@adcp/sdk 15.3.0 → 15.5.0

package/dist/lib/reporting/ledger/row-storage-object.d.mts

@@ -0,0 +1,112 @@
+/**
+ * Object-storage providers for revision row chunks (shared SDK persistence
+ * spec, adcontextprotocol/adcp#7996 §3.3–§3.4).
+ *
+ * A provider is a thin, credential-free port over one object store. It never
+ * decides where bytes go: keys are rendered by the SDK from an allowlisted
+ * binding, and every byte a provider returns is verified against digests
+ * committed in PostgreSQL before rows are released.
+ */
+export interface ReportingRowObjectContextV1 {
+    signal: AbortSignal;
+}
+export interface ReportingRowObjectLocationV1 {
+    /** Non-secret provider coordinates (bucket, container, filesystem root name, endpoint host). */
+    readonly location: Readonly<Record<string, string>>;
+    /** Host-mapped client reference; never a secret. */
+    readonly credentialRef?: string;
+}
+export interface ReportingRowObjectPutInputV1 extends ReportingRowObjectLocationV1 {
+    key: string;
+    bytes: Uint8Array;
+    contentType: 'application/x-ndjson' | 'application/gzip';
+    /** Non-secret object metadata (installation and intent identifiers). */
+    metadata: Readonly<Record<string, string>>;
+}
+export interface ReportingRowObjectGetInputV1 extends ReportingRowObjectLocationV1 {
+    key: string;
+    /** Exact native version recorded at write time. */
+    nativeVersion: string;
+    /** Byte range within the stored object; omit for the whole object. */
+    range?: {
+        offset: number;
+        length: number;
+    };
+    /** Hard cap on bytes read; providers abort beyond it. */
+    maxBytes: number;
+}
+export interface ReportingRowObjectDeleteInputV1 extends ReportingRowObjectLocationV1 {
+    key: string;
+    nativeVersion: string;
+}
+export interface ReportingRowObjectProviderV1 {
+    /** Registry name, e.g. `filesystem`, `gcs`, `s3`, `azure_blob`. */
+    readonly name: string;
+    /** Whether `get` honours `range` without reading the whole object. */
+    readonly rangedReads: boolean;
+    /**
+     * Validate binding coordinates against the provider's closed schema. Throw
+     * `INVALID_INPUT` for unknown fields or values that could carry secrets.
+     */
+    validateLocation(location: Readonly<Record<string, string>>): void;
+    /** Fail closed (`UNSAFE_BINDING`) when the destination is unsafe or create-only writes are not enforced. */
+    probe(input: ReportingRowObjectLocationV1 & {
+        prefix: string;
+    }, context: ReportingRowObjectContextV1): Promise<void>;
+    /**
+     * Create-only write. Returns `created: true` with the new native version, or
+     * `created: false` with the existing object's version when the key is taken.
+     * Must never replace an existing object.
+     */
+    putIfAbsent(input: ReportingRowObjectPutInputV1, context: ReportingRowObjectContextV1): Promise<{
+        created: boolean;
+        nativeVersion: string;
+    }>;
+    /** Bytes at the exact native version, or `null` when that version is absent. */
+    get(input: ReportingRowObjectGetInputV1, context: ReportingRowObjectContextV1): Promise<Uint8Array | null>;
+    /** Delete the exact native version. Idempotent: `absent` is success. */
+    delete(input: ReportingRowObjectDeleteInputV1, context: ReportingRowObjectContextV1): Promise<'deleted' | 'absent'>;
+}
+/** Placeholders allowed in object key templates. */
+export declare const REPORTING_ROW_KEY_PLACEHOLDERS: readonly ["prefix", "namespace_key", "account_key", "period_date", "finality", "revision_key", "content_sha256", "chunk_index"];
+export declare const REPORTING_ROW_DEFAULT_KEY_TEMPLATE = "{prefix}/{namespace_key}/{account_key}/{period_date}/{finality}/{revision_key}/{content_sha256}/{chunk_index}";
+/** Validate an object key template; throws `INVALID_INPUT`. */
+export declare function assertReportingRowKeyTemplateV1(template: string): void;
+export declare function assertReportingRowPrefixV1(prefix: string): void;
+/** Pseudonymous account segment; never a raw account ID. */
+export declare function reportingRowAccountKeyV1(namespaceKey: string, accountId: string): string;
+export declare function reportingRowRevisionKeyV1(rowSetId: string): string;
+/** Render one chunk's object key and confine it to the binding's owned prefix. */
+export declare function renderReportingRowObjectKeyV1(input: {
+    template: string;
+    prefix: string;
+    namespaceKey: string;
+    accountId: string;
+    rowSetId: string;
+    periodStart?: string;
+    finality?: 'snapshot' | 'official';
+    contentSha256: string;
+    chunkIndex: number;
+    compression: 'none' | 'gzip';
+}): string;
+export interface FilesystemReportingRowObjectProviderOptionsV1 {
+    /**
+     * Root name → absolute directory. Bindings name a root (`location.root`);
+     * they never carry paths, so the database cannot point writes elsewhere.
