@plasius/economy 0.10.0 → 0.11.0

package/dist/index.d.cts

@@ -1229,7 +1229,7 @@ interface EconomyIdPort {
 
 /** Additive authoritative command types; legacy V1/V2 command unions stay unchanged. */
 type EconomyAuditedCommandTypeV1 = EconomyCommandType | "initialize-wallet" | "initialize-admin-reporting";
-type EconomyCommandSourceV1 = "browser" | "shopify" | "ayet" | "bitlabs" | "operator" | "system";
+type EconomyCommandSourceV1 = "browser" | "shopify" | "ayet" | "bitlabs" | "google-ad-manager" | "operator" | "system";
 type EconomyCommandProcessingModeV1 = "initial" | "replay";
 type EconomyPrincipalTypeV1 = "account" | "delegated-child" | "service" | "operator";
 type EconomyCausationKindV1 = "provider-event" | "economy-command" | "ledger-transaction" | "workflow-event" | "authority-commit";
@@ -1298,7 +1298,7 @@ interface AuditedEconomyCommandEnvelopeV1 {
     readonly acceptedRegion: string;
     readonly writerFencingToken: string;
 }
-type EconomyAcquisitionProviderV1 = "shopify" | "ayet" | "bitlabs";
+type EconomyAcquisitionProviderV1 = "shopify" | "ayet" | "bitlabs" | "google-ad-manager";
 /**
  * Privacy-minimized verified provider evidence. Every value derived from a raw
  * provider identifier or callback body is represented by a domain-separated
@@ -1315,8 +1315,17 @@ interface EconomyProviderEvidenceHashV1 {
     readonly eventType: string;
     readonly payloadFingerprint: EconomyHmacFingerprintV1;
     readonly reconciliationEvidenceFingerprint?: EconomyHmacFingerprintV1;
-    readonly signatureScheme: string;
-    readonly signatureVerifiedAt: IsoTimestamp;
+    /** Legacy/signed-callback verification fields; both must be present together. */
+    readonly signatureScheme?: string;
+    readonly signatureVerifiedAt?: IsoTimestamp;
+    /**
+     * Additive discriminator. Omitted legacy evidence remains provider-signed.
+     * Google final reports must use authenticated retrieval, never a fabricated
+     * provider-signature claim.
+     */
+    readonly verificationMode?: "provider-signature" | "authenticated-retrieval";
+    readonly authenticatedRetrievalScheme?: string;
+    readonly authenticatedRetrievedAt?: IsoTimestamp;
     readonly providerOccurredAt?: IsoTimestamp;
     readonly receivedAt: IsoTimestamp;
     readonly operationalHandleBindingId?: string;

package/dist/index.d.ts

@@ -1229,7 +1229,7 @@ interface EconomyIdPort {
 
 /** Additive authoritative command types; legacy V1/V2 command unions stay unchanged. */
 type EconomyAuditedCommandTypeV1 = EconomyCommandType | "initialize-wallet" | "initialize-admin-reporting";
-type EconomyCommandSourceV1 = "browser" | "shopify" | "ayet" | "bitlabs" | "operator" | "system";
+type EconomyCommandSourceV1 = "browser" | "shopify" | "ayet" | "bitlabs" | "google-ad-manager" | "operator" | "system";
 type EconomyCommandProcessingModeV1 = "initial" | "replay";
 type EconomyPrincipalTypeV1 = "account" | "delegated-child" | "service" | "operator";
 type EconomyCausationKindV1 = "provider-event" | "economy-command" | "ledger-transaction" | "workflow-event" | "authority-commit";
@@ -1298,7 +1298,7 @@ interface AuditedEconomyCommandEnvelopeV1 {
     readonly acceptedRegion: string;
     readonly writerFencingToken: string;
 }
-type EconomyAcquisitionProviderV1 = "shopify" | "ayet" | "bitlabs";
+type EconomyAcquisitionProviderV1 = "shopify" | "ayet" | "bitlabs" | "google-ad-manager";
 /**
  * Privacy-minimized verified provider evidence. Every value derived from a raw
  * provider identifier or callback body is represented by a domain-separated
@@ -1315,8 +1315,17 @@ interface EconomyProviderEvidenceHashV1 {
     readonly eventType: string;
     readonly payloadFingerprint: EconomyHmacFingerprintV1;
     readonly reconciliationEvidenceFingerprint?: EconomyHmacFingerprintV1;
-    readonly signatureScheme: string;
-    readonly signatureVerifiedAt: IsoTimestamp;
+    /** Legacy/signed-callback verification fields; both must be present together. */
+    readonly signatureScheme?: string;
+    readonly signatureVerifiedAt?: IsoTimestamp;
+    /**
+     * Additive discriminator. Omitted legacy evidence remains provider-signed.
+     * Google final reports must use authenticated retrieval, never a fabricated
+     * provider-signature claim.
+     */
+    readonly verificationMode?: "provider-signature" | "authenticated-retrieval";
+    readonly authenticatedRetrievalScheme?: string;
+    readonly authenticatedRetrievedAt?: IsoTimestamp;
     readonly providerOccurredAt?: IsoTimestamp;
     readonly receivedAt: IsoTimestamp;
     readonly operationalHandleBindingId?: string;

