_profile.schema_dialect !== source.contract.schemaDialect || delivery.reporting_profile.schema_ref_policy !== source.contract.schemaRefPolicy) {
+    throw new TypeError("Delivery offering does not describe the source contract");
+  }
+  if (delivery.method !== void 0 || delivery.reconciliation_mode !== "delivery_only" || delivery.feed_purpose === "billing") {
+    throw new TypeError("ReliableReportingService currently installs Core API delivery only");
+  }
+  if (delivery.schedule.alignment !== "utc" && delivery.schedule.alignment !== "source_timezone") {
+    throw new TypeError(
+      `ReliableReportingService cannot honor '${delivery.schedule.alignment}' period alignment; it generates fixed-length periods from the utc and source_timezone origins`
+    );
+  }
+  assertOfferingScheduleShape(delivery);
+  const advertisedSla = parseAdvertisedDuration(delivery.schedule.delivery_sla, "delivery_sla");
+  parseAdvertisedDuration(delivery.schedule.period_duration, "period_duration");
+  if (delivery.supported_finality.includes("official") && source.publicationClass !== "AUTHORITATIVE") {
+    throw new TypeError("Official delivery finality requires an authoritative source offering");
+  }
+  if (source.publicationClass === "AUTHORITATIVE" && delivery.supported_finality.includes("snapshot")) {
+    throw new TypeError(
+      "Authoritative source offerings cannot advertise snapshot delivery finality; the ledger installs them as official only"
+    );
+  }
+  if (delivery.supported_finality.includes("official") && source.publicationClass === "AUTHORITATIVE") {
+    const { finalization } = source;
+    const readyOffset = finalization.schedule.daysAfterPeriodEnd * 864e5 + localTimeOfDayMilliseconds(finalization.schedule.sourceLocalReadyTime);
+    const earliest = readyOffset + reportingIsoDurationMillisecondsV1(finalization.worstCaseAvailabilityLag);
+    if (advertisedSla < earliest) {
+      throw new TypeError(
+        "Official reporting delivery SLA is shorter than the source can finalize and publish; the advertised deadline is unreachable for every period"
+      );
+    }
+  }
+  if (source.publicationClass === "PROVISIONAL_SNAPSHOT") {
+    const worstCase = reportingIsoDurationMillisecondsV1(source.cadence.worstCaseAvailabilityLag);
+    if (advertisedSla < worstCase) {
+      throw new TypeError(
+        "Snapshot reporting delivery SLA is shorter than the source worst-case availability lag; the advertised deadline is unreachable for every period"
+      );
+    }
+  }
+  const pinnedTimezone = delivery.schedule.period_timezone_policy === "fixed" ? delivery.schedule.period_timezone : source.sourceTimezone.ianaTimezone;
+  if (pinnedTimezone) {
+    const now = Date.now();
+    if (delivery.schedule.alignment === "utc" && reportingUtcOffsetMinutesV1(pinnedTimezone, now) !== 0) {
+      throw new TypeError("UTC-aligned reporting requires a source timezone whose UTC offset is zero");
+    }
+    const originMs = reportingScheduleOriginV1(
+      delivery.schedule.alignment === "utc" ? "utc" : "source_timezone",
+      pinnedTimezone
+    );
+    if (reportingUtcOffsetMinutesV1(pinnedTimezone, originMs) !== reportingUtcOffsetMinutesV1(pinnedTimezone, now)) {
+      throw new TypeError(
+        "Reporting source timezone no longer observes its schedule-origin offset; no anchor derived from the protocol origin can land on source-local midnight"
+      );
+    }
+    assertConstantUtcOffset(
+      pinnedTimezone,
+      now - OFFSET_BACKWARD_HORIZON_DAYS * DAY_MILLISECONDS,
+      now + OFFSET_FORWARD_HORIZON_DAYS * DAY_MILLISECONDS
+    );
+  }
+  const period = reportingIsoDurationMillisecondsV1(delivery.schedule.period_duration);
+  const min = reportingIsoDurationMillisecondsV1(source.windowing.minimumWindow);
+  const max = reportingIsoDurationMillisecondsV1(source.windowing.maximumWindow);
+  if (period < min || period > max) throw new TypeError("Delivery schedule is outside source window bounds");
+  if (period % 864e5 !== 0) {
+    throw new TypeError(
