@adcp/sdk 14.0.0-rc.37 → 14.0.0-rc.39

package/dist/lib/reporting/source/manifest.js

@@ -74,13 +74,18 @@ const METRIC_NAME = /^[A-Za-z][A-Za-z0-9_.:-]{0,127}$/;
 const REASON = /^[A-Za-z0-9](?:[A-Za-z0-9 !#$%&'()*+,./:;<=>?@^_{}|~-]{0,510}[A-Za-z0-9])?$/;
 const ReportingSha256V1Schema = import_zod.z.string().regex(SHA256);
 const ReportingFingerprintV1Schema = import_zod.z.string().regex(/^sha256:[a-f0-9]{64}$/);
-const ReportingExternalIdV1Schema = import_zod.z.string().min(1).max(255).refine(
-  (value) => value.trim() === value && !Array.from(value).some((character) => {
-    const codePoint = character.codePointAt(0);
-    return codePoint !== void 0 && (codePoint <= 31 || codePoint === 127);
-  }),
-  "Identifier must not contain whitespace padding or control characters"
-);
+const EXTERNAL_ID_MAX_CHARS = 255;
+function isUnpaddedControlFreeIdentifier(value) {
+  if (value.length > EXTERNAL_ID_MAX_CHARS) return false;
+  if (value.length === 0) return false;
+  if (/^\s/.test(value) || /\s$/.test(value)) return false;
+  for (let index = 0; index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit <= 31 || unit === 127) return false;
+  }
+  return true;
+}
+const ReportingExternalIdV1Schema = import_zod.z.string().min(1).max(EXTERNAL_ID_MAX_CHARS).refine(isUnpaddedControlFreeIdentifier, "Identifier must not contain whitespace padding or control characters");
 const ReportingOpaqueReferenceV1Schema = import_zod.z.string().regex(OPAQUE_REF);
 const ReportingEvidenceReasonV1Schema = import_zod.z.string().min(1).max(512).regex(REASON);
 const ReportingInstantV1Schema = import_zod.z.iso.datetime({ offset: true }).refine((value) => {

package/dist/lib/reporting/source/manifest.mjs

@@ -12,13 +12,18 @@ const METRIC_NAME = /^[A-Za-z][A-Za-z0-9_.:-]{0,127}$/;
 const REASON = /^[A-Za-z0-9](?:[A-Za-z0-9 !#$%&'()*+,./:;<=>?@^_{}|~-]{0,510}[A-Za-z0-9])?$/;
 const ReportingSha256V1Schema = z.string().regex(SHA256);
 const ReportingFingerprintV1Schema = z.string().regex(/^sha256:[a-f0-9]{64}$/);
-const ReportingExternalIdV1Schema = z.string().min(1).max(255).refine(
-  (value) => value.trim() === value && !Array.from(value).some((character) => {
-    const codePoint = character.codePointAt(0);
-    return codePoint !== void 0 && (codePoint <= 31 || codePoint === 127);
-  }),
-  "Identifier must not contain whitespace padding or control characters"
-);
+const EXTERNAL_ID_MAX_CHARS = 255;
+function isUnpaddedControlFreeIdentifier(value) {
+  if (value.length > EXTERNAL_ID_MAX_CHARS) return false;
+  if (value.length === 0) return false;
+  if (/^\s/.test(value) || /\s$/.test(value)) return false;
+  for (let index = 0; index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit <= 31 || unit === 127) return false;
+  }
+  return true;
+}
+const ReportingExternalIdV1Schema = z.string().min(1).max(EXTERNAL_ID_MAX_CHARS).refine(isUnpaddedControlFreeIdentifier, "Identifier must not contain whitespace padding or control characters");
 const ReportingOpaqueReferenceV1Schema = z.string().regex(OPAQUE_REF);
 const ReportingEvidenceReasonV1Schema = z.string().min(1).max(512).regex(REASON);
 const ReportingInstantV1Schema = z.iso.datetime({ offset: true }).refine((value) => {

