@cloudbitmaps/core 0.14.0 → 0.15.0

package/dist/core/crbm-storage-source.d.ts

@@ -1,8 +1,8 @@
 import { type IAuditSink } from './audit.js';
 import type { Yielder } from './cooperative.js';
 import type { Clock, Rng } from './determinism.js';
-import type { CrbmCrypto, IKeystore, WrappedDek } from './crypto.js';
-import type { ChunkRef, StorageChunkSource, GenerationMetadata, GenerationSummary, GenKey, IStorageDriver, IRegistryDriver, RegistryRecord, RegistrySummary, SegmentRef, SegmentSize, Token } from './ports.js';
+import type { Aead, CrbmCrypto, IKeystore, WrappedDek } from './crypto.js';
+import type { ChunkRef, ChunkRead, ReadChunksOptions, StorageChunkSource, GenerationMetadata, GenerationSummary, GenKey, IStorageDriver, IRegistryDriver, RegistryRecord, RegistrySummary, SegmentRef, SegmentSize, Token } from './ports.js';
 import { CrbmReader } from './crbm/reader.js';
 import type { CrbmReaderOptions } from './crbm/reader.js';
 import type { CodecBitmap, CodecInterface } from './codec.js';
@@ -55,12 +55,16 @@ export interface CrbmStorageChunkSourceOptions extends CrbmReaderOptions {
      */
     readonly maxOpenSegments?: number;
     /**
-     * Aggregate byte ceiling on the parsed `.crbm` indices resident in the reader cache (default 64 MiB) — the
+     * Aggregate byte ceiling on what the reader cache holds (default 64 MiB): the parsed `.crbm` indices, and the chunk bytes a
+     * reader keeps when its first read returned a whole small object (see below) — the
      * **second half of that memory bound**. `maxOpenSegments` alone bounds by *count*, but a wide/dense segment's
      * parsed index can reach about 1.3 MB, so 1024 wide indices could pin over a GB and blow a small heap (e.g. a 128 MB
      * Lambda) while the count is nominally "in bounds". This caps the summed {@link CrbmReader.retainedBytes} (the
-     * parsed index, and any metadata a generation carries) across cached readers; the least-recently-used reader is evicted once the total would exceed it — whichever
-     * of the count/byte bounds binds first. Lower it for memory-tight deployments with wide segments; a single
+     * parsed index, any metadata a generation carries, and any kept chunk bytes) across cached readers; the least-recently-used reader is evicted once the total would exceed it — whichever
+     * of the count/byte bounds binds first. A reader whose open read the whole object keeps a copy of its chunk region when
+     * that region is at most this ceiling divided by {@link maxOpenSegments} (64 KiB by default) — its fair share — so a small generation's
+     * chunks are served from memory with no further request, and a bigger one is read by range. Only a source with a timed
+     * pointer refresh ({@link currentGenTtlMs} above 0, a registry and a clock) keeps chunk bytes. Lower it for memory-tight deployments with wide segments; a single
      * segment whose index alone exceeds the budget is still cached (it can't be shrunk) but nothing else alongside.
      */
     readonly maxOpenIndexBytes?: number;
@@ -122,6 +126,8 @@ export declare class CrbmStorageChunkSource implements StorageChunkSource {
     private readonly keystore;
     private readonly requireEncryption;
     private readonly readerOptions;
+    /** The most chunk bytes a reader keeps from its open: the reader cache's byte bound over its count bound, per reader; 0 without a timed pointer refresh. */
+    private readonly keepChunkBytesUpTo;
     private readonly clock;
     private readonly currentGenTtlMs;
     constructor(driver: IStorageDriver, options?: CrbmStorageChunkSourceOptions);
@@ -317,6 +323,22 @@ export declare class CrbmStorageChunkSource implements StorageChunkSource {
     /** Build the per-generation decryption context for an encrypted segment (undefined for cleartext). */
     private cryptoForRead;
     getChunk(ref: ChunkRef): Promise<Uint8Array | null>;
+    /**
+     * Several chunks as a stream, in as few storage requests as {@link CrbmReader.readChunks} can make them (see
+     * {@link StorageChunkSource.getChunks}). The stream is served from one resolved generation, and every chunk says
+     * which version it came from. A generation swept, or an object replaced under its number, while the stream runs
+     * re-resolves the segment and carries on with the keys not yet yielded from whatever is current then, so each chunk
+     * is whole and from one generation and the stream may describe two; a second failure with no chunk yielded in between
+     * propagates. `options.retry` runs the resolution, each range request and the check that a failed read's object was
+     * replaced, so a transient fault repeats that step alone. Nothing is resolved until the first chunk is asked for.
+     */
+    getChunks(ref: SegmentRef, keys: readonly number[], options?: ReadChunksOptions): AsyncGenerator<ChunkRead>;
+    /**
+     * {@link getChunks} of a specific generation, the pinned shape read. It yields the chunks without a version: the
+     * caller that pinned the generation knows it. It never moves to another generation; `held` as for
+     * {@link getChunkAt}.
+     */
+    getChunksAt(ref: SegmentRef, generation: number, keys: readonly number[], held?: PinnedObject, options?: ReadChunksOptions): AsyncGenerator<Omit<ChunkRead, 'version'>>;
     listChunkKeys(ref: SegmentRef): Promise<number[]>;
     sizeOf(ref: SegmentRef): Promise<SegmentSize | null>;
     cardinalities(ref: SegmentRef): Promise<ReadonlyMap<number, number> | null>;
@@ -681,6 +703,28 @@ export declare function bulkLoadCrbmGeneration(driver: IStorageDriver, key: GenK
      */
     row?: RegistryRecord | null;
 }): Promise<BulkLoadResult>;
+/**
+ * What a load has already started when it calls {@link bulkLoadAhead}: its number, and the segment's data key, each
+ * still in flight so their round trips overlap the encoding. Both are joined where the write needs them, and neither
+ * may be left to reject unobserved.
+ */
+export interface LoadAhead {
+    /** The number the generation takes (see {@link nextLoadGeneration}); joined just before the object is written. */
+    readonly generation: PromiseLike<number>;
+    /**
+     * The key a caller already asked the keystore to unwrap, with the wrappings it asked about. Used only when the
+     * row the write reads after the ids carries exactly these wrappings; otherwise the write unwraps for itself.
+     */
+    readonly unwrapped?: {
+        readonly wrapped: readonly WrappedDek[];
+        readonly aead: PromiseLike<Aead>;
+    };
+}
+/**
+ * {@link bulkLoadCrbmGeneration} for a load whose number, and perhaps its key, are still being fetched: the same
+ * options, with the same meaning, and the same writes. The number is joined only where the object is written.
+ */
+export declare function bulkLoadAhead(driver: IStorageDriver, ref: SegmentRef, ahead: LoadAhead, ids: Iterable<number> | AsyncIterable<number> | DecodedLoadInput, options?: NonNullable<Parameters<typeof bulkLoadCrbmGeneration>[3]>): Promise<BulkLoadResult>;
 /**
  * Open a {@link CrbmReader} on one generation over the storage driver's range/tail reads (decrypting if `crypto`).
  * The reader the write paths use to re-read what they wrote, and the erasure rewrite uses to stream the old

