@adcp/sdk 16.0.0-beta.2 → 16.0.0-beta.4

package/dist/lib/types/enums.generated.d.ts

@@ -98,6 +98,8 @@ export declare const FrequencyCapDurationUnitValues: readonly ["seconds", "minut
 export declare const FrequencyCapMutableFieldValues: readonly ["max_impressions", "per", "window", "suppress"];
 export declare const FrequencyCapScopeValues: readonly ["package"];
 export declare const GenreTaxonomyValues: readonly ["iab_content_3.0", "iab_content_2.2", "gracenote", "eidr", "apple_genres", "google_genres", "roku", "amazon_genres", "custom"];
+export declare const GeographicPlaceIdentifierSystemValues: readonly ["geonames", "google_ads", "microsoft_ads"];
+export declare const GeographicPlaceTypeValues: readonly ["airport", "borough", "city", "city_region", "commune", "county", "district", "municipality", "neighborhood", "post_town", "prefecture", "province", "quarter", "state", "territory", "ward"];
 export declare const GeographicTargetingLevelValues: readonly ["country", "region", "metro", "postal_area"];
 export declare const GOPTypeValues: readonly ["closed", "open"];
 export declare const GovernanceDecisionValues: readonly ["approved", "denied", "conditions"];
@@ -200,6 +202,7 @@ export declare const SortMetricValues: readonly ["impressions", "spend", "clicks
 export declare const SpecialCategoryValues: readonly ["awards", "championship", "concert", "conference", "election", "festival", "gala", "holiday", "premiere", "product_launch", "reunion", "tribute"];
 export declare const SponsoredPlacementTypeValues: readonly ["sponsored_search", "sponsored_display", "sponsored_native"];
 export declare const StandardScopeValues: readonly ["attestation_verifier"];
+export declare const StartTimingValues: readonly ["asap"];
 export declare const StoryboardStatusValues: readonly ["passing", "failing", "partial", "untested", "skipped", "not_selected", "unknown"];
 export declare const TalentRoleValues: readonly ["host", "guest", "creator", "cast", "narrator", "producer", "correspondent", "commentator", "analyst"];
 export declare const TaskStatusValues: readonly ["submitted", "working", "input-required", "completed", "canceled", "failed", "rejected", "auth-required", "unknown"];

package/dist/lib/types/enums.generated.js

@@ -121,6 +121,8 @@ __export(enums_generated_exports, {
   FrequencyCapScopeValues: () => FrequencyCapScopeValues,
   GOPTypeValues: () => GOPTypeValues,
   GenreTaxonomyValues: () => GenreTaxonomyValues,
+  GeographicPlaceIdentifierSystemValues: () => GeographicPlaceIdentifierSystemValues,
+  GeographicPlaceTypeValues: () => GeographicPlaceTypeValues,
   GeographicTargetingLevelValues: () => GeographicTargetingLevelValues,
   GovernanceDecisionValues: () => GovernanceDecisionValues,
   GovernanceDomainValues: () => GovernanceDomainValues,
@@ -223,6 +225,7 @@ __export(enums_generated_exports, {
   SpecialCategoryValues: () => SpecialCategoryValues,
   SponsoredPlacementTypeValues: () => SponsoredPlacementTypeValues,
   StandardScopeValues: () => StandardScopeValues,
+  StartTimingValues: () => StartTimingValues,
   StoryboardStatusValues: () => StoryboardStatusValues,
   TMPResponseTypeValues: () => TMPResponseTypeValues,
   TalentRoleValues: () => TalentRoleValues,
@@ -354,6 +357,8 @@ const FrequencyCapDurationUnitValues = ["seconds", "minutes", "hours", "days", "
 const FrequencyCapMutableFieldValues = ["max_impressions", "per", "window", "suppress"];
 const FrequencyCapScopeValues = ["package"];
 const GenreTaxonomyValues = ["iab_content_3.0", "iab_content_2.2", "gracenote", "eidr", "apple_genres", "google_genres", "roku", "amazon_genres", "custom"];
+const GeographicPlaceIdentifierSystemValues = ["geonames", "google_ads", "microsoft_ads"];
+const GeographicPlaceTypeValues = ["airport", "borough", "city", "city_region", "commune", "county", "district", "municipality", "neighborhood", "post_town", "prefecture", "province", "quarter", "state", "territory", "ward"];
 const GeographicTargetingLevelValues = ["country", "region", "metro", "postal_area"];
 const GOPTypeValues = ["closed", "open"];
 const GovernanceDecisionValues = ["approved", "denied", "conditions"];
@@ -455,6 +460,7 @@ const SortMetricValues = ["impressions", "spend", "clicks", "ctr", "views", "com
 const SpecialCategoryValues = ["awards", "championship", "concert", "conference", "election", "festival", "gala", "holiday", "premiere", "product_launch", "reunion", "tribute"];
 const SponsoredPlacementTypeValues = ["sponsored_search", "sponsored_display", "sponsored_native"];
 const StandardScopeValues = ["attestation_verifier"];
+const StartTimingValues = ["asap"];
 const StoryboardStatusValues = ["passing", "failing", "partial", "untested", "skipped", "not_selected", "unknown"];
 const TalentRoleValues = ["host", "guest", "creator", "cast", "narrator", "producer", "correspondent", "commentator", "analyst"];
 const TaskStatusValues = ["submitted", "working", "input-required", "completed", "canceled", "failed", "rejected", "auth-required", "unknown"];
@@ -712,6 +718,8 @@ const RequestSigningErrorCodeMetadata = Object.freeze(requestSigningErrorCodeMet
   FrequencyCapScopeValues,
   GOPTypeValues,
   GenreTaxonomyValues,
+  GeographicPlaceIdentifierSystemValues,
+  GeographicPlaceTypeValues,
   GeographicTargetingLevelValues,
   GovernanceDecisionValues,
   GovernanceDomainValues,
@@ -814,6 +822,7 @@ const RequestSigningErrorCodeMetadata = Object.freeze(requestSigningErrorCodeMet
   SpecialCategoryValues,
   SponsoredPlacementTypeValues,
   StandardScopeValues,
+  StartTimingValues,
   StoryboardStatusValues,
   TMPResponseTypeValues,
   TalentRoleValues,

