@adcp/sdk 15.0.0 → 15.2.0

package/dist/lib/reporting/ledger/object-writes.d.mts

@@ -0,0 +1,69 @@
+export declare class ReportingObjectWriteConflictError extends Error {
+    constructor();
+}
+/** Symbol branding preserves errors when CJS stores are paired with ESM fences. */
+export declare function isReportingObjectWriteConflictError(error: unknown): boolean;
+export declare class ReportingObjectWriteNotRevokedError extends Error {
+    constructor();
+}
+export declare function isReportingObjectWriteNotRevokedError(error: unknown): boolean;
+/** Non-secret destination identity, scoped to the store's isolated tenant database. */
+export interface ReportingObjectWriteScopeV1 {
+    account_id: string;
+    destination_ref: string;
+    generation: number;
+}
+export interface ReportingObjectWriteV1 {
+    bucket: string;
+    object_name: string;
+    sha256: string;
+    size_bytes: number;
+}
+export interface ReportingObjectWriteBindingV1 {
+    bucket: string;
+    /** SHA-256 of a host-owned deployment namespace; immutable per authorization generation. */
+    namespace_key: string;
+}
+export interface ReportingObjectWriteContextV1 {
+    signal?: AbortSignal;
+}
+export declare function reportingObjectWriteScopeKey(scope: ReportingObjectWriteScopeV1): string;
+export declare function reportingObjectWriteName(scope: ReportingObjectWriteScopeV1, binding: ReportingObjectWriteBindingV1, planId: string, index: number): string;
+export interface ReportingObjectWritePlanV1 extends ReportingObjectWriteScopeV1 {
+    provider: ReportingObjectWriteBindingV1;
+    /** Stable opaque identity for the same logical delivery across retries. */
+    plan_id: string;
+    objects: readonly ReportingObjectWriteV1[];
+}
+export interface ReportingObjectWriteCursorV1 {
+    plan_id: string;
+    object_index: number;
+}
+export interface ReportingObjectWriteStoreV1 {
+    /** Registration and destination revocation MUST share one authority/lock boundary. */
+    registerObjectWritePlan(plan: ReportingObjectWritePlanV1, context?: ReportingObjectWriteContextV1): Promise<'registered' | 'unchanged' | 'revoked'>;
+    /** Authoritative cleanup routing, available only for a closed generation. */
+    getObjectWriteBinding(scope: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
+    /** Only reads closed (revoked) generations; inventory never prunes automatically. */
+    listRevokedObjectWrites(scope: ReportingObjectWriteScopeV1, options?: {
+        after?: ReportingObjectWriteCursorV1;
+        limit?: number;
+    }, context?: ReportingObjectWriteContextV1): Promise<Array<ReportingObjectWriteV1 & ReportingObjectWriteCursorV1>>;
+    /** Trusted provider code calls this only after verifying a persistent tombstone. */
+    markObjectWriteFenced(input: ReportingObjectWriteScopeV1 & ReportingObjectWriteCursorV1 & {
+        tombstone_generation: string;
+    }, context?: ReportingObjectWriteContextV1): Promise<void>;
+}
+/** Apply after REPORTING_MANAGED_DELIVERY_MIGRATION. Additive and independently opt-in. */
+export declare const REPORTING_OBJECT_WRITE_MIGRATION = "\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_bindings (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  bucket TEXT NOT NULL,\n  namespace_key TEXT NOT NULL CHECK (namespace_key ~ '^[a-f0-9]{64}$'),\n  PRIMARY KEY (account_id, destination_ref, generation),\n  FOREIGN KEY (account_id, destination_ref, generation)\n    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)\n);\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_plans (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  plan_id TEXT NOT NULL CHECK (plan_id ~ '^[a-f0-9]{64}$'),\n  fingerprint TEXT NOT NULL,\n  PRIMARY KEY (account_id, destination_ref, generation, plan_id),\n  FOREIGN KEY (account_id, destination_ref, generation)\n    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)\n);\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_writes (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  plan_id TEXT NOT NULL,\n  object_index INTEGER NOT NULL CHECK (object_index >= 0 AND object_index < 128),\n  bucket TEXT NOT NULL,\n  object_name TEXT NOT NULL,\n  sha256 TEXT NOT NULL CHECK (sha256 ~ '^[a-f0-9]{64}$'),\n  size_bytes BIGINT NOT NULL CHECK (size_bytes >= 0 AND size_bytes <= 67108864),\n  fenced_at TIMESTAMPTZ,\n  tombstone_generation TEXT,\n  PRIMARY KEY (account_id, destination_ref, generation, plan_id, object_index),\n  UNIQUE (bucket, object_name),\n  FOREIGN KEY (account_id, destination_ref, generation, plan_id)\n    REFERENCES adcp_reporting_object_write_plans(account_id, destination_ref, generation, plan_id)\n);\n";
