@sekiban/dcb-runtime 0.2.0

package/dist/downstream/types.d.ts

@@ -0,0 +1,77 @@
+/** A queue payload is intentionally an internal envelope, never part of V1. */
+/**
+ * `import` is a direct, operator-owned C# record import. It never traverses
+ * Queue or doorbell, where a newly authored event must always be UUID v7.
+ */
+export type DeliverySource = "queue" | "fast" | "import";
+/** G32 has no legacy delivery lane. Every durable envelope is explicitly g32. */
+export type DeliveryProvenance = "g32";
+/** One tag-local committed-membership fact carried by a G43 obligation. */
+export interface OutboxCommittedMembership {
+    readonly serviceId: string;
+    readonly eventId: string;
+    readonly tag: string;
+}
+/**
+ * Source-authoritative facts required to turn a transport handoff into a
+ * global-array receipt.  `canonicalBytesBase64` is the exact G43 digest
+ * preimage, not a projection-derived reconstruction.
+ */
+export interface OutboxCompletenessFacts {
+    readonly canonicalBytesBase64: string;
+    readonly eventDigest: string;
+    readonly declaredTagSet: readonly string[];
+    readonly localCommittedMembership: readonly OutboxCommittedMembership[];
+    /** Local to the source Tag DO; never treated as a global sequence. */
+    readonly obligationSequence: number;
+}
+export interface DownstreamOutboxMessage {
+    version: 1;
+    serviceId: string;
+    /** Stable identity of the allocator DO lineage that issued this delivery. */
+    allocatorLineageId: string;
+    tag: string;
+    attemptId: string;
+    eventId: string;
+    suid: string;
+    payload: string;
+    /** UTC write-time timestamp carried with the exact event payload. */
+    timestamp: string;
+    /** Nullable only on the fenced C# import lane; normal delivery is exact constants. */
+    causationId: string | null;
+    correlationId: string | null;
+    executedUser: string | null;
+    /** The complete set of tag-side copies expected for this event. */
+    eventTags: string[];
+    /** Durable C# EventType = eventPayloadName. */
+    eventType: string;
+    provenance: DeliveryProvenance;
+    /** Durable outbox clock fact, set before the first queue send attempt. */
+    enqueuedAt: number;
+    /** G43 source facts; required before the global array can acknowledge. */
+    completeness: OutboxCompletenessFacts;
+}
+export interface OutboxDeliveryIdentity {
+    attemptId: string;
+    eventId: string;
+    suid: string;
+    allocatorLineageId: string;
+    payload: string;
+    eventType: string;
+    provenance: DeliveryProvenance;
+    timestamp: string;
+    causationId: string | null;
+    correlationId: string | null;
+    executedUser: string | null;
+    completeness: Pick<OutboxCompletenessFacts, "eventDigest" | "obligationSequence">;
+}
+export interface OutboxDelivery extends OutboxDeliveryIdentity {
+    enqueuedAt: number;
+    deliveredAt: number | null;
+}
+export interface PipelineClock {
+    now(): number;
+}
+export declare const systemPipelineClock: PipelineClock;
+export declare function outboxIdentity(message: OutboxDeliveryIdentity): string;
+export declare function isDownstreamOutboxMessage(value: unknown): value is DownstreamOutboxMessage;

