@cloudbitmaps/core 0.8.2 → 0.9.0

package/dist/chunk-L54FL5DW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/drivers/_shared/registry.ts"],"names":[],"mappings":";;;AAiBA,IAAM,QAAA,GAA8B,CAAC,QAAA,EAAU,YAAA,EAAc,WAAW,WAAW,CAAA;AAEnF,IAAM,uBAAuB,EAAA,GAAK,IAAA;AAElC,IAAM,gBAAA,GAAmB,CAAA;AACzB,IAAM,wBAAwB,CAAA,GAAI,IAAA;AAElC,SAAS,mBAAmB,GAAA,EAAmB;AAC7C,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,GAAG,CAAA,IAAK,MAAM,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,+CAAA,EAAkD,GAAG,CAAA,CAAE,CAAA;AAAA,EACnF;AACF;AAEA,SAAS,aAAA,CAAc,KAAA,EAAe,KAAA,GAAQ,iBAAA,EAAyB;AACrE,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IAAK,QAAQ,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,EAAG,KAAK,CAAA,qCAAA,EAAwC,KAAK,CAAA,CAAE,CAAA;AAAA,EACnF;AACF;AAGA,SAAS,iBAAA,CAAkB,IAAY,KAAA,EAAqB;AAC1D,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,KAAK,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,EAAG,KAAK,CAAA,2CAAA,EAA8C,EAAE,CAAA,CAAE,CAAA;AAAA,EACtF;AACF;AAEA,SAAS,eAAe,MAAA,EAAsB;AAC5C,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,gBAAgB,CAAA,sBAAA,EAAyB,QAAA,CAAS,KAAK,GAAG,CAAC,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,EACxF;AACF;AAOA,SAAS,kBAAA,CAAmB,MAAe,KAAA,EAAqB;AAC9D,EAAA,IAAI,SAAS,MAAA,EAAW;AACxB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,EAAG,KAAK,CAAA,0BAAA,CAA4B,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,oBAAA,EAAsB;AACtC,IAAA,MAAM,IAAI,gBAAgB,CAAA,EAAG,KAAK,OAAO,IAAA,CAAK,MAAM,CAAA,eAAA,EAAkB,oBAAoB,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/F;AACF;AAQA,SAAS,mBAAA,CAAoB,OAAgB,QAAA,EAAyB;AACpE,EAAA,IAAI,UAAU,MAAA,EAAW;AACzB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,KAAuB;AACnC,IAAA,MAAM,WAAW,IAAI,cAAA,CAAe,GAAG,CAAA,GAAI,IAAI,gBAAgB,GAAG,CAAA;AAAA,EACpE,CAAA;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,OAAQ,8BAA8B,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAO,KAAA;AACb,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,IAAA,CAAK,4CAA4C,CAAA;AACxE,EAAA,IAAI,KAAK,MAAA,GAAS,gBAAA;AAChB,IAAA,IAAA,CAAK,CAAA,gBAAA,EAAmB,IAAA,CAAK,MAAM,CAAA,cAAA,EAAiB,gBAAgB,CAAA,CAAE,CAAA;AACxE,EAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,IAAA,IAAI,MAAM,IAAA,IAAQ,OAAO,CAAA,KAAM,QAAA,OAAe,qCAAqC,CAAA;AACnF,IAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,GAAI,CAAA;AAC3B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,KAAW,CAAA;AAChD,MAAA,IAAA,CAAK,2CAA2C,CAAA;AAClD,IAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,MAAA,KAAW,CAAA;AACpD,MAAA,IAAA,CAAK,kDAAkD,CAAA;AACzD,IAAA,IAAK,QAAmB,MAAA,GAAS,qBAAA;AAC/B,MAAA,IAAA,CAAK,CAAA,qBAAA,EAAyB,OAAA,CAAmB,MAAM,CAAA,OAAA,EAAU,qBAAqB,CAAA,CAAA,CAAG,CAAA;AAAA,EAC7F;AACF;AAGO,SAAS,0BAA0B,GAAA,EAA8B;AACtE,EAAA,kBAAA,CAAmB,IAAI,UAAU,CAAA;AACjC,EAAA,IAAI,GAAA,CAAI,eAAA,KAAoB,MAAA,EAAW,aAAA,CAAc,IAAI,eAAe,CAAA;AACxE,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,MAAA,EAAW,cAAA,CAAe,IAAI,MAAM,CAAA;AACvD,EAAA,mBAAA,CAAoB,GAAA,CAAI,aAAa,KAAK,CAAA;AAC1C,EAAA,kBAAA,CAAmB,GAAA,CAAI,WAAW,WAAW,CAAA;AAC7C,EAAA,kBAAA,CAAmB,GAAA,CAAI,WAAW,WAAW,CAAA;AAC/C;AAGO,SAAS,sBAAsB,KAAA,EAA4B;AAChE,EAAA,IAAI,KAAA,CAAM,UAAA,KAAe,MAAA,EAAW,kBAAA,CAAmB,MAAM,UAAU,CAAA;AACvE,EAAA,IAAI,KAAA,CAAM,eAAA,KAAoB,MAAA,EAAW,aAAA,CAAc,MAAM,eAAe,CAAA;AAC5E,EAAA,IAAI,MAAM,mBAAA,KAAwB,MAAA;AAChC,IAAA,aAAA,CAAc,KAAA,CAAM,qBAAqB,qBAAqB,CAAA;AAChE,EAAA,IAAI,MAAM,eAAA,KAAoB,MAAA;AAC5B,IAAA,iBAAA,CAAkB,KAAA,CAAM,iBAAiB,iBAAiB,CAAA;AAC5D,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,EAAW,cAAA,CAAe,MAAM,MAAM,CAAA;AAC3D,EAAA,IAAI,aAAA,IAAiB,KAAA,EAAO,mBAAA,CAAoB,KAAA,CAAM,aAAa,KAAK,CAAA;AACxE,EAAA,IAAI,WAAA,IAAe,KAAA,EAAO,kBAAA,CAAmB,KAAA,CAAM,WAAW,WAAW,CAAA;AACzE,EAAA,IAAI,WAAA,IAAe,KAAA,EAAO,kBAAA,CAAmB,KAAA,CAAM,WAAW,WAAW,CAAA;AAC3E;AAuBO,IAAM,uBAAA,GAA0B;AAOhC,SAAS,2BAAA,CAA4B,KAAc,GAAA,EAAmB;AAC3E,EAAA,IAAI,QAAQ,MAAA,EAAW;AACvB,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,CAAC,OAAO,SAAA,CAAU,GAAG,CAAA,IAAK,GAAA,GAAM,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,eAAe,CAAA,4CAAA,EAA+C,MAAA,CAAO,GAAG,CAAC,CAAA,GAAA,EAAM,GAAG,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAM,uBAAA,EAAyB;AACjC,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,2BAAA,EAA8B,GAAG,CAAA,kCAAA,EAAqC,uBAAuB,MAAM,GAAG,CAAA;AAAA,KACxG;AAAA,EACF;AACF;AAGO,SAAS,0BAA0B,GAAA,EAA+B;AACvE,EAAA,OAAO,KAAK,SAAA,CAAU;AAAA,IACpB,aAAA,EAAe,uBAAA;AAAA,IACf,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,QAAQ,GAAA,CAAI;AAAA,GACb,CAAA;AACH;AAOO,SAAS,kBAAkB,MAAA,EAAgC;AAChE,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,+CAAA,EAAkD,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAC7B,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,CAAC,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,iDAAA,EAAoD,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO,CAAA;AACT;AAOO,SAAS,qBAAA,CAAsB,MAAc,GAAA,EAA+B;AACjF,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,gCAAA,EAAmC,GAAG,CAAA,CAAE,CAAA;AAAA,EACnE;AAGA,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,EAAU;AACjD,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,uCAAA,EAA0C,GAAG,CAAA,CAAE,CAAA;AAAA,EAC1E;AACA,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,2BAAA,CAA4B,GAAA,CAAI,eAAe,GAAG,CAAA;AAClD,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,SAAA,IAAa,GAAA,CAAI,WAAW,IAAA,IAAQ,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,EAAU;AAC7F,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,uCAAA,EAA0C,GAAG,CAAA,CAAE,CAAA;AAAA,EAC1E;AACA,EAAA,MAAM,IAAI,GAAA,CAAI,MAAA;AACd,EAAA,uBAAA,CAAwB,GAAG,GAAG,CAAA;AAC9B,EAAA,IAAI,OAAO,CAAA,CAAE,KAAA,KAAU,QAAA,EAAU;AAC/B,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,mCAAA,EAAsC,GAAG,CAAA,CAAE,CAAA;AAAA,EACtE;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,MAAA,EAAQ,IAAI,MAAA,EAAyB;AACtE;AAGO,SAAS,aAAA,CACd,GAAA,EACA,GAAA,EACA,GAAA,EACA,KAAA,EACgB;AAChB,EAAA,OAAO;AAAA,IACL,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,aAAa,GAAA,CAAI,WAAA;AAAA,IACjB,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,eAAA,EAAiB,IAAI,eAAA,IAAmB,CAAA;AAAA,IACxC,MAAA,EAAQ,IAAI,MAAA,IAAU,QAAA;AAAA,IACtB,mBAAA,EAAqB,CAAA;AAAA;AAAA,IACrB,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,SAAA,EAAW,GAAA;AAAA,IACX,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACF;AACF;AAQO,SAAS,uBAAA,CAAwB,GAA4B,GAAA,EAAmB;AACrF,EAAA,IACE,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,IACpB,CAAA,CAAE,SAAA,KAAc,MAAA,IAAa,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,IACrD,OAAO,EAAE,UAAA,KAAe,QAAA,IACxB,OAAO,CAAA,CAAE,eAAA,KAAoB,QAAA,IAC7B,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IACpB,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,IACvB,OAAO,CAAA,CAAE,cAAc,QAAA,EACvB;AACA,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,4CAAA,EAA+C,GAAG,CAAA,CAAE,CAAA;AAAA,EAC/E;AAGA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,CAAA,CAAE,UAAU,CAAA,IAAK,CAAA,CAAE,aAAa,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,2CAAA,EAA8C,EAAE,UAAU,CAAA,GAAA,EAAM,GAAG,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,CAAA,CAAE,eAAe,CAAA,IAAK,CAAA,CAAE,kBAAkB,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,gDAAA,EAAmD,GAAG,CAAA,CAAE,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,uCAAA,EAA0C,EAAE,MAAM,CAAA,GAAA,EAAM,GAAG,CAAA,CAAE,CAAA;AAAA,EACxF;AACA,EAAA,IAAI,EAAE,UAAA,KAAe,MAAA,IAAa,OAAO,CAAA,CAAE,eAAe,QAAA,EAAU;AAClE,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,2CAAA,EAA8C,GAAG,CAAA,CAAE,CAAA;AAAA,EAC9E;AACA,EAAA,IAAI,EAAE,cAAA,KAAmB,MAAA,IAAa,OAAO,CAAA,CAAE,mBAAmB,QAAA,EAAU;AAC1E,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,+CAAA,EAAkD,GAAG,CAAA,CAAE,CAAA;AAAA,EAClF;AACA,EAAA,IACE,CAAA,CAAE,mBAAA,KAAwB,MAAA,KACzB,CAAC,MAAA,CAAO,SAAA,CAAU,CAAA,CAAE,mBAAmB,CAAA,IAAM,CAAA,CAAE,mBAAA,GAAiC,CAAA,CAAA,EACjF;AACA,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,oDAAA,EAAuD,GAAG,CAAA,CAAE,CAAA;AAAA,EACvF;AACA,EAAA,IACE,CAAA,CAAE,eAAA,KAAoB,MAAA,KACrB,OAAO,EAAE,eAAA,KAAoB,QAAA,IAC5B,CAAC,MAAA,CAAO,SAAS,CAAA,CAAE,eAAe,CAAA,IACjC,CAAA,CAAE,kBAA6B,CAAA,CAAA,EAClC;AACA,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,gDAAA,EAAmD,GAAG,CAAA,CAAE,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,EAAE,KAAA,KAAU,MAAA,IAAa,OAAO,CAAA,CAAE,UAAU,QAAA,EAAU;AACxD,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,sCAAA,EAAyC,GAAG,CAAA,CAAE,CAAA;AAAA,EACzE;AACA,EAAA,mBAAA,CAAoB,CAAA,CAAE,aAAa,IAAI,CAAA;AACzC;AAOO,SAAS,kBAAA,CACd,IAAA,EACA,KAAA,EACA,GAAA,EACA,KAAA,EACgB;AAChB,EAAA,OAAO;AAAA,IACL,WAAW,IAAA,CAAK,SAAA;AAAA,IAChB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,UAAA,EAAY,KAAA,CAAM,UAAA,IAAc,IAAA,CAAK,UAAA;AAAA,IACrC,WAAA,EAAa,aAAA,IAAiB,KAAA,GAAQ,KAAA,CAAM,cAAc,IAAA,CAAK,WAAA;AAAA,IAC/D,KAAA,EAAO,OAAA,IAAW,KAAA,GAAQ,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AAAA,IAC7C,eAAA,EAAiB,KAAA,CAAM,eAAA,IAAmB,IAAA,CAAK,eAAA;AAAA,IAC/C,MAAA,EAAQ,KAAA,CAAM,MAAA,IAAU,IAAA,CAAK,MAAA;AAAA,IAC7B,UAAA,EAAY,YAAA,IAAgB,KAAA,GAAQ,KAAA,CAAM,aAAa,IAAA,CAAK,UAAA;AAAA,IAC5D,cAAA,EAAgB,gBAAA,IAAoB,KAAA,GAAQ,KAAA,CAAM,iBAAiB,IAAA,CAAK,cAAA;AAAA,IACxE,eAAA,EAAiB,iBAAA,IAAqB,KAAA,GAAQ,KAAA,CAAM,kBAAkB,IAAA,CAAK,eAAA;AAAA,IAC3E,mBAAA,EAAqB,KAAA,CAAM,mBAAA,IAAuB,IAAA,CAAK,mBAAA,IAAuB,CAAA;AAAA,IAC9E,SAAA,EAAW,WAAA,IAAe,KAAA,GAAQ,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AAAA,IACzD,SAAA,EAAW,WAAA,IAAe,KAAA,GAAQ,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AAAA,IACzD,WAAW,IAAA,CAAK,SAAA;AAAA,IAChB,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACF;AACF","file":"chunk-L54FL5DW.js","sourcesContent":["/**\n * Shared, SDK-free helpers for assembling + validating {@link RegistryRecord}s (Phase 4c).\n *\n * The registry's record-construction, patch-application, and field-validation are identical across every\n * backend (memory / LocalFs / DynamoDB) — only the *storage* + OCC mechanics differ. This is the one home\n * for that logic so the three drivers can't drift. Pure: no I/O, no SDK, no clock (the caller passes `now`).