@adcp/sdk 14.0.0-rc.39 → 14.0.0-rc.40

package/dist/lib/supply-path/evaluate.mjs

@@ -0,0 +1,407 @@
+import { resolveAgentProperties } from "../discovery/resolve-agent-properties.mjs";
+import {
+  parsePublisherPropertySelector,
+  expandPublisherPropertySelector
+} from "../discovery/publisher-property-selector.mjs";
+import { MediaChannelValues, PropertyIdentifierTypesValues, PropertyTypeValues } from "../types/enums.generated.mjs";
+import { agentIdentity, domain, record, records, strings } from "./validation.mjs";
+const SUPPLY_PATH_STATES = ["unverified", "owner_attested", "host_delegated", "verified_owner_sold"];
+function parseInventoryPartnerDomains(content) {
+  const partners = /* @__PURE__ */ new Set();
+  for (const line of content.split(/\r?\n/)) {
+    const match = line.trim().match(/^inventorypartnerdomain\s*=\s*([A-Za-z0-9.-]+)\s*(?:#.*)?$/i);
+    const value = match ? domain(match[1]) : null;
+    if (value) partners.add(value);
+  }
+  return [...partners];
+}
+function revoked(manifest, publisher) {
+  if (manifest.revoked_publisher_domains === void 0) return false;
+  if (!Array.isArray(manifest.revoked_publisher_domains)) return true;
+  return manifest.revoked_publisher_domains.some(
+    (item) => !domain(record(item) ? item.publisher_domain : item) || domain(record(item) ? item.publisher_domain : item) === publisher
+  );
+}
+function coversCollection(entry, owner, id) {
+  if (entry.collections === void 0) return true;
+  if (!Array.isArray(entry.collections) || entry.collections.length === 0) return false;
+  if (!entry.collections.every(
+    (selector) => record(selector) && domain(selector.publisher_domain) && (selector.collection_ids === void 0 || strings(selector.collection_ids))
+  ))
+    return false;
+  return entry.collections.some(
+    (selector) => domain(selector.publisher_domain) === owner && (selector.collection_ids === void 0 || id !== void 0 && selector.collection_ids.includes(id))
+  );
+}
+const PROPERTY_TYPES = new Set(PropertyTypeValues);
+const PROPERTY_IDENTIFIER_TYPES = /* @__PURE__ */ new Set([
+  ...PropertyIdentifierTypesValues,
+  // Retained only for the pinned canonical corpus, whose CTV properties use
+  // this distribution identifier in property records.
+  "roku_channel_id"
+]);
+const PROPERTY_CHANNELS = new Set(MediaChannelValues);
+function isPropertyToken(value) {
+  return typeof value === "string" && /^[a-z0-9_]+$/.test(value);
+}
+function isPropertyTokenList(value) {
+  return Array.isArray(value) && value.length > 0 && value.every(isPropertyToken);
+}
+function isOptionalUniqueList(value, valid) {
+  return value === void 0 || Array.isArray(value) && value.every(valid) && new Set(value).size === value.length;
+}
+function isValidPropertyRecord(value) {
+  if (!record(value) || typeof value.property_type !== "string" || !PROPERTY_TYPES.has(value.property_type) || typeof value.name !== "string" || value.name.length === 0 || !Array.isArray(value.identifiers) || value.identifiers.length === 0) {
+    return false;
+  }
+  if (value.property_id !== void 0 && !isPropertyToken(value.property_id)) return false;
+  if (value.publisher_domain !== void 0 && !domain(value.publisher_domain)) return false;
+  if (!isOptionalUniqueList(value.tags, isPropertyToken) || !isOptionalUniqueList(value.supported_channels, (item) => typeof item === "string" && PROPERTY_CHANNELS.has(item))) {
+    return false;
+  }
+  return value.identifiers.every(
+    (identifier) => record(identifier) && typeof identifier.type === "string" && PROPERTY_IDENTIFIER_TYPES.has(identifier.type) && typeof identifier.value === "string" && identifier.value.length > 0
+  );
+}
+function hasPropertyAuthorizationEnvelope(entry) {
+  if (entry.authorization_type === "property_ids") return isPropertyTokenList(entry.property_ids);
+  if (entry.authorization_type === "property_tags") return isPropertyTokenList(entry.property_tags);
+  if (entry.authorization_type === "inline_properties") {
+    return Array.isArray(entry.properties) && entry.properties.length > 0 && entry.properties.every(isValidPropertyRecord);
+  }
+  if (entry.authorization_type === "publisher_properties") {
+    if (!Array.isArray(entry.publisher_properties) || entry.publisher_properties.length === 0 || !entry.publisher_properties.every(record)) {
