@sekiban/dcb-runtime 0.2.0

package/dist/bootstrap/BootstrapCoordinatorDurableObject.js

@@ -0,0 +1,357 @@
+import { parseBootstrapDump } from "./manifest";
+import { scopeIdFor } from "../scope/ScopeName";
+import { DurableObjectActivation, enterNativeActorHandleSpan, noOpNativeTracing, } from "../trace/CommitTrace";
+import { beginDurableObjectHandlerObservation } from "../trace/ObservationStream";
+const CONTROL = "bootstrap-control";
+const DUMP = "bootstrap-dump";
+const MAX_CHUNK_EVENTS = 128;
+const MAX_CHUNK_BYTES = 192 * 1024;
+const MAX_RELEASED_COMMANDS = 512;
+const object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const string = (value) => typeof value === "string" && value.length > 0;
+const epoch = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+const response = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8" } });
+const reject = (code, message, status = 409) => response({ code, error: message }, status);
+function empty(serviceId) {
+    return { schemaVersion: 1, status: "EMPTY", importId: null, targetServiceId: serviceId, allocatorLineageId: null, source: null, digest: null, manifest: null, progress: {}, leaseEpoch: 0, leaseUntil: null, failure: null, readyAt: null, normalInFlight: 0, normalCommands: {}, releasedCommands: {}, verifiedImportId: null, verifiedLeaseEpoch: null, storeCompletion: null };
+}
+function expired(control) { return control.leaseUntil !== null && control.leaseUntil <= Date.now(); }
+function commands(control) { return { ...(control.normalCommands ?? {}) }; }
+function released(control) { return { ...(control.releasedCommands ?? {}) }; }
+function fault(body, point) { return object(body) && body.faultAt === point; }
+function encodedBytes(value) { return new TextEncoder().encode(JSON.stringify(value)).byteLength; }
+/** Per-service authority and linearization point for bootstrap and normal writes. */
+export class BootstrapCoordinatorDurableObject {
+    ctx;
+    env;
+    nativeTracing;
+    /** Constructor-scoped observation only; never persisted or used for control. */
+    activation = new DurableObjectActivation();
+    constructor(ctx, env, nativeTracing = noOpNativeTracing) {
+        this.ctx = ctx;
+        this.env = env;
+        this.nativeTracing = nativeTracing;
+    }
+    async fetch(request) {
+        // Flip before this handler performs its first await.
+        const activation = this.activation.beginHandler();
+        const observation = beginDurableObjectHandlerObservation("BOOTSTRAP", activation);
+        const url = new URL(request.url);
+        const serviceId = url.searchParams.get("__serviceId");
+        if (!string(serviceId))
+            return reject("bootstrap_service_required", "target service identity is required", 400);
+        if (request.method === "GET" && url.pathname === "/state")
+            return response(await this.control(serviceId));
+        if (request.method === "POST" && url.pathname === "/command/admit")
+            return this.traceCommand(request, serviceId, activation, observation, "admit");
+        if (request.method === "POST" && url.pathname === "/command/finalize")
+            return this.traceCommand(request, serviceId, activation, observation, "finalize");
+        if (request.method === "POST" && url.pathname === "/command/release")
+            return this.traceCommand(request, serviceId, activation, observation, "release");
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return reject("bootstrap_body_invalid", "JSON body is required", 400);
+        }
+        if (request.method !== "POST")
+            return reject("bootstrap_route_not_found", "bootstrap route was not found", 404);
+        if (url.pathname === "/plan")
+            return this.plan(serviceId, body);
+        if (url.pathname === "/import")
+            return this.import(serviceId, body);
+        if (url.pathname === "/verify")
+            return this.verify(serviceId, body);
+        if (url.pathname === "/ready")
+            return this.ready(serviceId, body);
+        if (url.pathname === "/abort")
+            return this.abort(serviceId, body);
+        if (url.pathname === "/route/check")
+            return this.route(serviceId, body);
+        return reject("bootstrap_route_not_found", "bootstrap route was not found", 404);
+    }
+    async traceCommand(request, serviceId, activation, observation, action) {
+        // Identity attribution and command execution must share one consumed
+        // request body. A tracing-only clone can remain readable after a DO
+        // response has completed when several workerd isolates are active.
