@cloudbitmaps/roaring 0.1.0-rc.0

package/dist/chunk-JWCQLJUG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/roaring-codec.ts","../src/codec-bound.ts","../src/index.ts"],"names":["coreBulkLoad","coreCompactSegment","coreRunCompactionCycle","coreRunExport","compactSegment","runExport"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,IAAM,EAAE,eAAA,EAAiB,mBAAA,EAAqB,qBAAA,EAAsB,GAAI,OAAA;AAGjE,IAAM,UAAA,GAAN,MAAM,WAAA,CAAkC;AAAA,EAC5B,MAAA;AAAA,EAET,YAAY,MAAA,EAAyB;AAC3C,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,OAAO,KAAA,GAAoB;AACzB,IAAA,OAAO,IAAI,WAAA,CAAW,IAAI,eAAA,EAAiB,CAAA;AAAA,EAC7C;AAAA,EAEA,OAAO,WAAW,MAAA,EAAsC;AACtD,IAAA,OAAO,IAAI,WAAA,CAAW,IAAI,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,eAAA,CAAgB,KAAA,EAAmB,QAAA,EAA8B;AACtE,IAAA,IAAI,KAAA,CAAM,SAAS,QAAA,EAAU;AAC3B,MAAA,MAAM,IAAI,cAAA,CAAe,CAAA,qBAAA,EAAwB,MAAM,MAAM,CAAA,eAAA,EAAkB,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,IAC5F;AACA,IAAA,IAAI;AACF,MAAA,OAAO,IAAI,WAAA,CAAW,eAAA,CAAgB,YAAY,KAAA,EAAO,qBAAA,CAAsB,QAAQ,CAAC,CAAA;AAAA,IAC1F,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,cAAA,CAAe,CAAA,8BAAA,EAAkC,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAAA,EAEA,SAAA,GAAwB;AACtB,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,mBAAA,CAAoB,QAAQ,CAAA;AAAA,EAC3D;AAAA,EAEA,IAAI,KAAA,EAAqB;AACvB,IAAA,IAAA,CAAK,MAAA,CAAO,IAAI,KAAK,CAAA;AAAA,EACvB;AAAA,EAEA,QAAQ,MAAA,EAAgC;AACtC,IAAA,IAAA,CAAK,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,EAC5B;AAAA,EAEA,OAAO,KAAA,EAAqB;AAC1B,IAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,EAC1B;AAAA,EAEA,WAAW,MAAA,EAAgC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,WAAW,MAAM,CAAA;AAAA,EAC/B;AAAA,EAEA,IAAI,KAAA,EAAwB;AAC1B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAAA,EAC9B;AAAA,EAEA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,MAAA,CAAO,IAAA;AAAA,EACrB;AAAA,EAEA,IAAI,OAAA,GAAmB;AACrB,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,EACrB;AAAA,EAEA,KAAA,GAAoB;AAClB,IAAA,OAAO,IAAI,WAAA,CAAW,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAU,KAAA,EAA0B;AAClC,IAAA,IAAA,CAAK,MAAA,CAAO,SAAA,CAAW,KAAA,CAAqB,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA,EAGA,cAAc,KAAA,EAA0B;AACtC,IAAA,IAAA,CAAK,MAAA,CAAO,aAAA,CAAe,KAAA,CAAqB,MAAM,CAAA;AAAA,EACxD;AAAA;AAAA,EAGA,WAAW,KAAA,EAA0B;AACnC,IAAA,IAAA,CAAK,MAAA,CAAO,UAAA,CAAY,KAAA,CAAqB,MAAM,CAAA;AAAA,EACrD;AAAA;AAAA,EAGA,CAAC,MAAA,CAAO,QAAQ,CAAA,GAA8B;AAC5C,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAA,EAAE;AAAA,EACtC;AAAA,EAEA,OAAA,GAAoB;AAClB,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,EAAQ;AAAA,EAC7B;AACF,CAAA;AAOO,IAAM,YAAA,GAA+B;AAAA,EAC1C,KAAA,EAAO,MAAM,UAAA,CAAW,KAAA,EAAM;AAAA,EAC9B,UAAA,EAAY,CAAC,MAAA,KAAW,UAAA,CAAW,WAAW,MAAM,CAAA;AAAA,EACpD,iBAAiB,CAAC,KAAA,EAAO,aAAa,UAAA,CAAW,eAAA,CAAgB,OAAO,QAAQ;AAClF,CAAA;;;AC/FO,IAAM,yBAAmC,CAAC,MAAA,EAAQ,KAAK,GAAA,EAAK,OAAA,GAAU,EAAC,KAC5EA,wBAAA,CAAa,QAAQ,GAAA,EAAK,GAAA,EAAK,EAAE,GAAG,OAAA,EAAS,OAAO,OAAA,CAAQ,KAAA,IAAS,cAAc,CAAA;AAG9E,IAAM,cAAA,GAAiC,CAAC,GAAA,EAAK,IAAA,EAAM,YACxDC,gBAAA,CAAmB,GAAA,EAAK,EAAE,GAAG,MAAM,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS,YAAA,IAAgB,OAAO,CAAA;AAG1E,IAAM,kBAAA,GAAyC,CAAC,IAAA,EAAM,OAAA,KAC3DC,oBAAA,CAAuB,EAAE,GAAG,