+      return false;
+    }
+    try {
+      for (const raw of entry.publisher_properties) {
+        const selector = parsePublisherPropertySelector(raw);
+        const value = raw;
+        if (selector.selection_type === "by_id" && (!isPropertyTokenList(value.property_ids) || value.property_tags !== void 0) || selector.selection_type === "by_tag" && (!isPropertyTokenList(value.property_tags) || value.property_ids !== void 0) || selector.selection_type === "all" && (value.property_ids !== void 0 || value.property_tags !== void 0)) {
+          return false;
+        }
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function propertyScope(entry, host, manifest, requirePublisher = false) {
+  if (revoked(manifest, host)) return /* @__PURE__ */ new Set();
+  if (!["property_ids", "property_tags", "publisher_properties", "inline_properties"].includes(
+    String(entry.authorization_type)
+  ))
+    return /* @__PURE__ */ new Set();
+  if (entry.authorization_type === "publisher_properties") {
+    if (!Array.isArray(entry.publisher_properties) || entry.publisher_properties.length === 0) return /* @__PURE__ */ new Set();
+    const properties = records(manifest.properties).filter(
+      (p) => isValidPropertyRecord(p) && (p.publisher_domain === void 0 && !requirePublisher || domain(p.publisher_domain) === host)
+    );
+    const ids = /* @__PURE__ */ new Set();
+    try {
+      for (const raw of entry.publisher_properties) {
+        const selector = parsePublisherPropertySelector(raw);
+        if ("property_ids" in selector && !strings(selector.property_ids)) return /* @__PURE__ */ new Set();
+        if ("property_tags" in selector && !strings(selector.property_tags)) return /* @__PURE__ */ new Set();
+        for (const single of expandPublisherPropertySelector(selector)) {
+          if (domain(single.publisher_domain) !== host) continue;
+          for (const property of properties) {
+            if (typeof property.property_id !== "string") continue;
+            if (single.selection_type === "all" || single.selection_type === "by_id" && single.property_ids.includes(property.property_id) || single.selection_type === "by_tag" && strings(property.tags) && property.tags.some((t) => single.property_tags.includes(t))) {
+              ids.add(property.property_id);
+            }
+          }
+        }
+      }
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+    return ids;
+  }
+  if (entry.authorization_type === "property_ids" && !strings(entry.property_ids)) return /* @__PURE__ */ new Set();
+  if (entry.authorization_type === "property_tags" && !strings(entry.property_tags)) return /* @__PURE__ */ new Set();
+  if (manifest.properties !== void 0 && (!Array.isArray(manifest.properties) || !manifest.properties.every(record)))
+    return /* @__PURE__ */ new Set();
+  if (entry.authorization_type === "inline_properties" && (!Array.isArray(entry.properties) || !entry.properties.every(record)))
+    return /* @__PURE__ */ new Set();
+  const result = resolveAgentProperties(
+    { ...manifest, authorized_agents: [entry] },
+    String(entry.url)
+  );
+  return new Set(
+    result.properties.filter(
+      (p) => isValidPropertyRecord(p) && (p.publisher_domain === void 0 && !requirePublisher || domain(p.publisher_domain) === host)
+    ).map((p) => p.property_id).filter((id) => typeof id === "string" && id.length > 0)
+  );
+}
+function isUnqualifiedPropertySelector(value) {
+  return record(value) && Object.keys(value).every(
+    (key) => ["publisher_domain", "publisher_domains", "selection_type", "property_ids", "property_tags"].includes(key)
+  );
+}
+function hasValidPropertySelectorPredicate(value) {
+  if (!isUnqualifiedPropertySelector(value)) return false;
+  try {
+    const selector = parsePublisherPropertySelector(value);
+    const raw = value;
+    if (selector.selection_type === "by_id")
+      return isPropertyTokenList(raw.property_ids) && raw.property_tags === void 0;
+    if (selector.selection_type === "by_tag")
+      return isPropertyTokenList(raw.property_tags) && raw.property_ids === void 0;
+    return raw.property_ids === void 0 && raw.property_tags === void 0;
+  } catch {
+    return false;
+  }
+}
+const UNDERSTOOD_GRANT_FIELDS = /* @__PURE__ */ new Set([
+  "url",
+  "authorized_for",