package/dist/downstream/types.js

@@ -0,0 +1,64 @@
+import { parseCanonicalEventKey } from "@sekiban/dcb-core";
+import { isSortableUniqueId } from "../allocator/SortableUniqueId";
+import { CANONICAL_UTC_TIMESTAMP_PATTERN, isUuidV7, serializedEventMetadata } from "../eventRecord";
+export const systemPipelineClock = {
+    now: () => Date.now(),
+};
+export function outboxIdentity(message) {
+    return [message.attemptId, message.eventId, message.suid, message.allocatorLineageId, message.payload, message.eventType, message.provenance, message.timestamp ?? "", message.causationId ?? "", message.correlationId ?? "", message.executedUser ?? "", message.completeness.eventDigest, String(message.completeness.obligationSequence)].join("\u0000");
+}
+function isCommittedMembership(value, candidate) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const membership = value;
+    return membership.serviceId === candidate.serviceId &&
+        membership.eventId === candidate.eventId &&
+        typeof membership.tag === "string" && membership.tag.length > 0;
+}
+function isCompletenessFacts(value, candidate) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const facts = value;
+    return typeof facts.canonicalBytesBase64 === "string" && facts.canonicalBytesBase64.length > 0 &&
+        typeof facts.eventDigest === "string" && /^[0-9a-f]{64}$/.test(facts.eventDigest) &&
+        Array.isArray(facts.declaredTagSet) && facts.declaredTagSet.length > 0 &&
+        facts.declaredTagSet.every((tag) => typeof tag === "string" && tag.length > 0) &&
+        new Set(facts.declaredTagSet).size === facts.declaredTagSet.length &&
+        Array.isArray(facts.localCommittedMembership) && facts.localCommittedMembership.length === 1 &&
+        facts.localCommittedMembership.every((membership) => isCommittedMembership(membership, candidate)) &&
+        facts.localCommittedMembership[0] !== undefined &&
+        facts.localCommittedMembership[0].tag === candidate.tag &&
+        Number.isSafeInteger(facts.obligationSequence) && facts.obligationSequence > 0;
+}
+export function isDownstreamOutboxMessage(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const candidate = value;
+    if (typeof candidate.eventType !== "string" || candidate.eventType.length === 0 || candidate.provenance !== "g32")
+        return false;
+    try {
+        parseCanonicalEventKey(candidate.eventType);
+    }
+    catch {
+        return false;
+    }
+    const metadata = typeof candidate.eventId === "string" ? serializedEventMetadata(candidate.eventId) : undefined;
+    return candidate.version === 1 &&
+        typeof candidate.serviceId === "string" && candidate.serviceId.length > 0 &&
+        typeof candidate.allocatorLineageId === "string" && candidate.allocatorLineageId.length > 0 &&
+        typeof candidate.tag === "string" && candidate.tag.length > 0 &&
+        typeof candidate.attemptId === "string" && candidate.attemptId.length > 0 &&
+        isUuidV7(candidate.eventId) &&
+        isSortableUniqueId(candidate.suid) &&
+        typeof candidate.payload === "string" &&
+        Array.isArray(candidate.eventTags) && candidate.eventTags.every((tag) => typeof tag === "string" && tag.length > 0) &&
+        new Set(candidate.eventTags).size === candidate.eventTags.length && candidate.eventTags.includes(candidate.tag) &&
+        typeof candidate.timestamp === "string" && CANONICAL_UTC_TIMESTAMP_PATTERN.test(candidate.timestamp) &&
+        candidate.causationId === metadata?.causationId &&
+        candidate.correlationId === metadata?.correlationId &&
+        candidate.executedUser === metadata?.executedUser &&
+        typeof candidate.enqueuedAt === "number" && Number.isSafeInteger(candidate.enqueuedAt) &&
+        candidate.provenance === "g32" &&
+        isCompletenessFacts(candidate.completeness, candidate);
+}

package/dist/eventIdentity.d.ts

@@ -0,0 +1,30 @@
+import { type CanonicalEventIdentity } from "@sekiban/dcb-core";
+import type { DeliverySource } from "./downstream/types";
+/** G32 has one durable delivery format; legacy lanes are deliberately gone. */
+export type EventProvenance = "g32";
+export type DeliveryProvenance = "g32";
+export declare class DeliveryIdentityError extends Error {
+    readonly code: string;
+    readonly retryable = false;
+    constructor(message: string);
+}
+export declare class MissingCanonicalEventIdentityError extends DeliveryIdentityError {
+    readonly code: "MISSING_CANONICAL_EVENT_IDENTITY";
+    constructor(source: DeliverySource);
+}
+export interface ResolvedDeliveryIdentity extends CanonicalEventIdentity {
+    readonly provenance: "g32";
+    /** Compatibility shape only; it is always false for an admitted G32 row. */
+    readonly legacy: false;
+}
+export declare function canonicalEventType(eventPayloadName: string): string;
+/**
+ * Resolve identity at the delivery admission boundary. A G32 delivery has a
+ * durable EventType equal to eventPayloadName; no payload discriminator or
+ * historical compatibility lane is permitted.
+ */
+export declare function resolveDeliveryIdentity(message: {
+    readonly eventType?: string;
+    readonly provenance?: DeliveryProvenance | EventProvenance;
+}, source: DeliverySource): ResolvedDeliveryIdentity;
+export declare function assertCanonicalEventType(value: string): CanonicalEventIdentity;

