@cloudbitmaps/core 0.20.0 → 0.22.0

package/dist/core/item-pull.d.ts

@@ -1,29 +0,0 @@
-/**
- * Pulls the items of an async iterator one at a time so that the code relaying them never holds the one it just
- * handed on. A binding of a generator's body (`for await (const item of …)`, `yield*`) is kept in the generator's
- * frame across its next `yield`, so the relay would hold the previous item, and whatever buffer it is a view into,
- * for as long as it waits for the next. Here the item sits in the pull between {@link advance} and {@link take}, and
- * `take` clears it before it returns.
- *
- * ```ts
- * const pull = new ItemPull(source);
- * try {
- *   while (await pull.advance()) yield pull.take((item) => wrap(item));
- * } finally {
- *   await pull.close();
- * }
- * ```
- *
- * Internal to core: not exported from any entry point.
- */
-export declare class ItemPull<A> {
-    private readonly iterator;
-    private item;
-    constructor(source: AsyncIterable<A>);
-    /** Waits for the next item and keeps it inside; `false` once the source has ended. A failure of the source throws. */
-    advance(): Promise<boolean>;
-    /** Hands over the item {@link advance} fetched, through `map`, and forgets it. */
-    take<B>(map: (item: A) => B): B;
-    /** Ends the source early (a consumer that stopped), as leaving a `for await` does. */
-    close(): Promise<void>;
-}

package/dist/core/kept-generations.d.ts

@@ -1,40 +0,0 @@
-/**
- * The generations a segment's row records as kept: the grace window below its pointer, so a load collects what its
- * publish pushed out of the window by name instead of listing the bucket.
- *
- * The record is a cache of what a listing would keep, never an inventory of the bucket. Absent means the row does not
- * know, and the load lists; an empty list means nothing below the pointer is kept. A patch that moves the pointer
- * without naming the list drops it (see `applyRegistryPatch`), so a writer that forgets the list leaves a row that
- * lists, never one that deletes a generation it should keep. Pure: no I/O, time or randomness.
- */
-import type { RegistryRecord } from './ports.js';
-/**
- * The most generations a writer records. A `keep` above it records none, and the load lists on every publish. A
- * reader accepts up to {@link MAX_STORED_KEPT_GENERATIONS}, so a release can write more than this without a new row
- * schema.
- */
-export declare const MAX_KEPT_GENERATIONS = 64;
-/** The most entries a stored row may hold: four times what a writer writes. */
-export declare const MAX_STORED_KEPT_GENERATIONS = 256;
-/**
- * The row's list when a collection may rely on it: present, on a row with a pointer, and every entry below that
- * pointer. A well-formed list that disagrees with the pointer is read but not used (the load lists instead), as a
- * summary that names another generation is.
- */
-export declare function usableKeptGens(record: RegistryRecord | null): readonly number[] | undefined;
-/** What a publish of a generation writes into the row, and which names it pushes out of the window. */
-export interface KeptAfter {
-    /** The list to write, or `undefined` to write none (the row then does not know, and the next load lists). */
-    readonly list: readonly number[] | undefined;
-    /** The generations the window no longer keeps, ascending: the names to delete. */
-    readonly evict: readonly number[];
-}
-/**
- * The list a publish of `generation` over `prev` writes: the newest `keep` of the row's list and the generation that
- * was current, and the names that fell out of it. Only generations that were current are named, so a number a refused
- * or crashed load took is never in it.
- *
- * No list is written when the row has no usable list to extend (except for generation 0, which has nothing below it),
- * when `keep` is above {@link MAX_KEPT_GENERATIONS}, or when no `keep` is given.
- */
-export declare function nextKept(prev: RegistryRecord | null, generation: number, keep: number | undefined): KeptAfter;

