@sekiban/dcb-runtime 0.2.0 → 0.2.2

package/dist/cosmos.js

@@ -138,6 +138,104 @@ function decayedLagEstimateMs(estimateMs, observedAtMs, nowMs) {
   return Math.max(0, estimateMs - elapsed);
 }
 
+// src/generated/cosmos-layout.ts
+var COSMOS_BINDINGS = Object.freeze({
+  "endpoint": "COSMOS_ENDPOINT",
+  "database": "COSMOS_DATABASE",
+  "key": "COSMOS_KEY"
+});
+var COSMOS_CONTAINER_LAYOUT = Object.freeze({
+  "events": {
+    "name": "dcb-events",
+    "partitionKeyPath": "/pk",
+    "partitionValueKinds": [
+      "{serviceId}|{eventId}",
+      "{serviceId}|__dcb_event_ops__"
+    ],
+    "documentIds": {
+      "logicalEvent": "canonical event id",
+      "eventSidecar": 'safeId("event-ops", eventId)',
+      "serviceGuards": {
+        "allocatorLineageBinding": 'safeId("allocator-lineage-binding")',
+        "suidBinding": 'safeId("suid-binding", suid)',
+        "deliveryIncident": 'safeId("incident", identityKey)'
+      }
+    }
+  },
+  "lagEstimates": {
+    "name": "dcb-lag-estimates",
+    "partitionKeyPath": "/serviceId",
+    "partitionValueKinds": [
+      "{serviceId}"
+    ],
+    "documentIds": {
+      "lagEstimate": "serviceId"
+    }
+  },
+  "pendingArrivals": {
+    "name": "dcb-pending-arrivals",
+    "partitionKeyPath": "/serviceId",
+    "partitionValueKinds": [
+      "{serviceId}"
+    ],
+    "documentIds": {
+      "pendingArrival": "safeId(eventId)"
+    }
+  },
+  "findings": {
+    "name": "dcb-findings",
+    "partitionKeyPath": "/serviceId",
+    "partitionValueKinds": [
+      "{serviceId}"
+    ],
+    "documentIds": {
+      "finding": "safeId(eventId, path, classification)",
+      "incidentProjection": 'safeId("incident", identityKey)'
+    }
+  },
+  "checkpoints": {
+    "name": "dcb-projection-checkpoints",
+    "partitionKeyPath": "/serviceId",
+    "partitionValueKinds": [
+      "{serviceId}"
+    ],
+    "documentIds": {
+      "checkpoint": "safeId(projectionId)"
+    }
+  }
+});
+var COSMOS_DOCUMENT_ID_RULES = Object.freeze({
+  "events": {
+    "logicalEvent": "canonical event id",
+    "eventSidecar": 'safeId("event-ops", eventId)',
+    "serviceGuards": {
+      "allocatorLineageBinding": 'safeId("allocator-lineage-binding")',
+      "suidBinding": 'safeId("suid-binding", suid)',
+      "deliveryIncident": 'safeId("incident", identityKey)'
+    }
+  },
+  "lagEstimates": {
+    "lagEstimate": "serviceId"
+  },
+  "pendingArrivals": {
+    "pendingArrival": "safeId(eventId)"
+  },
+  "findings": {
+    "finding": "safeId(eventId, path, classification)",
+    "incidentProjection": 'safeId("incident", identityKey)'
+  },
+  "checkpoints": {
+    "checkpoint": "safeId(projectionId)"
+  }
+});
+var COSMOS_CONTAINER_NAMES = Object.freeze({
+  "events": "dcb-events",
+  "lagEstimates": "dcb-lag-estimates",
+  "pendingArrivals": "dcb-pending-arrivals",
+  "findings": "dcb-findings",
+  "checkpoints": "dcb-projection-checkpoints"
+});
+
 // src/store/types.ts
 var CanonicalEventIdentityConflictError = class extends Error {
   constructor(provider, eventId, message) {
@@ -152,34 +250,32 @@ var CanonicalEventIdentityConflictError = class extends Error {
 };
 
