@sekiban/dcb-runtime 0.2.0

package/dist/bootstrap/OperatorBootstrap.js

@@ -0,0 +1,104 @@
+import { parseBootstrapDump } from "./manifest";
+import { createBootstrapStoreAdapter } from "./BootstrapStoreAdapter";
+import { scopeIdFor } from "../scope/ScopeName";
+function json(body, status = 200) { return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8" } }); }
+function object(value) { return typeof value === "object" && value !== null && !Array.isArray(value); }
+function bearer(request, token) {
+    const supplied = request.headers.get("authorization");
+    // Keep absence indistinguishable from an undiscovered management surface.
+    if (supplied === null)
+        return json({ code: "not_found", error: "not found" }, 404);
+    if (supplied !== `Bearer ${token}`)
+        return json({ code: "operator_auth_required", error: "valid bearer required" }, 403);
+    return undefined;
+}
+/** Bearer-only operator lane. Incoming headers are never forwarded to a DO. */
+export async function handleOperatorBootstrap(request, env, storeProvider, hooks = {}) {
+    const denied = bearer(request, env.REPAIR_OPERATOR_TOKEN);
+    if (denied !== undefined)
+        return denied;
+    const url = new URL(request.url);
+    const match = url.pathname.match(/^\/operator\/bootstrap\/([^/]+)\/(plan|import|status|abort|export)$/);
+    if (match === null)
+        return json({ code: "not_found", error: "not found" }, 404);
+    let serviceId;
+    try {
+        serviceId = decodeURIComponent(match[1]);
+    }
+    catch {
+        return json({ code: "bootstrap_service_invalid", error: "Bootstrap serviceId must be URI encoded" }, 400);
+    }
+    if (serviceId.length === 0)
+        return json({ code: "bootstrap_service_invalid", error: "Bootstrap serviceId is required" }, 400);
+    const operation = match[2];
+    const coordinator = env.BOOTSTRAP.get(scopeIdFor(env.BOOTSTRAP, { serviceId, doClass: "bootstrap", identity: "coordinator" }));
+    let body = {};
+    if (operation !== "status")
+        try {
+            body = await request.json();
+        }
+        catch {
+            return json({ code: "bootstrap_body_invalid", error: "JSON body required" }, 400);
+        }
+    const invoke = (path, value, method = "POST") => {
+        const internal = new URL(`https://bootstrap.internal${path}`);
+        internal.searchParams.set("__serviceId", serviceId);
+        return coordinator.fetch(new Request(internal, method === "GET" ? { method } : { method, headers: { "content-type": "application/json" }, body: JSON.stringify(value) }));
+    };
+    if (operation === "status")
+        return invoke("/state", undefined, "GET");
+    if (operation === "abort")
+        return invoke("/abort", body);
+    if (operation === "export") {
+        if (!object(body) || typeof body.targetServiceId !== "string" || body.targetServiceId.length === 0 || "allocatorLineageId" in body)
+            return json({ code: "bootstrap_export_invalid", error: "targetServiceId is required and allocator lineage is server-derived" }, 400);
+        // A caller must not nominate a synthetic lineage. Initializing the target
+        // service allocator first gives bootstrap and future commits one durable,
+        // authoritative lineage source.
+        const allocator = env.ALLOCATOR.get(scopeIdFor(env.ALLOCATOR, { serviceId: body.targetServiceId, doClass: "allocator", identity: "allocator" }));
+        const allocatorState = await allocator.fetch(new Request("https://bootstrap.internal/state"));
+        if (!allocatorState.ok)
+            return json({ code: "bootstrap_allocator_unavailable", error: "target allocator state is unavailable" }, 503);
+        const allocatorBody = await allocatorState.json();
+        if (typeof allocatorBody.allocatorLineageId !== "string" || allocatorBody.allocatorLineageId.length === 0)
+            return json({ code: "bootstrap_allocator_invalid", error: "target allocator lineage is invalid" }, 500);
+        const sourceAllocator = env.ALLOCATOR.get(scopeIdFor(env.ALLOCATOR, { serviceId, doClass: "allocator", identity: "allocator" }));
+        const sourceAllocatorState = await sourceAllocator.fetch(new Request("https://bootstrap.internal/state"));
+        if (!sourceAllocatorState.ok)
+            return json({ code: "bootstrap_allocator_unavailable", error: "source allocator state is unavailable" }, 503);
+        const sourceAllocatorBody = await sourceAllocatorState.json();
+        if (typeof sourceAllocatorBody.allocatorLineageId !== "string" || sourceAllocatorBody.allocatorLineageId.length === 0)
+            return json({ code: "bootstrap_allocator_invalid", error: "source allocator lineage is invalid" }, 500);
+        const adapter = storeProvider.createBootstrapAdapter?.(env) ?? createBootstrapStoreAdapter(storeProvider.name, storeProvider.create(env));
+        return json(await adapter.exportPage({ sourceServiceId: serviceId, sourceAllocatorLineageId: sourceAllocatorBody.allocatorLineageId, targetServiceId: body.targetServiceId, allocatorLineageId: allocatorBody.allocatorLineageId, pageSize: typeof body.pageSize === "number" ? body.pageSize : 128 }));
+    }
+    if (operation === "plan")
+        return invoke("/plan", body);
+    if (!object(body) || !object(body.dump))
+        return json({ code: "bootstrap_dump_invalid", error: "import requires dump" }, 400);
+    let dump;
+    try {
+        dump = parseBootstrapDump(body.dump);
+    }
+    catch {
+        return json({ code: "bootstrap_dump_invalid", error: "invalid canonical dump" }, 400);
+    }
+    if (typeof body.importId !== "string" || typeof body.leaseEpoch !== "number")
+        return json({ code: "bootstrap_epoch_rejected", error: "importId and leaseEpoch required" }, 409);
+    const adapter = storeProvider.createBootstrapAdapter?.(env) ?? createBootstrapStoreAdapter(storeProvider.name, storeProvider.create(env));
+    await adapter.admitBootstrap({ importId: body.importId, leaseEpoch: body.leaseEpoch, manifest: dump.manifest, events: dump.events });
+    const imported = await invoke("/import", body);
+    if (!imported.ok)
+        return imported;
+    const verified = await invoke("/verify", body);
+    if (!verified.ok)
+        return verified;
+    await adapter.verifyBootstrap({ importId: body.importId, manifest: dump.manifest });
+    try {
+        await hooks.afterVerifyBeforeReady?.({ serviceId, importId: body.importId, leaseEpoch: body.leaseEpoch, manifest: dump.manifest });
+    }
+    catch {
+        return json({ code: "bootstrap_read_model_rebuild_failed", error: "target read-model rebuild failed before READY" }, 503);
+    }
+    return invoke("/ready", body);
+}

