@cloudbitmaps/core 0.19.0 → 0.20.0

package/dist/{chunk-TNWTIAON.js → chunk-YSC7NJWV.js}

@@ -172,11 +172,179 @@ function decodeNameFromPath(encoded) {
   return decodePercent(encoded);
 }
 
+// src/core/validate.ts
+var CHUNK_KEY_MAX = 65535;
+var MAX_NAME_LENGTH = 256;
+var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+function isWellFormedString(value) {
+  return !LONE_SURROGATE.test(value);
+}
+function encodedNameLength(value) {
+  return Math.max(encodeNameForKey(value).length, encodeNameForPath(value).length);
+}
+function validatePart(value, field) {
+  if (typeof value !== "string") {
+    throw new ValidationError(`${field} must be a string; got ${typeof value}`);
+  }
+  if (value.length === 0) {
+    throw new ValidationError(`${field} must not be empty`);
+  }
+  if (value.length > MAX_NAME_LENGTH) {
+    throw new ValidationError(
+      `${field} is too long: ${value.length} characters (limit ${MAX_NAME_LENGTH} once encoded for a storage key)`
+    );
+  }
+  if (LONE_SURROGATE.test(value)) {
+    throw new ValidationError(
+      `${field} contains an unpaired surrogate, so it has no UTF-8 encoding and cannot be stored. This is usually a string sliced through an astral character (an emoji, say) \u2014 slice by code point instead.`
+    );
+  }
+  const encoded = encodedNameLength(value);
+  if (encoded > MAX_NAME_LENGTH) {
+    throw new ValidationError(
+      `${field} is too long: ${encoded} characters once encoded for storage (limit ${MAX_NAME_LENGTH}). The name itself is ${value.length} characters \u2014 encoding expands anything outside [A-Za-z0-9._-], so a name of mostly non-ASCII text, or one full of colons, reaches the limit sooner than its length suggests.`
+    );
+  }
+}
+function validateSegmentRef(ref) {
+  validatePart(ref.segment, "segment");
+  if (ref.namespace !== void 0) validatePart(ref.namespace, "namespace");
+}
+var RESERVED_NAMESPACE_PREFIX = "cbm.due.";
+function isReservedNamespace(namespace) {
+  return namespace !== void 0 && namespace.startsWith(RESERVED_NAMESPACE_PREFIX);
+}
+function validateUserNamespace(namespace) {
+  validatePart(namespace, "namespace");
+  if (isReservedNamespace(namespace)) {
+    throw new ValidationError(
+      `namespace "${namespace}" is reserved: names starting with "${RESERVED_NAMESPACE_PREFIX}" hold the library's own bookkeeping rows, which every fleet-wide scan skips, so a segment there would be invisible to an erasure, a consistency check, an export and a retention sweep. Choose another namespace.`
+    );
+  }
+}
+function validateUserRef(ref) {
+  validatePart(ref.segment, "segment");
+  if (ref.namespace !== void 0) validateUserNamespace(ref.namespace);
+}
+function validateChunkKeyOrder(keys) {
+  for (let i = 1; i < keys.length; i++) {
+    if (!(keys[i] >= keys[i - 1]))
+      throw new ValidationError("chunk keys must be in ascending order");
+  }
+}
+function validateChunkRef(ref) {
+  validateSegmentRef(ref);
+  if (!Number.isInteger(ref.chunkKey) || ref.chunkKey < 0 || ref.chunkKey > CHUNK_KEY_MAX) {
+    throw new ValidationError(`chunkKey must be an integer in [0, ${CHUNK_KEY_MAX}]`);
+  }
+}
+
+// src/core/concurrency.ts
+async function mapWithConcurrency(items, limit, fn) {
+  if (!Number.isInteger(limit) || limit < 1) {
+    throw new ValidationError(`concurrency limit must be a positive integer; got ${limit}`);
+  }
+  const results = new Array(items.length);
+  let next = 0;
+  let failed = false;
+  let firstError;
+  const worker = async () => {
+    while (!failed) {
+      const i = next++;
+      if (i >= items.length) return;