+        let body;
+        return enterNativeActorHandleSpan(this.nativeTracing, { actorClass: "BOOTSTRAP", actorKey: `bootstrap:${serviceId}`, activation, observation }, async () => {
+            try {
+                body = await request.json();
+            }
+            catch {
+                return undefined;
+            }
+            const commandId = object(body) && string(body.commandId) ? body.commandId : undefined;
+            return commandId === undefined ? undefined : { attemptId: commandId, serviceId };
+        }, async () => body === undefined
+            ? reject("bootstrap_body_invalid", "JSON body is required", 400)
+            : this.command(serviceId, body, action, observation));
+    }
+    async control(serviceId) { return (await this.ctx.storage.get(CONTROL)) ?? empty(serviceId); }
+    valid(control, body) {
+        if (!object(body) || !string(body.importId) || !epoch(body.leaseEpoch))
+            return "bootstrap importId and leaseEpoch are required";
+        if (control.importId !== body.importId || control.leaseEpoch !== body.leaseEpoch)
+            return "bootstrap fencing epoch does not match";
+        return undefined;
+    }
+    async plan(serviceId, body) {
+        if (!object(body) || !string(body.importId) || !object(body.dump) || !object(body.targetEvidence) || typeof body.targetEvidence.bindingExists !== "boolean" || typeof body.targetEvidence.eventsExist !== "boolean")
+            return reject("bootstrap_plan_invalid", "importId, dump, and explicit target evidence are required", 400);
+        const importId = body.importId;
+        let dump;
+        try {
+            dump = parseBootstrapDump(body.dump);
+        }
+        catch (failure) {
+            const e = failure;
+            return reject(e.code ?? "bootstrap_dump_invalid", e.message ?? "invalid dump", 400);
+        }
+        if (dump.manifest.target.serviceId !== serviceId)
+            return reject("bootstrap_target_mismatch", "manifest target is not this coordinator service");
+        if (body.targetEvidence.bindingExists || body.targetEvidence.eventsExist)
+            return reject("bootstrap_target_not_fresh", "existing binding or events forbid bootstrap without writes");
+        const planned = await this.ctx.storage.transaction(async (txn) => {
+            const control = (await txn.get(CONTROL)) ?? empty(serviceId);
+            if (control.status === "READY")
+                return { error: "bootstrap_ready_permanent" };
+            if (control.status !== "EMPTY")
+                return control.importId === importId && control.digest === dump.manifest.contentDigest ? { control } : { error: "bootstrap_plan_conflict" };
+            if (control.normalInFlight !== 0 || Object.keys(commands(control)).length !== 0)
+                return { error: "bootstrap_normal_command_in_flight" };
+            const next = { ...control, status: "PLANNED", importId, allocatorLineageId: dump.manifest.target.allocatorLineageId, source: dump.manifest.source, digest: dump.manifest.contentDigest, manifest: dump.manifest, leaseEpoch: control.leaseEpoch + 1, leaseUntil: Date.now() + 30_000, failure: null, progress: {}, verifiedImportId: null, verifiedLeaseEpoch: null, storeCompletion: null };
+            await txn.put(CONTROL, next);
+            await txn.put(DUMP, dump);
+            return { control: next };
+        });
+        if (fault(body, "mode-record") && !("error" in planned))
+            return reject("bootstrap_simulated_crash", "simulated crash after mode record", 503);
+        return "error" in planned ? reject(planned.error ?? "bootstrap_plan_rejected", planned.error ?? "bootstrap plan rejected") : response(planned.control, planned.control.status === "PLANNED" ? 201 : 200);
+    }
+    chunks(events) {
+        const chunks = [];
+        let current = [];
+        let bytes = 0;
+        for (const event of events) {
+            const eventBytes = encodedBytes(event);
+            if (eventBytes > MAX_CHUNK_BYTES)
+                throw new Error("bootstrap event exceeds encoded chunk bound");
+            if (current.length === MAX_CHUNK_EVENTS || bytes + eventBytes > MAX_CHUNK_BYTES) {
+                chunks.push(current);
+                current = [];
+                bytes = 0;
+            }
+            current.push(event);
+            bytes += eventBytes;
+        }
+        if (current.length > 0)
+            chunks.push(current);
+        return chunks;
+    }
+    async import(serviceId, body) {