package/dist/bootstrap/manifest.d.ts

@@ -0,0 +1,9 @@
+import type { BootstrapDump } from "./types";
+export declare class BootstrapManifestError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** A small deterministic digest for portable validation. It is deliberately not a security primitive. */
+export declare function bootstrapDigest(value: unknown): string;
+/** Parses and validates the complete dump before a coordinator can mutate a target. */
+export declare function parseBootstrapDump(value: unknown): BootstrapDump;

package/dist/bootstrap/manifest.js

@@ -0,0 +1,115 @@
+import { assertCanonicalEventType } from "../eventIdentity";
+import { assertSortableUniqueId } from "../allocator/SortableUniqueId";
+import { CANONICAL_UTC_TIMESTAMP_PATTERN, isRfc4122Uuid, serializedEventMetadata } from "../eventRecord";
+export class BootstrapManifestError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const nonEmpty = (value) => typeof value === "string" && value.length > 0;
+const exactKeys = (value, keys, name) => {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index]))
+        throw new BootstrapManifestError("unknown_or_missing_field", `${name} has unknown or missing fields`);
+};
+const canonical = (value) => {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (isObject(value))
+        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+    return JSON.stringify(value);
+};
+/** A small deterministic digest for portable validation. It is deliberately not a security primitive. */
+export function bootstrapDigest(value) {
+    let hash = 2166136261;
+    for (const char of canonical(value)) {
+        hash ^= char.charCodeAt(0);
+        hash = Math.imul(hash, 16777619);
+    }
+    return `fnv1a32:${(hash >>> 0).toString(16).padStart(8, "0")}`;
+}
+function parseManifest(value) {
+    if (!isObject(value))
+        throw new BootstrapManifestError("manifest_invalid", "manifest must be an object");
+    exactKeys(value, ["canonicalization", "contentDigest", "eventCount", "format", "highWatermark", "source", "tagCounts", "target", "version"], "manifest");
+    if (value.format !== "sekiban-dcb-bootstrap" || value.version !== 1 || value.canonicalization !== "utf8-json-sorted-keys-v1" || !nonEmpty(value.contentDigest) || !isObject(value.source) || !isObject(value.target) || !isObject(value.tagCounts))
+        throw new BootstrapManifestError("manifest_invalid", "manifest has an invalid format or version");
+    exactKeys(value.source, ["lineageId", "serviceId"], "manifest.source");
+    exactKeys(value.target, ["allocatorLineageId", "serviceId"], "manifest.target");
+    const eventCount = value.eventCount;
+    const tagCounts = value.tagCounts;
+    if (!nonEmpty(value.source.serviceId) || !nonEmpty(value.source.lineageId) || !nonEmpty(value.target.serviceId) || !nonEmpty(value.target.allocatorLineageId) || (typeof value.highWatermark !== "string" && value.highWatermark !== null) || typeof eventCount !== "number" || !Number.isSafeInteger(eventCount) || eventCount < 0 || !Object.entries(tagCounts).every(([tag, count]) => nonEmpty(tag) && typeof count === "number" && Number.isSafeInteger(count) && count >= 0))
+        throw new BootstrapManifestError("manifest_invalid", "manifest field is invalid");
+    return value;
+}
+function parseEvent(value) {
+    if (!isObject(value))
+        throw new BootstrapManifestError("record_invalid", "event record must be an object");
+    const allowed = ["causationId", "correlationId", "eventId", "eventTags", "eventType", "executedUser", "payload", "provenance", "suid", "timestamp"];
+    if (Object.keys(value).some((key) => !allowed.includes(key)) || !nonEmpty(value.eventId) || !nonEmpty(value.suid) ||
