@cloudbitmaps/core 0.8.2 → 0.9.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { a as IWarmDriver, h as ColdChunkSource, S as SegmentRef, W as WarmReadOptions, i as SegmentSize, I as IColdDriver, d as IRegistryDriver, j as IKeystore, b as ChunkRef, C as ColdCaps, G as GenKey, B as BlobSink, R as RegCaps, e as RegistryRecord, f as NewRegistryRecord, T as Token, g as RegistryPatch, c as WarmRow, N as NoRow, k as CrbmCrypto, l as BlobReader, m as WrappedDek, A as Aead, n as AeadSealed } from './ports-5BQTGKze.cjs';
-export { o as BufferReader, p as BufferSink, q as GovernanceMeta, r as NO_ROW, s as RegistryStatus, t as aadFor } from './ports-5BQTGKze.cjs';
+import { a as IWarmDriver, h as ColdChunkSource, S as SegmentRef, W as WarmReadOptions, i as SegmentSize, I as IColdDriver, d as IRegistryDriver, j as IKeystore, b as ChunkRef, C as ColdCaps, G as GenKey, B as BlobSink, R as RegCaps, e as RegistryRecord, f as NewRegistryRecord, T as Token, g as RegistryPatch, c as WarmRow, N as NoRow, k as CrbmCrypto, l as BlobReader, m as WrappedDek, A as Aead, n as AeadSealed, o as GovernanceMeta } from './ports-CvcvJWf6.cjs';
+export { p as BufferReader, q as BufferSink, r as NO_ROW, s as RegistryStatus, t as aadFor } from './ports-CvcvJWf6.cjs';
 
 /**
  * The **bitmap-codec seam**.
@@ -2209,7 +2209,10 @@ interface DropResult {
      * How the segment got to its current state. Absent on a fresh, ordinary drop (tombstone written, Cold swept).
      *
      * - `'warm-only'` — **a successful retirement.** No registry row and no Cold objects, so this was an accumulator
-     *   segment: its Warm rows were deleted and it now reads empty. Pairs with `dropped: true`.
+     *   segment: its Warm rows were deleted and it now reads empty. Pairs with `dropped: true`. Note this depends on
+     *   the segment having **no row**: `setRetention` mints one (that is what makes a warm-only segment enumerable),
+     *   so a retention-managed accumulator takes the ordinary row-bearing path and reports `reason: undefined` with a
+     *   tombstone instead. Branch on `dropped`; `reason` is for understanding, not for control flow.
      * - `'already'` — it was already a tombstone. Idempotent; pairs with `dropped: true`. Note a re-drop is **not**
      *   a no-op — it also clears Warm rows that landed after the tombstone.
      * - `'absent'` — **nothing existed.** No registry row, no Cold objects, and no Warm rows to delete. Pairs with
@@ -2289,6 +2292,243 @@ declare function dropSegment(ref: SegmentRef, deps: DropDeps, options: {
     audit?: IAuditSink;
 }): Promise<DropResult>;
 
+/**
+ * The smallest accepted `expiresAt`: 2001-09-09, the point below which an epoch-**seconds** value would land.
+ *
+ * This is a deliberate guard against the single most damaging typo available here. `Date.now() / 1000 + 30 * 86400`
+ * is a natural thing to write, and it produces a number ~1.8 billion — an instant in **1970**, which is to say
+ * *already expired*. Without this check, that typo is not a validation error, it is a sweep that retires the
+ * segment on its very next pass. Anything below this floor is far likelier to be seconds than a genuine intent to
+ * expire a segment two decades ago, and the caller who really means "retire it now" can say so with `dropSegment`.
+ */
+declare const MIN_EXPIRES_AT_MS = 1000000000000;
+/** A segment's retention policy: the instant it becomes eligible for retirement. */
+interface RetentionPolicy {
+    /**
+     * Absolute epoch-**milliseconds**. Once `now >= expiresAt`, a retention sweep may retire the segment — delete
+     * its Warm rows and its Cold generations. A value in the past is legal (backfilling a policy onto existing
+     * buckets is a normal thing to do) and means "eligible on the next sweep".
+     */
+    readonly expiresAt: number;
+}
+interface RetentionDeps {
+    readonly registry: IRegistryDriver;
+}
+interface SetRetentionResult {
+    readonly segment: string;
+    readonly namespace?: string;
+    /** The policy now stored on the row. */
+    readonly expiresAt: number;
+    /**
+     * True iff this call **minted the registry row**. That is the warm-only-accumulator case: the segment existed
+     * only as Warm deltas, invisible to `registry.list()` and therefore to every fleet-wide operation, and it is
+     * now enumerable. The row claims no Cold generation (`currentGen: null`), so reads are unaffected.
+     */
+    readonly createdRow: boolean;
+}
+/**
+ * Read the policy off a registry row's `retention` metadata. Returns `null` when there is no policy, and
+ * `'invalid'` when the key is present but unusable (wrong type, or below the epoch-seconds floor).
+ *
+ * The three-way answer exists so a fleet sweep can *report* a malformed policy instead of choosing between two
+ * bad options: treating it as "no policy" hides an operator error on a segment someone believes is expiring, and
+ * throwing aborts a ledger over one bad row. Nothing writes an invalid policy through
+ * {@link setSegmentRetention} — hand-edited rows, an older/newer writer, or a restore are how it happens.
+ */
+declare function readRetentionPolicy(meta: GovernanceMeta | undefined): RetentionPolicy | null | 'invalid';
+/** The stored policy for one segment, or `null` if it has none (and `'invalid'` for a malformed one). */
+declare function getSegmentRetention(ref: SegmentRef, deps: RetentionDeps): Promise<RetentionPolicy | null | 'invalid'>;
+/**
+ * Record when a segment becomes eligible for retirement, creating its registry row if it has none.
+ *
+ * Idempotent and safe to re-run: writing the same instant twice is a no-op in effect. Other keys already in the
+ * row's `retention` metadata are preserved — this owns one key, not the whole object.
+ *
+ * Refuses a `destroyed` segment: a tombstone has nothing left to retire, and putting a policy on one would make
+ * a sweep repeatedly "retire" bytes that are already gone.
