@adcp/sdk 16.0.0-beta.3 → 16.0.0-beta.5

package/dist/lib/reporting/ledger/managed-postgres.d.mts

@@ -1,293 +0,0 @@
-import type { ReportingMaterialization, SyncReportingReceiptsResponse } from '../../types/index.mjs';
-import type { ReportingPgPool } from './postgres.mjs';
-import type { ReportingLedgerNotificationActivityPortV1, ReportingLedgerTransactionV1, ReportingManagedDeliveryBindingV1, ReportingLedgerStore } from './types.mjs';
-import { type ReportingObjectWritePlanV1, type ReportingObjectWriteScopeV1, type ReportingObjectWriteCursorV1, type ReportingObjectWriteV1, type ReportingObjectWriteBindingV1, type ReportingObjectWriteContextV1, type ReportingObjectWriteStoreV1, type ReportingObjectWriteAuthorityStoreV1 } from './object-writes.mjs';
-import { type ReportingDestinationAuthorizationV1, type ReportingDestinationRevocationLeaseV1, type ReportingManagedDeliveryLeaseV1, type ReportingManagedDeliveryAdvertisedPoliciesV1, type ReportingManagedDeliveryStore, type ReportingReceiptBatchInputV1 } from './managed.mjs';
-/**
- * Additive migration owned by #2944. It intentionally does not alter the Core
- * tables so the #2943 notification/activity bridge can evolve that schema
- * independently. Apply after REPORTING_LEDGER_MIGRATION in the same schema.
- *
- * @experimental Reliable Reporting storage surface: breaking changes may ship in minor releases. See https://github.com/adcontextprotocol/adcp-client/blob/main/docs/guides/REPORTING-STABILITY.md
- */
-export declare const REPORTING_MANAGED_DELIVERY_MIGRATION: string;
-/**
- * @experimental Reliable Reporting storage surface: breaking changes may ship in minor releases. See https://github.com/adcontextprotocol/adcp-client/blob/main/docs/guides/REPORTING-STABILITY.md
- */
-export interface PostgresReportingManagedDeliveryStoreOptions {
-    /** Transactional reporting outbox used for successful delivery-ready events. */
-    notificationActivityPort?: ReportingLedgerNotificationActivityPortV1<ReportingLedgerTransactionV1>;
-    /**
-     * The `automated_recovery_window_seconds` this deployment advertises.
-     *
-     * The capability is agent-wide and immutable once published, while bindings
-     * arrive over time, so validating only at startup leaves the window open:
-     * an agent advertising 60s starts clean and a 900s binding installed an hour
-     * later silently makes the published promise false until the next restart.
-     * Set here, `installBinding` refuses any Core configuration whose recovery
-     * window exceeds the advertised bound, inside the same transaction that
-     * checks binding eligibility. `createReportingManagedDeliveryRuntime` adopts
-     * its own advertised value into the store at wiring time, so setting it
-     * explicitly is only needed when bindings are installed without a runtime.
-     */
-    advertisedRecoveryWindowSeconds?: number;
-    /**
-     * The `status_retention_days` this deployment advertises.
-     *
-     * Supply it together with `evidenceRetentionDays` so the store can refuse a
-     * retention shorter than a horizon you have already promised. Pruning
-     * evidence the capability document still says is queryable is a broken
-     * promise, not a capacity optimisation.
-     */
-    statusRetentionDays?: number;
-    /**
-     * Days of managed evidence an account is still accountable for.
-     *
-     * MAX_MATERIALIZATIONS_PER_ACCOUNT and MAX_RECEIPTS_PER_CONSUMER are
-     * lifetime counts. Left unbounded they are a one-way door: a long-lived
-     * account eventually reaches them and then stops planning materializations
-     * and refuses every receipt, permanently, with no operator-visible way back
-     * — evidence is immutable, so nothing ever frees capacity.
-     *
-     * Setting this makes the caps active-scope: only evidence recorded inside
-     * the window counts against them, and `pruneExpiredEvidence` can delete what
-     * falls outside it. Choose a value at least as long as the
-     * `status_retention_days` you advertise, since that is the period you
-     * promised the metadata stays queryable. Omit it to keep the previous
-     * lifetime accounting with no pruning.