package/dist/lib/types/enums.generated.mjs

@@ -98,6 +98,8 @@ const FrequencyCapDurationUnitValues = ["seconds", "minutes", "hours", "days", "
 const FrequencyCapMutableFieldValues = ["max_impressions", "per", "window", "suppress"];
 const FrequencyCapScopeValues = ["package"];
 const GenreTaxonomyValues = ["iab_content_3.0", "iab_content_2.2", "gracenote", "eidr", "apple_genres", "google_genres", "roku", "amazon_genres", "custom"];
+const GeographicPlaceIdentifierSystemValues = ["geonames", "google_ads", "microsoft_ads"];
+const GeographicPlaceTypeValues = ["airport", "borough", "city", "city_region", "commune", "county", "district", "municipality", "neighborhood", "post_town", "prefecture", "province", "quarter", "state", "territory", "ward"];
 const GeographicTargetingLevelValues = ["country", "region", "metro", "postal_area"];
 const GOPTypeValues = ["closed", "open"];
 const GovernanceDecisionValues = ["approved", "denied", "conditions"];
@@ -199,6 +201,7 @@ const SortMetricValues = ["impressions", "spend", "clicks", "ctr", "views", "com
 const SpecialCategoryValues = ["awards", "championship", "concert", "conference", "election", "festival", "gala", "holiday", "premiere", "product_launch", "reunion", "tribute"];
 const SponsoredPlacementTypeValues = ["sponsored_search", "sponsored_display", "sponsored_native"];
 const StandardScopeValues = ["attestation_verifier"];
+const StartTimingValues = ["asap"];
 const StoryboardStatusValues = ["passing", "failing", "partial", "untested", "skipped", "not_selected", "unknown"];
 const TalentRoleValues = ["host", "guest", "creator", "cast", "narrator", "producer", "correspondent", "commentator", "analyst"];
 const TaskStatusValues = ["submitted", "working", "input-required", "completed", "canceled", "failed", "rejected", "auth-required", "unknown"];
@@ -455,6 +458,8 @@ export {
   FrequencyCapScopeValues,
   GOPTypeValues,
   GenreTaxonomyValues,
+  GeographicPlaceIdentifierSystemValues,
+  GeographicPlaceTypeValues,
   GeographicTargetingLevelValues,
   GovernanceDecisionValues,
   GovernanceDomainValues,
@@ -557,6 +562,7 @@ export {
   SpecialCategoryValues,
   SponsoredPlacementTypeValues,
   StandardScopeValues,
+  StartTimingValues,
   StoryboardStatusValues,
   TMPResponseTypeValues,
   TalentRoleValues,