+ */
+declare function setSegmentRetention(ref: SegmentRef, deps: RetentionDeps, policy: RetentionPolicy): Promise<SetRetentionResult>;
+/**
+ * Remove a segment's expiry so no sweep will retire it. Returns whether a policy was actually removed (`false`
+ * for a segment with no row, or one that had no policy) — a separate verb from setting one, because "cancel the
+ * expiry" and "expire at time T" are different intents and a magic sentinel value for the first is how a typo
+ * becomes a deletion.
+ *
+ * Other `retention` keys are left in place; if removing the expiry empties the metadata, the field is cleared.
+ */
+declare function clearSegmentRetention(ref: SegmentRef, deps: RetentionDeps): Promise<boolean>;
+
+/**
+ * The retention **sweep** (Phase 6) — the thing that acts on the policies `setSegmentRetention` records.
+ *
+ * `retireExpired` enumerates the registry, selects the segments whose `expiresAt` has passed, and retires each
+ * one through {@link dropSegment}. It deliberately **delegates rather than reimplements**: the Warm → registry →
+ * Cold ordering, the re-sweep for a generation staged by an in-flight compaction, and the `generationsRemaining`
+ * report are all load-bearing and already live there. A sweep that open-coded the deletions would be a second
+ * implementation of the most dangerous ordering in the library.
+ *
+ * **This is a call, not a daemon.** Nothing here schedules itself. You run it from whatever heartbeat your
+ * deployment already has — an EventBridge rule, a Kubernetes CronJob, a queue consumer, the compaction worker's
+ * loop — and the library stays a library: it has to behave identically in a Lambda, an edge isolate and a
+ * long-lived server, and a timer that only works in one of those is worse than none.
+ *
+ * Three properties make it safe to point at a fleet:
+ *
+ *  - **`dryRun` at the sweep level.** `dropSegment`'s `confirmSegment` guard is vacuous in a loop (it is the same
+ *    variable twice), so the meaningful preview is here: it reports what it *would* retire, per segment, and
+ *    touches nothing.
+ *  - **A per-cycle `limit`.** Clock skew, a bad backfill, or a namespace-wide policy mistake should cost one
+ *    bounded batch, not the fleet. When the limit bites, the result says so (`limited: true`) rather than looking
+ *    like a completed sweep.
+ *  - **A ledger, never an exception.** A per-segment fault is recorded and the sweep continues — the caller's
+ *    load-bearing question is *which* segments were retired, and a throw from the middle of the loop answers it
+ *    for none of them while having already retired some. Same posture as `eraseNamespace`.
+ *
+ * It also **purges the tombstones its own retirements leave behind**. A retired segment that had a registry row
+ * gets a `destroyed` row, and one dead row per retired daily bucket — or per retired dedup wave — is exactly the
+ * registry litter `dropSegment` already refuses to create for a row-less accumulator. Purging is narrow on
+ * purpose: only a tombstone that still carries an **expired retention policy** (so it is attributably ours, never
+ * a GDPR crypto-shred), only after a grace period, and only once Warm and Cold are provably empty for it —
+ * because deleting the row is what makes the name reusable and takes the segment out of reach of
+ * `gcOrphanGenerations`.
+ */
+
+/** Default cap on retirements per sweep — a bounded batch, so a policy mistake costs one batch, not the fleet. */
+declare const DEFAULT_RETIRE_LIMIT = 100;
+/**
+ * Default delay before a retirement's own tombstone row is purged: 24 h.
+ *
+ * The row is a fence — while it exists, `publishGeneration`, `bulkLoadCrbmGeneration` and `compactSegment` all
+ * refuse the segment, so a writer that was mid-operation when the drop landed cannot resurrect it. That window is
+ * seconds to minutes in practice; a day of margin costs one tiny row and removes any need to reason about it.
+ */
+declare const DEFAULT_TOMBSTONE_GRACE_MS = 86400000;
+interface RetireExpiredOptions {
+    /** Scope the sweep to one namespace. Omit to sweep every namespace the registry knows. */
+    readonly namespace?: string;
+    /**
+     * The instant to compare policies against (epoch-ms). Required here because `core/` takes its time from the
+     * caller, never from the platform — `store.retireExpired()` fills it in from the store's clock.
+     */
+    readonly now: number;
+    /** Maximum segments to retire in this cycle (default {@link DEFAULT_RETIRE_LIMIT}). */
+    readonly limit?: number;
+    /** Report what would be retired and change nothing. */
+    readonly dryRun?: boolean;
+    /** Forwarded to each `dropSegment`, so every retirement lands in the audit trail as `segment.dispose`. */
+    readonly audit?: IAuditSink;
+    /** Ceiling on rows enumerated (default `DEFAULT_MAX_SCAN_SEGMENTS`, 250,000); exceeding it throws. */
+    readonly maxScanSegments?: number;
+    /**
+     * Whether to delete the tombstone rows this sweep's own past retirements left (default `true`). Set `false` to
+     * keep every tombstone forever — the right choice if something outside this library treats the presence of a
+     * `destroyed` row as an attestation.
+     *
+     * Two knobs rather than one `number | 'never'`, deliberately: `0` would have had to mean "purge immediately"
+     * here while `coldGenTtlMs: 0` in this same library means "pin forever", and one option whose zero is the
+     * opposite of another's is a reading hazard for whoever tunes both.
+     */
+    readonly purgeTombstones?: boolean;
+    /** How long a retirement's tombstone must age before this sweep deletes it (default 24 h). */
+    readonly tombstoneGraceMs?: number;
+}
+/** What happened to one segment in a sweep. */
+type RetireEntry = {
+    readonly segment: string;
+    readonly namespace?: string;
+    /** Retired: `result` is `dropSegment`'s full report — **check `generationsRemaining`**. */
+    readonly action: 'retired';
+    readonly expiresAt: number;
+    readonly result: DropResult;
+    /**
+     * Present when the retirement **completed the destructive part and then faulted** — the tombstone is written
+     * and the segment reads empty, but something after that (the Cold sweep) threw. The storage may not be fully
+     * reclaimed; re-run. Reported as `retired` rather than `skipped` because the segment really is retired, and
+     * saying otherwise is the one thing a caller cannot recover from.
