@cloudbitmaps/core 0.1.3 → 0.3.0

package/dist/index.d.cts

@@ -122,6 +122,29 @@ declare function resolvePerOpBudget(opt: BudgetOption | undefined, storeBudget:
  * (disabled).
  */
 declare function checkBudget(budget: Budget | null, projectedRequests: number, op: string): void;
+/**
+ * Drain an async iterable into an array, refusing **as soon as** the budget is exceeded.
+ *
+ * This exists because the obvious spelling is wrong in a way that is easy to miss:
+ *
+ * ```ts
+ * for await (const rec of registry.list(ns)) recs.push(rec);
+ * checkBudget(budget, recs.length, op);   // ← too late; the memory is already spent
+ * ```
+ *
+ * That pattern bounds the **fan-out** but not the **enumeration**, so a tight budget refuses the work only
+ * after paying for the list — which defeats the purpose. It was measured buffering 20,000 registry records
+ * under `budget: { maxRequests: 2 }` before throwing. Draining incrementally bounds resident memory to
+ * `O(budget)` instead of `O(fleet)`.
+ *
+ * **The error message is deliberately vaguer than `checkBudget`'s.** It reports "more than N" rather than an
+ * exact total, because knowing the exact total requires finishing the scan — which is precisely the cost being
+ * refused. An honest approximation beats an expensive exact number.
+ *
+ * A `null` budget (`budget: false`) means the caller has explicitly opted out of fan-out limits, so this
+ * degrades to a plain drain.
+ */
+declare function collectWithinBudget<T>(source: AsyncIterable<T>, budget: Budget | null, op: string): Promise<T[]>;
 
 /**
  * The determinism seam.
@@ -430,6 +453,15 @@ declare function isTransient(err: unknown): boolean;
  */
 declare function withRetry<T>(op: () => Promise<T>, policy: RetryPolicy, deps: RetryDeps): Promise<T>;
 
+/**
+ * Default ceiling on resident warm-delta bytes for a single segment scan: 64 MiB.
+ *
+ * Chosen to be generous enough that no realistic segment trips it — a maximally-wide segment of 65,536 chunks
+ * would need ~1 KiB of warm delta per chunk to reach it — while still being small enough to keep a modest
+ * container (a 512 MiB Lambda, say) alive rather than OOM-killed when a pathological segment or a hostile
+ * caller shows up.
+ */
+declare const DEFAULT_MAX_WARM_SCAN_BYTES: number;
 interface EngineDeps {
     readonly warm: IWarmDriver;
     readonly cold: ColdChunkSource;
@@ -463,6 +495,19 @@ interface EngineDeps {
      * row, so bounded concurrency is safe (`addMany` is already non-atomic on partial failure).
      */
     readonly writeConcurrency?: number;
+    /**
+     * Hard ceiling on the bytes one warm scan may hold resident, in bytes. Default {@link DEFAULT_MAX_WARM_SCAN_BYTES}.
+     *
+     * **Separate from `budget`, and enforced even when `budget: false`.** The budget bounds *cost* — billable
+     * requests — which is a different axis from memory, and conflating the two is what let a segment with
+     * thousands of warm chunks materialise ~12 MB before a `maxRequests: 2` budget could refuse it. It is also
+     * why `intersect` cannot use the budget as a memory bound: its budget is `common keys × operands`, a product
+     * that one wide operand can legitimately exceed in row count while staying entirely legal.
+     *
+     * Always on, because a ceiling that `budget: false` switches off is missing at exactly the moment it is
+     * needed. Configurable, because a ceiling you cannot raise is a landmine for a legitimately large segment.
+     */
+    readonly maxWarmScanBytes?: number;
     /**
      * Per-op denial-of-wallet budget (07 Decision #3 / T3), already resolved by the facade: a {@link Budget} to
      * enforce, or `null` to disable. Undefined ⇒ {@link DEFAULT_BUDGET} (a direct engine construction still gets
@@ -485,6 +530,7 @@ declare class SegmentEngine {
     /** Consistency for READ-path Warm fetches (precomputed; OCC RMW passes strong explicitly, see `warmGet`). */
     private readonly readOpts;
     private readonly writeConcurrency;
+    private readonly maxWarmScanBytes;
     /** Resolved per-op budget (null = disabled); undefined deps ⇒ the generous default. See {@link checkBudget}. */
     private readonly budget;
     constructor(deps: EngineDeps);
@@ -1791,6 +1837,20 @@ declare function eraseNamespace(namespace: string, deps: EraseDeps, options: {
  * to confirm a reported tear.
  */
 