 // src/store/CosmosEventStore.ts
-var COSMOS_EVENT_PARTITION_KEY_PATH = "/pk";
-var COSMOS_AUXILIARY_PARTITION_KEY_PATH = "/serviceId";
-var DEFAULT_COSMOS_CONTAINERS = Object.freeze({
-  events: "dcb-events",
-  lagEstimates: "dcb-lag-estimates",
-  pendingArrivals: "dcb-pending-arrivals",
-  findings: "dcb-findings",
-  checkpoints: "dcb-projection-checkpoints"
-});
+var COSMOS_EVENT_PARTITION_KEY_PATH = COSMOS_CONTAINER_LAYOUT.events.partitionKeyPath;
+var COSMOS_AUXILIARY_PARTITION_KEY_PATH = COSMOS_CONTAINER_LAYOUT.lagEstimates.partitionKeyPath;
+var DEFAULT_COSMOS_CONTAINERS = COSMOS_CONTAINER_NAMES;
 function cosmosContainerDefinitions(containers = DEFAULT_COSMOS_CONTAINERS) {
-  return [
-    {
-      name: containers.events,
-      partitionKeyPath: COSMOS_EVENT_PARTITION_KEY_PATH,
-      // The C# CosmosEvent is partitioned by the exact serviceId|id pair.
-      // Refuse a missing id here so an introspection fixture cannot mistake
-      // an auxiliary service partition for the logical event partition.
-      partitionKeyValue: (serviceId, id) => {
-        if (typeof id !== "string" || id.length === 0) throw new Error("Cosmos event partition key requires an event id");
-        return eventPk(serviceId, id);
-      }
-    },
-    ...[containers.lagEstimates, containers.pendingArrivals, containers.findings, containers.checkpoints].map((name) => ({
+  return Object.keys(COSMOS_CONTAINER_LAYOUT).map((key) => {
+    const layout = COSMOS_CONTAINER_LAYOUT[key];
+    const name = containers[key];
+    if (key === "events") {
+      return {
+        name,
+        partitionKeyPath: layout.partitionKeyPath,
+        // The C# CosmosEvent is partitioned by the exact serviceId|id pair.
+        // Refuse a missing id here so an introspection fixture cannot mistake
+        // an auxiliary service partition for the logical event partition.
+        partitionKeyValue: (serviceId, id) => {
+          if (typeof id !== "string" || id.length === 0) throw new Error("Cosmos event partition key requires an event id");
+          return eventPk(serviceId, id);
+        }
+      };
+    }
+    return {
       name,
-      partitionKeyPath: COSMOS_AUXILIARY_PARTITION_KEY_PATH,
+      partitionKeyPath: layout.partitionKeyPath,
       partitionKeyValue: (serviceId) => serviceId
-    }))
-  ];
+    };
+  });
 }
 var CosmosClientError = class extends Error {
   constructor(status, message) {
@@ -238,6 +334,19 @@ function compareCosmosSuid(left, right) {
 function safeId(...parts) {
   return parts.map((part) => encodeURIComponent(part)).join("~");
 }
+function rulePrefix(rule, fallback) {
+  return rule.match(/^safeId\("([^"]+)"/)?.[1] ?? fallback;
+}
+var EVENT_OPS_ID_PREFIX = rulePrefix(COSMOS_DOCUMENT_ID_RULES.events.eventSidecar, "event-ops");
+var LINEAGE_ID_PREFIX = rulePrefix(
+  COSMOS_DOCUMENT_ID_RULES.events.serviceGuards.allocatorLineageBinding,
+  "allocator-lineage-binding"
+);
+var SUID_ID_PREFIX = rulePrefix(COSMOS_DOCUMENT_ID_RULES.events.serviceGuards.suidBinding, "suid-binding");
+var INCIDENT_ID_PREFIX = rulePrefix(
+  COSMOS_DOCUMENT_ID_RULES.events.serviceGuards.deliveryIncident,
+  "incident"
+);
 function eventPk(serviceId, id) {
   return `${serviceId}|${id}`;
 }
@@ -503,19 +612,22 @@ ${date}
       ["sign"]
     );
     const signature = encodeURIComponent(`type=master&ver=1.0&sig=${base64(await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(signaturePayload)))}`);
-    const response = await this.fetcher(new URL(path, this.endpoint), {
-      method,