+     */
+    roots: Readonly<Record<string, string>>;
+}
+/**
+ * Local filesystem provider for tests and single-host deployments. Create-only
+ * writes use a temporary file, `fsync`, and `link()` to the final name, which
+ * fails rather than replacing an existing object.
+ */
+export declare function createFilesystemReportingRowObjectProviderV1(options: FilesystemReportingRowObjectProviderOptionsV1): ReportingRowObjectProviderV1;
+/**
+ * Behavioural conformance for a custom object provider. Writes and deletes
+ * only under `prefix`; run it against a dedicated test bucket or prefix.
+ * Resolves with the checks that passed; rejects on the first violation.
+ */
+export declare function runReportingRowObjectProviderConformanceV1(provider: ReportingRowObjectProviderV1, input: ReportingRowObjectLocationV1 & {
+    prefix: string;
+}): Promise<string[]>;

package/dist/lib/reporting/ledger/row-storage-object.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Object-storage providers for revision row chunks (shared SDK persistence
+ * spec, adcontextprotocol/adcp#7996 §3.3–§3.4).
+ *
+ * A provider is a thin, credential-free port over one object store. It never
+ * decides where bytes go: keys are rendered by the SDK from an allowlisted
+ * binding, and every byte a provider returns is verified against digests
+ * committed in PostgreSQL before rows are released.
+ */
+export interface ReportingRowObjectContextV1 {
+    signal: AbortSignal;
+}
+export interface ReportingRowObjectLocationV1 {
+    /** Non-secret provider coordinates (bucket, container, filesystem root name, endpoint host). */
+    readonly location: Readonly<Record<string, string>>;
+    /** Host-mapped client reference; never a secret. */
+    readonly credentialRef?: string;
+}
+export interface ReportingRowObjectPutInputV1 extends ReportingRowObjectLocationV1 {
+    key: string;
+    bytes: Uint8Array;
+    contentType: 'application/x-ndjson' | 'application/gzip';
+    /** Non-secret object metadata (installation and intent identifiers). */
+    metadata: Readonly<Record<string, string>>;
+}
+export interface ReportingRowObjectGetInputV1 extends ReportingRowObjectLocationV1 {
+    key: string;
+    /** Exact native version recorded at write time. */
+    nativeVersion: string;
+    /** Byte range within the stored object; omit for the whole object. */
+    range?: {
+        offset: number;
+        length: number;
+    };
+    /** Hard cap on bytes read; providers abort beyond it. */
+    maxBytes: number;
+}
+export interface ReportingRowObjectDeleteInputV1 extends ReportingRowObjectLocationV1 {
+    key: string;
+    nativeVersion: string;
+}
+export interface ReportingRowObjectProviderV1 {
+    /** Registry name, e.g. `filesystem`, `gcs`, `s3`, `azure_blob`. */
+    readonly name: string;
+    /** Whether `get` honours `range` without reading the whole object. */
+    readonly rangedReads: boolean;
+    /**
+     * Validate binding coordinates against the provider's closed schema. Throw
+     * `INVALID_INPUT` for unknown fields or values that could carry secrets.