+        typeof value.payload !== "string" || !Array.isArray(value.eventTags) || !value.eventTags.every(nonEmpty) ||
+        new Set(value.eventTags).size !== value.eventTags.length || !nonEmpty(value.eventType) ||
+        !isObject(value.provenance) || value.provenance.origin !== "g32" || !nonEmpty(value.timestamp) ||
+        ![value.causationId, value.correlationId, value.executedUser].every((metadata) => metadata === null || nonEmpty(metadata))) {
+        throw new BootstrapManifestError("record_invalid", "event record is invalid");
+    }
+    try {
+        assertSortableUniqueId(value.suid);
+        // A C# import is permitted to contain any RFC 4122 Id. New commit
+        // admission remains UUID v7; this parser is the migration boundary.
+        if (!isRfc4122Uuid(value.eventId))
+            throw new Error("event id");
+        assertCanonicalEventType(value.eventType);
+        JSON.parse(value.payload);
+    }
+    catch {
+        throw new BootstrapManifestError("record_invalid", "G32 record identity or payload is invalid");
+    }
+    if (!CANONICAL_UTC_TIMESTAMP_PATTERN.test(value.timestamp)) {
+        throw new BootstrapManifestError("record_invalid", "record timestamp is not UTC");
+    }
+    const metadata = serializedEventMetadata(value.eventId);
+    const nullableMetadata = value.causationId === null && value.correlationId === null && value.executedUser === null;
+    const serializedMetadata = value.causationId === metadata.causationId && value.correlationId === metadata.correlationId && value.executedUser === metadata.executedUser;
+    if (!nullableMetadata && !serializedMetadata) {
+        throw new BootstrapManifestError("record_invalid", "record metadata must be all null or use the serialized C# constants");
+    }
+    return {
+        eventId: value.eventId,
+        suid: value.suid,
+        payload: value.payload,
+        // C# Tags preserve emission order; do not sort the durable record.
+        eventTags: [...value.eventTags],
+        eventType: value.eventType,
+        provenance: { origin: "g32" },
+        timestamp: value.timestamp,
+        causationId: value.causationId,
+        correlationId: value.correlationId,
+        executedUser: value.executedUser,
+    };
+}
+/** Parses and validates the complete dump before a coordinator can mutate a target. */
+export function parseBootstrapDump(value) {
+    if (!isObject(value))
+        throw new BootstrapManifestError("dump_invalid", "dump must be an object");
+    exactKeys(value, ["events", "manifest"], "dump");
+    if (!Array.isArray(value.events))
+        throw new BootstrapManifestError("dump_invalid", "events must be an array");
+    const manifest = parseManifest(value.manifest);
+    const events = value.events.map(parseEvent);
+    if (events.length !== manifest.eventCount || new Set(events.map((event) => event.eventId)).size !== events.length || events.some((event, index) => index > 0 && events[index - 1].suid >= event.suid))
+        throw new BootstrapManifestError("record_order_or_duplicate", "event records must be unique and strictly SUID-ascending");
+    const counts = {};
+    for (const event of events)
+        for (const tag of event.eventTags)
+            counts[tag] = (counts[tag] ?? 0) + 1;
+    if (canonical(counts) !== canonical(manifest.tagCounts) || (events.at(-1)?.suid ?? null) !== manifest.highWatermark)
+        throw new BootstrapManifestError("manifest_mismatch", "manifest counts or high watermark do not match records");
+    if (bootstrapDigest({ manifest: { ...manifest, contentDigest: "" }, events }) !== manifest.contentDigest)
+        throw new BootstrapManifestError("digest_mismatch", "dump content digest does not match");
+    return { manifest, events };
+}