+        const control = await this.control(serviceId);
+        const invalid = this.valid(control, body);
+        if (invalid !== undefined)
+            return reject("bootstrap_epoch_rejected", invalid);
+        if (control.status !== "PLANNED" && control.status !== "IMPORTING" && control.status !== "FAILED")
+            return reject("bootstrap_state_rejected", "import is not permitted in this state");
+        if (expired(control))
+            return reject("bootstrap_lease_expired", "only a same-plan takeover may continue an expired lease");
+        const dump = await this.ctx.storage.get(DUMP);
+        if (dump === undefined || control.manifest === null)
+            return reject("bootstrap_plan_missing", "planned dump is unavailable", 500);
+        const byTag = new Map();
+        for (const event of dump.events)
+            for (const tag of event.eventTags)
+                byTag.set(tag, [...(byTag.get(tag) ?? []), event]);
+        await this.ctx.storage.transaction(async (txn) => { const current = (await txn.get(CONTROL)) ?? empty(serviceId); if (current.importId !== control.importId || current.leaseEpoch !== control.leaseEpoch)
+            throw new Error("bootstrap epoch advanced"); await txn.put(CONTROL, { ...current, status: "IMPORTING" }); });
+        // Sequential tags give strict same-tag ordering and bounded cross-tag concurrency (one).
+        for (const [tag, events] of [...byTag.entries()].sort(([left], [right]) => left.localeCompare(right))) {
+            for (const chunk of this.chunks(events)) {
+                const stub = this.env.TAG.get(scopeIdFor(this.env.TAG, { serviceId, doClass: "tag", identity: tag }));
+                const tagUrl = new URL("https://bootstrap.internal/bootstrap/admit");
+                tagUrl.searchParams.set("__tag", tag);
+                tagUrl.searchParams.set("__serviceId", serviceId);
+                // Bootstrap dumps model C# provenance as an object, while Tag's
+                // durable internal envelope uses the fixed G32 discriminator.  This
+                // is a representation boundary, not a legacy fallback.
+                const candidates = chunk.map((event) => {
+                    if (event.provenance.origin !== "g32")
+                        throw new Error("bootstrap dump provenance is not G32");
+                    return {
+                        eventId: event.eventId,
+                        suid: event.suid,
+                        payload: event.payload,
+                        eventTags: event.eventTags,
+                        eventType: event.eventType,
+                        timestamp: event.timestamp,
+                        causationId: event.causationId,
+                        correlationId: event.correlationId,
+                        executedUser: event.executedUser,
+                        provenance: "g32",
+                        allocatorLineageId: control.allocatorLineageId,
+                    };
+                });
+                const admitted = await stub.fetch(new Request(tagUrl, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ importId: control.importId, leaseEpoch: control.leaseEpoch, manifestDigest: control.digest, targetServiceId: serviceId, candidates }) }));
+                if (!admitted.ok)
+                    return reject("bootstrap_tag_admission_failed", `tag ${tag} rejected bootstrap admission`, admitted.status);
+                if (fault(body, "tag-chunk"))
+                    return reject("bootstrap_simulated_crash", "simulated crash after tag chunk", 503);
+                await this.ctx.storage.transaction(async (txn) => { const current = (await txn.get(CONTROL)) ?? empty(serviceId); if (current.importId !== control.importId || current.leaseEpoch !== control.leaseEpoch)
+                    throw new Error("bootstrap epoch advanced"); await txn.put(CONTROL, { ...current, progress: { ...current.progress, [tag]: chunk.at(-1).suid } }); });
+                if (fault(body, "store-progress-gap"))
+                    return reject("bootstrap_simulated_crash", "simulated crash after durable tag write", 503);
+            }
+        }
+        // Seed the exact allocator used by normal commits for this service. Its
+        // durable lineage is the target store binding.
+        // An empty, fresh G32 dump has no predecessor watermark.  Do not invent
+        // an old `suid-` sentinel: the first normal allocation must establish the
+        // new 30-digit domain itself.  A non-empty dump is seeded exactly once.