+/** Default in-flight fan-out for the consistency scan — bounded, no thundering herd. */
+/**
+ * Default ceiling on how many registry records one consistency check may hold resident: 250,000.
+ *
+ * **Named `maxScanSegments`, not `maxSegments`, on purpose.** Compaction already has a `maxSegments`
+ * (`CR_COMPACT_MAX_SEGMENTS`) that caps how much work one cycle does and then *continues normally*. This one
+ * caps how much a scan may hold and *refuses* past it. Same-sounding names with opposite behaviour at the
+ * limit is a trap; pairing this with `maxWarmScanBytes` instead makes both read as what they are — ceilings on
+ * a scan that fail closed.
+ *
+ * Generous — the compaction docs target 100K+ segment fleets — while still bounding a DR drill's memory to
+ * something a modest operator box survives. Raisable, because a ceiling you cannot lift is a landmine.
+ */
+declare const DEFAULT_MAX_SCAN_SEGMENTS = 250000;
 interface ConsistencyIssue {
     readonly segment: string;
     readonly namespace?: string;
@@ -1830,6 +1890,7 @@ declare function runConsistencyCheck(deps: {
 }, options?: {
     namespace?: string;
     concurrency?: number;
+    maxScanSegments?: number;
 }): Promise<ConsistencyReport>;
 
 /**
@@ -1963,4 +2024,4 @@ declare class CrbmWriter {
     private buildFooter;
 }
 
-export { AWS_US_EAST_1_ONDEMAND, Aead, AeadSealed, type AuditEvent, type AuditEventKind, BlobReader, BlobSink, BoundedLru, type Budget, BudgetExceededError, type BudgetOption, type BulkLoadResult, CapabilityError, ChunkRef, type Clock, CloudRoaringError, type CodecBitmap, type CodecInterface, ColdCaps, ColdChunkSource, type CompactionCandidate, type CompactionCycleResult, type CompactionDeps, type CompactionOptions, type CompactionResult, type ConsistencyErrorEntry, type ConsistencyIssue, type ConsistencyReport, type CostAdvisory, type CostReport, CountingMetricsSink, CrbmColdChunkSource, type CrbmColdChunkSourceOptions, CrbmCrypto, CrbmReader, type CrbmReaderOptions, CrbmWriter, type CrbmWriterOptions, DEFAULT_BUDGET, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETRY_POLICY, type DestroyResult, type DiscoveryOptions, type EngineDeps, type EraseDeps, type EstimateInput, type ExportFailure, type ExportFormat, type ExportManifest, type ExportOptions, type ExportSink, type ExportWriter, type ExportedSegment, GenKey, type IAuditSink, IColdDriver, IKeystore, type IMetricsSink, IRegistryDriver, IWarmDriver, InProcessKeystore, type InProcessKeystoreOptions, IntegrityError, KeyUnavailableError, LocalFsColdDriver, LocalFsRegistryDriver, type LocalFsRegistryDriverOptions, LocalFsWarmDriver, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, type MemoryRegistryDriverOptions, MemoryWarmDriver, type MetricEvent, type MetricOpName, type MetricsSnapshot, NOOP_AUDIT, NOOP_METRICS, NewRegistryRecord, NoRow, NodeAead, NotFoundError, type PricingProfile, RecordingAuditSink, RegCaps, RegistryPatch, RegistryRecord, type RetryDeps, type RetryPolicy, RetryingColdChunkSource, RetryingColdDriver, type RetryingOptions, RetryingRegistryDriver, RetryingWarmDriver, type Rng, SegmentEngine, SegmentRef, SegmentSize, type SegmentSizing, TimeoutError, Token, type Topology, TransientError, UnsupportedError, ValidationError, WarmReadOptions, WarmRow, type Workload, WrappedDek, WriteConflictError, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, compactSegment, destroySegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, groundedReport, isCloudRoaringError, isIntegrityError, isNotFoundError, isTransient, isTransientError, isValidationError, isWriteConflictError, joinId, mapWithConcurrency, publishGeneration, resolveBudget, resolvePerOpBudget, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, splitId, validateCompactionOptions, validateSegmentRef, withRetry, writeCrbmGeneration };
+export { AWS_US_EAST_1_ONDEMAND, Aead, AeadSealed, type AuditEvent, type AuditEventKind, BlobReader, BlobSink, BoundedLru, type Budget, BudgetExceededError, type BudgetOption, type BulkLoadResult, CapabilityError, ChunkRef, type Clock, CloudRoaringError, type CodecBitmap, type CodecInterface, ColdCaps, ColdChunkSource, type CompactionCandidate, type CompactionCycleResult, type CompactionDeps, type CompactionOptions, type CompactionResult, type ConsistencyErrorEntry, type ConsistencyIssue, type ConsistencyReport, type CostAdvisory, type CostReport, CountingMetricsSink, CrbmColdChunkSource, type CrbmColdChunkSourceOptions, CrbmCrypto, CrbmReader, type CrbmReaderOptions, CrbmWriter, type CrbmWriterOptions, DEFAULT_BUDGET, DEFAULT_MAX_SCAN_SEGMENTS, DEFAULT_MAX_WARM_SCAN_BYTES, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETRY_POLICY, type DestroyResult, type DiscoveryOptions, type EngineDeps, type EraseDeps, type EstimateInput, type ExportFailure, type ExportFormat, type ExportManifest, type ExportOptions, type ExportSink, type ExportWriter, type ExportedSegment, GenKey, type IAuditSink, IColdDriver, IKeystore, type IMetricsSink, IRegistryDriver, IWarmDriver, InProcessKeystore, type InProcessKeystoreOptions, IntegrityError, KeyUnavailableError, LocalFsColdDriver, LocalFsRegistryDriver, type LocalFsRegistryDriverOptions, LocalFsWarmDriver, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, type MemoryRegistryDriverOptions, MemoryWarmDriver, type MetricEvent, type MetricOpName, type MetricsSnapshot, NOOP_AUDIT, NOOP_METRICS, NewRegistryRecord, NoRow, NodeAead, NotFoundError, type PricingProfile, RecordingAuditSink, RegCaps, RegistryPatch, RegistryRecord, type RetryDeps, type RetryPolicy, RetryingColdChunkSource, RetryingColdDriver, type RetryingOptions, RetryingRegistryDriver, RetryingWarmDriver, type Rng, SegmentEngine, SegmentRef, SegmentSize, type SegmentSizing, TimeoutError, Token, type Topology, TransientError, UnsupportedError, ValidationError, WarmReadOptions, WarmRow, type Workload, WrappedDek, WriteConflictError, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, collectWithinBudget, compactSegment, destroySegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, groundedReport, isCloudRoaringError, isIntegrityError, isNotFoundError, isTransient, isTransientError, isValidationError, isWriteConflictError, joinId, mapWithConcurrency, publishGeneration, resolveBudget, resolvePerOpBudget, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, splitId, validateCompactionOptions, validateSegmentRef, withRetry, writeCrbmGeneration };

