@adcp/sdk 14.4.0 → 15.2.0

package/dist/lib/reporting/ledger/managed-postgres.js

@@ -26,6 +26,7 @@ var import_node_crypto = require("node:crypto");
 var import_jcs = require('../../utils/jcs.js');
 var import_evidence = require('../evidence.js');
 var import_types = require('./types.js');
+var import_object_writes = require('./object-writes.js');
 var import_managed = require('./managed.js');
 const REPORTING_MANAGED_DELIVERY_MIGRATION = `
 CREATE TABLE IF NOT EXISTS adcp_reporting_destination_authorizations (
@@ -1522,6 +1523,231 @@ class PostgresReportingManagedDeliveryStore {
     const row = result.rows[0];
     return row ? { materialization: structuredClone(row.materialization), binding: structuredClone(row.binding) } : null;
   }
+  /** Freeze all writable names under the same locks as revokeDestination. */
+  async registerObjectWritePlan(input, context = {}) {
+    const plan = structuredClone(input);
+    const fingerprint = (0, import_object_writes.reportingObjectWritePlanFingerprint)(plan);
+    return this.transaction(async (client) => {
+      await advisoryLock(client, accountLock(plan.account_id));
+      await advisoryLock(client, authLock(plan.account_id, plan.destination_ref));
+      const authorized = await client.query(
+        `SELECT 1 FROM adcp_reporting_destination_authorizations
+         WHERE account_id = $1 AND destination_ref = $2 AND generation = $3 AND revoked_at IS NULL`,
+        [plan.account_id, plan.destination_ref, plan.generation]
+      );
+      if (!authorized.rowCount) return "revoked";
+      await client.query(
+        `INSERT INTO adcp_reporting_object_write_bindings (account_id,destination_ref,generation,bucket,namespace_key)
+         VALUES ($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`,
+        [plan.account_id, plan.destination_ref, plan.generation, plan.provider.bucket, plan.provider.namespace_key]
+      );
+      const binding = await client.query(
+        `SELECT bucket,namespace_key FROM adcp_reporting_object_write_bindings
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3`,
+        [plan.account_id, plan.destination_ref, plan.generation]
+      );
+      if (binding.rows[0]?.bucket !== plan.provider.bucket || binding.rows[0]?.namespace_key !== plan.provider.namespace_key)
+        throw new import_object_writes.ReportingObjectWriteConflictError();
+      const inserted = await client.query(
+        `INSERT INTO adcp_reporting_object_write_plans (account_id, destination_ref, generation, plan_id, fingerprint)
+         VALUES ($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`,
+        [plan.account_id, plan.destination_ref, plan.generation, plan.plan_id, fingerprint]
+      );
+      if (!inserted.rowCount) {
+        const existing = await client.query(
+          `SELECT fingerprint FROM adcp_reporting_object_write_plans
+           WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4`,
+          [plan.account_id, plan.destination_ref, plan.generation, plan.plan_id]
+        );
+        if (existing.rows[0]?.fingerprint !== fingerprint) throw new import_object_writes.ReportingObjectWriteConflictError();
+        return "unchanged";
+      }
+      await client.query(
+        `INSERT INTO adcp_reporting_object_writes
+         (account_id,destination_ref,generation,plan_id,object_index,bucket,object_name,sha256,size_bytes)
+         SELECT $1,$2,$3,$4,(ordinality-1)::integer,value->>'bucket',value->>'object_name',value->>'sha256',
+           (value->>'size_bytes')::bigint FROM jsonb_array_elements($5::jsonb) WITH ORDINALITY`,
+        [
+          plan.account_id,
+          plan.destination_ref,
+          plan.generation,
+          plan.plan_id,
+          JSON.stringify(
+            plan.objects.map(({ bucket, object_name, sha256, size_bytes }) => ({
+              bucket,
+              object_name,
+              sha256,
+              size_bytes
+            }))
+          )
+        ]
+      );
+      return "registered";
+    }, context.signal);
+  }
+  async listRevokedObjectWrites(inputScope, inputOptions = {}, context = {}) {
+    const scope = structuredClone(inputScope);
+    const options = structuredClone(inputOptions);
+    (0, import_object_writes.assertReportingObjectWriteScope)(scope);