package/dist/eventIdentity.js

@@ -0,0 +1,49 @@
+import { canonicalEventKey, parseCanonicalEventKey } from "@sekiban/dcb-core";
+export class DeliveryIdentityError extends Error {
+    code = "DELIVERY_IDENTITY_INVALID";
+    retryable = false;
+    constructor(message) {
+        super(message);
+        this.name = "DeliveryIdentityError";
+    }
+}
+export class MissingCanonicalEventIdentityError extends DeliveryIdentityError {
+    code = "MISSING_CANONICAL_EVENT_IDENTITY";
+    constructor(source) {
+        super(`G32 ${source} delivery is missing canonical event identity`);
+        this.name = "MissingCanonicalEventIdentityError";
+    }
+}
+export function canonicalEventType(eventPayloadName) {
+    return canonicalEventKey(eventPayloadName);
+}
+function provenanceFrom(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === "g32")
+        return value;
+    throw new DeliveryIdentityError("Unknown event identity provenance");
+}
+/**
+ * Resolve identity at the delivery admission boundary. A G32 delivery has a
+ * durable EventType equal to eventPayloadName; no payload discriminator or
+ * historical compatibility lane is permitted.
+ */
+export function resolveDeliveryIdentity(message, source) {
+    const provenance = provenanceFrom(message.provenance);
+    if (message.eventType === undefined) {
+        throw new MissingCanonicalEventIdentityError(source);
+    }
+    const identity = parseCanonicalEventKey(message.eventType);
+    if (provenance !== "g32") {
+        throw new DeliveryIdentityError("G32 delivery provenance is required");
+    }
+    return {
+        ...identity,
+        provenance: "g32",
+        legacy: false,
+    };
+}
+export function assertCanonicalEventType(value) {
+    return parseCanonicalEventKey(value);
+}

package/dist/eventRecord.d.ts

@@ -0,0 +1,26 @@
+/** C# serialized-path constants used by every G32 logical event record. */
+export declare const SERIALIZED_COMMIT_CORRELATION_ID: "SerializedCommit";
+export declare const SERIALIZED_SEKIBAN_EXECUTOR: "SerializedSekibanExecutor";
+/**
+ * UTC text accepted by the C# provider models. DateTime has seven tick
+ * digits, but its JSON serializer legitimately elides trailing zeroes; the
+ * durable interchange therefore permits one through seven fractional digits.
+ * TS-authored writes continue to use the millisecond spelling from
+ * writeTimestampUtc.
+ */
+export declare const CANONICAL_UTC_TIMESTAMP_PATTERN: RegExp;
+export interface SerializedEventMetadata {
+    readonly causationId: string;
+    readonly correlationId: typeof SERIALIZED_COMMIT_CORRELATION_ID;
+    readonly executedUser: typeof SERIALIZED_SEKIBAN_EXECUTOR;
+}
+export declare function serializedEventMetadata(eventId: string): SerializedEventMetadata;
+/**
+ * UUID version 7 following the RFC 9562 layout used by Guid.CreateVersion7:
+ * 48 bits Unix milliseconds, version 7, RFC4122 variant, then crypto bits.
+ */
+export declare function createUuidV7(nowMs?: number): string;
+export declare function isRfc4122Uuid(value: unknown): value is string;
+export declare function isUuidV7(value: unknown): value is string;
+/** ISO-8601 UTC spelling required by D1's logical C# record. */
+export declare function writeTimestampUtc(nowMs?: number): string;

package/dist/eventRecord.js

@@ -0,0 +1,53 @@
+/** C# serialized-path constants used by every G32 logical event record. */
+export const SERIALIZED_COMMIT_CORRELATION_ID = "SerializedCommit";
+export const SERIALIZED_SEKIBAN_EXECUTOR = "SerializedSekibanExecutor";
+/**
+ * UTC text accepted by the C# provider models. DateTime has seven tick
+ * digits, but its JSON serializer legitimately elides trailing zeroes; the
+ * durable interchange therefore permits one through seven fractional digits.
+ * TS-authored writes continue to use the millisecond spelling from
+ * writeTimestampUtc.
+ */
+export const CANONICAL_UTC_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{1,7}Z$/;
+export function serializedEventMetadata(eventId) {
+    return Object.freeze({
+        causationId: eventId,
+        correlationId: SERIALIZED_COMMIT_CORRELATION_ID,
+        executedUser: SERIALIZED_SEKIBAN_EXECUTOR,
+    });
+}
+/**
+ * UUID version 7 following the RFC 9562 layout used by Guid.CreateVersion7:
+ * 48 bits Unix milliseconds, version 7, RFC4122 variant, then crypto bits.
+ */
+export function createUuidV7(nowMs = Date.now()) {
+    if (!Number.isSafeInteger(nowMs) || nowMs < 0 || nowMs > 0xffff_ffff_ffff) {
+        throw new Error("UUIDv7 time must be a non-negative 48-bit safe integer");
+    }
+    if (typeof globalThis.crypto?.getRandomValues !== "function") {
+        throw new Error("crypto.getRandomValues is required for UUIDv7");
+    }
+    const bytes = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(bytes);
+    let time = BigInt(nowMs);
+    for (let index = 5; index >= 0; index -= 1) {
+        bytes[index] = Number(time & 0xffn);
+        time >>= 8n;
+    }
+    bytes[6] = (bytes[6] & 0x0f) | 0x70;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = [...bytes].map((value) => value.toString(16).padStart(2, "0")).join("");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+export function isRfc4122Uuid(value) {
+    return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+export function isUuidV7(value) {
+    return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
+}
+/** ISO-8601 UTC spelling required by D1's logical C# record. */
+export function writeTimestampUtc(nowMs = Date.now()) {
+    if (!Number.isSafeInteger(nowMs) || nowMs < 0)
+        throw new Error("Write timestamp requires a non-negative safe Unix millisecond value");
+    return new Date(nowMs).toISOString();
+}