package/dist/index.d.ts

@@ -122,6 +122,29 @@ declare function resolvePerOpBudget(opt: BudgetOption | undefined, storeBudget:
  * (disabled).
  */
 declare function checkBudget(budget: Budget | null, projectedRequests: number, op: string): void;
+/**
+ * Drain an async iterable into an array, refusing **as soon as** the budget is exceeded.
+ *
+ * This exists because the obvious spelling is wrong in a way that is easy to miss:
+ *
+ * ```ts
+ * for await (const rec of registry.list(ns)) recs.push(rec);
+ * checkBudget(budget, recs.length, op);   // ← too late; the memory is already spent
+ * ```
+ *
+ * That pattern bounds the **fan-out** but not the **enumeration**, so a tight budget refuses the work only
+ * after paying for the list — which defeats the purpose. It was measured buffering 20,000 registry records
+ * under `budget: { maxRequests: 2 }` before throwing. Draining incrementally bounds resident memory to
+ * `O(budget)` instead of `O(fleet)`.
+ *
+ * **The error message is deliberately vaguer than `checkBudget`'s.** It reports "more than N" rather than an
+ * exact total, because knowing the exact total requires finishing the scan — which is precisely the cost being
+ * refused. An honest approximation beats an expensive exact number.
+ *
+ * A `null` budget (`budget: false`) means the caller has explicitly opted out of fan-out limits, so this
+ * degrades to a plain drain.
+ */
+declare function collectWithinBudget<T>(source: AsyncIterable<T>, budget: Budget | null, op: string): Promise<T[]>;
 
 /**
  * The determinism seam.
@@ -430,6 +453,15 @@ declare function isTransient(err: unknown): boolean;
  */
 declare function withRetry<T>(op: () => Promise<T>, policy: RetryPolicy, deps: RetryDeps): Promise<T>;
 