+  "authorization_type",
+  "property_ids",
+  "property_tags",
+  "properties",
+  "publisher_properties",
+  "collections",
+  "delegation_type",
+  "exclusive",
+  "signing_keys",
+  "encryption_keys",
+  "last_updated"
+]);
+function unsupportedConstraints(entry) {
+  const unknown = Object.keys(entry).filter((key) => !UNDERSTOOD_GRANT_FIELDS.has(key));
+  for (const selector of records(entry.collections)) {
+    unknown.push(
+      ...Object.keys(selector).filter((key) => !["publisher_domain", "collection_ids"].includes(key)).map((key) => `collections[].${key}`)
+    );
+  }
+  for (const selector of records(entry.publisher_properties)) {
+    unknown.push(
+      ...Object.keys(selector).filter(
+        (key) => !["publisher_domain", "publisher_domains", "selection_type", "property_ids", "property_tags"].includes(key)
+      ).map((key) => `publisher_properties[].${key}`)
+    );
+  }
+  return unknown;
+}
+function nodeCost(value) {
+  const stack = [value];
+  let cost = 0;
+  while (stack.length) {
+    const item = stack.pop();
+    if (++cost > 32768) return Infinity;
+    if (typeof item === "string" && item.length > 8192) return Infinity;
+    if (Array.isArray(item)) {
+      if (item.length > 1024) return Infinity;
+      stack.push(...item);
+    } else if (record(item)) {
+      const values = Object.values(item);
+      if (values.length > 1024) return Infinity;
+      stack.push(...values);
+    }
+  }
+  return cost;
+}
+function evaluationLimitVerdict() {
+  const failure = { ok: false, failure: "evaluation_limit_exceeded" };
+  return {
+    semantics_version: "1",
+    state: "unverified",
+    legs: {
+      owner_collection_declared: { ...failure },
+      owner_distribution_carriage: { ...failure },
+      owner_agent_declared: { ...failure },
+      host_authorization: { ...failure },
+      inventory_partner_domain: { ...failure }
+    }
+  };
+}
+function evaluateSupplyPath(input) {
+  const total = nodeCost(input);
+  if (!Number.isFinite(total)) return evaluationLimitVerdict();
+  const grants = nodeCost(input.hostManifest?.authorized_agents);
+  const properties = nodeCost(input.hostManifest?.properties);
+  const collections = records(input.ownerManifest?.collections).length;
+  if (!Number.isFinite(total) || grants * properties + Math.max(1, collections) * total * 4 > 4e6) {
+    return evaluationLimitVerdict();
+  }
+  if (input.collectionId === void 0) {
+    const collections2 = records(input.ownerManifest?.collections).filter(
+      (c) => typeof c.collection_id === "string" && c.collection_id.length > 0
+    );
+    if (collections2.length) {
+      const verdicts = collections2.map((c) => evaluateSupplyPath({ ...input, collectionId: c.collection_id }));
+      return verdicts.reduce(
+        (best, next) => SUPPLY_PATH_STATES.indexOf(next.state) > SUPPLY_PATH_STATES.indexOf(best.state) ? next : best
+      );
+    }
+  }
+  const owner = domain(input.ownerDomain);
+  const host = domain(input.hostDomain);
+  const agent = agentIdentity(input.agentUrl);
+  const ownerManifest = record(input.ownerManifest) ? input.ownerManifest : null;
+  const hostManifest = record(input.hostManifest) ? input.hostManifest : null;
+  const isRevoked = (role, publisher) => {
+    const manifest = role === "owner" ? ownerManifest : hostManifest;
+    return manifest !== null && revoked(manifest, publisher) || (input.heldRevocations?.[role] ?? []).some((value) => domain(value) === publisher);
+  };
+  const collectionLeg = { ok: false };
+  const declared = records(ownerManifest?.collections).filter(
+    (c) => c.publisher_domain === void 0 && !input.requireExplicitOwnerPublisherDomain || domain(c.publisher_domain) === owner
+  );
+  const targets = declared.filter((c) => c.collection_id === input.collectionId && typeof c.collection_id === "string");
+  if (!ownerManifest) collectionLeg.failure = "manifest_not_found";
+  else if (owner && isRevoked("owner", owner)) collectionLeg.failure = "publisher_revoked";
+  else if (!input.collectionId && !declared.length) collectionLeg.failure = "no_collections_declared";
+  else if (!owner || !input.collectionId?.trim() || targets.length !== 1) {
+    collectionLeg.failure = "collection_not_declared";