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS,YAAA,IAAgB,OAAO;AAGzE,IAAM,YAAuB,CAAC,MAAA,EAAQ,UAAU,IAAA,EAAM,OAAA,GAAU,EAAC,KACtEC,WAAA,CAAc,QAAQ,QAAA,EAAU,IAAA,EAAM,EAAE,GAAG,OAAA,EAAS,OAAO,OAAA,CAAQ,KAAA,IAAS,cAAc,CAAA;;;AC1C5F,IAAA,WAAA,GAAA;AAAA,QAAA,CAAA,WAAA,EAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,OAAA,EAAA,MAAA,OAAA;AAAA,EAAA,OAAA,EAAA,MAAA,OAAA;AAAA,EAAA,sBAAA,EAAA,MAAA,sBAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,SAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAw0BA,UAAA,CAAA,WAAA,EAAA,SAAA,CAAA;AA1vBA,IAAM,cAAN,MAAmC;AAAA,EACjC,GAAA,GAAc;AACZ,IAAA,OAAO,KAAK,GAAA,EAAI;AAAA,EAClB;AAAA,EAEA,MAAM,EAAA,EAA2B;AAC/B,IAAA,IAAI,EAAA,IAAM,CAAA,EAAG,OAAO,OAAA,CAAQ,OAAA,EAAQ;AASpC,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,MAAA,UAAA,CAAW,SAAS,EAAE,CAAA;AAAA,IACxB,CAAC,CAAA;AAAA,EACH;AACF,CAAA;AAGA,IAAM,YAAN,MAA+B;AAAA,EAC7B,IAAA,GAAe;AACb,IAAA,OAAO,KAAK,MAAA,EAAO;AAAA,EACrB;AACF,CAAA;AAEA,IAAM,wBAAA,GAA2B,IAAA;AAEjC,IAAM,yBAAA,GAA4B,CAAA;AAElC,SAAS,oBAAoB,WAAA,EAAuC;AAClE,EAAA,IAAI,WAAA,KAAgB,WAAc,CAAC,MAAA,CAAO,UAAU,WAAW,CAAA,IAAK,cAAc,CAAA,CAAA,EAAI;AACpF,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,4CAAA,EAA+C,WAAW,CAAA,CAAE,CAAA;AAAA,EACxF;AACF;AAQA,SAAS,YAAA,CAAa,SAA0D,EAAA,EAAkB;AAChG,EAAA,IAAI,OAAA,CAAQ,SAAA,KAAc,MAAA,IAAa,OAAA,CAAQ,kBAAkB,IAAA,EAAM;AACrE,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,GAAG,EAAE,CAAA,6JAAA;AAAA,KAEP;AAAA,EACF;AACF;AA0LA,SAAS,iBAAA,CACP,SACA,KAAA,EAIA;AACA,EAAA,MAAM,OAAgB,OAAA,CAAQ,IAAA;AAC9B,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC7C,IAAA,MAAM,IAAI,gBAAgB,oDAAoD,CAAA;AAAA,EAChF;AACA,EAAA,MAAM,WAAA,GAAc,OAAQ,IAAA,CAAkC,QAAA,KAAa,UAAA;AAC3E,EAAA,MAAM,eAAA,GAAkB,OAAQ,IAAA,CAA8B,YAAA,KAAiB,UAAA;AAC/E,EAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,IAAA,MAAM,IAAI,eAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,eAAA,EAAiB;AACpC,IAAA,MAAM,IAAI,gBAAgB,oDAAoD,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,WAAA,EAAa;AAIf,IAAA,IACE,OAAA,CAAQ,aAAa,MAAA,IACrB,OAAA,CAAQ,aAAa,MAAA,IACrB,OAAA,CAAQ,sBAAsB,IAAA,EAC9B;AACA,MAAA,MAAM,IAAI,eAAA;AAAA,QACR;AAAA,OAEF;AAAA,IACF;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,IAAA,EAAyB,MAAA,EAAQ,MAAA,EAAU;AAAA,EAC9D;AAGA,EAAA,MAAM,MAAA,GAAS,IAAA;AACf,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,IAAI,mBAAA,CAAoB,MAAA,EAAQ;AAAA,MACtC,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,mBAAmB,OAAA,CAAQ,iBAAA;AAAA,MAC3B,KAAA;AAAA,MACA,iBAAiB,OAAA,CAAQ,YAAA;AAAA,MACzB,iBAAiB,OAAA,CAAQ,kBAAA;AAAA,MACzB,mBAAmB,OAAA,CAAQ;AAAA,KAC5B,CAAA;AAAA,IACD;AAAA,GACF;AACF;AAEO,IAAM,eAAN,MAAmB;AAAA,EACP,MAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA;AAAA;AAAA;AAAA,EAIA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAEjB,YAAY,OAAA,EAA8B;AACxC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAI,WAAA,EAAY;AAC/C,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAI,SAAA,EAAU;AAEzC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC3D,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAgC;AAAA,MAChD,UAAA,EAAY,QAAQ,cAAA,IAAkB,wBAAA;AAAA,MACtC,OAAO,OAAA,CAAQ,UAAA;AAAA,MACf;AAAA,KACD,CAAA;AAGD,IAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,OAAA,EAAS,KAAK,CAAA;AACjD,IAAA,IAAI,OAAwB,QAAA,CAAS,MAAA;AAIrC,IAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,IAAA,IAAI,OAAA,CAAQ,UAAU,KAAA,EAAO;AAC3B,MAAA,MAAM,SAAA,GAA6B;AAAA,QACjC,KAAA;AAAA,QACA,GAAA;AAAA,QACA,QAAQ,OAAA,CAAQ,KAAA;AAAA;AAAA,QAEhB,OAAA,EAAS,CAAC,IAAA,KAAS;AACjB,UAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,YACd,IAAA,EAAM,OAAA;AAAA,YACN,MAAA,EAAQ,WAAA;AAAA,YACR,SAAS,IAAA,CAAK,OAAA;AAAA,YACd,SAAS,IAAA,CAAK;AAAA,WACf,CAAA;AACD,UAAA,OAAA,CAAQ,UAAU,IAAI,CAAA;AAAA,QACxB;AAAA,OACF;AACA,MAAA,IAAA,GAAO,IAAI,kBAAA,CAAmB,OAAA,CAAQ,IAAA,EAAM,SAAS,CAAA;AACrD,MAAA,IAAA,GAAO,IAAI,uBAAA,CAAwB,IAAA,EAAM,SAAS,CAAA;AAAA,IACpD;AACA,IAAA,IACE,OAAA,CAAQ,gBAAA,KAAqB,MAAA,KAC5B,CAAC,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,gBAAgB,CAAA,IAAK,OAAA,CAAQ,gBAAA,GAAmB,CAAA,CAAA,EAC3E;AACA,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,CAAA,iDAAA,EAAoD,QAAQ,gBAAgB,CAAA;AAAA,OAC9E;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,MAAA,GAAS,aAAA,CAAc,OAAA,CAAQ,MAAA,EAAQ,cAAc,CAAA;AAC1D,IAAA,MAAM,IAAA,GAAmB;AAAA,MACvB,IAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA,EAAO,YAAA;AAAA;AAAA,MACP,KAAA;AAAA,MACA,GAAA;AAAA,MACA,YAAY,OAAA,CAAQ,UAAA;AAAA,MACpB,OAAA;AAAA,MACA,qBAAqB,OAAA,CAAQ,mBAAA;AAAA,MAC7B,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,MAC1B,QAAQ,IAAA,CAAK;AAAA,KACf;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAIf,IAAA,IAAA,CAAK,aAAa,QAAA,CAAS,MAAA;AAC3B,IAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,IAAA;AAC1B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,iBAAA,GAAoB,QAAQ,iBAAA,IAAqB,KAAA;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cAAA,GAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,eAAe,MAAA,EAAW;AACjC,MAAA,MAAM,IAAI,gBAAA;AAAA,QACR;AAAA,OAGF;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAW;AAC/B,MAAA,MAAM,IAAI,gBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,UAAA;AAAA,MACX,MAAM,IAAA,CAAK,UAAA;AAAA,MACX,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,KAAA,EAAO,YAAA;AAAA;AAAA,MACP,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,mBAAmB,IAAA,CAAK,iBAAA;AAAA,MACxB,SAAS,IAAA,CAAK;AAAA;AAAA,KAChB;AAAA,EACF;AAAA;AAAA,EAGA,OAAA,CAAQ,MAAc,OAAA,EAAmC;AACvD,IAAA,MAAM,MAAkB,EAAE,OAAA,EAAS,IAAA,EAAM,SAAA,EAAW,SAAS,SAAA,EAAU;AACvE,IAAA,kBAAA,CAAmB,GAAG,CAAA;AACtB,IAAA,OAAO,IAAI,QAAQ,IAAA,CAAK,MAAA,EAAQ,KAAK,IAAA,CAAK,KAAA,EAAO,KAAK,OAAO,CAAA;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAA,CACJ,EAAA,EACA,OAAA,GAKI,EAAC,EACmB;AACxB,IAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAW;AAC/B,MAAA,MAAM,IAAI,iBAAiB,sDAAsD,CAAA;AAAA,IACnF;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,IAAA,YAAA,CAAa,SAAS,eAAe,CAAA;AACrC,IAAA,mBAAA,CAAoB,QAAQ,WAAW,CAAA;AACvC,IAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,OAAA,CAAQ,MAAA,EAAQ,KAAK,MAAM,CAAA;AAC7D,IAAA,OAAA,CAAQ,EAAE,CAAA;AACV,IAAA,MAAM,OAAyB,EAAC;AAChC,IAAA,WAAA,MAAiB,GAAA,IAAO,SAAS,IAAA,CAAK,OAAA,CAAQ,SAAS,CAAA,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AACvE,IAAA,WAAA,CAAY,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,eAAe,CAAA;AAKhD,IAAA,MAAM,aAAa,MAAM,kBAAA;AAAA,MACvB,IAAA;AAAA,MACA,QAAQ,WAAA,IAAe,yBAAA;AAAA,MACvB,OAAO,GAAA,KAA2C;AAChD,QAAA,IAAI,GAAA,CAAI,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AACvC,QAAA,MAAM,MAAkB,EAAE,OAAA