+     */
+    validateLocation(location: Readonly<Record<string, string>>): void;
+    /** Fail closed (`UNSAFE_BINDING`) when the destination is unsafe or create-only writes are not enforced. */
+    probe(input: ReportingRowObjectLocationV1 & {
+        prefix: string;
+    }, context: ReportingRowObjectContextV1): Promise<void>;
+    /**
+     * Create-only write. Returns `created: true` with the new native version, or
+     * `created: false` with the existing object's version when the key is taken.
+     * Must never replace an existing object.
+     */
+    putIfAbsent(input: ReportingRowObjectPutInputV1, context: ReportingRowObjectContextV1): Promise<{
+        created: boolean;
+        nativeVersion: string;
+    }>;
+    /** Bytes at the exact native version, or `null` when that version is absent. */
+    get(input: ReportingRowObjectGetInputV1, context: ReportingRowObjectContextV1): Promise<Uint8Array | null>;
+    /** Delete the exact native version. Idempotent: `absent` is success. */
+    delete(input: ReportingRowObjectDeleteInputV1, context: ReportingRowObjectContextV1): Promise<'deleted' | 'absent'>;
+}
+/** Placeholders allowed in object key templates. */
+export declare const REPORTING_ROW_KEY_PLACEHOLDERS: readonly ["prefix", "namespace_key", "account_key", "period_date", "finality", "revision_key", "content_sha256", "chunk_index"];
+export declare const REPORTING_ROW_DEFAULT_KEY_TEMPLATE = "{prefix}/{namespace_key}/{account_key}/{period_date}/{finality}/{revision_key}/{content_sha256}/{chunk_index}";
+/** Validate an object key template; throws `INVALID_INPUT`. */
+export declare function assertReportingRowKeyTemplateV1(template: string): void;
+export declare function assertReportingRowPrefixV1(prefix: string): void;
+/** Pseudonymous account segment; never a raw account ID. */
+export declare function reportingRowAccountKeyV1(namespaceKey: string, accountId: string): string;
+export declare function reportingRowRevisionKeyV1(rowSetId: string): string;
+/** Render one chunk's object key and confine it to the binding's owned prefix. */
+export declare function renderReportingRowObjectKeyV1(input: {
+    template: string;
+    prefix: string;
+    namespaceKey: string;
+    accountId: string;
+    rowSetId: string;
+    periodStart?: string;
+    finality?: 'snapshot' | 'official';
+    contentSha256: string;
+    chunkIndex: number;
+    compression: 'none' | 'gzip';
+}): string;
+export interface FilesystemReportingRowObjectProviderOptionsV1 {
+    /**
+     * Root name → absolute directory. Bindings name a root (`location.root`);
+     * they never carry paths, so the database cannot point writes elsewhere.
+     */
+    roots: Readonly<Record<string, string>>;
+}
+/**
+ * Local filesystem provider for tests and single-host deployments. Create-only
+ * writes use a temporary file, `fsync`, and `link()` to the final name, which
+ * fails rather than replacing an existing object.
+ */
+export declare function createFilesystemReportingRowObjectProviderV1(options: FilesystemReportingRowObjectProviderOptionsV1): ReportingRowObjectProviderV1;
+/**
+ * Behavioural conformance for a custom object provider. Writes and deletes
+ * only under `prefix`; run it against a dedicated test bucket or prefix.
+ * Resolves with the checks that passed; rejects on the first violation.