package/dist/index.js

@@ -1903,6 +1903,7 @@ var COMMAND_SOURCES = /* @__PURE__ */ new Set([
   "shopify",
   "ayet",
   "bitlabs",
+  "google-ad-manager",
   "operator",
   "system"
 ]);
@@ -1915,7 +1916,8 @@ var PRINCIPAL_TYPES = /* @__PURE__ */ new Set([
 var PROVIDER_SOURCES = /* @__PURE__ */ new Set([
   "shopify",
   "ayet",
-  "bitlabs"
+  "bitlabs",
+  "google-ad-manager"
 ]);
 var CAUSATION_KINDS = /* @__PURE__ */ new Set([
   "provider-event",
@@ -1927,7 +1929,8 @@ var CAUSATION_KINDS = /* @__PURE__ */ new Set([
 var PROVIDERS = /* @__PURE__ */ new Set([
   "shopify",
   "ayet",
-  "bitlabs"
+  "bitlabs",
+  "google-ad-manager"
 ]);
 var FINGERPRINT_DOMAINS = /* @__PURE__ */ new Set([
   "economy.idempotency-key.v1",
@@ -1957,6 +1960,12 @@ var SOURCE_COMMAND_TYPES = {
   ]),
   ayet: /* @__PURE__ */ new Set(["credit-reward", "hold", "release-hold", "reverse"]),
   bitlabs: /* @__PURE__ */ new Set(["credit-reward", "hold", "release-hold", "reverse"]),
+  "google-ad-manager": /* @__PURE__ */ new Set([
+    "credit-reward",
+    "hold",
+    "release-hold",
+    "reverse"
+  ]),
   operator: /* @__PURE__ */ new Set(["adjust", "reverse", "hold", "release-hold"]),
   system: /* @__PURE__ */ new Set([
     "credit-event",
@@ -2230,6 +2239,9 @@ function assertEconomyProviderEvidenceHash(evidence) {
       "reconciliationEvidenceFingerprint",
       "signatureScheme",
       "signatureVerifiedAt",
+      "verificationMode",
+      "authenticatedRetrievalScheme",
+      "authenticatedRetrievedAt",
       "providerOccurredAt",
       "receivedAt",
       "operationalHandleBindingId"
@@ -2264,9 +2276,27 @@ function assertEconomyProviderEvidenceHash(evidence) {
     );
   }
   assertSafeClassifier(evidence.eventType, "Provider event type");
-  assertSafeClassifier(evidence.signatureScheme, "Provider signature scheme");
-  const signatureVerifiedAt = parseIsoTimestamp(evidence.signatureVerifiedAt);
   const receivedAt = parseIsoTimestamp(evidence.receivedAt);
+  const signatureFieldsPresent = evidence.signatureScheme !== void 0 && evidence.signatureVerifiedAt !== void 0;
+  const retrievalFieldsPresent = evidence.authenticatedRetrievalScheme !== void 0 && evidence.authenticatedRetrievedAt !== void 0;
+  const verificationMode = evidence.verificationMode ?? "provider-signature";
+  economyAssert(
+    verificationMode === "provider-signature" && evidence.provider !== "google-ad-manager" && signatureFieldsPresent && !retrievalFieldsPresent && evidence.authenticatedRetrievalScheme === void 0 && evidence.authenticatedRetrievedAt === void 0 || verificationMode === "authenticated-retrieval" && evidence.provider === "google-ad-manager" && retrievalFieldsPresent && evidence.signatureScheme === void 0 && evidence.signatureVerifiedAt === void 0,
+    "INVALID_CONTRACT",
+    "Provider evidence must use exactly one permitted verification method"
+  );
+  const verifiedAt = verificationMode === "provider-signature" ? evidence.signatureVerifiedAt : evidence.authenticatedRetrievedAt;
+  if (verificationMode === "provider-signature") {
+    assertSafeClassifier(
+      evidence.signatureScheme,
+      "Provider signature scheme"
+    );
+  } else {
+    assertSafeClassifier(
+      evidence.authenticatedRetrievalScheme,
+      "Provider authenticated-retrieval scheme"
+    );
+  }
   if (evidence.providerOccurredAt !== void 0) {
     economyAssert(
       parseIsoTimestamp(evidence.providerOccurredAt) <= receivedAt,
@@ -2275,9 +2305,9 @@ function assertEconomyProviderEvidenceHash(evidence) {
     );
   }
   economyAssert(
-    receivedAt >= signatureVerifiedAt,
+    receivedAt >= parseIsoTimestamp(verifiedAt),
     "INVALID_TIME_WINDOW",
-    "Provider evidence cannot be received before signature verification"
+    "Provider evidence cannot be received before verification"
   );
   if (evidence.operationalHandleBindingId !== void 0) {
     assertEconomyIdentifier(
@@ -2627,8 +2657,13 @@ function canonicalEconomyProviderEvidenceHashPayload(evidence) {
         evidence.reconciliationEvidenceFingerprint
       )
     },
-    signatureScheme: evidence.signatureScheme,
-    signatureVerifiedAt: evidence.signatureVerifiedAt,
+    ...evidence.verificationMode === void 0 ? {} : { verificationMode: evidence.verificationMode },
+    ...evidence.signatureScheme === void 0 ? {} : { signatureScheme: evidence.signatureScheme },
+    ...evidence.signatureVerifiedAt === void 0 ? {} : { signatureVerifiedAt: evidence.signatureVerifiedAt },
+    ...evidence.authenticatedRetrievalScheme === void 0 ? {} : {
+      authenticatedRetrievalScheme: evidence.authenticatedRetrievalScheme
+    },
+    ...evidence.authenticatedRetrievedAt === void 0 ? {} : { authenticatedRetrievedAt: evidence.authenticatedRetrievedAt },
     ...evidence.providerOccurredAt === void 0 ? {} : { providerOccurredAt: evidence.providerOccurredAt },
     receivedAt: evidence.receivedAt,
     ...evidence.operationalHandleBindingId === void 0 ? {} : {
@@ -3682,6 +3717,15 @@ function assertReversalAvailable(originalTransactionId, existingTransactions) {
 }
 