package/dist/lib/validation/schema-loader.js

@@ -48,6 +48,7 @@ __export(schema_loader_exports, {
   listValidatorKeys: () => listValidatorKeys,
   registerExternalSchemaRoot: () => registerExternalSchemaRoot,
   resolveBundleKey: () => resolveBundleKey,
+  resolveServedValidationVersion: () => resolveServedValidationVersion,
   schemaAllowsTopLevelField: () => schemaAllowsTopLevelField,
   toReleasePrecisionWire: () => toReleasePrecisionWire,
   unregisterExternalSchemaRoot: () => unregisterExternalSchemaRoot,
@@ -754,6 +755,29 @@ function hasSchemaBundle(version) {
     return false;
   }
 }
+const SERVED_RELEASE_MAJOR = /^(\d+)\.\d+(?:-[a-zA-Z0-9.-]+)?$/;
+const NUMERIC_PIN_MAJOR = /^(\d+)\.\d+/;
+function resolveServedValidationVersion(response, pinnedVersion) {
+  const pinMajor = NUMERIC_PIN_MAJOR.exec(pinnedVersion)?.[1];
+  if (pinMajor === void 0) return pinnedVersion;
+  try {
+    if (isExternalSchemaRootActive(pinnedVersion)) return pinnedVersion;
+  } catch {
+    return pinnedVersion;
+  }
+  const echoed = response !== null && typeof response === "object" ? response.adcp_version : void 0;
+  if (typeof echoed !== "string") return pinnedVersion;
+  const echoMajor = SERVED_RELEASE_MAJOR.exec(echoed)?.[1];
+  if (echoMajor === void 0 || echoMajor !== pinMajor) return pinnedVersion;
+  let pinnedRelease;
+  try {
+    pinnedRelease = toReleasePrecisionWire(pinnedVersion);
+  } catch {
+    return pinnedVersion;
+  }
+  if (echoed === pinnedRelease) return pinnedVersion;
+  return hasSchemaBundle(echoed) ? echoed : pinnedVersion;
+}
 const mcpToolSchemaCache = /* @__PURE__ */ new Map();
 const mcpToolSummaryCache = /* @__PURE__ */ new Map();
 function boundedMcpToolSummary(value) {
@@ -1019,6 +1043,7 @@ function cloneJsonValue(value) {
   listValidatorKeys,
   registerExternalSchemaRoot,
   resolveBundleKey,
+  resolveServedValidationVersion,
   schemaAllowsTopLevelField,
   toReleasePrecisionWire,
   unregisterExternalSchemaRoot,

package/dist/lib/validation/schema-loader.mjs

@@ -701,6 +701,29 @@ function hasSchemaBundle(version) {
     return false;
   }
 }
+const SERVED_RELEASE_MAJOR = /^(\d+)\.\d+(?:-[a-zA-Z0-9.-]+)?$/;
+const NUMERIC_PIN_MAJOR = /^(\d+)\.\d+/;
+function resolveServedValidationVersion(response, pinnedVersion) {
+  const pinMajor = NUMERIC_PIN_MAJOR.exec(pinnedVersion)?.[1];
+  if (pinMajor === void 0) return pinnedVersion;
+  try {
+    if (isExternalSchemaRootActive(pinnedVersion)) return pinnedVersion;
+  } catch {
+    return pinnedVersion;
+  }
+  const echoed = response !== null && typeof response === "object" ? response.adcp_version : void 0;
+  if (typeof echoed !== "string") return pinnedVersion;
+  const echoMajor = SERVED_RELEASE_MAJOR.exec(echoed)?.[1];
+  if (echoMajor === void 0 || echoMajor !== pinMajor) return pinnedVersion;
+  let pinnedRelease;
+  try {
+    pinnedRelease = toReleasePrecisionWire(pinnedVersion);
+  } catch {
+    return pinnedVersion;
+  }
+  if (echoed === pinnedRelease) return pinnedVersion;
+  return hasSchemaBundle(echoed) ? echoed : pinnedVersion;
+}
 const mcpToolSchemaCache = /* @__PURE__ */ new Map();
 const mcpToolSummaryCache = /* @__PURE__ */ new Map();
 function boundedMcpToolSummary(value) {
@@ -965,6 +988,7 @@ export {
   listValidatorKeys,
   registerExternalSchemaRoot,
   resolveBundleKey,
+  resolveServedValidationVersion,
   schemaAllowsTopLevelField,
   toReleasePrecisionWire,
   unregisterExternalSchemaRoot,