+    collectionLeg.detail = `owner declares ${declared.length} collection(s); none has an unambiguous collection_id "${input.collectionId}"`;
+  } else {
+    collectionLeg.ok = true;
+    if (typeof targets[0].kind === "string") collectionLeg.detail = `kind: ${targets[0].kind}`;
+  }
+  const carriage = { ok: false };
+  const entries = collectionLeg.ok ? records(targets[0].distribution).filter((e) => domain(e.publisher_domain) === host) : [];
+  let claimed = [];
+  if (!collectionLeg.ok) carriage.failure = "collection_leg_failed";
+  else if (!host || !entries.length) carriage.failure = "no_distribution_for_host";
+  else {
+    const valid = entries.every(
+      (e) => Object.keys(e).every((key) => ["publisher_domain", "property_ids", "identifiers"].includes(key)) && (e.property_ids === void 0 || strings(e.property_ids)) && (e.identifiers === void 0 || Array.isArray(e.identifiers) && e.identifiers.length > 0 && e.identifiers.every(
+        (i) => record(i) && typeof i.type === "string" && i.type.length > 0 && typeof i.value === "string" && i.value.length > 0
+      )) && (e.property_ids !== void 0 || e.identifiers !== void 0)
+    );
+    claimed = [...new Set(entries.flatMap((e) => strings(e.property_ids) ? e.property_ids : []))];
+    if (!valid) {
+      carriage.failure = "property_ids_unresolved";
+      carriage.detail = "Malformed distribution constraints";
+    } else if (!claimed.length) {
+      carriage.ok = true;
+      carriage.detail = "carriage asserted without host property_ids (identifiers only)";
+    } else if (!hostManifest) {
+      carriage.failure = "host_manifest_not_found";
+      carriage.property_ids_unmatched = claimed;
+    } else {
+      const properties2 = records(hostManifest.properties).filter(
+        (p) => isValidPropertyRecord(p) && (p.publisher_domain === void 0 && !input.requireExplicitHostPublisherDomain || domain(p.publisher_domain) === host)
+      );
+      const counts = /* @__PURE__ */ new Map();
+      for (const property of properties2) counts.set(property.property_id, (counts.get(property.property_id) ?? 0) + 1);
+      const known = new Set([...counts].filter(([, count]) => count === 1).map(([id]) => id));
+      carriage.property_ids_matched = claimed.filter((id) => known.has(id));
+      carriage.property_ids_unmatched = claimed.filter((id) => !known.has(id));
+      carriage.ok = carriage.property_ids_unmatched.length === 0;
+      if (!carriage.ok) carriage.failure = "property_ids_unresolved";
+    }
+  }
+  const ownerAgent = !ownerManifest ? { ok: false, failure: "manifest_not_found" } : agent && records(ownerManifest.authorized_agents).some(
+    (e) => agentIdentity(e.url) === agent && owner && hasPropertyAuthorizationEnvelope(e) && (!input.requireExplicitOwnerPublisherDomain || e.collections !== void 0) && coversCollection(e, owner, input.collectionId) && !unsupportedConstraints(e).length
+  ) ? { ok: true } : { ok: false, failure: "agent_not_declared_by_owner" };
+  const hostLeg = { ok: false };
+  if (!hostManifest) hostLeg.failure = "manifest_not_found";
+  else {
+    const agents = agent ? records(hostManifest.authorized_agents).filter((e) => agentIdentity(e.url) === agent) : [];
+    const covered = owner && !isRevoked("host", owner) && !(host && isRevoked("owner", host)) ? agents.filter((e) => e.collections !== void 0 && coversCollection(e, owner, input.collectionId)) : [];
+    if (!agents.length) hostLeg.failure = "no_agent_entry";
+    else if (!covered.length) hostLeg.failure = "collection_scope_mismatch";
+    else {
+      const matched = host && !isRevoked("host", host) && carriage.ok && collectionLeg.ok && covered.find((e) => {
+        if (!hasPropertyAuthorizationEnvelope(e) || unsupportedConstraints(e).length) return false;
+        const scope = propertyScope(e, host, hostManifest, input.requireExplicitHostPublisherDomain);
+        const required = input.requiredHostPropertyIds ?? claimed;
+        if (input.requiredHostPropertyIds && (!required.length || claimed.length && !required.every((id) => claimed.includes(id))))
+          return false;
+        if (!claimed.length) return false;
+        return required.length ? required.every((id) => scope.has(id)) : scope.size > 0;
+      });
+      if (!matched) {
+        const constraints = [...new Set(covered.flatMap(unsupportedConstraints))].sort();