+/**
+ * Default ceiling on resident warm-delta bytes for a single segment scan: 64 MiB.
+ *
+ * Chosen to be generous enough that no realistic segment trips it — a maximally-wide segment of 65,536 chunks
+ * would need ~1 KiB of warm delta per chunk to reach it — while still being small enough to keep a modest
+ * container (a 512 MiB Lambda, say) alive rather than OOM-killed when a pathological segment or a hostile
+ * caller shows up.
+ */
+declare const DEFAULT_MAX_WARM_SCAN_BYTES: number;
 interface EngineDeps {
     readonly warm: IWarmDriver;
     readonly cold: ColdChunkSource;
@@ -463,6 +495,19 @@ interface EngineDeps {
      * row, so bounded concurrency is safe (`addMany` is already non-atomic on partial failure).
      */
     readonly writeConcurrency?: number;
+    /**
+     * Hard ceiling on the bytes one warm scan may hold resident, in bytes. Default {@link DEFAULT_MAX_WARM_SCAN_BYTES}.
+     *
+     * **Separate from `budget`, and enforced even when `budget: false`.** The budget bounds *cost* — billable
+     * requests — which is a different axis from memory, and conflating the two is what let a segment with
+     * thousands of warm chunks materialise ~12 MB before a `maxRequests: 2` budget could refuse it. It is also
+     * why `intersect` cannot use the budget as a memory bound: its budget is `common keys × operands`, a product
+     * that one wide operand can legitimately exceed in row count while staying entirely legal.
+     *
+     * Always on, because a ceiling that `budget: false` switches off is missing at exactly the moment it is
+     * needed. Configurable, because a ceiling you cannot raise is a landmine for a legitimately large segment.
+     */
+    readonly maxWarmScanBytes?: number;
     /**
      * Per-op denial-of-wallet budget (07 Decision #3 / T3), already resolved by the facade: a {@link Budget} to
      * enforce, or `null` to disable. Undefined ⇒ {@link DEFAULT_BUDGET} (a direct engine construction still gets
@@ -485,6 +530,7 @@ declare class SegmentEngine {
     /** Consistency for READ-path Warm fetches (precomputed; OCC RMW passes strong explicitly, see `warmGet`). */
     private readonly readOpts;
     private readonly writeConcurrency;
+    private readonly maxWarmScanBytes;
     /** Resolved per-op budget (null = disabled); undefined deps ⇒ the generous default. See {@link checkBudget}. */
     private readonly budget;
     constructor(deps: EngineDeps);
@@ -1791,6 +1837,20 @@ declare function eraseNamespace(namespace: string, deps: EraseDeps, options: {
  * to confirm a reported tear.
  */
 
+/** Default in-flight fan-out for the consistency scan — bounded, no thundering herd. */
+/**
+ * Default ceiling on how many registry records one consistency check may hold resident: 250,000.
+ *
+ * **Named `maxScanSegments`, not `maxSegments`, on purpose.** Compaction already has a `maxSegments`
+ * (`CR_COMPACT_MAX_SEGMENTS`) that caps how much work one cycle does and then *continues normally*. This one
+ * caps how much a scan may hold and *refuses* past it. Same-sounding names with opposite behaviour at the
+ * limit is a trap; pairing this with `maxWarmScanBytes` instead makes both read as what they are — ceilings on
+ * a scan that fail closed.
+ *
+ * Generous — the compaction docs target 100K+ segment fleets — while still bounding a DR drill's memory to
+ * something a modest operator box survives. Raisable, because a ceiling you cannot lift is a landmine.
+ */
+declare const DEFAULT_MAX_SCAN_SEGMENTS = 250000;
 interface ConsistencyIssue {
     readonly segment: string;
     readonly namespace?: string;
@@ -1830,6 +1890,7 @@ declare function runConsistencyCheck(deps: {
 }, options?: {
     namespace?: string;
     concurrency?: number;
+    maxScanSegments?: number;
 }): Promise<ConsistencyReport>;
 
 /**
@@ -1963,4 +2024,4 @@ declare class CrbmWriter {
     private buildFooter;
 }
 