-     */
-    evidenceRetentionDays?: number;
-}
-/**
- * @experimental Reliable Reporting storage surface: breaking changes may ship in minor releases. See https://github.com/adcontextprotocol/adcp-client/blob/main/docs/guides/REPORTING-STABILITY.md
- */
-export declare class PostgresReportingManagedDeliveryStore implements ReportingManagedDeliveryStore, ReportingObjectWriteStoreV1, ReportingObjectWriteAuthorityStoreV1 {
-    private readonly pool;
-    private readonly evidenceRetentionDays;
-    private readonly statusRetentionDays;
-    private readonly pendingRecoveryWindowSeconds;
-    private policyRegistered;
-    private bindingAdmission;
-    private readonly notificationActivityPort?;
-    /**
-     * Durably records the agent-wide advertised recovery window.
-     *
-     * Written to the database, not held in memory: the promise is agent-wide,
-     * so a second store instance — in this process or another replica — must be
-     * held to the same value, and `installBinding` must read it inside its own
-     * transaction rather than trusting whatever the local object happens to
-     * know. Multiple replicas monotonically retain the smallest registered
-     * maximum: a shorter recovery promise is stronger and can never be widened
-     * by a later runtime.
-     */
-    adoptAdvertisedRecoveryWindowSeconds(seconds: number): Promise<void>;
-    /**
-     * Durably records the advertised `status_retention_days`.
-     *
-     * Retention is enforced against the widest promise any runtime registered
-     * over this database, so a store configured with a short evidence retention
-     * cannot prune inside a horizon a differently configured runtime published.
-     */
-    adoptAdvertisedStatusRetentionDays(days: number): Promise<void>;
-    /** Registers the complete capability policy under one lock and transaction. */
-    adoptAdvertisedPolicies(policy: ReportingManagedDeliveryAdvertisedPoliciesV1): Promise<ReportingManagedDeliveryAdvertisedPoliciesV1>;
-    /**
-     * Flushes constructor-supplied promises into the durable registry.
-     *
-     * Called from every entry point that depends on them, so a store built with
-     * options behaves identically to one a runtime adopted into.
-     */
-    private ensurePolicyRegistered;
-    private upsertPolicy;
-    private upsertPolicies;
-    private validateRecoveryWindow;
-    private readPolicyRow;
-    private readPolicy;
-    /** Read-only access to PostgreSQL row chunks for claim hydration. */
-    private readonly rowStorage;
-    constructor(pool: ReportingPgPool, options?: PostgresReportingManagedDeliveryStoreOptions);
-    /** SQL fragment scoping a count to the active retention window, if one is set. */
-    private activeScope;
-    /**
-     * Deletes managed evidence that has aged out of `evidenceRetentionDays`.
-     *
-     * Only ever removes evidence the deployment no longer promises: nothing
-     * inside the retention window, nothing still `pending` or leased, and no
-     * receipt batch inside its own replay retention. Immutable evidence stays
-     * immutable while it is retained — this frees capacity at the far end of the
-     * window rather than rewriting anything. Returns what it removed so a
-     * scheduler can page through with `limit`.
-     */
-    pruneExpiredEvidence(input: {
-        account_id: string;
-        limit?: number;
-    }): Promise<{
-        materializations: number;
-        receipts: number;
-        batches: number;
-    }>;
-    probe(coreStore: ReportingLedgerStore): Promise<boolean>;
-    listInstalledRecoveryWindowSeconds(): Promise<number[]>;
-    authorizeDestination(input: Omit<ReportingDestinationAuthorizationV1, 'revoked_at' | 'cleanup_completed_at'>): Promise<void>;
-    revokeDestination(input: {
-        account_id: string;
-        destination_ref: string;
-        generation: number;
-        revoked_at: string;
-    }): Promise<boolean>;
-    setBindingAdmission(admit: ((binding: ReportingManagedDeliveryBindingV1) => void) | undefined): void;
-    installBinding(binding: ReportingManagedDeliveryBindingV1): Promise<{
-        inserted: boolean;
-    }>;
-    planMaterializations(input?: {
-        account_id?: string;
-        limit?: number;
-    }): Promise<number>;
-    /**
-     * Claims a bounded, durable round-robin page of accounts that currently
-     * have at least one materialization candidate.