+export declare function assertReportingObjectWriteScope(scope: ReportingObjectWriteScopeV1): void;
+export declare function reportingObjectWritePlanFingerprint(plan: ReportingObjectWritePlanV1): string;
+/** Opt-in authority for complete provider adapters; the original primitive store port is unchanged. */
+export interface ReportingObjectWriteAuthorityStoreV1 extends ReportingObjectWriteStoreV1 {
+    probeObjectWriteAuthority(context?: ReportingObjectWriteContextV1): Promise<boolean>;
+    getObjectWriteAuthorityId(context?: ReportingObjectWriteContextV1): Promise<string>;
+    getAuthorizedObjectWriteBinding(scope: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
+    getObjectWritePlan(scope: ReportingObjectWriteScopeV1, planId: string, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWritePlanV1 | null>;
+}
+/** PostgreSQL 13+; apply after REPORTING_OBJECT_WRITE_MIGRATION. Identity survives replica/worker restart. */
+export declare const REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION = "\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_authority (\n  singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton),\n  installation_id UUID NOT NULL DEFAULT gen_random_uuid(),\n  schema_version INTEGER NOT NULL DEFAULT 1 CHECK (schema_version = 1)\n);\nINSERT INTO adcp_reporting_object_write_authority (singleton) VALUES (TRUE) ON CONFLICT DO NOTHING;\n";

package/dist/lib/reporting/ledger/object-writes.d.ts

@@ -0,0 +1,69 @@
+export declare class ReportingObjectWriteConflictError extends Error {
+    constructor();
+}
+/** Symbol branding preserves errors when CJS stores are paired with ESM fences. */
+export declare function isReportingObjectWriteConflictError(error: unknown): boolean;
+export declare class ReportingObjectWriteNotRevokedError extends Error {
+    constructor();
+}
+export declare function isReportingObjectWriteNotRevokedError(error: unknown): boolean;
+/** Non-secret destination identity, scoped to the store's isolated tenant database. */
+export interface ReportingObjectWriteScopeV1 {
+    account_id: string;
+    destination_ref: string;
+    generation: number;
+}
+export interface ReportingObjectWriteV1 {
+    bucket: string;
+    object_name: string;
+    sha256: string;
+    size_bytes: number;
+}
+export interface ReportingObjectWriteBindingV1 {
+    bucket: string;
+    /** SHA-256 of a host-owned deployment namespace; immutable per authorization generation. */
+    namespace_key: string;
+}
+export interface ReportingObjectWriteContextV1 {
+    signal?: AbortSignal;
+}
+export declare function reportingObjectWriteScopeKey(scope: ReportingObjectWriteScopeV1): string;
+export declare function reportingObjectWriteName(scope: ReportingObjectWriteScopeV1, binding: ReportingObjectWriteBindingV1, planId: string, index: number): string;
+export interface ReportingObjectWritePlanV1 extends ReportingObjectWriteScopeV1 {
+    provider: ReportingObjectWriteBindingV1;
+    /** Stable opaque identity for the same logical delivery across retries. */
+    plan_id: string;
+    objects: readonly ReportingObjectWriteV1[];
+}
+export interface ReportingObjectWriteCursorV1 {
+    plan_id: string;
+    object_index: number;
+}
+export interface ReportingObjectWriteStoreV1 {
+    /** Registration and destination revocation MUST share one authority/lock boundary. */
+    registerObjectWritePlan(plan: ReportingObjectWritePlanV1, context?: ReportingObjectWriteContextV1): Promise<'registered' | 'unchanged' | 'revoked'>;
+    /** Authoritative cleanup routing, available only for a closed generation. */
+    getObjectWriteBinding(scope: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
+    /** Only reads closed (revoked) generations; inventory never prunes automatically. */
+    listRevokedObjectWrites(scope: ReportingObjectWriteScopeV1, options?: {