+      try {
+        results[i] = await fn(items[i], i);
+      } catch (err) {
+        if (!failed) {
+          failed = true;
+          firstError = err;
+        }
+        return;
+      }
+    }
+  };
+  const workers = Array.from({ length: Math.min(limit, items.length) }, () => worker());
+  await Promise.all(workers);
+  if (failed) throw firstError;
+  return results;
+}
+
+// src/core/ports.ts
+function assertRegistryCanWrite(registry, what) {
+  if (registry.capabilities().canWrite === false) {
+    throw new UnsupportedError(
+      `${what}: the registry reports it cannot write a row in this runtime (capabilities().canWrite is false), so nothing is written`
+    );
+  }
+}
+var STORAGE_BACKEND_BRAND = /* @__PURE__ */ Symbol.for("cloudbitmaps.storage-backend");
+var STORAGE_BACKEND = STORAGE_BACKEND_BRAND;
+function brandAsBackend(target) {
+  if (target === null || typeof target !== "object") {
+    throw new ValidationError("brandAsBackend needs `{ storage, registry }`");
+  }
+  const { storage, registry } = target;
+  if (storage === null || typeof storage !== "object" || typeof storage.putImmutable !== "function") {
+    throw new ValidationError(
+      "brandAsBackend: `storage` must be an IStorageDriver (it has no `putImmutable`)"
+    );
+  }
+  if (registry === null || typeof registry !== "object" || typeof registry.compareAndSwap !== "function") {
+    throw new ValidationError(
+      "brandAsBackend: `registry` must be an IRegistryDriver (it has no `compareAndSwap`)"
+    );
+  }
+  try {
+    Object.defineProperty(target, STORAGE_BACKEND_BRAND, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  } catch {
+    throw new ValidationError(
+      "brandAsBackend: cannot brand a frozen or non-extensible object \u2014 pass a plain object or a class instance"
+    );
+  }
+  return target;
+}
+function isStorageBackend(value) {
+  return typeof value === "object" && value !== null && value[STORAGE_BACKEND_BRAND] === true;
+}
+
+// src/core/pointer-id.ts
+var RESOLVED_FIELDS = [
+  "currentGen",
+  "status",
+  "wrappedDeks",
+  "keyId",
+  "summary"
+];
+function renewsPointer(patch) {
+  return RESOLVED_FIELDS.some((field) => field in patch);
+}
+function renewPointer(row) {
+  return { currentGen: row.currentGen };
+}
+function pointerIdOf(row) {
+  const pointerId = row.pointerId;
+  if (typeof pointerId !== "string" || pointerId.length === 0) {
+    throw new UnsupportedError(
+      `the registry returned the row of "${row.segment}" with no pointerId: a registry must set it on every row (the token of the write that last named currentGen, status, wrappedDeks, keyId or summary; see renewsPointer in @cloudbitmaps/core/driver-kit)`
+    );
+  }
+  return pointerId;
+}
+
 // src/core/token.ts
 var INCARNATION_TOKEN = /^([0-9a-f]{32})\.(0|[1-9]\d*)\.([0-9a-f]{16})$/;
 function incarnationOf(token) {
   return INCARNATION_TOKEN.exec(token)?.[1];
 }
+function incarnationField(token) {
+  const incarnation = token === void 0 ? void 0 : incarnationOf(token);
+  return incarnation === void 0 ? {} : { incarnation };
+}
 function sameIncarnation(a, b) {
   const ia = incarnationOf(a.token);
   const ib = incarnationOf(b.token);
@@ -349,146 +517,6 @@ async function releaseLease(ref, deps, holder) {
   throw new WriteConflictError(`lease: contention releasing a lease on segment "${ref.segment}"`);
 }
 
-// src/core/validate.ts
-var CHUNK_KEY_MAX = 65535;
-var MAX_NAME_LENGTH = 256;
-var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
-function isWellFormedString(value) {
-  return !LONE_SURROGATE.test(value);