package/dist/lib/reporting/source/source.d.mts

@@ -1545,3 +1545,29 @@ export declare function completedReportingSourceResponseV1(input: {
     request: ReportingSourceSliceRequestV1;
     manifest: SourceBatchManifestReferenceV1;
 }): ReportingSourceExecutionResponseV1;
+/**
+ * Normative period-boundary origins from `core/reporting-schedule.json`.
+ *
+ * `utc` uses 1970-01-01T00:00:00Z as interval zero; `source_timezone` uses
+ * local midnight on that date in the explicit period timezone. Every boundary
+ * is the origin plus an interval ordinal, so an adopter that follows the spec
+ * anchors its generation on that origin rather than on a recent date.
+ */
+export declare const REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1: number;
+/** Minutes east of UTC that `timeZone` observes at `instantMs`. */
+export declare function reportingUtcOffsetMinutesV1(timeZone: string, instantMs: number): number;
+/**
+ * True when `timeZone` does not hold one UTC offset across `[startMs, endMs]`.
+ *
+ * Fixed-millisecond period arithmetic only agrees with the spec's civil-time
+ * boundary generation while the offset holds still, so any change in the span
+ * means boundaries drift off source-local midnight.
+ */
+export declare function reportingUtcOffsetChangesV1(timeZone: string, startMs: number, endMs: number): boolean;
+/** True when `instantMs` is exactly 00:00:00.000 local time in `timeZone`. */
+export declare function reportingIsSourceLocalMidnightV1(instantMs: number, timeZone: string): boolean;
+/**
+ * Interval zero for an alignment, per `reporting-schedule.json` §period_generation.
+ * `billing_cycle` has no derivable origin — it carries an explicit anchor.
+ */
+export declare function reportingScheduleOriginV1(alignment: 'utc' | 'source_timezone', timeZone: string): number;

package/dist/lib/reporting/source/source.d.ts

@@ -1545,3 +1545,29 @@ export declare function completedReportingSourceResponseV1(input: {
     request: ReportingSourceSliceRequestV1;
     manifest: SourceBatchManifestReferenceV1;
 }): ReportingSourceExecutionResponseV1;
+/**
+ * Normative period-boundary origins from `core/reporting-schedule.json`.
+ *
+ * `utc` uses 1970-01-01T00:00:00Z as interval zero; `source_timezone` uses
+ * local midnight on that date in the explicit period timezone. Every boundary
+ * is the origin plus an interval ordinal, so an adopter that follows the spec
+ * anchors its generation on that origin rather than on a recent date.
+ */
+export declare const REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1: number;
+/** Minutes east of UTC that `timeZone` observes at `instantMs`. */
+export declare function reportingUtcOffsetMinutesV1(timeZone: string, instantMs: number): number;
+/**
+ * True when `timeZone` does not hold one UTC offset across `[startMs, endMs]`.
+ *
+ * Fixed-millisecond period arithmetic only agrees with the spec's civil-time
+ * boundary generation while the offset holds still, so any change in the span
+ * means boundaries drift off source-local midnight.
+ */
+export declare function reportingUtcOffsetChangesV1(timeZone: string, startMs: number, endMs: number): boolean;
+/** True when `instantMs` is exactly 00:00:00.000 local time in `timeZone`. */
+export declare function reportingIsSourceLocalMidnightV1(instantMs: number, timeZone: string): boolean;
+/**
+ * Interval zero for an alignment, per `reporting-schedule.json` §period_generation.
+ * `billing_cycle` has no derivable origin — it carries an explicit anchor.
+ */
+export declare function reportingScheduleOriginV1(alignment: 'utc' | 'source_timezone', timeZone: string): number;