 // src/audit-graph.ts
+var PROVIDER_COMMAND_SOURCES = /* @__PURE__ */ new Set([
+  "shopify",
+  "ayet",
+  "bitlabs",
+  "google-ad-manager"
+]);
+function isProviderCommandSource(source) {
+  return PROVIDER_COMMAND_SOURCES.has(source);
+}
 function assertCanonicalHash4(value, label) {
   economyAssert(
     typeof value === "string" && /^sha256:[a-f0-9]{64}$/u.test(value),
@@ -3709,7 +3753,7 @@ function assertCreatedReference(manifest, kind, id, contentHash) {
 }
 function assertProviderGraph(graph, hash, acceptanceCommit) {
   const envelope = graph.commandEnvelope;
-  const providerSource = envelope.commandSource === "shopify" || envelope.commandSource === "ayet" || envelope.commandSource === "bitlabs";
+  const providerSource = isProviderCommandSource(envelope.commandSource);
   if (!providerSource) {
     economyAssert(
       graph.providerEvidenceManifest === void 0 && graph.providerEvidence.length === 0 && graph.operationalHandleBindings.length === 0,
@@ -3856,7 +3900,7 @@ function expectedTransactionActivityTypes(envelope) {
   }
   if (envelope.commandType === "credit-reward") {
     return /* @__PURE__ */ new Set([
-      envelope.commandSource === "ayet" ? "rewarded-ad" : "offerwall"
+      envelope.commandSource === "ayet" || envelope.commandSource === "google-ad-manager" ? "rewarded-ad" : "offerwall"
     ]);
   }
   if (envelope.commandType === "credit-event") {
@@ -3911,7 +3955,7 @@ function assertReceiptGraph(graph, commandEnvelopeHash, hash, acceptanceCommit,
     accepted.receiptId,
     acceptedHash
   );
-  const providerSource = envelope.commandSource === "shopify" || envelope.commandSource === "ayet" || envelope.commandSource === "bitlabs";
+  const providerSource = isProviderCommandSource(envelope.commandSource);
   if (graph.resultReceipt === void 0) {
     economyAssert(
       providerSource && graph.transaction === void 0 && resultCommit === void 0,
@@ -4031,7 +4075,9 @@ function assertAuthorityCommits(graph, hash) {
     "INVALID_CONTRACT",
     "Authority commits do not reconstruct the expected authority head"
   );
-  const providerSource = graph.commandEnvelope.commandSource === "shopify" || graph.commandEnvelope.commandSource === "ayet" || graph.commandEnvelope.commandSource === "bitlabs";
+  const providerSource = isProviderCommandSource(
+    graph.commandEnvelope.commandSource
+  );
   const acceptanceKind = providerSource ? "provider-acceptance" : "first-party-command";
   const acceptanceCommit = graph.commits.find(
     (commit) => commit.manifest.commitKind === acceptanceKind