package/dist/core/engine.d.ts

@@ -4,6 +4,13 @@ import type { Clock } from './determinism.js';
 import type { BoundedLru } from './lru.js';
 import type { IMetricsSink } from './metrics.js';
 import type { GenerationMetadata, StorageChunkSource, SegmentRef, SegmentSize } from './ports.js';
+/**
+ * Range requests a stream holds ahead of a combine or `iterate` by default (chunk keys, on a source that reads chunk by
+ * chunk, and for `count`'s fallback) — bounds memory and concurrent reads (invariant 6). A read that does not fit
+ * one range of a source's stream takes about one sequential round trip per this many ranges, so this, not the network,
+ * is what sets how long a long read takes.
+ */
+export declare const DEFAULT_INTERSECT_CONCURRENCY = 32;
 export interface EngineDeps {
     readonly storage: StorageChunkSource;
     /** Optional cache of decoded (immutable) Storage chunks. */
@@ -49,11 +56,15 @@ export interface IdRange {
 /** Options common to the chunk-aligned combines. */
 export interface CombineOptions extends IdRange {
     /**
-     * Max chunk keys resolved concurrently — bounds the Storage footprint (about `concurrency × operands` chunks in
-     * flight). A positive integer; default 32. The window opens 8 keys wide (or `concurrency`, if lower) and widens
-     * as keys are taken, so a read that stops early fetches no more than a few keys ahead; one that runs to the end
-     * spends nearly all of its round trips at the full width. A read that stops early has requested up to
-     * `concurrency` keys per operand past the last one it used.
+     * How far ahead each operand is read: a positive integer, default 32. The library's own stores read each operand as
+     * one stream of coalesced ranges (chunks that sit near each other are one request), and `concurrency` is how many
+     * range requests a stream holds ahead of the read, in flight or landed and not yet used. So about
+     * `concurrency × operands` requests are in flight at most, and, since a range is at most 1 MiB (one chunk, when a chunk
+     * is larger), about `concurrency × operands` MiB are held, whatever the segment's size. The stream opens 4 ranges wide
+     * (or `concurrency`, if lower) and widens as ranges are taken, so a read that stops early has asked for little past
+     * where it stopped, and a read that fits one range makes one request however many chunks it needs. A source that
+     * reads chunk by chunk (a custom one) is read as before: `concurrency` chunk keys at once, opening 8 wide. A running
+     * stream holds its operand's reader outside the reader cache's bounds until it ends or the segment moves on.
      */
     readonly concurrency?: number;
     /** Override the store's per-op budget for this call (`false` lifts it). */
@@ -83,6 +94,11 @@ export declare class SegmentEngine {
      * promise per distinct key in flight.
      */
     private readonly openReads;
+    /**
+     * The chunk streams open right now. An {@link invalidate} of a segment marks its streams, which then cache no chunk
+     * they deliver, as a read whose entry an invalidation dropped does not (streams hold no `openReads` entry).
+     */
+    private readonly openStreams;
     constructor(deps: EngineDeps);
     /** Membership: one chunk lookup — the cache, else one Storage fetch of that chunk. */
     has(seg: SegmentRef, id: number): Promise<boolean>;
@@ -117,9 +133,17 @@ export declare class SegmentEngine {
     /** The chunks of `seg` at `chunkKeys`, read through a window of {@link DEFAULT_INTERSECT_CONCURRENCY}. */
     private chunkWindow;
     /**
-     * Every id, ascending, reading ahead through a window of up to 32 chunk fetches that opens 1, 2, 4 … 32 wide, so a
-     * read that stops early has fetched only a handful of chunks past the one it stopped in; with `range`, only the ids in `(after, through]`, fetching only the
-     * chunks the range overlaps (see {@link IdRange}).
+     * The chunks of `seg` at `chunkKeys`, taken in ascending key order by a read that may stop at any point: one stream of
+     * coalesced ranges when the source has `getChunks`, opening 1, 2, 4 … ranges wide up to {@link DEFAULT_INTERSECT_CONCURRENCY},
+     * else the chunk-by-chunk window of that many reads. `close` stops what is left of it.
+     */
+    private chunkSequence;
+    /**
+     * Every id, ascending, reading the chunks as one stream of coalesced ranges (chunks that sit near each other are one
+     * request) that opens 1, 2, 4 … 32 ranges wide, so a read that stops early has asked for only a few ranges past the
+     * one it stopped in (each at most 1 MiB); with `range`, only the ids in `(after, through]`, fetching only the
+     * chunks the range overlaps (see {@link IdRange}). A source that reads chunk by chunk is read through a window of up to
+     * 32 chunk fetches that opens 1, 2, 4 … 32 wide.
      *
      * Two generators, not one with a branch: a second `yield` site in the full read's generator grows its frame, and
      * every id of a read that asked for no range paid for it (measured at about 5% per id). The full read keeps the
@@ -149,11 +173,11 @@ export declare class SegmentEngine {
      *
      * Chunk-skipping intersection. Aligns each segment's chunk-key set (read from the `.crbm` index, no payload),
      * keeps only keys present in **all** operands (a key missing from any operand can't contribute → its Storage
-     * chunks are never fetched — the core saving), then for each surviving key fetches the operands' chunks in
-     * parallel and hands them to the codec for the AND, streaming results through a bounded in-flight window.
+     * chunks are never fetched — the core saving), then reads each operand's surviving chunks as one stream of coalesced
+     * ranges and hands them, key by key, to the codec for the AND, streaming results through a bounded window.
      *
-     * **Memory:** the Storage payload footprint is bounded by the window (`concurrency × operands × chunk`), not by
-     * segment size — that's the Lambda-friendly property.
+     * **Memory:** the Storage payload footprint is bounded by the window (`concurrency × operands × chunk`, a range being
+     * at most a chunk's cap of 1 MiB), not by segment size — that's the Lambda-friendly property.
      *
      * Generation-consistent within the call (normal case): each operand's current generation is resolved **once**
      * up front (before the fan-out) and threaded into every chunk read, so a concurrent load can't corrupt or tear
@@ -164,7 +188,9 @@ export declare class SegmentEngine {
      * waiting for the TTL, so a shorter call can meet them too: **the reader cache evicting an operand mid-call**
      * (`maxOpenSegments`), whose re-read re-resolves fresh; a sweep deleting the generation it was reading, which
      * heals the read forward; and an invalidation, which this store's own `load`, `rollback` and `eraseSubject` make
-     * and `invalidate()` makes on request. Still whole/immutable per read, never torn.
+     * and `invalidate()` makes on request. Still whole/immutable per read, never torn. An operand's stream resolves its
+     * segment again before it serves each chunk, so each of those moves a running read as it would a read of one chunk, and
+     * the ranges it had requested of the earlier generation are dropped, not served.
      */
     intersect(segs: readonly SegmentRef[], options?: CombineOptions): AsyncGenerator<number>;
     /**
@@ -207,6 +233,32 @@ export declare class SegmentEngine {
      * used as-is — one clone per key, not one per operand.
      */
     private combineChunk;
+    /**
+     * One operand's chunk at `key`: from its stream when it has one, else a read of that chunk on its own. Not `async`,
+     * so a stream's take is made before anything is awaited: concurrent takes of one stream must be made in key order.
+     */
+    private operandChunk;
+    /**
+     * Open `keys` of `seg` as a stream of coalesced ranges, or `undefined` when the read is per key: a source with no
+     * `getChunks`, a segment with no generation, or nothing to read. The chunks already decoded in the cache are taken out
+     * of the key list first and served from there, so a repeat read asks the source for nothing it holds. Nothing is
+     * requested until the first chunk is asked for.
+     */
+    private openStreamed;
+    private closeStreamed;
+    /**
+     * The decoded chunk at `chunkKey` of a streamed read: the next chunk of its stream, or, for a chunk the cache held
+     * when the read opened, the cached instance while it is still there, and a read of that chunk alone once it is not.
+     */
+    private streamedChunk;
+    /**
+     * The version a streamed chunk is cached under, or `null` for one not to cache: the version its read reports when the
+     * source names versions as its lookups do (`currentVersion`), and otherwise the one the read planned under, since a
+     * lookup by generation number would never find a chunk cached under a stream's version.
+     */
+    private streamedVersion;
+    /** The cache key of a chunk: by the version it was read under, or by segment and key alone for a source with none. */
+    private chunkCacheKey;
     /** The segment's chunk keys, ascending — a shape read off the index, no payload. Keys are untrusted (invariant 5). */
     private chunkKeys;
     /**
@@ -297,6 +349,16 @@ export declare class SegmentEngine {
      * one): callers read it or clone it, never mutate it.
      */
     private storageChunk;
-    /** One request for one chunk, decoded, range-checked and cached. */
+    /**
+     * A chunk's stored bytes decoded under the size cap (invariant 5) and range-checked: the one place a chunk becomes a
+     * bitmap, whether its bytes came from a request of its own or from a stream of coalesced ranges.
+     */
+    private decodeChunk;
+    /**
+     * One chunk, decoded, range-checked and cached. A source with `getChunks` is read through it, as a one-key stream, so
+     * a `storage.get` is reported only for a request that was sent (a chunk the source holds in memory sends none);
+     * the chunk is cached under the version it came from, as a stream's chunk is. A source without it is read by
+     * `getChunk`, one event a call.
+     */
     private fetchChunk;
 }

package/dist/core/item-pull.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Pulls the items of an async iterator one at a time so that the code relaying them never holds the one it just
+ * handed on. A binding of a generator's body (`for await (const item of …)`, `yield*`) is kept in the generator's
+ * frame across its next `yield`, so the relay would hold the previous item, and whatever buffer it is a view into,
+ * for as long as it waits for the next. Here the item sits in the pull between {@link advance} and {@link take}, and
+ * `take` clears it before it returns.
+ *
+ * ```ts
+ * const pull = new ItemPull(source);
+ * try {
+ *   while (await pull.advance()) yield pull.take((item) => wrap(item));
+ * } finally {
+ *   await pull.close();
+ * }
+ * ```
+ *
+ * Internal to core: not exported from any entry point.
+ */
+export declare class ItemPull<A> {
+    private readonly iterator;
+    private item;
+    constructor(source: AsyncIterable<A>);
+    /** Waits for the next item and keeps it inside; `false` once the source has ended. A failure of the source throws. */
+    advance(): Promise<boolean>;
+    /** Hands over the item {@link advance} fetched, through `map`, and forgets it. */
+    take<B>(map: (item: A) => B): B;
+    /** Ends the source early (a consumer that stopped), as leaving a `for await` does. */
+    close(): Promise<void>;
+}

package/dist/core/metrics.d.ts

@@ -26,19 +26,26 @@ export type MetricEvent = {
     readonly kind: 'storage.get';
     readonly namespace?: string;
     readonly segment: string;
-    /** One event per request, however many callers were waiting on it. Bytes returned (0 if the chunk was absent — a GET still happened). */
+    /**
+     * One event per request for chunks: a range request of a combine or `iterate`, which carries every chunk the read
+     * needs from a stretch of the object, or the one chunk of a read made on its own, however many callers were waiting
+     * on it. Bytes returned: the range's, the gaps between its chunks included (0 if a single chunk was absent — a GET
+     * still happened).
+     */
     readonly bytes: number;
     /**
-     * Elapsed wall time of the read — includes any transient-retry backoff on the storage call. From the
-     * injected clock, clamped to ≥ 0 (0 under the no-wait test clock).
+     * Elapsed wall time of the request — includes any transient-retry backoff on the storage call. From the
+     * injected clock, clamped to ≥ 0 (0 under the no-wait test clock). For a range of a stream, the time from the
+     * range being asked for to its answer, which the source measures.
      */
     readonly ms: number;
 } | {
     /**
      * One decoded-chunk cache lookup (emitted only when a cache is configured). `hit: false` means the lookup found
-     * no cached chunk. A caller that missed while another caller's read of the same chunk was open waits on that
-     * read and adds no `storage.get`, so the misses can outnumber the `storage.get` events; the `storage.get`
-     * count is the number of requests.
+     * no cached chunk. A combine or `iterate` looks up every chunk it needs when it opens its streams. A caller that
+     * missed while another caller's read of the same chunk was open waits on that read and adds no `storage.get`, and a
+     * range carries several chunks, so the misses can outnumber the `storage.get` events; the `storage.get` count is
+     * the number of requests for chunks.
      */
     readonly kind: 'cache';
     readonly hit: boolean;

package/dist/core/pinned-storage-source.d.ts

@@ -21,7 +21,7 @@
  * on some other handle. That is why the routing is by segment identity here rather than by which object the
  * caller happened to start from.
  */
-import type { ChunkRef, GenerationSummary, StorageChunkSource, SegmentRef, SegmentSize } from './ports.js';
+import type { ChunkRef, ChunkRead, ReadChunksOptions, GenerationSummary, StorageChunkSource, SegmentRef, SegmentSize } from './ports.js';
 import type { CrbmStorageChunkSource } from './crbm-storage-source.js';
 /**
  * What a pin holds for one segment: the generation, the version identifying those exact bytes, and the pinned
@@ -64,6 +64,12 @@ export declare class PinnedStorageChunkSource implements StorageChunkSource {
      */
     private pinFor;
     getChunk(ref: ChunkRef): Promise<Uint8Array | null>;
+    /**
+     * A pinned segment's chunks come from the pinned generation alone, under the version a pinned read keys by
+     * ({@link currentVersion}); another segment's go to the live source, which answers with its own.
+     */
+    getChunks(ref: SegmentRef, keys: readonly number[], options?: ReadChunksOptions): AsyncIterable<ChunkRead>;
+    private pinnedChunks;
     listChunkKeys(ref: SegmentRef): Promise<number[]>;
     sizeOf(ref: SegmentRef): Promise<SegmentSize | null>;
     cardinalities(ref: SegmentRef): Promise<ReadonlyMap<number, number> | null>;