+        if (control.manifest.highWatermark !== null) {
+            const allocator = this.env.ALLOCATOR.get(scopeIdFor(this.env.ALLOCATOR, { serviceId, doClass: "allocator", identity: "allocator" }));
+            const seeded = await allocator.fetch(new Request("https://bootstrap.internal/seed-after", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ importId: control.importId, leaseEpoch: control.leaseEpoch, highWatermark: control.manifest.highWatermark }) }));
+            if (!seeded.ok)
+                return reject("bootstrap_allocator_seed_failed", "allocator seedAfter rejected bootstrap", seeded.status);
+        }
+        if (fault(body, "allocator-seed"))
+            return reject("bootstrap_simulated_crash", "simulated crash after allocator seed", 503);
+        const next = await this.ctx.storage.transaction(async (txn) => { const current = (await txn.get(CONTROL)) ?? empty(serviceId); if (current.importId !== control.importId || current.leaseEpoch !== control.leaseEpoch)
+            throw new Error("bootstrap epoch advanced"); const updated = { ...current, status: "VERIFYING" }; await txn.put(CONTROL, updated); return updated; });
+        return response(next);
+    }
+    async verify(serviceId, body) {
+        const control = await this.control(serviceId);
+        const invalid = this.valid(control, body);
+        if (invalid !== undefined)
+            return reject("bootstrap_epoch_rejected", invalid);
+        if (control.status !== "VERIFYING" || control.manifest === null)
+            return reject("bootstrap_state_rejected", "verify requires VERIFYING");
+        const dump = await this.ctx.storage.get(DUMP);
+        if (dump === undefined)
+            return reject("bootstrap_plan_missing", "planned dump is unavailable", 500);
+        const expectedByTag = new Map();
+        for (const event of dump.events)
+            for (const tag of event.eventTags)
+                expectedByTag.set(tag, [...(expectedByTag.get(tag) ?? []), event]);
+        for (const [tag, expected] of expectedByTag) {
+            const url = new URL("https://bootstrap.internal/state");
+            url.searchParams.set("__tag", tag);
+            const actual = await this.env.TAG.get(scopeIdFor(this.env.TAG, { serviceId, doClass: "tag", identity: tag })).fetch(new Request(url));
+            if (!actual.ok)
+                return reject("bootstrap_verify_tag_missing", `tag ${tag} is missing`, actual.status);
+            const state = await actual.json();
+            const actualEvents = Array.isArray(state.events) ? state.events : [];
+            const expectedHead = expected.at(-1)?.suid ?? null;
+            if (state.head !== expectedHead || actualEvents.length !== expected.length || actualEvents.some((value, index) => {
+                const event = value;
+                const source = expected[index];
+                return event.eventId !== source.eventId ||
+                    event.suid !== source.suid ||
+                    event.payload !== source.payload ||
+                    event.eventType !== source.eventType ||
+                    event.provenance !== "g32" ||
+                    source.provenance.origin !== "g32" ||
+                    JSON.stringify(event.eventTags) !== JSON.stringify(source.eventTags);
+            }))
+                return reject("bootstrap_verify_tag_mismatch", `tag ${tag} does not match manifest`);
+        }
+        // Permitted core completion branch: immutable pre-populated manifest snapshot.
