@cloudbitmaps/core 0.17.0 → 0.18.0

package/dist/core/engine.d.ts

@@ -312,32 +312,8 @@ export declare class SegmentEngine {
     private streamedVersion;
     /** The cache key of a chunk: by the version it was read under, or by segment and key alone for a source with none. */
     private chunkCacheKey;
-    /** The segment's chunk keys, ascending — a shape read off the index, no payload. Keys are untrusted (invariant 5). */
+    /** The segment's chunk keys, ascending, checked as untrusted tier data. */
     private chunkKeys;
-    /**
-     * Tier-derived keys are untrusted (invariant 5) — fail fast on a corrupt/out-of-range key rather than
-     * letting it flow into the id-routing step and produce a bogus id.
-     */
-    private assertChunkKeyInRange;
-    /**
-     * The other half of invariant 5: a chunk payload holds **remainders** — 16-bit offsets within one chunk — so
-     * every value must be `<= 0xffff`.
-     *
-     * Nothing upstream establishes that. The byte cap bounds *size*, and CRC/AEAD prove the bytes are the bytes
-     * that were written — which anyone able to write the bucket satisfies trivially. A value `>= 65536` would then
-     * reach the id-routing step, which masks it (`remainder & 0xffff`) and emits a **fabricated id belonging to a different
-     * chunk's id space**: indistinguishable from real data, inflating `count()` and creating spurious `intersect`
-     * matches.
-     *
-     * Costs one `maximum()` per chunk, not per id — `maximum` is optional on the codec seam precisely so a codec
-     * that cannot answer in O(1) opts out instead of making the read path walk every value.
-     *
-     * One value stands for all of them only because the decode is structurally checked. Roaring answers `maximum()`
-     * from its last container, so a payload listing its containers out of order would report the wrong one's
-     * largest value and pass here while holding values above 65,535. The codec's `safeDeserialize` refuses that
-     * payload, and every other shape that would make this answer wrong, before it reaches this check.
-     */
-    private assertChunkPayloadInRange;
     /**
      * Refuse a combine whose operand names a segment that was never created.
      *
@@ -402,11 +378,6 @@ export declare class SegmentEngine {
      * one): callers read it or clone it, never mutate it.
      */
     private storageChunk;
-    /**
-     * A chunk's stored bytes decoded under the size cap (invariant 5) and range-checked: the one place a chunk becomes a
-     * bitmap, whether its bytes came from a request of its own or from a stream of coalesced ranges.
-     */
-    private decodeChunk;
     /**
      * One chunk, decoded, range-checked and cached. A source with `getChunks` is read through it, as a one-key stream, so
      * a `storage.get` is reported only for a request that was sent (a chunk the source holds in memory sends none);

package/dist/core/errors.d.ts

@@ -61,6 +61,20 @@ export declare class LeaseExpiredError extends CloudRoaringError {
  */
 export declare class LeaseLimitError extends CloudRoaringError {
 }
+/**
+ * An operand a call relied on changed while the call ran, so what the call built from it is not published. Carries the
+ * operand's name in the call and why it is stale (`'moved'`: it was pinned at a generation and its pointer has since
+ * moved; `'erased'`: an erasure ran in the store after a call with a feed began, so what the feed gave it may hold an
+ * erased id), under the stable `code` `'stale-operand'`. Deterministic: run the call again against the current operand.
+ */
+export declare class StaleOperandError extends CloudRoaringError {
+    readonly code: "stale-operand";
+    /** The operand's name in the call that found it stale. */
+    readonly operand: string;
+    /** Why it is stale. */
+    readonly reason: 'moved' | 'erased';
+    constructor(message: string, operand: string, reason: 'moved' | 'erased');
+}
 /**
  * This build/configuration cannot perform the requested operation, though nothing is malformed. Two uses:
  * (1) **format** — the bytes are well-formed but unreadable here (an unknown `.crbm` major version) —
@@ -125,6 +139,8 @@ export declare function isWriteConflictError(err: unknown): err is WriteConflict
 export declare function isTransientError(err: unknown): err is TransientError;
 /** A read came after its pin's lease ended. */
 export declare function isLeaseExpiredError(err: unknown): err is LeaseExpiredError;
+/** An operand a call relied on changed while it ran. */
+export declare function isStaleOperandError(err: unknown): err is StaleOperandError;
 /** A segment has no room for another live lease. */
 export declare function isLeaseLimitError(err: unknown): err is LeaseLimitError;
 /** A requested object/row does not exist. */