+    const limit = options.limit ?? 100;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e3 || options.after && (!/^[a-f0-9]{64}$/.test(options.after.plan_id) || !Number.isSafeInteger(options.after.object_index) || options.after.object_index < 0 || options.after.object_index >= 128)) {
+      throw new Error("Invalid reporting object-write page");
+    }
+    return this.transaction(async (client) => {
+      await advisoryLock(client, accountLock(scope.account_id));
+      await advisoryLock(client, authLock(scope.account_id, scope.destination_ref));
+      const revoked = await client.query(
+        `SELECT 1 FROM adcp_reporting_destination_authorizations
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND revoked_at IS NOT NULL`,
+        [scope.account_id, scope.destination_ref, scope.generation]
+      );
+      if (!revoked.rowCount) throw new import_object_writes.ReportingObjectWriteNotRevokedError();
+      const rows = await client.query(
+        `SELECT plan_id,object_index,bucket,object_name,sha256,size_bytes::float8 AS size_bytes
+         FROM adcp_reporting_object_writes WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND fenced_at IS NULL
+         AND ($4::text IS NULL OR (plan_id,object_index) > ($4,$5::integer))
+         ORDER BY plan_id,object_index LIMIT $6`,
+        [
+          scope.account_id,
+          scope.destination_ref,
+          scope.generation,
+          options.after?.plan_id ?? null,
+          options.after?.object_index ?? null,
+          limit
+        ]
+      );
+      return rows.rows;
+    }, context.signal);
+  }
+  async markObjectWriteFenced(input, context = {}) {
+    const frozen = structuredClone(input);
+    (0, import_object_writes.assertReportingObjectWriteScope)(frozen);
+    if (!/^[a-f0-9]{64}$/.test(frozen.plan_id) || !Number.isSafeInteger(frozen.object_index) || frozen.object_index < 0 || frozen.object_index >= 128 || !/^[1-9][0-9]{0,39}$/.test(frozen.tombstone_generation)) {
+      throw new Error("Invalid reporting object-write fence");
+    }
+    await this.transaction(async (client) => {
+      await advisoryLock(client, accountLock(frozen.account_id));
+      await advisoryLock(client, authLock(frozen.account_id, frozen.destination_ref));
+      const updated = await client.query(
+        `UPDATE adcp_reporting_object_writes object SET fenced_at=COALESCE(fenced_at,clock_timestamp()), tombstone_generation=$6
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4 AND object_index=$5
+         AND (tombstone_generation IS NULL OR tombstone_generation=$6)
+         AND EXISTS (SELECT 1 FROM adcp_reporting_destination_authorizations authz
+           WHERE authz.account_id=object.account_id AND authz.destination_ref=object.destination_ref
+           AND authz.generation=object.generation AND authz.revoked_at IS NOT NULL)`,
+        [
+          frozen.account_id,
+          frozen.destination_ref,
+          frozen.generation,
+          frozen.plan_id,
+          frozen.object_index,
+          frozen.tombstone_generation
+        ]
+      );
+      if (updated.rowCount !== 1) throw new Error("Reporting object-write fence is not eligible");
+    }, context.signal);
+  }
+  async getObjectWriteBinding(input, context = {}) {
+    const scope = structuredClone(input);
+    (0, import_object_writes.assertReportingObjectWriteScope)(scope);
+    return this.transaction(async (client) => {
+      await advisoryLock(client, accountLock(scope.account_id));
+      await advisoryLock(client, authLock(scope.account_id, scope.destination_ref));
+      const revoked = await client.query(
+        `SELECT 1 FROM adcp_reporting_destination_authorizations
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND revoked_at IS NOT NULL`,
+        [scope.account_id, scope.destination_ref, scope.generation]
+      );
+      if (!revoked.rowCount) throw new import_object_writes.ReportingObjectWriteNotRevokedError();
+      const binding = await client.query(
+        `SELECT bucket,namespace_key FROM adcp_reporting_object_write_bindings
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3`,
+        [scope.account_id, scope.destination_ref, scope.generation]
+      );
+      return binding.rows[0] ?? null;
+    }, context.signal);
+  }