-export { AWS_US_EAST_1_ONDEMAND, Aead, AeadSealed, type AuditEvent, type AuditEventKind, BlobReader, BlobSink, BoundedLru, type Budget, BudgetExceededError, type BudgetOption, type BulkLoadResult, CapabilityError, ChunkRef, type Clock, CloudRoaringError, type CodecBitmap, type CodecInterface, ColdCaps, ColdChunkSource, type CompactionCandidate, type CompactionCycleResult, type CompactionDeps, type CompactionOptions, type CompactionResult, type ConsistencyErrorEntry, type ConsistencyIssue, type ConsistencyReport, type CostAdvisory, type CostReport, CountingMetricsSink, CrbmColdChunkSource, type CrbmColdChunkSourceOptions, CrbmCrypto, CrbmReader, type CrbmReaderOptions, CrbmWriter, type CrbmWriterOptions, DEFAULT_BUDGET, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETRY_POLICY, type DestroyResult, type DiscoveryOptions, type EngineDeps, type EraseDeps, type EstimateInput, type ExportFailure, type ExportFormat, type ExportManifest, type ExportOptions, type ExportSink, type ExportWriter, type ExportedSegment, GenKey, type IAuditSink, IColdDriver, IKeystore, type IMetricsSink, IRegistryDriver, IWarmDriver, InProcessKeystore, type InProcessKeystoreOptions, IntegrityError, KeyUnavailableError, LocalFsColdDriver, LocalFsRegistryDriver, type LocalFsRegistryDriverOptions, LocalFsWarmDriver, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, type MemoryRegistryDriverOptions, MemoryWarmDriver, type MetricEvent, type MetricOpName, type MetricsSnapshot, NOOP_AUDIT, NOOP_METRICS, NewRegistryRecord, NoRow, NodeAead, NotFoundError, type PricingProfile, RecordingAuditSink, RegCaps, RegistryPatch, RegistryRecord, type RetryDeps, type RetryPolicy, RetryingColdChunkSource, RetryingColdDriver, type RetryingOptions, RetryingRegistryDriver, RetryingWarmDriver, type Rng, SegmentEngine, SegmentRef, SegmentSize, type SegmentSizing, TimeoutError, Token, type Topology, TransientError, UnsupportedError, ValidationError, WarmReadOptions, WarmRow, type Workload, WrappedDek, WriteConflictError, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, compactSegment, destroySegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, groundedReport, isCloudRoaringError, isIntegrityError, isNotFoundError, isTransient, isTransientError, isValidationError, isWriteConflictError, joinId, mapWithConcurrency, publishGeneration, resolveBudget, resolvePerOpBudget, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, splitId, validateCompactionOptions, validateSegmentRef, withRetry, writeCrbmGeneration };
+export { AWS_US_EAST_1_ONDEMAND, Aead, AeadSealed, type AuditEvent, type AuditEventKind, BlobReader, BlobSink, BoundedLru, type Budget, BudgetExceededError, type BudgetOption, type BulkLoadResult, CapabilityError, ChunkRef, type Clock, CloudRoaringError, type CodecBitmap, type CodecInterface, ColdCaps, ColdChunkSource, type CompactionCandidate, type CompactionCycleResult, type CompactionDeps, type CompactionOptions, type CompactionResult, type ConsistencyErrorEntry, type ConsistencyIssue, type ConsistencyReport, type CostAdvisory, type CostReport, CountingMetricsSink, CrbmColdChunkSource, type CrbmColdChunkSourceOptions, CrbmCrypto, CrbmReader, type CrbmReaderOptions, CrbmWriter, type CrbmWriterOptions, DEFAULT_BUDGET, DEFAULT_MAX_SCAN_SEGMENTS, DEFAULT_MAX_WARM_SCAN_BYTES, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETRY_POLICY, type DestroyResult, type DiscoveryOptions, type EngineDeps, type EraseDeps, type EstimateInput, type ExportFailure, type ExportFormat, type ExportManifest, type ExportOptions, type ExportSink, type ExportWriter, type ExportedSegment, GenKey, type IAuditSink, IColdDriver, IKeystore, type IMetricsSink, IRegistryDriver, IWarmDriver, InProcessKeystore, type InProcessKeystoreOptions, IntegrityError, KeyUnavailableError, LocalFsColdDriver, LocalFsRegistryDriver, type LocalFsRegistryDriverOptions, LocalFsWarmDriver, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, type MemoryRegistryDriverOptions, MemoryWarmDriver, type MetricEvent, type MetricOpName, type MetricsSnapshot, NOOP_AUDIT, NOOP_METRICS, NewRegistryRecord, NoRow, NodeAead, NotFoundError, type PricingProfile, RecordingAuditSink, RegCaps, RegistryPatch, RegistryRecord, type RetryDeps, type RetryPolicy, RetryingColdChunkSource, RetryingColdDriver, type RetryingOptions, RetryingRegistryDriver, RetryingWarmDriver, type Rng, SegmentEngine, SegmentRef, SegmentSize, type SegmentSizing, TimeoutError, Token, type Topology, TransientError, UnsupportedError, ValidationError, WarmReadOptions, WarmRow, type Workload, WrappedDek, WriteConflictError, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, collectWithinBudget, compactSegment, destroySegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, groundedReport, isCloudRoaringError, isIntegrityError, isNotFoundError, isTransient, isTransientError, isValidationError, isWriteConflictError, joinId, mapWithConcurrency, publishGeneration, resolveBudget, resolvePerOpBudget, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, splitId, validateCompactionOptions, validateSegmentRef, withRetry, writeCrbmGeneration };