package/dist/core/ports.d.ts

@@ -40,11 +40,80 @@ export interface GenKey extends SegmentRef {
 export interface SegmentSize {
     readonly sizeBytes: number;
 }
+/**
+ * One chunk of a {@link StorageChunkSource.getChunks} stream: the key asked for, its bytes (`null` where the generation
+ * holds none), and the version of the generation the bytes were read from, or `null` when the segment has no
+ * generation. The version is what {@link StorageChunkSource.currentVersion} reports for that generation, so a caller
+ * can key what it keeps by the generation the bytes came from rather than the one it resolved earlier.
+ */
+export interface ChunkRead {
+    readonly key: number;
+    readonly bytes: Uint8Array | null;
+    readonly version: string | null;
+}
+/** Options of {@link StorageChunkSource.getChunks}. */
+export interface ReadChunksOptions {
+    /**
+     * Runs one storage request, and may run it again if it fails. A source passes each request it makes through
+     * this, so a caller that retries transient faults repeats the one request that failed, not the ones that landed.
+     * Absent, each request runs once.
+     */
+    readonly retry?: <T>(request: () => Promise<T>) => Promise<T>;
+    /**
+     * How many range requests the stream holds ahead of its consumer, in flight or landed and not yet taken: a positive
+     * integer, 32 by default. It bounds the requests in flight, and the memory the stream holds, at this many times the
+     * largest range (1 MiB, 1 MiB + 28 B for one encrypted chunk).
+     */
+    readonly concurrency?: number;
+    /**
+     * Open the window 1, 2, 4 … ranges wide up to `concurrency` instead of at full width, so a reader that stops early
+     * has asked for little; a number starts it that wide instead of at 1 (a positive integer), and it doubles from there.
+     */
+    readonly ramp?: boolean | number;
+    /**
+     * Called once for every range request the stream sends, when it settles: a request the consumer took, one that was
+     * still in flight when the consumer stopped, and one that failed. `bytes` is what the request moved, the gaps between
+     * the chunks it carried included (0 when it failed), and `ms` how long it took, retries included (0 when the source
+     * has no clock). It is how a caller counts what it is billed for, since several chunks can share a request and
+     * a stopped stream leaves some in flight. A throw from it is ignored.
+     */
+    readonly onRequest?: (request: {
+        readonly bytes: number;
+        readonly ms: number;
+    }) => void;
+}
 /** Per-chunk read view of the immutable Storage tier (implemented by the `.crbm` reader). */
 export interface StorageChunkSource {
     /** Read-only bytes for the chunk, or `null` if absent. Callers must not mutate the buffer. */
     getChunk(ref: ChunkRef): Promise<Uint8Array | null>;
     listChunkKeys(ref: SegmentRef): Promise<number[]>;
+    /**
+     * Optional: several chunks of one segment as a stream, read **from one generation** with fewer storage requests than
+     * one per chunk where the chunks sit near each other in the object. `keys` are chunk keys in ascending order (a key
+     * may repeat; any other order is a `ValidationError`). The stream yields one {@link ChunkRead} per position of
+     * `keys`, in that order, as the requests that carry them land; a key the generation does not hold yields `null`
+     * bytes, as {@link StorageChunkSource.getChunk} answers. Each chunk is checked as a read of it alone is.
+     *
+     * **Nothing is resolved or read until the first chunk is asked for**, and the source holds at most
+     * {@link ReadChunksOptions.concurrency} ranges at a time (in flight, or landed and not yet taken), however many keys
+     * there are: a consumer that is slow holds the stream back, and one that stops early (`break`, or `return()`) stops
+     * the reads, so the requests it had already started (at most that many) finish and are dropped, and are not retried.
+     * A stream that fails raises at once and sends nothing further, and the requests it left in flight finish in the
+     * background and never raise. A plain chunk may be a view into a buffer of up to 1 MiB that it shares with its
+     * neighbours (and the same view at two positions for a key asked twice), so do not write to it, and copy a chunk to
+     * keep it.
+     *
+     * One stream reads one generation. If that generation is swept, or its object replaced, while the stream runs, a
+     * source may re-resolve the segment and continue with the keys not yet yielded from the generation that is current
+     * then; each chunk says which version it came from, and each is whole and verified either way. Before it does, it
+     * waits for the requests the failed stream left in flight, so a heal never opens a second window beside them: a
+     * request that never answers delays a heal, as it would hang a read of one chunk, until the driver's read timeout (if
+     * it has one) ends it, and never delays an error. A source that reads a pinned generation never heals.
+     *
+     * A source that cannot read a range of an object omits this, and a caller reads chunk by chunk; the `.crbm`
+     * source, which is what the stores the library ships read through, implements it.
+     */
+    getChunks?(ref: SegmentRef, keys: readonly number[], options?: ReadChunksOptions): AsyncIterable<ChunkRead>;
     /**
      * Optional: the current generation's grounded size, cheaply (from the already-parsed `.crbm` index — no
      * payload reads), or `null` if the segment has no Storage generation. Powers the grounded `costReport()`.

package/dist/core/validate.d.ts

@@ -42,5 +42,10 @@ export declare function isReservedNamespace(namespace: string | undefined): bool
 export declare function validateUserNamespace(namespace: string): void;
 /** Validate a segment ref an application hands in: the name rules, and a namespace outside the reserved prefix. */
 export declare function validateUserRef(ref: SegmentRef): void;
+/**
+ * Validate the keys of a `getChunks` stream: in ascending order, a key may repeat. Checked before anything is
+ * resolved or read, so a caller's mistake costs no request.
+ */
+export declare function validateChunkKeyOrder(keys: readonly number[]): void;
 /** Validate a chunk ref: the segment/namespace rules plus `chunkKey` ∈ `[0, 65535]` (a u16). A driver-boundary check. */
 export declare function validateChunkRef(ref: ChunkRef): void;

package/dist/driver-kit.js

@@ -28,7 +28,7 @@ import {
   validateRegistryPatch,
   validateSegmentRef,
   webCryptoEntropy
-} from "./chunk-5W3XS2IU.js";
+} from "./chunk-B7IGS3W6.js";
 
 // src/drivers/_shared/object-registry-keys.ts
 var REGISTRY_SUFFIX = ".reg";
@@ -104,7 +104,7 @@ function parseRegistryKey(prefix, objectKey) {
 var MAX_ROW_BYTES = 1 * 1024 * 1024;
 var MAX_DELETE_ATTEMPTS = 8;
 var MAX_READ_ATTEMPTS = 8;
-var LIST_READ_CONCURRENCY = 16;
+var LIST_READ_CONCURRENCY = 48;
 var ObjectVersionRaced = class extends Error {
   constructor(objectKey) {
     super(`registry object was overwritten mid-read: ${objectKey}`);