\n */\nimport { IntegrityError, UnsupportedError, ValidationError } from '@/core/errors';\nimport type {\n  NewRegistryRecord,\n  RegistryPatch,\n  RegistryRecord,\n  SegmentRef,\n  Token,\n} from '@/core/ports';\n\n/** The valid {@link RegistryStatus} values — used to validate both caller input and stored bytes. */\nconst STATUSES: readonly string[] = ['active', 'compacting', 'erasing', 'destroyed'];\n/** Cap on a serialized governance blob (retention/residency) — bounds row size so a row can't be bricked. */\nconst MAX_GOVERNANCE_BYTES = 64 * 1024;\n/** Bounds on the wrapped-DEK list (one DEK wrapped under a few KEKs) — keeps the row small + rejects abuse. */\nconst MAX_WRAPPED_DEKS = 8;\nconst MAX_WRAPPED_DEK_BYTES = 4 * 1024;\n\nfunction validateGeneration(gen: number): void {\n  if (!Number.isInteger(gen) || gen < 0) {\n    throw new ValidationError(`currentGen must be a non-negative integer; got ${gen}`);\n  }\n}\n\nfunction validateCount(count: number, field = 'dirtyChunkCount'): void {\n  if (!Number.isInteger(count) || count < 0) {\n    throw new ValidationError(`${field} must be a non-negative integer; got ${count}`);\n  }\n}\n\n/** Validate an epoch-ms timestamp (non-negative, finite). */\nfunction validateTimestamp(ms: number, field: string): void {\n  if (!Number.isFinite(ms) || ms < 0) {\n    throw new ValidationError(`${field} must be a non-negative finite number; got ${ms}`);\n  }\n}\n\nfunction validateStatus(status: string): void {\n  if (!STATUSES.includes(status)) {\n    throw new ValidationError(`status must be one of ${STATUSES.join('/')}; got ${status}`);\n  }\n}\n\n/**\n * Validate a governance blob (retention/residency) at the write boundary: it must be JSON-serializable\n * (a `BigInt`/function/circular value fails fast with a typed error instead of a cryptic one deep in a\n * driver) and within a size cap (so an oversized blob can't write a row that's later unreadable — a brick).\n */\nfunction validateGovernance(meta: unknown, field: string): void {\n  if (meta === undefined) return;\n  let json: string;\n  try {\n    json = JSON.stringify(meta);\n  } catch {\n    throw new ValidationError(`${field} must be JSON-serializable`);\n  }\n  if (json.length > MAX_GOVERNANCE_BYTES) {\n    throw new ValidationError(`${field} is ${json.length}B, exceeds cap ${MAX_GOVERNANCE_BYTES}B`);\n  }\n}\n\n/**\n * Validate the wrapped-DEK list at the write/read boundary: a bounded array of `{ keyId, wrapped }` with\n * non-empty string fields and a per-entry size cap (so a row can't be bricked, and corrupt bytes are rejected\n * rather than reaching the keystore). `isStored` toggles the error class (write = ValidationError; read =\n * IntegrityError, invariant 5).\n */\nfunction validateWrappedDeks(value: unknown, isStored: boolean): void {\n  if (value === undefined) return;\n  const fail = (msg: string): never => {\n    throw isStored ? new IntegrityError(msg) : new ValidationError(msg);\n  };\n  if (!Array.isArray(value)) fail('wrappedDeks must be an array');\n  const list = value as unknown[];\n  if (list.length === 0) fail('wrappedDeks must be non-empty when present');\n  if (list.length > MAX_WRAPPED_DEKS)\n    fail(`wrappedDeks has ${list.length} entries, cap ${MAX_WRAPPED_DEKS}`);\n  for (const w of list) {\n    if (w === null || typeof w !== 'object') fail('wrappedDeks entry must be an object');\n    const { keyId, wrapped } = w as { keyId?: unknown; wrapped?: unknown };\n    if (typeof keyId !== 'string' || keyId.length === 0)\n      fail('wrappedDeks entry needs a non-empty keyId');\n    if (typeof wrapped !== 'string' || wrapped.length === 0)\n      fail('wrappedDeks entry needs a non-empty wrapped blob');\n    if ((wrapped as string).length > MAX_WRAPPED_DEK_BYTES)\n      fail(`wrappedDeks entry is ${(wrapped as string).length}B, cap ${MAX_WRAPPED_DEK_BYTES}B`);\n  }\n}\n\n/** Validate the caller-settable fields at `create`. */\nexport function validateNewRegistryRecord(rec: NewRegistryRecord): void {\n  validateGeneration(rec.currentGen);\n  if (rec.dirtyChunkCount !== undefined) validateCount(rec.dirtyChunkCount);\n  if (rec.status !== undefined) validateStatus(rec.status);\n  validateWrappedDeks(rec.wrappedDeks, false);\n  validateGovernance(rec.retention, 'retention');\n  validateGovernance(rec.residency, 'residency');\n}\n\n/** Validate the caller-settable fields in a `compareAndSwap` patch. */\nexport function validateRegistryPatch(patch: RegistryPatch): void {\n  if (patch.currentGen !== undefined) validateGeneration(patch.currentGen);\n  if (patch.dirtyChunkCount !== undefined) validateCount(patch.dirtyChunkCount);\n  if (patch.consecutiveFailures !== undefined)\n    validateCount(patch.consecutiveFailures, 'consecutiveFailures');\n  if (patch.lastCompactedAt !