-     *
-     * The policy row serializes only the final cursor compare-and-set. Eligible
-     * account discovery runs without that global lock so retained revision
-     * history cannot block materialization settlement or revocation. The cursor
-     * advances before provider work; a crash may defer a selected account until
-     * the ring wraps, but can never pin every future sweep behind it.
-     */
-    private claimMaterializationPlanningAccounts;
-    claimMaterialization(input: {
-        owner: string;
-        now: string;
-        lease_milliseconds: number;
-        account_id?: string;
-    }): Promise<ReportingManagedDeliveryLeaseV1 | null>;
-    /**
-     * Fails materializations that have used every delivery attempt.
-     *
-     * The claim predicate stops handing them out, so without this they would
-     * stay `pending` — invisible to the planner, which skips an obligation with
-     * any pending row, and so never retried or replanned.
-     */
-    failExhaustedMaterializations(input?: {
-        account_id?: string;
-        limit?: number;
-    }): Promise<number>;
-    settleMaterialization(input: {
-        lease: ReportingManagedDeliveryLeaseV1;
-        now: string;
-        /** Retention the database must see satisfied, not just the worker. */
-        minimum_resource_retention_days?: number;
-        outcome: {
-            status: 'available' | 'delivered';
-            resource: NonNullable<ReportingMaterialization['resource']>;
-            verification: NonNullable<ReportingMaterialization['verification']>;
-        } | {
-            status: 'failed';
-            failure_code: string;
-        };
-    }): Promise<boolean>;
-    claimRevocation(input: {
-        owner: string;
-        now: string;
-        lease_milliseconds: number;
-        account_id?: string;
-        authorization_revocation_seconds?: number;
-        steal_after_milliseconds?: number;
-    }): Promise<ReportingDestinationRevocationLeaseV1 | null>;
-    completeRevocation(input: {
-        lease: ReportingDestinationRevocationLeaseV1;
-        completed_at: string;
-    }): Promise<boolean>;
-    releaseRevocation(input: {
-        lease: ReportingDestinationRevocationLeaseV1;
-        backoff_milliseconds?: number;
-    }): Promise<boolean>;
-    getReadableResource(input: {
-        account_id: string;
-        resource_ref: string;
-    }): Promise<{
-        materialization: {
-            reporting_materialization_id: string;
-            reporting_revision_id: string;
-            reporting_obligation_id: string;
-            delivery_config_id: string;
-            delivery_config_version: number;
-            destination_ref: string;
-            feed_purpose: import("../../types/tools.generated.mjs").ReportingFeedPurpose;
-            method: "file_transfer" | "dataset_share" | "warehouse_materialization";
-            transport?: string;
-            attempt: number;
-            status: "pending" | "available" | "delivered" | "failed";
-            ready_at?: string;
-            failed_at?: string;
-            failure_code?: string;
-            resource?: import("../../types/index.mjs").ReportingResource;
-            verification?: import("../../types/index.mjs").ReportingVerification;
-            created_at: string;
-        };
-        binding: ReportingManagedDeliveryBindingV1;
-    } | null>;
-    /** Freeze all writable names under the same locks as revokeDestination. */
-    registerObjectWritePlan(input: ReportingObjectWritePlanV1, context?: ReportingObjectWriteContextV1): Promise<'registered' | 'unchanged' | 'revoked'>;
-    listRevokedObjectWrites(inputScope: ReportingObjectWriteScopeV1, inputOptions?: {
-        after?: ReportingObjectWriteCursorV1;
-        limit?: number;
-    }, context?: ReportingObjectWriteContextV1): Promise<Array<ReportingObjectWriteV1 & ReportingObjectWriteCursorV1>>;
-    markObjectWriteFenced(input: ReportingObjectWriteScopeV1 & ReportingObjectWriteCursorV1 & {
-        tombstone_generation: string;
-    }, context?: ReportingObjectWriteContextV1): Promise<void>;
-    getObjectWriteBinding(input: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
-    probeObjectWriteAuthority(context?: ReportingObjectWriteContextV1): Promise<boolean>;
-    getObjectWriteAuthorityId(context?: ReportingObjectWriteContextV1): Promise<string>;
-    getAuthorizedObjectWriteBinding(input: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
-    getObjectWritePlan(input: ReportingObjectWriteScopeV1, planId: string, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWritePlanV1 | null>;
-    /**
-     * Generations that carry no recorded pattern/transport, with why the
-     * migration backfill could not infer them. These are routed to a router's
-     * `legacyDefault` (or fail revocation with a typed error) until the host
-     * supplies the contract. Read-only; it never edits a row.