package/dist/core/metadata.d.ts

@@ -1,42 +0,0 @@
-/**
- * Generation metadata: a small, flat record of strings and finite numbers attached to one generation.
- *
- * The rules live here once, for every boundary that meets a value: a caller's input, refused with
- * `ValidationError`, and bytes read back from a tier, refused with `IntegrityError`. The caller passes the error
- * to raise. Pure: no I/O.
- */
-import type { GenerationMetadata } from './ports.js';
-/** Cap on the canonical JSON of one generation's metadata, in UTF-8 bytes (braces and quotes included). */
-export declare const MAX_METADATA_BYTES = 1024;
-/** Cap on one metadata key, in UTF-8 bytes. */
-export declare const MAX_METADATA_KEY_BYTES = 128;
-/**
- * Validate `value` as generation metadata (`GenerationMetadata` in the ports) and return its canonical JSON: RFC 8785
- * (the JSON Canonicalization Scheme) for a flat object of strings and finite numbers. Keys are sorted by UTF-16 code
- * unit, strings are escaped as `JSON.stringify` escapes them, numbers are written as ECMAScript's
- * `Number.prototype.toString` writes them (so `-0` is `0`, and `1e21` is `1e+21`), and there is no whitespace. Key
- * order therefore never changes the bytes, and `tests/golden/metadata-canonical.json` holds vectors a port can check
- * itself against. Both caps are in UTF-8 bytes. The container is an object whose prototype is
- * `Object.prototype` or `null`, holding only enumerable data properties with string keys. `fail` raises the error the
- * boundary calls for. The empty object passes and returns `{}`: whether it may be stored is the caller's rule.
- */
-export declare function canonicalMetadataJson(value: unknown, fail: (message: string) => never): string;
-/**
- * The bytes a generation stores for `value`: its canonical JSON in UTF-8, or `undefined` when it has none (`undefined`
- * or the empty object, which store nothing). Synchronous, so what is stored is what the caller passed at the call,
- * whatever it does with its object afterwards. `fail` raises the boundary's error.
- */
-export declare function metadataBytes(value: unknown, fail: (message: string) => never): Uint8Array | undefined;
-/**
- * A caller's metadata, checked against the rules and copied, so what is stored is what the caller passed at the call,
- * whatever it does with its object afterwards: the frozen record in canonical key order, or `undefined` when there is
- * none (`undefined`, or the empty object, which store nothing). Synchronous. `fail` raises the boundary's error.
- */
-export declare function copiedMetadata(value: unknown, fail: (message: string) => never): GenerationMetadata | undefined;
-/**
- * Read metadata back from bytes a tier holds, which are untrusted. They must be at most {@link MAX_METADATA_BYTES},
- * valid UTF-8, and exactly the canonical JSON of a non-empty record, so a stored copy has one spelling: whitespace, a
- * key out of order or listed twice, and a number or an escape `JSON.stringify` would write another way are all
- * refused. Returns a frozen record of its own. `fail` raises the boundary's error.
- */
-export declare function metadataFromBytes(bytes: Uint8Array, fail: (message: string) => never): GenerationMetadata;

package/dist/core/reader-defaults.d.ts

@@ -1,29 +0,0 @@
-/**
- * The storage reader's defaults. `@cloudbitmaps/tools` prices what two of them cause and keeps its own copies, which
- * `tests/tools/store-defaults.test.ts` holds equal to these.
- */
-/** Default TTL (ms) for re-resolving a segment's `currentGen` — the bound on post-publish read staleness. */
-export declare const DEFAULT_CURRENT_GEN_TTL_MS = 2000;
-/**
- * How long (ms) a reader keeps serving after a pointer refresh failed transiently, before the next read asks the
- * registry again. Short, so an outage ends the stale serving soon after the registry answers; fixed, so a registry
- * that is down is asked at most once per this interval per segment being read (the refresh is coalesced per
- * segment). Never longer than the TTL itself.
- */
-export declare const REFRESH_RETRY_MS = 500;
-/** Default ceiling on cached segment readers (each holds a parsed `.crbm` index) — the steady-state count bound. */
-export declare const DEFAULT_MAX_OPEN_SEGMENTS = 1024;
-/** Default aggregate ceiling (bytes) on resident parsed indices in the reader cache — the steady-state byte bound. */
-export declare const DEFAULT_MAX_OPEN_INDEX_BYTES: number;
-/**
- * How many segments' resolutions a store keeps per reader it keeps open: the resolution cache's count bound is this
- * times `cache.readerMax` (8,192 by default). A resolution is the few hundred bytes of a row a read resolves through,
- * kept for `cache.genTtlMs` whether or not the segment's reader is still open, so a store reading more segments at once
- * than its readers hold keeps more of them than it keeps readers.
- */
-export declare const RESOLUTIONS_PER_OPEN_SEGMENT = 8;
-/**
- * The resolution cache's byte bound is `cache.readerMaxBytes` divided by this (4 MiB by default): what it holds is a
- * sixteenth of what the readers may.
- */
-export declare const RESOLUTION_BYTES_DIVISOR = 16;