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json",
-        "x-ms-date": date,
-        "x-ms-version": "2018-12-31",
-        authorization: signature,
-        ...extraHeaders
-      },
-      body: body === void 0 ? void 0 : JSON.stringify(body)
-    });
-    return response;
+    try {
+      return await this.fetcher(new URL(path, this.endpoint), {
+        method,
+        headers: {
+          accept: "application/json",
+          "content-type": "application/json",
+          "x-ms-date": date,
+          "x-ms-version": "2018-12-31",
+          authorization: signature,
+          ...extraHeaders
+        },
+        body: body === void 0 ? void 0 : JSON.stringify(body)
+      });
+    } catch {
+      throw new CosmosClientError(0, "Cosmos request failed before a response was received");
+    }
   }
   async errorFrom(response, prefix) {
     return new CosmosClientError(response.status, `${prefix} (HTTP ${response.status})`);
@@ -793,7 +905,7 @@ var CosmosEventStore = class {
     this.ready();
     return await this.client.read(
       this.containers.events,
-      safeId("incident", identityKey),
+      safeId(INCIDENT_ID_PREFIX, identityKey),
       auxiliaryPk(serviceId)
     ) !== void 0;
   }
@@ -825,7 +937,7 @@ var CosmosEventStore = class {
   }
   async bindLineage(serviceId, allocatorLineageId, boundAt) {
     const document = {
-      id: safeId("allocator-lineage-binding"),
+      id: safeId(LINEAGE_ID_PREFIX),
       pk: auxiliaryPk(serviceId),
       serviceId,
       kind: "allocator-lineage-binding",
@@ -845,7 +957,7 @@ var CosmosEventStore = class {
    * mutation. Historical rows are still checked by eventDocuments above.
    */
   async reserveSuid(serviceId, suid, eventId) {
-    const id = safeId("suid-binding", suid);
+    const id = safeId(SUID_ID_PREFIX, suid);
     const existing = await this.client.read(this.containers.events, id, auxiliaryPk(serviceId));
     if (existing !== void 0) return existing.document.eventId;
     const document = {
@@ -868,7 +980,7 @@ var CosmosEventStore = class {
   }
   async persistIncident(incident) {
     const document = {
-      id: safeId("incident", incident.identityKey),
+      id: safeId(INCIDENT_ID_PREFIX, incident.identityKey),
       pk: auxiliaryPk(incident.serviceId),
       serviceId: incident.serviceId,
       kind: "delivery-incident",
@@ -891,7 +1003,7 @@ var CosmosEventStore = class {
   }
   async projectIncident(incident) {
     const document = {
-      id: safeId("incident", incident.identityKey),
+      id: safeId(INCIDENT_ID_PREFIX, incident.identityKey),
       serviceId: incident.serviceId,
       eventId: incident.eventId ?? incident.incomingEventId ?? incident.identityKey,
       path: incident.classification,
@@ -948,7 +1060,7 @@ var CosmosEventStore = class {
   async eventOps(serviceId, eventId) {
     const row = await this.client.read(
       this.containers.events,
-      safeId("event-ops", eventId),
+      safeId(EVENT_OPS_ID_PREFIX, eventId),
       eventPk(serviceId, eventId)
     );
     return row?.document;
@@ -993,7 +1105,7 @@ var CosmosEventStore = class {
     throw new Error("Cosmos event CAS did not converge");
   }
   async mutateEventOps(message, arrivedAt, lagMs) {
-    const id = safeId("event-ops", message.eventId);
+    const id = safeId(EVENT_OPS_ID_PREFIX, message.eventId);
     const pk = eventPk(message.serviceId, message.eventId);
     const nextArrival = {
       serviceId: message.serviceId,
@@ -1389,12 +1501,64 @@ function createBootstrapStoreAdapter(provider, store, identityGuard) {
 }
 