+        const ids = new Set(dump.events.map((event) => event.eventId));
+        if (ids.size !== dump.events.length || dump.events.length !== control.manifest.eventCount)
+            return reject("bootstrap_verify_store_mismatch", "prepopulated store snapshot does not match manifest");
+        if (fault(body, "verifying"))
+            return reject("bootstrap_simulated_crash", "simulated crash during verification", 503);
+        const verified = await this.ctx.storage.transaction(async (txn) => { const current = (await txn.get(CONTROL)) ?? empty(serviceId); if (current.status !== "VERIFYING" || current.importId !== control.importId || current.leaseEpoch !== control.leaseEpoch)
+            throw new Error("bootstrap verification CAS failed"); const updated = { ...current, verifiedImportId: control.importId, verifiedLeaseEpoch: control.leaseEpoch, storeCompletion: "prepopulated-manifest" }; await txn.put(CONTROL, updated); return updated; });
+        return response(verified);
+    }
+    async ready(serviceId, body) {
+        const control = await this.control(serviceId);
+        const invalid = this.valid(control, body);
+        if (invalid !== undefined)
+            return reject("bootstrap_epoch_rejected", invalid);
+        if (control.status !== "VERIFYING" || control.verifiedImportId !== control.importId || control.verifiedLeaseEpoch !== control.leaseEpoch || control.storeCompletion === null)
+            return reject("bootstrap_verification_required", "READY requires same importId and epoch verification");
+        for (const tag of Object.keys(control.manifest.tagCounts)) {
+            const stub = this.env.TAG.get(scopeIdFor(this.env.TAG, { serviceId, doClass: "tag", identity: tag }));
+            const url = new URL("https://bootstrap.internal/bootstrap/close");
+            url.searchParams.set("__tag", tag);
+            const closed = await stub.fetch(new Request(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ importId: control.importId, leaseEpoch: control.leaseEpoch }) }));
+            if (!closed.ok)
+                return reject("bootstrap_tag_close_failed", `tag ${tag} refused READY close`, closed.status);
+        }
+        if (fault(body, "ready-cas"))
+            return reject("bootstrap_simulated_crash", "simulated crash before READY CAS", 503);
+        const ready = await this.ctx.storage.transaction(async (txn) => { const current = (await txn.get(CONTROL)) ?? empty(serviceId); if (current.status === "READY")
+            return current; if (current.status !== "VERIFYING" || current.leaseEpoch !== control.leaseEpoch || current.verifiedImportId !== current.importId || current.verifiedLeaseEpoch !== current.leaseEpoch)
+            throw new Error("bootstrap READY CAS failed"); const updated = { ...current, status: "READY", leaseUntil: null, readyAt: new Date().toISOString() }; await txn.put(CONTROL, updated); return updated; });
+        return response(ready);
+    }
+    /** Operator abort retains the durable failed plan for audit/retry; it never clears target state. */
+    async abort(serviceId, body) {
+        const control = await this.control(serviceId);
+        const invalid = this.valid(control, body);
+        if (invalid !== undefined)
+            return reject("bootstrap_epoch_rejected", invalid);
+        if (control.status === "EMPTY" || control.status === "READY")
+            return reject("bootstrap_state_rejected", "abort requires an active bootstrap");
+        const aborted = await this.ctx.storage.transaction(async (txn) => {
+            const current = (await txn.get(CONTROL)) ?? empty(serviceId);
+            if (current.importId !== control.importId || current.leaseEpoch !== control.leaseEpoch)
+                throw new Error("bootstrap abort CAS failed");
+            const next = { ...current, status: "FAILED", failure: "operator_abort", leaseUntil: null };
+            await txn.put(CONTROL, next);
+            return next;
+        });
+        return response(aborted);
+    }
+    async route(serviceId, body) {
+        if (!object(body) || !string(body.route))
+            return reject("bootstrap_route_invalid", "route is required", 400);
+        const control = await this.control(serviceId);
+        return control.status === "EMPTY" || control.status === "READY" ? response({ admitted: true, leaseEpoch: control.leaseEpoch, route: body.route }) : reject("bootstrap_route_rejected", `${body.route} is unavailable during bootstrap`);
+    }
+    async command(serviceId, body, action, observation) {
+        if (!object(body) || !string(body.commandId))
+            return reject("bootstrap_command_invalid", "commandId is required", 400);
+        const commandId = body.commandId;
+        observation?.markFirstStorageRead();
+        const result = await this.ctx.storage.transaction(async (txn) => {
+            const control = (await txn.get(CONTROL)) ?? empty(serviceId);
+            const current = commands(control);
+            const completed = released(control);
+            if (action === "admit") {
+                if (control.status !== "EMPTY" && control.status !== "READY")
+                    return { rejected: true };
+                if (current[commandId] !== undefined)
+                    return { control };
+                current[commandId] = control.leaseEpoch;
+                const updated = { ...control, normalInFlight: Object.keys(current).length, normalCommands: current };
+                await txn.put(CONTROL, updated);
+                return { control: updated };
+            }
+            const expectedEpoch = body.leaseEpoch;
+            // Release is cleanup only and may be retried after a lost response; it
+            // may never authorize a mutation. Finalize retains the strict epoch CAS.