,EAAS,IAAI,OAAA,EAAS,SAAA,EAAW,IAAI,SAAA,EAAU;AACzE,QAAA,OAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,IAAI,GAAA,EAAK,EAAA,EAAI,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA,GACvD,EAAE,OAAA,EAAS,GAAA,CAAI,SAAS,SAAA,EAAW,GAAA,CAAI,WAAU,GACjD,IAAA;AAAA,MACN;AAAA,KACF;AACA,IAAA,MAAM,WAAW,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAA8B,MAAM,IAAI,CAAA;AAC5E,IAAA,OAAO,EAAE,EAAA,EAAI,QAAA,EAAU,eAAA,EAAiB,KAAK,MAAA,EAAO;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqCA,MAAM,YAAA,CACJ,EAAA,EACA,OAAA,EAQ6B;AAC7B,IAAA,MAAM,UAAA,GAAa,KAAK,cAAA,EAAe;AAGvC,IAAA,yBAAA,CAA0B,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,CAAA;AAClD,IAAA,YAAA,CAAa,SAAS,cAAc,CAAA;AACpC,IAAA,mBAAA,CAAoB,QAAQ,WAAW,CAAA;AACvC,IAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,OAAA,CAAQ,MAAA,EAAQ,KAAK,MAAM,CAAA;AAC7D,IAAA,OAAA,CAAQ,EAAE,CAAA;AACV,IAAA,MAAM,OAAyB,EAAC;AAChC,IAAA,WAAA,MAAiB,GAAA,IAAO,WAAW,QAAA,CAAS,IAAA,CAAK,QAAQ,SAAS,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAClF,IAAA,WAAA,CAAY,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,cAAc,CAAA;AAK/C,IAAA,MAAM,UAAU,MAAM,kBAAA;AAAA,MACpB,IAAA;AAAA,MACA,QAAQ,WAAA,IAAe,yBAAA;AAAA,MACvB,OAAO,GAAA,KAA6C;AAClD,QAAA,IAAI,GAAA,CAAI,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AACvC,QAAA,MAAM,MAAkB,EAAE,OAAA,EAAS,IAAI,OAAA,EAAS,SAAA,EAAW,IAAI,SAAA,EAAU;AACzE,QAAA,IAAI,OAAA,GAAU,KAAA;AACd,QAAA,IAAI;AAIF,UAAA,IAAI,CAAE,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,EAAA,EAAI,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA,EAAI,OAAO,IAAA;AACpE,UAAA,MAAM,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,EAAE,CAAA;AAChC,UAAA,OAAA,GAAU,IAAA;AAGV,UAAA,MAAM,MAAA,GAAS,MAAMC,gBAAAA,CAAe,GAAA,EAAK,UAAA,EAAY;AAAA,YACnD,OAAO,OAAA,CAAQ,KAAA;AAAA,YACf,OAAO,OAAA,CAAQ;AAAA,WAChB,CAAA;AACD,UAAA,OAAO;AAAA,YACL,SAAS,GAAA,CAAI,OAAA;AAAA,YACb,WAAW,GAAA,CAAI,SAAA;AAAA,YACf,OAAA,EAAS,IAAA;AAAA,YACT,kBAAkB,MAAA,CAAO,SAAA;AAAA,YACzB,OAAO,MAAA,CAAO,KAAA;AAAA,YACd,IAAA,EAAM,MAAA,CAAO,SAAA,GAAY,KAAA,CAAA,GAAY,MAAA,CAAO;AAAA,WAC9C;AAAA,QACF,SAAS,GAAA,EAAK;AAGZ,UAAA,OAAO;AAAA,YACL,SAAS,GAAA,CAAI,OAAA;AAAA,YACb,WAAW,GAAA,CAAI,SAAA;AAAA,YACf,OAAA;AAAA,YACA,gBAAA,EAAkB,KAAA;AAAA,YAClB,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,WAClE;AAAA,QACF;AAAA,MACF;AAAA,KACF;AACA,IAAA,MAAM,aAAa,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAgC,MAAM,IAAI,CAAA;AAC7E,IAAA,OAAO,EAAE,EAAA,EAAI,UAAA,EAAY,eAAA,EAAiB,KAAK,MAAA,EAAO;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,OAAA,CAAQ,GAAA,EAAiB,OAAA,EAAuD;AACpF,IAAA,kBAAA,CAAmB,GAAG,CAAA;AACtB,IAAA,OAAOA,gBAAAA,CAAe,GAAA,EAAK,IAAA,CAAK,cAAA,IAAkB,OAAO,CAAA;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,gBAAA,CACJ,OAAA,GAAwD,EAAC,EAC7B;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,cAAA,EAAe;AACjC,IAAA,OAAO,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS,EAAG,OAAO,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,cAAA,CAAe,IAAA,EAAkB,OAAA,GAAyB,EAAC,EAA4B;AAC3F,IAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAW;AAC/B,MAAA,MAAM,IAAI,iBAAiB,uDAAuD,CAAA;AAAA,IACpF;AAEA,IAAA,OAAOC,WAAAA,CAAU,IAAA,EAAM,IAAA,CAAK,QAAA,EAAU,IAAA,EAAM;AAAA,MAC1C,GAAG,OAAA;AAAA,MACH,KAAA,EAAO,QAAQ,KAAA,IAAS;AAAA,KACzB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