@sekiban/dcb-runtime 0.2.0 → 0.2.1

package/README.md

@@ -5,9 +5,13 @@ Cloudflare Durable Object and HTTP runtime for Serialized DCB V1.
 This package is the matched-set runtime companion to `@sekiban/dcb-core`,
 `@sekiban/dcb-domain`, and `@sekiban/dcb-client`. Consumers such as the
 meeting-room Cloudflare sample import public entry points (`@sekiban/dcb-runtime`,
-`@sekiban/dcb-runtime/cloudflare`, `/d1`, `/d1-mv`, `/mv`, `/cosmos`) and re-export
+`@sekiban/dcb-runtime/cloudflare`, `/d1`, `/d1-mv`, `/mv`, and the experimental `/cosmos`) and re-export
 Durable Object classes from their Worker module graph as Cloudflare requires.
 
+The experimental Cosmos provider is never selected by environment values. A
+consumer must import `createCosmosStoreProvider` from `/cosmos` and pass it as
+`createRuntimeWorker({ storeProvider })`.
+
 ## License
 
 Elastic License 2.0. See [LICENSE](./LICENSE).

package/dist/allocator/AllocatorDurableObject.js

@@ -10,6 +10,8 @@ const ATTEMPT_KEY_PREFIX = "attempt:";
 const ROLLBACK_WARNING_WINDOW_MS = 1000n;
 class AllocationTransactionFault extends Error {
 }
+class ImportSeedRequiredError extends Error {
+}
 function json(body, status = 200) {
     return new Response(JSON.stringify(body), {
         status,
@@ -55,7 +57,19 @@ function seedFrom(value) {
     catch {
         return { error: "highWatermark must be an allocator SUID" };
     }
-    return { value: { importId: value.importId, leaseEpoch: value.leaseEpoch, highWatermark: value.highWatermark } };
+    let storeMaximum;
+    if (value.storeMaximum !== undefined) {
+        if (!isNonEmptyString(value.storeMaximum))
+            return { error: "storeMaximum must be an allocator SUID" };
+        try {
+            decodeSuid(value.storeMaximum);
+        }
+        catch {
+            return { error: "storeMaximum must be an allocator SUID" };
+        }
+        storeMaximum = value.storeMaximum;
+    }
+    return { value: { importId: value.importId, leaseEpoch: value.leaseEpoch, highWatermark: value.highWatermark, ...(storeMaximum !== undefined ? { storeMaximum } : {}) } };
 }
 function newAllocatorLineageId() {
     // A fresh token is generated when the allocator has no durable state, so a
@@ -118,6 +132,7 @@ function allocateFrom(value) {
             ...(serviceId !== undefined ? { serviceId } : {}),
             ...(bootstrapCommandId !== undefined ? { bootstrapCommandId } : {}),
             ...(bootstrapEpoch !== undefined ? { bootstrapEpoch } : {}),
+            ...(value.requiresImportSeed === true ? { requiresImportSeed: true } : {}),
         },
     };
 }
@@ -519,6 +534,8 @@ export class AllocatorDurableObject {
                 const state = persistedState === undefined
                     ? currentState(lineage)
                     : { ...persistedState, allocatorLineageId: lineage, schemaVersion: 5, bootstrapSeed: persistedState.bootstrapSeed ?? null, lastRollbackWarningFingerprint: persistedState.lastRollbackWarningFingerprint ?? null };
+                if (input.requiresImportSeed === true && state.bootstrapSeed === null)
+                    throw new ImportSeedRequiredError();
                 // This is intentionally before the first transaction write. A clock
                 // failure therefore cannot leave a vector, watermark, or warning fact.
                 let clockTick;
@@ -609,6 +626,9 @@ export class AllocatorDurableObject {
             return json(result.vector, result.created ? 201 : 200);
         }
         catch (failure) {
+            if (failure instanceof ImportSeedRequiredError) {
+                return error(409, "allocator_seed_required", "commit before import seed");
+            }
             if (failure instanceof AllocationTransactionFault) {
                 return error(503, "simulated_allocation_crash", "Simulated interruption before durable allocation transaction commit");
             }
@@ -649,7 +669,10 @@ export class AllocatorDurableObject {
             }
             if (state.allocatedWatermark !== null)
                 return { status: 409, body: { code: "allocator_seed_rejected", error: "allocator already allocating" } };
-            const updated = { ...state, allocatedWatermark: input.highWatermark, bootstrapSeed: input };
+            if (input.storeMaximum !== undefined && input.highWatermark < input.storeMaximum) {
+                return { status: 409, body: { code: "allocator_seed_below_store_max", error: "seed below store maximum" } };
+            }
+            const updated = { ...state, allocatedWatermark: input.highWatermark, bootstrapSeed: { importId: input.importId, leaseEpoch: input.leaseEpoch, highWatermark: input.highWatermark } };
             await txn.put(STATE_KEY, updated);
             return { status: 201, body: updated };
         });

