@cloudbitmaps/core 0.21.0 → 0.23.0

package/dist/core/summary.d.ts

@@ -1,110 +0,0 @@
-/**
- * A generation's summary on its registry row: how a writer builds it, how a reader opens it, and how it is held
- * against the object it describes.
- *
- * The row carries a cached description of the current generation, `{ generation, cardinality, fingerprint, tailBytes,
- * metadata? }`, written by the same compare-and-swap that moves the pointer. The fingerprint names the generation's
- * object, by its size and footer checksum, as `CrbmReader.fingerprint` does, and `tailBytes` is how much of the object's
- * end one open reads. On a cleartext segment the values are in the clear. On an encrypted one the row holds
- * `{ generation, sealed }` instead: the cardinality as a fixed-width little-endian u64, the object's size as a u64 and
- * its footer checksum as a u32, then `tailBytes` as a u32, then the metadata's canonical JSON if there is any, sealed
- * under the segment's data key with the summary scope of the associated data, which binds it to its namespace, segment
- * and generation. The numbers are fixed-width so the ciphertext's length reveals only the metadata's size, never how
- * many digits the count or the size has, and `tailBytes`, which tracks the number of chunks, is sealed for the same
- * reason the size is. Pure: no I/O.
- *
- * The generation's `.crbm` object stays the truth, and the summary is a copy of it. {@link summaryAgrees} is the
- * comparison of one with the other, and the fingerprint is what a reader holds every object it opens against.
- */
-import type { Aead } from './crypto.js';
-import type { ClearRegistrySummary, GenerationMetadata, RegistryRecord, RegistrySummary, SealedRegistrySummary, SegmentRef } from './ports.js';
-/** A generation holds at most every 32-bit id. */
-export declare const MAX_SUMMARY_CARDINALITY: number;
-/**
- * The most a summary's `tailBytes` can be: the reader's own default caps on what an open fetches, an index of at most
- * 8 MiB, an extension block of at most its cap and its trailer, and the footer. The library's writer cannot reach it. A
- * reader can report more for an object it did not write, since it accepts bytes between the index and the footer. A
- * literal, so the registry validators that use it do not import the format module; a test holds it to the sum of the
- * format's constants.
- */
-export declare const MAX_TAIL_BYTES = 8392820;
-/** Whether `tailBytes` is one a summary of an object of `size` bytes can carry. */
-export declare function tailBytesFit(tailBytes: unknown, size: number): boolean;
-/**
- * What a summary says about a generation: its id count, and its metadata when it has any. `tailBytes`, when given, is
- * the bytes of the object's end one open reads.
- */
-export interface GenerationDescription {
-    readonly cardinality: number;
-    readonly metadata?: GenerationMetadata | undefined;
-    readonly tailBytes?: number | undefined;
-}
-/**
- * What a row's summary says: the generation's description, the fingerprint of the object it describes and the
- * bytes of that object's end one open reads.
- */
-export interface SummaryDescription extends GenerationDescription {
-    readonly fingerprint: string;
-    readonly tailBytes: number;
-}
-/** The size of the object a fingerprint names, in bytes: what `stat()` reports from a row's summary. */
-export declare function sizeOfFingerprint(fingerprint: string): number;
-/**
- * The clear summary of a generation on a cleartext segment, naming its object by `fingerprint`. `metadata` is left off
- * when there is none.
- */
-export declare function clearSummary(generation: number, cardinality: number, fingerprint: string, tailBytes: number, metadata?: GenerationMetadata): ClearRegistrySummary;
-/**
- * The sealed summary of a generation on an encrypted segment: the cardinality as a u64, the object's size as a u64,
- * its footer checksum as a u32 and its `tailBytes` as a u32, then the metadata's canonical JSON, sealed under `aead` and
- * bound to `ref` and `generation`.
- */
-export declare function sealSummary(aead: Aead, ref: SegmentRef, generation: number, cardinality: number, fingerprint: string, tailBytes: number, metadata?: GenerationMetadata): SealedRegistrySummary;
-/**