 // src/cosmos.ts
-function createCosmosStoreProvider(config) {
+var CosmosConfigurationError = class extends Error {
+  constructor(missingBindings, message) {
+    super(message);
+    this.missingBindings = missingBindings;
+    this.name = "CosmosConfigurationError";
+  }
+  missingBindings;
+  code = "COSMOS_CONFIGURATION_INVALID";
+};
+function bindingValue(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function invalidConfiguration(missingBindings) {
+  return new CosmosConfigurationError(
+    missingBindings,
+    `Cosmos configuration is incomplete; missing bindings: ${missingBindings.join(", ")}`
+  );
+}
+function resolveCosmosOptions(config, env) {
+  const staticValues = {
+    COSMOS_ENDPOINT: config.endpoint,
+    COSMOS_DATABASE: config.database,
+    COSMOS_KEY: config.key
+  };
+  const hasStaticValues = Object.values(staticValues).some((value) => value !== void 0);
+  if (config.client !== void 0) {
+    if (hasStaticValues) {
+      throw invalidConfiguration(["client cannot be combined with COSMOS_ENDPOINT, COSMOS_DATABASE, or COSMOS_KEY"]);
+    }
+    return { ...config };
+  }
+  const values = hasStaticValues ? staticValues : {
+    COSMOS_ENDPOINT: env.COSMOS_ENDPOINT,
+    COSMOS_DATABASE: env.COSMOS_DATABASE,
+    COSMOS_KEY: env.COSMOS_KEY
+  };
+  const missingBindings = Object.entries(values).filter(([, value]) => bindingValue(value) === void 0).map(([name]) => name);
+  if (missingBindings.length > 0) throw invalidConfiguration(missingBindings);
+  return {
+    ...config,
+    endpoint: bindingValue(values.COSMOS_ENDPOINT),
+    database: bindingValue(values.COSMOS_DATABASE),
+    key: bindingValue(values.COSMOS_KEY)
+  };
+}
+function createCosmosStoreProvider(config = {}) {
+  const hasStaticConfiguration = [config.endpoint, config.database, config.key].some((value) => value !== void 0);
+  if (config.client !== void 0 || hasStaticConfiguration) resolveCosmosOptions(config, {});
   return Object.freeze({
     name: "cosmos",
-    isConfigured: () => true,
-    create: () => new CosmosEventStore(config),
-    createBootstrapAdapter: () => createCosmosBootstrapAdapter(new CosmosEventStore(config))
+    isConfigured: (env) => {
+      resolveCosmosOptions(config, env);
+      return true;
+    },
+    create: (env) => new CosmosEventStore(resolveCosmosOptions(config, env)),
+    createBootstrapAdapter: (env) => createCosmosBootstrapAdapter(
+      new CosmosEventStore(resolveCosmosOptions(config, env))
+    )
   });
 }
 function createCosmosBootstrapAdapter(store) {
@@ -1402,6 +1566,7 @@ function createCosmosBootstrapAdapter(store) {
 }
 export {
   CosmosClientError,
+  CosmosConfigurationError,
   CosmosEventStore,
   CosmosRestClient,
   DEFAULT_COSMOS_CONTAINERS,