package/dist/lib/reporting/source/source.js

@@ -19,6 +19,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var source_exports = {};
 __export(source_exports, {
   REPORTING_MAX_SOURCE_WINDOW_DAYS_V1: () => REPORTING_MAX_SOURCE_WINDOW_DAYS_V1,
+  REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1: () => REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1,
   ReportingIsoDurationV1Schema: () => ReportingIsoDurationV1Schema,
   ReportingMetricOrDimensionNameV1Schema: () => ReportingMetricOrDimensionNameV1Schema,
   ReportingSourceCapabilitiesV1JsonSchema: () => ReportingSourceCapabilitiesV1JsonSchema,
@@ -33,9 +34,13 @@ __export(source_exports, {
   ReportingSourceSliceRequestV1Schema: () => ReportingSourceSliceRequestV1Schema,
   ReportingSourceWindowingV1Schema: () => ReportingSourceWindowingV1Schema,
   completedReportingSourceResponseV1: () => completedReportingSourceResponseV1,
+  reportingIsSourceLocalMidnightV1: () => reportingIsSourceLocalMidnightV1,
   reportingIsoDurationMillisecondsV1: () => reportingIsoDurationMillisecondsV1,
+  reportingScheduleOriginV1: () => reportingScheduleOriginV1,
   reportingSourceCapabilitiesSha256V1: () => reportingSourceCapabilitiesSha256V1,
-  reportingSourceCapabilitiesV1: () => reportingSourceCapabilitiesV1
+  reportingSourceCapabilitiesV1: () => reportingSourceCapabilitiesV1,
+  reportingUtcOffsetChangesV1: () => reportingUtcOffsetChangesV1,
+  reportingUtcOffsetMinutesV1: () => reportingUtcOffsetMinutesV1
 });
 module.exports = __toCommonJS(source_exports);
 var import_node_crypto = require("node:crypto");
@@ -524,9 +529,69 @@ function sourceLocalDate(instant, timezone) {
   const values = Object.fromEntries(parts.map((part) => [part.type, part.value]));
   return `${values.year}-${values.month}-${values.day}`;
 }
+const REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1 = Date.UTC(1970, 0, 1);
+const zonedFormatters = /* @__PURE__ */ new Map();
+function zonedFormatter(timeZone) {
+  let formatter = zonedFormatters.get(timeZone);
+  if (!formatter) {
+    formatter = new Intl.DateTimeFormat("en-US", {
+      timeZone,
+      hourCycle: "h23",
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit"
+    });
+    zonedFormatters.set(timeZone, formatter);
+  }
+  return formatter;
+}
+function zonedParts(timeZone, instantMs) {
+  const parts = zonedFormatter(timeZone).formatToParts(new Date(instantMs));
+  const field = (type) => Number(parts.find((part) => part.type === type)?.value);
+  return {
+    year: field("year"),
+    month: field("month"),
+    day: field("day"),
+    hour: field("hour"),
+    minute: field("minute"),
+    second: field("second")
+  };
+}
+function reportingUtcOffsetMinutesV1(timeZone, instantMs) {
+  const parts = zonedParts(timeZone, instantMs);
+  const asUtc = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
+  return Math.round((asUtc - (instantMs - instantMs % 1e3)) / 6e4);
+}
+const REPORTING_OFFSET_PROBE_STEP_MS_V1 = 10 * 864e5;
+function reportingUtcOffsetChangesV1(timeZone, startMs, endMs) {
+  const baseline = reportingUtcOffsetMinutesV1(timeZone, startMs);
+  for (let instant = startMs; instant < endMs; instant += REPORTING_OFFSET_PROBE_STEP_MS_V1) {
+    if (reportingUtcOffsetMinutesV1(timeZone, instant) !== baseline) return true;
+  }
+  return reportingUtcOffsetMinutesV1(timeZone, endMs) !== baseline;
+}
+function reportingIsSourceLocalMidnightV1(instantMs, timeZone) {
+  if (instantMs % 1e3 !== 0) return false;
+  const parts = zonedParts(timeZone, instantMs);
+  return parts.hour === 0 && parts.minute === 0 && parts.second === 0;
+}
+function reportingScheduleOriginV1(alignment, timeZone) {
+  if (alignment === "utc") return REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1;
+  let instant = REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1;
+  for (let pass = 0; pass < 3; pass += 1) {
+    const candidate = REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1 - reportingUtcOffsetMinutesV1(timeZone, instant) * 6e4;
+    if (candidate === instant) break;
+    instant = candidate;
+  }
+  return instant;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   REPORTING_MAX_SOURCE_WINDOW_DAYS_V1,
+  REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1,
   ReportingIsoDurationV1Schema,
   ReportingMetricOrDimensionNameV1Schema,
   ReportingSourceCapabilitiesV1JsonSchema,
@@ -541,7 +606,11 @@ function sourceLocalDate(instant, timezone) {
   ReportingSourceSliceRequestV1Schema,
   ReportingSourceWindowingV1Schema,
   completedReportingSourceResponseV1,
+  reportingIsSourceLocalMidnightV1,
   reportingIsoDurationMillisecondsV1,
+  reportingScheduleOriginV1,
   reportingSourceCapabilitiesSha256V1,
-  reportingSourceCapabilitiesV1
+  reportingSourceCapabilitiesV1,
+  reportingUtcOffsetChangesV1,
+  reportingUtcOffsetMinutesV1
 });