- * What a sealed summary says, opened with `aead` under the summary scope of `ref` and the summary's own generation.
- * The bytes are untrusted: a blob that is not base64, is the wrong size, fails its authentication (tampered, or moved
- * from another generation's row), or holds a count outside 0 to 2^32, a size no object can have, or metadata that
- * breaks the rules, is an {@link IntegrityError}.
- */
-export declare function openSummary(aead: Aead, ref: SegmentRef, summary: SealedRegistrySummary): SummaryDescription;
-/**
- * What a row's summary says of its current generation, or `undefined` when it says nothing a reader may use. It is
- * used only for the generation it names, on an active row, and in the shape the row's keys call for: clear on a row
- * with no wrapped keys, sealed on a row with them. A sealed one is opened with `aead`, and is unusable without it,
- * or when it does not open, so a summary a tamperer moved or rewrote is never believed; a clear one whose fingerprint
- * names no object is unusable too. Never throws for a bad summary: the row's copy is a cache, and a copy that cannot be
- * used is a copy that is not there.
- */
-export declare function usableSummary(ref: SegmentRef, row: Pick<RegistryRecord, 'summary' | 'status' | 'currentGen' | 'wrappedDeks'>, aead: Aead | undefined): SummaryDescription | undefined;
-/**
- * Whether a summary's description of a generation is what its object holds: the same id count and the same metadata,
- * compared in canonical form, so key order never matters, and the same `tailBytes` when both say one (a cold open sizes
- * its tail read from the row's, so a number the object does not bear out is not believed again). A summary with
- * metadata over an object with none, and the reverse, disagree: whether an encrypted object's metadata block is present
- * is not authenticated (stripping it needs no key), so the row's sealed copy is what a missing block is held against.
- */
-export declare function summaryAgrees(summary: GenerationDescription, object: GenerationDescription): boolean;
-/**
- * The metadata an erasure carries into its rewrite of a generation: the object's own, except that an object with none
- * whose row's authenticated summary of the same generation has some gets the row's. Whether an encrypted object has a
- * metadata block is not authenticated, so a block stripped from one reads as none, and the sealed summary on the row is
- * the one copy that says there was a block; carrying it keeps the rewrite from erasing the record of what it dropped.
- * Pass `authenticated` only for a summary that was opened (a clear one has no more authority than the block it sits
- * beside). Never refuses. The erasure reaches this with a stripped block only past a fingerprint forged to match the
- * row's, since stripping the block changes the object's size and the open is held to the row's fingerprint.
- */
-export declare function metadataToCarry(object: GenerationMetadata | undefined, authenticated: GenerationDescription | undefined): GenerationMetadata | undefined;
-/**
- * The summary of a generation of `ref`, describing the object `description.fingerprint` names, clear or sealed under
- * `aead` as the segment's keys call for. `undefined` when the object's `tailBytes` is above {@link MAX_TAIL_BYTES}: a
- * reader accepts bytes between an object's index and its footer, so an object this library did not write can report a
- * tail the row cannot record, and a row is legal without a summary (a read then opens the object with the default tail).
- * The description's size, footer checksum and `tailBytes` must all come from the one object.
- */
-export declare function summaryOf(ref: SegmentRef, generation: number, description: SummaryDescription, aead: Aead | undefined): RegistrySummary | undefined;
-/**
- * {@link summaryOf} for an object this library wrote, whose tail is within {@link MAX_TAIL_BYTES} by construction (its
- * index holds at most 65,536 entries and its extension block at most 4 KiB). Throws {@link IntegrityError} for a tail
- * that is not, which the writer cannot produce.
- */
-export declare function ownSummary(ref: SegmentRef, generation: number, description: SummaryDescription, aead: Aead | undefined): RegistrySummary;