package/dist/core/summary.d.ts

@@ -1,78 +0,0 @@
-/**
- * A generation's summary on its registry row: how a writer builds it, how a reader opens it, and how it is held
- * against the object it describes.
- *
- * The row carries a cached description of the current generation, `{ generation, cardinality, fingerprint, metadata? }`,
- * written by the same compare-and-swap that moves the pointer. The fingerprint names the generation's object, by its
- * size and footer checksum, as `CrbmReader.fingerprint` does. On a cleartext segment the values are in the clear. On an
- * encrypted one the row holds `{ generation, sealed }` instead: the cardinality as a fixed-width little-endian u64, the
- * object's size as a u64 and its footer checksum as a u32, then the metadata's canonical JSON if there is any, sealed
- * under the segment's data key with the summary scope of the associated data, which binds it to its namespace, segment
- * and generation. The numbers are fixed-width so the ciphertext's length reveals only the metadata's size, never how
- * many digits the count or the size has. Pure: no I/O.
- *
- * The generation's `.crbm` object stays the truth, and the summary is a copy of it. {@link summaryAgrees} is the
- * comparison of one with the other, and the fingerprint is what a reader holds every object it opens against.
- */
-import type { Aead } from './crypto.js';
-import type { ClearRegistrySummary, GenerationMetadata, RegistryRecord, RegistrySummary, SealedRegistrySummary, SegmentRef } from './ports.js';
-/** What a summary says about a generation: its id count, and its metadata when it has any. */
-export interface GenerationDescription {
-    readonly cardinality: number;
-    readonly metadata?: GenerationMetadata | undefined;
-}
-/** What a row's summary says: the generation's description, and the fingerprint of the object it describes. */
-export interface SummaryDescription extends GenerationDescription {
-    readonly fingerprint: string;
-}
-/** The size of the object a fingerprint names, in bytes: what `stat()` reports from a row's summary. */
-export declare function sizeOfFingerprint(fingerprint: string): number;
-/**
- * The clear summary of a generation on a cleartext segment, naming its object by `fingerprint`. `metadata` is left off
- * when there is none.
- */
-export declare function clearSummary(generation: number, cardinality: number, fingerprint: string, metadata?: GenerationMetadata): ClearRegistrySummary;
-/**
- * The sealed summary of a generation on an encrypted segment: the cardinality as a u64, the object's size as a u64 and
- * its footer checksum as a u32, then the metadata's canonical JSON, sealed under `aead` and bound to `ref` and
- * `generation`.
- */
-export declare function sealSummary(aead: Aead, ref: SegmentRef, generation: number, cardinality: number, fingerprint: string, metadata?: GenerationMetadata): SealedRegistrySummary;
-/**
- * What a sealed summary says, opened with `aead` under the summary scope of `ref` and the summary's own generation.
- * The bytes are untrusted: a blob that is not base64, is the wrong size, fails its authentication (tampered, or moved
- * from another generation's row), or holds a count outside 0 to 2^32, a size no object can have, or metadata that
- * breaks the rules, is an {@link IntegrityError}.
- */
-export declare function openSummary(aead: Aead, ref: SegmentRef, summary: SealedRegistrySummary): SummaryDescription;
-/**
- * What a row's summary says of its current generation, or `undefined` when it says nothing a reader may use. It is
- * used only for the generation it names, on an active row, and in the shape the row's keys call for: clear on a row
- * with no wrapped keys, sealed on a row with them. A sealed one is opened with `aead`, and is unusable without it,
- * or when it does not open, so a summary a tamperer moved or rewrote is never believed; a clear one whose fingerprint
- * names no object is unusable too. Never throws for a bad summary: the row's copy is a cache, and a copy that cannot be
- * used is a copy that is not there.
- */
-export declare function usableSummary(ref: SegmentRef, row: Pick<RegistryRecord, 'summary' | 'status' | 'currentGen' | 'wrappedDeks'>, aead: Aead | undefined): SummaryDescription | undefined;
-/**
- * Whether a summary's description of a generation is what its object holds: the same id count and the same metadata,
- * compared in canonical form, so key order never matters. A summary with metadata over an object with none, and the
- * reverse, disagree: whether an encrypted object's metadata block is present is not authenticated (stripping it needs
- * no key), so the row's sealed copy is what a missing block is held against.
- */
-export declare function summaryAgrees(summary: GenerationDescription, object: GenerationDescription): boolean;
-/**
- * The metadata an erasure carries into its rewrite of a generation: the object's own, except that an object with none
- * whose row's authenticated summary of the same generation has some gets the row's. Whether an encrypted object has a
- * metadata block is not authenticated, so a block stripped from one reads as none, and the sealed summary on the row is
- * the one copy that says there was a block; carrying it keeps the rewrite from erasing the record of what it dropped.
- * Pass `authenticated` only for a summary that was opened (a clear one has no more authority than the block it sits
- * beside). Never refuses. The erasure reaches this with a stripped block only past a fingerprint forged to match the
- * row's, since stripping the block changes the object's size and the open is held to the row's fingerprint.
- */
-export declare function metadataToCarry(object: GenerationMetadata | undefined, authenticated: GenerationDescription | undefined): GenerationMetadata | undefined;
-/**
- * The summary of a generation of `ref`, describing the object `description.fingerprint` names, clear or sealed under
- * `aead` as the segment's keys call for.
- */
-export declare function summaryOf(ref: SegmentRef, generation: number, description: SummaryDescription, aead: Aead | undefined): RegistrySummary;