package/dist/lib/version.d.mts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "16.0.0-beta.2";
+export declare const LIBRARY_VERSION = "16.0.0-beta.4";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "16.0.0-beta.2";
+    readonly library: "16.0.0-beta.4";
     readonly adcp: "3.2.4";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
-    readonly generatedAt: "2026-10-15T15:37:12.181Z";
+    readonly generatedAt: "2026-10-16T14:15:27.258Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.d.ts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "16.0.0-beta.2";
+export declare const LIBRARY_VERSION = "16.0.0-beta.4";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "16.0.0-beta.2";
+    readonly library: "16.0.0-beta.4";
     readonly adcp: "3.2.4";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
-    readonly generatedAt: "2026-10-15T15:37:12.181Z";
+    readonly generatedAt: "2026-10-16T14:15:27.258Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -31,7 +31,7 @@ __export(version_exports, {
   toReleasePrecisionVersion: () => toReleasePrecisionVersion
 });
 module.exports = __toCommonJS(version_exports);
-const LIBRARY_VERSION = "16.0.0-beta.2";
+const LIBRARY_VERSION = "16.0.0-beta.4";
 const ADCP_VERSION = "3.2.4";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -98,10 +98,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2.4"
 ];
 const VERSION_INFO = {
-  library: "16.0.0-beta.2",
+  library: "16.0.0-beta.4",
   adcp: "3.2.4",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-15T15:37:12.181Z"
+  generatedAt: "2026-10-16T14:15:27.258Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/version.mjs

@@ -1,4 +1,4 @@
-const LIBRARY_VERSION = "16.0.0-beta.2";
+const LIBRARY_VERSION = "16.0.0-beta.4";
 const ADCP_VERSION = "3.2.4";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -65,10 +65,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2.4"
 ];
 const VERSION_INFO = {
-  library: "16.0.0-beta.2",
+  library: "16.0.0-beta.4",
   adcp: "3.2.4",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-15T15:37:12.181Z"
+  generatedAt: "2026-10-16T14:15:27.258Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/docs/TYPE-SUMMARY.md

@@ -1,7 +1,7 @@
 # AdCP Type Summary
 
-> Generated at: 2026-10-15
-> @adcp/sdk v16.0.0-beta.2
+> Generated at: 2026-10-16
+> @adcp/sdk v16.0.0-beta.4
 
 Curated reference of the types that matter for using the AdCP client. For full generated types see `src/lib/types/tools.generated.ts` and `src/lib/types/core.generated.ts`.
 
@@ -49,6 +49,11 @@ interface A2ALegacyCompatOptions {
 }
 
 interface TransportOptions {
+  // Defaults to 4 MiB (DEFAULT_MAX_RESPONSE_BYTES); only 0 opts out
+  // (Infinity / negatives fall back to the default).
+  // SSE is bounded per event plus `maxResponseBytes * 2` cumulative per call.
+  // Over-cap responses throw ResponseTooLargeError; nothing is truncated.
+  // A per-call `transport` replaces this object; it does not merge.
   maxResponseBytes?: number;
   trustedFetchFn?: typeof fetch;
   allowPrivateIp?: boolean;
@@ -2895,9 +2900,23 @@ interface InlineReportingAvailabilityEvidenceV1 {
 
 ## Seller Reporting Ledger
 
-Ledger symbols import from `@adcp/sdk/reporting/ledger`; `createPostgresPersistentNotificationRuntime` is a server symbol and imports from `@adcp/sdk/server`.
+The ledger interface, handlers and producer import from `@adcp/sdk/reporting/ledger`. The PostgreSQL store, its migrations, row storage and maintenance import from `@adcp/reporting-storage`, managed delivery from `@adcp/reporting-storage/managed` and notification activity from `@adcp/reporting-storage/notifications` (install `@adcp/reporting-storage` next to `@adcp/sdk`; it is pre-1.0 and every export is experimental). `createPostgresPersistentNotificationRuntime` is a server symbol and imports from `@adcp/sdk/server`.
 
 ```typescript
+import { Pool } from 'pg';
+import { createPostgresPersistentNotificationRuntime } from '@adcp/sdk/server';
+import {
+  createReportingDeliveryHandler,
+  createReportingProducer,
+  createReportingStatusHandler,
+  createSyncReportingStatusHandler,
+} from '@adcp/sdk/reporting/ledger';
+import { PostgresReportingLedgerStore, REPORTING_LEDGER_MIGRATION } from '@adcp/reporting-storage';
+import {
+  createPostgresReportingNotificationActivityRuntime,
+  createPostgresReportingNotificationAttemptCheckpoint,
+} from '@adcp/reporting-storage/notifications';
+
 // Build the notification path first: the store must be constructed with the
 // activity port, or lifecycle transitions record no activity and notify nobody.
 const attemptCheckpoint = createPostgresReportingNotificationAttemptCheckpoint({
@@ -2960,6 +2979,9 @@ The store freezes configuration lineage and period-end denominators, retains imm
 Import from `@adcp/sdk/reporting/service`. This is the adapter-first lifecycle owner over the source and ledger primitives; it does not introduce another store or transport.
 