package/dist/lib/reporting/source/source.mjs

@@ -500,8 +500,68 @@ function sourceLocalDate(instant, timezone) {
   const values = Object.fromEntries(parts.map((part) => [part.type, part.value]));
   return `${values.year}-${values.month}-${values.day}`;
 }
+const REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1 = Date.UTC(1970, 0, 1);
+const zonedFormatters = /* @__PURE__ */ new Map();
+function zonedFormatter(timeZone) {
+  let formatter = zonedFormatters.get(timeZone);
+  if (!formatter) {
+    formatter = new Intl.DateTimeFormat("en-US", {
+      timeZone,
+      hourCycle: "h23",
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit"
+    });
+    zonedFormatters.set(timeZone, formatter);
+  }
+  return formatter;
+}
+function zonedParts(timeZone, instantMs) {
+  const parts = zonedFormatter(timeZone).formatToParts(new Date(instantMs));
+  const field = (type) => Number(parts.find((part) => part.type === type)?.value);
+  return {
+    year: field("year"),
+    month: field("month"),
+    day: field("day"),
+    hour: field("hour"),
+    minute: field("minute"),
+    second: field("second")
+  };
+}
+function reportingUtcOffsetMinutesV1(timeZone, instantMs) {
+  const parts = zonedParts(timeZone, instantMs);
+  const asUtc = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
+  return Math.round((asUtc - (instantMs - instantMs % 1e3)) / 6e4);
+}
+const REPORTING_OFFSET_PROBE_STEP_MS_V1 = 10 * 864e5;
+function reportingUtcOffsetChangesV1(timeZone, startMs, endMs) {
+  const baseline = reportingUtcOffsetMinutesV1(timeZone, startMs);
+  for (let instant = startMs; instant < endMs; instant += REPORTING_OFFSET_PROBE_STEP_MS_V1) {
+    if (reportingUtcOffsetMinutesV1(timeZone, instant) !== baseline) return true;
+  }
+  return reportingUtcOffsetMinutesV1(timeZone, endMs) !== baseline;
+}
+function reportingIsSourceLocalMidnightV1(instantMs, timeZone) {
+  if (instantMs % 1e3 !== 0) return false;
+  const parts = zonedParts(timeZone, instantMs);
+  return parts.hour === 0 && parts.minute === 0 && parts.second === 0;
+}
+function reportingScheduleOriginV1(alignment, timeZone) {
+  if (alignment === "utc") return REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1;
+  let instant = REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1;
+  for (let pass = 0; pass < 3; pass += 1) {
+    const candidate = REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1 - reportingUtcOffsetMinutesV1(timeZone, instant) * 6e4;
+    if (candidate === instant) break;
+    instant = candidate;
+  }
+  return instant;
+}
 export {
   REPORTING_MAX_SOURCE_WINDOW_DAYS_V1,
+  REPORTING_SCHEDULE_ORIGIN_UTC_DATE_V1,
   ReportingIsoDurationV1Schema,
   ReportingMetricOrDimensionNameV1Schema,
   ReportingSourceCapabilitiesV1JsonSchema,
@@ -516,7 +576,11 @@ export {
   ReportingSourceSliceRequestV1Schema,
   ReportingSourceWindowingV1Schema,
   completedReportingSourceResponseV1,
+  reportingIsSourceLocalMidnightV1,
   reportingIsoDurationMillisecondsV1,
+  reportingScheduleOriginV1,
   reportingSourceCapabilitiesSha256V1,
-  reportingSourceCapabilitiesV1
+  reportingSourceCapabilitiesV1,
+  reportingUtcOffsetChangesV1,
+  reportingUtcOffsetMinutesV1
 };