package/dist/index.js

@@ -117,6 +117,18 @@ function checkBudget(budget, projectedRequests, op) {
     );
   }
 }
+async function collectWithinBudget(source, budget, op) {
+  const out = [];
+  for await (const item of source) {
+    out.push(item);
+    if (budget !== null && out.length > budget.maxRequests) {
+      throw new BudgetExceededError(
+        `${op} would fan out to more than ${budget.maxRequests} units, over the per-op budget \u2014 the scan was abandoned at that point rather than completed, so no exact total is available. Raise \`budget.maxRequests\`, override it per-op, or set \`budget: false\``
+      );
+    }
+  }
+  return out;
+}
 
 // src/core/keys.ts
 var FIELD = " ";
@@ -310,6 +322,7 @@ var ZeroRng = class {
     return 0;
   }
 };
+var DEFAULT_MAX_WARM_SCAN_BYTES = 64 * 1024 * 1024;
 var SegmentEngine = class {
   warm;
   cold;
@@ -325,6 +338,7 @@ var SegmentEngine = class {
   /** Consistency for READ-path Warm fetches (precomputed; OCC RMW passes strong explicitly, see `warmGet`). */
   readOpts;
   writeConcurrency;
+  maxWarmScanBytes;
   /** Resolved per-op budget (null = disabled); undefined deps ⇒ the generous default. See {@link checkBudget}. */
   budget;
   constructor(deps) {
@@ -339,6 +353,12 @@ var SegmentEngine = class {
     this.occBackoff = deps.occBackoff ?? DEFAULT_OCC_BACKOFF;
     this.readOpts = { consistent: (deps.warmReadConsistency ?? "strong") !== "eventual" };
     this.writeConcurrency = deps.writeConcurrency ?? 1;
+    this.maxWarmScanBytes = deps.maxWarmScanBytes ?? DEFAULT_MAX_WARM_SCAN_BYTES;
+    if (!Number.isFinite(this.maxWarmScanBytes) || this.maxWarmScanBytes < 1) {
+      throw new ValidationError(
+        `maxWarmScanBytes must be a finite number >= 1 (got ${String(deps.maxWarmScanBytes)})`
+      );
+    }
     this.budget = deps.budget === void 0 ? DEFAULT_BUDGET : deps.budget;
     this.metrics = safeMetrics(deps.metrics ?? NOOP_METRICS);
     this.metricsOn = this.metrics !== NOOP_METRICS;
@@ -370,7 +390,7 @@ var SegmentEngine = class {
     return cold ? cold.has(remainder) : false;
   }
   async count(seg) {
-    const warmRows = await this.collectWarm(seg);
+    const warmRows = await this.collectWarm(seg, "count", this.budget?.maxRequests ?? null);
     const cardinalities = this.cold.cardinalities ? await this.cold.cardinalities(seg) : null;
     if (!cardinalities) {
       const chunkKeys = await this.chunkKeys(seg, warmRows);
@@ -402,7 +422,7 @@ var SegmentEngine = class {
     return this.cold.sizeOf ? this.cold.sizeOf(seg) : Promise.resolve(null);
   }
   async *iterate(seg) {
-    const warmRows = await this.collectWarm(seg);
+    const warmRows = await this.collectWarm(seg, "iterate", this.budget?.maxRequests ?? null);
     const chunkKeys = await this.chunkKeys(seg, warmRows);
     checkBudget(this.budget, chunkKeys.length, "iterate");
     const gen = await this.currentGen(seg);
@@ -449,7 +469,7 @@ var SegmentEngine = class {
     const budget = resolvePerOpBudget(options?.budget, this.budget);
     const operands = await Promise.all(
       segs.map(async (seg) => {
-        const warmRows = await this.collectWarm(seg);
+        const warmRows = await this.collectWarm(seg, "intersect", null);
         const keys = await this.chunkKeys(seg, warmRows);
         const gen = await this.currentGen(seg);
         return { seg, warmRows, keys: new Set(keys), gen };
@@ -590,12 +610,22 @@ var SegmentEngine = class {
     }
     return row;
   }
-  async collectWarm(seg) {
+  async collectWarm(seg, op, rowCeiling) {
     const rows = /* @__PURE__ */ new Map();
     let bytes = 0;
     for await (const row of this.warm.listChunks(seg, this.readOpts)) {
       rows.set(row.chunkKey, row.bytes);
       bytes += row.bytes.length;
+      if (bytes > this.maxWarmScanBytes) {
+        throw new BudgetExceededError(
+          `${op} would hold more than ${this.maxWarmScanBytes} bytes of warm deltas resident for one segment \u2014 the scan was abandoned there rather than completed. Raise \`maxWarmScanBytes\`, narrow the segment, or compact it so fewer chunks carry warm deltas. (This ceiling is independent of \`budget\` and stays in force when \`budget: false\`.)`
+        );
+      }
+      if (rowCeiling !== null && rows.size > rowCeiling) {
+        throw new BudgetExceededError(
+          `${op} would read more than ${rowCeiling} warm chunk rows, over the per-op budget \u2014 the scan was abandoned at that point rather than completed, so no exact total is available. Raise \`budget.maxRequests\`, override it per-op, or set \`budget: false\``
+        );
+      }
     }
     if (this.metricsOn) {
       this.metrics.onEvent({
@@ -1083,22 +1113,44 @@ function aadFor(ref, generation, scope) {
 }
 