package/dist/downstream/OutboxDrain.d.ts

@@ -1,6 +1,7 @@
 import { type DownstreamOutboxMessage, type PipelineClock } from "./types";
+import { type ServiceIdentityEnvironment, type ServiceIdentityProvider } from "../service/ServiceIdentityProvider";
 import type { G60DurableHopObserver } from "../diagnostics/G60DurableHop";
-export interface OutboxDrainEnv {
+export interface OutboxDrainEnv extends ServiceIdentityEnvironment {
     TAG: DurableObjectNamespace;
     DOWNSTREAM_QUEUE: Queue<DownstreamOutboxMessage>;
 }
@@ -18,6 +19,8 @@ export interface OutboxDrainOptions {
     readonly acknowledgement?: "transport" | "global-receipt";
     /** G60 observation is scheduled by the active Worker context. */
     readonly durableHopObserver?: G60DurableHopObserver;
+    /** Caller/deployment authority; body.serviceId is never the naming authority. */
+    readonly serviceIdentityProvider?: ServiceIdentityProvider;
 }
 export interface DrainResult {
     serviceId: string;

package/dist/downstream/OutboxDrain.js

@@ -1,5 +1,7 @@
 import { outboxIdentity, systemPipelineClock } from "./types";
 import { scopeIdFor } from "../scope/ScopeName";
+import { scopeIdentityMissingResponse } from "../scope/ControlRouteScope";
+import { envServiceIdentity, ServiceIdentityMissingError, } from "../service/ServiceIdentityProvider";
 function json(body, status = 200) {
     return new Response(JSON.stringify(body), {
         status,
@@ -110,10 +112,30 @@ export async function handleOutboxDrainRequest(request, env, options = {}) {
     if (!isDrainRequest(body)) {
         return json({ error: "serviceId and unique non-empty tags are required", code: "invalid_outbox_drain_request" }, 400);
     }
+    const requestedServiceId = body.serviceId;
+    const tags = body.tags;
+    const provider = options.serviceIdentityProvider ?? envServiceIdentity(env);
+    let authority;
+    try {
+        authority = provider.forRequest(request).serviceId;
+    }
+    catch (caught) {
+        if (caught instanceof ServiceIdentityMissingError)
+            return scopeIdentityMissingResponse();
+        throw caught;
+    }
+    // Body serviceId is caller-supplied input, not Durable Object naming authority.
+    if (requestedServiceId !== authority) {
+        console.warn({ schema: "sdt.scope/v1", code: "scope.mismatch", route: "outbox-drain" });
+        return json({
+            code: "scope.mismatch",
+            error: "The request service identity is not authorized for this deployment",
+        }, 403);
+    }
     try {
         const results = [];
-        for (const tag of body.tags) {
-            results.push(await drainTagOutbox({ serviceId: body.serviceId, tag }, env, systemPipelineClock, options));
+        for (const tag of tags) {
+            results.push(await drainTagOutbox({ serviceId: authority, tag }, env, systemPipelineClock, options));
         }
         return json({ results });
     }

package/dist/generated/cosmos-layout.d.ts

@@ -0,0 +1,87 @@
+export declare const COSMOS_LAYOUT_STABILITY: "experimental";
+export declare const COSMOS_PROVIDER_ID: "cosmos";
+export declare const COSMOS_BINDINGS: {
+    readonly endpoint: "COSMOS_ENDPOINT";
+    readonly database: "COSMOS_DATABASE";
+    readonly key: "COSMOS_KEY";
+};
+export declare const COSMOS_CONTAINER_LAYOUT: Readonly<{
+    readonly events: {
+        readonly name: "dcb-events";
+        readonly partitionKeyPath: "/pk";
+        readonly partitionValueKinds: readonly ["{serviceId}|{eventId}", "{serviceId}|__dcb_event_ops__"];
+        readonly documentIds: {
+            readonly logicalEvent: "canonical event id";
+            readonly eventSidecar: "safeId(\"event-ops\", eventId)";
+            readonly serviceGuards: {
+                readonly allocatorLineageBinding: "safeId(\"allocator-lineage-binding\")";
+                readonly suidBinding: "safeId(\"suid-binding\", suid)";
+                readonly deliveryIncident: "safeId(\"incident\", identityKey)";
+            };
+        };
+    };
+    readonly lagEstimates: {
+        readonly name: "dcb-lag-estimates";
+        readonly partitionKeyPath: "/serviceId";
+        readonly partitionValueKinds: readonly ["{serviceId}"];
+        readonly documentIds: {
+            readonly lagEstimate: "serviceId";
+        };
+    };
+    readonly pendingArrivals: {
+        readonly name: "dcb-pending-arrivals";
+        readonly partitionKeyPath: "/serviceId";
+        readonly partitionValueKinds: readonly ["{serviceId}"];
+        readonly documentIds: {
+            readonly pendingArrival: "safeId(eventId)";
+        };
+    };
+    readonly findings: {
+        readonly name: "dcb-findings";
+        readonly partitionKeyPath: "/serviceId";
+        readonly partitionValueKinds: readonly ["{serviceId}"];
+        readonly documentIds: {
+            readonly finding: "safeId(eventId, path, classification)";
+            readonly incidentProjection: "safeId(\"incident\", identityKey)";
+        };
+    };
+    readonly checkpoints: {
+        readonly name: "dcb-projection-checkpoints";
+        readonly partitionKeyPath: "/serviceId";
+        readonly partitionValueKinds: readonly ["{serviceId}"];
+        readonly documentIds: {
+            readonly checkpoint: "safeId(projectionId)";
+        };
+    };
+}>;
+export declare const COSMOS_DOCUMENT_ID_RULES: Readonly<{
+    readonly events: {
+        readonly logicalEvent: "canonical event id";
+        readonly eventSidecar: "safeId(\"event-ops\", eventId)";
+        readonly serviceGuards: {
+            readonly allocatorLineageBinding: "safeId(\"allocator-lineage-binding\")";
+            readonly suidBinding: "safeId(\"suid-binding\", suid)";
+            readonly deliveryIncident: "safeId(\"incident\", identityKey)";
+        };
+    };
+    readonly lagEstimates: {
+        readonly lagEstimate: "serviceId";
+    };
+    readonly pendingArrivals: {
+        readonly pendingArrival: "safeId(eventId)";
+    };
+    readonly findings: {
+        readonly finding: "safeId(eventId, path, classification)";
+        readonly incidentProjection: "safeId(\"incident\", identityKey)";
+    };
+    readonly checkpoints: {
+        readonly checkpoint: "safeId(projectionId)";
+    };
+}>;
+export declare const COSMOS_CONTAINER_NAMES: Readonly<{
+    readonly events: "dcb-events";
+    readonly lagEstimates: "dcb-lag-estimates";
+    readonly pendingArrivals: "dcb-pending-arrivals";
+    readonly findings: "dcb-findings";
+    readonly checkpoints: "dcb-projection-checkpoints";
+}>;