-}
-function encodedNameLength(value) {
-  return Math.max(encodeNameForKey(value).length, encodeNameForPath(value).length);
-}
-function validatePart(value, field) {
-  if (typeof value !== "string") {
-    throw new ValidationError(`${field} must be a string; got ${typeof value}`);
-  }
-  if (value.length === 0) {
-    throw new ValidationError(`${field} must not be empty`);
-  }
-  if (value.length > MAX_NAME_LENGTH) {
-    throw new ValidationError(
-      `${field} is too long: ${value.length} characters (limit ${MAX_NAME_LENGTH} once encoded for a storage key)`
-    );
-  }
-  if (LONE_SURROGATE.test(value)) {
-    throw new ValidationError(
-      `${field} contains an unpaired surrogate, so it has no UTF-8 encoding and cannot be stored. This is usually a string sliced through an astral character (an emoji, say) \u2014 slice by code point instead.`
-    );
-  }
-  const encoded = encodedNameLength(value);
-  if (encoded > MAX_NAME_LENGTH) {
-    throw new ValidationError(
-      `${field} is too long: ${encoded} characters once encoded for storage (limit ${MAX_NAME_LENGTH}). The name itself is ${value.length} characters \u2014 encoding expands anything outside [A-Za-z0-9._-], so a name of mostly non-ASCII text, or one full of colons, reaches the limit sooner than its length suggests.`
-    );
-  }
-}
-function validateSegmentRef(ref) {
-  validatePart(ref.segment, "segment");
-  if (ref.namespace !== void 0) validatePart(ref.namespace, "namespace");
-}
-var RESERVED_NAMESPACE_PREFIX = "cbm.due.";
-function isReservedNamespace(namespace) {
-  return namespace !== void 0 && namespace.startsWith(RESERVED_NAMESPACE_PREFIX);
-}
-function validateUserNamespace(namespace) {
-  validatePart(namespace, "namespace");
-  if (isReservedNamespace(namespace)) {
-    throw new ValidationError(
-      `namespace "${namespace}" is reserved: names starting with "${RESERVED_NAMESPACE_PREFIX}" hold the library's own bookkeeping rows, which every fleet-wide scan skips, so a segment there would be invisible to an erasure, a consistency check, an export and a retention sweep. Choose another namespace.`
-    );
-  }
-}
-function validateUserRef(ref) {
-  validatePart(ref.segment, "segment");
-  if (ref.namespace !== void 0) validateUserNamespace(ref.namespace);
-}
-function validateChunkKeyOrder(keys) {
-  for (let i = 1; i < keys.length; i++) {
-    if (!(keys[i] >= keys[i - 1]))
-      throw new ValidationError("chunk keys must be in ascending order");
-  }
-}
-function validateChunkRef(ref) {
-  validateSegmentRef(ref);
-  if (!Number.isInteger(ref.chunkKey) || ref.chunkKey < 0 || ref.chunkKey > CHUNK_KEY_MAX) {
-    throw new ValidationError(`chunkKey must be an integer in [0, ${CHUNK_KEY_MAX}]`);
-  }
-}
-
-// src/core/concurrency.ts
-async function mapWithConcurrency(items, limit, fn) {
-  if (!Number.isInteger(limit) || limit < 1) {
-    throw new ValidationError(`concurrency limit must be a positive integer; got ${limit}`);
-  }
-  const results = new Array(items.length);
-  let next = 0;
-  let failed = false;
-  let firstError;
-  const worker = async () => {
-    while (!failed) {
-      const i = next++;
-      if (i >= items.length) return;
-      try {
-        results[i] = await fn(items[i], i);
-      } catch (err) {
-        if (!failed) {
-          failed = true;
-          firstError = err;
-        }
-        return;
-      }
-    }
-  };
-  const workers = Array.from({ length: Math.min(limit, items.length) }, () => worker());
-  await Promise.all(workers);
-  if (failed) throw firstError;
-  return results;
-}
-