+  async probeObjectWriteAuthority(context = {}) {
+    await this.transaction(async (client) => {
+      await client.query(
+        `SELECT installation_id,schema_version FROM adcp_reporting_object_write_authority WHERE singleton AND schema_version=1`
+      );
+      await client.query(
+        `SELECT account_id,destination_ref,generation,bucket,namespace_key FROM adcp_reporting_object_write_bindings LIMIT 0`
+      );
+      await client.query(
+        `SELECT account_id,destination_ref,generation,plan_id,fingerprint FROM adcp_reporting_object_write_plans LIMIT 0`
+      );
+      await client.query(
+        `SELECT plan_id,object_index,bucket,object_name,sha256,size_bytes,fenced_at,tombstone_generation FROM adcp_reporting_object_writes LIMIT 0`
+      );
+    }, context.signal);
+    await this.getObjectWriteAuthorityId(context);
+    return true;
+  }
+  async getObjectWriteAuthorityId(context = {}) {
+    return this.transaction(async (client) => {
+      const result = await client.query(
+        `SELECT installation_id::text FROM adcp_reporting_object_write_authority WHERE singleton AND schema_version=1`
+      );
+      const id = result.rows[0]?.installation_id;
+      if (result.rowCount !== 1 || !id || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(id))
+        throw new Error("Reporting object-write authority migration is unavailable");
+      return id;
+    }, context.signal);
+  }
+  async getAuthorizedObjectWriteBinding(input, context = {}) {
+    const scope = {
+      account_id: input.account_id,
+      destination_ref: input.destination_ref,
+      generation: input.generation
+    };
+    (0, import_object_writes.assertReportingObjectWriteScope)(scope);
+    return this.transaction(async (client) => {
+      const result = await client.query(
+        `SELECT binding.bucket,binding.namespace_key FROM adcp_reporting_object_write_bindings binding
+         JOIN adcp_reporting_destination_authorizations authz USING (account_id,destination_ref,generation)
+         WHERE binding.account_id=$1 AND binding.destination_ref=$2 AND binding.generation=$3 AND authz.revoked_at IS NULL`,
+        [scope.account_id, scope.destination_ref, scope.generation]
+      );
+      return result.rows[0] ?? null;
+    }, context.signal);
+  }
+  async getObjectWritePlan(input, planId, context = {}) {
+    const scope = {
+      account_id: input.account_id,
+      destination_ref: input.destination_ref,
+      generation: input.generation
+    };
+    (0, import_object_writes.assertReportingObjectWriteScope)(scope);
+    if (typeof planId !== "string" || !/^[a-f0-9]{64}$/.test(planId))
+      throw new Error("Invalid reporting object-write plan identity");
+    return this.transaction(async (client) => {
+      const selected = await client.query(
+        `SELECT binding.bucket,binding.namespace_key,plan.fingerprint FROM adcp_reporting_object_write_plans plan
+         JOIN adcp_reporting_object_write_bindings binding USING (account_id,destination_ref,generation)
+         JOIN adcp_reporting_destination_authorizations authz USING (account_id,destination_ref,generation)
+         WHERE plan.account_id=$1 AND plan.destination_ref=$2 AND plan.generation=$3 AND plan.plan_id=$4 AND authz.revoked_at IS NULL`,
+        [scope.account_id, scope.destination_ref, scope.generation, planId]
+      );
+      if (!selected.rows[0]) return null;
+      const selectedBinding = selected.rows[0];
+      const objects = await client.query(
+        `SELECT bucket,object_name,sha256,size_bytes::float8 AS size_bytes FROM adcp_reporting_object_writes
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4 ORDER BY object_index`,
+        [scope.account_id, scope.destination_ref, scope.generation, planId]
+      );
+      const plan = {
+        ...scope,
+        plan_id: planId,
+        provider: { bucket: selectedBinding.bucket, namespace_key: selectedBinding.namespace_key },
+        objects: objects.rows
+      };
+      if ((0, import_object_writes.reportingObjectWritePlanFingerprint)(plan) !== selectedBinding.fingerprint)
+        throw new import_object_writes.ReportingObjectWriteConflictError();
+      return plan;
+    }, context.signal);
+  }
   async isAuthorizationCurrent(input) {
     const result = await this.query(