-     *
-     * `no_binding`: nothing to infer from. `binding_without_transport`: at least
-     * one binding names no transport. `bindings_disagree`: the bindings name
-     * different methods or transports. `not_recorded`: the bindings agree, but
-     * the generation was created without a contract after the one-time backfill
-     * ran, so nothing records it.
-     */
-    listDestinationAuthorizationsWithoutContract(input?: {
-        account_id?: string;
-        limit?: number;
-    }): Promise<Array<{
-        account_id: string;
-        destination_ref: string;
-        generation: number;
-        reason: 'no_binding' | 'binding_without_transport' | 'bindings_disagree' | 'not_recorded';
-    }>>;
-    isAuthorizationCurrent(input: {
-        account_id: string;
-        destination_ref: string;
-        generation: number;
-    }): Promise<boolean>;
-    syncReceiptBatch(input: ReportingReceiptBatchInputV1): Promise<SyncReportingReceiptsResponse['results']>;
-    /**
-     * Rebuilds a prior batch response from the compact replay record plus the
-     * append-only receipt rows, re-checking authorization exactly as the first
-     * call did so a revoked destination cannot be replayed back into disclosure.
-     */
-    /**
-     * Replays a prior batch response exactly.
-     *
-     * An exact same-key replay is side-effect free and returns the caller its own
-     * previously recorded verdict, so later revocation of the destination does
-     * not change it. Downgrading a replay to `failed` once authorization ended
-     * broke the protocol-wide rule that a replayed idempotency key returns the
-     * same response, and bought nothing: the body is the caller's own receipt
-     * echoed back with the verdict it already received, so a revoked caller
-     * learns nothing it did not already hold. Fail-closed still governs every
-     * path that *accepts* new evidence — `loadReceiptEvidence` joins
-     * `revoked_at IS NULL` — and nothing here reads another consumer's rows.
-     */
-    private replayReceiptBatch;
-    private recordReceipt;
-    private loadReceiptEvidence;
-    private transaction;
-    private query;
-}

package/dist/lib/reporting/ledger/managed-postgres.d.ts

@@ -1,293 +0,0 @@
-import type { ReportingMaterialization, SyncReportingReceiptsResponse } from '../../types';
-import type { ReportingPgPool } from './postgres';
-import type { ReportingLedgerNotificationActivityPortV1, ReportingLedgerTransactionV1, ReportingManagedDeliveryBindingV1, ReportingLedgerStore } from './types';
-import { type ReportingObjectWritePlanV1, type ReportingObjectWriteScopeV1, type ReportingObjectWriteCursorV1, type ReportingObjectWriteV1, type ReportingObjectWriteBindingV1, type ReportingObjectWriteContextV1, type ReportingObjectWriteStoreV1, type ReportingObjectWriteAuthorityStoreV1 } from './object-writes';
-import { type ReportingDestinationAuthorizationV1, type ReportingDestinationRevocationLeaseV1, type ReportingManagedDeliveryLeaseV1, type ReportingManagedDeliveryAdvertisedPoliciesV1, type ReportingManagedDeliveryStore, type ReportingReceiptBatchInputV1 } from './managed';
-/**
- * Additive migration owned by #2944. It intentionally does not alter the Core
- * tables so the #2943 notification/activity bridge can evolve that schema
- * independently. Apply after REPORTING_LEDGER_MIGRATION in the same schema.
- *
- * @experimental Reliable Reporting storage surface: breaking changes may ship in minor releases. See https://github.com/adcontextprotocol/adcp-client/blob/main/docs/guides/REPORTING-STABILITY.md
- */
-export declare const REPORTING_MANAGED_DELIVERY_MIGRATION: string;
-/**
- * @experimental Reliable Reporting storage surface: breaking changes may ship in minor releases. See https://github.com/adcontextprotocol/adcp-client/blob/main/docs/guides/REPORTING-STABILITY.md
- */
-export interface PostgresReportingManagedDeliveryStoreOptions {
-    /** Transactional reporting outbox used for successful delivery-ready events. */
-    notificationActivityPort?: ReportingLedgerNotificationActivityPortV1<ReportingLedgerTransactionV1>;
-    /**
-     * The `automated_recovery_window_seconds` this deployment advertises.