package/dist/generated/cosmos-layout.js

@@ -0,0 +1,99 @@
+// Generated by scripts/cosmos-layout-contract.mjs. Do not edit.
+export const COSMOS_LAYOUT_STABILITY = "experimental";
+export const COSMOS_PROVIDER_ID = "cosmos";
+export const COSMOS_BINDINGS = Object.freeze({
+    "endpoint": "COSMOS_ENDPOINT",
+    "database": "COSMOS_DATABASE",
+    "key": "COSMOS_KEY"
+});
+export const COSMOS_CONTAINER_LAYOUT = Object.freeze({
+    "events": {
+        "name": "dcb-events",
+        "partitionKeyPath": "/pk",
+        "partitionValueKinds": [
+            "{serviceId}|{eventId}",
+            "{serviceId}|__dcb_event_ops__"
+        ],
+        "documentIds": {
+            "logicalEvent": "canonical event id",
+            "eventSidecar": "safeId(\"event-ops\", eventId)",
+            "serviceGuards": {
+                "allocatorLineageBinding": "safeId(\"allocator-lineage-binding\")",
+                "suidBinding": "safeId(\"suid-binding\", suid)",
+                "deliveryIncident": "safeId(\"incident\", identityKey)"
+            }
+        }
+    },
+    "lagEstimates": {
+        "name": "dcb-lag-estimates",
+        "partitionKeyPath": "/serviceId",
+        "partitionValueKinds": [
+            "{serviceId}"
+        ],
+        "documentIds": {
+            "lagEstimate": "serviceId"
+        }
+    },
+    "pendingArrivals": {
+        "name": "dcb-pending-arrivals",
+        "partitionKeyPath": "/serviceId",
+        "partitionValueKinds": [
+            "{serviceId}"
+        ],
+        "documentIds": {
+            "pendingArrival": "safeId(eventId)"
+        }
+    },
+    "findings": {
+        "name": "dcb-findings",
+        "partitionKeyPath": "/serviceId",
+        "partitionValueKinds": [
+            "{serviceId}"
+        ],
+        "documentIds": {
+            "finding": "safeId(eventId, path, classification)",
+            "incidentProjection": "safeId(\"incident\", identityKey)"
+        }
+    },
+    "checkpoints": {
+        "name": "dcb-projection-checkpoints",
+        "partitionKeyPath": "/serviceId",
+        "partitionValueKinds": [
+            "{serviceId}"
+        ],
+        "documentIds": {
+            "checkpoint": "safeId(projectionId)"
+        }
+    }
+});
+export const COSMOS_DOCUMENT_ID_RULES = Object.freeze({
+    "events": {
+        "logicalEvent": "canonical event id",
+        "eventSidecar": "safeId(\"event-ops\", eventId)",
+        "serviceGuards": {
+            "allocatorLineageBinding": "safeId(\"allocator-lineage-binding\")",
+            "suidBinding": "safeId(\"suid-binding\", suid)",
+            "deliveryIncident": "safeId(\"incident\", identityKey)"
+        }
+    },
+    "lagEstimates": {
+        "lagEstimate": "serviceId"
+    },
+    "pendingArrivals": {
+        "pendingArrival": "safeId(eventId)"
+    },
+    "findings": {
+        "finding": "safeId(eventId, path, classification)",
+        "incidentProjection": "safeId(\"incident\", identityKey)"
+    },
+    "checkpoints": {
+        "checkpoint": "safeId(projectionId)"
+    }
+});
+export const COSMOS_CONTAINER_NAMES = Object.freeze({
+    "events": "dcb-events",
+    "lagEstimates": "dcb-lag-estimates",
+    "pendingArrivals": "dcb-pending-arrivals",
+    "findings": "dcb-findings",
+    "checkpoints": "dcb-projection-checkpoints"
+});