package/dist/lib/schemas/index.d.mts

@@ -43,7 +43,8 @@ import { z } from 'zod';
 import * as schemas from '../types/schemas.generated.mjs';
 import type { CanonicalGetProductsRequest } from '../v2/projection/creative-delivery.mjs';
 import type { KnownToolRequestSchemas } from '../utils/tool-request-schemas.mjs';
-import { type ResolvedToolSchemaDocument, type ResponseVariant } from '../validation/schema-loader.mjs';
+import { getSchemaDocumentByRef, type Direction, type ResolvedToolSchemaDocument, type ResponseVariant } from '../validation/schema-loader.mjs';
+import type { ValidateFunction } from 'ajv';
 export * from '../types/schemas.generated.mjs';
 export type { PlacementPresentationDocument, PlacementPresentationReference } from '../types/core.generated.mjs';
 type LooseObjectShapeFor<T extends object> = {
@@ -180,10 +181,30 @@ export interface ToolResponseSchemaLookupOptions extends ToolSchemaLookupOptions
     variant?: ResponseVariant;
 }
 export type VersionedToolSchema = ResolvedToolSchemaDocument;
+/**
+ * Retrieve one immutable protocol-authored JSON Schema document by its path
+ * within a selected AdCP bundle. This exposes the authored `$ref` graph as a
+ * separate surface from the self-contained bundled documents returned by
+ * {@link getToolInputSchema} and {@link getToolResponseSchema}. Validation
+ * callers should normally prefer {@link getCanonicalToolValidator} so
+ * reference registration stays internal.
+ */
+export { getSchemaDocumentByRef };
 /** Retrieve the protocol-authored request JSON Schema for a specific AdCP release. */
 export declare function getToolInputSchema(toolName: string, options?: ToolSchemaLookupOptions): VersionedToolSchema | undefined;
 /** Retrieve a protocol-authored response JSON Schema for a specific AdCP release. */
 export declare function getToolResponseSchema(toolName: string, options?: ToolResponseSchemaLookupOptions): VersionedToolSchema | undefined;
+/**
+ * Compile the exact protocol-authored JSON Schema for offline conformance and
+ * CI validation. Unlike the SDK's live-wire response validation, this does not
+ * apply `relaxResponseRoot`, so extensible envelope fields can be rejected when
+ * the selected normative schema does not declare them.
+ *
+ * This validator is not intended for validating live wire responses, whose
+ * transport envelope can carry extension fields. It uses `allErrors: true`, so
+ * every call reports all violations collected by AJV in `validator.errors`.
+ */
+export declare function getCanonicalToolValidator(toolName: string, direction: Direction, options?: ToolSchemaLookupOptions): ValidateFunction | undefined;
 type InputShape = Record<string, z.ZodType>;
 type InputSchema = z.ZodType;
 type ShapeOf<T> = T extends {

package/dist/lib/schemas/index.d.ts

@@ -43,7 +43,8 @@ import { z } from 'zod';
 import * as schemas from '../types/schemas.generated';
 import type { CanonicalGetProductsRequest } from '../v2/projection/creative-delivery';
 import type { KnownToolRequestSchemas } from '../utils/tool-request-schemas';
-import { type ResolvedToolSchemaDocument, type ResponseVariant } from '../validation/schema-loader';
+import { getSchemaDocumentByRef, type Direction, type ResolvedToolSchemaDocument, type ResponseVariant } from '../validation/schema-loader';
+import type { ValidateFunction } from 'ajv';
 export * from '../types/schemas.generated';
 export type { PlacementPresentationDocument, PlacementPresentationReference } from '../types/core.generated';
 type LooseObjectShapeFor<T extends object> = {
@@ -180,10 +181,30 @@ export interface ToolResponseSchemaLookupOptions extends ToolSchemaLookupOptions
     variant?: ResponseVariant;
 }
 export type VersionedToolSchema = ResolvedToolSchemaDocument;
+/**
+ * Retrieve one immutable protocol-authored JSON Schema document by its path
+ * within a selected AdCP bundle. This exposes the authored `$ref` graph as a
+ * separate surface from the self-contained bundled documents returned by
+ * {@link getToolInputSchema} and {@link getToolResponseSchema}. Validation
+ * callers should normally prefer {@link getCanonicalToolValidator} so
+ * reference registration stays internal.
+ */
+export { getSchemaDocumentByRef };
 /** Retrieve the protocol-authored request JSON Schema for a specific AdCP release. */
 export declare function getToolInputSchema(toolName: string, options?: ToolSchemaLookupOptions): VersionedToolSchema | undefined;
 /** Retrieve a protocol-authored response JSON Schema for a specific AdCP release. */
 export declare function getToolResponseSchema(toolName: string, options?: ToolResponseSchemaLookupOptions): VersionedToolSchema | undefined;
+/**
+ * Compile the exact protocol-authored JSON Schema for offline conformance and
+ * CI validation. Unlike the SDK's live-wire response validation, this does not
+ * apply `relaxResponseRoot`, so extensible envelope fields can be rejected when
+ * the selected normative schema does not declare them.
+ *
+ * This validator is not intended for validating live wire responses, whose
+ * transport envelope can carry extension fields. It uses `allErrors: true`, so
+ * every call reports all violations collected by AJV in `validator.errors`.
+ */
+export declare function getCanonicalToolValidator(toolName: string, direction: Direction, options?: ToolSchemaLookupOptions): ValidateFunction | undefined;
 type InputShape = Record<string, z.ZodType>;
 type InputSchema = z.ZodType;
 type ShapeOf<T> = T extends {

