@sekiban/dcb-runtime 0.2.0

package/dist/tag/TagSqlMeasurement.d.ts

@@ -0,0 +1,26 @@
+/**
+ * G43's structural measurement harness. It is deliberately opt-in and holds
+ * no durable state: a test starts it immediately before a real Tag DO handler
+ * request and completes it only after response serialization. Every SQL
+ * cursor obtained through the handler is retained until final consumption, so
+ * counters are summed over the complete statement universe rather than a
+ * hand-selected query.
+ */
+export interface G43MeasuredCursor {
+    readonly query: string;
+    readonly rowsRead: number;
+    readonly rowsWritten: number;
+}
+export interface G43SqlMeasurementSnapshot {
+    readonly statements: readonly string[];
+    readonly cursors: readonly G43MeasuredCursor[];
+    readonly rowsRead: number;
+    readonly rowsWritten: number;
+}
+export declare class G43SqlMeasurement {
+    private readonly statements;
+    private readonly cursors;
+    private completed;
+    instrument(sql: SqlStorage): SqlStorage;
+    complete(): G43SqlMeasurementSnapshot;
+}

package/dist/tag/TagSqlMeasurement.js

@@ -0,0 +1,44 @@
+export class G43SqlMeasurement {
+    statements = [];
+    cursors = [];
+    completed = false;
+    instrument(sql) {
+        return new Proxy(sql, {
+            get: (target, property, receiver) => {
+                if (property === "exec") {
+                    return (query, ...bindings) => {
+                        if (this.completed)
+                            throw new Error("G43 SQL measurement cannot observe a completed handler");
+                        const cursor = target.exec(query, ...bindings);
+                        this.statements.push(query);
+                        this.cursors.push({
+                            query,
+                            cursor: cursor,
+                        });
+                        return cursor;
+                    };
+                }
+                const value = Reflect.get(target, property, receiver);
+                return typeof value === "function" ? value.bind(target) : value;
+            },
+        });
+    }
+    complete() {
+        if (this.completed)
+            throw new Error("G43 SQL measurement is already complete");
+        this.completed = true;
+        const cursors = this.cursors.map(({ query, cursor }) => {
+            // SqlStorage cursor counters are only final after full enumeration. This
+            // consumes even write/no-row cursors, and makes an omitted statement
+            // impossible to hide behind a partial cursor read.
+            cursor.toArray();
+            return { query, rowsRead: cursor.rowsRead, rowsWritten: cursor.rowsWritten };
+        });
+        return Object.freeze({
+            statements: Object.freeze([...this.statements]),
+            cursors: Object.freeze(cursors),
+            rowsRead: cursors.reduce((sum, cursor) => sum + cursor.rowsRead, 0),
+            rowsWritten: cursors.reduce((sum, cursor) => sum + cursor.rowsWritten, 0),
+        });
+    }
+}