package/dist/http/ConfiguredBearer.d.ts

@@ -0,0 +1,12 @@
+export type ConfiguredBearerResult = "unconfigured" | "missing" | "invalid" | "authorized";
+export type ConfiguredBearerTokenNormalization = "exact" | "trim";
+export interface CheckConfiguredBearerOptions {
+    readonly tokenNormalization?: ConfiguredBearerTokenNormalization;
+}
+/**
+ * Decide whether a configured shared secret admits this request.
+ * Callers map the four results onto their own HTTP responses.
+ * The binding is configured only when it is a string with a non-whitespace
+ * character. Exact mode keeps those bytes; trim mode is opt-in.
+ */
+export declare function checkConfiguredBearer(request: Request, binding: unknown, options?: CheckConfiguredBearerOptions): Promise<ConfiguredBearerResult>;

package/dist/http/ConfiguredBearer.js

@@ -0,0 +1,33 @@
+async function sha256(value) {
+    const encoded = new TextEncoder().encode(value);
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", encoded));
+}
+function digestsMatch(expected, supplied) {
+    let difference = expected.length ^ supplied.length;
+    const length = Math.max(expected.length, supplied.length);
+    for (let index = 0; index < length; index += 1) {
+        difference |= (expected[index] ?? 0) ^ (supplied[index] ?? 0);
+    }
+    return difference === 0;
+}
+/**
+ * Decide whether a configured shared secret admits this request.
+ * Callers map the four results onto their own HTTP responses.
+ * The binding is configured only when it is a string with a non-whitespace
+ * character. Exact mode keeps those bytes; trim mode is opt-in.
+ */
+export async function checkConfiguredBearer(request, binding, options) {
+    if (typeof binding !== "string" || binding.trim().length === 0) {
+        return "unconfigured";
+    }
+    const effectiveToken = options?.tokenNormalization === "trim" ? binding.trim() : binding;
+    const supplied = request.headers.get("authorization");
+    if (supplied === null)
+        return "missing";
+    const expected = `Bearer ${effectiveToken}`;
+    const [expectedDigest, suppliedDigest] = await Promise.all([
+        sha256(expected),
+        sha256(supplied),
+    ]);
+    return digestsMatch(expectedDigest, suppliedDigest) ? "authorized" : "invalid";
+}

package/dist/http/IncidentMaintenance.d.ts

@@ -0,0 +1,8 @@
+import { type ServiceIdentityProvider } from "../service/ServiceIdentityProvider";
+export interface IncidentMaintenanceEnvironment {
+    readonly D1?: D1Database;
+    readonly INCIDENT_MAINTAINER_TOKEN?: string;
+    readonly G11_VERIFICATION_ENABLED?: string;
+}
+export declare function isIncidentMaintenancePath(pathname: string): boolean;
+export declare function handleIncidentMaintenance(request: Request, env: IncidentMaintenanceEnvironment, serviceIdentityProvider: ServiceIdentityProvider): Promise<Response>;