@plasius/economy 0.10.0 → 0.11.1

package/README.md

@@ -85,6 +85,13 @@ not raise these defaults without a separately versioned policy decision.
 `GoogleRewardedWebReconciliationV1` separately proves final paid-impression,
 eligible-net-revenue, nominal-liability, and reserve coverage.
 
+The audited authority treats `google-ad-manager` as a provider command source.
+Final reports use `authenticated-retrieval` evidence with a bounded retrieval
+scheme and verification time; they cannot be represented as signed callbacks.
+Legacy Shopify, ayeT, and BitLabs signed-evidence canonical bytes remain
+unchanged. Google reward credits consequently require the provider-acceptance
+and provider-result authority boundaries and produce `rewarded-ad` activity.
+
 `createGoogleRewardedWebQuote()` uses exact integer GBP micros and issues one
 whole Token only when conservative eligible net is at least 125,000 micros for
 the 100,000-micro nominal liability. The completion bundle has no package
@@ -576,12 +583,12 @@ Coverage must remain at least 80%, and every changed source file must appear in
 LCOV. Generated property tests cover exact arithmetic, double-entry balance,
 projection rebuilds, idempotency, reversals, lot isolation, and allocation
 non-negativity. npm publication is performed only by the approved GitHub CD
-workflow on configurable trusted self-hosted runners. Release LCOV and the
-CycloneDX SBOM remain retained even when an external coverage or npm provenance
-service is unavailable. Release tags and GitHub Releases use a current-repository
-GitHub App token with explicit Contents and Workflows write permissions; npm
-publication continues to use only the protected `NPM_TOKEN`. Both release jobs
-install a checksum-pinned GitHub CLI under `RUNNER_TEMP`. A requested version
+workflow from the protected `main` branch. The final publication job runs on a
+GitHub-hosted runner so npm can validate its short-lived OIDC identity and
+record provenance; it has no long-lived npm write-token fallback. Release LCOV
+and the CycloneDX SBOM remain retained even when an external coverage service
+is unavailable. Release tags and GitHub Releases use a current-repository
+GitHub App token with explicit Contents and Workflows write permissions. A requested version
 bump reuses the current version only when neither npm nor GitHub records it as a
 completed release; use `bump=none` for deliberate recovery of prepared metadata.
 Publication checks out the verified current release-branch HEAD so that recovery
@@ -593,3 +600,16 @@ Do not include raw idempotency keys, provider identifiers, provider callback
 bodies or signatures, payment details, personal data, encrypted-handle
 ciphertext, or secrets in contracts, metadata, tests, examples, or logs.
 Report vulnerabilities privately according to [SECURITY.md](./SECURITY.md).
+<!-- BEGIN PLASIUS RELEASE INTEGRITY -->
+## Release integrity
+
+Production package publication runs only from `.github/workflows/cd.yml` on
+protected `main`. The job verifies that the prepared commit is still the
+current main commit and has an exact successful `ci.yml` push result before it
+mutates release state. Public package CI runs on GitHub-hosted capacity so it
+cannot execute on company-managed runners. npm publication runs on
+GitHub-hosted Node.js 24 with
+npm 11.5.1 or newer, uses the protected `production` environment and
+short-lived npm OIDC with provenance, and has no long-lived npm write-token
+fallback. Rollback disables CD; it never rewrites published package history.
+<!-- END PLASIUS RELEASE INTEGRITY -->