,aAAa,KAAA,EAAkC;AACpD,IAAA,OAAO,aAAa,KAAK,CAAA;AAAA,EAC3B;AACF;AAYO,IAAM,UAAN,MAAc;AAAA,EAGnB,WAAA,CACmB,MAAA,EACA,GAAA,EACA,KAAA,EACA,OAAA,EACjB;AAJiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAEjB,IAAA,IAAA,CAAK,YAAY,OAAA,KAAY,YAAA;AAAA,EAC/B;AAAA,EANmB,MAAA;AAAA,EACA,GAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EANF,SAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAejB,MAAc,KAAA,CAAS,IAAA,EAAoB,EAAA,EAAkC;AAC3E,IAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,EAAA,EAAG;AAC/B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI;AACjC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,EAAA,EAAG;AAAA,IAClB,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,EAAE,IAAA,EAAM,IAAA,EAAM,MAAM,EAAA,EAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,GAAA,EAAI,GAAI,SAAS,GAAG,CAAA;AAAA,IAC1F;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,EAAA,EAA2B;AAC7B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,MAAM,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EAC9D;AAAA;AAAA,EAEA,QAAQ,GAAA,EAAsC;AAC5C,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,SAAA,EAAW,MAAM,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAAA,EACvE;AAAA;AAAA,EAEA,OAAO,EAAA,EAA2B;AAChC,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,QAAA,EAAU,MAAM,IAAA,CAAK,OAAO,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACpE;AAAA;AAAA,EAEA,WAAW,GAAA,EAAsC;AAC/C,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,YAAA,EAAc,MAAM,IAAA,CAAK,OAAO,UAAA,CAAW,IAAA,CAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAAA,EAC7E;AAAA,EACA,IAAI,EAAA,EAA8B;AAChC,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,MAAM,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EAC9D;AAAA,EACA,KAAA,GAAyB;AACvB,IAAA,OAAO,IAAA,CAAK,MAAM,OAAA,EAAS,MAAM,KAAK,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,EAC9D;AAAA,EACA,OAAA,GAAiC;AAC/B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAA,CACE,QACA,OAAA,EACuB;AACvB,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,CAAC,KAAK,GAAA,EAAK,GAAG,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAC,GAAG,OAAO,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CACE,IAAA,EACA,MAAA,EACA,OAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,MAAM,eAAA;AAAA,MAAiB,MACjC,IAAA,CAAK,MAAA,CAAO,cAAc,IAAA,CAAK,GAAA,EAAK,CAAC,IAAA,CAAK,GAAA,EAAK,GAAG,MAAA,CAAO,IAAI,CAAC,CAAA,KAAM,EAAE,GAAG,CAAC,GAAG,OAAO;AAAA,KACtF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAW,OAAA,EAIO;AACtB,IAAA,MAAM,UAAA,GAAa,KAAK,MAAA,CAAO,gBAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,aAAa,MAAM,IAAA,CAAK,OAAO,WAAA,CAAY,IAAA,CAAK,GAAG,CAAA,GAAI,IAAA;AACpE,IAAA,OAAO,cAAA,CAAe;AAAA,MACpB,SAAA,EAAW,MAAM,SAAA,IAAa,CAAA;AAAA,MAC9B,QAAA,EAAU,UAAA;AAAA,MACV,UAAU,OAAA,EAAS,QAAA;AAAA,MACnB,UAAU,OAAA,EAAS,QAAA;AAAA,MACnB,SAAS,OAAA,EAAS,OAAA;AAAA,MAClB,UAAA,EAAY,UAAA,GACR,MAAA,GACA,CAAC,0EAAqE;AAAA,KAC3E,CAAA;AAAA,EACH;AACF,CAAA;AA0BO,IAAM,OAAA,GAAU,YAAA","file":"chunk-JWCQLJUG.js","sourcesContent":["/**\n * SafeBitmap — the thin wrapper around the `roaring` (CRoaring) engine that owns the\n * untrusted-bytes boundary (finding S1).