+     */
+    readonly fault?: `failed: ${string}`;
+} | {
+    readonly segment: string;
+    readonly namespace?: string;
+    /** `dryRun` only — what a real sweep would have retired, with `dropSegment`'s own preview attached. */
+    readonly action: 'would-retire';
+    readonly expiresAt: number;
+    readonly result: DropResult;
+} | {
+    readonly segment: string;
+    readonly namespace?: string;
+    /** A tombstone row from an earlier retirement was deleted (or would be, under `dryRun`). */
+    readonly action: 'purged-tombstone' | 'would-purge-tombstone';
+} | {
+    readonly segment: string;
+    readonly namespace?: string;
+    readonly action: 'skipped';
+    /**
+     * `'invalid-policy'` — the row has an `expiresAt` that is not usable (hand-edited, or restored from another
+     * schema). Reported rather than ignored: reading as "never expires" on a segment someone believes is
+     * expiring is the silence that costs a retention commitment.
+     * `'limit'` — eligible, but this cycle's `limit` was already spent. Re-run to continue.
+     * `'tombstone-not-empty'` — a tombstone whose Warm rows or Cold generations are not gone even after a GC
+     * attempt, so its row is kept: the row is what keeps the segment reachable by `gcOrphanGenerations` and
+     * refused by every writer.
+     * `'policy-changed'` — the live row no longer says "expired" (a `clearRetention`, a new `expiresAt`, or
+     * someone else's drop landed between the enumeration and this segment's turn). Not an error: the sweep
+     * re-reads before every deletion precisely so cancelling an expiry works on a sweep already in flight.
+     * `` `failed: …` `` — any fault, isolated to this segment. A fault that happened *after* the tombstone
+     * landed is reported as `retired` with a `fault` instead, because that segment IS retired.
+     */
+    readonly reason: 'invalid-policy' | 'limit' | 'tombstone-not-empty' | 'policy-changed' | `failed: ${string}`;
+};
+interface RetireExpiredResult {
+    /** Registry rows enumerated. */
+    readonly scanned: number;
+    /** Rows whose policy said "expired" — including any the `limit` deferred. */
+    readonly eligible: number;
+    /**
+     * Segments **actually retired**. Zero under `dryRun` — see `wouldRetire`. Kept honest because this is the field
+     * most likely to end up on a dashboard, and the CLI emits it: a counter that means "deleted" in one mode and
+     * "would delete" in another produces phantom deletions on any graph that does not also join on `dryRun`.
+     */
+    readonly retired: number;
+    /** Segments a real sweep **would** have retired. Only ever non-zero under `dryRun`. */
+    readonly wouldRetire: number;
+    /** Tombstone rows actually deleted. Zero under `dryRun`; the `would-purge-tombstone` entries carry the preview. */
+    readonly tombstonesPurged: number;
+    /** True when `limit` cut the cycle short — **more segments are still eligible**. Re-run. */
+    readonly limited: boolean;
+    readonly dryRun: boolean;
+    /** Per-segment ledger. Inspect it: a `skipped` or failed entry is a segment that still holds data. */
+    readonly entries: readonly RetireEntry[];
+}
+/**
+ * Retire every segment whose retention policy has expired, and clean up the tombstones earlier sweeps left.
+ *
+ * Returns a ledger; **never throws for a per-segment fault** (those become entries). It does throw for a bad
+ * argument, and for a fleet larger than `maxScanSegments` — a scan that cannot be held in memory is a fail-loud
+ * condition, not a partial result to be mistaken for a complete sweep.
+ */
+declare function retireExpired(deps: DropDeps, options: RetireExpiredOptions): Promise<RetireExpiredResult>;
+
+/**
+ * Ceiling on registry records one fleet-wide scan holds resident. Raise it via the caller's `maxScanSegments` when
+ * the fleet really is that large *and* the memory is there; narrow the scan with a `namespace` otherwise.
+ */
+declare const DEFAULT_MAX_SCAN_SEGMENTS = 250000;
+/** Fail fast on a bad ceiling BEFORE the (possibly huge) scan, not after. */
+declare function validateMaxScanSegments(value: number, op: string): void;
+/**
+ * Drain every registry record (optionally one namespace) into an array, refusing past `maxScanSegments`.
+ *
+ * The bound is checked **before** each push, so the array never exceeds the ceiling the caller agreed to — the
+ * earlier form pushed first and then threw, which meant the very row that broke the budget was already resident,
+ * and a caller sizing a container against `maxScanSegments` was off by one row at the worst possible moment.
+ */
+declare function drainRegistry(registry: IRegistryDriver, options: {
+    namespace?: string;
+    maxScanSegments: number;
+    op: string;
+}): Promise<RegistryRecord[]>;
+
 /**
  * Fail-safe cross-tier DR check (gap #11). The registry (`currentGen`, e.g. in
  * DynamoDB) and the immutable `.crbm` generations (e.g. in S3) back up and restore **independently**, so a
@@ -2307,20 +2547,6 @@ declare function dropSegment(ref: SegmentRef, deps: DropDeps, options: {
  * to confirm a reported tear.
  */
 
-/** Default in-flight fan-out for the consistency scan — bounded, no thundering herd. */
-/**
- * Default ceiling on how many registry records one consistency check may hold resident: 250,000.
- *
- * **Named `maxScanSegments`, not `maxSegments`, on purpose.** Compaction already has a `maxSegments`
- * (`CR_COMPACT_MAX_SEGMENTS`) that caps how much work one cycle does and then *continues normally*. This one
- * caps how much a scan may hold and *refuses* past it. Same-sounding names with opposite behaviour at the
- * limit is a trap; pairing this with `maxWarmScanBytes` instead makes both read as what they are — ceilings on
- * a scan that fail closed.
- *
- * Generous — the compaction docs target 100K+ segment fleets — while still bounding a DR drill's memory to
- * something a modest operator box survives. Raisable, because a ceiling you cannot lift is a landmine.