-     *
-     * The capability is agent-wide and immutable once published, while bindings
-     * arrive over time, so validating only at startup leaves the window open:
-     * an agent advertising 60s starts clean and a 900s binding installed an hour
-     * later silently makes the published promise false until the next restart.
-     * Set here, `installBinding` refuses any Core configuration whose recovery
-     * window exceeds the advertised bound, inside the same transaction that
-     * checks binding eligibility. `createReportingManagedDeliveryRuntime` adopts
-     * its own advertised value into the store at wiring time, so setting it
-     * explicitly is only needed when bindings are installed without a runtime.
-     */
-    advertisedRecoveryWindowSeconds?: number;
-    /**
-     * The `status_retention_days` this deployment advertises.
-     *
-     * Supply it together with `evidenceRetentionDays` so the store can refuse a
-     * retention shorter than a horizon you have already promised. Pruning
-     * evidence the capability document still says is queryable is a broken
-     * promise, not a capacity optimisation.
-     */
-    statusRetentionDays?: number;
-    /**
-     * Days of managed evidence an account is still accountable for.
-     *
-     * MAX_MATERIALIZATIONS_PER_ACCOUNT and MAX_RECEIPTS_PER_CONSUMER are
-     * lifetime counts. Left unbounded they are a one-way door: a long-lived
-     * account eventually reaches them and then stops planning materializations
-     * and refuses every receipt, permanently, with no operator-visible way back
-     * — evidence is immutable, so nothing ever frees capacity.
-     *
-     * Setting this makes the caps active-scope: only evidence recorded inside
-     * the window counts against them, and `pruneExpiredEvidence` can delete what
-     * falls outside it. Choose a value at least as long as the
-     * `status_retention_days` you advertise, since that is the period you
-     * promised the metadata stays queryable. Omit it to keep the previous
-     * lifetime accounting with no pruning.
-     */
-    evidenceRetentionDays?: number;
-}
-/**
- * @experimental Reliable Reporting storage surface: breaking changes may ship in minor releases. See https://github.com/adcontextprotocol/adcp-client/blob/main/docs/guides/REPORTING-STABILITY.md
- */
-export declare class PostgresReportingManagedDeliveryStore implements ReportingManagedDeliveryStore, ReportingObjectWriteStoreV1, ReportingObjectWriteAuthorityStoreV1 {
-    private readonly pool;
-    private readonly evidenceRetentionDays;
-    private readonly statusRetentionDays;
-    private readonly pendingRecoveryWindowSeconds;
-    private policyRegistered;
-    private bindingAdmission;
-    private readonly notificationActivityPort?;
-    /**
-     * Durably records the agent-wide advertised recovery window.
-     *
-     * Written to the database, not held in memory: the promise is agent-wide,
-     * so a second store instance — in this process or another replica — must be
-     * held to the same value, and `installBinding` must read it inside its own
-     * transaction rather than trusting whatever the local object happens to
-     * know. Multiple replicas monotonically retain the smallest registered
-     * maximum: a shorter recovery promise is stronger and can never be widened
-     * by a later runtime.
-     */
-    adoptAdvertisedRecoveryWindowSeconds(seconds: number): Promise<void>;
-    /**
-     * Durably records the advertised `status_retention_days`.
-     *
-     * Retention is enforced against the widest promise any runtime registered
-     * over this database, so a store configured with a short evidence retention
-     * cannot prune inside a horizon a differently configured runtime published.
-     */
-    adoptAdvertisedStatusRetentionDays(days: number): Promise<void>;
-    /** Registers the complete capability policy under one lock and transaction. */
-    adoptAdvertisedPolicies(policy: ReportingManagedDeliveryAdvertisedPoliciesV1): Promise<ReportingManagedDeliveryAdvertisedPoliciesV1>;
-    /**
-     * Flushes constructor-supplied promises into the durable registry.
-     *
-     * Called from every entry point that depends on them, so a store built with
-     * options behaves identically to one a runtime adopted into.