package/dist/core/token.d.ts

@@ -1,41 +0,0 @@
-/**
- * The registry token's incarnation: the part of a token that says which incarnation of a name a row is.
- *
- * A shipped registry gives a row it creates a token `<incarnation>.<counter>.<write>`: 32 lowercase hex digits drawn
- * from injected entropy when the row is created, a decimal counter, and 16 hex digits drawn for each write. Every write
- * of the row keeps the incarnation, and a name created again draws a new one, so two incarnations are told apart by it
- * even when their rows were created in the same millisecond or one is gone. A registry of someone else's issues tokens
- * in any form, and one whose tokens carry no incarnation id is told apart only by the row's creation stamp.
- *
- * This lives in `core/` so the publish can read it, and the registry drivers, which build the tokens, import it from
- * here: the form has one definition.
- */
-import type { Token } from './ports.js';
-/** An incarnation-form token: the incarnation id, the counter and a write part, `.`-separated, in lowercase hex. */
-export declare const INCARNATION_TOKEN: RegExp;
-/**
- * The incarnation id in a token, or `undefined` for one that has none: a token a registry of someone else's issues in
- * another form. Two tokens with the same incarnation are writes of one incarnation of a row.
- */
-export declare function incarnationOf(token: Token): string | undefined;
-/** An audit event's `incarnation`, from the token of the row it is about: absent for a token that carries none. */
-export declare function incarnationField(token: Token | undefined): {
-    readonly incarnation?: string;
-};
-/**
- * Whether two reads of one name's row are one incarnation of it.
- *
- * - Both tokens carry an incarnation id: the ids decide, and the clock stamps do not enter.
- * - Only one does: different incarnations. A registry gives its rows one form of token, so a row without an id never
- *   becomes a row with one, nor the reverse.
- * - Neither does (a registry of someone else's whose tokens carry none): there is no id to compare, and the creation
- *   stamp is the only signal left. It is a clock reading, so `landedHere` also checks the object under the number by
- *   its footer, and `onlyLeasesDiffer` also requires every field but the leases to match.
- */
-export declare function sameIncarnation(a: {
-    readonly token: Token;
-    readonly createdAt: number;
-}, b: {
-    readonly token: Token;
-    readonly createdAt: number;
-}): boolean;

package/dist/drivers/_shared/entropy.d.ts

@@ -1,5 +0,0 @@
-import type { Entropy } from '../../core/determinism.js';
-/** Draws from the platform's Web Crypto; `UnsupportedError` on a runtime without it. */
-export declare const webCryptoEntropy: Entropy;
-/** Whether `entropy` can draw here: an injected source always, the default only where Web Crypto exists. */
-export declare function entropyIsAvailable(entropy: Entropy): boolean;