package/dist/index.cjs

@@ -2169,6 +2169,7 @@ var COMMAND_SOURCES = /* @__PURE__ */ new Set([
   "shopify",
   "ayet",
   "bitlabs",
+  "google-ad-manager",
   "operator",
   "system"
 ]);
@@ -2181,7 +2182,8 @@ var PRINCIPAL_TYPES = /* @__PURE__ */ new Set([
 var PROVIDER_SOURCES = /* @__PURE__ */ new Set([
   "shopify",
   "ayet",
-  "bitlabs"
+  "bitlabs",
+  "google-ad-manager"
 ]);
 var CAUSATION_KINDS = /* @__PURE__ */ new Set([
   "provider-event",
@@ -2193,7 +2195,8 @@ var CAUSATION_KINDS = /* @__PURE__ */ new Set([
 var PROVIDERS = /* @__PURE__ */ new Set([
   "shopify",
   "ayet",
-  "bitlabs"
+  "bitlabs",
+  "google-ad-manager"
 ]);
 var FINGERPRINT_DOMAINS = /* @__PURE__ */ new Set([
   "economy.idempotency-key.v1",
@@ -2223,6 +2226,12 @@ var SOURCE_COMMAND_TYPES = {
   ]),
   ayet: /* @__PURE__ */ new Set(["credit-reward", "hold", "release-hold", "reverse"]),
   bitlabs: /* @__PURE__ */ new Set(["credit-reward", "hold", "release-hold", "reverse"]),
+  "google-ad-manager": /* @__PURE__ */ new Set([
+    "credit-reward",
+    "hold",
+    "release-hold",
+    "reverse"
+  ]),
   operator: /* @__PURE__ */ new Set(["adjust", "reverse", "hold", "release-hold"]),
   system: /* @__PURE__ */ new Set([
     "credit-event",
@@ -2496,6 +2505,9 @@ function assertEconomyProviderEvidenceHash(evidence) {
       "reconciliationEvidenceFingerprint",
       "signatureScheme",
       "signatureVerifiedAt",
+      "verificationMode",
+      "authenticatedRetrievalScheme",
+      "authenticatedRetrievedAt",
       "providerOccurredAt",
       "receivedAt",
       "operationalHandleBindingId"
@@ -2530,9 +2542,27 @@ function assertEconomyProviderEvidenceHash(evidence) {
     );
   }
   assertSafeClassifier(evidence.eventType, "Provider event type");
-  assertSafeClassifier(evidence.signatureScheme, "Provider signature scheme");
-  const signatureVerifiedAt = parseIsoTimestamp(evidence.signatureVerifiedAt);
   const receivedAt = parseIsoTimestamp(evidence.receivedAt);
+  const signatureFieldsPresent = evidence.signatureScheme !== void 0 && evidence.signatureVerifiedAt !== void 0;
+  const retrievalFieldsPresent = evidence.authenticatedRetrievalScheme !== void 0 && evidence.authenticatedRetrievedAt !== void 0;
+  const verificationMode = evidence.verificationMode ?? "provider-signature";
+  economyAssert(
+    verificationMode === "provider-signature" && evidence.provider !== "google-ad-manager" && signatureFieldsPresent && !retrievalFieldsPresent && evidence.authenticatedRetrievalScheme === void 0 && evidence.authenticatedRetrievedAt === void 0 || verificationMode === "authenticated-retrieval" && evidence.provider === "google-ad-manager" && retrievalFieldsPresent && evidence.signatureScheme === void 0 && evidence.signatureVerifiedAt === void 0,
+    "INVALID_CONTRACT",
+    "Provider evidence must use exactly one permitted verification method"
+  );
+  const verifiedAt = verificationMode === "provider-signature" ? evidence.signatureVerifiedAt : evidence.authenticatedRetrievedAt;
+  if (verificationMode === "provider-signature") {
+    assertSafeClassifier(
+      evidence.signatureScheme,
+      "Provider signature scheme"
+    );
+  } else {
+    assertSafeClassifier(
+      evidence.authenticatedRetrievalScheme,
+      "Provider authenticated-retrieval scheme"
+    );
+  }
   if (evidence.providerOccurredAt !== void 0) {
     economyAssert(
       parseIsoTimestamp(evidence.providerOccurredAt) <= receivedAt,
@@ -2541,9 +2571,9 @@ function assertEconomyProviderEvidenceHash(evidence) {
     );
   }
   economyAssert(
-    receivedAt >= signatureVerifiedAt,
+    receivedAt >= parseIsoTimestamp(verifiedAt),
     "INVALID_TIME_WINDOW",
-    "Provider evidence cannot be received before signature verification"
+    "Provider evidence cannot be received before verification"
   );
   if (evidence.operationalHandleBindingId !== void 0) {
     assertEconomyIdentifier(
@@ -2893,8 +2923,13 @@ function canonicalEconomyProviderEvidenceHashPayload(evidence) {
         evidence.reconciliationEvidenceFingerprint
       )
     },
-    signatureScheme: evidence.signatureScheme,
-    signatureVerifiedAt: evidence.signatureVerifiedAt,
+    ...evidence.verificationMode === void 0 ? {} : { verificationMode: evidence.verificationMode },
+    ...evidence.signatureScheme === void 0 ? {} : { signatureScheme: evidence.signatureScheme },
+    ...evidence.signatureVerifiedAt === void 0 ? {} : { signatureVerifiedAt: evidence.signatureVerifiedAt },
+    ...evidence.authenticatedRetrievalScheme === void 0 ? {} : {
+      authenticatedRetrievalScheme: evidence.authenticatedRetrievalScheme
+    },
+    ...evidence.authenticatedRetrievedAt === void 0 ? {} : { authenticatedRetrievedAt: evidence.authenticatedRetrievedAt },
     ...evidence.providerOccurredAt === void 0 ? {} : { providerOccurredAt: evidence.providerOccurredAt },
     receivedAt: evidence.receivedAt,
     ...evidence.operationalHandleBindingId === void 0 ? {} : {
@@ -3948,6 +3983,15 @@ function assertReversalAvailable(originalTransactionId, existingTransactions) {
 }
 