+ */
+export declare function runReportingRowObjectProviderConformanceV1(provider: ReportingRowObjectProviderV1, input: ReportingRowObjectLocationV1 & {
+    prefix: string;
+}): Promise<string[]>;

package/dist/lib/reporting/ledger/row-storage-object.js

@@ -0,0 +1,281 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var row_storage_object_exports = {};
+__export(row_storage_object_exports, {
+  REPORTING_ROW_DEFAULT_KEY_TEMPLATE: () => REPORTING_ROW_DEFAULT_KEY_TEMPLATE,
+  REPORTING_ROW_KEY_PLACEHOLDERS: () => REPORTING_ROW_KEY_PLACEHOLDERS,
+  assertReportingRowKeyTemplateV1: () => assertReportingRowKeyTemplateV1,
+  assertReportingRowPrefixV1: () => assertReportingRowPrefixV1,
+  createFilesystemReportingRowObjectProviderV1: () => createFilesystemReportingRowObjectProviderV1,
+  renderReportingRowObjectKeyV1: () => renderReportingRowObjectKeyV1,
+  reportingRowAccountKeyV1: () => reportingRowAccountKeyV1,
+  reportingRowRevisionKeyV1: () => reportingRowRevisionKeyV1,
+  runReportingRowObjectProviderConformanceV1: () => runReportingRowObjectProviderConformanceV1
+});
+module.exports = __toCommonJS(row_storage_object_exports);
+var import_crypto = require("crypto");
+var import_fs = require("fs");
+var path = __toESM(require("path"));
+var import_jcs = require('../../utils/jcs.js');
+var import_row_storage_errors = require('./row-storage-errors.js');
+const REPORTING_ROW_KEY_PLACEHOLDERS = Object.freeze([
+  "prefix",
+  "namespace_key",
+  "account_key",
+  "period_date",
+  "finality",
+  "revision_key",
+  "content_sha256",
+  "chunk_index"
+]);
+const REPORTING_ROW_DEFAULT_KEY_TEMPLATE = "{prefix}/{namespace_key}/{account_key}/{period_date}/{finality}/{revision_key}/{content_sha256}/{chunk_index}";
+const PREFIX = /^[A-Za-z0-9_.=-]+(?:\/[A-Za-z0-9_.=-]+)*$/;
+const KEY = /^[A-Za-z0-9_.=-]+(?:\/[A-Za-z0-9_.=-]+)*$/;
+const PLACEHOLDER = /\{([a-z0-9_]+)\}/g;
+function assertReportingRowKeyTemplateV1(template) {
+  if (!template.startsWith("{prefix}/{namespace_key}/")) {
+    throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", "key templates must begin with {prefix}/{namespace_key}/");
+  }
+  for (const required of ["{content_sha256}", "{chunk_index}"]) {
+    if (!template.includes(required)) {
+      throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", `key templates must include ${required}`);
+    }
+  }
+  const unknown = [...template.matchAll(PLACEHOLDER)].map((match) => match[1]).filter((name) => !REPORTING_ROW_KEY_PLACEHOLDERS.includes(name));
+  if (unknown.length > 0) {
+    throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", `unknown key template placeholders: ${unknown.join(", ")}`);
+  }
+  const literal = template.replace(PLACEHOLDER, "x");
+  if (!KEY.test(literal) || literal.split("/").some((segment) => segment === "." || segment === "..")) {
+    throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", "key template contains unsafe characters or segments");
+  }
+}
+function assertReportingRowPrefixV1(prefix) {
+  if (!PREFIX.test(prefix) || prefix.length > 512 || prefix.split("/").some((segment) => segment === "." || segment === "..")) {
+    throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", "row binding prefix is invalid");
+  }
+}
+function reportingRowAccountKeyV1(namespaceKey, accountId) {
+  return sha256Hex((0, import_jcs.canonicalize)(["adcp.account_key.v1", namespaceKey, accountId]));
+}
+function reportingRowRevisionKeyV1(rowSetId) {
+  return sha256Hex((0, import_jcs.canonicalize)(["adcp.revision_key.v1", rowSetId]));
+}
+function renderReportingRowObjectKeyV1(input) {
+  const values = {
+    prefix: input.prefix,
+    namespace_key: input.namespaceKey,
+    account_key: reportingRowAccountKeyV1(input.namespaceKey, input.accountId),
+    period_date: periodDate(input.periodStart),
+    finality: input.finality ?? "adjustment",
+    revision_key: reportingRowRevisionKeyV1(input.rowSetId),
+    content_sha256: input.contentSha256,
+    chunk_index: String(input.chunkIndex).padStart(6, "0")
+  };
+  const key = input.template.replace(PLACEHOLDER, (_, name) => values[name]) + (input.compression === "gzip" ? ".jsonl.gz" : ".jsonl");