-     */
-    private ensurePolicyRegistered;
-    private upsertPolicy;
-    private upsertPolicies;
-    private validateRecoveryWindow;
-    private readPolicyRow;
-    private readPolicy;
-    /** Read-only access to PostgreSQL row chunks for claim hydration. */
-    private readonly rowStorage;
-    constructor(pool: ReportingPgPool, options?: PostgresReportingManagedDeliveryStoreOptions);
-    /** SQL fragment scoping a count to the active retention window, if one is set. */
-    private activeScope;
-    /**
-     * Deletes managed evidence that has aged out of `evidenceRetentionDays`.
-     *
-     * Only ever removes evidence the deployment no longer promises: nothing
-     * inside the retention window, nothing still `pending` or leased, and no
-     * receipt batch inside its own replay retention. Immutable evidence stays
-     * immutable while it is retained — this frees capacity at the far end of the
-     * window rather than rewriting anything. Returns what it removed so a
-     * scheduler can page through with `limit`.
-     */
-    pruneExpiredEvidence(input: {
-        account_id: string;
-        limit?: number;
-    }): Promise<{
-        materializations: number;
-        receipts: number;
-        batches: number;
-    }>;
-    probe(coreStore: ReportingLedgerStore): Promise<boolean>;
-    listInstalledRecoveryWindowSeconds(): Promise<number[]>;
-    authorizeDestination(input: Omit<ReportingDestinationAuthorizationV1, 'revoked_at' | 'cleanup_completed_at'>): Promise<void>;
-    revokeDestination(input: {
-        account_id: string;
-        destination_ref: string;
-        generation: number;
-        revoked_at: string;
-    }): Promise<boolean>;
-    setBindingAdmission(admit: ((binding: ReportingManagedDeliveryBindingV1) => void) | undefined): void;
-    installBinding(binding: ReportingManagedDeliveryBindingV1): Promise<{
-        inserted: boolean;
-    }>;
-    planMaterializations(input?: {
-        account_id?: string;
-        limit?: number;
-    }): Promise<number>;
-    /**
-     * Claims a bounded, durable round-robin page of accounts that currently
-     * have at least one materialization candidate.
-     *
-     * The policy row serializes only the final cursor compare-and-set. Eligible
-     * account discovery runs without that global lock so retained revision
-     * history cannot block materialization settlement or revocation. The cursor
-     * advances before provider work; a crash may defer a selected account until
-     * the ring wraps, but can never pin every future sweep behind it.
-     */
-    private claimMaterializationPlanningAccounts;
-    claimMaterialization(input: {
-        owner: string;
-        now: string;
-        lease_milliseconds: number;
-        account_id?: string;
-    }): Promise<ReportingManagedDeliveryLeaseV1 | null>;
-    /**
-     * Fails materializations that have used every delivery attempt.
-     *
-     * The claim predicate stops handing them out, so without this they would
-     * stay `pending` — invisible to the planner, which skips an obligation with
-     * any pending row, and so never retried or replanned.
-     */
-    failExhaustedMaterializations(input?: {
-        account_id?: string;
-        limit?: number;
-    }): Promise<number>;
-    settleMaterialization(input: {
-        lease: ReportingManagedDeliveryLeaseV1;
-        now: string;
-        /** Retention the database must see satisfied, not just the worker. */
-        minimum_resource_retention_days?: number;
-        outcome: {
-            status: 'available' | 'delivered';
-            resource: NonNullable<ReportingMaterialization['resource']>;
-            verification: NonNullable<ReportingMaterialization['verification']>;
-        } | {
-            status: 'failed';
-            failure_code: string;
-        };
-    }): Promise<boolean>;
-    claimRevocation(input: {
-        owner: string;
-        now: string;
-        lease_milliseconds: number;
-        account_id?: string;
-        authorization_revocation_seconds?: number;
-        steal_after_milliseconds?: number;
-    }): Promise<ReportingDestinationRevocationLeaseV1 | null>;
-    completeRevocation(input: {
-        lease: ReportingDestinationRevocationLeaseV1;
-        completed_at: string;
-    }): Promise<boolean>;
-    releaseRevocation(input: {
-        lease: ReportingDestinationRevocationLeaseV1;
-        backoff_milliseconds?: number;
-    }): Promise<boolean>;
-    getReadableResource(input: {
-        account_id: string;
-        resource_ref: string;
-    }): Promise<{
-        materialization: {
-            reporting_materialization_id: string;