package/dist/bootstrap/BootstrapCoordinatorDurableObject.d.ts

@@ -23,6 +23,8 @@ export declare class BootstrapCoordinatorDurableObject implements DurableObject
     /** Operator abort retains the durable failed plan for audit/retry; it never clears target state. */
     private abort;
     private route;
+    private permit;
+    private permitRelease;
     private command;
 }
 export {};

package/dist/bootstrap/BootstrapCoordinatorDurableObject.js

@@ -13,13 +13,22 @@ const epoch = (value) => typeof value === "number" && Number.isSafeInteger(value
 const response = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8" } });
 const reject = (code, message, status = 409) => response({ code, error: message }, status);
 function empty(serviceId) {
-    return { schemaVersion: 1, status: "EMPTY", importId: null, targetServiceId: serviceId, allocatorLineageId: null, source: null, digest: null, manifest: null, progress: {}, leaseEpoch: 0, leaseUntil: null, failure: null, readyAt: null, normalInFlight: 0, normalCommands: {}, releasedCommands: {}, verifiedImportId: null, verifiedLeaseEpoch: null, storeCompletion: null };
+    return { schemaVersion: 1, status: "EMPTY", importId: null, targetServiceId: serviceId, allocatorLineageId: null, source: null, digest: null, manifest: null, progress: {}, leaseEpoch: 0, leaseUntil: null, failure: null, readyAt: null, normalInFlight: 0, normalCommands: {}, releasedCommands: {}, writePermits: {}, verifiedImportId: null, verifiedLeaseEpoch: null, storeCompletion: null };
 }
 function expired(control) { return control.leaseUntil !== null && control.leaseUntil <= Date.now(); }
 function commands(control) { return { ...(control.normalCommands ?? {}) }; }
 function released(control) { return { ...(control.releasedCommands ?? {}) }; }
+function permits(control) { return { ...(control.writePermits ?? {}) }; }
 function fault(body, point) { return object(body) && body.faultAt === point; }
 function encodedBytes(value) { return new TextEncoder().encode(JSON.stringify(value)).byteLength; }
+async function readBody(request) {
+    try {
+        return await request.json();
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Per-service authority and linearization point for bootstrap and normal writes. */
 export class BootstrapCoordinatorDurableObject {
     ctx;
@@ -48,6 +57,10 @@ export class BootstrapCoordinatorDurableObject {
             return this.traceCommand(request, serviceId, activation, observation, "finalize");
         if (request.method === "POST" && url.pathname === "/command/release")
             return this.traceCommand(request, serviceId, activation, observation, "release");
+        if (request.method === "POST" && url.pathname === "/command/permit")
+            return this.permit(serviceId, await readBody(request));
+        if (request.method === "POST" && url.pathname === "/command/permit-release")
+            return this.permitRelease(serviceId, await readBody(request));
         let body;
         try {
             body = await request.json();
@@ -119,6 +132,8 @@ export class BootstrapCoordinatorDurableObject {
                 return { error: "bootstrap_ready_permanent" };
             if (control.status !== "EMPTY")
                 return control.importId === importId && control.digest === dump.manifest.contentDigest ? { control } : { error: "bootstrap_plan_conflict" };
+            if (Object.keys(permits(control)).length !== 0)
+                return { error: "bootstrap_write_permit_active" };
             if (control.normalInFlight !== 0 || Object.keys(commands(control)).length !== 0)
                 return { error: "bootstrap_normal_command_in_flight" };
             const next = { ...control, status: "PLANNED", importId, allocatorLineageId: dump.manifest.target.allocatorLineageId, source: dump.manifest.source, digest: dump.manifest.contentDigest, manifest: dump.manifest, leaseEpoch: control.leaseEpoch + 1, leaseUntil: Date.now() + 30_000, failure: null, progress: {}, verifiedImportId: null, verifiedLeaseEpoch: null, storeCompletion: null };
@@ -315,6 +330,54 @@ export class BootstrapCoordinatorDurableObject {
         const control = await this.control(serviceId);
         return control.status === "EMPTY" || control.status === "READY" ? response({ admitted: true, leaseEpoch: control.leaseEpoch, route: body.route }) : reject("bootstrap_route_rejected", `${body.route} is unavailable during bootstrap`);
     }
+    async permit(serviceId, body) {
+        if (!object(body) || !string(body.commandId) || !string(body.digest))
+            return reject("bootstrap_permit_invalid", "commandId and digest are required", 400);
+        const commandId = body.commandId;
+        const digest = body.digest;
+        const result = await this.ctx.storage.transaction(async (txn) => {
+            const control = (await txn.get(CONTROL)) ?? empty(serviceId);
+            const active = permits(control);
+            if (active[commandId] !== undefined) {
+                return active[commandId] === digest
+                    ? { control }
+                    : { digestMismatch: true };
+            }
+            if (control.status !== "EMPTY" && control.status !== "READY")
+                return { rejected: true };
+            const updated = { ...control, writePermits: { ...active, [commandId]: digest } };
+            await txn.put(CONTROL, updated);
+            return { control: updated };
+        });
+        if ("digestMismatch" in result)
+            return reject("bootstrap_permit_digest_mismatch", "bootstrap permit digest does not match the held permit");
+        if ("rejected" in result)
+            return reject("bootstrap_command_rejected", "bootstrap epoch rejects normal durable mutation");
+        return response({ leaseEpoch: result.control.leaseEpoch, admitted: true });
+    }
+    async permitRelease(serviceId, body) {
+        if (!object(body) || !string(body.commandId))
+            return reject("bootstrap_permit_invalid", "commandId is required", 400);
+        const commandId = body.commandId;
+        const digest = string(body.digest) ? body.digest : undefined;
+        const result = await this.ctx.storage.transaction(async (txn) => {
+            const control = (await txn.get(CONTROL)) ?? empty(serviceId);
+            const active = permits(control);
+            if (active[commandId] !== undefined && digest !== undefined && active[commandId] !== digest) {
+                return { digestMismatch: true };
+            }
+            if (active[commandId] === undefined)
+                return { control };
+            const next = { ...active };
+            delete next[commandId];
+            const updated = { ...control, writePermits: next };
+            await txn.put(CONTROL, updated);
+            return { control: updated };
+        });
+        if ("digestMismatch" in result)
+            return reject("bootstrap_permit_digest_mismatch", "bootstrap permit digest does not match the held permit");
+        return response({ leaseEpoch: result.control.leaseEpoch, admitted: true });
+    }
     async command(serviceId, body, action, observation) {
         if (!object(body) || !string(body.commandId))
             return reject("bootstrap_command_invalid", "commandId is required", 400);