package/dist/driver-kit.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/drivers/_shared/object-registry-keys.ts", "../src/drivers/_shared/object-registry.ts"],
-  "sourcesContent": ["/**\n * The registry object layout, shared by every object-store registry (S3, GCS, Azure Blob).\n *\n * One tiny JSON object per segment at `<prefix>registry/<ns>/<segment>.reg`, **registry-first** \u2014 separate\n * from the namespace-first storage layout (`<prefix><ns>/segments/\u2026`) \u2014 so discovery is a single list over\n * `registry/` for all namespaces, or `registry/<ns>/` for one, never entangled with the `.crbm` payloads.\n *\n * It lives here rather than in a driver because all three object stores encode names the same way\n * (`encodeNameForKey`, `namespaceKeyPart`) and build byte-identical keys. Three copies of this would be\n * three chances for one cloud's layout to drift from the others \u2014 and a drifted key is not a visible bug, it\n * is a segment that quietly cannot be found by a store pointed at the same bucket.\n */\nimport { ValidationError } from '@/core/errors';\nimport { validateSegmentRef } from '@/core/validate';\nimport type { SegmentRef } from '@/core/ports';\nimport { DEFAULT_NAMESPACE, decodeNameFromKey, encodeNameForKey, namespaceKeyPart } from './keys';\n\nconst REGISTRY_SUFFIX = '.reg';\n\n/** Normalize an optional caller prefix to either `''` or `trimmed/` (no leading/trailing slashes). */\nexport function prefixPart(prefix: string | undefined): string {\n  if (prefix === undefined) return '';\n  const trimmed = prefix.replace(/^\\/+|\\/+$/g, '');\n  return trimmed === '' ? '' : `${trimmed}/`;\n}\n\n/**\n * Validate a caller-supplied key prefix (trusted config, but make it a real containment boundary): reject\n * control characters and `.`/`..` path segments so a prefix cannot traverse out of its intended space.\n * Returns it unchanged \u2014 the key builders normalize slashes.\n *\n * The traversal check covers three spellings, because the tools that walk these buckets do. A bare `..` is\n * the obvious one. A **backslash** segment matters on ADLS Gen2 and to Windows-side tooling, which treat it\n * as a separator this code otherwise would not. And a percent-encoded `..` matters because `gsutil`,\n * `s3fs`, `gcsfuse` and `azcopy` decode a key on their way to a local path \u2014 the same reasoning\n * `name-codec.ts` already applies to segment names, which a prefix has no reason to be exempt from.\n */\nexport function normalizeObjectPrefix(prefix: string | undefined): string | undefined {\n  if (prefix === undefined) return undefined;\n  for (const ch of prefix) {\n    const code = ch.charCodeAt(0);\n    // C0 plus DEL: a bare `< 0x20` lets U+007F through, and it is as unprintable as the rest.\n    if (code < 0x20 || code === 0x7f) {\n      throw new ValidationError('prefix must not contain control characters');\n    }\n  }\n  if (prefix.includes('\\\\')) {\n    throw new ValidationError(\n      `prefix must not contain backslashes (a path separator on some backends): ${JSON.stringify(prefix)}`,\n    );\n  }\n  // Check the decoded spelling too, so an encoded `..` cannot slip past the literal comparison.\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(prefix);\n  } catch {\n    decoded = prefix; // not valid percent-encoding; the literal check still applies\n  }\n  for (const source of decoded === prefix ? [prefix] : [prefix, decoded]) {\n    for (const segment of source.split('/')) {\n      if (segment === '.' || segment === '..') {\n        throw new ValidationError(\n          `prefix must not contain \".\" or \"..\" path segments: ${JSON.stringify(prefix)}`,\n        );\n      }\n    }\n  }\n  return prefix;\n}\n\n/** The key prefix under which every registry object lives: `<prefix>registry/`. */\nexport function registryPrefix(prefix: string | undefined): string {\n  return `${prefixPart(prefix)}registry/`;\n}\n\n/** The full key of one segment's registry object: `<prefix>registry/<ns>/<segment>.reg`. */\nexport function registryObjectKey(prefix: string | undefined, ref: SegmentRef): string {\n  validateSegmentRef(ref);\n  return `${registryPrefix(prefix)}${namespaceKeyPart(ref.namespace)}/${encodeNameForKey(ref.segment)}${REGISTRY_SUFFIX}`;\n}\n\n/** The list prefix for discovery: registry-wide, or scoped to one namespace. */\nexport function registryListPrefix(prefix: string | undefined, namespace?: string): string {\n  const base = registryPrefix(prefix);\n  return namespace === undefined ? base : `${base}${namespaceKeyPart(namespace)}/`;\n}\n\n/**\n * Parse a `<prefix>registry/<ns>/<segment>.reg` key back to its {@link SegmentRef}, or `null` if it does not\n * match \u2014 a stray or foreign object under the prefix, or one whose parsed ref fails the round-trip check.\n * `_default` maps back to the absent namespace. A name is percent-encoded on the way in, so no encoded name\n * can contain `/` and the split stays unambiguous whatever the caller named their segment.\n */\nexport function parseRegistryKey(prefix: string | undefined, objectKey: string): SegmentRef | null {\n  const base = registryPrefix(prefix);\n  if (!objectKey.startsWith(base) || !objectKey.endsWith(REGISTRY_SUFFIX)) return null;\n  const rest = objectKey.slice(base.length, objectKey.length - REGISTRY_SUFFIX.length);\n  const slash = rest.indexOf('/');\n  if (slash < 0) return null;\n  const nsPart = rest.slice(0, slash);\n  const encodedSegment = rest.slice(slash + 1);\n  if (encodedSegment.length === 0 || encodedSegment.includes('/')) return null;\n  const segment = decodeNameFromKey(encodedSegment);\n  const namespace = nsPart === DEFAULT_NAMESPACE ? undefined : decodeNameFromKey(nsPart);\n  // The encoding must ROUND-TRIP, not merely decode: a foreign object placed under our prefix could spell a\n  // name two ways, and reporting both would hand a sweep one segment under two identities.\n  if (encodeNameForKey(segment) !== encodedSegment) return null;\n  if (namespace !== undefined && encodeNameForKey(namespace) !== nsPart) return null;\n  const ref: SegmentRef = { segment, namespace };\n  try {\n    validateSegmentRef(ref); // reject a hostile/foreign key that isn't a valid ref\n  } catch {\n    return null;\n  }\n  return ref;\n}\n", "/**\n * `ObjectStoreRegistry` \u2014 an {@link IRegistryDriver} over any object store with conditional writes.\n *\n * Lets a **read-mostly deployment run on one bucket alone** \u2014 storage `.crbm` generations plus the registry in\n * the same place, with no separate database. One tiny JSON object per segment at\n * `<prefix>registry/<ns>/<segment>.reg` holding the `{ deleted, record }` envelope (the same shape LocalFs\n * persists). The OCC token is a random incarnation id drawn when the row is created, a counter advanced on every\n * mutation, and a random part drawn for every write, so with overwhelming probability a deleted-then-recreated row, or\n * one restored from a backup, never re-issues an old token (ABA-safe) \u2014 identical semantics to the LocalFs registry, so it passes the same\n * conformance suite.\n *\n * **`delete` removes a row for good where the store vouches for a conditional delete** (`If-Match: <etag>`,\n * `ifGenerationMatch: <generation>`), and only a row whose token carries an incarnation id: a re-create draws a new\n * incarnation, so nothing of the old row is needed to keep its tokens apart, and a full `list()` no longer reads a\n * row for every name it ever held. Every other row is **tombstoned**: the object stays, its counter advanced, and a\n * re-create carries the counter on. A row a release before 0.12 wrote has a bare decimal token and is always\n * tombstoned, since a process still on that release, re-creating the name over nothing, would start its counter at 0\n * again and issue the old row's tokens.\n *\n * **The atomic swap is offloaded to the store's conditional writes.** `create` writes only if absent (or\n * over a tombstone under its version), and `compareAndSwap`/`delete` write (or delete) only if the object still\n * carries the version we read \u2014 so a concurrent writer between our read and our write loses, and the loss surfaces\n * as {@link WriteConflictError}. No in-process lock is needed (unlike LocalFs): the precondition fences\n * writers *across processes*.\n *\n * **Why this is shared rather than written per cloud.** Every object store worth using has the same two\n * primitives under different names \u2014 S3 `If-None-Match: *` / `If-Match: <etag>`, GCS `ifGenerationMatch: 0`\n * / `ifGenerationMatch: <generation>`, Azure `If-None-Match: *` / `If-Match: <etag>` \u2014 so the only thing\n * that differs is a few I/O calls, which is what {@link ObjectRegistryStore} abstracts. The parts that are\n * genuinely hard (the ABA-safe token, the delete and its tombstone, the bounded delete retry, the round-trip key check)\n * exist once. Three copies would be three chances for one cloud to drift, and a drifted registry is not a\n * visible bug \u2014 it is a lost `currentGen` swap.\n *\n * **Deployment requirements** (a backend that violates these silently corrupts the registry):\n * - The store **must honor the conditional write**. One that accepts the precondition header and ignores it\n *   degrades compare-and-swap to last-write-wins \u2192 lost `currentGen` swaps.\n * - Reads must be **strongly consistent** \u2014 true of S3 (since 2020), GCS and Azure Blob \u2014 since the registry\n *   advertises `strongRead` and generation resolution depends on it.\n * - **Do not apply a lifecycle-expiration rule to the `registry/` prefix that expires a current version.**\n *   Expiring a live row loses its pointer. A tombstone `delete` left keeps the counter for a re-create; one expired\n *   by a rule is no worse than a row removed for good, since a recreate draws a fresh incarnation and its tokens are\n *   new but for a collision of probability 2^-128 per pair of incarnations, but a rule cannot tell a tombstone from a\n *   live row.\n * - **A store's conditional delete must be honoured by its backend** before the store sets `conditionalDelete`.\n *   One that ignores the precondition lets two sweepers and a re-create delete a live row.\n *\n * **`list()` is fail-closed, and one bad object stops it for everyone.** An object under the `registry/`\n * prefix whose key parses but whose body does not aborts the whole enumeration \u2014 every namespace, not just\n * the affected segment \u2014 and it stays that way until an operator removes the object. The error names the\n * offending key.\n *\n * That is the deliberate choice, and it is the *safer* one rather than the more convenient one. Skipping the\n * unreadable row would keep discovery running, but `list()` is what tells orphan generation collection which\n * segments exist: a row missing from the enumeration makes its storage `.crbm` generations look unreferenced,\n * and the next GC pass would delete them. Silently skipping turns a parse error into data loss. Refusing to\n * enumerate keeps every sweep off a set it cannot vouch for (invariant 5 \u2014 bytes from the tier are\n * untrusted). **Recovery:** read the named object, and either restore a valid envelope or delete it; nothing\n * else is damaged, and discovery resumes on its own.\n */\nimport {\n  IntegrityError,\n  TransientError,\n  ValidationError,\n  WriteConflictError,\n  isWriteConflictError,\n} from '@/core/errors';\nimport type {\n  IRegistryDriver,\n  NewRegistryRecord,\n  RegCaps,\n  RegistryPatch,\n  RegistryRecord,\n  SegmentRef,\n  Token,\n} from '@/core/ports';\nimport type { Entropy } from '@/core/determinism';\nimport { mapWithConcurrency } from '@/core/concurrency';\nimport {\n  applyRegistryPatch,\n  incarnationOf,\n  newIncarnationToken,\n  nextRegistryToken,\n  parseRegistryEnvelope,\n  recordFromNew,\n  serializeRegistryEnvelope,\n  validateNewRegistryRecord,\n  validateRegistryPatch,\n  type RegistryEnvelope,\n} from './registry';\nimport { entropyIsAvailable, webCryptoEntropy } from './entropy';\nimport { parseRegistryKey, registryListPrefix, registryObjectKey } from './object-registry-keys';\n\n/** Defensive cap on a single registry object read from storage, before allocation (rows are tiny; ~1 KB). */\nexport const MAX_ROW_BYTES = 1 * 1024 * 1024;\n/** Bounded retry for `delete`'s read then delete or tombstone, under cross-process contention (then fails typed). */\nconst MAX_DELETE_ATTEMPTS = 8;\n/** Bounded re-read when a store's pinned version is overwritten mid-read (see {@link ObjectVersionRaced}). */\nconst MAX_READ_ATTEMPTS = 8;\n/** In-flight reads per `list()` page \u2014 turns the serial N+1 into one list plus bounded parallel reads. */\nconst LIST_READ_CONCURRENCY = 16;\n\n/**\n * Raised by a store when the version it pinned for a read vanished before it could fetch the bytes \u2014\n * a concurrent writer overwrote or deleted the object in between.\n *\n * This is deliberately **neither** of the two things it superficially resembles. It is not absence: the row\n * is very likely still live, just one version further on. And it is not a write conflict: the caller may be\n * a read-only `get()`, which has nothing to conflict with. Either is an easy misreading for a store that reads a\n * row in two calls, metadata and then bytes pinned to it, which is why the signal is part of the port rather than\n * left to each store's judgement. {@link ObjectStoreRegistry} answers it the only way that is correct for every\n * caller: it reads again.\n *\n * Stores whose read is atomic can never raise it, and every shipped store's is: S3 serves bytes and `ETag` from one\n * `GetObject`, GCS bytes and `generation` from one GET, and Azure Blob bytes and `ETag` from one GET.\n */\nexport class ObjectVersionRaced extends Error {\n  constructor(objectKey: string) {\n    super(`registry object was overwritten mid-read: ${objectKey}`);\n    this.name = 'ObjectVersionRaced';\n  }\n}\n\n/** One object as read, with the opaque version that fences a later conditional write. */\nexport interface ObjectRow {\n  readonly bytes: Uint8Array;\n  /** The store's version fence \u2014 an S3/Azure ETag, a GCS generation. Opaque to this class. */\n  readonly version: string;\n}\n\n/**\n * The I/O calls an object store must provide to host a registry: three, and an optional conditional delete. Everything\n * else \u2014 the OCC token, tombstones, the delete retry, key parsing \u2014 is implemented once above.\n */\nexport interface ObjectRegistryStore {\n  /** A label for error messages, e.g. `GCS` or `Azure Blob`. */\n  readonly label: string;\n  /**\n   * Read one object, or `null` when it is absent.