       `SELECT 1 FROM adcp_reporting_destination_authorizations
@@ -1822,7 +2048,8 @@ class PostgresReportingManagedDeliveryStore {
     );
     return result.rows[0] ? { subjectId: receipt.reporting_adjustment_id, adjustment: result.rows[0].adjustment } : null;
   }
-  async transaction(body) {
+  async transaction(body, signal) {
+    signal?.throwIfAborted();
     let client;
     try {
       client = await this.pool.connect();
@@ -1832,9 +2059,23 @@ class PostgresReportingManagedDeliveryStore {
     let releaseError;
     let transactionStarted = false;
     try {
+      signal?.throwIfAborted();
       await client.query("BEGIN");
       transactionStarted = true;
-      const value = await body(client);
+      if (signal) await client.query("SET LOCAL lock_timeout = '5s'; SET LOCAL statement_timeout = '10s'");
+      const guarded = signal ? {
+        query: async (sql, values) => {
+          signal.throwIfAborted();
+          const result = await client.query(sql, values);
+          signal.throwIfAborted();
+          return result;
+        },
+        release: () => {
+          throw new Error("Transaction body cannot release connection");
+        }
+      } : client;
+      const value = await body(guarded);
+      signal?.throwIfAborted();
       await client.query("COMMIT");
       return value;
     } catch (cause) {

package/dist/lib/reporting/ledger/managed-postgres.mjs

@@ -2,6 +2,12 @@ import { createHash, randomUUID } from "node:crypto";
 import { canonicalize } from "../../utils/jcs.mjs";
 import { isReportingAdjustmentReceiptEvidence, isReportingReceiptEvidence } from "../evidence.mjs";
 import { REPORTING_LEDGER_AUTHORITY } from "./types.mjs";
+import {
+  assertReportingObjectWriteScope,
+  reportingObjectWritePlanFingerprint,
+  ReportingObjectWriteConflictError,
+  ReportingObjectWriteNotRevokedError
+} from "./object-writes.mjs";
 import {
   adjustmentReceiptEvidenceMatches,
   assertMaterializationOutcome,
@@ -1502,6 +1508,231 @@ class PostgresReportingManagedDeliveryStore {
     const row = result.rows[0];
     return row ? { materialization: structuredClone(row.materialization), binding: structuredClone(row.binding) } : null;
   }
+  /** Freeze all writable names under the same locks as revokeDestination. */
+  async registerObjectWritePlan(input, context = {}) {
+    const plan = structuredClone(input);
+    const fingerprint = reportingObjectWritePlanFingerprint(plan);
+    return this.transaction(async (client) => {
+      await advisoryLock(client, accountLock(plan.account_id));
+      await advisoryLock(client, authLock(plan.account_id, plan.destination_ref));
+      const authorized = await client.query(
+        `SELECT 1 FROM adcp_reporting_destination_authorizations
+         WHERE account_id = $1 AND destination_ref = $2 AND generation = $3 AND revoked_at IS NULL`,
+        [plan.account_id, plan.destination_ref, plan.generation]
+      );
+      if (!authorized.rowCount) return "revoked";
+      await client.query(
+        `INSERT INTO adcp_reporting_object_write_bindings (account_id,destination_ref,generation,bucket,namespace_key)
+         VALUES ($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`,
+        [plan.account_id, plan.destination_ref, plan.generation, plan.provider.bucket, plan.provider.namespace_key]
+      );
+      const binding = await client.query(
+        `SELECT bucket,namespace_key FROM adcp_reporting_object_write_bindings
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3`,
+        [plan.account_id, plan.destination_ref, plan.generation]
+      );
+      if (binding.rows[0]?.bucket !== plan.provider.bucket || binding.rows[0]?.namespace_key !== plan.provider.namespace_key)
+        throw new ReportingObjectWriteConflictError();
+      const inserted = await client.query(
+        `INSERT INTO adcp_reporting_object_write_plans (account_id, destination_ref, generation, plan_id, fingerprint)
+         VALUES ($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`,
+        [plan.account_id, plan.destination_ref, plan.generation, plan.plan_id, fingerprint]
+      );
+      if (!inserted.rowCount) {
+        const existing = await client.query(
+          `SELECT fingerprint FROM adcp_reporting_object_write_plans