+  if (!KEY.test(key) || key.split("/").some((segment) => segment === "." || segment === "..") || !key.startsWith(`${input.prefix}/${input.namespaceKey}/`)) {
+    throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", "rendered object key escapes the binding prefix");
+  }
+  return key;
+}
+function periodDate(periodStart) {
+  if (!periodStart) return "undated";
+  const parsed = new Date(periodStart);
+  if (Number.isNaN(parsed.getTime())) return "undated";
+  return parsed.toISOString().slice(0, 10).replace(/-/g, "/");
+}
+function createFilesystemReportingRowObjectProviderV1(options) {
+  const roots = /* @__PURE__ */ new Map();
+  for (const [name, directory] of Object.entries(options.roots)) {
+    if (!/^[A-Za-z0-9_.-]{1,64}$/.test(name) || !path.isAbsolute(directory)) {
+      throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", "filesystem roots need a simple name and an absolute path");
+    }
+    roots.set(name, path.resolve(directory));
+  }
+  const resolve = (location, key) => {
+    const root = roots.get(location.root ?? "");
+    if (!root) throw new import_row_storage_errors.ReportingRowStoreError("UNSAFE_BINDING", "filesystem root is not configured");
+    const target = path.resolve(root, key);
+    if (!target.startsWith(root + path.sep)) {
+      throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", "object key escapes the filesystem root");
+    }
+    return target;
+  };
+  const version = async (target) => {
+    const stat = await import_fs.promises.stat(target);
+    return `${stat.ino}:${stat.mtimeMs}:${stat.size}`;
+  };
+  return {
+    name: "filesystem",
+    rangedReads: true,
+    validateLocation(location) {
+      const keys = Object.keys(location);
+      if (keys.length !== 1 || keys[0] !== "root" || !roots.has(location.root)) {
+        throw new import_row_storage_errors.ReportingRowStoreError("INVALID_INPUT", "filesystem locations name exactly one configured root");
+      }
+    },
+    async probe(input) {
+      const root = roots.get(input.location.root ?? "");
+      if (!root) throw new import_row_storage_errors.ReportingRowStoreError("UNSAFE_BINDING", "filesystem root is not configured");
+      await import_fs.promises.mkdir(root, { recursive: true });
+    },
+    async putIfAbsent(input, context) {
+      context.signal.throwIfAborted();
+      const target = resolve(input.location, input.key);
+      await import_fs.promises.mkdir(path.dirname(target), { recursive: true });
+      const temporary = `${target}.${(0, import_crypto.randomUUID)()}.tmp`;
+      const handle = await import_fs.promises.open(temporary, "wx");
+      try {
+        await handle.writeFile(input.bytes);
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      try {
+        await import_fs.promises.link(temporary, target);
+        return { created: true, nativeVersion: await version(target) };
+      } catch (error) {
+        if (error.code === "EEXIST") {
+          return { created: false, nativeVersion: await version(target) };
+        }
+        throw new import_row_storage_errors.ReportingRowStoreError("PROVIDER_UNAVAILABLE", "filesystem write failed");
+      } finally {
+        await import_fs.promises.rm(temporary, { force: true });
+      }
+    },
+    async get(input, context) {
+      context.signal.throwIfAborted();
+      const target = resolve(input.location, input.key);
+      let handle;
+      try {
+        handle = await import_fs.promises.open(target, "r");
+      } catch (error) {
+        if (error.code === "ENOENT") return null;
+        throw new import_row_storage_errors.ReportingRowStoreError("PROVIDER_UNAVAILABLE", "filesystem read failed");
+      }
+      try {
+        const stat = await handle.stat();
+        if (`${stat.ino}:${stat.mtimeMs}:${stat.size}` !== input.nativeVersion) return null;
+        const offset = input.range?.offset ?? 0;
+        const length = input.range?.length ?? stat.size - offset;
+        if (offset < 0 || length < 0 || offset + length > stat.size) {
+          throw new import_row_storage_errors.ReportingRowStoreError("ROWS_INTEGRITY_FAILED", "requested range exceeds the stored object");
