@sekiban/dcb-runtime 0.2.0

package/dist/commit/types.d.ts

@@ -0,0 +1,25 @@
+import type { ConsistencyTag } from "../journal/types";
+/** The V1 base64 payload after fatal UTF-8 JSON admission, retained as text. */
+export interface SerializedCommitCandidate {
+    /** Decoded UTF-8 JSON text; whitespace and member order are preserved. */
+    payload: string;
+    eventPayloadName: string;
+    eventType: string;
+    tags: string[];
+}
+export interface ValidatedCommitEnvelope {
+    eventCandidates: SerializedCommitCandidate[];
+    consistencyTags: ConsistencyTag[];
+    allTags: string[];
+}
+export interface AllocatedCommitCandidate extends SerializedCommitCandidate {
+    eventId: string;
+    suid: string;
+    timestamp: string;
+}
+/**
+ * Narrow fault hooks used only by the Miniflare adversarial tests. They are
+ * carried in a private header rather than accepted in the V1 JSON envelope.
+ */
+export type CommitTestFault = "reservation-delayed-success" | "after-reservations-before-allocation" | "allocator-commit" | "journal-cas-after-allocator" | "tag-append-always" | "tag-append-last" | "fence-install-partial" | "fence-not-durable" | "tag-state-unavailable" | "sealing-after-cas" | "tombstone-after-durable";
+export declare const COMMIT_TEST_FAULTS: readonly CommitTestFault[];

package/dist/commit/types.js

@@ -0,0 +1,13 @@
+export const COMMIT_TEST_FAULTS = [
+    "reservation-delayed-success",
+    "after-reservations-before-allocation",
+    "allocator-commit",
+    "journal-cas-after-allocator",
+    "tag-append-always",
+    "tag-append-last",
+    "fence-install-partial",
+    "fence-not-durable",
+    "tag-state-unavailable",
+    "sealing-after-cas",
+    "tombstone-after-durable",
+];

package/dist/completeness/GlobalCompletenessReconciler.d.ts

@@ -0,0 +1,77 @@
+import type { DownstreamOutboxMessage } from "../downstream/types";
+import { type GlobalCompletenessCoverage, type GlobalCompletenessHealthRecord, type GlobalCompletenessScanResult, type SourceObligationFact } from "./types";
+/** Test-only seam for exercising the same receipt-read failure branch. */
+export interface GlobalCompletenessReconcilerOptions {
+    readonly globalReceiptMatcher?: (serviceId: string, tag: string, obligation: SourceObligationFact) => Promise<boolean>;
+}
+/**
+ * An independent source→global reconciliation pass. It never receives a
+ * Queue message or an expected test count: its universe is the source-side
+ * partition registry captured before paging any Tag DO.
+ */
+export declare class GlobalCompletenessReconciler {
+    private readonly database;
+    private readonly tags;
+    private readonly scannerVersion;
+    private readonly options;
+    constructor(database: D1Database, tags: DurableObjectNamespace, scannerVersion?: string, options?: GlobalCompletenessReconcilerOptions);
+    reconcile(serviceId: string, nowMs: number): Promise<GlobalCompletenessScanResult>;
+    private readSourcePage;
+    /**
+     * Read the detector health authority without using findings, delivery, or
+     * Queue state as a proxy. A never-run or expired successful scan is never
+     * silently healthy.
+     */
+    readHealth(serviceId: string, nowMs: number, staleAfterMs?: number): Promise<GlobalCompletenessHealthRecord>;
+    /**
+     * The one interim coverage gate.  It deliberately has no configuration
+     * matrix and does not turn a missing finding into a synthetic healthy read.
+     */
+    coverage(serviceId: string, nowMs: number): Promise<GlobalCompletenessCoverage>;
+    /**
+     * The downstream view gate must consume the same proof domain that the
+     * reconciler persisted. A service-level HEALTHY bit is insufficient: a
+     * delivery from a partition added after that scan must remain blocked until
+     * a later successful cursor includes its exact local obligation sequence.
+     */
+    coverageForObligation(serviceId: string, tag: string, obligationSequence: number, nowMs: number): Promise<GlobalCompletenessCoverage>;
+    /**
+     * DeliveryCore calls this after a detector exception and before it returns
+     * without applying views. It shares the scanner's single health/finding
+     * authority rather than creating a second incident workflow.
+     */
+    recordDetectorFailure(serviceId: string, error: unknown, nowMs: number): Promise<void>;
+    /** D1 receipt join is independent from every projection and transport. */
+    globalReceiptMatches(serviceId: string, tag: string, obligation: SourceObligationFact): Promise<boolean>;
+    private snapshotPartitions;
+    private assertSnapshotUniverseUnchanged;
+    private assertStartPartitionsRetained;
+    private assertPage;
+    /**
+     * The frontier is derived only from receipts inside the immutable source
+     * snapshot that just passed every G44 join.  It is not the mutable global
+     * table head: a delivery arriving after the snapshot is deliberately left
+     * for a later FULL scan.
+     */
+    private settledFrontierAtSnapshot;
+    private latestFindingPartitionTag;
+    private appendObligationFinding;
+    private appendFinding;
+    private writeHealth;
+}
+/** The acknowledgement payload carries facts from the same source envelope. */
+export declare function globalReceiptAcknowledgement(message: DownstreamOutboxMessage, receivedAt: number): {
+    deliveries: {
+        attemptId: string;
+        eventId: string;
+        suid: string;
+        payload: string;
+        eventType: string;
+        provenance: "g32";
+        timestamp: string;
+        allocatorLineageId: string;
+        enqueuedAt: number;
+        completeness: import("../downstream/types").OutboxCompletenessFacts;
+    }[];
+    nowMs: number;
+};