+        hostLeg.failure = covered.every((e) => unsupportedConstraints(e).length) ? "unsupported_constraints" : "property_scope_mismatch";
+        hostLeg.detail = constraints.length ? `Unevaluated grant fields: ${constraints.join(", ")}` : "No grant proves the complete carried property scope";
+      } else {
+        hostLeg.ok = true;
+        hostLeg.matched_entry = {
+          url: String(matched.url),
+          ...typeof matched.authorization_type === "string" ? { authorization_type: matched.authorization_type } : {},
+          ...typeof matched.delegation_type === "string" ? { delegation_type: matched.delegation_type } : {},
+          ...Array.isArray(matched.collections) ? {
+            collections: matched.collections.map((s) => ({
+              publisher_domain: String(s.publisher_domain),
+              ...s.collection_ids !== void 0 ? { collection_ids: [...s.collection_ids] } : {}
+            }))
+          } : {}
+        };
+      }
+    }
+  }
+  const partners = input.hostInventoryPartnerDomainsByFile ? inventoryPartnersForInput(input) : input.hostInventoryPartnerDomains;
+  const partner = input.inventoryPartnerDomainEvaluated === false ? { ok: false, failure: "not_evaluated" } : partners === null ? { ok: false, failure: "ads_txt_unavailable" } : owner && partners.some((d) => domain(d) === owner) ? { ok: true } : { ok: false, failure: "not_declared" };
+  const attested = collectionLeg.ok && entries.length > 0;
+  const state = hostLeg.ok && collectionLeg.ok && carriage.ok ? "verified_owner_sold" : partner.ok && ownerAgent.ok && collectionLeg.ok && !(owner && isRevoked("host", owner) || host && isRevoked("host", host)) && !(host && isRevoked("owner", host)) ? "host_delegated" : attested ? "owner_attested" : "unverified";
+  return {
+    semantics_version: "1",
+    ...collectionLeg.ok ? { resolved_collection_id: input.collectionId } : {},
+    state,
+    legs: {
+      owner_collection_declared: collectionLeg,
+      owner_distribution_carriage: carriage,
+      owner_agent_declared: ownerAgent,
+      host_authorization: hostLeg,
+      inventory_partner_domain: partner
+    }
+  };
+}
+function supplyPathAdsTxtPolicy(input) {
+  if (input.collectionId === void 0) {
+    const candidates = records(input.ownerManifest?.collections).filter(
+      (c) => typeof c.collection_id === "string" && c.collection_id.length > 0
+    );
+    if (candidates.length) {
+      const policies = candidates.map((c) => supplyPathAdsTxtPolicy({ ...input, collectionId: String(c.collection_id) }));
+      return { files: [...new Set(policies.flatMap((policy) => policy.files))].sort(), requireAll: false };
+    }
+  }
+  const collectionIds = new Set(
+    records(input.ownerManifest?.collections).filter((c) => input.collectionId === void 0 || c.collection_id === input.collectionId).flatMap(
+      (c) => records(c.distribution).filter((d) => domain(d.publisher_domain) === domain(input.hostDomain)).flatMap((d) => strings(d.property_ids) ? d.property_ids : [])
+    )
+  );
+  const requested = input.requiredHostPropertyIds ? new Set(input.requiredHostPropertyIds) : collectionIds;
+  const properties = records(input.hostManifest?.properties).filter(
+    (p) => requested.has(String(p.property_id)) && (p.publisher_domain === void 0 && !input.requireExplicitHostPublisherDomain || domain(p.publisher_domain) === domain(input.hostDomain))
+  );
+  const files = /* @__PURE__ */ new Set();
+  for (const property of properties) {
+    if (property.property_type === "website") files.add("ads.txt");
+    if (property.property_type === "mobile_app" || property.property_type === "ctv_app") files.add("app-ads.txt");
+  }
+  if (!input.hostManifest || !properties.length) return { files: ["app-ads.txt", "ads.txt"], requireAll: false };
+  return { files: [...files].sort(), requireAll: true };
+}
+function combineInventoryPartnerDomains(contents, requireAll) {
+  if (!contents.length || requireAll && contents.some((c) => c === null)) return null;
+  const fetched = contents.filter((c) => c !== null).map(parseInventoryPartnerDomains);
+  if (!fetched.length) return null;
+  return requireAll ? fetched[0].filter((d) => fetched.every((domains) => domains.includes(d))) : [...new Set(fetched.flat())];
+}
+function inventoryPartnersForInput(input) {