+        after?: ReportingObjectWriteCursorV1;
+        limit?: number;
+    }, context?: ReportingObjectWriteContextV1): Promise<Array<ReportingObjectWriteV1 & ReportingObjectWriteCursorV1>>;
+    /** Trusted provider code calls this only after verifying a persistent tombstone. */
+    markObjectWriteFenced(input: ReportingObjectWriteScopeV1 & ReportingObjectWriteCursorV1 & {
+        tombstone_generation: string;
+    }, context?: ReportingObjectWriteContextV1): Promise<void>;
+}
+/** Apply after REPORTING_MANAGED_DELIVERY_MIGRATION. Additive and independently opt-in. */
+export declare const REPORTING_OBJECT_WRITE_MIGRATION = "\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_bindings (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  bucket TEXT NOT NULL,\n  namespace_key TEXT NOT NULL CHECK (namespace_key ~ '^[a-f0-9]{64}$'),\n  PRIMARY KEY (account_id, destination_ref, generation),\n  FOREIGN KEY (account_id, destination_ref, generation)\n    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)\n);\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_plans (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  plan_id TEXT NOT NULL CHECK (plan_id ~ '^[a-f0-9]{64}$'),\n  fingerprint TEXT NOT NULL,\n  PRIMARY KEY (account_id, destination_ref, generation, plan_id),\n  FOREIGN KEY (account_id, destination_ref, generation)\n    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)\n);\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_writes (\n  account_id TEXT NOT NULL,\n  destination_ref TEXT NOT NULL,\n  generation BIGINT NOT NULL,\n  plan_id TEXT NOT NULL,\n  object_index INTEGER NOT NULL CHECK (object_index >= 0 AND object_index < 128),\n  bucket TEXT NOT NULL,\n  object_name TEXT NOT NULL,\n  sha256 TEXT NOT NULL CHECK (sha256 ~ '^[a-f0-9]{64}$'),\n  size_bytes BIGINT NOT NULL CHECK (size_bytes >= 0 AND size_bytes <= 67108864),\n  fenced_at TIMESTAMPTZ,\n  tombstone_generation TEXT,\n  PRIMARY KEY (account_id, destination_ref, generation, plan_id, object_index),\n  UNIQUE (bucket, object_name),\n  FOREIGN KEY (account_id, destination_ref, generation, plan_id)\n    REFERENCES adcp_reporting_object_write_plans(account_id, destination_ref, generation, plan_id)\n);\n";
+export declare function assertReportingObjectWriteScope(scope: ReportingObjectWriteScopeV1): void;
+export declare function reportingObjectWritePlanFingerprint(plan: ReportingObjectWritePlanV1): string;
+/** Opt-in authority for complete provider adapters; the original primitive store port is unchanged. */
+export interface ReportingObjectWriteAuthorityStoreV1 extends ReportingObjectWriteStoreV1 {
+    probeObjectWriteAuthority(context?: ReportingObjectWriteContextV1): Promise<boolean>;
+    getObjectWriteAuthorityId(context?: ReportingObjectWriteContextV1): Promise<string>;
+    getAuthorizedObjectWriteBinding(scope: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
+    getObjectWritePlan(scope: ReportingObjectWriteScopeV1, planId: string, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWritePlanV1 | null>;
+}
+/** PostgreSQL 13+; apply after REPORTING_OBJECT_WRITE_MIGRATION. Identity survives replica/worker restart. */
+export declare const REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION = "\nCREATE TABLE IF NOT EXISTS adcp_reporting_object_write_authority (\n  singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton),\n  installation_id UUID NOT NULL DEFAULT gen_random_uuid(),\n  schema_version INTEGER NOT NULL DEFAULT 1 CHECK (schema_version = 1)\n);\nINSERT INTO adcp_reporting_object_write_authority (singleton) VALUES (TRUE) ON CONFLICT DO NOTHING;\n";

package/dist/lib/reporting/ledger/object-writes.js

@@ -0,0 +1,147 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var object_writes_exports = {};
+__export(object_writes_exports, {
+  REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION: () => REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION,
+  REPORTING_OBJECT_WRITE_MIGRATION: () => REPORTING_OBJECT_WRITE_MIGRATION,
+  ReportingObjectWriteConflictError: () => ReportingObjectWriteConflictError,
+  ReportingObjectWriteNotRevokedError: () => ReportingObjectWriteNotRevokedError,
+  assertReportingObjectWriteScope: () => assertReportingObjectWriteScope,