package/dist/tag/TagSqlSchema.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SDT-G43's tag-local authority is intentionally a normal SQLite schema, not
+ * a serialized application record hidden behind a KV key.  These statements
+ * are kept literal so schema review and `sqlite_master` introspection see the
+ * exact primary keys, uniqueness constraints, foreign keys, and indexes.
+ *
+ * Existing TAG_KEY records are deliberately not migrated.  This repository is
+ * still in development and the operator ruling for G43 is to reset those test
+ * records rather than introduce a mixed-format or rollback protocol.
+ */
+export declare const TAG_SQL_SCHEMA_DDL = "\n  PRAGMA foreign_keys = ON;\n\n  CREATE TABLE IF NOT EXISTS tag_identity (\n    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),\n    tag TEXT NOT NULL UNIQUE,\n    created_at TEXT NOT NULL\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_control (\n    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),\n    schema_version INTEGER NOT NULL CHECK (schema_version = 3),\n    head_suid TEXT NOT NULL,\n    clock_offset_ms INTEGER NOT NULL,\n    clock_now_ms INTEGER,\n    version INTEGER NOT NULL,\n    repair_owner TEXT,\n    repair_lease_until INTEGER,\n    highest_repair_epoch INTEGER NOT NULL,\n    repair_scope_version INTEGER NOT NULL,\n    created_at TEXT NOT NULL,\n    updated_at TEXT NOT NULL,\n    FOREIGN KEY (singleton) REFERENCES tag_identity(singleton) ON DELETE RESTRICT\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_reservation (\n    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),\n    attempt_id TEXT NOT NULL,\n    epoch INTEGER NOT NULL,\n    reservation_token TEXT NOT NULL UNIQUE,\n    expected_head TEXT NOT NULL,\n    expires_at INTEGER NOT NULL,\n    alarm_due_at INTEGER NOT NULL,\n    FOREIGN KEY (singleton) REFERENCES tag_identity(singleton) ON DELETE RESTRICT\n  );\n  CREATE INDEX IF NOT EXISTS tag_reservation_due_idx ON tag_reservation(alarm_due_at);\n\n  CREATE TABLE IF NOT EXISTS tag_epoch (\n    attempt_id TEXT PRIMARY KEY,\n    highest_epoch INTEGER NOT NULL,\n    sealed_epoch INTEGER,\n    confirmation_epoch INTEGER\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_tombstone (\n    attempt_id TEXT PRIMARY KEY,\n    epoch INTEGER NOT NULL\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_event (\n    service_id TEXT NOT NULL,\n    event_id TEXT NOT NULL,\n    attempt_id TEXT NOT NULL,\n    suid TEXT NOT NULL,\n    payload TEXT NOT NULL,\n    event_tags_json TEXT NOT NULL,\n    allocator_lineage_id TEXT NOT NULL,\n    event_type TEXT NOT NULL,\n    provenance TEXT NOT NULL CHECK (provenance = 'g32'),\n    timestamp TEXT NOT NULL,\n    event_json TEXT NOT NULL,\n    PRIMARY KEY (service_id, event_id),\n    UNIQUE (suid)\n  );\n  CREATE INDEX IF NOT EXISTS tag_event_suid_idx ON tag_event(suid);\n  CREATE INDEX IF NOT EXISTS tag_event_attempt_idx ON tag_event(attempt_id, event_id);\n\n  CREATE TABLE IF NOT EXISTS tag_head (\n    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),\n    service_id TEXT NOT NULL,\n    head_suid TEXT NOT NULL,\n    FOREIGN KEY (singleton) REFERENCES tag_identity(singleton) ON DELETE RESTRICT\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_committed_membership (\n    service_id TEXT NOT NULL,\n    event_id TEXT NOT NULL,\n    tag TEXT NOT NULL,\n    committed_at TEXT NOT NULL,\n    PRIMARY KEY (service_id, event_id, tag),\n    FOREIGN KEY (service_id, event_id)\n      REFERENCES tag_event(service_id, event_id) ON DELETE RESTRICT,\n    FOREIGN KEY (tag) REFERENCES tag_identity(tag) ON DELETE RESTRICT\n  );\n  CREATE INDEX IF NOT EXISTS tag_committed_membership_tag_idx\n    ON tag_committed_membership(tag, service_id, event_id);\n\n  CREATE TABLE IF NOT EXISTS tag_outbox_obligation (\n    obligation_sequence INTEGER PRIMARY KEY AUTOINCREMENT,\n    service_id TEXT NOT NULL,\n    event_id TEXT NOT NULL,\n    attempt_id TEXT NOT NULL,\n    suid TEXT NOT NULL,\n    