\n   *\n   * **`null` means the object does not exist** \u2014 nothing weaker. A store that reads in two round trips\n   * (metadata for the version fence, then the bytes pinned to it) can find that version already gone; it\n   * MUST report that with {@link ObjectVersionRaced} rather than `null` or {@link WriteConflictError}, and\n   * the caller re-reads. Retryable faults throw {@link TransientError}.\n   *\n   * `bytes` and `version` MUST describe the **same** observation of the object: `version` is the fence a\n   * later conditional write is conditioned on, so a pair drawn from two different versions would either\n   * fail a write that should have succeeded or, worse, pass one that should not.\n   */\n  read(key: string): Promise<ObjectRow | null>;\n  /**\n   * Write one object under a precondition: `'absent'` means create-only, a version means\n   * compare-and-swap against exactly that version. A lost race MUST throw {@link WriteConflictError}.\n   *\n   * A store must not replay this write after a lost response without telling the replay apart: the replay meets\n   * the row it just wrote and its precondition fails, which would read as a lost race. Send it once, or store a\n   * write id with the row and treat a conflict whose stored row carries it as success. Retryable faults throw\n   * {@link TransientError}.\n   */\n  write(key: string, body: Uint8Array, expect: 'absent' | { version: string }): Promise<void>;\n  /** Every object key under `prefix`, paginated internally. */\n  listKeys(prefix: string): AsyncIterable<string>;\n  /**\n   * Optional: delete one object, and only while it is still at exactly `expect.version`, by a precondition the\n   * backend applies (`If-Match: <etag>`, `ifGenerationMatch: <generation>`). An object that was overwritten, or is\n   * gone, MUST throw {@link WriteConflictError} and delete nothing. Retryable faults throw {@link TransientError}.\n   *\n   * Sending it again after a lost response is safe, unlike a write: the precondition names one version, so a second\n   * copy can remove nothing the first was not allowed to. A copy that meets its own landed delete fails the\n   * precondition and reports a conflict; the registry re-reads, and finds the row gone.\n   *\n   * The registry calls it only when {@link conditionalDelete} is `true`.\n   */\n  delete?(key: string, expect: { version: string }): Promise<void>;\n  /**\n   * Whether {@link delete} may be relied on: `true` only where the backend is known to apply the precondition. A\n   * backend that accepts the header and ignores it would let a delete remove a row written after the delete read it,\n   * a live one included. Absent or `false`, the registry never calls `delete` and tombstones every row instead.\n   */\n  readonly conditionalDelete?: boolean;\n}\n\nexport class ObjectStoreRegistry implements IRegistryDriver {\n  /**\n   * `entropy` draws the random parts of every token: a new row's incarnation id, and each write's own part. It\n   * defaults to the platform's Web Crypto. Inject one only to make a test replayable: a seeded source in production\n   * gives every process the same ids.\n   */\n  constructor(\n    private readonly store: ObjectRegistryStore,\n    private readonly prefix: string | undefined,\n    private readonly now: () => number,\n    private readonly entropy: Entropy = webCryptoEntropy,\n  ) {}\n\n  capabilities(): RegCaps {\n    const conditionalDelete = this.removesRows();\n    return entropyIsAvailable(this.entropy)\n      ? { strongRead: true, conditionalDelete }\n      : { strongRead: true, canWrite: false, conditionalDelete };\n  }\n\n  /** Whether a delete removes a row born with an incarnation id: the store has a delete, and vouches for it. */\n  private removesRows(): boolean {\n    return this.store.conditionalDelete === true && typeof this.store.delete === 'function';\n  }\n\n  async get(ref: SegmentRef): Promise<RegistryRecord | null> {\n    const current = await this.readRow(registryObjectKey(this.prefix, ref));\n    return current && !current.env.deleted ? current.env.record : null;\n  }\n\n  async create(ref: SegmentRef, record: NewRegistryRecord): Promise<{ token: Token }> {\n    const checked = validateNewRegistryRecord(record);\n    const key = registryObjectKey(this.prefix, ref);\n    const current = await this.readRow(key);\n    if (current !== null && !current.env.deleted) {\n      throw new WriteConflictError(`registry row already exists for segment ${ref.segment}`);\n    }\n    // A new incarnation, whose counter continues across a tombstone, so with overwhelming probability a recreate never re-issues an old token.\n    const token = newIncarnationToken(this.entropy, current?.env.record);\n    const env: RegistryEnvelope = {\n      deleted: false,\n      record: recordFromNew(ref, checked, this.now(), token),\n    };\n    // Create-only when truly absent; overwrite the tombstone under its version when recreating. Either way\n    // a concurrent create loses the precondition and surfaces as a conflict.\n    await this.putRow(key, env, current ? { version: current.version } : 'absent');\n    return { token };\n  }\n\n  async compareAndSwap(\n    ref: SegmentRef,\n    expected: Token,\n    patch: RegistryPatch,\n  ): Promise<{ token: Token }> {\n    const checked = validateRegistryPatch(patch);\n    const key = registryObjectKey(this.prefix, ref);\n    const current = await this.readRow(key);\n    if (current === null || current.env.deleted || current.env.record.token !== expected) {\n      throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);\n    }\n    const token = nextRegistryToken(current.env.record, this.entropy);\n    const env: RegistryEnvelope = {\n      deleted: false,\n      record: applyRegistryPatch(current.env.record, checked, this.now(), token),\n    };\n    // The version we read fences a concurrent writer between that read and this write.\n    await this.putRow(key, env, { version: current.version });\n    return { token };\n  }\n\n  async *list(namespace?: string): AsyncIterable<RegistryRecord> {\n    const prefix = registryListPrefix(this.prefix, namespace);\n    // One list plus bounded parallel reads. A serial await-in-loop made this O(N) sequential round trips.\n    let page: string[] = [];\n    const flush = async function* (\n      this: ObjectStoreRegistry,\n      keys: string[],\n    ): AsyncIterable<RegistryRecord> {\n      const rows = await mapWithConcurrency(keys, LIST_READ_CONCURRENCY, (key) =>\n        this.readRow(key),\n      );\n      for (const current of rows) {\n        if (current && !current.env.deleted) yield current.env.record;\n      }\n    }.bind(this);\n\n    for await (const key of this.store.listKeys(prefix)) {\n      if (parseRegistryKey(this.prefix, key) === null) continue; // stray or foreign object\n      page.push(key);\n      if (page.length >= LIST_READ_CONCURRENCY) {\n        yield* flush(page);\n        page = [];\n      }\n    }\n    if (page.length > 0) yield* flush(page);\n  }\n\n  async delete(ref: SegmentRef, expected?: Token): Promise<void> {\n    const key = registryObjectKey(this.prefix, ref);\n    // A row born with an incarnation id is removed from the store, by a delete the store applies only while the\n    // object is still the version read here: a later create draws a new incarnation, so nothing of this row is needed\n    // to keep its tokens apart. Any other row is tombstoned (the counter advanced, the object kept), so a re-create\n    // carries the counter on. Retry the read and the write on a cross-process race; it converges, then fails typed\n    // rather than silently leaving the row live.\n    for (let attempt = 0; attempt < MAX_DELETE_ATTEMPTS; attempt++) {\n      const current = await this.readRow(key);\n      if (expected !== undefined) {\n        // Fenced: the row must still carry the token the caller read. Re-checked on every attempt, so a row\n        // that was swapped, or deleted and re-created, between two attempts is refused rather than tombstoned.\n        if (current === null || current.env.deleted || current.env.record.token !== expected) {\n          throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);\n        }\n      } else if (current === null || current.env.deleted) {\n        return; // idempotent \u2014 already gone\n      }\n      try {\n        const remove = this.removesRows() ? this.store.delete : undefined;\n        if (remove !== undefined && incarnationOf(current.env.record.token) !== undefined) {\n          // The version read above is the row the caller's token names, so this removes that row and no later one.\n          await remove.call(this.store, key, { version: current.version });\n          return;\n        }\n        const token = nextRegistryToken(current.env.record, this.entropy);\n        const env: RegistryEnvelope = {\n          deleted: true,\n          record: { ...current.env.record, token, updatedAt: this.now() },\n        };\n        await this.putRow(key, env, { version: current.version });\n        return;\n      } catch (err) {\n        if (isWriteConflictError(err)) continue; // raced \u2014 re-read and try again\n        throw err;\n      }\n    }\n    throw new WriteConflictError(`registry delete: contention deleting \"${ref.segment}\" \u2014 retry`);\n  }\n\n  /**\n   * Read + parse a registry object, returning its envelope and version fence, or null if absent.\n   *\n   * A store that pins a version to read consistently ({@link ObjectVersionRaced}) loses that pin whenever a\n   * concurrent writer lands mid-read. Re-reading is the whole answer \u2014 the next read simply observes the\n   * newer version \u2014 and it is bounded so a row under permanent write saturation fails typed instead of\n   * spinning. Only a store that reads in two calls gets here; none of the shipped stores does.\n   */\n  private async readRow(\n    objectKey: string,\n  ): Promise<{ env: RegistryEnvelope; version: string } | null> {\n    const row = await this.readRaced(objectKey);\n    if (row === null) return null;\n    if (row.bytes.length > MAX_ROW_BYTES) {\n      throw new IntegrityError(\n        `registry object ${row.bytes.length}B exceeds cap ${MAX_ROW_BYTES}B`,\n      );\n    }\n    if (row.version.length === 0) {\n      // The version is the OCC fence for CAS; a backend that omits it cannot be used safely as a registry.\n      throw new IntegrityError(\n        `registry object has no version fence (needed for compare-and-swap): ${objectKey}`,\n      );\n    }\n    const env = parseRegistryEnvelope(new TextDecoder().decode(row.bytes), objectKey);\n    return { env, version: row.version };\n  }\n\n  /** {@link ObjectRegistryStore.read}, retrying the bounded number of times a mid-read overwrite allows. */\n  private async readRaced(objectKey: string): Promise<ObjectRow | null> {\n    for (let attempt = 0; attempt < MAX_READ_ATTEMPTS; attempt++) {\n      try {\n        return await this.store.read(objectKey);\n      } catch (err) {\n        if (!(err instanceof ObjectVersionRaced)) throw err;\n      }\n    }\n    throw new TransientError(\n      `registry read: ${this.store.label} object \"${objectKey}\" was overwritten on every one of ` +\n        `${MAX_READ_ATTEMPTS} attempts \u2014 retry`,\n    );\n  }\n\n  /** Conditional write of an envelope. The store maps a lost precondition to {@link WriteConflictError}. */\n  private async putRow(\n    objectKey: string,\n    env: RegistryEnvelope,\n    expect: 'absent' | { version: string },\n  ): Promise<void> {\n    const body = new TextEncoder().encode(serializeRegistryEnvelope(env));\n    if (body.length > MAX_ROW_BYTES) {\n      // Belt-and-braces: the governance/DEK fields are already capped by validate*, so this cannot fire for\n      // valid input \u2014 but never write a row that would later be unreadable.\n      throw new ValidationError(`registry object ${body.length}B exceeds cap ${MAX_ROW_BYTES}B`);\n    }\n    await this.store.write(objectKey, body, expect);\n  }\n}\n"],
+  "sourcesContent": ["/**\n * The registry object layout, shared by every object-store registry (S3, GCS, Azure Blob).\n *\n * One tiny JSON object per segment at `<prefix>registry/<ns>/<segment>.reg`, **registry-first** \u2014 separate\n * from the namespace-first storage layout (`<prefix><ns>/segments/\u2026`) \u2014 so discovery is a single list over\n * `registry/` for all namespaces, or `registry/<ns>/` for one, never entangled with the `.crbm` payloads.\n *\n * It lives here rather than in a driver because all three object stores encode names the same way\n * (`encodeNameForKey`, `namespaceKeyPart`) and build byte-identical keys. Three copies of this would be\n * three chances for one cloud's layout to drift from the others \u2014 and a drifted key is not a visible bug, it\n * is a segment that quietly cannot be found by a store pointed at the same bucket.\n */\nimport { ValidationError } from '@/core/errors';\nimport { validateSegmentRef } from '@/core/validate';\nimport type { SegmentRef } from '@/core/ports';\nimport { DEFAULT_NAMESPACE, decodeNameFromKey, encodeNameForKey, namespaceKeyPart } from './keys';\n\nconst REGISTRY_SUFFIX = '.reg';\n\n/** Normalize an optional caller prefix to either `''` or `trimmed/` (no leading/trailing slashes). */\nexport function prefixPart(prefix: string | undefined): string {\n  if (prefix === undefined) return '';\n  const trimmed = prefix.replace(/^\\/+|\\/+$/g, '');\n  return trimmed === '' ? '' : `${trimmed}/`;\n}\n\n/**\n * Validate a caller-supplied key prefix (trusted config, but make it a real containment boundary): reject\n * control characters and `.`/`..` path segments so a prefix cannot traverse out of its intended space.\n * Returns it unchanged \u2014 the key builders normalize slashes.\n *\n * The traversal check covers three spellings, because the tools that walk these buckets do. A bare `..` is\n * the obvious one. A **backslash** segment matters on ADLS Gen2 and to Windows-side tooling, which treat it\n * as a separator this code otherwise would not. And a percent-encoded `..` matters because `gsutil`,\n * `s3fs`, `gcsfuse` and `azcopy` decode a key on their way to a local path \u2014 the same reasoning\n * `name-codec.ts` already applies to segment names, which a prefix has no reason to be exempt from.\n */\nexport function normalizeObjectPrefix(prefix: string | undefined): string | undefined {\n  if (prefix === undefined) return undefined;\n  for (const ch of prefix) {\n    const code = ch.charCodeAt(0);\n    // C0 plus DEL: a bare `< 0x20` lets U+007F through, and it is as unprintable as the rest.\n    if (code < 0x20 || code === 0x7f) {\n      throw new ValidationError('prefix must not contain control characters');\n    }\n  }\n  if (prefix.includes('\\\\')) {\n    throw new ValidationError(\n      `prefix must not contain backslashes (a path separator on some backends): ${JSON.stringify(prefix)}`,\n    );\n  }\n  // Check the decoded spelling too, so an encoded `..` cannot slip past the literal comparison.