package/dist/core/token.d.ts

@@ -1,41 +0,0 @@
-/**
- * The registry token's incarnation: the part of a token that says which incarnation of a name a row is.
- *
- * A shipped registry gives a row it creates a token `<incarnation>.<counter>.<write>`: 32 lowercase hex digits drawn
- * from injected entropy when the row is created, a decimal counter, and 16 hex digits drawn for each write. Every write
- * of the row keeps the incarnation, and a name created again draws a new one, so two incarnations are told apart by it
- * even when their rows were created in the same millisecond or one is gone. A registry of someone else's issues tokens
- * in any form, and one whose tokens carry no incarnation id is told apart only by the row's creation stamp.
- *
- * This lives in `core/` so the publish can read it, and the registry drivers, which build the tokens, import it from
- * here: the form has one definition.
- */
-import type { Token } from './ports.js';
-/** An incarnation-form token: the incarnation id, the counter and a write part, `.`-separated, in lowercase hex. */
-export declare const INCARNATION_TOKEN: RegExp;
-/**
- * The incarnation id in a token, or `undefined` for one that has none: a token a registry of someone else's issues in
- * another form. Two tokens with the same incarnation are writes of one incarnation of a row.
- */
-export declare function incarnationOf(token: Token): string | undefined;
-/** An audit event's `incarnation`, from the token of the row it is about: absent for a token that carries none. */
-export declare function incarnationField(token: Token | undefined): {
-    readonly incarnation?: string;
-};
-/**
- * Whether two reads of one name's row are one incarnation of it.
- *
- * - Both tokens carry an incarnation id: the ids decide, and the clock stamps do not enter.
- * - Only one does: different incarnations. A registry gives its rows one form of token, so a row without an id never
- *   becomes a row with one, nor the reverse.
- * - Neither does (a registry of someone else's whose tokens carry none): there is no id to compare, and the creation
- *   stamp is the only signal left. It is a clock reading, so a caller that acts on this answer proves its own object
- *   too.
- */
-export declare function sameIncarnation(a: {
-    readonly token: Token;
-    readonly createdAt: number;
-}, b: {
-    readonly token: Token;
-    readonly createdAt: number;
-}): boolean;

package/dist/drivers/_shared/entropy.d.ts

@@ -1,5 +0,0 @@
-import type { Entropy } from '../../core/determinism.js';
-/** Draws from the platform's Web Crypto; `UnsupportedError` on a runtime without it. */
-export declare const webCryptoEntropy: Entropy;
-/** Whether `entropy` can draw here: an injected source always, the default only where Web Crypto exists. */
-export declare function entropyIsAvailable(entropy: Entropy): boolean;