== undefined)\n    validateTimestamp(patch.lastCompactedAt, 'lastCompactedAt');\n  if (patch.status !== undefined) validateStatus(patch.status);\n  if ('wrappedDeks' in patch) validateWrappedDeks(patch.wrappedDeks, false);\n  if ('retention' in patch) validateGovernance(patch.retention, 'retention');\n  if ('residency' in patch) validateGovernance(patch.residency, 'residency');\n}\n\n/**\n * The persisted envelope for a registry row: the record plus a tombstone flag. A **deleted** row keeps its\n * record (with an advanced counter) rather than being removed, so the monotonic token survives a\n * delete→recreate — ABA-safety. Shared by the persistent drivers (LocalFs file, S3 object).\n *\n * `schemaVersion` is a wire-only concern — it stamps the persisted bytes, not the in-memory domain object —\n * so it lives on the serialize/parse boundary ({@link serializeRegistryEnvelope} /\n * {@link parseRegistryEnvelope}), never on this interface.\n */\nexport interface RegistryEnvelope {\n  readonly deleted: boolean;\n  readonly record: RegistryRecord;\n}\n\n/**\n * Current registry-row schema version — a pre-1.0 format-freeze prerequisite (Phase G). Every persistent\n * registry driver — the LocalFs/S3 `{ deleted, record }` envelope and the DynamoDB body — stamps its rows\n * with this so a reader can fail-closed on a future, incompatible layout instead of misparsing it. Bump only\n * on a backward-incompatible change. Policy: a **higher** stamp than this build knows → `UnsupportedError`\n * (fail-closed); an **absent** stamp → legacy pre-freeze row, tolerated as v1.\n */\nexport const REGISTRY_SCHEMA_VERSION = 1;\n\n/**\n * Validate a persisted registry row's `schemaVersion` (untrusted bytes, invariant 5): absent → legacy v1\n * (tolerated); a malformed value → `IntegrityError`; a version newer than this build → `UnsupportedError`\n * (fail-closed rather than misread a format we don't understand).\n */\nexport function assertRegistrySchemaVersion(raw: unknown, ctx: string): void {\n  if (raw === undefined) return; // pre-stamp rows are v1\n  if (typeof raw !== 'number' || !Number.isInteger(raw) || raw < 1) {\n    throw new IntegrityError(`registry row has a malformed schemaVersion (${String(raw)}): ${ctx}`);\n  }\n  if (raw > REGISTRY_SCHEMA_VERSION) {\n    throw new UnsupportedError(\n      `registry row schemaVersion ${raw} is newer than this build reads (v${REGISTRY_SCHEMA_VERSION}): ${ctx}`,\n    );\n  }\n}\n\n/** Serialize a registry envelope for persistence, stamping the current {@link REGISTRY_SCHEMA_VERSION}. */\nexport function serializeRegistryEnvelope(env: RegistryEnvelope): string {\n  return JSON.stringify({\n    schemaVersion: REGISTRY_SCHEMA_VERSION,\n    deleted: env.deleted,\n    record: env.record,\n  });\n}\n\n/**\n * The OCC counter encoded in a record's token. A published row always has a **canonical decimal** token\n * (`String(counter)`), so anything else (`\"1e3\"`, `\"0x10\"`, `\" 5 \"`, `\"\"`, a >2^53 value) is corruption /\n * tampering — reject it (invariant 5) rather than let `Number()` coerce it and silently break monotonicity.\n */\nexport function registryCounterOf(record: RegistryRecord): number {\n  if (!/^(0|[1-9]\\d*)$/.test(record.token)) {\n    throw new IntegrityError(`registry row token is not a canonical counter: ${record.token}`);\n  }\n  const n = Number(record.token);\n  if (!Number.isSafeInteger(n)) {\n    throw new IntegrityError(`registry row token is out of safe-integer range: ${record.token}`);\n  }\n  return n;\n}\n\n/**\n * Parse + structurally validate a persisted `{ deleted, record }` envelope from stored bytes. A published row\n * is always whole (atomic write), so a parse failure or a missing/mistyped field means corruption/tampering —\n * fail fast (invariant 5), never silently report \"absent\". `ctx` names the source (path/key) for the message.\n */\nexport function parseRegistryEnvelope(text: string, ctx: string): RegistryEnvelope {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    throw new IntegrityError(`registry row is not valid JSON: ${ctx}`);\n  }\n  // Guard before any property access: `JSON.parse` yields `null`/primitives for hostile bytes (e.g. `\"null\"`,\n  // `\"5\"`), which would throw an *untyped* TypeError on the dereference below (invariant 5 wants a typed error).\n  if (parsed === null || typeof parsed !== 'object') {\n    throw new IntegrityError(`registry row has a malformed envelope: ${ctx}`);\n  }\n  const env = parsed as { schemaVersion?: unknown; deleted?: unknown; record?: unknown };\n  assertRegistrySchemaVersion(env.schemaVersion, ctx);\n  if (typeof env.deleted !== 'boolean' || env.record === null || typeof env.record !== 'object') {\n    throw new IntegrityError(`registry row has a malformed envelope: ${ctx}`);\n  }\n  const r = env.record as Record<string, unknown>;\n  assertStoredRecordShape(r, ctx);\n  if (typeof r.token !