package/dist/bootstrap/types.d.ts

@@ -0,0 +1,75 @@
+/** Provider-neutral, immutable G32 dump wire. */
+export interface BootstrapManifest {
+    readonly format: "sekiban-dcb-bootstrap";
+    readonly version: 1;
+    readonly source: {
+        readonly serviceId: string;
+        readonly lineageId: string;
+    };
+    readonly target: {
+        readonly serviceId: string;
+        readonly allocatorLineageId: string;
+    };
+    readonly highWatermark: string | null;
+    readonly eventCount: number;
+    readonly tagCounts: Readonly<Record<string, number>>;
+    readonly contentDigest: string;
+    readonly canonicalization: "utf8-json-sorted-keys-v1";
+}
+export interface BootstrapEventRecord {
+    readonly eventId: string;
+    readonly suid: string;
+    readonly payload: string;
+    readonly eventTags: readonly string[];
+    readonly eventType: string;
+    readonly provenance: Readonly<{
+        readonly origin: "g32";
+    }>;
+    readonly timestamp: string;
+    readonly causationId: string | null;
+    readonly correlationId: string | null;
+    readonly executedUser: string | null;
+}
+export interface BootstrapDump {
+    readonly manifest: BootstrapManifest;
+    readonly events: readonly BootstrapEventRecord[];
+}
+export type BootstrapStatus = "EMPTY" | "PLANNED" | "IMPORTING" | "VERIFYING" | "READY" | "FAILED";
+export interface BootstrapControlRecord {
+    readonly schemaVersion: 1;
+    readonly status: BootstrapStatus;
+    readonly importId: string | null;
+    readonly targetServiceId: string;
+    readonly allocatorLineageId: string | null;
+    readonly source: BootstrapManifest["source"] | null;
+    readonly digest: string | null;
+    readonly manifest: BootstrapManifest | null;
+    readonly progress: Readonly<Record<string, string | null>>;
+    readonly leaseEpoch: number;
+    readonly leaseUntil: number | null;
+    readonly failure: string | null;
+    readonly readyAt: string | null;
+    readonly normalInFlight: number;
+    /** Commands admitted before a bootstrap plan.  The epoch is carried to every
+     * final durable write, rather than treating admission as a one-time check. */
+    readonly normalCommands?: Readonly<Record<string, number>>;
+    /** Recently released entry admissions, retained only for their final epoch check. */
+    readonly releasedCommands?: Readonly<Record<string, number>>;
+    /** READY is a post-verification state, never merely an import completion. */
+    readonly verifiedImportId?: string | null;
+    readonly verifiedLeaseEpoch?: number | null;
+    readonly storeCompletion?: "prepopulated-manifest" | null;
+}
+/** G22 supplies provider implementations. Bootstrap core deliberately has no adapter. */
+export interface BootstrapStoreAdmissionPort {
+    admitBootstrap(input: {
+        readonly importId: string;
+        readonly leaseEpoch: number;
+        readonly manifest: BootstrapManifest;
+        readonly events: readonly BootstrapEventRecord[];
+    }): Promise<void>;
+    verifyBootstrap(input: {
+        readonly importId: string;
+        readonly manifest: BootstrapManifest;
+    }): Promise<void>;
+}

package/dist/bootstrap/types.js

@@ -0,0 +1 @@
+export {};

package/dist/cli/OperatorRepairCli.d.ts

@@ -0,0 +1,11 @@
+import { type NativeTracing } from "../trace/CommitTrace";
+import { type ServiceIdentityProvider } from "../service/ServiceIdentityProvider";
+export interface OperatorRepairEnv {
+    JOURNAL: DurableObjectNamespace;
+    TAG: DurableObjectNamespace;
+    REPAIR_OPERATOR_TOKEN: string;
+    REPAIR_EXCLUSION_LOOKUP?: Fetcher;
+    SDT_SERVICE_ID?: string;
+}
+/** Authenticated, bounded control-plane command; it is not a V1 public wire endpoint. */
+export declare function handleOperatorRepair(request: Request, env: OperatorRepairEnv, nativeTracing?: NativeTracing, serviceIdentityProvider?: ServiceIdentityProvider): Promise<Response>;