+           WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4`,
+          [plan.account_id, plan.destination_ref, plan.generation, plan.plan_id]
+        );
+        if (existing.rows[0]?.fingerprint !== fingerprint) throw new ReportingObjectWriteConflictError();
+        return "unchanged";
+      }
+      await client.query(
+        `INSERT INTO adcp_reporting_object_writes
+         (account_id,destination_ref,generation,plan_id,object_index,bucket,object_name,sha256,size_bytes)
+         SELECT $1,$2,$3,$4,(ordinality-1)::integer,value->>'bucket',value->>'object_name',value->>'sha256',
+           (value->>'size_bytes')::bigint FROM jsonb_array_elements($5::jsonb) WITH ORDINALITY`,
+        [
+          plan.account_id,
+          plan.destination_ref,
+          plan.generation,
+          plan.plan_id,
+          JSON.stringify(
+            plan.objects.map(({ bucket, object_name, sha256, size_bytes }) => ({
+              bucket,
+              object_name,
+              sha256,
+              size_bytes
+            }))
+          )
+        ]
+      );
+      return "registered";
+    }, context.signal);
+  }
+  async listRevokedObjectWrites(inputScope, inputOptions = {}, context = {}) {
+    const scope = structuredClone(inputScope);
+    const options = structuredClone(inputOptions);
+    assertReportingObjectWriteScope(scope);
+    const limit = options.limit ?? 100;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e3 || options.after && (!/^[a-f0-9]{64}$/.test(options.after.plan_id) || !Number.isSafeInteger(options.after.object_index) || options.after.object_index < 0 || options.after.object_index >= 128)) {
+      throw new Error("Invalid reporting object-write page");
+    }
+    return this.transaction(async (client) => {
+      await advisoryLock(client, accountLock(scope.account_id));
+      await advisoryLock(client, authLock(scope.account_id, scope.destination_ref));
+      const revoked = await client.query(
+        `SELECT 1 FROM adcp_reporting_destination_authorizations
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND revoked_at IS NOT NULL`,
+        [scope.account_id, scope.destination_ref, scope.generation]
+      );
+      if (!revoked.rowCount) throw new ReportingObjectWriteNotRevokedError();
+      const rows = await client.query(
+        `SELECT plan_id,object_index,bucket,object_name,sha256,size_bytes::float8 AS size_bytes
+         FROM adcp_reporting_object_writes WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND fenced_at IS NULL
+         AND ($4::text IS NULL OR (plan_id,object_index) > ($4,$5::integer))
+         ORDER BY plan_id,object_index LIMIT $6`,
+        [
+          scope.account_id,
+          scope.destination_ref,
+          scope.generation,
+          options.after?.plan_id ?? null,
+          options.after?.object_index ?? null,
+          limit
+        ]
+      );
+      return rows.rows;
+    }, context.signal);
+  }
+  async markObjectWriteFenced(input, context = {}) {
+    const frozen = structuredClone(input);
+    assertReportingObjectWriteScope(frozen);
+    if (!/^[a-f0-9]{64}$/.test(frozen.plan_id) || !Number.isSafeInteger(frozen.object_index) || frozen.object_index < 0 || frozen.object_index >= 128 || !/^[1-9][0-9]{0,39}$/.test(frozen.tombstone_generation)) {
+      throw new Error("Invalid reporting object-write fence");
+    }
+    await this.transaction(async (client) => {
+      await advisoryLock(client, accountLock(frozen.account_id));
+      await advisoryLock(client, authLock(frozen.account_id, frozen.destination_ref));
+      const updated = await client.query(
+        `UPDATE adcp_reporting_object_writes object SET fenced_at=COALESCE(fenced_at,clock_timestamp()), tombstone_generation=$6
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4 AND object_index=$5
+         AND (tombstone_generation IS NULL OR tombstone_generation=$6)
+         AND EXISTS (SELECT 1 FROM adcp_reporting_destination_authorizations authz
+           WHERE authz.account_id=object.account_id AND authz.destination_ref=object.destination_ref
+           AND authz.generation=object.generation AND authz.revoked_at IS NOT NULL)`,
+        [
+          frozen.account_id,
+          frozen.destination_ref,
+          frozen.generation,
+          frozen.plan_id,