+  isReportingObjectWriteConflictError: () => isReportingObjectWriteConflictError,
+  isReportingObjectWriteNotRevokedError: () => isReportingObjectWriteNotRevokedError,
+  reportingObjectWriteName: () => reportingObjectWriteName,
+  reportingObjectWritePlanFingerprint: () => reportingObjectWritePlanFingerprint,
+  reportingObjectWriteScopeKey: () => reportingObjectWriteScopeKey
+});
+module.exports = __toCommonJS(object_writes_exports);
+var import_node_crypto = require("node:crypto");
+var import_jcs = require('../../utils/jcs.js');
+class ReportingObjectWriteConflictError extends Error {
+  constructor() {
+    super("Reporting object-write plan conflict");
+    this.name = "ReportingObjectWriteConflictError";
+    Object.defineProperty(this, /* @__PURE__ */ Symbol.for("adcp.reporting.objectWriteConflict"), { value: true });
+  }
+}
+function isReportingObjectWriteConflictError(error) {
+  return !!error && typeof error === "object" && error[/* @__PURE__ */ Symbol.for("adcp.reporting.objectWriteConflict")] === true;
+}
+class ReportingObjectWriteNotRevokedError extends Error {
+  constructor() {
+    super("Reporting object-write generation is not revoked");
+    this.name = "ReportingObjectWriteNotRevokedError";
+    Object.defineProperty(this, /* @__PURE__ */ Symbol.for("adcp.reporting.objectWriteNotRevoked"), { value: true });
+  }
+}
+function isReportingObjectWriteNotRevokedError(error) {
+  return !!error && typeof error === "object" && error[/* @__PURE__ */ Symbol.for("adcp.reporting.objectWriteNotRevoked")] === true;
+}
+function reportingObjectWriteScopeKey(scope) {
+  assertReportingObjectWriteScope(scope);
+  return (0, import_node_crypto.createHash)("sha256").update(JSON.stringify([scope.account_id, scope.destination_ref, scope.generation])).digest("hex");
+}
+function reportingObjectWriteName(scope, binding, planId, index) {
+  return `adcp-reporting/${binding.namespace_key}/${reportingObjectWriteScopeKey(scope)}/${planId}/${index}`;
+}
+const REPORTING_OBJECT_WRITE_MIGRATION = `
+CREATE TABLE IF NOT EXISTS adcp_reporting_object_write_bindings (
+  account_id TEXT NOT NULL,
+  destination_ref TEXT NOT NULL,
+  generation BIGINT NOT NULL,
+  bucket TEXT NOT NULL,
+  namespace_key TEXT NOT NULL CHECK (namespace_key ~ '^[a-f0-9]{64}$'),
+  PRIMARY KEY (account_id, destination_ref, generation),
+  FOREIGN KEY (account_id, destination_ref, generation)
+    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)
+);
+CREATE TABLE IF NOT EXISTS adcp_reporting_object_write_plans (
+  account_id TEXT NOT NULL,
+  destination_ref TEXT NOT NULL,
+  generation BIGINT NOT NULL,
+  plan_id TEXT NOT NULL CHECK (plan_id ~ '^[a-f0-9]{64}$'),
+  fingerprint TEXT NOT NULL,
+  PRIMARY KEY (account_id, destination_ref, generation, plan_id),
+  FOREIGN KEY (account_id, destination_ref, generation)
+    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)
+);
+CREATE TABLE IF NOT EXISTS adcp_reporting_object_writes (
+  account_id TEXT NOT NULL,
+  destination_ref TEXT NOT NULL,
+  generation BIGINT NOT NULL,
+  plan_id TEXT NOT NULL,
+  object_index INTEGER NOT NULL CHECK (object_index >= 0 AND object_index < 128),
+  bucket TEXT NOT NULL,
+  object_name TEXT NOT NULL,
+  sha256 TEXT NOT NULL CHECK (sha256 ~ '^[a-f0-9]{64}$'),
+  size_bytes BIGINT NOT NULL CHECK (size_bytes >= 0 AND size_bytes <= 67108864),
+  fenced_at TIMESTAMPTZ,
+  tombstone_generation TEXT,
+  PRIMARY KEY (account_id, destination_ref, generation, plan_id, object_index),
+  UNIQUE (bucket, object_name),
+  FOREIGN KEY (account_id, destination_ref, generation, plan_id)
+    REFERENCES adcp_reporting_object_write_plans(account_id, destination_ref, generation, plan_id)
+);
+`;
+function assertReportingObjectWriteScope(scope) {
+  if (!scope || ![scope.account_id, scope.destination_ref].every((v) => typeof v === "string" && v.length > 0 && v.length <= 255) || !Number.isSafeInteger(scope.generation) || scope.generation < 1)
+    throw new Error("Invalid reporting object-write scope");
+}
+function reportingObjectWritePlanFingerprint(plan) {
+  assertReportingObjectWriteScope(plan);