 // src/core/crbm/crc32c.ts
-var TABLE = (() => {
+var TABLES = (() => {
   const POLY = 2197175160;
-  const table = new Uint32Array(256);
+  const t0 = new Uint32Array(256);
   for (let n = 0; n < 256; n++) {
     let c = n;
-    for (let k = 0; k < 8; k++) {
-      c = c & 1 ? POLY ^ c >>> 1 : c >>> 1;
+    for (let k = 0; k < 8; k++) c = c & 1 ? POLY ^ c >>> 1 : c >>> 1;
+    t0[n] = c >>> 0;
+  }
+  const tables = [t0];
+  for (let k = 1; k < 8; k++) {
+    const prev = tables[k - 1];
+    const next = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+      const v = prev[n];
+      next[n] = (v >>> 8 ^ t0[v & 255]) >>> 0;
     }
-    table[n] = c >>> 0;
+    tables.push(next);
   }
-  return table;
+  return tables;
 })();
+var T0 = TABLES[0];
+var T1 = TABLES[1];
+var T2 = TABLES[2];
+var T3 = TABLES[3];
+var T4 = TABLES[4];
+var T5 = TABLES[5];
+var T6 = TABLES[6];
+var T7 = TABLES[7];
 function crc32c(bytes, seed = 0) {
   let crc = (seed ^ 4294967295) >>> 0;
-  for (let i = 0; i < bytes.length; i++) {
-    crc = (TABLE[(crc ^ bytes[i]) & 255] ^ crc >>> 8) >>> 0;
+  let i = 0;
+  const n8 = bytes.length - bytes.length % 8;
+  for (; i < n8; i += 8) {
+    crc ^= bytes[i] | bytes[i + 1] << 8 | bytes[i + 2] << 16 | bytes[i + 3] << 24;
+    crc = (T7[crc & 255] ^ T6[crc >>> 8 & 255] ^ T5[crc >>> 16 & 255] ^ T4[crc >>> 24 & 255] ^ T3[bytes[i + 4]] ^ T2[bytes[i + 5]] ^ T1[bytes[i + 6]] ^ T0[bytes[i + 7]]) >>> 0;
+  }
+  for (; i < bytes.length; i++) {
+    crc = (T0[(crc ^ bytes[i]) & 255] ^ crc >>> 8) >>> 0;
   }
   return (crc ^ 4294967295) >>> 0;
 }
@@ -1609,6 +1661,7 @@ function coldBlobReader(driver, key) {
   };
 }
 var DEFAULT_CURRENT_GEN_TTL_MS = 2e3;
+var BULK_FLUSH_IDS = 1 << 20;
 var DEFAULT_MAX_OPEN_SEGMENTS = 1024;
 var DEFAULT_MAX_OPEN_INDEX_BYTES = 64 * 1024 * 1024;
 var CrbmColdChunkSource = class {
@@ -1886,15 +1939,29 @@ async function bulkLoadCrbmGeneration(driver, key, ids, options = {}) {
   }
   const codec = requireCodec(options.codec, "bulkLoadCrbmGeneration");
   const byChunk = /* @__PURE__ */ new Map();
+  const pendingByChunk = /* @__PURE__ */ new Map();
+  let pending = 0;
+  const flushPending = () => {
+    for (const [chunkKey, rems] of pendingByChunk) {
+      if (rems.length === 0) continue;
+      const existingBitmap = byChunk.get(chunkKey);
+      if (existingBitmap === void 0) byChunk.set(chunkKey, codec.fromValues(rems));
+      else existingBitmap.addMany(rems);
+      rems.length = 0;
+    }
+    pending = 0;
+  };
   for await (const id of toAsyncIterable(ids)) {
     const { chunkKey, remainder } = splitId(id);
-    let bitmap = byChunk.get(chunkKey);
-    if (bitmap === void 0) {
-      bitmap = codec.empty();
-      byChunk.set(chunkKey, bitmap);
+    let bucket = pendingByChunk.get(chunkKey);
+    if (bucket === void 0) {
+      bucket = [];
+      pendingByChunk.set(chunkKey, bucket);
     }
-    bitmap.add(remainder);
+    bucket.push(remainder);
+    if (++pending >= BULK_FLUSH_IDS) flushPending();
   }
+  flushPending();
   let cardinality = 0;
   const chunks = [];
   for (const [chunkKey, bitmap] of byChunk) {
@@ -3472,6 +3539,7 @@ async function eraseWarm(warm, ref) {
 }
 