package/dist/drivers/_shared/registry.d.ts

@@ -1,107 +0,0 @@
-import type { Entropy } from '../../core/determinism.js';
-import { incarnationOf } from '../../core/token.js';
-import { usableKnownGens } from '../../core/known-generations.js';
-import type { NewRegistryRecord, RegistryPatch, RegistryRecord, SegmentRef, Token } from '../../core/ports.js';
-/**
- * The fields a stored record may carry: {@link RegistryRecord}'s, and nothing else. A field no reader resolves
- * through is refused on read-back like any other corruption (invariant 5), rather than ignored. A field the record
- * gains is listed here with its validator; the registry test fails to compile when this list and the record disagree.
- */
-export declare const RECORD_FIELDS: readonly ["namespace", "segment", "currentGen", "wrappedDeks", "keyId", "status", "retention", "residency", "summary", "createdAt", "updatedAt", "token", "knownGens", "leases", "pointerId"];
-/**
- * Validate the caller-settable fields at `create`, and return the record to store: the caller's, with its summary
- * replaced by the checked, frozen copy {@link validateSummary} builds.
- */
-export declare function validateNewRegistryRecord(rec: NewRegistryRecord): NewRegistryRecord;
-/**
- * Validate the caller-settable fields in a `compareAndSwap` patch, and return the patch to apply: the caller's, with
- * its summary replaced by the checked, frozen copy. That a given `summary` names the row's resulting `currentGen`,
- * and agrees with its resulting keys, needs the stored row, so {@link applyRegistryPatch} checks both.
- */
-export declare function validateRegistryPatch(patch: RegistryPatch): RegistryPatch;
-/**
- * The persisted envelope for a registry row: the record plus a tombstone flag. A **deleted** row keeps its
- * record (with an advanced counter) rather than being removed, so a re-create carries the counter on and the two
- * incarnations' tokens are apart by construction, as well as by their random parts — ABA-safety. A row removed by a
- * conditional delete leaves no counter to carry on, so a re-create starts at 0 and only the random parts keep its
- * tokens apart from the old ones. Shared by the
- * persistent drivers (LocalFs file, S3 object).
- *
- * `schemaVersion` is a wire-only concern — it stamps the persisted bytes, not the in-memory domain object —
- * so it lives on the serialize/parse boundary ({@link serializeRegistryEnvelope} /
- * {@link parseRegistryEnvelope}), never on this interface.
- */
-export interface RegistryEnvelope {
-    readonly deleted: boolean;
-    readonly record: RegistryRecord;
-}
-/**
- * Current registry-row schema version — a pre-1.0 format-freeze prerequisite. Every persistent
- * registry driver — every one of which persists the `{ deleted, record }` envelope — stamps its rows
- * with this so a reader can fail-closed on a layout it does not read instead of misparsing it. Bump only
- * on a backward-incompatible change. Policy: any stamp but this one → `UnsupportedError` (fail-closed); an
- * **absent** or malformed stamp → `IntegrityError`, since every row this build writes has one.
- *
- * Schema 5 is the record with `knownGens`, the ledger of the generations a row made current (each with its object's footer
- * checksum, in the order they were made current), and a summary that records `tailBytes`. This build reads schema 5 and
- * nothing else: a row stamped lower carries no ledger and, below 4, no `pointerId` either, so nothing could say which
- * generations the row published or which write set what it resolves to.
- */
-export declare const REGISTRY_SCHEMA_VERSION = 5;
-/**
- * Validate a persisted registry row's `schemaVersion` (untrusted bytes, invariant 5) and return it: an absent or
- * malformed value → `IntegrityError`; any version but {@link REGISTRY_SCHEMA_VERSION} → `UnsupportedError`
- * (fail-closed rather than misread a format this build does not read), naming what to do for an earlier one. The steps
- * are in the changelog's entry for the release that introduced the schema; the message names that entry and no anchor,
- * which cannot go stale.
- */
-export declare function assertRegistrySchemaVersion(raw: unknown, ctx: string): number;
-/** Serialize a registry envelope for persistence, stamping the current {@link REGISTRY_SCHEMA_VERSION}. */
-export declare function serializeRegistryEnvelope(env: RegistryEnvelope): string;
-export { usableKnownGens };
-export { incarnationOf };
-/** A fresh incarnation id from `entropy`: 128 bits as 32 lowercase hex digits. */
-export declare function drawIncarnation(entropy: Entropy): string;
-/** A fresh write part from `entropy`: 64 bits as 16 lowercase hex digits. */
-export declare function drawWrite(entropy: Entropy): string;
-/**
- * The token for the write after `record`'s: the same incarnation, the counter one on, and a fresh write part. For a
- * compare-and-swap or a tombstone.
- */
-export declare function nextRegistryToken(record: RegistryRecord, entropy: Entropy): Token;
-/**
- * The token of a new row: a fresh incarnation and write part from `entropy`, and a counter that continues
- * `tombstone`'s when the row is created over one, else starts at 0.
- */
-export declare function newIncarnationToken(entropy: Entropy, tombstone: RegistryRecord | undefined): Token;
-/**
- * Parse + structurally validate a persisted `{ deleted, record }` envelope from stored bytes. A published row
- * is always whole (atomic write), so a parse failure or a missing/mistyped field means corruption/tampering —
- * fail fast (invariant 5), never silently report "absent". `ctx` names the source (path/key) for the message.
- * `expected` is the segment the row was read under; a row that names another is refused.
- */
-export declare function parseRegistryEnvelope(text: string, ctx: string, expected?: SegmentRef): RegistryEnvelope;
-/**
- * Build a full record from a {@link NewRegistryRecord} plus identity, audit timestamps, and an OCC token. The create
- * sets what the row resolves to, so its `pointerId` is its own token.
- */
-export declare function recordFromNew(ref: SegmentRef, rec: NewRegistryRecord, now: number, token: Token): RegistryRecord;
-/**
- * Fail-fast structural check on a record read back from a persistent tier (untrusted bytes, invariant 5):
- * a published row is always whole, so a missing/mistyped required field means corruption/tampering — reject
- * it rather than silently report "absent". The form of `token` and `pointerId`, and how the two relate, is checked by
- * the caller.
- */
-export declare function assertStoredRecordShape(r: Record<string, unknown>, ctx: string): void;
-/**
- * Apply a patch to an existing record, returning a new one with a fresh `updatedAt` + `token` (identity and
- * `createdAt` are preserved). Optional fields use `'k' in patch` so a patch can *clear* them (set to
- * `undefined`, e.g. dropping `keyId` on crypto-shred); required fields use `??` (they always have a value). A patch
- * that names a resolved field ({@link renewsPointer}) sets `pointerId` to this write's token; any other keeps it.
- *
- * `summary` describes the current generation, so it follows the pointer and the keys: a patch that moves
- * `currentGen`, or changes `wrappedDeks` so the summary's shape no longer agrees, without mentioning `summary` drops
- * the old one; and a summary the patch gives must name the resulting `currentGen` and agree with the resulting keys
- * (`ValidationError`, before anything is written).
- */
-export declare function applyRegistryPatch(prev: RegistryRecord, patch: RegistryPatch, now: number, token: Token): RegistryRecord;