- */
-declare const DEFAULT_MAX_SCAN_SEGMENTS = 250000;
 interface ConsistencyIssue {
     readonly segment: string;
     readonly namespace?: string;
@@ -2532,4 +2758,4 @@ declare class CrbmWriter {
     private buildFooter;
 }
 
-export { AWS_US_EAST_1_ONDEMAND, Aead, AeadSealed, type AuditEvent, type AuditEventKind, BlobReader, BlobSink, BoundedLru, type Budget, BudgetExceededError, type BudgetOption, type BulkLoadResult, CapabilityError, ChunkRef, type Clock, CloudRoaringError, type CodecBitmap, type CodecInterface, ColdCaps, ColdChunkSource, type CompactionCandidate, type CompactionCycleResult, type CompactionDeps, type CompactionOptions, type CompactionResult, type ConsistencyErrorEntry, type ConsistencyIssue, type ConsistencyReport, type CostAdvisory, type CostReport, CountingMetricsSink, CrbmColdChunkSource, type CrbmColdChunkSourceOptions, CrbmCrypto, CrbmReader, type CrbmReaderOptions, CrbmWriter, type CrbmWriterOptions, DEFAULT_BUDGET, DEFAULT_MAX_SCAN_SEGMENTS, DEFAULT_MAX_WARM_SCAN_BYTES, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETRY_POLICY, DEFAULT_WRITE_CONCURRENCY, type DestroyResult, type DiscoveryOptions, type DropDeps, type DropResult, type EngineDeps, type EraseDeps, type EstimateInput, type ExportFailure, type ExportFormat, type ExportManifest, type ExportOptions, type ExportSink, type ExportWriter, type ExportedSegment, GenKey, type IAuditSink, IColdDriver, IKeystore, type IMetricsSink, IRegistryDriver, IWarmDriver, InProcessKeystore, type InProcessKeystoreOptions, IntegrityError, KeyUnavailableError, LocalFsColdDriver, LocalFsRegistryDriver, type LocalFsRegistryDriverOptions, LocalFsWarmDriver, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, type MemoryRegistryDriverOptions, MemoryWarmDriver, type MetricEvent, type MetricOpName, type MetricsSnapshot, NOOP_AUDIT, NOOP_METRICS, NewRegistryRecord, NoRow, NodeAead, NotFoundError, type PricingProfile, RecordingAuditSink, RegCaps, RegistryPatch, RegistryRecord, type RetryDeps, type RetryPolicy, RetryingColdChunkSource, RetryingColdDriver, type RetryingOptions, RetryingRegistryDriver, RetryingWarmDriver, type Rng, SegmentEngine, SegmentRef, SegmentSize, type SegmentSizing, TimeoutError, Token, type Topology, TransientError, UnsupportedError, ValidationError, WarmReadOptions, WarmRow, type Workload, WrappedDek, WriteConflictError, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, collectWithinBudget, compactSegment, destroySegment, dropSegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, groundedReport, isCloudRoaringError, isIntegrityError, isNotFoundError, isTransient, isTransientError, isValidationError, isWriteConflictError, joinId, mapWithConcurrency, publishGeneration, resolveBudget, resolvePerOpBudget, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, splitId, validateCompactionOptions, validateSegmentRef, withRetry, writeCrbmGeneration };
+export { AWS_US_EAST_1_ONDEMAND, Aead, AeadSealed, type AuditEvent, type AuditEventKind, BlobReader, BlobSink, BoundedLru, type Budget, BudgetExceededError, type BudgetOption, type BulkLoadResult, CapabilityError, ChunkRef, type Clock, CloudRoaringError, type CodecBitmap, type CodecInterface, ColdCaps, ColdChunkSource, type CompactionCandidate, type CompactionCycleResult, type CompactionDeps, type CompactionOptions, type CompactionResult, type ConsistencyErrorEntry, type ConsistencyIssue, type ConsistencyReport, type CostAdvisory, type CostReport, CountingMetricsSink, CrbmColdChunkSource, type CrbmColdChunkSourceOptions, CrbmCrypto, CrbmReader, type CrbmReaderOptions, CrbmWriter, type CrbmWriterOptions, DEFAULT_BUDGET, DEFAULT_MAX_SCAN_SEGMENTS, DEFAULT_MAX_WARM_SCAN_BYTES, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETIRE_LIMIT, DEFAULT_RETRY_POLICY, DEFAULT_TOMBSTONE_GRACE_MS, DEFAULT_WRITE_CONCURRENCY, type DestroyResult, type DiscoveryOptions, type DropDeps, type DropResult, type EngineDeps, type EraseDeps, type EstimateInput, type ExportFailure, type ExportFormat, type ExportManifest, type ExportOptions, type ExportSink, type ExportWriter, type ExportedSegment, GenKey, GovernanceMeta, type IAuditSink, IColdDriver, IKeystore, type IMetricsSink, IRegistryDriver, IWarmDriver, InProcessKeystore, type InProcessKeystoreOptions, IntegrityError, KeyUnavailableError, LocalFsColdDriver, LocalFsRegistryDriver, type LocalFsRegistryDriverOptions, LocalFsWarmDriver, MIN_EXPIRES_AT_MS, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, type MemoryRegistryDriverOptions, MemoryWarmDriver, type MetricEvent, type MetricOpName, type MetricsSnapshot, NOOP_AUDIT, NOOP_METRICS, NewRegistryRecord, NoRow, NodeAead, NotFoundError, type PricingProfile, RecordingAuditSink, RegCaps, RegistryPatch, RegistryRecord, type RetentionDeps, type RetentionPolicy, type RetireEntry, type RetireExpiredOptions, type RetireExpiredResult, type RetryDeps, type RetryPolicy, RetryingColdChunkSource, RetryingColdDriver, type RetryingOptions, RetryingRegistryDriver, RetryingWarmDriver, type Rng, SegmentEngine, SegmentRef, SegmentSize, type SegmentSizing, type SetRetentionResult, TimeoutError, Token, type Topology, TransientError, UnsupportedError, ValidationError, WarmReadOptions, WarmRow, type Workload, WrappedDek, WriteConflictError, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, clearSegmentRetention, collectWithinBudget, compactSegment, destroySegment, drainRegistry, dropSegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, getSegmentRetention, groundedReport, isCloudRoaringError, isIntegrityError, isNotFoundError, isTransient, isTransientError, isValidationError, isWriteConflictError, joinId, mapWithConcurrency, publishGeneration, readRetentionPolicy, resolveBudget, resolvePerOpBudget, retireExpired, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, setSegmentRetention, splitId, validateCompactionOptions, validateMaxScanSegments, validateSegmentRef, withRetry, writeCrbmGeneration };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { a as IWarmDriver, h as ColdChunkSource, S as SegmentRef, W as WarmReadOptions, i as SegmentSize, I as IColdDriver, d as IRegistryDriver, j as IKeystore, b as ChunkRef, C as ColdCaps, G as GenKey, B as BlobSink, R as RegCaps, e as RegistryRecord, f as NewRegistryRecord, T as Token, g as RegistryPatch, c as WarmRow, N as NoRow, k as CrbmCrypto, l as BlobReader, m as WrappedDek, A as Aead, n as AeadSealed } from './ports-5BQTGKze.js';
-export { o as BufferReader, p as BufferSink, q as GovernanceMeta, r as NO_ROW, s as RegistryStatus, t as aadFor } from './ports-5BQTGKze.js';
+import { a as IWarmDriver, h as ColdChunkSource, S as SegmentRef, W as WarmReadOptions, i as SegmentSize, I as IColdDriver, d as IRegistryDriver, j as IKeystore, b as ChunkRef, C as ColdCaps, G as GenKey, B as BlobSink, R as RegCaps, e as RegistryRecord, f as NewRegistryRecord, T as Token, g as RegistryPatch, c as WarmRow, N as NoRow, k as CrbmCrypto, l as BlobReader, m as WrappedDek, A as Aead, n as AeadSealed, o as GovernanceMeta } from './ports-CvcvJWf6.js';
+export { p as BufferReader, q as BufferSink, r as NO_ROW, s as RegistryStatus, t as aadFor } from './ports-CvcvJWf6.js';
 
 /**
  * The **bitmap-codec seam**.