+  if (!plan.provider || typeof plan.provider.bucket !== "string" || !/^[a-z0-9][a-z0-9.-]{1,220}[a-z0-9]$/.test(plan.provider.bucket) || typeof plan.provider.namespace_key !== "string" || !/^[a-f0-9]{64}$/.test(plan.provider.namespace_key) || typeof plan.plan_id !== "string" || !/^[a-f0-9]{64}$/.test(plan.plan_id) || !Array.isArray(plan.objects) || plan.objects.length < 1 || plan.objects.length > 128 || plan.objects.some(
+    (o, i) => !o || typeof o.bucket !== "string" || !/^[a-z0-9][a-z0-9.-]{1,220}[a-z0-9]$/.test(o.bucket) || o.bucket !== plan.provider.bucket || o.object_name !== reportingObjectWriteName(plan, plan.provider, plan.plan_id, i) || typeof o.object_name !== "string" || !/^[A-Za-z0-9/_-]{1,1024}$/.test(o.object_name) || typeof o.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(o.sha256) || !Number.isSafeInteger(o.size_bytes) || o.size_bytes < 0 || o.size_bytes > 64 * 1024 * 1024
+  ) || plan.objects.reduce((total, o) => total + o.size_bytes, 0) > 64 * 1024 * 1024 || new Set(plan.objects.map((o) => JSON.stringify([o.bucket, o.object_name]))).size !== plan.objects.length)
+    throw new Error("Invalid reporting object-write plan");
+  return (0, import_node_crypto.createHash)("sha256").update(
+    (0, import_jcs.canonicalize)({
+      account_id: plan.account_id,
+      destination_ref: plan.destination_ref,
+      generation: plan.generation,
+      plan_id: plan.plan_id,
+      provider: { bucket: plan.provider.bucket, namespace_key: plan.provider.namespace_key },
+      objects: plan.objects.map(({ bucket, object_name, sha256, size_bytes }) => ({
+        bucket,
+        object_name,
+        sha256,
+        size_bytes
+      }))
+    })
+  ).digest("hex");
+}
+const REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION = `
+CREATE TABLE IF NOT EXISTS adcp_reporting_object_write_authority (
+  singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton),
+  installation_id UUID NOT NULL DEFAULT gen_random_uuid(),
+  schema_version INTEGER NOT NULL DEFAULT 1 CHECK (schema_version = 1)
+);
+INSERT INTO adcp_reporting_object_write_authority (singleton) VALUES (TRUE) ON CONFLICT DO NOTHING;
+`;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION,
+  REPORTING_OBJECT_WRITE_MIGRATION,
+  ReportingObjectWriteConflictError,
+  ReportingObjectWriteNotRevokedError,
+  assertReportingObjectWriteScope,
+  isReportingObjectWriteConflictError,
+  isReportingObjectWriteNotRevokedError,
+  reportingObjectWriteName,
+  reportingObjectWritePlanFingerprint,
+  reportingObjectWriteScopeKey
+});

package/dist/lib/reporting/ledger/object-writes.mjs

@@ -0,0 +1,114 @@
+import { createHash } from "node:crypto";
+import { canonicalize } from "../../utils/jcs.mjs";
+class ReportingObjectWriteConflictError extends Error {
+  constructor() {
+    super("Reporting object-write plan conflict");
+    this.name = "ReportingObjectWriteConflictError";
+    Object.defineProperty(this, /* @__PURE__ */ Symbol.for("adcp.reporting.objectWriteConflict"), { value: true });
+  }
+}
+function isReportingObjectWriteConflictError(error) {
+  return !!error && typeof error === "object" && error[/* @__PURE__ */ Symbol.for("adcp.reporting.objectWriteConflict")] === true;
+}
+class ReportingObjectWriteNotRevokedError extends Error {
+  constructor() {
+    super("Reporting object-write generation is not revoked");
+    this.name = "ReportingObjectWriteNotRevokedError";
+    Object.defineProperty(this, /* @__PURE__ */ Symbol.for("adcp.reporting.objectWriteNotRevoked"), { value: true });
+  }
+}
+function isReportingObjectWriteNotRevokedError(error) {
+  return !!error && typeof error === "object" && error[/* @__PURE__ */ Symbol.for("adcp.reporting.objectWriteNotRevoked")] === true;
+}
+function reportingObjectWriteScopeKey(scope) {
+  assertReportingObjectWriteScope(scope);
+  return createHash("sha256").update(JSON.stringify([scope.account_id, scope.destination_ref, scope.generation])).digest("hex");
+}
+function reportingObjectWriteName(scope, binding, planId, index) {
+  return `adcp-reporting/${binding.namespace_key}/${reportingObjectWriteScopeKey(scope)}/${planId}/${index}`;
+}
+const REPORTING_OBJECT_WRITE_MIGRATION = `
+CREATE TABLE IF NOT EXISTS adcp_reporting_object_write_bindings (
+  account_id TEXT NOT NULL,
+  destination_ref TEXT NOT NULL,
+  generation BIGINT NOT NULL,