+          frozen.object_index,
+          frozen.tombstone_generation
+        ]
+      );
+      if (updated.rowCount !== 1) throw new Error("Reporting object-write fence is not eligible");
+    }, context.signal);
+  }
+  async getObjectWriteBinding(input, context = {}) {
+    const scope = structuredClone(input);
+    assertReportingObjectWriteScope(scope);
+    return this.transaction(async (client) => {
+      await advisoryLock(client, accountLock(scope.account_id));
+      await advisoryLock(client, authLock(scope.account_id, scope.destination_ref));
+      const revoked = await client.query(
+        `SELECT 1 FROM adcp_reporting_destination_authorizations
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND revoked_at IS NOT NULL`,
+        [scope.account_id, scope.destination_ref, scope.generation]
+      );
+      if (!revoked.rowCount) throw new ReportingObjectWriteNotRevokedError();
+      const binding = await client.query(
+        `SELECT bucket,namespace_key FROM adcp_reporting_object_write_bindings
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3`,
+        [scope.account_id, scope.destination_ref, scope.generation]
+      );
+      return binding.rows[0] ?? null;
+    }, context.signal);
+  }
+  async probeObjectWriteAuthority(context = {}) {
+    await this.transaction(async (client) => {
+      await client.query(
+        `SELECT installation_id,schema_version FROM adcp_reporting_object_write_authority WHERE singleton AND schema_version=1`
+      );
+      await client.query(
+        `SELECT account_id,destination_ref,generation,bucket,namespace_key FROM adcp_reporting_object_write_bindings LIMIT 0`
+      );
+      await client.query(
+        `SELECT account_id,destination_ref,generation,plan_id,fingerprint FROM adcp_reporting_object_write_plans LIMIT 0`
+      );
+      await client.query(
+        `SELECT plan_id,object_index,bucket,object_name,sha256,size_bytes,fenced_at,tombstone_generation FROM adcp_reporting_object_writes LIMIT 0`
+      );
+    }, context.signal);
+    await this.getObjectWriteAuthorityId(context);
+    return true;
+  }
+  async getObjectWriteAuthorityId(context = {}) {
+    return this.transaction(async (client) => {
+      const result = await client.query(
+        `SELECT installation_id::text FROM adcp_reporting_object_write_authority WHERE singleton AND schema_version=1`
+      );
+      const id = result.rows[0]?.installation_id;
+      if (result.rowCount !== 1 || !id || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(id))
+        throw new Error("Reporting object-write authority migration is unavailable");
+      return id;
+    }, context.signal);
+  }
+  async getAuthorizedObjectWriteBinding(input, context = {}) {
+    const scope = {
+      account_id: input.account_id,
+      destination_ref: input.destination_ref,
+      generation: input.generation
+    };
+    assertReportingObjectWriteScope(scope);
+    return this.transaction(async (client) => {
+      const result = await client.query(
+        `SELECT binding.bucket,binding.namespace_key FROM adcp_reporting_object_write_bindings binding
+         JOIN adcp_reporting_destination_authorizations authz USING (account_id,destination_ref,generation)
+         WHERE binding.account_id=$1 AND binding.destination_ref=$2 AND binding.generation=$3 AND authz.revoked_at IS NULL`,
+        [scope.account_id, scope.destination_ref, scope.generation]
+      );
+      return result.rows[0] ?? null;
+    }, context.signal);
+  }
+  async getObjectWritePlan(input, planId, context = {}) {
+    const scope = {
+      account_id: input.account_id,
+      destination_ref: input.destination_ref,
+      generation: input.generation
+    };
+    assertReportingObjectWriteScope(scope);
+    if (typeof planId !== "string" || !/^[a-f0-9]{64}$/.test(planId))
+      throw new Error("Invalid reporting object-write plan identity");
+    return this.transaction(async (client) => {
+      const selected = await client.query(
+        `SELECT binding.bucket,binding.namespace_key,plan.fingerprint FROM adcp_reporting_object_write_plans plan
+         JOIN adcp_reporting_object_write_bindings binding USING (account_id,destination_ref,generation)
+         JOIN adcp_reporting_destination_authorizations authz USING (account_id,destination_ref,generation)