payload TEXT NOT NULL,\n    allocator_lineage_id TEXT NOT NULL,\n    event_type TEXT NOT NULL,\n    provenance TEXT NOT NULL CHECK (provenance = 'g32'),\n    timestamp TEXT NOT NULL,\n    canonical_bytes BLOB NOT NULL,\n    event_digest TEXT NOT NULL,\n    declared_tag_set_json TEXT NOT NULL,\n    local_committed_membership_json TEXT NOT NULL,\n    status TEXT NOT NULL CHECK (status IN ('pending', 'acknowledged', 'poison')),\n    next_attempt_at INTEGER NOT NULL,\n    attempt_count INTEGER NOT NULL DEFAULT 0,\n    enqueued_at INTEGER,\n    acknowledged_at INTEGER,\n    last_error TEXT,\n    UNIQUE (service_id, event_id, attempt_id),\n    FOREIGN KEY (service_id, event_id)\n      REFERENCES tag_event(service_id, event_id) ON DELETE RESTRICT\n  );\n  CREATE INDEX IF NOT EXISTS tag_outbox_obligation_due_idx\n    ON tag_outbox_obligation(status, next_attempt_at, obligation_sequence);\n\n  CREATE TABLE IF NOT EXISTS tag_source_partition_registration (\n    service_id TEXT NOT NULL,\n    partition_tag TEXT NOT NULL,\n    last_obligation_sequence INTEGER NOT NULL,\n    status TEXT NOT NULL CHECK (status IN ('pending', 'registered')),\n    next_attempt_at INTEGER,\n    attempt_count INTEGER NOT NULL DEFAULT 0,\n    last_error TEXT,\n    PRIMARY KEY (service_id, partition_tag)\n  );\n  CREATE INDEX IF NOT EXISTS tag_source_partition_registration_due_idx\n    ON tag_source_partition_registration(status, next_attempt_at, service_id, partition_tag);\n\n  CREATE TABLE IF NOT EXISTS tag_commit_receipt (\n    attempt_id TEXT NOT NULL,\n    epoch INTEGER NOT NULL,\n    committed_at TEXT NOT NULL,\n    committed_event_count INTEGER NOT NULL,\n    head_suid TEXT NOT NULL,\n    reservation_confirmed INTEGER NOT NULL CHECK (reservation_confirmed IN (0, 1)),\n    PRIMARY KEY (attempt_id, epoch)\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_fence (\n    reason TEXT NOT NULL,\n    attempt_id TEXT NOT NULL,\n    epoch INTEGER NOT NULL,\n    PRIMARY KEY (reason, attempt_id)\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_cleared_fence (\n    reason TEXT NOT NULL,\n    attempt_id TEXT NOT NULL,\n    epoch INTEGER NOT NULL,\n    PRIMARY KEY (reason, attempt_id)\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_bootstrap_admission (\n    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),\n    import_id TEXT NOT NULL,\n    lease_epoch INTEGER NOT NULL,\n    manifest_digest TEXT NOT NULL,\n    target_service_id TEXT NOT NULL,\n    closed INTEGER NOT NULL CHECK (closed IN (0, 1)),\n    FOREIGN KEY (singleton) REFERENCES tag_identity(singleton) ON DELETE RESTRICT\n  );\n\n  CREATE TABLE IF NOT EXISTS tag_repair_scope (\n    attempt_id TEXT NOT NULL,\n    event_id TEXT NOT NULL,\n    item_json TEXT NOT NULL,\n    PRIMARY KEY (attempt_id, event_id)\n  );\n";
+/**
+ * Packet-owned AC8 range seam. The query text and index identity are exported
+ * so the measurement checker can prove exactly what was explained and what
+ * returned rows were compared against; no "equivalent" plan is accepted.
+ */
+export declare const TAG_READ_AFTER_INDEX = "tag_event_suid_idx";
+export declare const TAG_READ_AFTER_SQL = "\n  SELECT event_json\n  FROM tag_event INDEXED BY tag_event_suid_idx\n  WHERE suid > ?\n  ORDER BY suid ASC\n  LIMIT ?\n";
+/**
+ * SDT-G46's frozen-frontier form of the same G43 range index seam.  It is not
+ * a second source path: a caller supplies the immutable `through` that the
+ * first `g43TagStateIncrementalCatchUp` page obtained from `readHeadFacts`.
+ */
+export declare const TAG_READ_AFTER_THROUGH_SQL = "\n  SELECT event_json\n  FROM tag_event INDEXED BY tag_event_suid_idx\n  WHERE suid > ? AND suid <= ?\n  ORDER BY suid ASC\n  LIMIT ?\n";
+export declare function initializeTagSqlSchema(sql: SqlStorage): void;
+/** A SQL-backed tag object always exposes this capability at runtime. */
+export declare function hasTagSqlStorage(storage: DurableObjectStorage): storage is DurableObjectStorage & {
+    sql: SqlStorage;
+};