+            if (action === "release") {
+                if (current[commandId] === undefined || (expectedEpoch !== undefined && (!epoch(expectedEpoch) || current[commandId] !== expectedEpoch)))
+                    return { rejected: true };
+                completed[commandId] = current[commandId];
+                delete current[commandId];
+                for (const stale of Object.keys(completed).slice(0, Math.max(0, Object.keys(completed).length - MAX_RELEASED_COMMANDS)))
+                    delete completed[stale];
+                const updated = { ...control, normalInFlight: Object.keys(current).length, normalCommands: current, releasedCommands: completed };
+                await txn.put(CONTROL, updated);
+                return { control: updated };
+            }
+            if (!epoch(expectedEpoch) || (current[commandId] !== expectedEpoch && completed[commandId] !== expectedEpoch) || control.leaseEpoch !== expectedEpoch || (control.status !== "EMPTY" && control.status !== "READY"))
+                return { rejected: true };
+            return { control };
+        });
+        return "rejected" in result ? reject("bootstrap_command_rejected", "bootstrap epoch rejects normal durable mutation") : response({ leaseEpoch: result.control.leaseEpoch, admitted: true });
+    }
+}

package/dist/bootstrap/BootstrapStoreAdapter.d.ts

@@ -0,0 +1,51 @@
+import type { BootstrapDump, BootstrapEventRecord, BootstrapManifest, BootstrapStoreAdmissionPort } from "./types";
+import type { PipelineStore, StoredEvent } from "../store/types";
+export interface BootstrapExportCursor {
+    readonly highWatermark: string | null;
+    readonly nextEventId: string | null;
+}
+export interface BootstrapExportPage {
+    readonly dump: BootstrapDump;
+    readonly page: readonly BootstrapEventRecord[];
+    readonly cursor: BootstrapExportCursor;
+    readonly complete: boolean;
+}
+export declare class BootstrapIdentityConflictError extends Error {
+    readonly provider: string;
+    readonly eventId: string;
+    readonly code: "BOOTSTRAP_EVENT_IDENTITY_CONFLICT";
+    constructor(provider: string, eventId: string);
+}
+export declare function bootstrapEventIdentityMatches(event: StoredEvent, record: BootstrapEventRecord): boolean;
+export type BootstrapIdentityGuard = (event: StoredEvent, record: BootstrapEventRecord) => boolean;
+/**
+ * Provider-neutral operator adapter.  A snapshot is anchored at the first
+ * observed high watermark; later pages always re-apply that predicate, so an
+ * append after a crash/resume cannot enter the export.
+ */
+export declare class BootstrapStoreAdapter implements BootstrapStoreAdmissionPort {
+    readonly provider: string;
+    private readonly store;
+    private readonly identityGuard;
+    constructor(provider: string, store: PipelineStore, identityGuard?: BootstrapIdentityGuard);
+    exportPage(input: {
+        readonly sourceServiceId: string;
+        /** Source lineage is explicit; G32 never labels a source as legacy. */
+        readonly sourceAllocatorLineageId: string;
+        readonly targetServiceId: string;
+        readonly allocatorLineageId: string;
+        readonly pageSize: number;
+        readonly cursor?: BootstrapExportCursor;
+    }): Promise<BootstrapExportPage>;
+    admitBootstrap(input: {
+        readonly importId: string;
+        readonly leaseEpoch: number;
+        readonly manifest: BootstrapManifest;
+        readonly events: readonly BootstrapEventRecord[];
+    }): Promise<void>;
+    verifyBootstrap(input: {
+        readonly importId: string;
+        readonly manifest: BootstrapManifest;
+    }): Promise<void>;
+}
+export declare function createBootstrapStoreAdapter(provider: string, store: PipelineStore, identityGuard?: BootstrapIdentityGuard): BootstrapStoreAdapter;

package/dist/bootstrap/BootstrapStoreAdapter.js

@@ -0,0 +1,162 @@
+import { bootstrapDigest } from "./manifest";
+import { canonicalDeclaredTagSet, eventDigestBytes, eventDigestHex } from "../tag/EventDigest";
+function arrayBufferBase64(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+export class BootstrapIdentityConflictError extends Error {
+    provider;
+    eventId;
+    code = "BOOTSTRAP_EVENT_IDENTITY_CONFLICT";
+    constructor(provider, eventId) {
+        super(`${provider} bootstrap EventId ${eventId} conflicts with the target identity`);