package/dist/drivers/_shared/registry.d.ts

@@ -1,104 +0,0 @@
-import type { Entropy } from '../../core/determinism.js';
-import { incarnationOf } from '../../core/token.js';
-import { usableKeptGens } from '../../core/kept-generations.js';
-import type { NewRegistryRecord, RegistryPatch, RegistryRecord, SegmentRef, Token } from '../../core/ports.js';
-/**
- * The fields a stored record may carry: {@link RegistryRecord}'s, and nothing else. A field no reader resolves
- * through is refused on read-back like any other corruption (invariant 5), rather than ignored. A field that joins
- * schema 4 before it is released is appended here, with its validator, and needs no new schema version.
- */
-export declare const RECORD_FIELDS: readonly ["namespace", "segment", "currentGen", "wrappedDeks", "keyId", "status", "retention", "residency", "summary", "createdAt", "updatedAt", "token", "keptGens", "leases", "pointerId"];
-/**
- * Validate the caller-settable fields at `create`, and return the record to store: the caller's, with its summary
- * replaced by the checked, frozen copy {@link validateSummary} builds.
- */
-export declare function validateNewRegistryRecord(rec: NewRegistryRecord): NewRegistryRecord;
-/**
- * Validate the caller-settable fields in a `compareAndSwap` patch, and return the patch to apply: the caller's, with
- * its summary replaced by the checked, frozen copy. That a given `summary` names the row's resulting `currentGen`,
- * and agrees with its resulting keys, needs the stored row, so {@link applyRegistryPatch} checks both.
- */
-export declare function validateRegistryPatch(patch: RegistryPatch): RegistryPatch;
-/**
- * The persisted envelope for a registry row: the record plus a tombstone flag. A **deleted** row keeps its
- * record (with an advanced counter) rather than being removed, so a re-create carries the counter on and the two
- * incarnations' tokens are apart by construction, as well as by their random parts — ABA-safety. A row removed by a
- * conditional delete leaves no counter to carry on, so a re-create starts at 0 and only the random parts keep its
- * tokens apart from the old ones. Shared by the
- * persistent drivers (LocalFs file, S3 object).
- *
- * `schemaVersion` is a wire-only concern — it stamps the persisted bytes, not the in-memory domain object —
- * so it lives on the serialize/parse boundary ({@link serializeRegistryEnvelope} /
- * {@link parseRegistryEnvelope}), never on this interface.
- */
-export interface RegistryEnvelope {
-    readonly deleted: boolean;
-    readonly record: RegistryRecord;
-}
-/**
- * Current registry-row schema version — a pre-1.0 format-freeze prerequisite. Every persistent
- * registry driver — every one of which persists the `{ deleted, record }` envelope — stamps its rows
- * with this so a reader can fail-closed on a layout it does not read instead of misparsing it. Bump only
- * on a backward-incompatible change. Policy: any stamp but this one → `UnsupportedError` (fail-closed); an
- * **absent** or malformed stamp → `IntegrityError`, since every row this build writes has one.
- *
- * Schema 4 is the record with `pointerId`, the incarnation-form token and a summary that names its object. This build
- * reads schema 4 and nothing else: a row stamped 1 to 3 carries no `pointerId`, so nothing could say which write set
- * what it resolves to.
- */
-export declare const REGISTRY_SCHEMA_VERSION = 4;
-/**
- * Validate a persisted registry row's `schemaVersion` (untrusted bytes, invariant 5) and return it: an absent or
- * malformed value → `IntegrityError`; any version but {@link REGISTRY_SCHEMA_VERSION} → `UnsupportedError`
- * (fail-closed rather than misread a format this build does not read), naming what to do for an earlier one.
- */
-export declare function assertRegistrySchemaVersion(raw: unknown, ctx: string): number;
-/** Serialize a registry envelope for persistence, stamping the current {@link REGISTRY_SCHEMA_VERSION}. */
-export declare function serializeRegistryEnvelope(env: RegistryEnvelope): string;
-export { usableKeptGens };
-export { incarnationOf };
-/** A fresh incarnation id from `entropy`: 128 bits as 32 lowercase hex digits. */
-export declare function drawIncarnation(entropy: Entropy): string;
-/** A fresh write part from `entropy`: 64 bits as 16 lowercase hex digits. */
-export declare function drawWrite(entropy: Entropy): string;
-/**
- * The token for the write after `record`'s: the same incarnation, the counter one on, and a fresh write part. For a
- * compare-and-swap or a tombstone.
- */
-export declare function nextRegistryToken(record: RegistryRecord, entropy: Entropy): Token;
-/**
- * The token of a new row: a fresh incarnation and write part from `entropy`, and a counter that continues
- * `tombstone`'s when the row is created over one, else starts at 0.
- */
-export declare function newIncarnationToken(entropy: Entropy, tombstone: RegistryRecord | undefined): Token;
-/**
- * Parse + structurally validate a persisted `{ deleted, record }` envelope from stored bytes. A published row
- * is always whole (atomic write), so a parse failure or a missing/mistyped field means corruption/tampering —
- * fail fast (invariant 5), never silently report "absent". `ctx` names the source (path/key) for the message.
- * `expected` is the segment the row was read under; a row that names another is refused.
- */
-export declare function parseRegistryEnvelope(text: string, ctx: string, expected?: SegmentRef): RegistryEnvelope;
-/**
- * Build a full record from a {@link NewRegistryRecord} plus identity, audit timestamps, and an OCC token. The create
- * sets what the row resolves to, so its `pointerId` is its own token.
- */
-export declare function recordFromNew(ref: SegmentRef, rec: NewRegistryRecord, now: number, token: Token): RegistryRecord;
-/**
- * Fail-fast structural check on a record read back from a persistent tier (untrusted bytes, invariant 5):
- * a published row is always whole, so a missing/mistyped required field means corruption/tampering — reject
- * it rather than silently report "absent". The form of `token` and `pointerId`, and how the two relate, is checked by
- * the caller.
- */
-export declare function assertStoredRecordShape(r: Record<string, unknown>, ctx: string): void;
-/**
- * Apply a patch to an existing record, returning a new one with a fresh `updatedAt` + `token` (identity and
- * `createdAt` are preserved). Optional fields use `'k' in patch` so a patch can *clear* them (set to
- * `undefined`, e.g. dropping `keyId` on crypto-shred); required fields use `??` (they always have a value). A patch
- * that names a resolved field ({@link renewsPointer}) sets `pointerId` to this write's token; any other keeps it.
- *
- * `summary` describes the current generation, so it follows the pointer and the keys: a patch that moves
- * `currentGen`, or changes `wrappedDeks` so the summary's shape no longer agrees, without mentioning `summary` drops
- * the old one; and a summary the patch gives must name the resulting `currentGen` and agree with the resulting keys
- * (`ValidationError`, before anything is written).
- */
-export declare function applyRegistryPatch(prev: RegistryRecord, patch: RegistryPatch, now: number, token: Token): RegistryRecord;