package/dist/lib/schemas/index.js

@@ -43,6 +43,8 @@ __export(schemas_exports, {
   TOOL_RESPONSE_SCHEMAS: () => import_response_schemas.TOOL_RESPONSE_SCHEMAS,
   customToolFor: () => customToolFor,
   customToolForSchema: () => customToolForSchema,
+  getCanonicalToolValidator: () => getCanonicalToolValidator,
+  getSchemaDocumentByRef: () => import_schema_loader.getSchemaDocumentByRef,
   getToolInputSchema: () => getToolInputSchema,
   getToolResponseSchema: () => getToolResponseSchema
 });
@@ -72,6 +74,9 @@ function getToolInputSchema(toolName, options = {}) {
 function getToolResponseSchema(toolName, options = {}) {
   return (0, import_schema_loader.getToolSchemaDocument)(toolName, options.variant ?? "sync", (0, import_adcp_version_config.resolveAdcpVersion)(options.adcpVersion));
 }
+function getCanonicalToolValidator(toolName, direction, options = {}) {
+  return (0, import_schema_loader.getCanonicalToolValidatorForVersion)(toolName, direction, (0, import_adcp_version_config.resolveAdcpVersion)(options.adcpVersion));
+}
 function shapeOf(s) {
   const candidate = s?.shape;
   return candidate && typeof candidate === "object" ? candidate : void 0;
@@ -123,6 +128,8 @@ function customToolForSchema(name, description, inputSchema, handler) {
   TOOL_RESPONSE_SCHEMAS,
   customToolFor,
   customToolForSchema,
+  getCanonicalToolValidator,
+  getSchemaDocumentByRef,
   getToolInputSchema,
   getToolResponseSchema,
   ...require('../types/schemas.generated.js')

package/dist/lib/schemas/index.mjs

@@ -3,6 +3,8 @@ import * as schemas from "../types/schemas.generated.mjs";
 import { GetProductsRequest_FieldsValues } from "../types/inline-enums.generated.mjs";
 import { TOOL_REQUEST_SCHEMAS } from "../utils/tool-request-schemas.mjs";
 import {
+  getCanonicalToolValidatorForVersion,
+  getSchemaDocumentByRef,
   getToolSchemaDocument
 } from "../validation/schema-loader.mjs";
 import { resolveAdcpVersion } from "../utils/adcp-version-config.mjs";
@@ -30,6 +32,9 @@ function getToolInputSchema(toolName, options = {}) {
 function getToolResponseSchema(toolName, options = {}) {
   return getToolSchemaDocument(toolName, options.variant ?? "sync", resolveAdcpVersion(options.adcpVersion));
 }
+function getCanonicalToolValidator(toolName, direction, options = {}) {
+  return getCanonicalToolValidatorForVersion(toolName, direction, resolveAdcpVersion(options.adcpVersion));
+}
 function shapeOf(s) {
   const candidate = s?.shape;
   return candidate && typeof candidate === "object" ? candidate : void 0;
@@ -80,6 +85,8 @@ export {
   TOOL_RESPONSE_SCHEMAS,
   customToolFor,
   customToolForSchema,
+  getCanonicalToolValidator,
+  getSchemaDocumentByRef,
   getToolInputSchema,
   getToolResponseSchema
 };