== 'string') {\n    throw new IntegrityError(`registry row is missing its token: ${ctx}`);\n  }\n  return { deleted: env.deleted, record: env.record as RegistryRecord };\n}\n\n/** Build a full record from a {@link NewRegistryRecord} plus identity, audit timestamps, and an OCC token. */\nexport function recordFromNew(\n  ref: SegmentRef,\n  rec: NewRegistryRecord,\n  now: number,\n  token: Token,\n): RegistryRecord {\n  return {\n    namespace: ref.namespace,\n    segment: ref.segment,\n    currentGen: rec.currentGen,\n    wrappedDeks: rec.wrappedDeks,\n    keyId: rec.keyId,\n    dirtyChunkCount: rec.dirtyChunkCount ?? 0,\n    status: rec.status ?? 'active',\n    consecutiveFailures: 0, // daemon health (Phase D); lastCompactedAt stays absent until first compaction\n    retention: rec.retention,\n    residency: rec.residency,\n    createdAt: now,\n    updatedAt: now,\n    token,\n  };\n}\n\n/**\n * Fail-fast structural check on a record read back from a persistent tier (untrusted bytes, invariant 5):\n * a published row is always whole, so a missing/mistyped required field means corruption/tampering — reject\n * it rather than silently report \"absent\". `token` is checked by the caller (its source differs per backend:\n * an in-body field vs a derived OCC counter).\n */\nexport function assertStoredRecordShape(r: Record<string, unknown>, ctx: string): void {\n  if (\n    typeof r.segment !== 'string' ||\n    (r.namespace !== undefined && typeof r.namespace !== 'string') ||\n    typeof r.currentGen !== 'number' ||\n    typeof r.dirtyChunkCount !== 'number' ||\n    typeof r.status !== 'string' ||\n    typeof r.createdAt !== 'number' ||\n    typeof r.updatedAt !== 'number'\n  ) {\n    throw new IntegrityError(`registry record is missing required fields: ${ctx}`);\n  }\n  // Enforce the same value invariants the write path checks, so corrupt/tampered bytes are rejected at the\n  // read boundary (invariant 5) rather than leaking a bad currentGen/status downstream.\n  if (!Number.isInteger(r.currentGen) || r.currentGen < 0) {\n    throw new IntegrityError(`registry record has an invalid currentGen (${r.currentGen}): ${ctx}`);\n  }\n  if (!Number.isInteger(r.dirtyChunkCount) || r.dirtyChunkCount < 0) {\n    throw new IntegrityError(`registry record has an invalid dirtyChunkCount: ${ctx}`);\n  }\n  if (!STATUSES.includes(r.status)) {\n    throw new IntegrityError(`registry record has an unknown status (${r.status}): ${ctx}`);\n  }\n  if (r.leaseOwner !== undefined && typeof r.leaseOwner !== 'string') {\n    throw new IntegrityError(`registry record has an invalid leaseOwner: ${ctx}`);\n  }\n  if (r.leaseExpiresAt !== undefined && typeof r.leaseExpiresAt !== 'number') {\n    throw new IntegrityError(`registry record has an invalid leaseExpiresAt: ${ctx}`);\n  }\n  if (\n    r.consecutiveFailures !== undefined &&\n    (!Number.isInteger(r.consecutiveFailures) || (r.consecutiveFailures as number) < 0)\n  ) {\n    throw new IntegrityError(`registry record has an invalid consecutiveFailures: ${ctx}`);\n  }\n  if (\n    r.lastCompactedAt !== undefined &&\n    (typeof r.lastCompactedAt !== 'number' ||\n      !Number.isFinite(r.lastCompactedAt) ||\n      (r.lastCompactedAt as number) < 0)\n  ) {\n    throw new IntegrityError(`registry record has an invalid lastCompactedAt: ${ctx}`);\n  }\n  if (r.keyId !== undefined && typeof r.keyId !== 'string') {\n    throw new IntegrityError(`registry record has an invalid keyId: ${ctx}`);\n  }\n  validateWrappedDeks(r.wrappedDeks, true); // invariant 5: reject a corrupt wrapped-DEK list on read-back\n}\n\n/**\n * Apply a patch to an existing record, returning a new one with a fresh `updatedAt` + `token` (identity and\n * `createdAt` are preserved). Optional fields use `'k' in patch` so a patch can *clear* them (set to\n * `undefined`, e.g. dropping `keyId` on crypto-shred); required fields use `??` (they always have a value).\n */\nexport function applyRegistryPatch(\n  prev: RegistryRecord,\n  patch: RegistryPatch,\n  now: number,\n  token: Token,\n): RegistryRecord {\n  return {\n    namespace: prev.namespace,\n    segment: prev.segment,\n    currentGen: patch.currentGen ?? prev.currentGen,\n    wrappedDeks: 'wrappedDeks' in patch ? patch.wrappedDeks : prev.wrappedDeks,\n    keyId: 'keyId' in patch ? patch.keyId : prev.keyId,\n    dirtyChunkCount: patch.dirtyChunkCount ?? prev.dirtyChunkCount,\n    status: patch.status ?? prev.status,\n    leaseOwner: 'leaseOwner' in patch ? patch.leaseOwner : prev.leaseOwner,\n    leaseExpiresAt: 'leaseExpiresAt' in patch ? patch.leaseExpiresAt : prev.leaseExpiresAt,\n    lastCompactedAt: 'lastCompactedAt' in patch ? patch.lastCompactedAt : prev.lastCompactedAt,\n    consecutiveFailures: patch.consecutiveFailures ?? prev.consecutiveFailures ?? 0,\n    retention: 'retention' in patch ? patch.retention : prev.retention,\n    residency: 'residency' in patch ? patch.residency : prev.residency,\n    createdAt: prev.createdAt,\n    updatedAt: now,\n    token,\n  };\n}\n"]}