package/dist/core/load-input.d.ts

@@ -57,11 +57,12 @@ export declare class ChunkLoadInput {
  * Check a load's input and decode a bitmap input, before the load makes any request.
  *
  * @returns ids unchanged, to be consumed lazily by the write, or the decoded bitmap.
+ * @param subject names what takes the input in a refusal's message.
  * @throws {ValidationError} for a byte array passed as ids; bytes that are malformed, over the cap, or followed by
  * more bytes; a `{ bitmap }` with no `serialize` method, or whose `serialize('portable')` returns no `Uint8Array`;
  * and anything that is none of the three inputs. An error the caller's own `serialize` throws propagates as it is.
  */
-export declare function prepareLoadInput(input: LoadInput, codec: CodecInterface): Iterable<number> | AsyncIterable<number> | DecodedLoadInput;
+export declare function prepareLoadInput(input: LoadInput, codec: CodecInterface, subject?: string): Iterable<number> | AsyncIterable<number> | DecodedLoadInput;
 /**
  * Portable bytes a caller holds, checked and decoded by the codec's safe deserializer: the one check every bitmap
  * input of a load goes through, and what a flavor offers its users to decode bytes they hold themselves.

package/dist/driver-kit.js

@@ -29,7 +29,7 @@ import {
   validateRegistryPatch,
   validateSegmentRef,
   webCryptoEntropy
-} from "./chunk-CV7GJO3B.js";
+} from "./chunk-CCP4U32U.js";
 
 // src/drivers/_shared/object-registry-keys.ts
 var REGISTRY_SUFFIX = ".reg";

package/dist/index.d.ts

@@ -39,6 +39,10 @@ export type { LeaseDeps, LeaseTake, TakenLease } from './core/leases.js';
 export { PinnedStorageChunkSource } from './core/pinned-storage-source.js';
 export type { PinnedAt } from './core/pinned-storage-source.js';
 export { loadSegment, loadSegmentChunks } from './core/load.js';
+export { compileCombineMany, rebindCombineMany, runCombineMany } from './core/combine-many.js';
+export type { CombineExpr, CombineManyDeps, CombineManyFeed, CombineManyFeedRecord, CombineManyHeld, CombineManyOperand, CombineManyOperandStats, CombineManyOutcome, CombineManyOutput, CombineManyOutputStats, CombineManyRequest, CombineManyRun, CombineManyStats, CombineManyWrite, CompiledCombineMany, } from './core/combine-many.js';
+export { prepareHeld } from './core/combine-held.js';
+export type { HeldChunks } from './core/combine-held.js';
 export type { LoadDeps, LoadOptions, LoadGuard, LoadResult, LoadRefusal } from './core/load.js';
 export type { LoadInput, PortableBitmap } from './core/load-input.js';
 export { decodeSerialized } from './core/load-input.js';
@@ -49,7 +53,7 @@ export type { EraseIdDeps, EraseIdResult } from './core/erase-id.js';
 export type { CodecInterface, CodecBitmap, EncodedChunk } from './core/codec.js';
 export type { Clock, Entropy, Rng } from './core/determinism.js';
 export type { StorageChunkSource, IStorageDriver, StorageCaps, ChunkRef, ChunkRead, ReadChunksOptions, SegmentRef, GenKey, IRegistryDriver, StorageBackend, RegistryRecord, NewRegistryRecord, RegistryPatch, RegistryStatus, RegistrySummary, RegistryWriteOptions, LeaseEntry, ReapLegacyTombstonesOptions, ReapLegacyTombstonesResult, ClearRegistrySummary, SealedRegistrySummary, GenerationMetadata, GenerationSummary, RegCaps, GovernanceMeta, SegmentSize, } from './core/ports.js';
-export { CloudRoaringError, ValidationError, WriteConflictError, IntegrityError, NotFoundError, UnsupportedError, CapabilityError, TransientError, KeyUnavailableError, BudgetExceededError, LeaseExpiredError, LeaseLimitError, isCloudRoaringError, isWriteConflictError, isTransientError, isNotFoundError, isIntegrityError, isValidationError, isLeaseExpiredError, isLeaseLimitError, } from './core/errors.js';
+export { CloudRoaringError, ValidationError, WriteConflictError, IntegrityError, NotFoundError, UnsupportedError, CapabilityError, TransientError, KeyUnavailableError, BudgetExceededError, LeaseExpiredError, LeaseLimitError, StaleOperandError, isCloudRoaringError, isWriteConflictError, isTransientError, isNotFoundError, isIntegrityError, isValidationError, isLeaseExpiredError, isLeaseLimitError, isStaleOperandError, } from './core/errors.js';
 export type { Aead, AeadSealed, IKeystore, WrappedDek, CrbmCrypto } from './core/crypto.js';
 export { aadFor } from './core/crypto.js';
 export { NodeAead, InProcessKeystore } from './drivers/crypto.js';