\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(prefix);\n  } catch {\n    decoded = prefix; // not valid percent-encoding; the literal check still applies\n  }\n  for (const source of decoded === prefix ? [prefix] : [prefix, decoded]) {\n    for (const segment of source.split('/')) {\n      if (segment === '.' || segment === '..') {\n        throw new ValidationError(\n          `prefix must not contain \".\" or \"..\" path segments: ${JSON.stringify(prefix)}`,\n        );\n      }\n    }\n  }\n  return prefix;\n}\n\n/** The key prefix under which every registry object lives: `<prefix>registry/`. */\nexport function registryPrefix(prefix: string | undefined): string {\n  return `${prefixPart(prefix)}registry/`;\n}\n\n/** The full key of one segment's registry object: `<prefix>registry/<ns>/<segment>.reg`. */\nexport function registryObjectKey(prefix: string | undefined, ref: SegmentRef): string {\n  validateSegmentRef(ref);\n  return `${registryPrefix(prefix)}${namespaceKeyPart(ref.namespace)}/${encodeNameForKey(ref.segment)}${REGISTRY_SUFFIX}`;\n}\n\n/** The list prefix for discovery: registry-wide, or scoped to one namespace. */\nexport function registryListPrefix(prefix: string | undefined, namespace?: string): string {\n  const base = registryPrefix(prefix);\n  return namespace === undefined ? base : `${base}${namespaceKeyPart(namespace)}/`;\n}\n\n/**\n * Parse a `<prefix>registry/<ns>/<segment>.reg` key back to its {@link SegmentRef}, or `null` if it does not\n * match \u2014 a stray or foreign object under the prefix, or one whose parsed ref fails the round-trip check.\n * `_default` maps back to the absent namespace. A name is percent-encoded on the way in, so no encoded name\n * can contain `/` and the split stays unambiguous whatever the caller named their segment.\n */\nexport function parseRegistryKey(prefix: string | undefined, objectKey: string): SegmentRef | null {\n  const base = registryPrefix(prefix);\n  if (!objectKey.startsWith(base) || !objectKey.endsWith(REGISTRY_SUFFIX)) return null;\n  const rest = objectKey.slice(base.length, objectKey.length - REGISTRY_SUFFIX.length);\n  const slash = rest.indexOf('/');\n  if (slash < 0) return null;\n  const nsPart = rest.slice(0, slash);\n  const encodedSegment = rest.slice(slash + 1);\n  if (encodedSegment.length === 0 || encodedSegment.includes('/')) return null;\n  const segment = decodeNameFromKey(encodedSegment);\n  const namespace = nsPart === DEFAULT_NAMESPACE ? undefined : decodeNameFromKey(nsPart);\n  // The encoding must ROUND-TRIP, not merely decode: a foreign object placed under our prefix could spell a\n  // name two ways, and reporting both would hand a sweep one segment under two identities.\n  if (encodeNameForKey(segment) !== encodedSegment) return null;\n  if (namespace !== undefined && encodeNameForKey(namespace) !== nsPart) return null;\n  const ref: SegmentRef = { segment, namespace };\n  try {\n    validateSegmentRef(ref); // reject a hostile/foreign key that isn't a valid ref\n  } catch {\n    return null;\n  }\n  return ref;\n}\n", "/**\n * `ObjectStoreRegistry` \u2014 an {@link IRegistryDriver} over any object store with conditional writes.\n *\n * Lets a **read-mostly deployment run on one bucket alone** \u2014 storage `.crbm` generations plus the registry in\n * the same place, with no separate database. One tiny JSON object per segment at\n * `<prefix>registry/<ns>/<segment>.reg` holding the `{ deleted, record }` envelope (the same shape LocalFs\n * persists). The OCC token is a random incarnation id drawn when the row is created, a counter advanced on every\n * mutation, and a random part drawn for every write, so with overwhelming probability a deleted-then-recreated row, or\n * one restored from a backup, never re-issues an old token (ABA-safe) \u2014 identical semantics to the LocalFs registry, so it passes the same\n * conformance suite.\n *\n * **`delete` removes a row for good where the store vouches for a conditional delete** (`If-Match: <etag>`,\n * `ifGenerationMatch: <generation>`), and only a row whose token carries an incarnation id: a re-create draws a new\n * incarnation, so nothing of the old row is needed to keep its tokens apart, and a full `list()` no longer reads a\n * row for every name it ever held. Every other row is **tombstoned**: the object stays, its counter advanced, and a\n * re-create carries the counter on. A row a release before 0.12 wrote has a bare decimal token and is always\n * tombstoned, since a process still on that release, re-creating the name over nothing, would start its counter at 0\n * again and issue the old row's tokens.\n *\n * **The atomic swap is offloaded to the store's conditional writes.** `create` writes only if absent (or\n * over a tombstone under its version), and `compareAndSwap`/`delete` write (or delete) only if the object still\n * carries the version we read \u2014 so a concurrent writer between our read and our write loses, and the loss surfaces\n * as {@link WriteConflictError}. No in-process lock is needed (unlike LocalFs): the precondition fences\n * writers *across processes*.\n *\n * **Why this is shared rather than written per cloud.** Every object store worth using has the same two\n * primitives under different names \u2014 S3 `If-None-Match: *` / `If-Match: <etag>`, GCS `ifGenerationMatch: 0`\n * / `ifGenerationMatch: <generation>`, Azure `If-None-Match: *` / `If-Match: <etag>` \u2014 so the only thing\n * that differs is a few I/O calls, which is what {@link ObjectRegistryStore} abstracts. The parts that are\n * genuinely hard (the ABA-safe token, the delete and its tombstone, the bounded delete retry, the round-trip key check)\n * exist once. Three copies would be three chances for one cloud to drift, and a drifted registry is not a\n * visible bug \u2014 it is a lost `currentGen` swap.\n *\n * **Deployment requirements** (a backend that violates these silently corrupts the registry):\n * - The store **must honor the conditional write**. One that accepts the precondition header and ignores it\n *   degrades compare-and-swap to last-write-wins \u2192 lost `currentGen` swaps.\n * - Reads must be **strongly consistent** \u2014 true of S3 (since 2020), GCS and Azure Blob \u2014 since the registry\n *   advertises `strongRead` and generation resolution depends on it.\n * - **Do not apply a lifecycle-expiration rule to the `registry/` prefix that expires a current version.**\n *   Expiring a live row loses its pointer. A tombstone `delete` left keeps the counter for a re-create; one expired\n *   by a rule is no worse than a row removed for good, since a recreate draws a fresh incarnation and its tokens are\n *   new but for a collision of probability 2^-128 per pair of incarnations, but a rule cannot tell a tombstone from a\n *   live row.\n * - **A store's conditional delete must be honoured by its backend** before the store sets `conditionalDelete`.\n *   One that ignores the precondition lets two sweepers and a re-create delete a live row.\n *\n * **`list()` is fail-closed, and one bad object stops it for everyone.** An object under the `registry/`\n * prefix whose key parses but whose body does not aborts the whole enumeration \u2014 every namespace, not just\n * the affected segment \u2014 and it stays that way until an operator removes the object. The error names the\n * offending key.\n *\n * That is the deliberate choice, and it is the *safer* one rather than the more convenient one. Skipping the\n * unreadable row would keep discovery running, but `list()` is what tells orphan generation collection which\n * segments exist: a row missing from the enumeration makes its storage `.crbm` generations look unreferenced,\n * and the next GC pass would delete them. Silently skipping turns a parse error into data loss. Refusing to\n * enumerate keeps every sweep off a set it cannot vouch for (invariant 5 \u2014 bytes from the tier are\n * untrusted). **Recovery:** read the named object, and either restore a valid envelope or delete it; nothing\n * else is damaged, and discovery resumes on its own.\n */\nimport {\n  IntegrityError,\n  TransientError,\n  ValidationError,\n  WriteConflictError,\n  isWriteConflictError,\n} from '@/core/errors';\nimport type {\n  IRegistryDriver,\n  NewRegistryRecord,\n  RegCaps,\n  RegistryPatch,\n  RegistryRecord,\n  SegmentRef,\n  Token,\n} from '@/core/ports';\nimport type { Entropy } from '@/core/determinism';\nimport { mapWithConcurrency } from '@/core/concurrency';\nimport {\n  applyRegistryPatch,\n  incarnationOf,\n  newIncarnationToken,\n  nextRegistryToken,\n  parseRegistryEnvelope,\n  recordFromNew,\n  serializeRegistryEnvelope,\n  validateNewRegistryRecord,\n  validateRegistryPatch,\n  type RegistryEnvelope,\n} from './registry';\nimport { entropyIsAvailable, webCryptoEntropy } from './entropy';\nimport { parseRegistryKey, registryListPrefix, registryObjectKey } from './object-registry-keys';\n\n/** Defensive cap on a single registry object read from storage, before allocation (rows are tiny; ~1 KB). */\nexport const MAX_ROW_BYTES = 1 * 1024 * 1024;\n/** Bounded retry for `delete`'s read then delete or tombstone, under cross-process contention (then fails typed). */\nconst MAX_DELETE_ATTEMPTS = 8;\n/** Bounded re-read when a store's pinned version is overwritten mid-read (see {@link ObjectVersionRaced}). */\nconst MAX_READ_ATTEMPTS = 8;\n/** In-flight reads per `list()` page \u2014 turns the serial N+1 into one list plus bounded parallel reads. */\nconst LIST_READ_CONCURRENCY = 48;\n\n/**\n * Raised by a store when the version it pinned for a read vanished before it could fetch the bytes \u2014\n * a concurrent writer overwrote or deleted the object in between.\n *\n * This is deliberately **neither** of the two things it superficially resembles. It is not absence: the row\n * is very likely still live, just one version further on. And it is not a write conflict: the caller may be\n * a read-only `get()`, which has nothing to conflict with. Either is an easy misreading for a store that reads a\n * row in two calls, metadata and then bytes pinned to it, which is why the signal is part of the port rather than\n * left to each store's judgement. {@link ObjectStoreRegistry} answers it the only way that is correct for every\n * caller: it reads again.\n *\n * Stores whose read is atomic can never raise it, and every shipped store's is: S3 serves bytes and `ETag` from one\n * `GetObject`, GCS bytes and `generation` from one GET, and Azure Blob bytes and `ETag` from one GET.\n */\nexport class ObjectVersionRaced extends Error {\n  constructor(objectKey: string) {\n    super(`registry object was overwritten mid-read: ${objectKey}`);\n    this.name = 'ObjectVersionRaced';\n  }\n}\n\n/** One object as read, with the opaque version that fences a later conditional write. */\nexport interface ObjectRow {\n  readonly bytes: Uint8Array;\n  /** The store's version fence \u2014 an S3/Azure ETag, a GCS generation. Opaque to this class. */\n  readonly version: string;\n}\n\n/**\n * The I/O calls an object store must provide to host a registry: three, and an optional conditional delete. Everything\n * else \u2014 the OCC token, tombstones, the delete retry, key parsing \u2014 is implemented once above.\n */\nexport interface ObjectRegistryStore {\n  /** A label for error messages, e.g. `GCS` or `Azure Blob`. */\n  readonly label: string;\n  /**\n   * Read one object, or `null` when it is absent.\n   *\n   * **`null` means the object does not exist** \u2014 nothing weaker. A store that reads in two round trips\n   * (metadata for the version fence, then the bytes pinned to it) can find that version already gone; it\n   * MUST report that with {@link ObjectVersionRaced} rather than `null` or {@link WriteConflictError}, and\n   * the caller re-reads. Retryable faults throw {@link TransientError}.\n   *\n   * `bytes` and `version` MUST describe the **same** observation of the object: `version` is the fence a\n   * later conditional write is conditioned on, so a pair drawn from two different versions would either\n   * fail a write that should have succeeded or, worse, pass one that should not.\n   */\n  read(key: string): Promise<ObjectRow | null>;\n  /**\n   * Write one object under a precondition: `'absent'` means create-only, a version means\n   * compare-and-swap against exactly that version. A lost race MUST throw {@link WriteConflictError}.\n   *\n   * A store must not replay this write after a lost response without telling the replay apart: the replay meets\n   * the row it just wrote and its precondition fails, which would read as a lost race. Send it once, or store a\n   * write id with the row and treat a conflict whose stored row carries it as success. Retryable faults throw\n   * {@link TransientError}.\n   */\n  write(key: string, body: Uint8Array, expect: 'absent' | { version: string }): Promise<void>;\n  /** Every object key under `prefix`, paginated internally. */\n  listKeys(prefix: string): AsyncIterable<string>;\n  /**\n   * Optional: delete one object, and only while it is still at exactly `expect.version`, by a precondition the\n   * backend applies (`If-Match: <etag>`, `ifGenerationMatch: <generation>`). An object that was overwritten, or is\n   * gone, MUST throw {@link WriteConflictError} and delete nothing. Retryable faults throw {@link TransientError}.\n   *\n   * Sending it again after a lost response is safe, unlike a write: the precondition names one version, so a second\n   * copy can remove nothing the first was not allowed to. A copy that meets its own landed delete fails the\n   * precondition and reports a conflict; the registry re-reads, and finds the row gone.\n   *\n   * The registry calls it only when {@link conditionalDelete} is `true`.\n   */\n  delete?(key: string, expect: { version: string }): Promise<void>;\n  /**\n   * Whether {@link delete} may be relied on: `true` only where the backend is known to apply the precondition. A\n   * backend that accepts the header and ignores it would let a delete remove a row written after the delete read it,\n   * a live one included. Absent or `false`, the registry never calls `delete` and tombstones every row instead.\n   */\n  readonly conditionalDelete?: boolean;\n}\n\nexport class ObjectStoreRegistry implements IRegistryDriver {\n  /**\n   * `entropy` draws the random parts of every token: a new row's incarnation id, and each write's own part. It\n   * defaults to the platform's Web Crypto. Inject one only to make a test replayable: a seeded source in production\n   * gives every process the same ids.