 ```typescript
+import { createReliableReportingService } from '@adcp/sdk/reporting/service';
+import { PostgresReportingLedgerStore, reportingLedgerMaintenance } from '@adcp/reporting-storage';
+
 interface ReliableReportingAdapterV1 {
   readonly sourceOffering: ReportingSourceOfferingV1;
   readonly deliveryOffering: ReportingDeliveryOffering;
@@ -2982,9 +3004,10 @@ const reporting = createReliableReportingService({
   resolveCurrency: account => currency,
   resolveCoverage: account => ({ constituents }), // authorized media-buy/package denominator
   resolveConsumerId, // optional; controls consumer-status handler/capability
+  maintenance: reportingLedgerMaintenance({ retention: { enabled: true } }), // optional factory from @adcp/reporting-storage
 });
 
-await pool.query(reporting.setup.migrations[0]);
+for (const sql of reporting.setup.migrations) await pool.query(sql);
 const installedPlatform = reporting.install(platform);
 await reporting.installConfiguration(configuration, { account: ctx.account });
 await reporting.runCycle({ accountId }); // tenant-partitioned
@@ -2994,7 +3017,7 @@ await reporting.stop();
 
 Account identity comes only from the framework-resolved context. Trusted host callbacks derive adapter routing, credential-free `sourceScope`, source timezone, currency, and the authorized constituent denominator. A declaration cannot supply `account`, `sourceScope`, `sourceTimezone`, `contract`, `currency`, `constituents`, or `mediaBuyIds`; `mediaBuyIds` is derived from `resolveCoverage`, so a buyer cannot name another buyer's media buys on a shared upstream network. Currency is frozen into configuration and obligation lineage. Capabilities are Core-only and derived from installed adapters and handlers; managed delivery, reconciled billing, receipts, webhook activity, and notifications are not advertised. Installation requires `platform.accounts.upsert`, which owns the advertised `sync_accounts` configuration path.
 
-For complete seller production assembly, use async `createPostgresReliableReportingProductionService` from `@adcp/sdk/reporting/service`. It owns the PostgreSQL Core/Managed stores, receipts, all three reporting notifications, webhook activity, migrations, probes, recovery, and capability publication. Supply `activity.tenantScopeForAccount`; Reconciled Billing offerings also require a trusted `obligatedConsumers` roster. Its scheduler and `recoverOnce` require explicit `deploymentWide: true` because recovery scans the whole namespace. See `docs/guides/REPORTING-LEDGER.md` and `docs/guides/REPORTING-OPERATIONS.md`.
+For complete seller production assembly, use async `createPostgresReliableReportingProductionService` from `@adcp/reporting-storage/service`. It owns the PostgreSQL Core/Managed stores, receipts, all three reporting notifications, webhook activity, migrations, probes, recovery, and capability publication. Supply `activity.tenantScopeForAccount`; Reconciled Billing offerings also require a trusted `obligatedConsumers` roster. Its scheduler and `recoverOnce` require explicit `deploymentWide: true` because recovery scans the whole namespace. See `docs/guides/REPORTING-LEDGER.md` and `docs/guides/REPORTING-OPERATIONS.md`.
 
 Buyer production processes use `createPostgresReportingConsumerRuntimeV1` with `createReliableReportingConsumerV1` from the package root. Verify webhook signatures before passing authenticated hints, preserve seller/principal scope, and configure `evaluateAdjustment` to authorize integrity-valid post-official corrections; the default defers them. See `docs/guides/REPORTING-RECONCILIATION.md`.
 

package/docs/guides/DISCOVERY-CACHE-AND-SESSION-REUSE.md

@@ -55,7 +55,7 @@ The key is a SHA-256 over:
 | configured `adcpVersion` / `wireAdcpVersion`         | negotiated version                                                                                                     |
 | every non-correlation, non-credential header         | unknown `x-*` tenant / routing / policy headers can select a different upstream view, so they fail closed into the key. This includes `baggage`, **ambient OpenTelemetry baggage included** |
 | request-signing identity and policy                  | `kind`, `kid`, `alg`, agent URL and signing policy; never the private key                                              |
-| effective `allowPrivateIp`, `maxResponseBytes`       | the transport policy the evidence was gathered under (per-call `transport` overrides included)                         |
+| configured `allowPrivateIp`, `maxResponseBytes`      | the transport policy the evidence was gathered under (per-call `transport` overrides included). These are the values the caller *configured*, not the effective ones: an unset `maxResponseBytes` keys as "unset" rather than as the 4 MiB default, so entries written before the default landed stay reusable. The MCP connection cache keys the *resolved* cap instead — see [Reusable MCP connections](#reusable-mcp-connections) |
 
 Not part of the key: correlation headers (`x-request-id`, `x-correlation-id`, `traceparent`, ...), and credential header values (`Authorization`, `x-adcp-auth`) — OAuth and `auth_token` credentials are also owned by `authIdentity`; a token rotation for the same authorization scope keeps the entry. **Choose `authIdentity` at least as narrow as the credential's authorization scope.** Change the identity or invalidate the cache when permissions change or access is revoked; use a distinct identity for anonymous access. Two principals must never share an identity. Keys are hashes and never contain the identity, token or header values.
 