\n *\n * All (de)serialization uses the **portable** format — the stable, validated one. The\n * `unsafe_frozen_*` formats are never used (they are explicitly documented as crash/attack\n * vectors). Every deserialize is preceded by a hard size cap.\n */\n// `roaring` is a CommonJS native addon. A *named* ESM import (`import { RoaringBitmap32 } from 'roaring'`)\n// crashes Node's ESM loader — its static lexer can't see the CJS module's exports — so we take the runtime\n// values off the module's default export (Node maps a CJS module's `module.exports` to `default`). This\n// keeps the shipped ESM bundle importable under Node ESM. The instance type is derived from the value so we\n// still get a `RoaringBitmap32` type without a (conflicting) second import.\nimport roaring from 'roaring';\nimport type { CodecBitmap, CodecInterface } from '@cloudbitmaps/core';\nimport { IntegrityError } from '@cloudbitmaps/core';\n\nconst { RoaringBitmap32, SerializationFormat, DeserializationFormat } = roaring;\ntype RoaringBitmap32 = InstanceType<typeof RoaringBitmap32>;\n\nexport class SafeBitmap implements CodecBitmap {\n  private readonly bitmap: RoaringBitmap32;\n\n  private constructor(bitmap: RoaringBitmap32) {\n    this.bitmap = bitmap;\n  }\n\n  static empty(): SafeBitmap {\n    return new SafeBitmap(new RoaringBitmap32());\n  }\n\n  static fromValues(values: Iterable<number>): SafeBitmap {\n    return new SafeBitmap(new RoaringBitmap32(values));\n  }\n\n  /**\n   * S1: validate size, then deserialize with the **portable** (validated) format.\n   * Throws `IntegrityError` if the input exceeds `maxBytes` or fails to decode — the\n   * native addon is never handed unbounded or unsafe-format input.\n   */\n  static safeDeserialize(bytes: Uint8Array, maxBytes: number): SafeBitmap {\n    if (bytes.length > maxBytes) {\n      throw new IntegrityError(`serialized bitmap is ${bytes.length}B, exceeds cap ${maxBytes}B`);\n    }\n    try {\n      return new SafeBitmap(RoaringBitmap32.deserialize(bytes, DeserializationFormat.portable));\n    } catch (err) {\n      throw new IntegrityError(`failed to deserialize bitmap: ${(err as Error).message}`);\n    }\n  }\n\n  serialize(): Uint8Array {\n    return this.bitmap.serialize(SerializationFormat.portable);\n  }\n\n  add(value: number): void {\n    this.bitmap.add(value);\n  }\n\n  addMany(values: Iterable<number>): void {\n    this.bitmap.addMany(values);\n  }\n\n  remove(value: number): void {\n    this.bitmap.remove(value);\n  }\n\n  removeMany(values: Iterable<number>): void {\n    this.bitmap.removeMany(values);\n  }\n\n  has(value: number): boolean {\n    return this.bitmap.has(value);\n  }\n\n  get size(): number {\n    return this.bitmap.size;\n  }\n\n  get isEmpty(): boolean {\n    return this.bitmap.isEmpty;\n  }\n\n  clone(): SafeBitmap {\n    return new SafeBitmap(this.bitmap.clone());\n  }\n\n  // The binary set ops take the `CodecBitmap` interface type (per the seam), but a single store is\n  // single-codec (homogeneity contract), so `other` is always a `SafeBitmap` here — reach its private\n  // `bitmap` (accessible on same-class instances) for the native op.