+  const policy = supplyPathAdsTxtPolicy(input);
+  const values = policy.files.map((file) => input.hostInventoryPartnerDomainsByFile?.[file] ?? null);
+  if (!values.length || policy.requireAll && values.some((value) => value === null)) return null;
+  const fetched = values.filter((value) => value !== null);
+  if (!fetched.length) return null;
+  return policy.requireAll ? fetched[0].filter((domain2) => fetched.every((value) => value.includes(domain2))) : [...new Set(fetched.flat())];
+}
+export {
+  SUPPLY_PATH_STATES,
+  combineInventoryPartnerDomains,
+  evaluateSupplyPath,
+  evaluationLimitVerdict,
+  hasValidPropertySelectorPredicate,
+  inventoryPartnersForInput,
+  isUnqualifiedPropertySelector,
+  parseInventoryPartnerDomains,
+  supplyPathAdsTxtPolicy
+};

package/dist/lib/supply-path/fetch-evidence.d.mts

@@ -0,0 +1,36 @@
+import { type SsrfFetchResult } from '../net/ssrf-fetch.mjs';
+import type { AuthoritativeSupplyPathOptions, SupplyPathEvidence, SupplyPathManifest } from './types.mjs';
+import { type SupplyPathRevocation } from './revocations.mjs';
+export declare function boundedOption(value: number | undefined, fallback: number, maximum: number, name: string): number;
+/** A verification-local evidence session. No cached verdict survives a request. */
+export declare class SupplyPathEvidenceSession {
+    private readonly options;
+    readonly evidence: SupplyPathEvidence[];
+    readonly crossOriginAuthorities: Set<string>;
+    private readonly observedRevocations;
+    readonly revocations: Map<string, readonly SupplyPathRevocation[]>;
+    readonly signal: AbortSignal;
+    private readonly maxBodyBytes;
+    private readonly timeoutMs;
+    private readonly deadlineAt;
+    private readonly timer;
+    private readonly controller;
+    private readonly abort;
+    private readonly responses;
+    private readonly provenance;
+    private observedBytes;
+    private readonly documents;
+    constructor(options: AuthoritativeSupplyPathOptions);
+    close(): void;
+    /** Enforce the absolute deadline even while synchronous evidence evaluation blocks timer delivery. */
+    assertActive(): void;
+    adagents(publisher: string): Promise<SupplyPathManifest | null>;
+    read(publisher: string, kind: SupplyPathEvidence['kind'], url: string, pointer?: boolean): Promise<SsrfFetchResult | null>;
+    private fetchEvidence;
+    private parseManifest;
+    private documentError;
+    private readAdagents;
+    private checkAuthority;
+    private readAndRemember;
+    private rememberRevocations;
+}

package/dist/lib/supply-path/fetch-evidence.d.ts

@@ -0,0 +1,36 @@
+import { type SsrfFetchResult } from '../net/ssrf-fetch';
+import type { AuthoritativeSupplyPathOptions, SupplyPathEvidence, SupplyPathManifest } from './types';
+import { type SupplyPathRevocation } from './revocations';
+export declare function boundedOption(value: number | undefined, fallback: number, maximum: number, name: string): number;
+/** A verification-local evidence session. No cached verdict survives a request. */
+export declare class SupplyPathEvidenceSession {
+    private readonly options;
+    readonly evidence: SupplyPathEvidence[];
+    readonly crossOriginAuthorities: Set<string>;
+    private readonly observedRevocations;
+    readonly revocations: Map<string, readonly SupplyPathRevocation[]>;
+    readonly signal: AbortSignal;
+    private readonly maxBodyBytes;
+    private readonly timeoutMs;
+    private readonly deadlineAt;
+    private readonly timer;
+    private readonly controller;
+    private readonly abort;
+    private readonly responses;
+    private readonly provenance;
+    private observedBytes;
+    private readonly documents;
+    constructor(options: AuthoritativeSupplyPathOptions);
+    close(): void;
+    /** Enforce the absolute deadline even while synchronous evidence evaluation blocks timer delivery. */
+    assertActive(): void;
+    adagents(publisher: string): Promise<SupplyPathManifest | null>;
+    read(publisher: string, kind: SupplyPathEvidence['kind'], url: string, pointer?: boolean): Promise<SsrfFetchResult | null>;
+    private fetchEvidence;
+    private parseManifest;
+    private documentError;
+    private readAdagents;
+    private checkAuthority;
+    private readAndRemember;
+    private rememberRevocations;
+}