package/dist/cli/OperatorRepairCli.js

@@ -0,0 +1,108 @@
+import { BindingExclusionLookupClient } from "../downstream/ExclusionLookup";
+import { RepairWorker, RepairWorkerFailure } from "../repair/RepairWorker";
+import { noOpNativeTracing } from "../trace/CommitTrace";
+import { envServiceIdentity, requireServiceIdentity } from "../service/ServiceIdentityProvider";
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json; charset=utf-8" },
+    });
+}
+function error(status, code, message) {
+    return json({ error: message, code }, status);
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function uniqueStrings(value, name) {
+    if (!Array.isArray(value) || value.length === 0 || !value.every(isNonEmptyString)) {
+        return { error: `${name} must be a non-empty array of non-empty strings` };
+    }
+    if (new Set(value).size !== value.length) {
+        return { error: `${name} values must be unique` };
+    }
+    return { value: [...value] };
+}
+function executionFrom(value, testFault) {
+    if (!isObject(value) || !isNonEmptyString(value.actor)) {
+        return { error: "actor is required" };
+    }
+    const attemptIds = uniqueStrings(value.attemptIds, "attemptIds");
+    const tags = uniqueStrings(value.tags, "tags");
+    if (attemptIds.value === undefined || tags.value === undefined) {
+        return { error: attemptIds.error ?? tags.error };
+    }
+    const mode = value.mode === undefined ? "dry-run" : value.mode;
+    if (mode !== "dry-run" && mode !== "execute") {
+        return { error: "mode must be dry-run or execute" };
+    }
+    const maxItems = value.maxItems === undefined ? 100 : value.maxItems;
+    if (typeof maxItems !== "number" || !Number.isSafeInteger(maxItems) || maxItems <= 0 || maxItems > 1_000) {
+        return { error: "maxItems must be a positive safe integer no greater than 1000" };
+    }
+    if (value.checkpoint !== undefined && !isNonEmptyString(value.checkpoint)) {
+        return { error: "checkpoint must be a non-empty string when present" };
+    }
+    return {
+        value: {
+            attemptIds: attemptIds.value,
+            tags: tags.value,
+            actor: value.actor,
+            // Store an auditable operator identity, never the bearer secret itself.
+            owner: `operator:${value.actor}`,
+            mode,
+            maxItems,
+            ...(value.checkpoint === undefined ? {} : { checkpoint: value.checkpoint }),
+            ...(testFault === undefined ? {} : { fault: testFault }),
+        },
+    };
+}
+function testFaultFromRequest(request) {
+    if (new URL(request.url).hostname !== "repair.test") {
+        return undefined;
+    }
+    const value = request.headers.get("x-sdt-g6-test-fault");
+    return value === "after-lease-before-prepare" ||
+        value === "after-prepare-before-apply" ||
+        value === "after-apply-before-observation" ||
+        value === "after-verify-before-audit" ||
+        value === "after-audit-before-clear" ||
+        value === "after-clear-before-final-observation"
+        ? value
+        : undefined;
+}
+/** Authenticated, bounded control-plane command; it is not a V1 public wire endpoint. */
+export async function handleOperatorRepair(request, env, nativeTracing = noOpNativeTracing, serviceIdentityProvider) {
+    if (request.method !== "POST") {
+        return error(404, "operator_repair_route_not_found", "Operator repair requires POST");
+    }
+    const token = env.REPAIR_OPERATOR_TOKEN;
+    if (!isNonEmptyString(token) || request.headers.get("authorization") !== `Bearer ${token}`) {
+        return error(401, "operator_auth_required", "A valid operator repair bearer token is required");
+    }
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch {
+        return error(400, "invalid_operator_repair_request", "Operator repair request must be JSON");
+    }
+    const parsed = executionFrom(body, testFaultFromRequest(request));
+    if (parsed.value === undefined) {
+        return error(400, "invalid_operator_repair_request", parsed.error ?? "Invalid operator repair request");
+    }
+    try {
+        const worker = new RepairWorker(env, new BindingExclusionLookupClient(env.REPAIR_EXCLUSION_LOOKUP), requireServiceIdentity(serviceIdentityProvider ?? envServiceIdentity(env)), { nativeTracing });
+        const result = await worker.execute(parsed.value);
+        return json(result, result.interrupted === undefined ? 200 : 202);
+    }
+    catch (failure) {
+        const message = failure instanceof RepairWorkerFailure
+            ? failure.message
+            : "Operator repair could not determine a durable repair result";
+        return error(500, "operator_repair_failed", message);
+    }
+}