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-09-15T02:30:34.567Z"
+  "synced_at": "2026-09-18T20:08:01.998Z"
 }

package/dist/lib/server/create-adcp-server.d.mts

@@ -1398,6 +1398,24 @@ export interface AdcpServerConfig<TAccount = unknown> {
      * the principal is still the authenticated buyer.
      */
     resolveIdempotencyPrincipal?: (ctx: HandlerContext<TAccount>, params: IdempotencyPrincipalParams, toolName: AdcpServerToolName) => string | undefined;
+    /**
+     * Resolve the reporting consumer identity a `sync_reporting_status` receipt
+     * is deposited for — the same identity the receipt handler records under.
+     *
+     * When present it is the replay namespace for that tool. The credential is
+     * not a safe substitute: an adopter may map two operator seats sharing one
+     * OAuth `client_id` to different reporting consumers, and keying replay by
+     * `oauth:<client_id>` then let the second seat be served the first's cached
+     * response and never record its own receipt. Absent this resolver the
+     * framework falls back to the canonical credential identity, which is
+     * correct exactly when the credential *is* the consumer.
+     *
+     * `createAdcpServerFromPlatform` wires this from the reporting platform's
+     * own `resolveConsumerId`, so a service-installed deployment gets it for
+     * free. Called once per dispatched `sync_reporting_status`, in addition to
+     * the receipt handler's own call.
+     */
+    resolveReportingConsumerId?: (ctx: HandlerContext<TAccount>, params: Record<string, unknown>) => string | Promise<string>;
     /**
      * Server-level prose surfaced on MCP `initialize`. Two forms:
      *

package/dist/lib/server/create-adcp-server.d.ts

@@ -1398,6 +1398,24 @@ export interface AdcpServerConfig<TAccount = unknown> {
      * the principal is still the authenticated buyer.
      */
     resolveIdempotencyPrincipal?: (ctx: HandlerContext<TAccount>, params: IdempotencyPrincipalParams, toolName: AdcpServerToolName) => string | undefined;
+    /**
+     * Resolve the reporting consumer identity a `sync_reporting_status` receipt
+     * is deposited for — the same identity the receipt handler records under.
+     *
+     * When present it is the replay namespace for that tool. The credential is
+     * not a safe substitute: an adopter may map two operator seats sharing one
+     * OAuth `client_id` to different reporting consumers, and keying replay by
+     * `oauth:<client_id>` then let the second seat be served the first's cached
+     * response and never record its own receipt. Absent this resolver the
+     * framework falls back to the canonical credential identity, which is
+     * correct exactly when the credential *is* the consumer.
+     *
+     * `createAdcpServerFromPlatform` wires this from the reporting platform's
+     * own `resolveConsumerId`, so a service-installed deployment gets it for
+     * free. Called once per dispatched `sync_reporting_status`, in addition to
+     * the receipt handler's own call.
+     */
+    resolveReportingConsumerId?: (ctx: HandlerContext<TAccount>, params: Record<string, unknown>) => string | Promise<string>;
     /**
      * Server-level prose surfaced on MCP `initialize`. Two forms:
      *