-// src/core/ports.ts
-function assertRegistryCanWrite(registry, what) {
-  if (registry.capabilities().canWrite === false) {
-    throw new UnsupportedError(
-      `${what}: the registry reports it cannot write a row in this runtime (capabilities().canWrite is false), so nothing is written`
-    );
-  }
-}
-var STORAGE_BACKEND_BRAND = /* @__PURE__ */ Symbol.for("cloudbitmaps.storage-backend");
-var STORAGE_BACKEND = STORAGE_BACKEND_BRAND;
-function brandAsBackend(target) {
-  if (target === null || typeof target !== "object") {
-    throw new ValidationError("brandAsBackend needs `{ storage, registry }`");
-  }
-  const { storage, registry } = target;
-  if (storage === null || typeof storage !== "object" || typeof storage.putImmutable !== "function") {
-    throw new ValidationError(
-      "brandAsBackend: `storage` must be an IStorageDriver (it has no `putImmutable`)"
-    );
-  }
-  if (registry === null || typeof registry !== "object" || typeof registry.compareAndSwap !== "function") {
-    throw new ValidationError(
-      "brandAsBackend: `registry` must be an IRegistryDriver (it has no `compareAndSwap`)"
-    );
-  }
-  try {
-    Object.defineProperty(target, STORAGE_BACKEND_BRAND, {
-      value: true,
-      enumerable: false,
-      writable: false,
-      configurable: false
-    });
-  } catch {
-    throw new ValidationError(
-      "brandAsBackend: cannot brand a frozen or non-extensible object \u2014 pass a plain object or a class instance"
-    );
-  }
-  return target;
-}
-function isStorageBackend(value) {
-  return typeof value === "object" && value !== null && value[STORAGE_BACKEND_BRAND] === true;
-}
-
 // src/drivers/_shared/keys.ts
 var DEFAULT_NAMESPACE = "_default";
 function namespaceKeyPart(namespace) {
@@ -498,26 +526,9 @@ function namespacePathPart(namespace) {
   return namespace === void 0 ? DEFAULT_NAMESPACE : encodeNameForPath(namespace);
 }
 
-// src/core/kept-generations.ts
-var MAX_KEPT_GENERATIONS = 64;
-var MAX_STORED_KEPT_GENERATIONS = 256;
-function usableKeptGens(record) {
-  const list = record?.keptGens;
-  if (record === null || list === void 0 || record.currentGen === null) return void 0;
-  for (const g of list) if (g >= record.currentGen) return void 0;
-  return list;
-}
-function nextKept(prev, generation, keep) {
-  const none = { list: void 0, evict: [] };
-  if (keep === void 0 || keep > MAX_KEPT_GENERATIONS) return none;
-  if (generation === 0) return { list: [], evict: [] };
-  const previous = prev?.currentGen ?? null;
-  const known = usableKeptGens(prev);
-  if (previous === null || known === void 0) return none;
-  const all = [...known, previous];
-  const cut = Math.max(0, all.length - keep);
-  return { list: all.slice(cut), evict: all.slice(0, cut) };
-}
+// src/core/crbm/frame.ts
+var PREAMBLE_BYTES = 8;
+var FOOTER_BYTES = 104;
 
 // src/core/metadata.ts
 var MAX_METADATA_BYTES = 1024;
@@ -597,9 +608,50 @@ function metadataFromBytes(bytes, fail) {
   return Object.freeze(parsed);
 }
 
+// src/core/crbm/fingerprint.ts
+var sizePart = (size) => `${size}:`;
+var fingerprintFor = (size, footerCrc) => `${sizePart(size)}${footerCrc}`;
+var FINGERPRINT = /^(0|[1-9]\d*):(0|[1-9]\d*)$/;
+function fingerprintParts(fingerprint) {
+  const match = typeof fingerprint === "string" ? FINGERPRINT.exec(fingerprint) : null;
+  if (match === null) return void 0;
+  const size = Number(match[1]);
+  const footerCrc = Number(match[2]);
+  if (!Number.isSafeInteger(size) || size < PREAMBLE_BYTES + FOOTER_BYTES) return void 0;
+  if (footerCrc > 4294967295) return void 0;
+  return { size, footerCrc };