package/dist/cloudflare.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Cloudflare-only runtime composition.
+ *
+ * This entrypoint is deliberately separate from the default runtime entrypoint:
+ * it imports the D1 provider directly and never imports the Postgres/Cosmos
+ * provider graph. A Worker using this surface therefore has an auditable
+ * zero-external-database bundle while the ordinary entrypoint remains the
+ * unchanged Postgres composition.
+ */
+import type { DomainDefinition } from "@sekiban/dcb-core";
+import { AllocatorDurableObject as RuntimeAllocatorDurableObject } from "./allocator/AllocatorDurableObject";
+import { BootstrapCoordinatorDurableObject as RuntimeBootstrapCoordinatorDurableObject } from "./bootstrap/BootstrapCoordinatorDurableObject";
+import type { DeliveryCoreResult, DeliveryViewHandler } from "./downstream/DeliveryCore";
+import type { DownstreamDoorbellBinding } from "./downstream/Doorbell";
+import type { DownstreamOutboxMessage } from "./downstream/types";
+import { JournalDurableObject as RuntimeJournalDurableObject } from "./journal/JournalDurableObject";
+import { type RuntimeDomainLike, type RuntimeWorkerConfig } from "./composition";
+import { type LiveProjectionPollObserver } from "./projection/LiveProjectionWorker";
+import { TagDurableObject as RuntimeTagDurableObject } from "./tag/TagDurableObject";
+import { TagStateDurableObject as RuntimeTagStateDurableObject } from "./tagstate/TagStateDurableObject";
+import type { GlobalCompletenessScanResult } from "./completeness/types";
+import type { StoredEvent } from "./store/types";
+import { type ServiceIdentityProvider } from "./service/ServiceIdentityProvider";
+export { createG60DurableHopObserver, observeG60UnsafeWriter, recordDurableHop, recordDurableHopSubstep, recordDurableUnsafeWriterBoundary, recordFirstUnsafeVisibleRead, } from "./diagnostics/G60DurableHop";
+export { G60_POST_ADMISSION_STAGES, G60_UNSAFE_WRITER_PATHS, } from "./diagnostics/G60DurableHop";
+export { G65_DIRECT_RING_BUDGET_MS, G65_DIRECT_RING_CLOCK_ORIGIN, recordG65DirectRing, readG65DirectRing, markG65DirectApplyStarted, markG65DirectApplyFinished, } from "./diagnostics/G65DirectRing";
+export type { G65DirectApplyOutcome, G65DirectRingOutcome, G65DirectRingRecord, } from "./diagnostics/G65DirectRing";
+export type { G60DurableUnsafeWriterObservation, G60DurablePostAdmissionObservation, G60DurableHopObservation, G60DurableHopObserver, G60PostAdmissionBoundary, G60PostAdmissionStage, G60UnsafeWriterBoundary, G60UnsafeWriterPath, G60UnsafeWriterTransport, G60HopStage, G60HopTransport, } from "./diagnostics/G60DurableHop";
+export { buildScopeName, DURABLE_OBJECT_SCOPE_CLASSES, isScopeServiceId, parseScopeName, scopeIdFor, ScopeNameError, tagStateScopeIdentity, } from "./scope/ScopeName";
+export type { DurableObjectScope, DurableObjectScopeClass, ScopeNameNamespace } from "./scope/ScopeName";
+export { envServiceIdentity, G11_SERVICE_ID_HEADER, injectableServiceIdentity, requestServiceIdentity, requireServiceIdentity, ServiceIdentityMissingError, TEST_SERVICE_ID_HEADER, } from "./service/ServiceIdentityProvider";
+export type { ServiceIdentityBehavior, ServiceIdentityEnvironment, ServiceIdentityProvider, ServiceIdentityRequestOptions, ServiceIdentityResolution, } from "./service/ServiceIdentityProvider";
+export interface CloudflareOnlyEnv {
+    ALLOCATOR: DurableObjectNamespace;
+    BOOTSTRAP: DurableObjectNamespace;
+    JOURNAL: DurableObjectNamespace;
+    TAG: DurableObjectNamespace;
+    TAG_STATE: DurableObjectNamespace;
+    DOWNSTREAM_QUEUE: Queue<DownstreamOutboxMessage>;
+    DOWNSTREAM_DOORBELL?: DownstreamDoorbellBinding;
+    D1: D1Database;
+    D1_MV: D1Database;
+    AUTO_DRAIN_OUTBOX?: string;
+    REPAIR_OPERATOR_TOKEN: string;
+    REPAIR_EXCLUSION_LOOKUP?: Fetcher;
+    G11_VERIFICATION_ENABLED?: string;
+    SDT_SERVICE_ID?: string;
+    DOMAIN_DELIVERY_CLASS?: string;
+    DIRECT_DOORBELL?: string;