@@ -2209,7 +2209,10 @@ interface DropResult {
      * How the segment got to its current state. Absent on a fresh, ordinary drop (tombstone written, Cold swept).
      *
      * - `'warm-only'` — **a successful retirement.** No registry row and no Cold objects, so this was an accumulator
-     *   segment: its Warm rows were deleted and it now reads empty. Pairs with `dropped: true`.
+     *   segment: its Warm rows were deleted and it now reads empty. Pairs with `dropped: true`. Note this depends on
+     *   the segment having **no row**: `setRetention` mints one (that is what makes a warm-only segment enumerable),
+     *   so a retention-managed accumulator takes the ordinary row-bearing path and reports `reason: undefined` with a
+     *   tombstone instead. Branch on `dropped`; `reason` is for understanding, not for control flow.
      * - `'already'` — it was already a tombstone. Idempotent; pairs with `dropped: true`. Note a re-drop is **not**
      *   a no-op — it also clears Warm rows that landed after the tombstone.
      * - `'absent'` — **nothing existed.** No registry row, no Cold objects, and no Warm rows to delete. Pairs with
@@ -2289,6 +2292,243 @@ declare function dropSegment(ref: SegmentRef, deps: DropDeps, options: {
     audit?: IAuditSink;
 }): Promise<DropResult>;
 
+/**
+ * The smallest accepted `expiresAt`: 2001-09-09, the point below which an epoch-**seconds** value would land.
+ *
+ * This is a deliberate guard against the single most damaging typo available here. `Date.now() / 1000 + 30 * 86400`
+ * is a natural thing to write, and it produces a number ~1.8 billion — an instant in **1970**, which is to say
+ * *already expired*. Without this check, that typo is not a validation error, it is a sweep that retires the
+ * segment on its very next pass. Anything below this floor is far likelier to be seconds than a genuine intent to
+ * expire a segment two decades ago, and the caller who really means "retire it now" can say so with `dropSegment`.
+ */
+declare const MIN_EXPIRES_AT_MS = 1000000000000;
+/** A segment's retention policy: the instant it becomes eligible for retirement. */
+interface RetentionPolicy {
+    /**
+     * Absolute epoch-**milliseconds**. Once `now >= expiresAt`, a retention sweep may retire the segment — delete
+     * its Warm rows and its Cold generations. A value in the past is legal (backfilling a policy onto existing
+     * buckets is a normal thing to do) and means "eligible on the next sweep".
+     */
+    readonly expiresAt: number;
+}
+interface RetentionDeps {
+    readonly registry: IRegistryDriver;
+}
+interface SetRetentionResult {
+    readonly segment: string;
+    readonly namespace?: string;
+    /** The policy now stored on the row. */
+    readonly expiresAt: number;
+    /**
+     * True iff this call **minted the registry row**. That is the warm-only-accumulator case: the segment existed
+     * only as Warm deltas, invisible to `registry.list()` and therefore to every fleet-wide operation, and it is
+     * now enumerable. The row claims no Cold generation (`currentGen: null`), so reads are unaffected.
+     */
+    readonly createdRow: boolean;
+}
+/**
+ * Read the policy off a registry row's `retention` metadata. Returns `null` when there is no policy, and
+ * `'invalid'` when the key is present but unusable (wrong type, or below the epoch-seconds floor).
+ *
+ * The three-way answer exists so a fleet sweep can *report* a malformed policy instead of choosing between two
+ * bad options: treating it as "no policy" hides an operator error on a segment someone believes is expiring, and
+ * throwing aborts a ledger over one bad row. Nothing writes an invalid policy through
+ * {@link setSegmentRetention} — hand-edited rows, an older/newer writer, or a restore are how it happens.
+ */
+declare function readRetentionPolicy(meta: GovernanceMeta | undefined): RetentionPolicy | null | 'invalid';
+/** The stored policy for one segment, or `null` if it has none (and `'invalid'` for a malformed one). */
+declare function getSegmentRetention(ref: SegmentRef, deps: RetentionDeps): Promise<RetentionPolicy | null | 'invalid'>;
+/**
+ * Record when a segment becomes eligible for retirement, creating its registry row if it has none.
+ *
+ * Idempotent and safe to re-run: writing the same instant twice is a no-op in effect. Other keys already in the
+ * row's `retention` metadata are preserved — this owns one key, not the whole object.
+ *
+ * Refuses a `destroyed` segment: a tombstone has nothing left to retire, and putting a policy on one would make
+ * a sweep repeatedly "retire" bytes that are already gone.
+ */
+declare function setSegmentRetention(ref: SegmentRef, deps: RetentionDeps, policy: RetentionPolicy): Promise<SetRetentionResult>;
+/**
+ * Remove a segment's expiry so no sweep will retire it. Returns whether a policy was actually removed (`false`
+ * for a segment with no row, or one that had no policy) — a separate verb from setting one, because "cancel the
+ * expiry" and "expire at time T" are different intents and a magic sentinel value for the first is how a typo
+ * becomes a deletion.