+}
+function compactFingerprint(fingerprint) {
+  const colon = fingerprint.indexOf(":");
+  const size = Number(fingerprint.slice(0, colon));
+  const crc = Number(fingerprint.slice(colon + 1));
+  return `${size.toString(36)}.${crc.toString(36)}`;
+}
+
+// src/core/kept-generations.ts
+var MAX_KEPT_GENERATIONS = 64;
+var MAX_STORED_KEPT_GENERATIONS = 256;
+function usableKeptGens(record) {
+  const list = record?.keptGens;
+  if (record === null || list === void 0 || record.currentGen === null) return void 0;
+  for (const g of list) if (g >= record.currentGen) return void 0;
+  return list;
+}
+function nextKept(prev, generation, keep) {
+  const none = { list: void 0, evict: [] };
+  if (keep === void 0 || keep > MAX_KEPT_GENERATIONS) return none;
+  if (generation === 0) return { list: [], evict: [] };
+  const previous = prev?.currentGen ?? null;
+  const known = usableKeptGens(prev);
+  if (previous === null || known === void 0) return none;
+  const all = [...known, previous];
+  const cut = Math.max(0, all.length - keep);
+  return { list: all.slice(cut), evict: all.slice(0, cut) };
+}
+
 // src/drivers/_shared/registry.ts
 var STATUSES = ["active", "destroyed"];
-var BASE_FIELDS = [
+var RECORD_FIELDS = [
   "namespace",
   "segment",
   "currentGen",
@@ -611,21 +663,18 @@ var BASE_FIELDS = [
   "summary",
   "createdAt",
   "updatedAt",
-  "token"
+  "token",
+  "keptGens",
+  "leases",
+  "pointerId"
 ];
-var SCHEMA_3_FIELDS = ["keptGens", "leases"];
-var RECORD_FIELDS = [...BASE_FIELDS, ...SCHEMA_3_FIELDS];
-function fieldsOf(schemaVersion) {
-  if (schemaVersion >= 3) return RECORD_FIELDS;
-  const base = BASE_FIELDS;
-  return schemaVersion === 2 ? base : base.filter((f) => f !== "summary");
-}
+var DRIVER_MANAGED = ["token", "pointerId"];
 var ENVELOPE_FIELDS = ["schemaVersion", "deleted", "record"];
 var MAX_GOVERNANCE_BYTES = 64 * 1024;
 var MAX_WRAPPED_DEKS = 8;
 var MAX_WRAPPED_DEK_BYTES = 4 * 1024;
 var MAX_SUMMARY_CARDINALITY = 2 ** 32;
-var SEALED_SUMMARY_MIN_BYTES = 12 + 8 + 16;
+var SEALED_SUMMARY_MIN_BYTES = 12 + 8 + 8 + 4 + 16;
 var SEALED_SUMMARY_MAX_BYTES = SEALED_SUMMARY_MIN_BYTES + MAX_METADATA_BYTES;
 var BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 function validateGeneration(gen) {
@@ -709,7 +758,7 @@ function validateSummary(value, isStored, ctx) {
   const s = value;
   const keys = Object.keys(s);
   const isSealed = keys.includes("sealed");
-  const allowed = isSealed ? ["generation", "sealed"] : ["generation", "cardinality", "metadata"];
+  const allowed = isSealed ? ["generation", "sealed"] : ["generation", "cardinality", "fingerprint", "metadata"];
   const extra = keys.filter((k) => !allowed.includes(k));
   if (extra.length > 0) {
     fail(
@@ -729,7 +778,7 @@ function validateSummary(value, isStored, ctx) {
     const bytes = text.length / 4 * 3 - (text.endsWith("==") ? 2 : text.endsWith("=") ? 1 : 0);
     if (bytes < SEALED_SUMMARY_MIN_BYTES || bytes > SEALED_SUMMARY_MAX_BYTES) {
       fail(
-        `sealed is ${bytes}B, outside ${SEALED_SUMMARY_MIN_BYTES}..${SEALED_SUMMARY_MAX_BYTES}B (a nonce, a fixed-width count, a tag, and metadata up to its cap)`
+        `sealed is ${bytes}B, outside ${SEALED_SUMMARY_MIN_BYTES}..${SEALED_SUMMARY_MAX_BYTES}B (a nonce, a fixed-width count and fingerprint, a tag, and metadata up to its cap)`
       );
     }
     return Object.freeze({ generation, sealed: text });
@@ -738,14 +787,29 @@ function validateSummary(value, isStored, ctx) {
   if (!Number.isInteger(n) || n < 0 || n > MAX_SUMMARY_CARDINALITY) {