 // src/core/consistency.ts
+var DEFAULT_MAX_SCAN_SEGMENTS = 25e4;
 var DEFAULT_CHECK_CONCURRENCY = 8;
 async function listGenerations(cold, ref) {
   const present = /* @__PURE__ */ new Set();
@@ -3483,8 +3551,21 @@ async function runConsistencyCheck(deps, options = {}) {
   if (!Number.isInteger(concurrency) || concurrency < 1) {
     throw new ValidationError(`concurrency must be a positive integer; got ${concurrency}`);
   }
+  const maxScanSegments = options.maxScanSegments ?? DEFAULT_MAX_SCAN_SEGMENTS;
+  if (!Number.isFinite(maxScanSegments) || maxScanSegments < 1) {
+    throw new ValidationError(
+      `maxScanSegments must be a finite number >= 1; got ${String(options.maxScanSegments)}`
+    );
+  }
   const recs = [];
-  for await (const rec of deps.registry.list(options.namespace)) recs.push(rec);
+  for await (const rec of deps.registry.list(options.namespace)) {
+    recs.push(rec);
+    if (recs.length > maxScanSegments) {
+      throw new BudgetExceededError(
+        `checkConsistency would enumerate more than ${maxScanSegments} segments \u2014 the scan was abandoned there rather than completed. Narrow it with \`namespace\`, or raise \`maxScanSegments\` if the fleet really is that large and the memory is available.`
+      );
+    }
+  }
   const results = await mapWithConcurrency(recs, concurrency, async (rec) => {
     if (rec.status === "destroyed") return { kind: "ok" };
     const ref = { segment: rec.segment, namespace: rec.namespace };
@@ -3676,6 +3757,6 @@ var RetryingRegistryDriver = class {
   }
 };
 
-export { AWS_US_EAST_1_ONDEMAND, BoundedLru, BufferReader, BufferSink, CountingMetricsSink, CrbmColdChunkSource, CrbmReader, CrbmWriter, DEFAULT_BUDGET, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETRY_POLICY, InProcessKeystore, LocalFsColdDriver, LocalFsRegistryDriver, LocalFsWarmDriver, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, MemoryWarmDriver, NOOP_AUDIT, NOOP_METRICS, NodeAead, RecordingAuditSink, RetryingColdChunkSource, RetryingColdDriver, RetryingRegistryDriver, RetryingWarmDriver, SegmentEngine, aadFor, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, compactSegment, destroySegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, groundedReport, isTransient, joinId, publishGeneration, resolveBudget, resolvePerOpBudget, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, splitId, validateCompactionOptions, withRetry, writeCrbmGeneration };
+export { AWS_US_EAST_1_ONDEMAND, BoundedLru, BufferReader, BufferSink, CountingMetricsSink, CrbmColdChunkSource, CrbmReader, CrbmWriter, DEFAULT_BUDGET, DEFAULT_MAX_SCAN_SEGMENTS, DEFAULT_MAX_WARM_SCAN_BYTES, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETRY_POLICY, InProcessKeystore, LocalFsColdDriver, LocalFsRegistryDriver, LocalFsWarmDriver, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, MemoryWarmDriver, NOOP_AUDIT, NOOP_METRICS, NodeAead, RecordingAuditSink, RetryingColdChunkSource, RetryingColdDriver, RetryingRegistryDriver, RetryingWarmDriver, SegmentEngine, aadFor, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, collectWithinBudget, compactSegment, destroySegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, groundedReport, isTransient, joinId, publishGeneration, resolveBudget, resolvePerOpBudget, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, splitId, validateCompactionOptions, withRetry, writeCrbmGeneration };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map