package/dist/tag/TagSqlSchema.js

@@ -0,0 +1,211 @@
+/**
+ * SDT-G43's tag-local authority is intentionally a normal SQLite schema, not
+ * a serialized application record hidden behind a KV key.  These statements
+ * are kept literal so schema review and `sqlite_master` introspection see the
+ * exact primary keys, uniqueness constraints, foreign keys, and indexes.
+ *
+ * Existing TAG_KEY records are deliberately not migrated.  This repository is
+ * still in development and the operator ruling for G43 is to reset those test
+ * records rather than introduce a mixed-format or rollback protocol.
+ */
+export const TAG_SQL_SCHEMA_DDL = `
+  PRAGMA foreign_keys = ON;
+
+  CREATE TABLE IF NOT EXISTS tag_identity (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    tag TEXT NOT NULL UNIQUE,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_control (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    schema_version INTEGER NOT NULL CHECK (schema_version = 3),
+    head_suid TEXT NOT NULL,
+    clock_offset_ms INTEGER NOT NULL,
+    clock_now_ms INTEGER,
+    version INTEGER NOT NULL,
+    repair_owner TEXT,
+    repair_lease_until INTEGER,
+    highest_repair_epoch INTEGER NOT NULL,
+    repair_scope_version INTEGER NOT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    FOREIGN KEY (singleton) REFERENCES tag_identity(singleton) ON DELETE RESTRICT
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_reservation (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    attempt_id TEXT NOT NULL,
+    epoch INTEGER NOT NULL,
+    reservation_token TEXT NOT NULL UNIQUE,
+    expected_head TEXT NOT NULL,
+    expires_at INTEGER NOT NULL,
+    alarm_due_at INTEGER NOT NULL,
+    FOREIGN KEY (singleton) REFERENCES tag_identity(singleton) ON DELETE RESTRICT
+  );
+  CREATE INDEX IF NOT EXISTS tag_reservation_due_idx ON tag_reservation(alarm_due_at);
+
+  CREATE TABLE IF NOT EXISTS tag_epoch (
+    attempt_id TEXT PRIMARY KEY,
+    highest_epoch INTEGER NOT NULL,
+    sealed_epoch INTEGER,
+    confirmation_epoch INTEGER
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_tombstone (
+    attempt_id TEXT PRIMARY KEY,
+    epoch INTEGER NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_event (
+    service_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    attempt_id TEXT NOT NULL,
+    suid TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    event_tags_json TEXT NOT NULL,
+    allocator_lineage_id TEXT NOT NULL,
+    event_type TEXT NOT NULL,
+    provenance TEXT NOT NULL CHECK (provenance = 'g32'),
+    timestamp TEXT NOT NULL,
+    event_json TEXT NOT NULL,
+    PRIMARY KEY (service_id, event_id),
+    UNIQUE (suid)
+  );
+  CREATE INDEX IF NOT EXISTS tag_event_suid_idx ON tag_event(suid);
+  CREATE INDEX IF NOT EXISTS tag_event_attempt_idx ON tag_event(attempt_id, event_id);
+
+  CREATE TABLE IF NOT EXISTS tag_head (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    service_id TEXT NOT NULL,
+    head_suid TEXT NOT NULL,
+    FOREIGN KEY (singleton) REFERENCES tag_identity(singleton) ON DELETE RESTRICT
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_committed_membership (
+    service_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    tag TEXT NOT NULL,
+    committed_at TEXT NOT NULL,
+    PRIMARY KEY (service_id, event_id, tag),
+    FOREIGN KEY (service_id, event_id)
+      REFERENCES tag_event(service_id, event_id) ON DELETE RESTRICT,
+    FOREIGN KEY (tag) REFERENCES tag_identity(tag) ON DELETE RESTRICT
+  );
+  CREATE INDEX IF NOT EXISTS tag_committed_membership_tag_idx
+    ON tag_committed_membership(tag, service_id, event_id);
+
+  CREATE TABLE IF NOT EXISTS tag_outbox_obligation (
+    obligation_sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+    service_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    attempt_id TEXT NOT NULL,
+    suid TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    allocator_lineage_id TEXT NOT NULL,