+        this.provider = provider;
+        this.eventId = eventId;
+        this.name = "BootstrapIdentityConflictError";
+    }
+}
+function compareOpaque(left, right) {
+    const a = new TextEncoder().encode(left);
+    const b = new TextEncoder().encode(right);
+    for (let index = 0; index < Math.min(a.length, b.length); index += 1)
+        if (a[index] !== b[index])
+            return a[index] - b[index];
+    return a.length - b.length;
+}
+export function bootstrapEventIdentityMatches(event, record) {
+    return event.suid === record.suid &&
+        event.payload === record.payload &&
+        event.eventType === record.eventType &&
+        event.timestamp === record.timestamp &&
+        event.causationId === record.causationId &&
+        event.correlationId === record.correlationId &&
+        event.executedUser === record.executedUser &&
+        JSON.stringify(event.eventTags) === JSON.stringify(record.eventTags);
+}
+function toRecord(event) {
+    return {
+        eventId: event.eventId,
+        suid: event.suid,
+        payload: event.payload,
+        eventTags: [...event.eventTags],
+        eventType: event.eventType,
+        provenance: { origin: "g32" },
+        timestamp: event.timestamp,
+        causationId: event.causationId,
+        correlationId: event.correlationId,
+        executedUser: event.executedUser,
+    };
+}
+/**
+ * Provider-neutral operator adapter.  A snapshot is anchored at the first
+ * observed high watermark; later pages always re-apply that predicate, so an
+ * append after a crash/resume cannot enter the export.
+ */
+export class BootstrapStoreAdapter {
+    provider;
+    store;
+    identityGuard;
+    constructor(provider, store, identityGuard = bootstrapEventIdentityMatches) {
+        this.provider = provider;
+        this.store = store;
+        this.identityGuard = identityGuard;
+    }
+    async exportPage(input) {
+        if (!Number.isSafeInteger(input.pageSize) || input.pageSize <= 0)
+            throw new Error("bootstrap export pageSize must be positive");
+        await this.store.initialize();
+        const observed = await this.store.readAllEvents(input.sourceServiceId, "");
+        const highWatermark = input.cursor?.highWatermark ?? observed.at(-1)?.suid ?? null;
+        // This predicate is the snapshot boundary. Do not replace it with a cursor-only page query.
+        const snapshot = observed.filter((event) => highWatermark === null || compareOpaque(event.suid, highWatermark) <= 0).map(toRecord);
+        const start = input.cursor?.nextEventId === null || input.cursor?.nextEventId === undefined ? 0 : snapshot.findIndex((event) => event.eventId === input.cursor.nextEventId) + 1;
+        const page = snapshot.slice(Math.max(0, start), Math.max(0, start) + input.pageSize);
+        const tagCounts = {};
+        for (const event of snapshot)
+            for (const tag of event.eventTags)
+                tagCounts[tag] = (tagCounts[tag] ?? 0) + 1;
+        const draft = {
+            format: "sekiban-dcb-bootstrap", version: 1,
+            source: { serviceId: input.sourceServiceId, lineageId: input.sourceAllocatorLineageId },
+            target: { serviceId: input.targetServiceId, allocatorLineageId: input.allocatorLineageId },
+            highWatermark, eventCount: snapshot.length, tagCounts,
+            canonicalization: "utf8-json-sorted-keys-v1",
+        };
+        const fullDump = { manifest: { ...draft, contentDigest: "" }, events: snapshot };
+        const manifest = { ...draft, contentDigest: bootstrapDigest(fullDump) };
+        const pageEnd = Math.max(0, start) + page.length;
+        return {
+            dump: { manifest, events: snapshot }, page,
+            cursor: { highWatermark, nextEventId: pageEnd >= snapshot.length ? null : snapshot[pageEnd - 1].eventId },
+            complete: pageEnd >= snapshot.length,
+        };
+    }
+    async admitBootstrap(input) {
+        await this.store.initialize();
+        const existing = new Map((await this.store.readAllEvents(input.manifest.target.serviceId, "")).map((event) => [event.eventId, event]));
+        for (const record of input.events) {
+            const prior = existing.get(record.eventId);
+            // The provider-level identity guard deliberately fires before any write.