+  bucket TEXT NOT NULL,
+  namespace_key TEXT NOT NULL CHECK (namespace_key ~ '^[a-f0-9]{64}$'),
+  PRIMARY KEY (account_id, destination_ref, generation),
+  FOREIGN KEY (account_id, destination_ref, generation)
+    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)
+);
+CREATE TABLE IF NOT EXISTS adcp_reporting_object_write_plans (
+  account_id TEXT NOT NULL,
+  destination_ref TEXT NOT NULL,
+  generation BIGINT NOT NULL,
+  plan_id TEXT NOT NULL CHECK (plan_id ~ '^[a-f0-9]{64}$'),
+  fingerprint TEXT NOT NULL,
+  PRIMARY KEY (account_id, destination_ref, generation, plan_id),
+  FOREIGN KEY (account_id, destination_ref, generation)
+    REFERENCES adcp_reporting_destination_authorizations(account_id, destination_ref, generation)
+);
+CREATE TABLE IF NOT EXISTS adcp_reporting_object_writes (
+  account_id TEXT NOT NULL,
+  destination_ref TEXT NOT NULL,
+  generation BIGINT NOT NULL,
+  plan_id TEXT NOT NULL,
+  object_index INTEGER NOT NULL CHECK (object_index >= 0 AND object_index < 128),
+  bucket TEXT NOT NULL,
+  object_name TEXT NOT NULL,
+  sha256 TEXT NOT NULL CHECK (sha256 ~ '^[a-f0-9]{64}$'),
+  size_bytes BIGINT NOT NULL CHECK (size_bytes >= 0 AND size_bytes <= 67108864),
+  fenced_at TIMESTAMPTZ,
+  tombstone_generation TEXT,
+  PRIMARY KEY (account_id, destination_ref, generation, plan_id, object_index),
+  UNIQUE (bucket, object_name),
+  FOREIGN KEY (account_id, destination_ref, generation, plan_id)
+    REFERENCES adcp_reporting_object_write_plans(account_id, destination_ref, generation, plan_id)
+);
+`;
+function assertReportingObjectWriteScope(scope) {
+  if (!scope || ![scope.account_id, scope.destination_ref].every((v) => typeof v === "string" && v.length > 0 && v.length <= 255) || !Number.isSafeInteger(scope.generation) || scope.generation < 1)
+    throw new Error("Invalid reporting object-write scope");
+}
+function reportingObjectWritePlanFingerprint(plan) {
+  assertReportingObjectWriteScope(plan);
+  if (!plan.provider || typeof plan.provider.bucket !== "string" || !/^[a-z0-9][a-z0-9.-]{1,220}[a-z0-9]$/.test(plan.provider.bucket) || typeof plan.provider.namespace_key !== "string" || !/^[a-f0-9]{64}$/.test(plan.provider.namespace_key) || typeof plan.plan_id !== "string" || !/^[a-f0-9]{64}$/.test(plan.plan_id) || !Array.isArray(plan.objects) || plan.objects.length < 1 || plan.objects.length > 128 || plan.objects.some(
+    (o, i) => !o || typeof o.bucket !== "string" || !/^[a-z0-9][a-z0-9.-]{1,220}[a-z0-9]$/.test(o.bucket) || o.bucket !== plan.provider.bucket || o.object_name !== reportingObjectWriteName(plan, plan.provider, plan.plan_id, i) || typeof o.object_name !== "string" || !/^[A-Za-z0-9/_-]{1,1024}$/.test(o.object_name) || typeof o.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(o.sha256) || !Number.isSafeInteger(o.size_bytes) || o.size_bytes < 0 || o.size_bytes > 64 * 1024 * 1024
+  ) || plan.objects.reduce((total, o) => total + o.size_bytes, 0) > 64 * 1024 * 1024 || new Set(plan.objects.map((o) => JSON.stringify([o.bucket, o.object_name]))).size !== plan.objects.length)
+    throw new Error("Invalid reporting object-write plan");
+  return createHash("sha256").update(
+    canonicalize({
+      account_id: plan.account_id,
+      destination_ref: plan.destination_ref,
+      generation: plan.generation,
+      plan_id: plan.plan_id,
+      provider: { bucket: plan.provider.bucket, namespace_key: plan.provider.namespace_key },
+      objects: plan.objects.map(({ bucket, object_name, sha256, size_bytes }) => ({
+        bucket,
+        object_name,
+        sha256,
+        size_bytes
+      }))
+    })
+  ).digest("hex");
+}
+const REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION = `
+CREATE TABLE IF NOT EXISTS adcp_reporting_object_write_authority (
+  singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton),
+  installation_id UUID NOT NULL DEFAULT gen_random_uuid(),
+  schema_version INTEGER NOT NULL DEFAULT 1 CHECK (schema_version = 1)
+);
+INSERT INTO adcp_reporting_object_write_authority (singleton) VALUES (TRUE) ON CONFLICT DO NOTHING;
+`;
+export {
+  REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION,
+  REPORTING_OBJECT_WRITE_MIGRATION,
+  ReportingObjectWriteConflictError,
+  ReportingObjectWriteNotRevokedError,