package/dist/drivers/localfs/exact-case.d.ts

@@ -1,34 +0,0 @@
-/**
- * The index of the first component of `actual` (the path as it is on disk, relative to the root) that equals the same
- * component of `expected` ignoring case but not exactly, or `-1` when there is none. A component that is a different
- * name altogether, or a path that is longer or shorter, is not a case difference.
- */
-export declare function firstCaseDifference(expected: readonly string[], actual: readonly string[]): number;
-export declare class ExactCase {
-    private readonly root;
-    /** `undefined` until the root holds an entry to try; then fixed, as a filesystem does not change its mind. */
-    private insensitive;
-    constructor(root: string);
-    /**
-     * Whether the root's filesystem folds case, learned from an entry already in the root: the entry's name with its
-     * case swapped is the same file or it is not. An empty or absent root holds nothing to alias, so it is not
-     * insensitive yet, and is looked at again on the next call.
-     */
-    private foldsCase;
-    /**
-     * The same question asked of the root's own name, or the nearest existing directory above it, when the root holds
-     * nothing to try: a root with no entries has none to alias yet, but two names created at once still would. Not
-     * remembered, since it is the volume above the root that answers.
-     */
-    private foldsAtAncestor;
-    /** Whether the root's filesystem folds case: names that differ only by case are one file there. */
-    folds(): Promise<boolean>;
-    /**
-     * `true` when `path` (inside the root) is, on disk, a path whose name differs only by case from the one given:
-     * the deepest part of it that exists is resolved to its real name and compared exactly. A path that does not exist
-     * yet, or that nothing differs from, is `false`.
-     */
-    differs(path: string): Promise<boolean>;
-    /** Refuse a write to `path` when its real name differs from it only by case. */
-    refuseVariant(path: string): Promise<void>;
-}

package/dist/drivers/localfs/fs-util.d.ts

@@ -1,55 +0,0 @@
-import type { FileHandle } from 'node:fs/promises';
-/** True when `err` is a Node system error with the given `code` (e.g. `'ENOENT'`, `'EEXIST'`). */
-export declare const isCode: (err: unknown, code: string) => boolean;
-/**
- * True when `err` says nothing is at the path: it is not there, a parent is not a directory, or the name is longer than
- * the filesystem allows, so no such object can exist.
- */
-export declare const isAbsent: (err: unknown) => boolean;
-export declare const isFsTransient: (err: unknown) => boolean;
-/**
- * Reclassify a transient filesystem fault as a retryable {@link TransientError}, so the store's read retry can
- * ride it out and a write's caller can tell it from a deterministic failure; everything else — including the
- * driver's own typed errors — propagates unchanged.
- */
-export declare const mapFsError: (err: unknown) => unknown;
-/**
- * `O_NOFOLLOW` where the platform supports it (absent on Windows → 0). OR it into an `open` flag set so a
- * symlink **at the final path component** is refused rather than followed outside the storage root.
- * Containment of symlinked *directory* components assumes the root itself is not attacker-writable.
- */
-export declare const O_NOFOLLOW: number;
-/**
- * The modes LocalFs creates what it stores with: files readable and writable by their owner alone, directories
- * searchable by it alone, so another user of the machine cannot read or list a segment. A process umask can only
- * remove bits from these, never add any. On Windows Node ignores a mode apart from the read-only bit, so passing
- * them there changes nothing.
- */
-export declare const FILE_MODE = 384;
-/**
- * Best-effort parent-directory fsync, so a just-published `rename`/`link` survives a crash. Without it the
- * directory entry can still be in the page cache when power goes: the generation's bytes are durable and
- * the name pointing at them is not, which is the one way a published generation can come back missing.
- */
-export declare function fsyncDir(dir: string): Promise<void>;
-/**
- * Write every byte of `bytes` at the handle's position. One `write` can write fewer bytes than it was asked to and not
- * fail (a full disk, a quota, some network filesystems), and a caller that took it for the whole would store a torn row
- * or object as a whole one. A write that makes no progress is a full device.
- */
-export declare function writeAll(handle: FileHandle, bytes: Uint8Array): Promise<void>;
-/**
- * Create `dir` and the directories missing above it, private from `top` down: what is missing above `top` is created
- * with the default mode (another service may need to traverse it), `top` and everything below it {@link DIR_MODE}. A
- * directory that exists keeps its mode.
- */
-export declare function makeDirs(dir: string, top: string): Promise<void>;
-/** The name of a temp file beside `finalPath`: `<finalPath>.<uuid>.tmp`. The only names {@link sweepOrphanTemps} removes. */
-export declare const tempPathFor: (finalPath: string) => string;
-/**
- * Remove the temp files in `dir` named by {@link tempPathFor} that were last written more than a day ago, streaming the
- * directory, and at most once an hour per directory in this process. Only regular files go (a symlink is never followed
- * or removed). Best effort: a failure leaves the files for a later sweep and is never raised. Callers start it without
- * awaiting it.
- */
-export declare function sweepOrphanTemps(dir: string, now?: number): Promise<void>;