+        }
+        if (length > input.maxBytes) {
+          throw new import_row_storage_errors.ReportingRowStoreError("ROWS_INTEGRITY_FAILED", "stored object exceeds its recorded size");
+        }
+        const buffer = Buffer.alloc(length);
+        await handle.read(buffer, 0, length, offset);
+        return buffer;
+      } finally {
+        await handle.close();
+      }
+    },
+    async delete(input, context) {
+      context.signal.throwIfAborted();
+      const target = resolve(input.location, input.key);
+      try {
+        if (await version(target) !== input.nativeVersion) return "absent";
+        await import_fs.promises.unlink(target);
+        return "deleted";
+      } catch (error) {
+        if (error.code === "ENOENT") return "absent";
+        throw new import_row_storage_errors.ReportingRowStoreError("PROVIDER_UNAVAILABLE", "filesystem delete failed");
+      }
+    }
+  };
+}
+async function runReportingRowObjectProviderConformanceV1(provider, input) {
+  assertReportingRowPrefixV1(input.prefix);
+  provider.validateLocation(input.location);
+  const context = { signal: AbortSignal.timeout(6e4) };
+  const passed = [];
+  const key = `${input.prefix}/conformance/${(0, import_crypto.randomUUID)()}.jsonl`;
+  const first = Buffer.from('{"a":1}\n{"b":2}\n');
+  const metadata = { "adcp-installation": "conformance", "adcp-intent": "conformance" };
+  const base = { location: input.location, ...input.credentialRef ? { credentialRef: input.credentialRef } : {} };
+  await provider.probe(input, context);
+  passed.push("probe");
+  const created = await provider.putIfAbsent(
+    { ...base, key, bytes: first, contentType: "application/x-ndjson", metadata },
+    context
+  );
+  if (!created.created || !created.nativeVersion) throw new Error("putIfAbsent did not create a new object");
+  passed.push("create");
+  const conflict = await provider.putIfAbsent(
+    { ...base, key, bytes: Buffer.from('{"c":3}\n'), contentType: "application/x-ndjson", metadata },
+    context
+  );
+  if (conflict.created || conflict.nativeVersion !== created.nativeVersion) {
+    throw new Error("putIfAbsent replaced or re-versioned an existing object");
+  }
+  const stored = await provider.get({ ...base, key, nativeVersion: created.nativeVersion, maxBytes: 1024 }, context);
+  if (!stored || !Buffer.from(stored).equals(first))
+    throw new Error("create-only write did not preserve the first bytes");
+  passed.push("create-only");
+  if (provider.rangedReads) {
+    const ranged = await provider.get(
+      { ...base, key, nativeVersion: created.nativeVersion, range: { offset: 8, length: 8 }, maxBytes: 1024 },
+      context
+    );
+    if (!ranged || Buffer.from(ranged).toString("utf8") !== '{"b":2}\n')
+      throw new Error("ranged read returned wrong bytes");
+    passed.push("ranged-read");
+  }
+  if (await provider.get({ ...base, key, nativeVersion: "not-a-version", maxBytes: 1024 }, context) !== null) {
+    throw new Error("get returned bytes for a version that does not exist");
+  }
+  passed.push("version-pinned-read");
+  if (await provider.delete({ ...base, key, nativeVersion: "not-a-version" }, context) !== "absent") {
+    throw new Error("delete removed an object at a different version");
+  }
+  if (await provider.delete({ ...base, key, nativeVersion: created.nativeVersion }, context) !== "deleted") {
+    throw new Error("delete did not remove the exact version");
+  }
+  if (await provider.delete({ ...base, key, nativeVersion: created.nativeVersion }, context) !== "absent") {
+    throw new Error("repeated delete was not idempotent");
+  }
+  passed.push("exact-version-delete");
+  return passed;
+}
+function sha256Hex(value) {
+  return (0, import_crypto.createHash)("sha256").update(value).digest("hex");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  REPORTING_ROW_DEFAULT_KEY_TEMPLATE,
+  REPORTING_ROW_KEY_PLACEHOLDERS,
+  assertReportingRowKeyTemplateV1,
+  assertReportingRowPrefixV1,
+  createFilesystemReportingRowObjectProviderV1,
+  renderReportingRowObjectKeyV1,
+  reportingRowAccountKeyV1,
+  reportingRowRevisionKeyV1,
+  runReportingRowObjectProviderConformanceV1
+});