+  assertReportingObjectWriteScope,
+  isReportingObjectWriteConflictError,
+  isReportingObjectWriteNotRevokedError,
+  reportingObjectWriteName,
+  reportingObjectWritePlanFingerprint,
+  reportingObjectWriteScopeKey
+};

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-07T00:14:46.446Z"
+  "synced_at": "2026-10-07T16:17:49.392Z"
 }

package/dist/lib/server/a2a-adapter.d.mts

@@ -53,8 +53,9 @@ import { type TaskStore } from '@a2a-js/sdk/server';
 import { AgentCard } from '@a2a-js/sdk';
 import type { AgentCapabilities, AgentProvider, AgentSkill, SecurityScheme } from '@a2a-js/sdk';
 import type { Request, RequestHandler } from 'express';
+import type { IncomingMessage } from 'node:http';
 import { type AdcpAuthInfo, type AdcpServer } from './adcp-server.mjs';
-import type { AdcpLogger } from './create-adcp-server.mjs';
+import { type AdcpLogger, type AdcpPreTransport } from './create-adcp-server.mjs';
 import type { A2ALegacyCompatOptions } from '../protocols/a2a.mjs';
 /**
  * Agent-card identity fields the adapter can't derive automatically.
@@ -185,6 +186,48 @@ export interface A2AAdapterOptions {
      * Set `enabled: false` to expose only the native A2A 1.0 path.
      */
     legacyCompat?: A2ALegacyCompatOptions;
+    /**
+     * RFC 9421 request-signature gate for the JSON-RPC endpoint. Defaults to the
+     * verifier that `createAdcpServer({ signedRequests })` attaches to `server`,
+     * so a seller that configures `signedRequests` enforces `required_for`,
+     * `protocol_methods_required_for` and the webhook-authentication rule over
+     * A2A exactly as it does over MCP. Pass it explicitly when you wired the
+     * verifier by hand (`serve({ preTransport })`).
+     *
+     * The gate runs on every `POST` to the JSON-RPC endpoint, before
+     * {@link A2AAdapterOptions.authenticate}. The adapter buffers the request
+     * body itself so the gate sees the exact signed bytes, resolves the AdCP
+     * operation from the Message's sole DataPart (`skill`), and rejects a body
+     * that does not resolve to exactly one operation with `request_body_malformed`
+     * before any handler runs. The dispatcher then runs only that operation.
+     * Unlike `authenticate`, a gate rejection is an HTTP 401 carrying
+     * `WWW-Authenticate: Signature error="<code>"`.
+     *
+     * A verified signature is surfaced to handlers as `ctx.authInfo`
+     * (`clientId: signing:<keyid>`). When `authenticate` is also set, its result
+     * stays authoritative and must carry the same `clientId`.
+     *
+     * Body capture: do not mount a body parser ahead of the adapter unless it
+     * records the raw bytes (`express.json({ verify: adapter.rawBodyVerify })`);
+     * a request whose raw body is unavailable is rejected.
+     */
+    preTransport?: AdcpPreTransport;
+    /**
+     * Canonical URL a client signed for this request (the signature's
+     * `@target-uri`). Defaults to the origin of `agentCard.url` plus the request's
+     * original path and query. Override when a path-rewriting proxy changes the
+     * path between the client and this process. Never derive it from a
+     * client-controlled `Host` / `X-Forwarded-*` header.
+     */
+    signedRequestsUrl?: (req: Request) => string;
+    /**
+     * Acknowledge that a seller advertising `signed-requests` / `request_signing`
+     * is not verifying signatures on this adapter (for example, an authenticating
+     * gateway in front of it does). Without this, `createA2AAdapter` refuses to
+     * construct when `server` advertises request signing but no gate is wired,
+     * because the advertisement would be false for A2A.
+     */
+    allowUnenforcedSignedRequests?: boolean;
 }
 /** Minimal Express app surface the adapter's `mount()` helper needs. */
 export interface ExpressAppLike {
@@ -227,6 +270,12 @@ export interface A2AAdapter {
     agentCardHandler: RequestHandler;
     /** Returns the merged, validated agent card. */
     getAgentCard(): Promise<AgentCard>;
+    /**
+     * `verify` hook for `express.json({ verify })` that records the exact request
+     * bytes on `req.rawBody`. Use it when a body parser must run ahead of the
+     * adapter on a signed-requests deployment.