package/dist/drivers/localfs/paths.d.ts

@@ -1,40 +0,0 @@
-import type { GenKey, SegmentRef } from '../../core/ports.js';
-/**
- * Refuse, before anything is written, a generation whose namespace directory or temp file name (the object's name and
- * the temp suffix) would be longer than a filesystem allows. A name inside the library's own cap can still be.
- */
-export declare function assertStorageNamesFit(key: GenKey): void;
-/** The same refusal for a registry row: the namespace directory, and the row file with the temp suffix. */
-export declare function assertRegistryNamesFit(ref: SegmentRef): void;
-/** Directory holding all of a namespace's segment objects. */
-export declare function segmentsDir(root: string, ref: SegmentRef): string;
-/** Absolute path of one `.crbm` generation object. */
-export declare function storageObjectPath(root: string, key: GenKey): string;
-/** Filename pattern for a segment's generations: `<segment>.<gen>.crbm`. */
-export declare function storageObjectFilename(segment: string, generation: number): string;
-/** Parse a generation number out of a `<segment>.<gen>.crbm` filename, or `null` if it doesn't match. */
-export declare function parseGeneration(segment: string, filename: string): number | null;
-/** Directory holding a namespace's registry rows (one file per segment). */
-export declare function registryDir(root: string, namespace: string | undefined): string;
-/** Absolute path of one segment's registry row file: `<ns>/registry/<segment>.reg`. */
-export declare function registryRowPath(root: string, ref: SegmentRef): string;
-/**
- * Parse a segment name out of a `<segment>.reg` filename, or `null` if it doesn't match — including any
- * file whose stem isn't a valid segment name. A strict parser means a stray or planted `.reg` file makes
- * `list()` *skip* it, never abort the whole enumeration on a boundary throw.
- */
-export declare function parseRegistryRow(filename: string): string | null;
-/**
- * Parse a namespace out of a directory name under the storage root, or `null` if it was not written by us.
- *
- * The inverse of the `namespacePathPart(ns)` that {@link segmentsDir} and {@link registryDir}
- * write. A fleet-wide scan enumerates these directories, so getting it wrong does not fail one segment — it
- * aborts the whole enumeration, taking the consistency check, the retention sweep and subject erasure with it.
- *
- * Like {@link parseRegistryRow} this requires the encoding to **round-trip**, so a planted literal `tenant:acme`
- * directory sitting next to the driver's own `tenant%3Aacme` is skipped rather than reported as a namespace
- * whose rows then resolve to the other directory. `_default` maps back to "no namespace".
- */
-export declare function parseNamespaceDir(entry: string): {
-    namespace: string | undefined;
-} | null;