package/dist/chunk-YEHMG6W2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/core/ports.ts"],"names":[],"mappings":";AAqBO,IAAM,MAAA,mBAAwB,MAAA,CAAO,GAAA,CAAI,sBAAsB","file":"chunk-YEHMG6W2.js","sourcesContent":["/**\n * Storage-driver contracts the engine depends on.\n *\n * Phase 1 uses the subset needed by the in-memory engine: the per-chunk Warm store (under OCC) and a\n * per-chunk read view of Cold. Drivers move opaque bytes + an OCC token; they never understand roaring,\n * `adds`/`removes`, or the `.crbm` layout. The full `IColdDriver` (blob/range) + `IRegistryDriver` arrive\n * with generations in Phase 2/3 — the `.crbm` reader will implement `ColdChunkSource`.\n */\n\nimport type { BlobSink } from './blob';\nimport type { WrappedDek } from './crypto';\n\n/** Opaque optimistic-concurrency token — unique per write, compared by equality only. */\nexport type Token = string;\n\n/** Sentinel for `putConditional` meaning \"the row must not exist yet\" (create). */\n// `Symbol.for` (the global registry), NOT `Symbol()`: the package ships multiple bundles (the core entry and\n// the `./dynamodb` / `./s3` subpaths), and tsup inlines `core/ports` into each. A plain `Symbol('no-row')`\n// would be a DISTINCT instance per bundle, so the engine's `NO_ROW` wouldn't `===` the one the DynamoDb warm\n// driver compares against — every create would misroute to the token-fenced path and fail. A registry symbol\n// is identity-stable across bundles/realms. (Invisible in tests, which share one source module graph.)\nexport const NO_ROW: unique symbol = Symbol.for('cloud-roaring.no-row');\nexport type NoRow = typeof NO_ROW;\n\nexport interface SegmentRef {\n  readonly namespace?: string;\n  readonly segment: string;\n}\n\nexport interface ChunkRef extends SegmentRef {\n  readonly chunkKey: number;\n}\n\n/** Identifies one immutable `.crbm` object — a single generation of a segment. */\nexport interface GenKey extends SegmentRef {\n  readonly generation: number;\n}\n\nexport interface WarmRow {\n  readonly token: Token;\n  /** Read-only: owned by the driver. Callers must NOT mutate the buffer (re-encode to write). */\n  readonly bytes: Uint8Array;\n}\n\n/**\n * Read consistency for a Warm fetch (gap #9). `consistent: true` (the default — omitted ⇒ true) is a\n * strong, read-your-writes read, as the OCC read-modify-write path requires. `consistent: false` requests an\n * **eventually-consistent** read — on DynamoDB that is ~½ the RCU cost; a driver that is always strongly\n * consistent (in-memory, LocalFs) ignores it. The engine uses it only on read paths (`has`/`count`/`iterate`/\n * `intersect`) when the store opts into `warmReadConsistency: 'eventual'`, trading read-after-write for cost.\n */\nexport interface WarmReadOptions {\n  readonly consistent?: boolean;\n}\n\n/** Per-chunk Warm store under optimistic concurrency. Returned byte buffers are read-only. */\nexport interface IWarmDriver {\n  get(ref: ChunkRef, opts?: WarmReadOptions): Promise<WarmRow | null>;\n  /** OCC write. `expected` = `NO_ROW` to create, else the token previously read. Throws `WriteConflictError` on mismatch. */\n  putConditional(\n    ref: ChunkRef,\n    bytes: Uint8Array,\n    expected: Token | NoRow,\n  ): Promise<{ token: Token }>;\n  /**\n   * Fenced delete — only if the stored token still equals `expected`; throws `WriteConflictError`\n   * otherwise. **Used by compaction (Phase 4); the Phase-1 engine never calls it** — drivers still\n   * implement it to satisfy the conformance suite.\n   */\n  deleteConditional(ref: ChunkRef, expected: Token): Promise<void>;\n  /** All dirty chunks of a segment, ascending `chunkKey`. Yielded `bytes` are read-only. */\n  listChunks(\n    ref: SegmentRef,\n    opts?: WarmReadOptions,\n  ): AsyncIterable<{ chunkKey: number } & WarmRow>;\n}\n\n/**\n * A segment's grounded on-disk footprint (Phase 5b) — the current generation's Cold object bytes, read\n * cheaply from the `.crbm` footer/index (no payload reads). Powers the grounded `costReport()`.\n */\nexport interface SegmentSize {\n  readonly sizeBytes: number;\n}\n\n/** Per-chunk read view of the immutable Cold tier (implemented by the `.crbm` reader from Phase 2). */\nexport interface ColdChunkSource {\n  /** Read-only bytes for the chunk, or `null` if absent. Callers must not mutate the buffer. */\n  getChunk(ref: ChunkRef): Promise<Uint8Array | null>;\n  listChunkKeys(ref: SegmentRef): Promise<number[]>;\n  /**\n   * Optional (Phase 5b): the current generation's grounded size, cheaply (from the already-parsed\n   * `.crbm` index — no payload reads), or `null` if the segment has no Cold generation. Powers the\n   * grounded `costReport()`.\n   */\n  sizeOf?