+      `Delivery schedule period '${delivery.schedule.period_duration}' is not a whole number of source-local days; the service generates period boundaries only on source-local midnight`
+    );
+  }
+  const executorCeiling = source.sourceExecution.maximumWindowDaysPerRequest * 864e5;
+  if (period > executorCeiling) {
+    throw new TypeError(
+      "Delivery schedule period exceeds the source executor maximumWindowDaysPerRequest; no single request could cover one period"
+    );
+  }
+  if (delivery.reporting_profile.primary_keys.length === 0) {
+    throw new TypeError("Delivery offering requires at least one reporting primary key");
+  }
+  if (delivery.reporting_profile.grain !== source.grain) {
+    throw new TypeError("Delivery offering grain does not match its source offering grain");
+  }
+  if (delivery.schedule.period_timezone_policy === "fixed" && source.sourceTimezone.ianaTimezone !== void 0 && delivery.schedule.period_timezone !== source.sourceTimezone.ianaTimezone) {
+    throw new TypeError("Delivery offering pins a period timezone its source offering does not declare");
+  }
+  if (delivery.supported_finality.length === 0) {
+    throw new TypeError("Delivery offering must advertise at least one supported finality");
+  }
+  if (new Set(delivery.supported_finality).size !== delivery.supported_finality.length) {
+    throw new TypeError("Delivery offering supported finality values must be unique");
+  }
+}
+function validateConfigurationAgainstDeliveryOffering(configuration, offering, automatedRecoveryWindowSeconds) {
+  if (configuration.feedPurpose !== offering.feed_purpose || configuration.report_definition_id !== offering.report_definition_id) {
+    throw new TypeError("Reporting configuration does not match its delivery offering");
+  }
+  if (!offering.supported_finality.includes(configuration.requiredFinality)) {
+    throw new TypeError("Reporting configuration finality is not supported by its delivery offering");
+  }
+  if (configuration.schedule.periodMilliseconds !== reportingIsoDurationMillisecondsV1(offering.schedule.period_duration) || configuration.schedule.deliverySlaMilliseconds !== reportingIsoDurationMillisecondsV1(offering.schedule.delivery_sla)) {
+    throw new TypeError("Reporting configuration schedule does not match its delivery offering");
+  }
+  if (configuration.schedule.officialAfterMilliseconds !== void 0 && configuration.schedule.officialAfterMilliseconds !== configuration.schedule.deliverySlaMilliseconds) {
+    throw new TypeError("Reporting official deadline must equal the advertised delivery SLA of its offering");
+  }
+  if (configuration.schedule.recoveryWindowMilliseconds !== automatedRecoveryWindowSeconds * 1e3) {
+    throw new TypeError(
+      "Reporting configuration recovery window must equal the advertised automated recovery window; the advertised value is what buyer-facing deadlines are measured against"
+    );
+  }
+}
+function trustedCoverage(coverage, requestedMetrics) {
+  if (!coverage || typeof coverage !== "object" || !Array.isArray(coverage.constituents)) {
+    throw new TypeError("resolveCoverage must return an authorized constituent denominator");
+  }
+  const constituents = ReportingCoverageConstituentIdentityV1Schema.array().min(1).max(SOURCE_BATCH_MANIFEST_MAX_METRIC_AVAILABILITY_V1).parse(structuredClone(coverage.constituents));
+  if (constituents.length * requestedMetrics.length > SOURCE_BATCH_MANIFEST_MAX_METRIC_AVAILABILITY_V1) {
+    throw new TypeError(
+      "Reporting coverage exceeds the per-slice metric availability bound; reduce constituents or metrics"
+    );
+  }
+  const constituentIds = new Set(constituents.map((value) => value.constituentId));
+  if (constituentIds.size !== constituents.length) {
+    throw new TypeError("resolveCoverage must return unique constituent identities");
+  }
+  for (const constituent of constituents) {
+    const binding = constituent.productBinding;
+    if (!binding) continue;
+    if (binding.productId !== constituent.productId) {
+      throw new TypeError("resolveCoverage constituent productId contradicts its product binding");