+     */
+    rawBodyVerify: (req: IncomingMessage, res: unknown, buf: Buffer) => void;
     /**
      * Wire all A2A routes onto an Express-compatible app in one call.
      * Eliminates the "card mounted at only one location" footgun: the

package/dist/lib/server/a2a-adapter.d.ts

@@ -53,8 +53,9 @@ import { type TaskStore } from '@a2a-js/sdk/server';
 import { AgentCard } from '@a2a-js/sdk';
 import type { AgentCapabilities, AgentProvider, AgentSkill, SecurityScheme } from '@a2a-js/sdk';
 import type { Request, RequestHandler } from 'express';
+import type { IncomingMessage } from 'node:http';
 import { type AdcpAuthInfo, type AdcpServer } from './adcp-server';
-import type { AdcpLogger } from './create-adcp-server';
+import { type AdcpLogger, type AdcpPreTransport } from './create-adcp-server';
 import type { A2ALegacyCompatOptions } from '../protocols/a2a';
 /**
  * Agent-card identity fields the adapter can't derive automatically.
@@ -185,6 +186,48 @@ export interface A2AAdapterOptions {
      * Set `enabled: false` to expose only the native A2A 1.0 path.
      */
     legacyCompat?: A2ALegacyCompatOptions;
+    /**
+     * RFC 9421 request-signature gate for the JSON-RPC endpoint. Defaults to the
+     * verifier that `createAdcpServer({ signedRequests })` attaches to `server`,
+     * so a seller that configures `signedRequests` enforces `required_for`,
+     * `protocol_methods_required_for` and the webhook-authentication rule over
+     * A2A exactly as it does over MCP. Pass it explicitly when you wired the
+     * verifier by hand (`serve({ preTransport })`).
+     *
+     * The gate runs on every `POST` to the JSON-RPC endpoint, before
+     * {@link A2AAdapterOptions.authenticate}. The adapter buffers the request
+     * body itself so the gate sees the exact signed bytes, resolves the AdCP
+     * operation from the Message's sole DataPart (`skill`), and rejects a body
+     * that does not resolve to exactly one operation with `request_body_malformed`
+     * before any handler runs. The dispatcher then runs only that operation.
+     * Unlike `authenticate`, a gate rejection is an HTTP 401 carrying
+     * `WWW-Authenticate: Signature error="<code>"`.
+     *
+     * A verified signature is surfaced to handlers as `ctx.authInfo`
+     * (`clientId: signing:<keyid>`). When `authenticate` is also set, its result
+     * stays authoritative and must carry the same `clientId`.
+     *
+     * Body capture: do not mount a body parser ahead of the adapter unless it
+     * records the raw bytes (`express.json({ verify: adapter.rawBodyVerify })`);
+     * a request whose raw body is unavailable is rejected.
+     */
+    preTransport?: AdcpPreTransport;
+    /**
+     * Canonical URL a client signed for this request (the signature's
+     * `@target-uri`). Defaults to the origin of `agentCard.url` plus the request's
+     * original path and query. Override when a path-rewriting proxy changes the
+     * path between the client and this process. Never derive it from a
+     * client-controlled `Host` / `X-Forwarded-*` header.
+     */
+    signedRequestsUrl?: (req: Request) => string;
+    /**
+     * Acknowledge that a seller advertising `signed-requests` / `request_signing`
+     * is not verifying signatures on this adapter (for example, an authenticating
+     * gateway in front of it does). Without this, `createA2AAdapter` refuses to
+     * construct when `server` advertises request signing but no gate is wired,
+     * because the advertisement would be false for A2A.
+     */
+    allowUnenforcedSignedRequests?: boolean;
 }
 /** Minimal Express app surface the adapter's `mount()` helper needs. */
 export interface ExpressAppLike {
@@ -227,6 +270,12 @@ export interface A2AAdapter {
     agentCardHandler: RequestHandler;
     /** Returns the merged, validated agent card. */
     getAgentCard(): Promise<AgentCard>;
+    /**
+     * `verify` hook for `express.json({ verify })` that records the exact request
+     * bytes on `req.rawBody`. Use it when a body parser must run ahead of the
+     * adapter on a signed-requests deployment.
+     */
+    rawBodyVerify: (req: IncomingMessage, res: unknown, buf: Buffer) => void;
     /**
      * Wire all A2A routes onto an Express-compatible app in one call.
      * Eliminates the "card mounted at only one location" footgun: the