+         WHERE plan.account_id=$1 AND plan.destination_ref=$2 AND plan.generation=$3 AND plan.plan_id=$4 AND authz.revoked_at IS NULL`,
+        [scope.account_id, scope.destination_ref, scope.generation, planId]
+      );
+      if (!selected.rows[0]) return null;
+      const selectedBinding = selected.rows[0];
+      const objects = await client.query(
+        `SELECT bucket,object_name,sha256,size_bytes::float8 AS size_bytes FROM adcp_reporting_object_writes
+         WHERE account_id=$1 AND destination_ref=$2 AND generation=$3 AND plan_id=$4 ORDER BY object_index`,
+        [scope.account_id, scope.destination_ref, scope.generation, planId]
+      );
+      const plan = {
+        ...scope,
+        plan_id: planId,
+        provider: { bucket: selectedBinding.bucket, namespace_key: selectedBinding.namespace_key },
+        objects: objects.rows
+      };
+      if (reportingObjectWritePlanFingerprint(plan) !== selectedBinding.fingerprint)
+        throw new ReportingObjectWriteConflictError();
+      return plan;
+    }, context.signal);
+  }
   async isAuthorizationCurrent(input) {
     const result = await this.query(
       `SELECT 1 FROM adcp_reporting_destination_authorizations
@@ -1802,7 +2033,8 @@ class PostgresReportingManagedDeliveryStore {
     );
     return result.rows[0] ? { subjectId: receipt.reporting_adjustment_id, adjustment: result.rows[0].adjustment } : null;
   }
-  async transaction(body) {
+  async transaction(body, signal) {
+    signal?.throwIfAborted();
     let client;
     try {
       client = await this.pool.connect();
@@ -1812,9 +2044,23 @@ class PostgresReportingManagedDeliveryStore {
     let releaseError;
     let transactionStarted = false;
     try {
+      signal?.throwIfAborted();
       await client.query("BEGIN");
       transactionStarted = true;
-      const value = await body(client);
+      if (signal) await client.query("SET LOCAL lock_timeout = '5s'; SET LOCAL statement_timeout = '10s'");
+      const guarded = signal ? {
+        query: async (sql, values) => {
+          signal.throwIfAborted();
+          const result = await client.query(sql, values);
+          signal.throwIfAborted();
+          return result;
+        },
+        release: () => {
+          throw new Error("Transaction body cannot release connection");
+        }
+      } : client;
+      const value = await body(guarded);
+      signal?.throwIfAborted();
       await client.query("COMMIT");
       return value;
     } catch (cause) {

package/dist/lib/reporting/ledger/object-writes.d.mts

@@ -0,0 +1,69 @@
+export declare class ReportingObjectWriteConflictError extends Error {
+    constructor();
+}
+/** Symbol branding preserves errors when CJS stores are paired with ESM fences. */
+export declare function isReportingObjectWriteConflictError(error: unknown): boolean;
+export declare class ReportingObjectWriteNotRevokedError extends Error {
+    constructor();
+}
+export declare function isReportingObjectWriteNotRevokedError(error: unknown): boolean;
+/** Non-secret destination identity, scoped to the store's isolated tenant database. */
+export interface ReportingObjectWriteScopeV1 {
+    account_id: string;
+    destination_ref: string;
+    generation: number;
+}
+export interface ReportingObjectWriteV1 {
+    bucket: string;
+    object_name: string;
+    sha256: string;
+    size_bytes: number;
+}
+export interface ReportingObjectWriteBindingV1 {
+    bucket: string;
+    /** SHA-256 of a host-owned deployment namespace; immutable per authorization generation. */
+    namespace_key: string;
+}
+export interface ReportingObjectWriteContextV1 {
+    signal?: AbortSignal;
+}
+export declare function reportingObjectWriteScopeKey(scope: ReportingObjectWriteScopeV1): string;
+export declare function reportingObjectWriteName(scope: ReportingObjectWriteScopeV1, binding: ReportingObjectWriteBindingV1, planId: string, index: number): string;
+export interface ReportingObjectWritePlanV1 extends ReportingObjectWriteScopeV1 {
+    provider: ReportingObjectWriteBindingV1;
+    /** Stable opaque identity for the same logical delivery across retries. */
+    plan_id: string;
+    objects: readonly ReportingObjectWriteV1[];
+}
+export interface ReportingObjectWriteCursorV1 {