 // src/audit-graph.ts
+var PROVIDER_COMMAND_SOURCES = /* @__PURE__ */ new Set([
+  "shopify",
+  "ayet",
+  "bitlabs",
+  "google-ad-manager"
+]);
+function isProviderCommandSource(source) {
+  return PROVIDER_COMMAND_SOURCES.has(source);
+}
 function assertCanonicalHash4(value, label) {
   economyAssert(
     typeof value === "string" && /^sha256:[a-f0-9]{64}$/u.test(value),
@@ -3975,7 +4019,7 @@ function assertCreatedReference(manifest, kind, id, contentHash) {
 }
 function assertProviderGraph(graph, hash, acceptanceCommit) {
   const envelope = graph.commandEnvelope;
-  const providerSource = envelope.commandSource === "shopify" || envelope.commandSource === "ayet" || envelope.commandSource === "bitlabs";
+  const providerSource = isProviderCommandSource(envelope.commandSource);
   if (!providerSource) {
     economyAssert(
       graph.providerEvidenceManifest === void 0 && graph.providerEvidence.length === 0 && graph.operationalHandleBindings.length === 0,
@@ -4122,7 +4166,7 @@ function expectedTransactionActivityTypes(envelope) {
   }
   if (envelope.commandType === "credit-reward") {
     return /* @__PURE__ */ new Set([
-      envelope.commandSource === "ayet" ? "rewarded-ad" : "offerwall"
+      envelope.commandSource === "ayet" || envelope.commandSource === "google-ad-manager" ? "rewarded-ad" : "offerwall"
     ]);
   }
   if (envelope.commandType === "credit-event") {
@@ -4177,7 +4221,7 @@ function assertReceiptGraph(graph, commandEnvelopeHash, hash, acceptanceCommit,
     accepted.receiptId,
     acceptedHash
   );
-  const providerSource = envelope.commandSource === "shopify" || envelope.commandSource === "ayet" || envelope.commandSource === "bitlabs";
+  const providerSource = isProviderCommandSource(envelope.commandSource);
   if (graph.resultReceipt === void 0) {
     economyAssert(
       providerSource && graph.transaction === void 0 && resultCommit === void 0,
@@ -4297,7 +4341,9 @@ function assertAuthorityCommits(graph, hash) {
     "INVALID_CONTRACT",
     "Authority commits do not reconstruct the expected authority head"
   );
-  const providerSource = graph.commandEnvelope.commandSource === "shopify" || graph.commandEnvelope.commandSource === "ayet" || graph.commandEnvelope.commandSource === "bitlabs";
+  const providerSource = isProviderCommandSource(
+    graph.commandEnvelope.commandSource
+  );
   const acceptanceKind = providerSource ? "provider-acceptance" : "first-party-command";
   const acceptanceCommit = graph.commits.find(
     (commit) => commit.manifest.commitKind === acceptanceKind