+    DIRECT_DOORBELL_ALLOWED_VIEWS?: string;
+    DIRECT_DOORBELL_MAX_INVOCATIONS?: string;
+    DIRECT_DOORBELL_DEGRADATION?: string;
+    DIRECT_DOORBELL_RECEIVER_MODE?: string;
+    DIRECT_DOORBELL_SELF_BINDING_PROOF?: string;
+    G26_VIEW_COUNT?: string;
+    /** Bound from Cloudflare Worker Version metadata; observation-only. */
+    WORKER_VERSION?: Readonly<{
+        id?: unknown;
+    }>;
+}
+export interface CloudflareOnlyWorkerOptions {
+    readonly domain?: DomainDefinition | RuntimeDomainLike;
+    readonly config?: RuntimeWorkerConfig;
+    /** Host seam; deployed composition defaults to envServiceIdentity. */
+    readonly serviceIdentityProvider?: ServiceIdentityProvider;
+    /** Optional deployment read-model rebuild that must finish before READY. */
+    readonly afterBootstrapVerify?: (input: {
+        readonly serviceId: string;
+        readonly env: CloudflareOnlyEnv;
+    }) => Promise<void>;
+    /**
+     * Runs after the fresh G44 reconciliation and before the scheduled
+     * live-projection poll. A sample can use the resulting persisted coverage
+     * for its SafeWindow-fenced materialized-view pass in this same tick.
+     */
+    readonly beforeLiveProjectionPoll?: (input: {
+        readonly env: CloudflareOnlyEnv;
+        readonly serviceId: string;
+        readonly scan: GlobalCompletenessScanResult;
+        readonly ctx: ExecutionContext;
+    }) => Promise<BeforeLiveProjectionPollResult | void>;
+    /** Persists the observation-only lifecycle of each scheduled live poll. */
+    readonly liveProjectionPollObserver?: LiveProjectionPollObserver;
+    /** Factories are evaluated per invocation; Queue and receiver can select views independently. */
+    readonly deliveryViews?: (input: {
+        readonly env: CloudflareOnlyEnv;
+        readonly ctx: ExecutionContext;
+    }) => readonly DeliveryViewHandler[];
+    /** Runs after all selected views have completed and before the drain trigger returns. */
+    readonly afterStoredDownstreamDelivery?: (input: {
+        readonly message: DownstreamOutboxMessage;
+        readonly event: StoredEvent;
+        readonly arrivedAt: number;
+        readonly env: CloudflareOnlyEnv;
+        readonly ctx: ExecutionContext;
+        readonly source?: "queue" | "fast" | "import";
+        readonly result?: DeliveryCoreResult;
+    }) => Promise<void>;
+    /**
+     * Runs after a Queue message has durably recorded its event, including when
+     * G44 keeps ordinary views fail-closed. The callback must only register
+     * non-blocking work with the active ExecutionContext and return.
+     */
+    readonly afterStoredQueueDelivery?: (input: {
+        readonly message: DownstreamOutboxMessage;
+        readonly result: DeliveryCoreResult;
+        readonly env: CloudflareOnlyEnv;
+        readonly ctx: ExecutionContext;
+    }) => void;
+}
+/**
+ * Result returned by the sample's retained-frontier safe-lane hook. The
+ * scanner result itself intentionally has no mutable frontier: on BLOCK the
+ * hook reads the last proven FULL cursor from the persisted health authority.
+ */
+export interface BeforeLiveProjectionPollResult {
+    readonly frontierSuid?: string | null;
+}
+/**
+ * Translate a scheduled scanner outcome and the hook's retained frontier into
+ * the live-poll fence. A FULL scan keeps the established unbounded behavior;
+ * every other outcome invokes the poll but is bounded by the last proven
+ * frontier (or by `null` when none exists).
+ */
+export declare function scheduledLiveProjectionMaximumSuid(scan: Pick<GlobalCompletenessScanResult, "kind">, retainedFrontierSuid: string | null | undefined): string | null | undefined;
+/**
+ * Keep the portable runtime free of a `cloudflare:workers` runtime import.
+ * These entrypoint-owned wrappers inject the active Cloudflare custom-span
+ * API into every Durable Object constructor used by the deployed Worker.
+ */
