@sekiban/dcb-runtime 0.2.0

package/dist/commit/CommitWorker.d.ts

@@ -0,0 +1,101 @@
+import { type ValidatedCommitEnvelope } from "./types";
+import type { DeliveryClass } from "../downstream/Doorbell";
+import { type CommitTraceClock, type CommitTraceProviderAdapter, type CommitTraceSink, type NativeTracing } from "../trace/CommitTrace";
+import { type ObservationLogSink } from "../trace/ObservationStream";
+import { type ServiceIdentityProvider } from "../service/ServiceIdentityProvider";
+import type { G60DurableHopObserver } from "../diagnostics/G60DurableHop";
+export interface CommitWorkerEnv {
+    ALLOCATOR: DurableObjectNamespace;
+    /**
+     * Retained for the G42 probe and RepairWorker routes.  CommitWorker must
+     * never resolve this namespace after G41: tags own prepare/commit facts.
+     */
+    JOURNAL?: DurableObjectNamespace;
+    TAG: DurableObjectNamespace;
+    /** Service-scoped bootstrap authority. Optional keeps pre-G21 unit harnesses compatible. */
+    BOOTSTRAP?: DurableObjectNamespace;
+    /** Set only by an authenticated deployment-verification lane. */
+    G11_VERIFICATION_ENABLED?: string;
+    /** Non-secret service identity configured per deployment. */
+    SDT_SERVICE_ID?: string;
+}
+/** Test seam for the admitted-then-stalled bootstrap race; production has no hook. */
+export interface CommitWorkerHooks {
+    /** Test-only barrier after entry admission is released and before /allocate. */
+    beforeBootstrapAllocation?(): Promise<void> | void;
+    beforeBootstrapFinalization?(): Promise<void> | void;
+    /** Test-only allocator identity; production uses the canonical allocator identity. */
+    allocatorScopeIdentity?: string;
+    /** Runtime composition value; never sourced from a caller-controlled V1 body. */
+    domainDeliveryClass?: DeliveryClass;
+    /** Registered schema/parser authority for exact-case payload admission. */
+    registeredEventParsers?: Readonly<Record<string, (payload: unknown) => unknown>>;
+    /** Test/evidence observer. It is not a public response or protocol field. */
+    commitTraceSink?: CommitTraceSink;
+    /** Deterministic test clock for trace containment and ratio fixtures. */
+    commitTraceClock?: CommitTraceClock;
+    /** Provider automatic attributes are optional adapter input only. */
+    commitTraceProvider?: CommitTraceProviderAdapter;
+    /** Cloudflare active-context span API supplied by the Worker entrypoint. */
+    nativeTracing?: NativeTracing;
+    /** Test-only sink injection; production emits the structured log normally. */
+    workerObservationSink?: ObservationLogSink;
+    /** G60 internal durable hop observation; never changes the V1 wire. */
+    durableHopObserver?: G60DurableHopObserver;
+    /** Host/deployment identity seam; absent callers receive the env-backed default. */
+    serviceIdentityProvider?: ServiceIdentityProvider;
+}
+/** Parse the complete V1 envelope before any Durable Object is contacted. */
+export declare function validateCommitEnvelope(value: unknown, registeredEventParsers?: Readonly<Record<string, (payload: unknown) => unknown>>): {
+    value: ValidatedCommitEnvelope;
+} | {
+    error: Response;
+};
+/**
+ * Stateless request orchestrator. Every mutation is delegated to the durable
+ * actor that owns it; this class retains only one request's generated IDs.
+ */
+export declare class CommitWorker {
+    private readonly env;
+    private readonly serviceId;
+    private readonly hooks;
+    constructor(env: CommitWorkerEnv, serviceId: string, hooks?: CommitWorkerHooks);
+    handle(request: Request): Promise<Response>;
+    private handleUntraced;
+    private tagFor;
+    /**
+     * `sdt.commit/v1` still has the historical S04/S05 row identities in its
+     * separately-owned G30 manifest.  G41 keeps those observations zero-work
+     * until that trace schema is revised by its owner, while proving that they
+     * cannot perform a JOURNAL namespace operation.  These spans are not a
+     * substitute for a Journal record or terminal-outcome authority.
+     */
+    private retiredJournalMilestone;
+    private bootstrapCommand;
+    private postJson;
+    private tagRequest;
+    private acquireReservations;
+    private allocate;
+    private readAllocation;
+    private withAllocatedSuids;
+    private appendAllTags;
+    /**
+     * Settle the same force-tombstone barrier used by the durable reservation
+     * failure path.  A concurrently-started admission can reject after one or
+     * more acquire calls have succeeded; in that branch there is no terminal
+     * Journal record to perform this cleanup on the caller's behalf.
+     */
+    private cancelReservations;
+    private finishReservationFailure;
+    /**
+     * Persist the local partial-write fact for each tag whose append did not
+     * commit.  This is not a response decoration: the Tag DO's fence is the
+     * source-side authority used by read and repair/reconciliation seams.
+     */
+    private installPartialWriteFences;
+    private partialWriteOutcome;
+    private successResponse;
+    /** The response was lost after tag-local facts may already be authoritative. */
+    private noApplicationOutcome;
+}
+export declare function handleSerializedCommit(request: Request, env: CommitWorkerEnv, hooks?: CommitWorkerHooks): Promise<Response>;