@@ -101,7 +101,7 @@ Unlike [`primeCapabilities`](../TYPE-SUMMARY.md) — which stays client-bound an
 
 This behavior applies by default, including calls that pass a signal or timeout outside a connection scope. The process-wide legacy/OAuth session cache retains at most 20 connections per cache with LRU eviction and has no idle expiry. For request workflows with many distinct credentials, use a scope to bound session lifetime. At process shutdown, `closeConnections()` from `@adcp/sdk/advanced` closes the process-wide connections.
 
-A reusable session is keyed only by what changes the _connection_: endpoint, credential, tenant / routing headers, signing identity, `allowPrivateIp`, a caller-injected fetch, and the workflow scope. These no longer choose or split a session:
+A reusable session is keyed only by what changes the _connection_: endpoint, credential, tenant / routing headers, signing identity, `allowPrivateIp`, `maxResponseBytes`, a caller-injected fetch, and the workflow scope. These no longer choose or split a session:
 
 - **Correlation headers**: `traceparent`, `tracestate`, `x-request-id`, `x-correlation-id`, `x-trace-id`, `x-span-id`, `x-debug-id`, `x-client-request-id`, `x-b3-*`, `x-amzn-trace-id`, `x-cloud-trace-context`, `x-datadog-*`, `sentry-trace`, and vendor-prefixed `x-<vendor>-request-id` / `-correlation-id` / `-trace-id` / `-span-id` / `-debug-id`. Names suggesting credentials or tenant/routing identity (including `auth`, `token`, `tenant`, `account`, `workspace`, `seat`, `advertiser`, `publisher`, `buyer` and `seller`) are never treated as correlation. **`baggage` stays in the key**: it can carry tenant or routing members. Any header outside the list above also stays in the key (fail closed).
 - **`AbortSignal`** and **`requestTimeoutMs`**: they bound a call.
@@ -114,6 +114,7 @@ Isolation properties:
 - A caller that joins another caller's in-flight connect waits under its own signal and timeout. If the creator cancels the connect, the joiner retries for itself, with at most two retries after foreign aborts.
 - A caller-injected `fetchFn` (a per-call network trust boundary) keeps its own one-shot session outside a connection scope; inside a scope its identity is part of the key.
 - Connections are never shared across credentials, tenant headers, signing identities or `allowPrivateIp` settings.
+- Connections are never shared across different `maxResponseBytes` values either. The response cap is decided once per request, and a session's standalone `GET` event-stream listener issues exactly one request — at connect time — so it carries whatever policy opened the connection for the life of that connection. Sharing across policies would let one `maxResponseBytes: 0` call hand an uncapped listener to every later caller. The key uses the *resolved* cap, so an explicit `4 * 1024 * 1024` and an unset value are the same policy and share a session; `0` and any other number each get their own. Varying the cap per call therefore costs a session per distinct value against the same agent, against a 20-entry LRU — prefer a single client-level value where you can, or pin the session with `withMCPConnectionScope` where continuity matters.
 
 ### Public connection scope
 

package/docs/guides/REPORTING-GCS-FENCE.md

@@ -1,12 +1,12 @@
 # Durable GCS reporting write fence
 
-`@adcp/sdk/reporting/gcs` provides a provider write-fence primitive backed by the existing PostgreSQL destination authority. It is a building block for a managed delivery adapter; it does not advertise Managed Delivery or Reconciled Billing capabilities or implement `ReportingManagedDeliveryAdapterV1`.
+`@adcp/reporting-storage/gcs` provides a provider write-fence primitive backed by the existing PostgreSQL destination authority. It is a building block for a managed delivery adapter; it does not advertise Managed Delivery or Reconciled Billing capabilities or implement `ReportingManagedDeliveryAdapterV1`.
 