package/dist/drivers/localfs/exact-case.d.ts

@@ -1,37 +0,0 @@
-import { ValidationError } from '../../core/errors.js';
-/**
- * The index of the first component of `actual` (the path as it is on disk, relative to the root) that equals the same
- * component of `expected` ignoring case but not exactly, or `-1` when there is none. A component that is a different
- * name altogether, or a path that is longer or shorter, is not a case difference.
- */
-export declare function firstCaseDifference(expected: readonly string[], actual: readonly string[]): number;
-/** What a path-resolving call needs of the filesystem: the error to refuse a write with. */
-export declare function caseVariantError(): ValidationError;
-export declare class ExactCase {
-    private readonly root;
-    /** `undefined` until the root holds an entry to try; then fixed, as a filesystem does not change its mind. */
-    private insensitive;
-    constructor(root: string);
-    /**
-     * Whether the root's filesystem folds case, learned from an entry already in the root: the entry's name with its
-     * case swapped is the same file or it is not. An empty or absent root holds nothing to alias, so it is not
-     * insensitive yet, and is looked at again on the next call.
-     */
-    private foldsCase;
-    /**
-     * The same question asked of the root's own name, or the nearest existing directory above it, when the root holds
-     * nothing to try: a root with no entries has none to alias yet, but two names created at once still would. Not
-     * remembered, since it is the volume above the root that answers.
-     */
-    private foldsAtAncestor;
-    /** Whether the root's filesystem folds case: names that differ only by case are one file there. */
-    folds(): Promise<boolean>;
-    /**
-     * `true` when `path` (inside the root) is, on disk, a path whose name differs only by case from the one given:
-     * the deepest part of it that exists is resolved to its real name and compared exactly. A path that does not exist
-     * yet, or that nothing differs from, is `false`.
-     */
-    differs(path: string): Promise<boolean>;
-    /** Refuse a write to `path` when its real name differs from it only by case. */
-    refuseVariant(path: string): Promise<void>;
-}

package/dist/drivers/localfs/fs-util.d.ts

@@ -1,33 +0,0 @@
-import type { FileHandle } from 'node:fs/promises';
-/** True when `err` is a Node system error with the given `code` (e.g. `'ENOENT'`, `'EEXIST'`). */
-export declare const isCode: (err: unknown, code: string) => boolean;
-/**
- * True when `err` says nothing is at the path: it is not there, a parent is not a directory, or the name is longer than
- * the filesystem allows, so no such object can exist.
- */
-export declare const isAbsent: (err: unknown) => boolean;
-export declare const isFsTransient: (err: unknown) => boolean;
-/**
- * Reclassify a transient filesystem fault as a retryable {@link TransientError}, so the store's read retry can
- * ride it out and a write's caller can tell it from a deterministic failure; everything else — including the
- * driver's own typed errors — propagates unchanged.
- */
-export declare const mapFsError: (err: unknown) => unknown;
-/**
- * `O_NOFOLLOW` where the platform supports it (absent on Windows → 0). OR it into an `open` flag set so a
- * symlink **at the final path component** is refused rather than followed outside the storage root.
- * Containment of symlinked *directory* components assumes the root itself is not attacker-writable.
- */
-export declare const O_NOFOLLOW: number;
-/**
- * Best-effort parent-directory fsync, so a just-published `rename`/`link` survives a crash. Without it the
- * directory entry can still be in the page cache when power goes: the generation's bytes are durable and
- * the name pointing at them is not, which is the one way a published generation can come back missing.
- */
-export declare function fsyncDir(dir: string): Promise<void>;
-/**
- * Write every byte of `bytes` at the handle's position. One `write` can write fewer bytes than it was asked to and not
- * fail (a full disk, a quota, some network filesystems), and a caller that took it for the whole would store a torn row
- * or object as a whole one. A write that makes no progress is a full device.
- */
-export declare function writeAll(handle: FileHandle, bytes: Uint8Array): Promise<void>;