-            reporting_revision_id: string;
-            reporting_obligation_id: string;
-            delivery_config_id: string;
-            delivery_config_version: number;
-            destination_ref: string;
-            feed_purpose: import("../../types/tools.generated").ReportingFeedPurpose;
-            method: "file_transfer" | "dataset_share" | "warehouse_materialization";
-            transport?: string;
-            attempt: number;
-            status: "pending" | "available" | "delivered" | "failed";
-            ready_at?: string;
-            failed_at?: string;
-            failure_code?: string;
-            resource?: import("../../types").ReportingResource;
-            verification?: import("../../types").ReportingVerification;
-            created_at: string;
-        };
-        binding: ReportingManagedDeliveryBindingV1;
-    } | null>;
-    /** Freeze all writable names under the same locks as revokeDestination. */
-    registerObjectWritePlan(input: ReportingObjectWritePlanV1, context?: ReportingObjectWriteContextV1): Promise<'registered' | 'unchanged' | 'revoked'>;
-    listRevokedObjectWrites(inputScope: ReportingObjectWriteScopeV1, inputOptions?: {
-        after?: ReportingObjectWriteCursorV1;
-        limit?: number;
-    }, context?: ReportingObjectWriteContextV1): Promise<Array<ReportingObjectWriteV1 & ReportingObjectWriteCursorV1>>;
-    markObjectWriteFenced(input: ReportingObjectWriteScopeV1 & ReportingObjectWriteCursorV1 & {
-        tombstone_generation: string;
-    }, context?: ReportingObjectWriteContextV1): Promise<void>;
-    getObjectWriteBinding(input: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
-    probeObjectWriteAuthority(context?: ReportingObjectWriteContextV1): Promise<boolean>;
-    getObjectWriteAuthorityId(context?: ReportingObjectWriteContextV1): Promise<string>;
-    getAuthorizedObjectWriteBinding(input: ReportingObjectWriteScopeV1, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWriteBindingV1 | null>;
-    getObjectWritePlan(input: ReportingObjectWriteScopeV1, planId: string, context?: ReportingObjectWriteContextV1): Promise<ReportingObjectWritePlanV1 | null>;
-    /**
-     * Generations that carry no recorded pattern/transport, with why the
-     * migration backfill could not infer them. These are routed to a router's
-     * `legacyDefault` (or fail revocation with a typed error) until the host
-     * supplies the contract. Read-only; it never edits a row.
-     *
-     * `no_binding`: nothing to infer from. `binding_without_transport`: at least
-     * one binding names no transport. `bindings_disagree`: the bindings name
-     * different methods or transports. `not_recorded`: the bindings agree, but
-     * the generation was created without a contract after the one-time backfill
-     * ran, so nothing records it.
-     */
-    listDestinationAuthorizationsWithoutContract(input?: {
-        account_id?: string;
-        limit?: number;
-    }): Promise<Array<{
-        account_id: string;
-        destination_ref: string;
-        generation: number;
-        reason: 'no_binding' | 'binding_without_transport' | 'bindings_disagree' | 'not_recorded';
-    }>>;
-    isAuthorizationCurrent(input: {
-        account_id: string;
-        destination_ref: string;
-        generation: number;
-    }): Promise<boolean>;
-    syncReceiptBatch(input: ReportingReceiptBatchInputV1): Promise<SyncReportingReceiptsResponse['results']>;
-    /**
-     * Rebuilds a prior batch response from the compact replay record plus the
-     * append-only receipt rows, re-checking authorization exactly as the first
-     * call did so a revoked destination cannot be replayed back into disclosure.
-     */
-    /**
-     * Replays a prior batch response exactly.
-     *
-     * An exact same-key replay is side-effect free and returns the caller its own
-     * previously recorded verdict, so later revocation of the destination does
-     * not change it. Downgrading a replay to `failed` once authorization ended
-     * broke the protocol-wide rule that a replayed idempotency key returns the
-     * same response, and bought nothing: the body is the caller's own receipt
-     * echoed back with the verdict it already received, so a revoked caller
-     * learns nothing it did not already hold. Fail-closed still governs every
-     * path that *accepts* new evidence — `loadReceiptEvidence` joins
-     * `revoked_at IS NULL` — and nothing here reads another consumer's rows.
-     */
-    private replayReceiptBatch;
-    private recordReceipt;
-    private loadReceiptEvidence;
-    private transaction;
-    private query;
-}