-Install the optional official Google client with `npm install @google-cloud/storage@^7.22.0` for Node 20 or Node 22+. Google client `^8.2.0` is also supported on Node 22+. This peer is required when compiling or using the GCS subpath, including its public types; other SDK subpaths remain independent. Apply `REPORTING_LEDGER_MIGRATION`, `REPORTING_MANAGED_DELIVERY_MIGRATION`, then the additive `REPORTING_OBJECT_WRITE_MIGRATION` from `@adcp/sdk/reporting/ledger` in the same isolated tenant schema. Apply the final migration to a fresh object-write schema if experimenting with earlier, unpublished versions of these tables: `CREATE TABLE IF NOT EXISTS` does not upgrade incompatible prerelease tables.
+Install the optional official Google client with `npm install @google-cloud/storage@^7.22.0` for Node 20 or Node 22+. Google client `^8.2.0` is also supported on Node 22+. This peer is required when compiling or using the GCS subpath, including its public types; other subpaths remain independent. Apply `REPORTING_LEDGER_MIGRATION`, `REPORTING_MANAGED_DELIVERY_MIGRATION`, then the additive `REPORTING_OBJECT_WRITE_MIGRATION` from `@adcp/reporting-storage` (and `@adcp/reporting-storage/managed` for the managed-delivery one) in the same isolated tenant schema. Apply the final migration to a fresh object-write schema if experimenting with earlier, unpublished versions of these tables: `CREATE TABLE IF NOT EXISTS` does not upgrade incompatible prerelease tables.
 
 ```typescript
 import { Storage } from '@google-cloud/storage';
-import { createGcsReportingObjectFenceV1 } from '@adcp/sdk/reporting/gcs';
+import { createGcsReportingObjectFenceV1 } from '@adcp/reporting-storage/gcs';
 
 const fence = createGcsReportingObjectFenceV1({
   storage: new Storage({ retryOptions: { totalTimeout: 60, maxRetries: 3 } }), // Host-owned ADC; retry timeout is in seconds.

package/docs/guides/REPORTING-GCS-MANAGED.md

@@ -1,17 +1,17 @@
 # Managed reporting delivery on GCS
 
-`@adcp/sdk/reporting/gcs` supplies a complete `ReportingManagedDeliveryAdapterV1` for private GCS file transfer. It supports `manifest_checksums` and `canonical_digest` by uploading deterministic JSONL and manifest bytes, then inspecting actual provider bytes and digest-pinned private contracts. The managed runtime owns materialization settlement, cleanup leases, retries and capability publication. Verification is attributed to the producer; independent buyer qualification is a separate gate.
+`@adcp/reporting-storage/gcs` supplies a complete `ReportingManagedDeliveryAdapterV1` for private GCS file transfer. It supports `manifest_checksums` and `canonical_digest` by uploading deterministic JSONL and manifest bytes, then inspecting actual provider bytes and digest-pinned private contracts. The managed runtime owns materialization settlement, cleanup leases, retries and capability publication. Verification is attributed to the producer; independent buyer qualification is a separate gate.
 
 Install the optional official `@google-cloud/storage` peer. Use 7.22.x on Node 20.19 or later; Storage 8.2.x requires Node 22 or later. The default SDK import does not load Google Storage. Supply a host-owned official Storage client using ADC, workload identity or short-lived impersonation. Never persist credentials in reporting descriptors, contract URIs, `ctx_metadata`, inventory or error envelopes.
 
-Apply `REPORTING_LEDGER_MIGRATION`, the applicable Core writer-fence migration, `REPORTING_MANAGED_DELIVERY_MIGRATION`, `REPORTING_OBJECT_WRITE_MIGRATION`, then `REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION` from `@adcp/sdk/reporting/ledger`. The last migration requires PostgreSQL 13 or later and creates one persistent installation UUID per isolated schema. Reapplying it preserves the UUID. Keep that row in backups and restores. **Never run delivery or cleanup from an independently writable clone of live authorization, inventory or materialization tables.** Such a clone would still address the original objects. Start a fresh isolated schema with a distinct deployment namespace and installation UUID, provision new destination grants, and import only the needed immutable Core facts. A restored replica of the same authority keeps its identity. Do not replace an identity while old write plans still exist. The adapter combines the UUID with your stable deployment namespace to avoid collisions between isolated schemas sharing a bucket.
+Apply `REPORTING_LEDGER_MIGRATION`, the applicable Core writer-fence migration, `REPORTING_MANAGED_DELIVERY_MIGRATION`, `REPORTING_OBJECT_WRITE_MIGRATION`, then `REPORTING_OBJECT_WRITE_AUTHORITY_MIGRATION` from `@adcp/reporting-storage` (`REPORTING_MANAGED_DELIVERY_MIGRATION` is on `@adcp/reporting-storage/managed`). The last migration requires PostgreSQL 13 or later and creates one persistent installation UUID per isolated schema. Reapplying it preserves the UUID. Keep that row in backups and restores. **Never run delivery or cleanup from an independently writable clone of live authorization, inventory or materialization tables.** Such a clone would still address the original objects. Start a fresh isolated schema with a distinct deployment namespace and installation UUID, provision new destination grants, and import only the needed immutable Core facts. A restored replica of the same authority keeps its identity. Do not replace an identity while old write plans still exist. The adapter combines the UUID with your stable deployment namespace to avoid collisions between isolated schemas sharing a bucket.
 
 Core and managed stores must share the exact same PostgreSQL pool, and Core must enable `managedDelivery: true`. The factory probes both stores and the provider policy before returning an adapter. Hosts supply pool acquisition/connect timeouts; transactions started with a signal additionally limit lock and statement waits. Readiness is bounded by the operation deadline, at most 60 seconds.
 