     fail(`cardinality must be an integer from 0 to 2^32 (got ${String(n)})`);
   }
+  const fingerprint = s.fingerprint;
+  if (fingerprintParts(fingerprint) === void 0) {
+    fail(
+      `fingerprint must be an object's, <size>:<footer checksum> in decimal (got ${shown(JSON.stringify(fingerprint))})`
+    );
+  }
   if (s.metadata === void 0) {
-    return Object.freeze({ generation, cardinality: n });
+    return Object.freeze({
+      generation,
+      cardinality: n,
+      fingerprint
+    });
   }
   const canonical = canonicalMetadataJson(s.metadata, fail);
   if (canonical === "{}") fail("metadata is empty; a generation without metadata carries none");
   if (isStored) return s;
   const metadata = Object.freeze(JSON.parse(canonical));
-  return Object.freeze({ generation, cardinality: n, metadata });
+  return Object.freeze({
+    generation,
+    cardinality: n,
+    fingerprint,
+    metadata
+  });
 }
 function validateSummaryNames(summary, currentGen) {
   if (summary !== void 0 && summary.generation !== currentGen) {
@@ -847,7 +911,16 @@ function validateKeptGensBelow(keptGens, currentGen) {
     );
   }
 }
+function refuseDriverManaged(write, what) {
+  const named = DRIVER_MANAGED.filter((field) => field in write);
+  if (named.length > 0) {
+    throw new ValidationError(
+      `${what} names ${named.join(" and ")}, which the registry sets on every write and a caller never does`
+    );
+  }
+}
 function validateNewRegistryRecord(rec) {
+  refuseDriverManaged(rec, "a new record");
   validateGeneration(rec.currentGen);
   if (rec.status !== void 0) validateStatus(rec.status);
   validateWrappedDeks(rec.wrappedDeks, false);
@@ -863,6 +936,7 @@ function validateNewRegistryRecord(rec) {
   return { ...withKept, summary };
 }
 function validateRegistryPatch(patch) {
+  refuseDriverManaged(patch, "a patch");
   validatePatchGeneration(patch);
   if (patch.status !== void 0) validateStatus(patch.status);
   if ("wrappedDeks" in patch) validateWrappedDeks(patch.wrappedDeks, false);
@@ -873,15 +947,19 @@ function validateRegistryPatch(patch) {
   if (!("summary" in patch)) return withLeases;
   return { ...withLeases, summary: validateSummary(patch.summary, false) };
 }
-var REGISTRY_SCHEMA_VERSION = 3;
-var OLDEST_REGISTRY_SCHEMA_VERSION = 1;
+var REGISTRY_SCHEMA_VERSION = 4;
 function assertRegistrySchemaVersion(raw, ctx) {
   if (raw === void 0) {
     throw new IntegrityError(`registry row has no schemaVersion: ${ctx}`);
   }
-  if (typeof raw !== "number" || !Number.isInteger(raw) || raw < OLDEST_REGISTRY_SCHEMA_VERSION) {
+  if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 1) {
     throw new IntegrityError(`registry row has a malformed schemaVersion (${shown(raw)}): ${ctx}`);
   }
+  if (raw < REGISTRY_SCHEMA_VERSION) {
+    throw new UnsupportedError(
+      `registry row schemaVersion ${raw} is one this build does not read: it reads schema ${REGISTRY_SCHEMA_VERSION} only. Export the segments with the release that wrote the row and load them with this one into a new prefix (the CHANGELOG gives the steps): ${ctx}`
+    );
+  }
   if (raw > REGISTRY_SCHEMA_VERSION) {
     throw new UnsupportedError(
       `registry row schemaVersion ${raw} is newer than this build reads (v${REGISTRY_SCHEMA_VERSION}): ${ctx}`
@@ -896,25 +974,31 @@ function serializeRegistryEnvelope(env) {
     record: env.record
   });
 }
-var COUNTER_TOKEN = /^(0|[1-9]\d*)$/;
-var WRITTEN_COUNTER_TOKEN = /^(0|[1-9]\d*)\.([0-9a-f]{16})$/;
 var INCARNATION_BYTES = 16;
 var WRITE_BYTES = 8;
-function tokenParts(token, schemaVersion, ctx) {