\n  /** In-place union: `this = this ∪ other`. */\n  orInPlace(other: CodecBitmap): void {\n    this.bitmap.orInPlace((other as SafeBitmap).bitmap);\n  }\n\n  /** In-place difference: `this = this \\ other`. */\n  andNotInPlace(other: CodecBitmap): void {\n    this.bitmap.andNotInPlace((other as SafeBitmap).bitmap);\n  }\n\n  /** In-place intersection: `this = this ∩ other`. */\n  andInPlace(other: CodecBitmap): void {\n    this.bitmap.andInPlace((other as SafeBitmap).bitmap);\n  }\n\n  /** Ascending iterator over the set values. */\n  [Symbol.iterator](): IterableIterator<number> {\n    return this.bitmap[Symbol.iterator]();\n  }\n\n  toArray(): number[] {\n    return this.bitmap.toArray();\n  }\n}\n\n/**\n * The roaring {@link CodecInterface} — the flagship codec, delegating to {@link SafeBitmap}'s statics. This is\n * the default the `CloudRoaring` facade injects into the engine; `core/` itself never hard-references it once a\n * caller supplies a codec. Moves to `@cloudbitmaps/roaring` when the package split lands ([DECISIONS #58]).\n */\nexport const roaringCodec: CodecInterface = {\n  empty: () => SafeBitmap.empty(),\n  fromValues: (values) => SafeBitmap.fromValues(values),\n  safeDeserialize: (bytes, maxBytes) => SafeBitmap.safeDeserialize(bytes, maxBytes),\n};\n","/**\n * Codec-bound wrappers over the public `@cloudbitmaps/core` entry points that need a bitmap codec.\n *\n * `core` is codec-agnostic and therefore cannot default the codec (the concrete codec lives *here*, in a package\n * that depends on core — a default over there would invert the dependency arrow). But an application using\n * `@cloudbitmaps/roaring` should never have to pass one. So this module re-binds each such entry point with\n * {@link roaringCodec} and the facade re-exports these **explicitly**, which shadows the same names coming from\n * `export * from '@cloudbitmaps/core'` (an explicit export always wins over a star export). Net effect: every\n * call signature is unchanged from before the family split — you can still call\n * `bulkLoadCrbmGeneration(driver, key, ids)` with no options at all.\n *\n * A caller who *wants* a different codec passes it explicitly; the binding only fills an absent one — via\n * `?? roaringCodec` rather than spread order, so an explicit `codec: undefined` still gets the binding\n * (`exactOptionalPropertyTypes` is off, so that call typechecks and must not fall through to the throw).\n */\nimport {\n  bulkLoadCrbmGeneration as coreBulkLoad,\n  compactSegment as coreCompactSegment,\n  runCompactionCycle as coreRunCompactionCycle,\n  runExport as coreRunExport,\n} from '@cloudbitmaps/core';\nimport { roaringCodec } from './roaring-codec';\n\ntype BulkLoad = typeof coreBulkLoad;\ntype CompactSegment = typeof coreCompactSegment;\ntype RunCompactionCycle = typeof coreRunCompactionCycle;\ntype RunExport = typeof coreRunExport;\n\n/** {@link coreBulkLoad} with the roaring codec pre-bound. */\nexport const bulkLoadCrbmGeneration: BulkLoad = (driver, key, ids, options = {}) =>\n  coreBulkLoad(driver, key, ids, { ...options, codec: options.codec ?? roaringCodec });\n\n/** {@link coreCompactSegment} with the roaring codec pre-bound. */\nexport const compactSegment: CompactSegment = (ref, deps, options) =>\n  coreCompactSegment(ref, { ...deps, codec: deps.codec ?? roaringCodec }, options);\n\n/** {@link coreRunCompactionCycle} with the roaring codec