package/dist/drivers/localfs/paths.d.ts

@@ -1,40 +0,0 @@
-import type { GenKey, SegmentRef } from '../../core/ports.js';
-/**
- * Refuse, before anything is written, a generation whose namespace directory or temp file name (the object's name and
- * the temp suffix) would be longer than a filesystem allows. A name inside the library's own cap can still be.
- */
-export declare function assertStorageNamesFit(key: GenKey): void;
-/** The same refusal for a registry row: the namespace directory, and the row file with the temp suffix. */
-export declare function assertRegistryNamesFit(ref: SegmentRef): void;
-/** Directory holding all of a namespace's segment objects. */
-export declare function segmentsDir(root: string, ref: SegmentRef): string;
-/** Absolute path of one `.crbm` generation object. */
-export declare function storageObjectPath(root: string, key: GenKey): string;
-/** Filename pattern for a segment's generations: `<segment>.<gen>.crbm`. */
-export declare function storageObjectFilename(segment: string, generation: number): string;
-/** Parse a generation number out of a `<segment>.<gen>.crbm` filename, or `null` if it doesn't match. */
-export declare function parseGeneration(segment: string, filename: string): number | null;
-/** Directory holding a namespace's registry rows (one file per segment). */
-export declare function registryDir(root: string, namespace: string | undefined): string;
-/** Absolute path of one segment's registry row file: `<ns>/registry/<segment>.reg`. */
-export declare function registryRowPath(root: string, ref: SegmentRef): string;
-/**
- * Parse a segment name out of a `<segment>.reg` filename, or `null` if it doesn't match — including any
- * file whose stem isn't a valid segment name. A strict parser means a stray or planted `.reg` file makes
- * `list()` *skip* it, never abort the whole enumeration on a boundary throw.
- */
-export declare function parseRegistryRow(filename: string): string | null;
-/**
- * Parse a namespace out of a directory name under the storage root, or `null` if it was not written by us.
- *
- * The inverse of the `namespacePathPart(ns)` that {@link segmentsDir} and {@link registryDir}
- * write. A fleet-wide scan enumerates these directories, so getting it wrong does not fail one segment — it
- * aborts the whole enumeration, taking the consistency check, the retention sweep and subject erasure with it.
- *
- * Like {@link parseRegistryRow} this requires the encoding to **round-trip**, so a planted literal `tenant:acme`
- * directory sitting next to the driver's own `tenant%3Aacme` is skipped rather than reported as a namespace
- * whose rows then resolve to the other directory. `_default` maps back to "no namespace".
- */
-export declare function parseNamespaceDir(entry: string): {
-    namespace: string | undefined;
-} | null;

package/dist/drivers/localfs/registry.d.ts

@@ -1,44 +0,0 @@
-import type { Entropy } from '../../core/determinism.js';
-import type { IRegistryDriver, NewRegistryRecord, RegCaps, RegistryPatch, RegistryRecord, SegmentRef, Token } from '../../core/ports.js';
-/** Entries in the process-wide row-lock map; the map is empty whenever no registry operation is in flight. */
-export declare function localFsRowLockCount(): number;
-export interface LocalFsRegistryDriverOptions {
-    /** Injected clock for `createdAt`/`updatedAt`; defaults to `Date.now`. */
-    readonly now?: () => number;
-    /** Draws every token's random parts; defaults to Web Crypto. Inject one only to make a test replayable. */
-    readonly entropy?: Entropy;
-}
-export declare class LocalFsRegistryDriver implements IRegistryDriver {
-    private readonly root;
-    private readonly now;
-    private readonly entropy;
-    private readonly exactCase;
-    constructor(root: string, options?: LocalFsRegistryDriverOptions);
-    /**
-     * `conditionalDelete`: a delete reads the row, checks it, and unlinks it under the row's lock, which every writer on
-     * the root in this process takes, so no write can land between the check and the unlink.
-     */
-    capabilities(): RegCaps;
-    get(ref: SegmentRef): Promise<RegistryRecord | null>;
-    create(ref: SegmentRef, record: NewRegistryRecord): Promise<{
-        token: Token;
-    }>;
-    /**
-     * A caller's `held` row (see `RegistryWriteOptions`) has no read to spare here: the row's file is read under its lock and its token compared
-     * there, a local read and no request, so a stale one fails exactly as a lost race does.
-     */
-    compareAndSwap(ref: SegmentRef, expected: Token, patch: RegistryPatch): Promise<{
-        token: Token;
-    }>;
-    list(namespace?: string): AsyncIterable<RegistryRecord>;
-    delete(ref: SegmentRef, expected?: Token): Promise<void>;
-    /** Remove a row's file and make the removal durable (fsync the directory). */
-    private unlinkRow;
-    /** Namespaces to scan: just the one requested, or every namespace dir under the root. */
-    private namespaceDirs;
-    /** Read the row at `path`, which must be the row of `ref`: one that names another segment is refused. */
-    private readRow;
-    private writeRow;
-    /** Serialize callbacks for a row so read-modify-write is atomic across every instance in the process. */
-    private withRowLock;
-}

package/dist/drivers/localfs/storage.d.ts

@@ -1,21 +0,0 @@
-import type { BlobSink } from '../../core/blob.js';
-import type { StorageCaps, GenKey, IStorageDriver, SegmentRef, StorageDeleteOptions, TailRead } from '../../core/ports.js';
-export declare class LocalFsStorageDriver implements IStorageDriver {
-    private readonly root;
-    private readonly exactCase;
-    constructor(root: string);
-    capabilities(): StorageCaps;
-    putImmutable(key: GenKey, write: (sink: BlobSink) => Promise<void>): Promise<{
-        size: number;
-        sha256: string;
-    }>;
-    getRange(key: GenKey, offset: number, length: number): Promise<Uint8Array>;
-    getTail(key: GenKey, maxBytes: number): Promise<TailRead>;
-    /**
-     * Idempotent. Ignores `options.ifVersion`, as `conditionalDelete: false` says: see the note on the class for why it
-     * cannot apply one. The parameter is declared so that a wrapper of this driver can hand the port's options on.
-     */
-    delete(key: GenKey, options?: StorageDeleteOptions): Promise<void>;
-    list(ref: SegmentRef): AsyncIterable<GenKey>;
-    private openRead;
-}