-  const bare = schemaVersion === void 0 || schemaVersion === 1 ? COUNTER_TOKEN.exec(token) : null;
-  const written = schemaVersion === void 0 || schemaVersion >= 2 ? WRITTEN_COUNTER_TOKEN.exec(token) ?? INCARNATION_TOKEN.exec(token) : null;
-  const match = bare ?? written;
+function tokenParts(token, ctx, what = "token") {
+  const match = typeof token === "string" ? INCARNATION_TOKEN.exec(token) : null;
   if (match === null) {
     throw new IntegrityError(
-      `registry row token is not one a schema-${schemaVersion ?? REGISTRY_SCHEMA_VERSION} row holds (${shown(JSON.stringify(token))}): ${ctx}`
+      `registry row ${what} is not one a shipped registry writes (${shown(JSON.stringify(token))}): ${ctx}`
     );
   }
-  const born = match.length === 4;
-  const counter = Number(born ? match[2] : match[1]);
+  const counter = Number(match[2]);
   if (!Number.isSafeInteger(counter)) {
-    throw new IntegrityError(`registry row token's counter is out of safe-integer range: ${ctx}`);
+    throw new IntegrityError(`registry row ${what}'s counter is out of safe-integer range: ${ctx}`);
+  }
+  return { incarnation: match[1], counter };
+}
+function checkPointerId(pointerId, token, ctx) {
+  const parts = tokenParts(pointerId, ctx, "pointerId");
+  if (parts.incarnation !== token.incarnation) {
+    throw new IntegrityError(
+      `registry row pointerId names another incarnation than its token: ${ctx}`
+    );
+  }
+  if (parts.counter > token.counter) {
+    throw new IntegrityError(`registry row pointerId is a write after its token: ${ctx}`);
   }
-  return { incarnation: born ? match[1] : void 0, counter };
 }
 function drawHex(entropy, bytes) {
   const drawn = entropy(bytes);
@@ -934,12 +1018,11 @@ function drawWrite(entropy) {
   return drawHex(entropy, WRITE_BYTES);
 }
 function nextRegistryToken(record, entropy) {
-  const { incarnation, counter } = tokenParts(record.token, void 0, record.segment);
-  const tail = `${counter + 1}.${drawWrite(entropy)}`;
-  return incarnation === void 0 ? tail : `${incarnation}.${tail}`;
+  const { incarnation, counter } = tokenParts(record.token, record.segment);
+  return `${incarnation}.${counter + 1}.${drawWrite(entropy)}`;
 }
 function newIncarnationToken(entropy, tombstone) {
-  const counter = tombstone === void 0 ? 0 : tokenParts(tombstone.token, void 0, tombstone.segment).counter + 1;
+  const counter = tombstone === void 0 ? 0 : tokenParts(tombstone.token, tombstone.segment).counter + 1;
   return `${drawIncarnation(entropy)}.${counter}.${drawWrite(entropy)}`;
 }
 function shown(v) {
@@ -957,7 +1040,7 @@ function parseRegistryEnvelope(text, ctx, expected) {
     throw new IntegrityError(`registry row has a malformed envelope: ${ctx}`);
   }
   const env = parsed;
-  const schemaVersion = assertRegistrySchemaVersion(env.schemaVersion, ctx);
+  assertRegistrySchemaVersion(env.schemaVersion, ctx);
   const extra = Object.keys(env).filter((k) => !ENVELOPE_FIELDS.includes(k));
   if (extra.length > 0) {
     throw new IntegrityError(
@@ -968,11 +1051,11 @@ function parseRegistryEnvelope(text, ctx, expected) {
     throw new IntegrityError(`registry row has a malformed envelope: ${ctx}`);
   }
   const r = env.record;
-  assertStoredRecordShape(r, ctx, schemaVersion);
+  assertStoredRecordShape(r, ctx);
   if (typeof r.token !== "string") {
     throw new IntegrityError(`registry row is missing its token: ${ctx}`);
   }
-  tokenParts(r.token, schemaVersion, ctx);
+  checkPointerId(r.pointerId, tokenParts(r.token, ctx), ctx);
   if (expected !== void 0 && (r.segment !== expected.segment || (r.namespace ?? void 0) !== (expected.namespace ?? void 0))) {