+    plan_id: string;
+    object_index: number;
+}
+export interface ReportingObjectWriteStoreV1 {
+    /** Registration and destination revocation MUST share one authority/lock boundary. */
+    registerObjectWritePlan(plan: ReportingObjectWritePlanV1, context?: ReportingObjectWriteContextV1): Promise<'registered' | 'unchanged' | 'revoked'>;
+    /** Authoritative cleanup routing, available only for a closed generation. */
+    getObjectWriteBinding(scope: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
+    /** Only reads closed (revoked) generations; inventory never prunes automatically. */
+    listRevokedObjectWrites(scope: ReportingObjectWriteScopeV1, options?: {
+        after?: ReportingObjectWriteCursorV1;
+        limit?: number;
+    }, context?: ReportingObjectWriteContextV1): Promise<Array<ReportingObjectWriteV1 & ReportingObjectWriteCursorV1>>;
+    /** Trusted provider code calls this only after verifying a persistent tombstone. */
+    markObjectWriteFenced(input: ReportingObjectWriteScopeV1 & ReportingObjectWriteCursorV1 & {
+        tombstone_generation: string;
+    }, context?: ReportingObjectWriteContextV1): Promise<void>;
+}
+/** Apply after REPORTING_MANAGED_DELIVERY_MIGRATION. Additive and independently opt-in. */
+export declare const REPORTING_OBJECT_WRITE_MIGRATION = "\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_bindings (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  bucket TEXT NOT NULL,\n  namespace_key TEXT NOT NULL CHECK (namespace_key ~ '^[a-f0-9]{64}$'),\n  PRIMARY KEY (account_id, destination_ref, generation),\n  FOREIGN KEY (account_id, destination_ref, generation)\n    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)\n);\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_plans (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  plan_id TEXT NOT NULL CHECK (plan_id ~ '^[a-f0-9]{64}$'),\n  fingerprint TEXT NOT NULL,\n  PRIMARY KEY (account_id, destination_ref, generation, plan_id),\n  FOREIGN KEY (account_id, destination_ref, generation)\n    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)\n);\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_writes (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  plan_id TEXT NOT NULL,\n  object_index INTEGER NOT NULL CHECK (object_index >= 0 AND object_index < 128),\n  bucket TEXT NOT NULL,\n  object_name TEXT NOT NULL,\n  sha256 TEXT NOT NULL CHECK (sha256 ~ '^[a-f0-9]{64}$'),\n  size_bytes BIGINT NOT NULL CHECK (size_bytes >= 0 AND size_bytes <= 67108864),\n  fenced_at TIMESTAMPTZ,\n  tombstone_generation TEXT,\n  PRIMARY KEY (account_id, destination_ref, generation, plan_id, object_index),\n  UNIQUE (bucket, object_name),\n  FOREIGN KEY (account_id, destination_ref, generation, plan_id)\n    REFERENCES adcp_reporting_object_write_plans(account_id, destination_ref, generation, plan_id)\n);\n";
+export declare function assertReportingObjectWriteScope(scope: ReportingObjectWriteScopeV1): void;
+export declare function reportingObjectWritePlanFingerprint(plan: ReportingObjectWritePlanV1): string;
+/** Opt-in authority for complete provider adapters; the original primitive store port is unchanged. */
+export interface ReportingObjectWriteAuthorityStoreV1 extends ReportingObjectWriteStoreV1 {
+    probeObjectWriteAuthority(context?: ReportingObjectWriteContextV1): Promise<boolean>;
+    getObjectWriteAuthorityId(context?: ReportingObjectWriteContextV1): Promise<string>;
+    getAuthorizedObjectWriteBinding(scope: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
+    getObjectWritePlan(scope: ReportingObjectWriteScopeV1, planId: string, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWritePlanV1 | null>;
+}
+/** PostgreSQL 13+; apply after REPORTING_OBJECT_WRITE_MIGRATION. Identity survives replica/worker restart. */
+export declare const REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION = "\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_authority (\n  singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton),\n  installation_id UUID NOT NULL DEFAULT gen_random_uuid(),\n  schema_version INTEGER NOT NULL DEFAULT 1 CHECK (schema_version = 1)\n);\nINSERT INTO adcp_reporting_object_write_authority (singleton) VALUES (TRUE) ON CONFLICT DO NOTHING;\n";