package/dist/lib/server/create-adcp-server.js

@@ -298,7 +298,7 @@ function thrownAdcpErrorRecovery(response) {
   }
   return import_error_codes.DEFAULT_UNKNOWN_ERROR_RECOVERY;
 }
-function resolveExtraScope(toolName, params, account, sessionKey, proposalScope, callerMutationScope) {
+function resolveExtraScope(toolName, params, account, sessionKey, proposalScope, callerMutationScope, callerPrincipal) {
   const accountLike = account;
   const accountId = typeof accountLike?.id === "string" ? accountLike.id : typeof accountLike?.account_id === "string" ? accountLike.account_id : void 0;
   const tenantId = typeof accountLike?.tenant_id === "string" ? accountLike.tenant_id : typeof accountLike?.tenantId === "string" ? accountLike.tenantId : void 0;
@@ -309,6 +309,10 @@ function resolveExtraScope(toolName, params, account, sessionKey, proposalScope,
       callerMutationScope.account_id ?? null
     ]);
   }
+  if (toolName === "sync_reporting_status") {
+    if (callerPrincipal === void 0) return void 0;
+    return JSON.stringify([tenantId ?? null, accountId ?? null, callerPrincipal]);
+  }
   if (toolName === "si_send_message") {
     const sessionId = params.session_id;
     return typeof sessionId === "string" && sessionId.length > 0 ? sessionId : void 0;
@@ -467,6 +471,15 @@ function authenticatedPrincipalForContext(authInfo, agent) {
   if (typeof authInfo?.clientId === "string" && authInfo.clientId.length > 0) return `client:${authInfo.clientId}`;
   return void 0;
 }
+function reportingConsumerPrincipalForContext(authInfo, agent) {
+  const credential = authInfo?.credential;
+  if (credential?.kind === "http_sig") return `http_sig:${credential.agent_url}`;
+  if (credential?.kind === "oauth") return `oauth:${credential.client_id}`;
+  if (credential?.kind === "api_key") return `api_key:${credential.key_id}`;
+  if (typeof authInfo?.clientId === "string" && authInfo.clientId.length > 0) return `client:${authInfo.clientId}`;
+  if (agent?.agent_url) return `agent:${agent.agent_url}`;
+  return void 0;
+}
 function taskOwnerScopeForContext(authInfo, sessionKey, agent, accountId) {
   if (sessionKey !== void 0) return `session:${sessionKey}`;
   if (agent?.agent_url) return `agent:${agent.agent_url}`;
@@ -1768,6 +1781,7 @@ function createAdcpServer(config) {
     capabilities: capConfig,
     idempotency: idempotencyConfig,
     resolveIdempotencyPrincipal,
+    resolveReportingConsumerId,
     instructions: instructionsOption,
     onInstructionsError = "skip",
     taskStore,
@@ -2842,6 +2856,37 @@ function createAdcpServer(config) {
             );
           }
         }
+        if (toolName === "sync_reporting_status" && idempotency !== void 0) {
+          const namedByResolver = resolveReportingConsumerId !== void 0;
+          const unidentified = namedByResolver ? ctx.authInfo === void 0 && ctx.agent === void 0 : reportingConsumerPrincipalForContext(ctx.authInfo, ctx.agent) === void 0;
+          if (unidentified) {
+            return finalize(
+              (0, import_errors2.adcpError)("AUTH_MISSING", {
+                message: "sync_reporting_status requires an authenticated caller principal"
+              })
+            );
+          }
+        }
+        let reportingConsumerIdentity;
+        if (toolName === "sync_reporting_status" && idempotency !== void 0 && resolveReportingConsumerId) {
+          try {
+            const resolved = await resolveReportingConsumerId(ctx, params);
+            if (typeof resolved !== "string" || resolved.length === 0 || resolved.length > 255) {
+              throw new Error("resolveReportingConsumerId must return a durable id of 1-255 characters");
+            }
+            reportingConsumerIdentity = resolved;
+          } catch (err) {
+            if (err instanceof import_async_outcome.AdcpError) return finalize(projectThrownAdcpError(err));
+            const reason = err instanceof Error ? err.message : String(err);
+            logger.error("Reporting consumer resolution failed", { tool: toolName, error: reason });
+            return finalize(
+              (0, import_errors2.adcpError)("SERVICE_UNAVAILABLE", {
+                message: "Reporting consumer resolution failed",
+                ...exposeErrorDetails && { details: { reason: (0, import_redact.redactCredentialPatterns)(reason) } }
+              })
+            );
+          }
+        }
         if (CALLER_SCOPED_MUTATION_TOOLS.has(toolName)) {
           if (ctx.authInfo === void 0 && ctx.agent === void 0) {
             return finalize(
@@ -2955,7 +3000,12 @@ function createAdcpServer(config) {
             ctx.account,
             ctx.sessionKey,
             ctx.proposalRefinementScope,
-            ctx.callerMutationScope
+            ctx.callerMutationScope,
+            // The resolved reporting consumer when the deployment can name it,
+            // and otherwise the canonical credential identity, so callers
+            // differing only by credential -- including two behind one
+            // registered buyer agent -- do not share a replay namespace.
+            reportingConsumerIdentity !== void 0 ? `consumer:${reportingConsumerIdentity}` : reportingConsumerPrincipalForContext(ctx.authInfo, ctx.agent)
           );
           const idempotencyPayload = buildIdempotencyPayload(toolName, params, ctx.account, ctx.sessionKey);
           try {