+    event_type TEXT NOT NULL,
+    provenance TEXT NOT NULL CHECK (provenance = 'g32'),
+    timestamp TEXT NOT NULL,
+    canonical_bytes BLOB NOT NULL,
+    event_digest TEXT NOT NULL,
+    declared_tag_set_json TEXT NOT NULL,
+    local_committed_membership_json TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('pending', 'acknowledged', 'poison')),
+    next_attempt_at INTEGER NOT NULL,
+    attempt_count INTEGER NOT NULL DEFAULT 0,
+    enqueued_at INTEGER,
+    acknowledged_at INTEGER,
+    last_error TEXT,
+    UNIQUE (service_id, event_id, attempt_id),
+    FOREIGN KEY (service_id, event_id)
+      REFERENCES tag_event(service_id, event_id) ON DELETE RESTRICT
+  );
+  CREATE INDEX IF NOT EXISTS tag_outbox_obligation_due_idx
+    ON tag_outbox_obligation(status, next_attempt_at, obligation_sequence);
+
+  CREATE TABLE IF NOT EXISTS tag_source_partition_registration (
+    service_id TEXT NOT NULL,
+    partition_tag TEXT NOT NULL,
+    last_obligation_sequence INTEGER NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('pending', 'registered')),
+    next_attempt_at INTEGER,
+    attempt_count INTEGER NOT NULL DEFAULT 0,
+    last_error TEXT,
+    PRIMARY KEY (service_id, partition_tag)
+  );
+  CREATE INDEX IF NOT EXISTS tag_source_partition_registration_due_idx
+    ON tag_source_partition_registration(status, next_attempt_at, service_id, partition_tag);
+
+  CREATE TABLE IF NOT EXISTS tag_commit_receipt (
+    attempt_id TEXT NOT NULL,
+    epoch INTEGER NOT NULL,
+    committed_at TEXT NOT NULL,
+    committed_event_count INTEGER NOT NULL,
+    head_suid TEXT NOT NULL,
+    reservation_confirmed INTEGER NOT NULL CHECK (reservation_confirmed IN (0, 1)),
+    PRIMARY KEY (attempt_id, epoch)
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_fence (
+    reason TEXT NOT NULL,
+    attempt_id TEXT NOT NULL,
+    epoch INTEGER NOT NULL,
+    PRIMARY KEY (reason, attempt_id)
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_cleared_fence (
+    reason TEXT NOT NULL,
+    attempt_id TEXT NOT NULL,
+    epoch INTEGER NOT NULL,
+    PRIMARY KEY (reason, attempt_id)
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_bootstrap_admission (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    import_id TEXT NOT NULL,
+    lease_epoch INTEGER NOT NULL,
+    manifest_digest TEXT NOT NULL,
+    target_service_id TEXT NOT NULL,
+    closed INTEGER NOT NULL CHECK (closed IN (0, 1)),
+    FOREIGN KEY (singleton) REFERENCES tag_identity(singleton) ON DELETE RESTRICT
+  );
+
+  CREATE TABLE IF NOT EXISTS tag_repair_scope (
+    attempt_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    item_json TEXT NOT NULL,
+    PRIMARY KEY (attempt_id, event_id)
+  );
+`;
+/**
+ * Packet-owned AC8 range seam. The query text and index identity are exported
+ * so the measurement checker can prove exactly what was explained and what
+ * returned rows were compared against; no "equivalent" plan is accepted.
+ */
+export const TAG_READ_AFTER_INDEX = "tag_event_suid_idx";
+export const TAG_READ_AFTER_SQL = `
+  SELECT event_json
+  FROM tag_event INDEXED BY tag_event_suid_idx
+  WHERE suid > ?
+  ORDER BY suid ASC
+  LIMIT ?
+`;
+/**
+ * SDT-G46's frozen-frontier form of the same G43 range index seam.  It is not
+ * a second source path: a caller supplies the immutable `through` that the
+ * first `g43TagStateIncrementalCatchUp` page obtained from `readHeadFacts`.
+ */
+export const TAG_READ_AFTER_THROUGH_SQL = `
+  SELECT event_json
+  FROM tag_event INDEXED BY tag_event_suid_idx
+  WHERE suid > ? AND suid <= ?
+  ORDER BY suid ASC
+  LIMIT ?
+`;
+export function initializeTagSqlSchema(sql) {
+    sql.exec(TAG_SQL_SCHEMA_DDL);
+}
+/** A SQL-backed tag object always exposes this capability at runtime. */
+export function hasTagSqlStorage(storage) {
+    return typeof storage.sql?.exec === "function";
+}