(ref: SegmentRef): Promise<SegmentSize | null>;\n  /**\n   * Optional (Phase 5c): the current generation's **per-chunk cardinality** (`chunkKey → count`), read\n   * from the already-parsed `.crbm` index with **no payload reads**, or `null` if the segment has no Cold\n   * generation. Powers the cheap `count()` — a warm-delta-free chunk is counted straight from the index\n   * instead of fetching + deserializing it. A source with no index (e.g. the in-memory source) omits this,\n   * and `count()` falls back to fetching + merging every chunk.\n   */\n  cardinalities?(ref: SegmentRef): Promise<ReadonlyMap<number, number> | null>;\n  /**\n   * Optional (Phase B, gap #4): the segment's **current generation number** as this source resolves it right now\n   * (registry `currentGen`, or the highest cold generation), or `null` if the segment has no Cold generation. The\n   * engine keys its HOT chunk cache by this so a generation bump (a compaction commit) is observed — a new\n   * generation misses the cache instead of serving a stale decoded chunk, and an erased id can't resurrect from a\n   * cached pre-compaction chunk. Cheap: served from the source's own (short-TTL-refreshed) snapshot, **not** a\n   * fresh backend read per call. A source that pins one immutable generation for its whole lifetime and never\n   * refreshes may omit this — the engine then keys the cache without a generation, exactly as before.\n   */\n  currentGeneration?(ref: SegmentRef): Promise<number | null>;\n}\n\n/** Capabilities a Cold driver advertises; validated at wiring time, fail-fast. */\nexport interface ColdCaps {\n  /** REQUIRED — the format relies on byte-range reads. */\n  readonly rangeRead: true;\n  /** Largest single object the backend accepts (informs single-object-vs-shard, B7 — future). */\n  readonly maxObjectBytes: number;\n  /** Optional: enables the pure-object `LATEST`-pointer registry variant (S3 conditional put). */\n  readonly conditionalPut?: boolean;\n}\n\n/**\n * Immutable object storage for `.crbm` generations. A \"dumb byte mover\": it\n * understands neither roaring nor the `.crbm` layout, only opaque bytes addressed by a {@link GenKey}.\n * The core never reuses a key, so puts are write-once.\n */\nexport interface IColdDriver {\n  capabilities(): ColdCaps;\n  /**\n   * Stream a new immutable generation. The driver opens a destination, hands `write` a {@link BlobSink},\n   * then atomically commits (and computes the content hash). Throws if the key already exists (write-once).\n   */\n  putImmutable(\n    key: GenKey,\n    write: (sink: BlobSink) => Promise<void>,\n  ): Promise<{ size: number; sha256: string }>;\n  /** Range read; the caller bounds-checks. Out-of-range is rejected, never a short/adjacent read. */\n  getRange(key: GenKey, offset: number, length: number): Promise<Uint8Array>;\n  /** Speculative tail read: the last `min(maxBytes, size)` bytes + the total object size. */\n  getTail(key: GenKey, maxBytes: number): Promise<{ bytes: Uint8Array; size: number }>;\n  delete(key: GenKey): Promise<void>;\n  /** Enumerate the generations present for a segment (orphan sweep / latest-gen resolution). */\n  list(ref: SegmentRef): AsyncIterable<GenKey>;\n}\n\n/**\n * Lifecycle status of a segment. `active` is the steady state;\n * `compacting`/`erasing` are transient flags a daemon sets while it works (Phase 4d/4e); `destroyed` is the\n * post-crypto-shred tombstone (the row is kept for audit but the segment is logically gone). The 4c registry\n * stores and round-trips the field; the *transitions* are driven by their owning features.\n */\nexport type RegistryStatus = 'active' | 'compacting' | 'erasing' | 'destroyed';\n\n/** Free-form, JSON-serializable governance metadata (retention/residency policy); shape lands in Phase 6. */\nexport type GovernanceMeta = Record<string, unknown>;\n\n/**\n * One registry row — the authoritative per-segment record. Exactly one per segment.\n */\nexport interface RegistryRecord extends SegmentRef {\n  /** **The** authoritative LATEST pointer: which immutable Cold generation is current. */\n  readonly currentGen: number;\n  /**\n   * Per-segment data-key (DEK) wrappings for encryption-at-rest (Phase 4e): the DEK envelope-wrapped under one\n   * or more KEKs (active + optional recovery). Reading unwraps with any held KEK; **crypto-shred deletes this\n   * whole list**, making the segment's at-rest bytes permanently unrecoverable. Absent ⇒ the segment is\n   * cleartext.\n   */\n  readonly wrappedDeks?: readonly WrappedDek[];\n  /**\n   * Optional **external** key reference (reserved) — e.g. a KMS key ARN for a future KMS keystore adapter that\n   * keeps wrapped material in the KMS rather than in-band {@link wrappedDeks}. Unused by the in-process BYOK\n   * keystore. Clearable on crypto-shred.