+ *
+ * Other `retention` keys are left in place; if removing the expiry empties the metadata, the field is cleared.
+ */
+declare function clearSegmentRetention(ref: SegmentRef, deps: RetentionDeps): Promise<boolean>;
+
+/**
+ * The retention **sweep** (Phase 6) — the thing that acts on the policies `setSegmentRetention` records.
+ *
+ * `retireExpired` enumerates the registry, selects the segments whose `expiresAt` has passed, and retires each
+ * one through {@link dropSegment}. It deliberately **delegates rather than reimplements**: the Warm → registry →
+ * Cold ordering, the re-sweep for a generation staged by an in-flight compaction, and the `generationsRemaining`
+ * report are all load-bearing and already live there. A sweep that open-coded the deletions would be a second
+ * implementation of the most dangerous ordering in the library.
+ *
+ * **This is a call, not a daemon.** Nothing here schedules itself. You run it from whatever heartbeat your
+ * deployment already has — an EventBridge rule, a Kubernetes CronJob, a queue consumer, the compaction worker's
+ * loop — and the library stays a library: it has to behave identically in a Lambda, an edge isolate and a
+ * long-lived server, and a timer that only works in one of those is worse than none.
+ *
+ * Three properties make it safe to point at a fleet:
+ *
+ *  - **`dryRun` at the sweep level.** `dropSegment`'s `confirmSegment` guard is vacuous in a loop (it is the same
+ *    variable twice), so the meaningful preview is here: it reports what it *would* retire, per segment, and
+ *    touches nothing.
+ *  - **A per-cycle `limit`.** Clock skew, a bad backfill, or a namespace-wide policy mistake should cost one
+ *    bounded batch, not the fleet. When the limit bites, the result says so (`limited: true`) rather than looking
+ *    like a completed sweep.
+ *  - **A ledger, never an exception.** A per-segment fault is recorded and the sweep continues — the caller's
+ *    load-bearing question is *which* segments were retired, and a throw from the middle of the loop answers it
+ *    for none of them while having already retired some. Same posture as `eraseNamespace`.
+ *
+ * It also **purges the tombstones its own retirements leave behind**. A retired segment that had a registry row
+ * gets a `destroyed` row, and one dead row per retired daily bucket — or per retired dedup wave — is exactly the
+ * registry litter `dropSegment` already refuses to create for a row-less accumulator. Purging is narrow on
+ * purpose: only a tombstone that still carries an **expired retention policy** (so it is attributably ours, never
+ * a GDPR crypto-shred), only after a grace period, and only once Warm and Cold are provably empty for it —
+ * because deleting the row is what makes the name reusable and takes the segment out of reach of
+ * `gcOrphanGenerations`.
+ */
+
+/** Default cap on retirements per sweep — a bounded batch, so a policy mistake costs one batch, not the fleet. */
+declare const DEFAULT_RETIRE_LIMIT = 100;
+/**
+ * Default delay before a retirement's own tombstone row is purged: 24 h.
+ *
+ * The row is a fence — while it exists, `publishGeneration`, `bulkLoadCrbmGeneration` and `compactSegment` all
+ * refuse the segment, so a writer that was mid-operation when the drop landed cannot resurrect it. That window is
+ * seconds to minutes in practice; a day of margin costs one tiny row and removes any need to reason about it.
+ */
+declare const DEFAULT_TOMBSTONE_GRACE_MS = 86400000;
+interface RetireExpiredOptions {
+    /** Scope the sweep to one namespace. Omit to sweep every namespace the registry knows. */
+    readonly namespace?: string;
+    /**
+     * The instant to compare policies against (epoch-ms). Required here because `core/` takes its time from the
+     * caller, never from the platform — `store.retireExpired()` fills it in from the store's clock.
+     */
+    readonly now: number;
+    /** Maximum segments to retire in this cycle (default {@link DEFAULT_RETIRE_LIMIT}). */
+    readonly limit?: number;
+    /** Report what would be retired and change nothing. */
+    readonly dryRun?: boolean;
+    /** Forwarded to each `dropSegment`, so every retirement lands in the audit trail as `segment.dispose`. */
+    readonly audit?: IAuditSink;
+    /** Ceiling on rows enumerated (default `DEFAULT_MAX_SCAN_SEGMENTS`, 250,000); exceeding it throws. */
+    readonly maxScanSegments?: number;
+    /**
+     * Whether to delete the tombstone rows this sweep's own past retirements left (default `true`). Set `false` to
+     * keep every tombstone forever — the right choice if something outside this library treats the presence of a
+     * `destroyed` row as an attestation.
+     *
+     * Two knobs rather than one `number | 'never'`, deliberately: `0` would have had to mean "purge immediately"
+     * here while `coldGenTtlMs: 0` in this same library means "pin forever", and one option whose zero is the
+     * opposite of another's is a reading hazard for whoever tunes both.
+     */
+    readonly purgeTombstones?: boolean;
+    /** How long a retirement's tombstone must age before this sweep deletes it (default 24 h). */
+    readonly tombstoneGraceMs?: number;
+}
+/** What happened to one segment in a sweep. */
+type RetireEntry = {
+    readonly segment: string;
+    readonly namespace?: string;
+    /** Retired: `result` is `dropSegment`'s full report — **check `generationsRemaining`**. */
+    readonly action: 'retired';
+    readonly expiresAt: number;
+    readonly result: DropResult;
+    /**
+     * Present when the retirement **completed the destructive part and then faulted** — the tombstone is written
+     * and the segment reads empty, but something after that (the Cold sweep) threw. The storage may not be fully
+     * reclaimed; re-run. Reported as `retired` rather than `skipped` because the segment really is retired, and
+     * saying otherwise is the one thing a caller cannot recover from.