package/dist/tag/types.d.ts

@@ -0,0 +1,173 @@
+export declare const RESERVATION_WINDOW_MS = 30000;
+export declare const PARTIAL_WRITE_FENCE_REASON = "partial_write";
+export declare const SEGMENT_ROTATION_FENCE_REASON = "segment_rotation";
+export interface TagEpoch {
+    attemptId: string;
+    epoch: number;
+}
+/**
+ * §3.1 consistency-entry spelling. F-001 preserves `lastSortedUniqueId`
+ * only for the §5.3 tag-state response, not for this request entry.
+ */
+export interface TagConsistencyEntry {
+    tag: string;
+    lastSortableUniqueId: string | null;
+}
+export interface TagReservation {
+    attemptId: string;
+    epoch: number;
+    token: string;
+    expectedHead: string;
+    expiresAt: number;
+    alarmDueAt: number;
+}
+export interface TagEvent {
+    attemptId: string;
+    eventId: string;
+    suid: string;
+    payload: string;
+    eventTags: string[];
+    eventType: string;
+    provenance: "g32";
+    timestamp: string;
+    /** Internal allocator lineage belongs to the sidecar/outbox path. */
+    allocatorLineageId: string;
+}
+/**
+ * The single internal source-read request for TagStateDO. It is dispatched
+ * directly between Durable Objects through TagDurableObject's private
+ * adapter, never through the public Worker router. `through` is omitted only
+ * by the first page; the Tag DO then freezes it from scalar, identity-checked
+ * head facts.
+ */
+export interface G43TagStateIncrementalRequest {
+    readonly tag: string;
+    readonly cursor: string;
+    readonly limit: number;
+    readonly through?: string;
+}
+/** A bounded page from the sole TagState event-source seam. */
+export interface G43TagStateIncrementalPage {
+    readonly events: readonly TagEvent[];
+    readonly lastSortableUniqueId: string;
+    readonly through: string;
+    /** Non-null only when this cursor has consumed the frozen frontier. */
+    readonly completeThrough: string | null;
+}
+export interface TagOutboxRow {
+    attemptId: string;
+    eventId: string;
+    suid: string;
+    payload: string;
+    allocatorLineageId: string;
+    eventType: string;
+    provenance: "g32";
+    timestamp: string;
+}
+/**
+ * Separate from the immutable outbox row so an append remains a commit-path
+ * write only. A drain records its first queue-attempt clock fact and delivery
+ * acknowledgement here.
+ */
+export interface TagOutboxDelivery extends TagOutboxRow {
+    enqueuedAt: number;
+    deliveredAt: number | null;
+}
+export interface TagFence {
+    reason: string;
+    attemptId: string;
+    epoch: number;
+}
+/** Bootstrap is intentionally separate from V1 append/reservation state. */
+export interface TagBootstrapAdmission {
+    importId: string;
+    leaseEpoch: number;
+    manifestDigest: string;
+    targetServiceId: string;
+    closed: boolean;
+}
+/**
+ * SDT-G6 repair authority is deliberately held by the Tag DO rather than by
+ * a Journal observation.  A scope item is the exact candidate that a repair
+ * lease is permitted to touch.
+ */
+export interface RepairScopeItem {
+    attemptId: string;
+    eventId: string;
+    suid: string;
+    payload: string;
+    eventTags: string[];
+    allocatorLineageId: string;
+    eventType: string;
+    provenance: "g32";
+    timestamp: string;
+}
+export type RepairBranch = "ROLLED_FORWARD" | "EXCLUDED_AUDITED" | "FAILED_CLOSED";
+/** Durable fact written by the Tag DO after it has made a branch decision. */
+export interface RepairResolution {
+    attemptId: string;
+    eventId: string;
+    suid: string;
+    branch: RepairBranch;
+    epoch: number;
+    owner: string;
+    recordedAt: string;
+}
+/** An audit is intentionally separate from the original commit outcome. */
+export interface RepairAudit {
+    attemptId: string;
+    eventId: string;
+    suid: string;
+    branch: Exclude<RepairBranch, "FAILED_CLOSED">;
+    actor: string;
+    epoch: number;
+    owner: string;
+    recordedAt: string;
+}
+export interface RepairFacts {
+    resolutions: RepairResolution[];
+    audits: RepairAudit[];
+}
+/**
+ * The per-tag durable authority. Its `head` is read from SQLite inside every
+ * consistency comparison; there is no in-memory cache of the head.
+ */
+export interface TagRecord {
+    /** G32 is a fresh namespace; earlier durable Tag record shapes are rejected. */
+    schemaVersion: 3;
+    tag: string;
+    head: string;
+    activeReservation: TagReservation | null;
+    alarmDueAt: number | null;
+    events: TagEvent[];
+    outbox: TagOutboxRow[];
+    highestEpoch: TagEpoch[];
+    sealedEpoch: TagEpoch[];
+    tombstones: TagEpoch[];
+    confirmations: TagEpoch[];
+    fences: TagFence[];
+    clearedFences: TagFence[];
+    bootstrapAdmission: TagBootstrapAdmission | null;
+    /** SDT-G6 repair fencing-token lease. */
+    repairOwner: string | null;
+    repairLeaseUntil: number | null;
+    highestRepairEpoch: number;
+    /** Durable, set-based authorization scope for the currently held lease. */
+    repairScope: RepairScopeItem[];
+    repairScopeVersion: number;
+    clockOffsetMs: number;
+    clockNowMs: number | null;
+    version: number;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * The immutable scalar facts needed by the commit response.  This is
+ * intentionally distinct from TagRecord: a caller that only needs the head
+ * must not hydrate or validate the tag's event history to obtain it.
+ */
+export interface TagHeadFacts {
+    head: string;
+    version: number;
+    updatedAt: string;
+}