\n   */\n  readonly keyId?: string;\n  /**\n   * Dirty-row hint written by `findCompactable`. Discovery still recomputes the live dirty count by scanning\n   * Warm each cycle (the count that decides candidacy), but it now **reads** this hint to gate a change-guarded\n   * CAS — the hint is only rewritten when the count actually moved, so an all-idle fleet issues no per-segment\n   * registry writes. It does not yet drive candidacy — turning the Warm scan itself into O(dirty) is a\n   * deferred cheap-enumeration fix.\n   */\n  readonly dirtyChunkCount: number;\n  readonly status: RegistryStatus;\n  /**\n   * Daemon health (Phase D, gap #2): epoch-ms of the last **successfully committed** compaction, and the\n   * count of **consecutive** compaction failures (reset to 0 by a successful commit). `lastCompactedAt`\n   * powers a dead-man's-switch / staleness alarm; `consecutiveFailures` drives **poison-segment quarantine** —\n   * discovery skips a segment past a failure threshold so one corrupt Warm row can't freeze the compaction of a\n   * segment **that has a committed generation** forever (with no alarm) while its Warm backlog grows unbounded.\n   * (A segment whose *very first* compaction keeps failing has no registry row to count against yet —\n   * bootstrap faults are surfaced as `error` results but not yet quarantined; gap #2.) Both\n   * **optional** (absent on rows written before Phase D, and on a segment never compacted) — read them as\n   * `lastCompactedAt ?? undefined`, `consecutiveFailures ?? 0`.\n   */\n  readonly lastCompactedAt?: number;\n  readonly consecutiveFailures?: number;\n  /**\n   * Compaction lease (Phase 4d): the opaque id of the worker currently compacting this segment, and the\n   * epoch-ms at which its lease expires. `status === 'compacting'` with `leaseExpiresAt` in the future means\n   * a live daemon owns it; once `leaseExpiresAt` is past, another worker may **steal** the lease (the prior\n   * holder crashed). Both absent in the steady (`active`) state. The lease is an efficiency guard only — the\n   * 2-phase commit is correct without it (OCC-fenced swap + write-once generations + version-fenced purge).\n   */\n  readonly leaseOwner?: string;\n  readonly leaseExpiresAt?: number;\n  /** Governance policy (Phase 6); stored + round-tripped now, semantics later. */\n  readonly retention?: GovernanceMeta;\n  readonly residency?: GovernanceMeta;\n  /** Epoch-ms of creation / last mutation (from the driver's injected clock). */\n  readonly createdAt: number;\n  readonly updatedAt: number;\n  /** Opaque OCC token — compare-by-equality, never reused (ABA-safe), exactly like {@link WarmRow.token}. */\n  readonly token: Token;\n}\n\n/** The caller-settable fields at {@link IRegistryDriver.create} (audit + token are driver-managed). */\nexport interface NewRegistryRecord {\n  readonly currentGen: number;\n  readonly wrappedDeks?: readonly WrappedDek[];\n  readonly keyId?: string;\n  /** Defaults to 0. */\n  readonly dirtyChunkCount?: number;\n  /** Defaults to `'active'`. */\n  readonly status?: RegistryStatus;\n  readonly retention?: GovernanceMeta;\n  readonly residency?: GovernanceMeta;\n}\n\n/** Fields a {@link IRegistryDriver.compareAndSwap} may mutate (identity + audit + token are off-limits). */\nexport type RegistryPatch = Partial<\n  Pick<\n    RegistryRecord,\n    | 'currentGen'\n    | 'wrappedDeks'\n    | 'keyId'\n    | 'dirtyChunkCount'\n    | 'status'\n    | 'leaseOwner'\n    | 'leaseExpiresAt'\n    | 'lastCompactedAt'\n    | 'consecutiveFailures'\n    | 'retention'\n    | 'residency'\n  >\n>;\n\n/** Capabilities a registry driver advertises; validated fail-fast at wiring time. */\nexport interface RegCaps {\n  /** REQUIRED — `currentGen` feeds read correctness + compaction CAS, so reads must be strongly consistent. */\n  readonly strongRead: true;\n}\n\n/**\n * Per-segment registry — the authoritative source of `currentGen`, the discovery index, and (Phase 4e) the\n * wrapped-DEK holder. One row per segment under OCC: a\n * never-reused, equality-compared {@link Token} (ABA-safe across delete→recreate, like the Warm tier).\n */\nexport interface IRegistryDriver {\n  capabilities(): RegCaps;\n  /** The segment's record, or `null` if it doesn't exist (or was deleted). */\n  get(ref: SegmentRef): Promise<RegistryRecord | null>;\n  /** Create the row; throws {@link WriteConflictError} if it already exists (use CAS to mutate). */\n  create(ref: SegmentRef, record: NewRegistryRecord): Promise<{ token: Token }>;\n  /** Server-side compare-and-set: apply `patch` iff the stored token equals `expected`, else `WriteConflictError`. */\n  compareAndSwap(ref: SegmentRef, expected: Token, patch: RegistryPatch): Promise<{ token: Token }>;\n  /** Discovery: every live record, optionally scoped to one namespace. Order is unspecified. */\n  list(namespace?: string): AsyncIterable<RegistryRecord>;\n  /** Remove the row (tombstoned for ABA-safety — a later `create` still gets a fresh, greater token). */\n  delete(ref: SegmentRef): Promise<void>;\n}\n"]}