 ```typescript
 import { Storage } from '@google-cloud/storage';
-import { createGcsReportingManagedDeliveryAdapterV1 } from '@adcp/sdk/reporting/gcs';
-import { createReportingManagedDeliveryRuntime } from '@adcp/sdk/reporting/ledger';
+import { createGcsReportingManagedDeliveryAdapterV1 } from '@adcp/reporting-storage/gcs';
+import { createReportingManagedDeliveryRuntime } from '@adcp/reporting-storage/managed';
 
 const adapter = await createGcsReportingManagedDeliveryAdapterV1({
   storage: new Storage(), // ADC/workload identity; no keys in reporting state

package/docs/guides/REPORTING-LEDGER-CUTOVER.md

@@ -3,7 +3,7 @@
 This guide is for a seller that already runs its own Reliable Reporting ledger
 (tables for configuration generations, obligations and revisions, row files in
 object storage and a warehouse, status issues and transitions) and wants
-`@adcp/sdk` to own the ledger from now on. Read the
+`@adcp/sdk` and `@adcp/reporting-storage` to own the ledger from now on. Read the
 [ledger guide](REPORTING-LEDGER.md) first for the SDK side, and the
 [operations runbook](REPORTING-OPERATIONS.md) for production practice.
 
@@ -28,7 +28,7 @@ You have two ways to run the SDK's service on top of what you have.
 | Change feed | `changeFeed: true`: `changesAfter`, current-revision reads, consumer cursors | You implement it, or go without host reads and the warehouse sink |
 | Retention | `maintenance.retention`: period-aligned retirement honouring the change-feed hold | You implement `retireExpiredPeriods` and tombstones, or never retire |
 | Maintenance | `maintenance`: snapshot sweep, abandoned-upload sweep, feed pruning | You write all of it |
-| Warehouse | `@adcp/sdk/reporting/bigquery` sink | Not available: it reads the SDK store |
+| Warehouse | `@adcp/reporting-storage/bigquery` sink | Not available: it reads the SDK store |
 | Correctness | Lease fencing, gap-free status checkpoints, immutable generations and the revision binding are enforced in one tested place | Every one of those guarantees is yours to prove |
 | Existing data | Starts empty; old tables stay behind a read-only hook | Old data served natively |
 
@@ -52,8 +52,8 @@ advertise Managed Delivery or Reconciled Billing today, read
 ```ts
 import { Pool } from 'pg';
 import { Storage } from '@google-cloud/storage';
-import { PostgresReportingLedgerStore } from '@adcp/sdk/reporting/ledger';
-import { createGcsReportingRowObjectProviderV1 } from '@adcp/sdk/reporting/gcs';
+import { PostgresReportingLedgerStore, reportingLedgerMaintenance } from '@adcp/reporting-storage';
+import { createGcsReportingRowObjectProviderV1 } from '@adcp/reporting-storage/gcs';
 import { createReliableReportingService } from '@adcp/sdk/reporting/service';
 
 // Apply once, in order, with your migration owner (PostgreSQL 13+):
@@ -86,10 +86,10 @@ const reporting = createReliableReportingService({
   statusRetentionDays: 90, // the commitment advertised to buyers; retention uses it
   // ...adapters, contact, resolveSource, resolveCurrency, resolveCoverage
   legacyRevisionReader, // see "The legacy fallback hook"
-  maintenance: {
+  maintenance: reportingLedgerMaintenance({
     retention: { enabled: true, recordRetentionDays: 120, limit: 100 },
     changeFeed: { changeRetentionDays: 30, maxFeedHoldDays: 7 },
-  },
+  }),
 });
 ```
 
@@ -118,7 +118,7 @@ state. The bytes live in your bucket.
 
 ### Keeping your BigQuery tables fed
 
-`@adcp/sdk/reporting/bigquery` follows the change feed and loads every
+`@adcp/reporting-storage/bigquery` follows the change feed and loads every
 committed revision's verified rows into BigQuery tables you name
 ([sink details](REPORTING-LEDGER.md#bigquery-warehouse-sink)). The warehouse
 copy is derived and never served.