package/dist/tag/types.js

@@ -0,0 +1,3 @@
+export const RESERVATION_WINDOW_MS = 30_000;
+export const PARTIAL_WRITE_FENCE_REASON = "partial_write";
+export const SEGMENT_ROTATION_FENCE_REASON = "segment_rotation";

package/dist/tagstate/TagStateDurableObject.d.ts

@@ -0,0 +1,57 @@
+import { type ProjectorRegistry } from "../projection/ProjectorRegistry";
+/** The fixed bounded source page used by both normal delta and replay. */
+export declare const TAG_STATE_SOURCE_PAGE_LIMIT = 64;
+export declare function configureTagStateProjectorRegistry(registry: ProjectorRegistry | undefined): void;
+export interface TagStateObjectIdentity {
+    readonly serviceId: string;
+    readonly tag: string;
+    readonly projectorId: string;
+}
+export interface TagStateReadSuccess {
+    readonly kind: "ready";
+    readonly payload: string;
+    readonly version: number;
+    readonly lastSortedUniqueId: string;
+    readonly projectorVersion: string;
+}
+interface TagStateDurableObjectEnv {
+    readonly TAG: DurableObjectNamespace;
+}
+/**
+ * TagState cache and resumable replay owner.  The only event source is the
+ * existing G43 Tag RPC; this object deliberately has neither a full-record
+ * fetch route nor a second source-query implementation.
+ */
+export declare class TagStateDurableObject implements DurableObject {
+    private readonly ctx;
+    private readonly env;
+    private g46CheckpointFault;
+    private g46SourceNamespace;
+    /**
+     * Installed by the entrypoint when it composes the deployed domain.  There
+     * is deliberately no default/test-registry fallback here: a DO isolate
+     * which was not built from that composition must return the typed registry
+     * failure rather than fold with a different projector authority.
+     */
+    private readonly registry;
+    constructor(ctx: DurableObjectState, env: TagStateDurableObjectEnv, registry?: ProjectorRegistry);
+    /** Test-only fault seam for the two durable checkpoint boundaries. */
+    setG46CheckpointFaultForTest(fault: "before-checkpoint" | "after-checkpoint" | undefined): void;
+    /** Test-only source seam; production always resolves `env.TAG`. */
+    setG46SourceNamespaceForTest(namespace: DurableObjectNamespace | undefined): void;
+    fetch(request: Request): Promise<Response>;
+    private read;
+    private beginDeltaOrRespondReady;
+    private continueRebuild;
+    private foldAndCheckpoint;
+    private success;
+    private readSource;
+    private assertSourcePage;
+    private resolveProjector;
+    private ensureIdentity;
+    private readCache;
+    private beginRebuild;
+    private sql;
+    private transaction;
+}
+export {};