     throw new IntegrityError(
       `registry row names another segment than the one it is stored for: ${ctx}`
@@ -996,11 +1079,12 @@ function recordFromNew(ref, rec, now, token) {
     leases: void 0,
     createdAt: now,
     updatedAt: now,
-    token
+    token,
+    pointerId: token
   };
 }
-function assertStoredRecordShape(r, ctx, schemaVersion = REGISTRY_SCHEMA_VERSION) {
-  if (typeof r.segment !== "string" || r.namespace !== void 0 && typeof r.namespace !== "string" || r.currentGen !== null && typeof r.currentGen !== "number" || typeof r.status !== "string" || typeof r.createdAt !== "number" || typeof r.updatedAt !== "number") {
+function assertStoredRecordShape(r, ctx) {
+  if (typeof r.segment !== "string" || typeof r.pointerId !== "string" || r.namespace !== void 0 && typeof r.namespace !== "string" || r.currentGen !== null && typeof r.currentGen !== "number" || typeof r.status !== "string" || typeof r.createdAt !== "number" || typeof r.updatedAt !== "number") {
     throw new IntegrityError(`registry record is missing required fields: ${ctx}`);
   }
   if (r.currentGen !== null && (!Number.isSafeInteger(r.currentGen) || r.currentGen < 0)) {
@@ -1011,11 +1095,11 @@ function assertStoredRecordShape(r, ctx, schemaVersion = REGISTRY_SCHEMA_VERSION
   if (!STATUSES.includes(r.status)) {
     throw new IntegrityError(`registry record has an unknown status (${shown(r.status)}): ${ctx}`);
   }
-  const declared = fieldsOf(schemaVersion);
+  const declared = RECORD_FIELDS;
   const extra = Object.keys(r).filter((k) => !declared.includes(k));
   if (extra.length > 0) {
     throw new IntegrityError(
-      `registry record has fields a schema-${schemaVersion} row does not declare (${shown(extra.join(", "))}): ${ctx}`
+      `registry record has fields a schema-${REGISTRY_SCHEMA_VERSION} row does not declare (${shown(extra.join(", "))}): ${ctx}`
     );
   }
   if (r.keyId !== void 0 && typeof r.keyId !== "string") {
@@ -1076,7 +1160,8 @@ function applyRegistryPatch(prev, patch, now, token) {
     leases,
     createdAt: prev.createdAt,
     updatedAt: now,
-    token
+    token,
+    pointerId: renewsPointer(patch) ? token : prev.pointerId
   };
 }
 
@@ -1125,24 +1210,12 @@ export {
   isCapabilityError,
   isBudgetExceededError,
   isKeyUnavailableError,
+  PREAMBLE_BYTES,
+  FOOTER_BYTES,
   encodeNameForKey,
   decodeNameFromKey,
   encodeNameForPath,
   decodeNameFromPath,
-  MAX_KEPT_GENERATIONS,
-  usableKeptGens,
-  nextKept,
-  incarnationOf,
-  sameIncarnation,
-  MAX_LEASE_MS,
-  LEASE_SKEW_MS,
-  MAX_LEASES_PER_SEGMENT,
-  isLive,
-  heldGenerations,
-  onlyLeasesDiffer,
-  leaseChurn,
-  takeLease,
-  releaseLease,
   MAX_NAME_LENGTH,
   encodedNameLength,
   validateSegmentRef,
@@ -1162,6 +1235,31 @@ export {
   metadataBytes,
   copiedMetadata,
   metadataFromBytes,
+  sizePart,
+  fingerprintFor,
+  fingerprintParts,
+  compactFingerprint,
+  incarnationOf,
+  incarnationField,
+  sameIncarnation,
+  RESOLVED_FIELDS,
+  renewsPointer,
+  renewPointer,
+  pointerIdOf,
+  MAX_LEASE_MS,
+  LEASE_SKEW_MS,
+  MAX_LEASES_PER_SEGMENT,
+  UNANSWERED_RESENDS,
+  UNANSWERED_BASE_MS,
+  isLive,
+  heldGenerations,
+  onlyLeasesDiffer,
+  leaseChurn,
+  takeLease,
+  releaseLease,
+  MAX_KEPT_GENERATIONS,
+  usableKeptGens,
+  nextKept,
   validateNewRegistryRecord,
   validateRegistryPatch,
   serializeRegistryEnvelope,
@@ -1178,4 +1276,4 @@ export {
   namespaceKeyPart,
   namespacePathPart
 };
-//# sourceMappingURL=chunk-TNWTIAON.js.map
+//# sourceMappingURL=chunk-YSC7NJWV.js.map