package/dist/drivers/localfs/registry.d.ts

@@ -1,50 +0,0 @@
-import type { Entropy } from '../../core/determinism.js';
-import type { IRegistryDriver, NewRegistryRecord, RegCaps, RegistryPatch, RegistryRecord, RegistryWriteOptions, SegmentRef, Token } from '../../core/ports.js';
-/** Entries in the process-wide row-lock map; the map is empty whenever no registry operation is in flight. */
-export declare function localFsRowLockCount(): number;
-interface LocalFsRegistryDriverOptions {
-    /** Injected clock for `createdAt`/`updatedAt`; defaults to `Date.now`. */
-    readonly now?: () => number;
-    /** Draws every token's random parts; defaults to Web Crypto. Inject one only to make a test replayable. */
-    readonly entropy?: Entropy;
-    /** The directory this root lives under, from which down directories are created private; defaults to the root. */
-    readonly privateRoot?: string;
-}
-export declare class LocalFsRegistryDriver implements IRegistryDriver {
-    private readonly root;
-    private readonly options;
-    private readonly now;
-    private readonly entropy;
-    private readonly exactCase;
-    constructor(root: string, options?: LocalFsRegistryDriverOptions);
-    /**
-     * `conditionalDelete`: a delete reads the row, checks it, and unlinks it under the row's lock, which every writer on
-     * the root in this process takes, so no write can land between the check and the unlink.
-     */
-    capabilities(): RegCaps;
-    /** Every write reports its token to `onToken` before the row's file is written. */
-    get reportsWriteTokens(): true;
-    get(ref: SegmentRef): Promise<RegistryRecord | null>;
-    create(ref: SegmentRef, record: NewRegistryRecord, options?: RegistryWriteOptions): Promise<{
-        token: Token;
-    }>;
-    /**
-     * A caller's `held` row (see `RegistryWriteOptions`) has no read to spare here: the row's file is read under its lock and its token compared
-     * there, a local read and no request, so a stale one fails exactly as a lost race does.
-     */
-    compareAndSwap(ref: SegmentRef, expected: Token, patch: RegistryPatch, options?: RegistryWriteOptions): Promise<{
-        token: Token;
-    }>;
-    list(namespace?: string): AsyncIterable<RegistryRecord>;
-    delete(ref: SegmentRef, expected?: Token): Promise<void>;
-    /** Remove a row's file and make the removal durable (fsync the directory). */
-    private unlinkRow;
-    /** Namespaces to scan: just the one requested, or every namespace dir under the root. */
-    private namespaceDirs;
-    /** Read the row at `path`, which must be the row of `ref`: one that names another segment is refused. */
-    private readRow;
-    private writeRow;
-    /** Serialize callbacks for a row so read-modify-write is atomic across every instance in the process. */
-    private withRowLock;
-}
-export {};

package/dist/drivers/localfs/storage.d.ts

@@ -1,28 +0,0 @@
-import { type BlobSink } from '../../core/blob.js';
-import type { StorageCaps, GenKey, IStorageDriver, SegmentRef, StorageDeleteOptions, TailRead } from '../../core/ports.js';
-export declare class LocalFsStorageDriver implements IStorageDriver {
-    private readonly root;
-    private readonly options;
-    private readonly exactCase;
-    /**
-     * `options.privateRoot` is the directory this one lives under, from which down directories are created private; it
-     * defaults to `root`.
-     */
-    constructor(root: string, options?: {
-        readonly privateRoot?: string;
-    });
-    capabilities(): StorageCaps;
-    putImmutable(key: GenKey, write: (sink: BlobSink) => Promise<void>): Promise<{
-        size: number;
-        sha256: string;
-    }>;
-    getRange(key: GenKey, offset: number, length: number): Promise<Uint8Array>;
-    getTail(key: GenKey, maxBytes: number): Promise<TailRead>;
-    /**
-     * Idempotent. Ignores `options.ifVersion`, as `conditionalDelete: false` says: see the note on the class for why it
-     * cannot apply one. The parameter is declared so that a wrapper of this driver can hand the port's options on.
-     */
-    delete(key: GenKey, options?: StorageDeleteOptions): Promise<void>;
-    list(ref: SegmentRef): AsyncIterable<GenKey>;
-    private openRead;
-}