+    }
+    if (constituent.constituentKind === "media_buy" && binding.mediaBuyId !== constituent.mediaBuyId) {
+      throw new TypeError("resolveCoverage constituent mediaBuyId contradicts its product binding");
+    }
+    if (constituent.constituentKind === "package_item" && binding.packageId !== constituent.packageId) {
+      throw new TypeError("resolveCoverage constituent packageId contradicts its product binding");
+    }
+  }
+  const mediaBuyIds = [
+    ...new Set(constituents.map((value) => value.mediaBuyId).filter((value) => Boolean(value)))
+  ].sort();
+  return { constituents, mediaBuyIds };
+}
+function sameIdMembers(left, right) {
+  if (!Array.isArray(left)) throw new TypeError("expectedMediaBuyIds must be an array of media buy IDs");
+  const expected = new Set(left);
+  return expected.size === right.length && right.every((value) => expected.has(value));
+}
+const DAY_MILLISECONDS = 864e5;
+const OFFSET_PROBE_STEP_DAYS = 10;
+const OFFSET_BACKWARD_HORIZON_DAYS = 400;
+const OFFSET_FORWARD_HORIZON_DAYS = 400;
+function assertSupportedScheduleSemantics(schedule, offering, sourceTimezone) {
+  const { alignment } = offering.schedule;
+  if (alignment !== "utc" && alignment !== "source_timezone") {
+    throw new TypeError(
+      `ReliableReportingService cannot honor '${alignment}' period alignment; it generates fixed-length periods from the utc and source_timezone origins`
+    );
+  }
+  if (offering.schedule.period_timezone_policy === "fixed" && offering.schedule.period_timezone !== sourceTimezone) {
+    throw new TypeError("Reporting offering pins a period timezone that is not the resolved source timezone");
+  }
+  if (schedule.periodMilliseconds % DAY_MILLISECONDS !== 0) {
+    throw new TypeError(
+      "Reporting periods must be whole source-local days; a sub-day window has no source-local midnight boundary"
+    );
+  }
+  const anchorMs = Date.parse(schedule.anchor);
+  if (!Number.isFinite(anchorMs)) throw new TypeError("Reporting configuration anchor must be a valid instant");
+  if (alignment === "utc" && reportingUtcOffsetMinutesV1(sourceTimezone, anchorMs) !== 0) {
+    throw new TypeError("UTC-aligned reporting requires a source timezone whose UTC offset is zero");
+  }
+  const originMs = reportingScheduleOriginV1(alignment, sourceTimezone);
+  const phase = ((anchorMs - originMs) % schedule.periodMilliseconds + schedule.periodMilliseconds) % schedule.periodMilliseconds;
+  if (phase !== 0) {
+    throw new TypeError(
+      `Reporting configuration anchor is not on a '${alignment}' period boundary; boundaries are derived from the protocol origin (1970-01-01 local midnight) plus whole periods`
+    );
+  }
+  const now = Date.now();
+  const spanStartMs = Math.max(anchorMs, now - OFFSET_BACKWARD_HORIZON_DAYS * DAY_MILLISECONDS);
+  const spanEndMs = Math.max(now, anchorMs) + OFFSET_FORWARD_HORIZON_DAYS * DAY_MILLISECONDS;
+  if (reportingUtcOffsetMinutesV1(sourceTimezone, originMs) !== reportingUtcOffsetMinutesV1(sourceTimezone, now)) {
+    throw new TypeError(
+      "Reporting source timezone no longer observes its schedule-origin offset; no anchor derived from the protocol origin can land on source-local midnight"
+    );
+  }
+  assertConstantUtcOffset(sourceTimezone, spanStartMs, spanEndMs);
+  if (!reportingIsSourceLocalMidnightV1(spanStartMs === anchorMs ? anchorMs : now, sourceTimezone)) {
+    const ordinal = Math.ceil((spanStartMs - originMs) / schedule.periodMilliseconds);
+    if (!reportingIsSourceLocalMidnightV1(originMs + ordinal * schedule.periodMilliseconds, sourceTimezone)) {
+      throw new TypeError("Reporting configuration boundaries do not land on source-local midnight");
+    }
+  }
+}
+function assertConstantUtcOffset(timeZone, startMs, endMs) {
+  const baseline = reportingUtcOffsetMinutesV1(timeZone, startMs);
+  for (let instant = startMs; instant < endMs; instant += OFFSET_PROBE_STEP_DAYS * DAY_MILLISECONDS) {
+    if (reportingUtcOffsetMinutesV1(timeZone, instant) !== baseline) {