+export declare class AllocatorDurableObject extends RuntimeAllocatorDurableObject {
+    constructor(ctx: DurableObjectState, env: CloudflareOnlyEnv);
+}
+export declare class BootstrapCoordinatorDurableObject extends RuntimeBootstrapCoordinatorDurableObject {
+    constructor(ctx: DurableObjectState, env: CloudflareOnlyEnv);
+}
+export declare class JournalDurableObject extends RuntimeJournalDurableObject {
+    constructor(ctx: DurableObjectState, env: CloudflareOnlyEnv);
+}
+export declare class TagDurableObject extends RuntimeTagDurableObject {
+    constructor(ctx: DurableObjectState, env: CloudflareOnlyEnv);
+}
+/** The dedicated (service, tag, projector) cache/replay Durable Object. */
+export declare class TagStateDurableObject extends RuntimeTagStateDurableObject {
+}
+/** Compose the named two-D1 Cloudflare-only Worker. */
+export declare function createCloudflareOnlyRuntimeWorker(options?: CloudflareOnlyWorkerOptions): ExportedHandler<CloudflareOnlyEnv>;
+export { processDownstreamDoorbell } from "./downstream/DownstreamAdapter";
+export { LIVE_PROJECTION_POLL_OUTCOMES, pollLiveProjections, } from "./projection/LiveProjectionWorker";
+export type { LiveProjectionEnv, LiveProjectionPollObservation, LiveProjectionPollObserver, LiveProjectionPollOutcome, ProjectionPollOptions, } from "./projection/LiveProjectionWorker";
+export type { ClosedPrefixCertificate } from "./allocator/types";
+export type { SafeViewCoverageContext } from "./projection/ProjectionRuntime";
+export { downstreamEnvelopeBytes, classifyDirectDoorbellFailure, preflightDirectDoorbell, readDomainDeliveryClass, readDirectDoorbellConfig, selectDirectDoorbellViews, MAX_SERVICE_BINDING_INVOCATIONS_PER_REQUEST, } from "./downstream/Doorbell";
+export { deliveryCorrelationId } from "./downstream/DeliveryCore";
+export { GlobalCompletenessReconciler } from "./completeness/GlobalCompletenessReconciler";
+export { G44_HEALTH_STALE_AFTER_MS, G44_SCANNER_VERSION, GLOBAL_COMPLETENESS_INTERIM_DISPOSITION, } from "./completeness/types";
+export type { GlobalCompletenessHealth, GlobalCompletenessCoverage, GlobalCompletenessHealthRecord, GlobalCompletenessScanResult, SourceObligationFact, SourceObligationPage, SourcePartitionSnapshot, } from "./completeness/types";
+export { observeFaultBarrier } from "./trace/ObservationStream";
+export { G42_JOURNAL_PROBE_ALARM_KEY, G42_JOURNAL_PROBE_IDENTITY_PREFIX, G42_JOURNAL_PROBE_INDEX_KEY, G42_JOURNAL_PROBE_INTERNAL_PREFIX, G42_JOURNAL_PROBE_LOGICAL_KEY_PREFIX, G42_JOURNAL_PROBE_PATH, G42_JOURNAL_PROBE_SCHEMA, G42_JOURNAL_PROBE_STORAGE_PREFIX, cleanupG42JournalProbeTrial, g42ProbeStorageKey, inventoryG42JournalProbeTrial, isG42ProbeIdentity, isG42ProbeLogicalKey, parseG42JournalProbeRequest, prepareG42JournalProbeTrial, measureG42JournalProbeTrial, runG42JournalProbeTrial, } from "./journal/JournalFirstTouchProbe";
+export type { G42JournalProbeCleanup, G42JournalProbeCleanupReceipt, G42JournalProbeInventory, G42JournalProbeInventoryReceipt, G42JournalProbeMeasurement, G42JournalProbeMeasurementReceipt, G42JournalProbePreparation, G42JournalProbePreparationReceipt, G42JournalProbeRequest, G42JournalProbeTrial, G42JournalProbeTrialReceipt, G42ProbeActivationFact, G42ProbeAlarmMode, G42ProbeCell, G42ProbeMediator, G42ProbeOperationResult, } from "./journal/JournalFirstTouchProbe";
+export type { DeliveryClass, DownstreamDoorbellBinding, DirectDoorbellDegradation, DirectDoorbellDeploymentConfig, DirectDoorbellPreflightResult, DirectDoorbellReceiverMode, DirectDoorbellFailureKind, } from "./downstream/Doorbell";
+export type { DeliveryCoreEnvironment, DeliveryCoreFailure, DeliveryCoreOptions, DeliveryCoreResult, DeliverySource, DeliveryViewApplyResult, DeliveryViewFailureClass, DeliveryViewHandler, DeliveryViewInput, DeliveryViewResult, } from "./downstream/DeliveryCore";
+declare const cloudflareOnlyRuntime: ExportedHandler<CloudflareOnlyEnv, unknown, unknown, unknown>;
+export default cloudflareOnlyRuntime;