package/dist/drivers/memory.d.ts

@@ -1,64 +0,0 @@
-import type { BlobSink } from '../core/blob.js';
-import type { Entropy } from '../core/determinism.js';
-import type { StorageCaps, StorageDeleteOptions, TailRead, GenKey, IStorageDriver, IRegistryDriver, NewRegistryRecord, RegCaps, RegistryPatch, RegistryRecord, RegistryWriteOptions, SegmentRef, Token } from '../core/ports.js';
-interface MemoryRegistryDriverOptions {
-    /** Injected clock for `createdAt`/`updatedAt`; defaults to `Date.now` (drivers may use ambient time). */
-    readonly now?: () => number;
-    /** Draws every token's random parts; defaults to Web Crypto. Inject one only to make a test replayable. */
-    readonly entropy?: Entropy;
-}
-/**
- * In-memory {@link IRegistryDriver} — one record per segment under OCC. The token has the form every shipped driver
- * gives it, an incarnation id drawn at create, a counter and a per-write random part, but its counter is global to the
- * driver: monotonic and never reused, so a record recreated after `delete` never meets an earlier token, by
- * construction, even though `delete` removes the row physically.
- */
-export declare class MemoryRegistryDriver implements IRegistryDriver {
-    private readonly rows;
-    private readonly now;
-    private readonly entropy;
-    private seq;
-    constructor(options?: MemoryRegistryDriverOptions);
-    private nextToken;
-    /** `conditionalDelete`: a delete checks the token and removes the row in one step, with no await between. */
-    capabilities(): RegCaps;
-    /** Every write reports its token to `onToken` before it is applied. */
-    get reportsWriteTokens(): true;
-    get(ref: SegmentRef): Promise<RegistryRecord | null>;
-    create(ref: SegmentRef, record: NewRegistryRecord, options?: RegistryWriteOptions): Promise<{
-        token: Token;
-    }>;
-    /**
-     * A caller's `held` row (see `RegistryWriteOptions`) has no read to spare here: the token is compared with the stored row in the same step
-     * as the write, in memory, so a stale one fails exactly as a lost race does.
-     */
-    compareAndSwap(ref: SegmentRef, expected: Token, patch: RegistryPatch, options?: RegistryWriteOptions): Promise<{
-        token: Token;
-    }>;
-    list(namespace?: string): AsyncIterable<RegistryRecord>;
-    delete(ref: SegmentRef, expected?: Token): Promise<void>;
-}
-/**
- * In-memory {@link IStorageDriver} — write-once immutable generation objects as opaque bytes. A "dumb byte
- * mover" (understands neither roaring nor `.crbm`), so it's a faithful storage backend for tests and a zero-setup
- * local storage tier. Mirrors the LocalFs/S3 contract (write-once, range/tail reads).
- *
- * Every object stored gets a version from a counter the driver never reuses, so two objects stored one after the other
- * under one key never share one, whatever their bytes. A delete given `ifVersion` compares it with the stored object's
- * and removes it in the same step, with no await between them: `conditionalDelete` is `true`.
- */
-export declare class MemoryStorageDriver implements IStorageDriver {
-    private readonly objects;
-    private stored;
-    capabilities(): StorageCaps;
-    putImmutable(key: GenKey, write: (sink: BlobSink) => Promise<void>): Promise<{
-        size: number;
-        sha256: string;
-    }>;
-    getRange(key: GenKey, offset: number, length: number): Promise<Uint8Array>;
-    getTail(key: GenKey, maxBytes: number): Promise<TailRead>;
-    delete(key: GenKey, options?: StorageDeleteOptions): Promise<void>;
-    list(ref: SegmentRef): AsyncIterable<GenKey>;
-    private require;
-}
-export {};

package/dist/testing/fuzz-core.d.ts

@@ -1,15 +0,0 @@
-/**
- * Internal surface for the coverage-guided fuzz harness, CORE half.
- *
- * Exposes the untrusted-bytes entry points the fuzz targets drive — including `parseIndex` and `parseExtension`,
- * which are deliberately **NOT public API**. Bundled by its own esbuild entry in `scripts/build.mjs` to the git-ignored repo-root `fuzz/build/`,
- * so it never enters `dist/` or the published package. Keeping it here (rather than widening
- * `packages/core/src/index.ts`) is the point: a test harness must not expand the published surface.
- * The codec half lives in the flavor package (`packages/roaring/src/testing/fuzz-codec.ts`), because a concrete
- * bitmap codec is exactly what core does not have.
- */
-export { CrbmReader, parseExtension, parseIndex } from '../core/crbm/reader.js';
-export { CrbmWriter } from '../core/crbm/writer.js';
-export { BufferReader, BufferSink } from '../core/blob.js';
-export { CloudRoaringError, IntegrityError, isCloudRoaringError } from '../core/errors.js';
-export { DEFAULT_MAX_BITMAP_BYTES, DEFAULT_MAX_PAYLOAD_BYTES } from '../core/crbm/format.js';