+     */
+    readonly fault?: `failed: ${string}`;
+} | {
+    readonly segment: string;
+    readonly namespace?: string;
+    /** `dryRun` only — what a real sweep would have retired, with `dropSegment`'s own preview attached. */
+    readonly action: 'would-retire';
+    readonly expiresAt: number;
+    readonly result: DropResult;
+} | {
+    readonly segment: string;
+    readonly namespace?: string;
+    /** A tombstone row from an earlier retirement was deleted (or would be, under `dryRun`). */
+    readonly action: 'purged-tombstone' | 'would-purge-tombstone';
+} | {
+    readonly segment: string;
+    readonly namespace?: string;
+    readonly action: 'skipped';
+    /**
+     * `'invalid-policy'` — the row has an `expiresAt` that is not usable (hand-edited, or restored from another
+     * schema). Reported rather than ignored: reading as "never expires" on a segment someone believes is
+     * expiring is the silence that costs a retention commitment.
+     * `'limit'` — eligible, but this cycle's `limit` was already spent. Re-run to continue.
+     * `'tombstone-not-empty'` — a tombstone whose Warm rows or Cold generations are not gone even after a GC
+     * attempt, so its row is kept: the row is what keeps the segment reachable by `gcOrphanGenerations` and
+     * refused by every writer.
+     * `'policy-changed'` — the live row no longer says "expired" (a `clearRetention`, a new `expiresAt`, or
+     * someone else's drop landed between the enumeration and this segment's turn). Not an error: the sweep
+     * re-reads before every deletion precisely so cancelling an expiry works on a sweep already in flight.
+     * `` `failed: …` `` — any fault, isolated to this segment. A fault that happened *after* the tombstone
+     * landed is reported as `retired` with a `fault` instead, because that segment IS retired.
+     */
+    readonly reason: 'invalid-policy' | 'limit' | 'tombstone-not-empty' | 'policy-changed' | `failed: ${string}`;
+};
+interface RetireExpiredResult {
+    /** Registry rows enumerated. */
+    readonly scanned: number;
+    /** Rows whose policy said "expired" — including any the `limit` deferred. */
+    readonly eligible: number;
+    /**
+     * Segments **actually retired**. Zero under `dryRun` — see `wouldRetire`. Kept honest because this is the field
+     * most likely to end up on a dashboard, and the CLI emits it: a counter that means "deleted" in one mode and
+     * "would delete" in another produces phantom deletions on any graph that does not also join on `dryRun`.
+     */
+    readonly retired: number;
+    /** Segments a real sweep **would** have retired. Only ever non-zero under `dryRun`. */
+    readonly wouldRetire: number;
+    /** Tombstone rows actually deleted. Zero under `dryRun`; the `would-purge-tombstone` entries carry the preview. */
+    readonly tombstonesPurged: number;
+    /** True when `limit` cut the cycle short — **more segments are still eligible**. Re-run. */
+    readonly limited: boolean;
+    readonly dryRun: boolean;
+    /** Per-segment ledger. Inspect it: a `skipped` or failed entry is a segment that still holds data. */
+    readonly entries: readonly RetireEntry[];
+}
+/**
+ * Retire every segment whose retention policy has expired, and clean up the tombstones earlier sweeps left.
+ *
+ * Returns a ledger; **never throws for a per-segment fault** (those become entries). It does throw for a bad
+ * argument, and for a fleet larger than `maxScanSegments` — a scan that cannot be held in memory is a fail-loud
+ * condition, not a partial result to be mistaken for a complete sweep.
+ */
+declare function retireExpired(deps: DropDeps, options: RetireExpiredOptions): Promise<RetireExpiredResult>;
+
+/**
+ * Ceiling on registry records one fleet-wide scan holds resident. Raise it via the caller's `maxScanSegments` when
+ * the fleet really is that large *and* the memory is there; narrow the scan with a `namespace` otherwise.
+ */
+declare const DEFAULT_MAX_SCAN_SEGMENTS = 250000;
+/** Fail fast on a bad ceiling BEFORE the (possibly huge) scan, not after. */
+declare function validateMaxScanSegments(value: number, op: string): void;
+/**
+ * Drain every registry record (optionally one namespace) into an array, refusing past `maxScanSegments`.
+ *
+ * The bound is checked **before** each push, so the array never exceeds the ceiling the caller agreed to — the
+ * earlier form pushed first and then threw, which meant the very row that broke the budget was already resident,
+ * and a caller sizing a container against `maxScanSegments` was off by one row at the worst possible moment.
+ */
+declare function drainRegistry(registry: IRegistryDriver, options: {
+    namespace?: string;
+    maxScanSegments: number;
+    op: string;
+}): Promise<RegistryRecord[]>;
+
 /**
  * Fail-safe cross-tier DR check (gap #11). The registry (`currentGen`, e.g. in
  * DynamoDB) and the immutable `.crbm` generations (e.g. in S3) back up and restore **independently**, so a
@@ -2307,20 +2547,6 @@ declare function dropSegment(ref: SegmentRef, deps: DropDeps, options: {
  * to confirm a reported tear.
  */
 
-/** Default in-flight fan-out for the consistency scan — bounded, no thundering herd. */
-/**
- * Default ceiling on how many registry records one consistency check may hold resident: 250,000.
- *
- * **Named `maxScanSegments`, not `maxSegments`, on purpose.** Compaction already has a `maxSegments`
- * (`CR_COMPACT_MAX_SEGMENTS`) that caps how much work one cycle does and then *continues normally*. This one
- * caps how much a scan may hold and *refuses* past it. Same-sounding names with opposite behaviour at the
- * limit is a trap; pairing this with `maxWarmScanBytes` instead makes both read as what they are — ceilings on
- * a scan that fail closed.
- *
- * Generous — the compaction docs target 100K+ segment fleets — while still bounding a DR drill's memory to
- * something a modest operator box survives. Raisable, because a ceiling you cannot lift is a landmine.