package/dist/g42-probe.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Node-safe contract entrypoint for SDT-G42's external probe runner.
+ *
+ * The primary Worker imports the same source through `cloudflare.ts`; this
+ * narrow entrypoint intentionally does not compose the Cloudflare runtime, so
+ * the pre-run runner and checker can execute under ordinary Node without
+ * resolving `cloudflare:workers`.
+ */
+export { G42_JOURNAL_PROBE_PATH, G42_JOURNAL_PROBE_SCHEMA, } from "./journal/JournalFirstTouchProbe";

package/dist/g42-probe.js

@@ -0,0 +1,9 @@
+/**
+ * Node-safe contract entrypoint for SDT-G42's external probe runner.
+ *
+ * The primary Worker imports the same source through `cloudflare.ts`; this
+ * narrow entrypoint intentionally does not compose the Cloudflare runtime, so
+ * the pre-run runner and checker can execute under ordinary Node without
+ * resolving `cloudflare:workers`.
+ */
+export { G42_JOURNAL_PROBE_PATH, G42_JOURNAL_PROBE_SCHEMA, } from "./journal/JournalFirstTouchProbe";

package/dist/http/SerializedQueryWorker.d.ts

@@ -0,0 +1,58 @@
+import { type ProjectorRegistry } from "../projection/ProjectorRegistry";
+import { type ProjectedQueryEntry, type QueryBacking, type MaterializedViewQueryPort, type QueryProjectionStore } from "../query/ProjectionQueryStore";
+import { type QueryRegistry } from "../query/QueryRegistry";
+import type { StoreProvider } from "../store/provider";
+import { type ServiceIdentityProvider } from "../service/ServiceIdentityProvider";
+export interface QueryWorkerEnv {
+    POSTGRES_URL?: string;
+    HYPERDRIVE?: Hyperdrive;
+    /** Optional explicit D1 provider binding; Postgres remains the default. */
+    D1?: D1Database;
+    /** Set only by an authenticated deployment-verification lane. */
+    G11_VERIFICATION_ENABLED?: string;
+    /** Non-secret service identity configured per deployment. */
+    SDT_SERVICE_ID?: string;
+    /** Separate D1 binding for row-backed materialized-view queries. */
+    D1_MV?: D1Database;
+}
+export interface QueryExecutionOptions {
+    /** A read-only fake store keeps wait and paging tests deterministic. */
+    store?: QueryProjectionStore;
+    storeProvider?: StoreProvider;
+    registry?: QueryRegistry;
+    projectors?: ProjectorRegistry;
+    /** Deploy-time query backing; request data can never select this value. */
+    queryBacking?: QueryBacking;
+    /** Optional injected port for tests or an explicitly composed runtime. */
+    materializedViewQueryPort?: MaterializedViewQueryPort;
+    now?: () => number;
+    sleep?: (milliseconds: number) => Promise<void>;
+    pollIntervalMs?: number;
+    /** Internal observation only; invoked without awaiting or changing the V1 response. */
+    afterUnsafeRead?: (input: {
+        readonly serviceId: string;
+        readonly viewId: string;
+        readonly entries: readonly ProjectedQueryEntry[];
+        readonly observedAt: number;
+    }) => void;
+    /** Host/deployment identity seam; defaults to envServiceIdentity. */
+    serviceIdentityProvider?: ServiceIdentityProvider;
+}
+/**
+ * G31 reserves a final loop slot so a healthy pending 120s waiter does not
+ * stop polling before its absolute deadline: 126 loop slots / at most 126
+ * source+MV probes plus one final confirmation. Backoff is 25, 50, 100, 200,
+ * 400, 800, then 1000ms. A normal pending waiter therefore makes 26 paired
+ * probes at the 20s floor and 126 at the 120s ceiling; a mandatory
+ * final-success recheck raises the global maximum to 127 paired probes / 254
+ * point-read statements. The cap
+ * also makes a stalled test clock deterministic instead of issuing unbounded
+ * reads.
+ */
+export declare const D1_WAIT_MAX_ITERATIONS = 126;
+export declare const D1_WAIT_MAX_POINT_READS = 254;
+/**
+ * V1 §5.4/§5.5 HTTP surface. It never starts a projection catch-up or writes
+ * a source/checkpoint row: the query sees only the durable read-side snapshot.
+ */
+export declare function handleSerializedQuery(request: Request, env: QueryWorkerEnv, options?: QueryExecutionOptions): Promise<Response>;