\n   */\n  constructor(\n    private readonly store: ObjectRegistryStore,\n    private readonly prefix: string | undefined,\n    private readonly now: () => number,\n    private readonly entropy: Entropy = webCryptoEntropy,\n  ) {}\n\n  capabilities(): RegCaps {\n    const conditionalDelete = this.removesRows();\n    return entropyIsAvailable(this.entropy)\n      ? { strongRead: true, conditionalDelete }\n      : { strongRead: true, canWrite: false, conditionalDelete };\n  }\n\n  /** Whether a delete removes a row born with an incarnation id: the store has a delete, and vouches for it. */\n  private removesRows(): boolean {\n    return this.store.conditionalDelete === true && typeof this.store.delete === 'function';\n  }\n\n  async get(ref: SegmentRef): Promise<RegistryRecord | null> {\n    const current = await this.readRow(registryObjectKey(this.prefix, ref));\n    return current && !current.env.deleted ? current.env.record : null;\n  }\n\n  async create(ref: SegmentRef, record: NewRegistryRecord): Promise<{ token: Token }> {\n    const checked = validateNewRegistryRecord(record);\n    const key = registryObjectKey(this.prefix, ref);\n    const current = await this.readRow(key);\n    if (current !== null && !current.env.deleted) {\n      throw new WriteConflictError(`registry row already exists for segment ${ref.segment}`);\n    }\n    // A new incarnation, whose counter continues across a tombstone, so with overwhelming probability a recreate never re-issues an old token.\n    const token = newIncarnationToken(this.entropy, current?.env.record);\n    const env: RegistryEnvelope = {\n      deleted: false,\n      record: recordFromNew(ref, checked, this.now(), token),\n    };\n    // Create-only when truly absent; overwrite the tombstone under its version when recreating. Either way\n    // a concurrent create loses the precondition and surfaces as a conflict.\n    await this.putRow(key, env, current ? { version: current.version } : 'absent');\n    return { token };\n  }\n\n  async compareAndSwap(\n    ref: SegmentRef,\n    expected: Token,\n    patch: RegistryPatch,\n  ): Promise<{ token: Token }> {\n    const checked = validateRegistryPatch(patch);\n    const key = registryObjectKey(this.prefix, ref);\n    const current = await this.readRow(key);\n    if (current === null || current.env.deleted || current.env.record.token !== expected) {\n      throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);\n    }\n    const token = nextRegistryToken(current.env.record, this.entropy);\n    const env: RegistryEnvelope = {\n      deleted: false,\n      record: applyRegistryPatch(current.env.record, checked, this.now(), token),\n    };\n    // The version we read fences a concurrent writer between that read and this write.\n    await this.putRow(key, env, { version: current.version });\n    return { token };\n  }\n\n  async *list(namespace?: string): AsyncIterable<RegistryRecord> {\n    const prefix = registryListPrefix(this.prefix, namespace);\n    // One list plus bounded parallel reads. A serial await-in-loop made this O(N) sequential round trips.\n    let page: string[] = [];\n    const flush = async function* (\n      this: ObjectStoreRegistry,\n      keys: string[],\n    ): AsyncIterable<RegistryRecord> {\n      const rows = await mapWithConcurrency(keys, LIST_READ_CONCURRENCY, (key) =>\n        this.readRow(key),\n      );\n      for (const current of rows) {\n        if (current && !current.env.deleted) yield current.env.record;\n      }\n    }.bind(this);\n\n    for await (const key of this.store.listKeys(prefix)) {\n      if (parseRegistryKey(this.prefix, key) === null) continue; // stray or foreign object\n      page.push(key);\n      if (page.length >= LIST_READ_CONCURRENCY) {\n        yield* flush(page);\n        page = [];\n      }\n    }\n    if (page.length > 0) yield* flush(page);\n  }\n\n  async delete(ref: SegmentRef, expected?: Token): Promise<void> {\n    const key = registryObjectKey(this.prefix, ref);\n    // A row born with an incarnation id is removed from the store, by a delete the store applies only while the\n    // object is still the version read here: a later create draws a new incarnation, so nothing of this row is needed\n    // to keep its tokens apart. Any other row is tombstoned (the counter advanced, the object kept), so a re-create\n    // carries the counter on. Retry the read and the write on a cross-process race; it converges, then fails typed\n    // rather than silently leaving the row live.\n    for (let attempt = 0; attempt < MAX_DELETE_ATTEMPTS; attempt++) {\n      const current = await this.readRow(key);\n      if (expected !== undefined) {\n        // Fenced: the row must still carry the token the caller read. Re-checked on every attempt, so a row\n        // that was swapped, or deleted and re-created, between two attempts is refused rather than tombstoned.\n        if (current === null || current.env.deleted || current.env.record.token !== expected) {\n          throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);\n        }\n      } else if (current === null || current.env.deleted) {\n        return; // idempotent \u2014 already gone\n      }\n      try {\n        const remove = this.removesRows() ? this.store.delete : undefined;\n        if (remove !== undefined && incarnationOf(current.env.record.token) !== undefined) {\n          // The version read above is the row the caller's token names, so this removes that row and no later one.\n          await remove.call(this.store, key, { version: current.version });\n          return;\n        }\n        const token = nextRegistryToken(current.env.record, this.entropy);\n        const env: RegistryEnvelope = {\n          deleted: true,\n          record: { ...current.env.record, token, updatedAt: this.now() },\n        };\n        await this.putRow(key, env, { version: current.version });\n        return;\n      } catch (err) {\n        if (isWriteConflictError(err)) continue; // raced \u2014 re-read and try again\n        throw err;\n      }\n    }\n    throw new WriteConflictError(`registry delete: contention deleting \"${ref.segment}\" \u2014 retry`);\n  }\n\n  /**\n   * Read + parse a registry object, returning its envelope and version fence, or null if absent.\n   *\n   * A store that pins a version to read consistently ({@link ObjectVersionRaced}) loses that pin whenever a\n   * concurrent writer lands mid-read. Re-reading is the whole answer \u2014 the next read simply observes the\n   * newer version \u2014 and it is bounded so a row under permanent write saturation fails typed instead of\n   * spinning. Only a store that reads in two calls gets here; none of the shipped stores does.\n   */\n  private async readRow(\n    objectKey: string,\n  ): Promise<{ env: RegistryEnvelope; version: string } | null> {\n    const row = await this.readRaced(objectKey);\n    if (row === null) return null;\n    if (row.bytes.length > MAX_ROW_BYTES) {\n      throw new IntegrityError(\n        `registry object ${row.bytes.length}B exceeds cap ${MAX_ROW_BYTES}B`,\n      );\n    }\n    if (row.version.length === 0) {\n      // The version is the OCC fence for CAS; a backend that omits it cannot be used safely as a registry.\n      throw new IntegrityError(\n        `registry object has no version fence (needed for compare-and-swap): ${objectKey}`,\n      );\n    }\n    const env = parseRegistryEnvelope(new TextDecoder().decode(row.bytes), objectKey);\n    return { env, version: row.version };\n  }\n\n  /** {@link ObjectRegistryStore.read}, retrying the bounded number of times a mid-read overwrite allows. */\n  private async readRaced(objectKey: string): Promise<ObjectRow | null> {\n    for (let attempt = 0; attempt < MAX_READ_ATTEMPTS; attempt++) {\n      try {\n        return await this.store.read(objectKey);\n      } catch (err) {\n        if (!(err instanceof ObjectVersionRaced)) throw err;\n      }\n    }\n    throw new TransientError(\n      `registry read: ${this.store.label} object \"${objectKey}\" was overwritten on every one of ` +\n        `${MAX_READ_ATTEMPTS} attempts \u2014 retry`,\n    );\n  }\n\n  /** Conditional write of an envelope. The store maps a lost precondition to {@link WriteConflictError}. */\n  private async putRow(\n    objectKey: string,\n    env: RegistryEnvelope,\n    expect: 'absent' | { version: string },\n  ): Promise<void> {\n    const body = new TextEncoder().encode(serializeRegistryEnvelope(env));\n    if (body.length > MAX_ROW_BYTES) {\n      // Belt-and-braces: the governance/DEK fields are already capped by validate*, so this cannot fire for\n      // valid input \u2014 but never write a row that would later be unreadable.\n      throw new ValidationError(`registry object ${body.length}B exceeds cap ${MAX_ROW_BYTES}B`);\n    }\n    await this.store.write(objectKey, body, expect);\n  }\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,IAAM,kBAAkB;AAGjB,SAAS,WAAW,QAAoC;AAC7D,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,UAAU,OAAO,QAAQ,cAAc,EAAE;AAC/C,SAAO,YAAY,KAAK,KAAK,GAAG,OAAO;AACzC;AAaO,SAAS,sBAAsB,QAAgD;AACpF,MAAI,WAAW,OAAW,QAAO;AACjC,aAAW,MAAM,QAAQ;AACvB,UAAM,OAAO,GAAG,WAAW,CAAC;AAE5B,QAAI,OAAO,MAAQ,SAAS,KAAM;AAChC,YAAM,IAAI,gBAAgB,4CAA4C;AAAA,IACxE;AAAA,EACF;AACA,MAAI,OAAO,SAAS,IAAI,GAAG;AACzB,UAAM,IAAI;AAAA,MACR,4EAA4E,KAAK,UAAU,MAAM,CAAC;AAAA,IACpG;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,mBAAmB,MAAM;AAAA,EACrC,QAAQ;AACN,cAAU;AAAA,EACZ;AACA,aAAW,UAAU,YAAY,SAAS,CAAC,MAAM,IAAI,CAAC,QAAQ,OAAO,GAAG;AACtE,eAAW,WAAW,OAAO,MAAM,GAAG,GAAG;AACvC,UAAI,YAAY,OAAO,YAAY,MAAM;AACvC,cAAM,IAAI;AAAA,UACR,sDAAsD,KAAK,UAAU,MAAM,CAAC;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,eAAe,QAAoC;AACjE,SAAO,GAAG,WAAW,MAAM,CAAC;AAC9B;AAGO,SAAS,kBAAkB,QAA4B,KAAyB;AACrF,qBAAmB,GAAG;AACtB,SAAO,GAAG,eAAe,MAAM,CAAC,GAAG,iBAAiB,IAAI,SAAS,CAAC,IAAI,iBAAiB,IAAI,OAAO,CAAC,GAAG,eAAe;AACvH;AAGO,SAAS,mBAAmB,QAA4B,WAA4B;AACzF,QAAM,OAAO,eAAe,MAAM;AAClC,SAAO,cAAc,SAAY,OAAO,GAAG,IAAI,GAAG,iBAAiB,SAAS,CAAC;AAC/E;AAQO,SAAS,iBAAiB,QAA4B,WAAsC;AACjG,QAAM,OAAO,eAAe,MAAM;AAClC,MAAI,CAAC,UAAU,WAAW,IAAI,KAAK,CAAC,UAAU,SAAS,eAAe,EAAG,QAAO;AAChF,QAAM,OAAO,UAAU,MAAM,KAAK,QAAQ,UAAU,SAAS,gBAAgB,MAAM;AACnF,QAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,MAAI,QAAQ,EAAG,QAAO;AACtB,QAAM,SAAS,KAAK,MAAM,GAAG,KAAK;AAClC,QAAM,iBAAiB,KAAK,MAAM,QAAQ,CAAC;AAC3C,MAAI,eAAe,WAAW,KAAK,eAAe,SAAS,GAAG,EAAG,QAAO;AACxE,QAAM,UAAU,kBAAkB,cAAc;AAChD,QAAM,YAAY,WAAW,oBAAoB,SAAY,kBAAkB,MAAM;AAGrF,MAAI,iBAAiB,OAAO,MAAM,eAAgB,QAAO;AACzD,MAAI,cAAc,UAAa,iBAAiB,SAAS,MAAM,OAAQ,QAAO;AAC9E,QAAM,MAAkB,EAAE,SAAS,UAAU;AAC7C,MAAI;AACF,uBAAmB,GAAG;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACtBO,IAAM,gBAAgB,IAAI,OAAO;AAExC,IAAM,sBAAsB;AAE5B,IAAM,oBAAoB;AAE1B,IAAM,wBAAwB;AAgBvB,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,WAAmB;AAC7B,UAAM,6CAA6C,SAAS,EAAE;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;AA6DO,IAAM,sBAAN,MAAqD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1D,YACmB,OACA,QACA,KACA,UAAmB,kBACpC;AAJiB;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAJgB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGnB,eAAwB;AACtB,UAAM,oBAAoB,KAAK,YAAY;AAC3C,WAAO,mBAAmB,KAAK,OAAO,IAClC,EAAE,YAAY,MAAM,kBAAkB,IACtC,EAAE,YAAY,MAAM,UAAU,OAAO,kBAAkB;AAAA,EAC7D;AAAA;AAAA,EAGQ,cAAuB;AAC7B,WAAO,KAAK,MAAM,sBAAsB,QAAQ,OAAO,KAAK,MAAM,WAAW;AAAA,EAC/E;AAAA,EAEA,MAAM,IAAI,KAAiD;AACzD,UAAM,UAAU,MAAM,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,GAAG,CAAC;AACtE,WAAO,WAAW,CAAC,QAAQ,IAAI,UAAU,QAAQ,IAAI,SAAS;AAAA,EAChE;AAAA,EAEA,MAAM,OAAO,KAAiB,QAAsD;AAClF,UAAM,UAAU,0BAA0B,MAAM;AAChD,UAAM,MAAM,kBAAkB,KAAK,QAAQ,GAAG;AAC9C,UAAM,UAAU,MAAM,KAAK,QAAQ,GAAG;AACtC,QAAI,YAAY,QAAQ,CAAC,QAAQ,IAAI,SAAS;AAC5C,YAAM,IAAI,mBAAmB,2CAA2C,IAAI,OAAO,EAAE;AAAA,IACvF;AAEA,UAAM,QAAQ,oBAAoB,KAAK,SAAS,SAAS,IAAI,MAAM;AACnE,UAAM,MAAwB;AAAA,MAC5B,SAAS;AAAA,MACT,QAAQ,cAAc,KAAK,SAAS,KAAK,IAAI,GAAG,KAAK;AAAA,IACvD;AAGA,UAAM,KAAK,OAAO,KAAK,KAAK,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC7E,WAAO,EAAE,MAAM;AAAA,EACjB;AAAA,EAEA,MAAM,eACJ,KACA,UACA,OAC2B;AAC3B,UAAM,UAAU,sBAAsB,KAAK;AAC3C,UAAM,MAAM,kBAAkB,KAAK,QAAQ,GAAG;AAC9C,UAAM,UAAU,MAAM,KAAK,QAAQ,GAAG;AACtC,QAAI,YAAY,QAAQ,QAAQ,IAAI,WAAW,QAAQ,IAAI,OAAO,UAAU,UAAU;AACpF,YAAM,IAAI,mBAAmB,uCAAuC,IAAI,OAAO,EAAE;AAAA,IACnF;AACA,UAAM,QAAQ,kBAAkB,QAAQ,IAAI,QAAQ,KAAK,OAAO;AAChE,UAAM,MAAwB;AAAA,MAC5B,SAAS;AAAA,MACT,QAAQ,mBAAmB,QAAQ,IAAI,QAAQ,SAAS,KAAK,IAAI,GAAG,KAAK;AAAA,IAC3E;AAEA,UAAM,KAAK,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,QAAQ,CAAC;AACxD,WAAO,EAAE,MAAM;AAAA,EACjB;AAAA,EAEA,OAAO,KAAK,WAAmD;AAC7D,UAAM,SAAS,mBAAmB,KAAK,QAAQ,SAAS;AAExD,QAAI,OAAiB,CAAC;AACtB,UAAM,QAAQ,iBAEZ,MAC+B;AAC/B,YAAM,OAAO,MAAM;AAAA,QAAmB;AAAA,QAAM;AAAA,QAAuB,CAAC,QAClE,KAAK,QAAQ,GAAG;AAAA,MAClB;AACA,iBAAW,WAAW,MAAM;AAC1B,YAAI,WAAW,CAAC,QAAQ,IAAI,QAAS,OAAM,QAAQ,IAAI;AAAA,MACzD;AAAA,IACF,EAAE,KAAK,IAAI;AAEX,qBAAiB,OAAO,KAAK,MAAM,SAAS,MAAM,GAAG;AACnD,UAAI,iBAAiB,KAAK,QAAQ,GAAG,MAAM,KAAM;AACjD,WAAK,KAAK,GAAG;AACb,UAAI,KAAK,UAAU,uBAAuB;AACxC,eAAO,MAAM,IAAI;AACjB,eAAO,CAAC;AAAA,MACV;AAAA,IACF;AACA,QAAI,KAAK,SAAS,EAAG,QAAO,MAAM,IAAI;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,KAAiB,UAAiC;AAC7D,UAAM,MAAM,kBAAkB,KAAK,QAAQ,GAAG;AAM9C,aAAS,UAAU,GAAG,UAAU,qBAAqB,WAAW;AAC9D,YAAM,UAAU,MAAM,KAAK,QAAQ,GAAG;AACtC,UAAI,aAAa,QAAW;AAG1B,YAAI,YAAY,QAAQ,QAAQ,IAAI,WAAW,QAAQ,IAAI,OAAO,UAAU,UAAU;AACpF,gBAAM,IAAI,mBAAmB,uCAAuC,IAAI,OAAO,EAAE;AAAA,QACnF;AAAA,MACF,WAAW,YAAY,QAAQ,QAAQ,IAAI,SAAS;AAClD;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,KAAK,YAAY,IAAI,KAAK,MAAM,SAAS;AACxD,YAAI,WAAW,UAAa,cAAc,QAAQ,IAAI,OAAO,KAAK,MAAM,QAAW;AAEjF,gBAAM,OAAO,KAAK,KAAK,OAAO,KAAK,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAC/D;AAAA,QACF;AACA,cAAM,QAAQ,kBAAkB,QAAQ,IAAI,QAAQ,KAAK,OAAO;AAChE,cAAM,MAAwB;AAAA,UAC5B,SAAS;AAAA,UACT,QAAQ,EAAE,GAAG,QAAQ,IAAI,QAAQ,OAAO,WAAW,KAAK,IAAI,EAAE;AAAA,QAChE;AACA,cAAM,KAAK,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,QAAQ,CAAC;AACxD;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,qBAAqB,GAAG,EAAG;AAC/B,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI,mBAAmB,yCAAyC,IAAI,OAAO,gBAAW;AAAA,EAC9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,QACZ,WAC4D;AAC5D,UAAM,MAAM,MAAM,KAAK,UAAU,SAAS;AAC1C,QAAI,QAAQ,KAAM,QAAO;AACzB,QAAI,IAAI,MAAM,SAAS,eAAe;AACpC,YAAM,IAAI;AAAA,QACR,mBAAmB,IAAI,MAAM,MAAM,iBAAiB,aAAa;AAAA,MACnE;AAAA,IACF;AACA,QAAI,IAAI,QAAQ,WAAW,GAAG;AAE5B,YAAM,IAAI;AAAA,QACR,uEAAuE,SAAS;AAAA,MAClF;AAAA,IACF;AACA,UAAM,MAAM,sBAAsB,IAAI,YAAY,EAAE,OAAO,IAAI,KAAK,GAAG,SAAS;AAChF,WAAO,EAAE,KAAK,SAAS,IAAI,QAAQ;AAAA,EACrC;AAAA;AAAA,EAGA,MAAc,UAAU,WAA8C;AACpE,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,UAAI;AACF,eAAO,MAAM,KAAK,MAAM,KAAK,SAAS;AAAA,MACxC,SAAS,KAAK;AACZ,YAAI,EAAE,eAAe,oBAAqB,OAAM;AAAA,MAClD;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,MAAM,KAAK,YAAY,SAAS,qCAClD,iBAAiB;AAAA,IACxB;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,OACZ,WACA,KACA,QACe;AACf,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,0BAA0B,GAAG,CAAC;AACpE,QAAI,KAAK,SAAS,eAAe;AAG/B,YAAM,IAAI,gBAAgB,mBAAmB,KAAK,MAAM,iBAAiB,aAAa,GAAG;AAAA,IAC3F;AACA,UAAM,KAAK,MAAM,MAAM,WAAW,MAAM,MAAM;AAAA,EAChD;AACF;",
   "names": []
 }