+            if (prior !== undefined && !this.identityGuard(prior, record))
+                throw new BootstrapIdentityConflictError(this.provider, record.eventId);
+            for (const tag of record.eventTags) {
+                const attemptId = `bootstrap:${input.importId}:${input.leaseEpoch}`;
+                const digestInput = {
+                    serviceId: input.manifest.target.serviceId,
+                    eventId: record.eventId,
+                    sortableUniqueId: record.suid,
+                    eventType: record.eventType,
+                    timestamp: record.timestamp,
+                    allocatorLineageId: input.manifest.target.allocatorLineageId,
+                    attemptId,
+                    declaredTagSet: canonicalDeclaredTagSet(record.eventTags),
+                    payload: new TextEncoder().encode(record.payload),
+                };
+                const delivered = await this.store.recordDelivery({
+                    version: 1,
+                    serviceId: input.manifest.target.serviceId,
+                    allocatorLineageId: input.manifest.target.allocatorLineageId,
+                    tag,
+                    attemptId,
+                    eventId: record.eventId,
+                    suid: record.suid,
+                    payload: record.payload,
+                    eventTags: [...record.eventTags],
+                    eventType: record.eventType,
+                    provenance: "g32",
+                    timestamp: record.timestamp,
+                    causationId: record.causationId,
+                    correlationId: record.correlationId,
+                    executedUser: record.executedUser,
+                    enqueuedAt: 0,
+                    completeness: {
+                        canonicalBytesBase64: arrayBufferBase64(eventDigestBytes(digestInput)),
+                        eventDigest: await eventDigestHex(digestInput),
+                        declaredTagSet: [...digestInput.declaredTagSet],
+                        localCommittedMembership: [{ serviceId: input.manifest.target.serviceId, eventId: record.eventId, tag }],
+                        // Bootstrap is not a source outbox replay path. The deterministic
+                        // per-event/tag ordinal is only enough to satisfy the D1 receipt
+                        // key while G44's source scanner remains explicitly out of scope.
+                        obligationSequence: Math.max(1, [...new TextEncoder().encode(`${record.eventId}|${tag}`)].reduce((total, byte) => (total * 33 + byte) % 1_000_000_000, 5381)),
+                    },
+                    // A C# import may contain a historical RFC 4122 Id. It bypasses
+                    // Queue/doorbell and is admitted only through this fenced path;
+                    // normal deliveries still require UUID v7.
+                }, 0, "import");
+                if (delivered.outcome !== "stored")
+                    throw new Error(`${this.provider} bootstrap admission rejected ${record.eventId}`);
+            }
+        }
+    }
+    async verifyBootstrap(input) {
+        await this.store.initialize();
+        const actual = await this.store.readAllEvents(input.manifest.target.serviceId, "");
+        if (actual.length !== input.manifest.eventCount)
+            throw new Error(`${this.provider} bootstrap store count differs for ${input.importId}`);
+    }
+}
+export function createBootstrapStoreAdapter(provider, store, identityGuard) {
+    return new BootstrapStoreAdapter(provider, store, identityGuard);
+}

package/dist/bootstrap/OperatorBootstrap.d.ts

@@ -0,0 +1,20 @@
+import type { BootstrapManifest } from "./types";
+import type { StoreProvider, StoreProviderEnvironment } from "../store/provider";
+export interface OperatorBootstrapEnv extends StoreProviderEnvironment {
+    readonly BOOTSTRAP: DurableObjectNamespace;
+    readonly ALLOCATOR: DurableObjectNamespace;
+    readonly REPAIR_OPERATOR_TOKEN: string;
+    readonly SDT_SERVICE_ID?: string;
+}
+/** Deployment composition may rebuild provider-specific read models after the
+ * durable store and tag verification, but before the coordinator becomes READY. */
+export interface OperatorBootstrapHooks {
+    readonly afterVerifyBeforeReady?: (input: {
+        readonly serviceId: string;
+        readonly importId: string;
+        readonly leaseEpoch: number;
+        readonly manifest: BootstrapManifest;
+    }) => Promise<void>;
+}
+/** Bearer-only operator lane. Incoming headers are never forwarded to a DO. */
+export declare function handleOperatorBootstrap(request: Request, env: OperatorBootstrapEnv, storeProvider: StoreProvider, hooks?: OperatorBootstrapHooks): Promise<Response>;