- */
-declare const DEFAULT_MAX_SCAN_SEGMENTS = 250000;
 interface ConsistencyIssue {
     readonly segment: string;
     readonly namespace?: string;
@@ -2532,4 +2758,4 @@ declare class CrbmWriter {
     private buildFooter;
 }
 
-export { AWS_US_EAST_1_ONDEMAND, Aead, AeadSealed, type AuditEvent, type AuditEventKind, BlobReader, BlobSink, BoundedLru, type Budget, BudgetExceededError, type BudgetOption, type BulkLoadResult, CapabilityError, ChunkRef, type Clock, CloudRoaringError, type CodecBitmap, type CodecInterface, ColdCaps, ColdChunkSource, type CompactionCandidate, type CompactionCycleResult, type CompactionDeps, type CompactionOptions, type CompactionResult, type ConsistencyErrorEntry, type ConsistencyIssue, type ConsistencyReport, type CostAdvisory, type CostReport, CountingMetricsSink, CrbmColdChunkSource, type CrbmColdChunkSourceOptions, CrbmCrypto, CrbmReader, type CrbmReaderOptions, CrbmWriter, type CrbmWriterOptions, DEFAULT_BUDGET, DEFAULT_MAX_SCAN_SEGMENTS, DEFAULT_MAX_WARM_SCAN_BYTES, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETRY_POLICY, DEFAULT_WRITE_CONCURRENCY, type DestroyResult, type DiscoveryOptions, type DropDeps, type DropResult, type EngineDeps, type EraseDeps, type EstimateInput, type ExportFailure, type ExportFormat, type ExportManifest, type ExportOptions, type ExportSink, type ExportWriter, type ExportedSegment, GenKey, type IAuditSink, IColdDriver, IKeystore, type IMetricsSink, IRegistryDriver, IWarmDriver, InProcessKeystore, type InProcessKeystoreOptions, IntegrityError, KeyUnavailableError, LocalFsColdDriver, LocalFsRegistryDriver, type LocalFsRegistryDriverOptions, LocalFsWarmDriver, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, type MemoryRegistryDriverOptions, MemoryWarmDriver, type MetricEvent, type MetricOpName, type MetricsSnapshot, NOOP_AUDIT, NOOP_METRICS, NewRegistryRecord, NoRow, NodeAead, NotFoundError, type PricingProfile, RecordingAuditSink, RegCaps, RegistryPatch, RegistryRecord, type RetryDeps, type RetryPolicy, RetryingColdChunkSource, RetryingColdDriver, type RetryingOptions, RetryingRegistryDriver, RetryingWarmDriver, type Rng, SegmentEngine, SegmentRef, SegmentSize, type SegmentSizing, TimeoutError, Token, type Topology, TransientError, UnsupportedError, ValidationError, WarmReadOptions, WarmRow, type Workload, WrappedDek, WriteConflictError, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, collectWithinBudget, compactSegment, destroySegment, dropSegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, groundedReport, isCloudRoaringError, isIntegrityError, isNotFoundError, isTransient, isTransientError, isValidationError, isWriteConflictError, joinId, mapWithConcurrency, publishGeneration, resolveBudget, resolvePerOpBudget, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, splitId, validateCompactionOptions, validateSegmentRef, withRetry, writeCrbmGeneration };
+export { AWS_US_EAST_1_ONDEMAND, Aead, AeadSealed, type AuditEvent, type AuditEventKind, BlobReader, BlobSink, BoundedLru, type Budget, BudgetExceededError, type BudgetOption, type BulkLoadResult, CapabilityError, ChunkRef, type Clock, CloudRoaringError, type CodecBitmap, type CodecInterface, ColdCaps, ColdChunkSource, type CompactionCandidate, type CompactionCycleResult, type CompactionDeps, type CompactionOptions, type CompactionResult, type ConsistencyErrorEntry, type ConsistencyIssue, type ConsistencyReport, type CostAdvisory, type CostReport, CountingMetricsSink, CrbmColdChunkSource, type CrbmColdChunkSourceOptions, CrbmCrypto, CrbmReader, type CrbmReaderOptions, CrbmWriter, type CrbmWriterOptions, DEFAULT_BUDGET, DEFAULT_MAX_SCAN_SEGMENTS, DEFAULT_MAX_WARM_SCAN_BYTES, DEFAULT_OCC_BACKOFF, DEFAULT_PRICING, DEFAULT_RETIRE_LIMIT, DEFAULT_RETRY_POLICY, DEFAULT_TOMBSTONE_GRACE_MS, DEFAULT_WRITE_CONCURRENCY, type DestroyResult, type DiscoveryOptions, type DropDeps, type DropResult, type EngineDeps, type EraseDeps, type EstimateInput, type ExportFailure, type ExportFormat, type ExportManifest, type ExportOptions, type ExportSink, type ExportWriter, type ExportedSegment, GenKey, GovernanceMeta, type IAuditSink, IColdDriver, IKeystore, type IMetricsSink, IRegistryDriver, IWarmDriver, InProcessKeystore, type InProcessKeystoreOptions, IntegrityError, KeyUnavailableError, LocalFsColdDriver, LocalFsRegistryDriver, type LocalFsRegistryDriverOptions, LocalFsWarmDriver, MIN_EXPIRES_AT_MS, MemoryColdChunkSource, MemoryColdDriver, MemoryRegistryDriver, type MemoryRegistryDriverOptions, MemoryWarmDriver, type MetricEvent, type MetricOpName, type MetricsSnapshot, NOOP_AUDIT, NOOP_METRICS, NewRegistryRecord, NoRow, NodeAead, NotFoundError, type PricingProfile, RecordingAuditSink, RegCaps, RegistryPatch, RegistryRecord, type RetentionDeps, type RetentionPolicy, type RetireEntry, type RetireExpiredOptions, type RetireExpiredResult, type RetryDeps, type RetryPolicy, RetryingColdChunkSource, RetryingColdDriver, type RetryingOptions, RetryingRegistryDriver, RetryingWarmDriver, type Rng, SegmentEngine, SegmentRef, SegmentSize, type SegmentSizing, type SetRetentionResult, TimeoutError, Token, type Topology, TransientError, UnsupportedError, ValidationError, WarmReadOptions, WarmRow, type Workload, WrappedDek, WriteConflictError, bulkLoadCrbmGeneration, checkBudget, chunkRefKey, clearSegmentRetention, collectWithinBudget, compactSegment, destroySegment, drainRegistry, dropSegment, eraseNamespace, estimateCost, findCompactable, gcOrphanGenerations, getSegmentRetention, groundedReport, isCloudRoaringError, isIntegrityError, isNotFoundError, isTransient, isTransientError, isValidationError, isWriteConflictError, joinId, mapWithConcurrency, publishGeneration, readRetentionPolicy, resolveBudget, resolvePerOpBudget, retireExpired, runCompactionCycle, runConsistencyCheck, runExport, safeMetrics, segmentKey, setSegmentRetention, splitId, validateCompactionOptions, validateMaxScanSegments, validateSegmentRef, withRetry, writeCrbmGeneration };