package/dist/bootstrap/types.d.ts

@@ -55,6 +55,12 @@ export interface BootstrapControlRecord {
     readonly normalCommands?: Readonly<Record<string, number>>;
     /** Recently released entry admissions, retained only for their final epoch check. */
     readonly releasedCommands?: Readonly<Record<string, number>>;
+    /**
+     * SDT-G36 durable write permits. Held from before allocation until every
+     * target tag of that attempt is durably resolved. Absent on old records
+     * (treated as `{}`). Only a bootstrap barrier, never commit authority.
+     */
+    readonly writePermits?: Readonly<Record<string, string>>;
     /** READY is a post-verification state, never merely an import completion. */
     readonly verifiedImportId?: string | null;
     readonly verifiedLeaseEpoch?: number | null;

package/dist/cloudflare.d.ts

@@ -42,6 +42,7 @@ export interface CloudflareOnlyEnv {
     D1_MV: D1Database;
     AUTO_DRAIN_OUTBOX?: string;
     REPAIR_OPERATOR_TOKEN: string;
+    INCIDENT_MAINTAINER_TOKEN?: string;
     REPAIR_EXCLUSION_LOOKUP?: Fetcher;
     G11_VERIFICATION_ENABLED?: string;
     SDT_SERVICE_ID?: string;
@@ -152,6 +153,8 @@ export type { ClosedPrefixCertificate } from "./allocator/types";
 export type { SafeViewCoverageContext } from "./projection/ProjectionRuntime";
 export { downstreamEnvelopeBytes, classifyDirectDoorbellFailure, preflightDirectDoorbell, readDomainDeliveryClass, readDirectDoorbellConfig, selectDirectDoorbellViews, MAX_SERVICE_BINDING_INVOCATIONS_PER_REQUEST, } from "./downstream/Doorbell";
 export { deliveryCorrelationId } from "./downstream/DeliveryCore";
+export { admitActiveWrite, assertNoSilentLedgerMerge, assertStrictlyBefore, createRotationState, maxSortableUniqueId, recordLateArrival, refuseSafeWindowSeal, refuseSealedWrite, refuseSilentLedgerMerge, replaceSealedIdentity, rotateAppend, ShardRotationError, } from "./shard/ShardRotation";
+export type { LateArrival, SealedShard, ShardRotationDiagnostic, ShardRotationState, } from "./shard/ShardRotation";
 export { GlobalCompletenessReconciler } from "./completeness/GlobalCompletenessReconciler";
 export { G44_HEALTH_STALE_AFTER_MS, G44_SCANNER_VERSION, GLOBAL_COMPLETENESS_INTERIM_DISPOSITION, } from "./completeness/types";
 export type { GlobalCompletenessHealth, GlobalCompletenessCoverage, GlobalCompletenessHealthRecord, GlobalCompletenessScanResult, SourceObligationFact, SourceObligationPage, SourcePartitionSnapshot, } from "./completeness/types";