package/dist/drivers/memory.d.ts

@@ -1,61 +0,0 @@
-import type { BlobSink } from '../core/blob.js';
-import type { Entropy } from '../core/determinism.js';
-import type { StorageCaps, StorageDeleteOptions, TailRead, GenKey, IStorageDriver, IRegistryDriver, NewRegistryRecord, RegCaps, RegistryPatch, RegistryRecord, SegmentRef, Token } from '../core/ports.js';
-export interface MemoryRegistryDriverOptions {
-    /** Injected clock for `createdAt`/`updatedAt`; defaults to `Date.now` (drivers may use ambient time). */
-    readonly now?: () => number;
-    /** Draws every token's random parts; defaults to Web Crypto. Inject one only to make a test replayable. */
-    readonly entropy?: Entropy;
-}
-/**
- * In-memory {@link IRegistryDriver} — one record per segment under OCC. The token has the form every shipped driver
- * gives it, an incarnation id drawn at create, a counter and a per-write random part, but its counter is global to the
- * driver: monotonic and never reused, so a record recreated after `delete` never meets an earlier token, by
- * construction, even though `delete` removes the row physically.
- */
-export declare class MemoryRegistryDriver implements IRegistryDriver {
-    private readonly rows;
-    private readonly now;
-    private readonly entropy;
-    private seq;
-    constructor(options?: MemoryRegistryDriverOptions);
-    private nextToken;
-    /** `conditionalDelete`: a delete checks the token and removes the row in one step, with no await between. */
-    capabilities(): RegCaps;
-    get(ref: SegmentRef): Promise<RegistryRecord | null>;
-    create(ref: SegmentRef, record: NewRegistryRecord): Promise<{
-        token: Token;
-    }>;
-    /**
-     * A caller's `held` row (see `RegistryWriteOptions`) has no read to spare here: the token is compared with the stored row in the same step
-     * as the write, in memory, so a stale one fails exactly as a lost race does.
-     */
-    compareAndSwap(ref: SegmentRef, expected: Token, patch: RegistryPatch): Promise<{
-        token: Token;
-    }>;
-    list(namespace?: string): AsyncIterable<RegistryRecord>;
-    delete(ref: SegmentRef, expected?: Token): Promise<void>;
-}
-/**
- * In-memory {@link IStorageDriver} — write-once immutable generation objects as opaque bytes. A "dumb byte
- * mover" (understands neither roaring nor `.crbm`), so it's a faithful storage backend for tests and a zero-setup
- * local storage tier. Mirrors the LocalFs/S3 contract (write-once, range/tail reads).
- *
- * Every object stored gets a version from a counter the driver never reuses, so two objects stored one after the other
- * under one key never share one, whatever their bytes. A delete given `ifVersion` compares it with the stored object's
- * and removes it in the same step, with no await between them: `conditionalDelete` is `true`.
- */
-export declare class MemoryStorageDriver implements IStorageDriver {
-    private readonly objects;
-    private stored;
-    capabilities(): StorageCaps;
-    putImmutable(key: GenKey, write: (sink: BlobSink) => Promise<void>): Promise<{
-        size: number;
-        sha256: string;
-    }>;
-    getRange(key: GenKey, offset: number, length: number): Promise<Uint8Array>;
-    getTail(key: GenKey, maxBytes: number): Promise<TailRead>;
-    delete(key: GenKey, options?: StorageDeleteOptions): Promise<void>;
-    list(ref: SegmentRef): AsyncIterable<GenKey>;
-    private require;
-}

package/dist/testing/fuzz-core.d.ts

@@ -1,15 +0,0 @@
-/**
- * Internal surface for the coverage-guided fuzz harness, CORE half.
- *
- * Exposes the untrusted-bytes entry points the fuzz targets drive — including `parseIndex` and `parseExtension`,
- * which are deliberately **NOT public API**. Bundled by its own esbuild entry in `scripts/build.mjs` to the git-ignored repo-root `fuzz/build/`,
- * so it never enters `dist/` or the published package. Keeping it here (rather than widening
- * `packages/core/src/index.ts`) is the point: a test harness must not expand the published surface.
- * The codec half lives in the flavor package (`packages/roaring/src/testing/fuzz-codec.ts`), because a concrete
- * bitmap codec is exactly what core does not have.
- */
-export { CrbmReader, parseExtension, parseIndex } from '../core/crbm/reader.js';
-export { CrbmWriter } from '../core/crbm/writer.js';
-export { BufferReader, BufferSink } from '../core/blob.js';
-export { CloudRoaringError, IntegrityError, isCloudRoaringError } from '../core/errors.js';
-export { DEFAULT_MAX_BITMAP_BYTES, DEFAULT_MAX_PAYLOAD_BYTES } from '../core/crbm/format.js';