package/dist/drivers/retry/retrying-chunk-source.d.ts

@@ -21,7 +21,7 @@
  */
 import type { Clock, Rng } from '../../core/determinism.js';
 import type { RetryPolicy } from '../../core/retry.js';
-import type { ChunkRef, GenerationSummary, StorageChunkSource, SegmentRef, SegmentSize } from '../../core/ports.js';
+import type { ChunkRef, ChunkRead, ReadChunksOptions, GenerationSummary, StorageChunkSource, SegmentRef, SegmentSize } from '../../core/ports.js';
 export interface RetryingOptions {
     readonly clock: Clock;
     readonly rng: Rng;
@@ -43,6 +43,7 @@ export declare class RetryingStorageChunkSource implements StorageChunkSource {
     private readonly deps;
     /** Present only when the inner source supports it — so capability detection stays honest. */
     readonly sizeOf?: (ref: SegmentRef) => Promise<SegmentSize | null>;
+    readonly getChunks?: (ref: SegmentRef, keys: readonly number[], options?: ReadChunksOptions) => AsyncIterable<ChunkRead>;
     readonly cardinalities?: (ref: SegmentRef) => Promise<ReadonlyMap<number, number> | null>;
     readonly summary?: (ref: SegmentRef) => Promise<GenerationSummary | null>;
     readonly currentGeneration?: (ref: SegmentRef) => Promise<number | null>;