+      throw new TypeError(
+        "Reporting source timezone changes its UTC offset; fixed-length periods cannot express its local days"
+      );
+    }
+  }
+  if (reportingUtcOffsetMinutesV1(timeZone, endMs) !== baseline) {
+    throw new TypeError(
+      "Reporting source timezone changes its UTC offset; fixed-length periods cannot express its local days"
+    );
+  }
+}
+function assertOfferingScheduleShape(offering) {
+  const advertised = offering.schedule;
+  const forbid = (fields) => {
+    for (const field of fields) {
+      if (advertised[field] !== void 0) {
+        throw new TypeError(
+          `Reporting offering advertises ${field}, which '${offering.schedule.alignment}' alignment forbids`
+        );
+      }
+    }
+  };
+  if (offering.schedule.alignment === "utc") {
+    forbid(["period_anchor", "period_anchor_policy", "period_timezone", "period_timezone_policy"]);
+    return;
+  }
+  forbid(["period_anchor", "period_anchor_policy"]);
+  const policy = offering.schedule.period_timezone_policy;
+  if (policy === void 0) {
+    throw new TypeError("source_timezone reporting offerings must advertise a period_timezone_policy");
+  }
+  if (policy === "fixed") {
+    if (offering.schedule.period_timezone === void 0) {
+      throw new TypeError("A fixed source_timezone reporting offering must advertise its period_timezone");
+    }
+    return;
+  }
+  if (offering.schedule.period_timezone !== void 0) {
+    forbid(["period_timezone"]);
+  }
+}
+function parseAdvertisedDuration(value, field) {
+  try {
+    return reportingIsoDurationMillisecondsV1(value);
+  } catch {
+    throw new TypeError(
+      `Reporting offering advertises a ${field} of '${value}' that this service cannot express as a fixed duration; every installation would reject it`
+    );
+  }
+}
+function localTimeOfDayMilliseconds(value) {
+  const [hours = 0, minutes = 0] = value.split(":").map(Number);
+  return hours * 36e5 + minutes * 6e4;
+}
+function trustedCurrency(value) {
+  if (typeof value !== "string" || !/^[A-Z]{3}$/.test(value)) {
+    throw new TypeError("resolveCurrency must return an ISO 4217-style three-letter uppercase currency");
+  }
+  return value;
+}
+function trustedTimezone(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 255) {
+    throw new TypeError("resolveSource must return a bounded IANA sourceTimezone");
+  }
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: value }).format(0);
+  } catch {
+    throw new TypeError("resolveSource must return a valid IANA sourceTimezone");
+  }
+  return value;
+}
+function assertNoUntrustedLineageFields(configuration) {
+  for (const field of [
+    "account",
+    "sourceScope",
+    "sourceTimezone",
+    "contract",
+    "currency",
+    "ctx_metadata",
+    "constituents",
+    "mediaBuyIds"
+  ]) {
+    if (Object.prototype.hasOwnProperty.call(configuration, field)) {
+      throw new TypeError(`Reporting configuration must not supply trusted lineage field ${field}`);
+    }
+  }
+}
+function containsContextMetadata(value) {
+  if (!value || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(containsContextMetadata);
+  for (const [key, child] of Object.entries(value)) {
+    if (/^(?:ctx_metadata|authInfo|auth_info)$/i.test(key) || containsContextMetadata(child)) return true;
+  }
+  return false;
+}
+function assertConsumerStatusStore(store) {
+  const candidate = store;
+  for (const method of ["getRevisionMetadata", "getConsumerStatusBatchReplay", "syncConsumerStatusBatch"]) {
+    if (typeof candidate[method] !== "function") {
+      throw new TypeError(`Consumer status requires a reporting ledger store with ${method}()`);
+    }
+  }
+}
+function positiveInteger(value, field) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${field} must be a positive safe integer`);
+}
+function deepFreeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const child of Object.values(value)) deepFreeze(child);
+  }
+  return value;
+}
+export * from "./conformance.mjs";
+export {
+  createReliableReportingService
+};