pre-bound. */\nexport const runCompactionCycle: RunCompactionCycle = (deps, options) =>\n  coreRunCompactionCycle({ ...deps, codec: deps.codec ?? roaringCodec }, options);\n\n/** {@link coreRunExport} with the roaring codec pre-bound (only the `'roaring'` format needs it). */\nexport const runExport: RunExport = (reader, registry, sink, options = {}) =>\n  coreRunExport(reader, registry, sink, { ...options, codec: options.codec ?? roaringCodec });\n","/**\n * CloudRoaring — distributed, cloud-native Roaring Bitmaps.\n *\n * The `CloudRoaring` class is the read/write engine over the tiered seams. You wire storage **once**, as a\n * single config object: a Cold driver (`cold`), a Warm driver (`warm`), and optionally a `registry` (the\n * authoritative generation pointer — needed to read encrypted segments and to resolve generations without a\n * cold `list`-scan) and a `keystore` (encryption-at-rest / crypto-shred). Pass a **raw** {@link IColdDriver}\n * as `cold` (e.g. `S3ColdDriver`, `LocalFsColdDriver`, `MemoryColdDriver`) and the store assembles the `.crbm`\n * cold source ({@link CrbmColdChunkSource}) for you — so each driver is named exactly once. Or pass an\n * already-built {@link ColdChunkSource} to control advanced reader options yourself.\n *\n * In-process lifecycle helpers — `compact`, `eraseSubject`, `subjectReport` — reuse the store's own drivers, so\n * you never re-pass them (they need the store built with a raw cold driver + registry). Out-of-process cold\n * writers (the compaction daemon, the seed/bulk-load CLI, `destroySegment`/`eraseNamespace`) wire their own deps\n * against the same drivers — they run in separate processes.md + the\n * getting-started guide.\n */\n\nimport {\n  BoundedLru,\n  CrbmColdChunkSource,\n  DEFAULT_BUDGET,\n  NOOP_METRICS,\n  RetryingColdChunkSource,\n  RetryingWarmDriver,\n  SegmentEngine,\n  UnsupportedError,\n  ValidationError,\n  checkBudget,\n  compactSegment,\n  estimateCost,\n  groundedReport,\n  mapWithConcurrency,\n  resolveBudget,\n  resolvePerOpBudget,\n  runConsistencyCheck,\n  runExport,\n  safeMetrics,\n  splitId,\n  validateCompactionOptions,\n  validateSegmentRef,\n} from '@cloudbitmaps/core';\nimport type {\n  Budget,\n  BudgetOption,\n  Clock,\n  CodecBitmap,\n  ColdChunkSource,\n  CompactionDeps,\n  CompactionOptions,\n  CompactionResult,\n  ConsistencyReport,\n  CostReport,\n  EngineDeps,\n  EstimateInput,\n  ExportManifest,\n  ExportOptions,\n  ExportSink,\n  IAuditSink,\n  IColdDriver,\n  IKeystore,\n  IMetricsSink,\n  IRegistryDriver,\n  IWarmDriver,\n  MetricOpName,\n  PricingProfile,\n  RegistryRecord,\n  RetryPolicy,\n  RetryingOptions,\n  Rng,\n  SegmentRef,\n  Topology,\n  Workload,\n} from '@cloudbitmaps/core';\n// This package's reason to exist: the roaring codec the facade injects into the codec-agnostic engine.\nimport { roaringCodec } from './roaring-codec';\n\n/** Default real-time clock — lives outside `core/`, so `Date.now()` + `setTimeout` are allowed here. */\nclass SystemClock implements Clock {\n  now(): number {\n    return Date.now();\n  }\n\n  sleep(ms: number): Promise<void> {\n    if (ms <= 0) return Promise.resolve();\n    // A *ref'd* timer, deliberately. Every `sleep` on this clock backs a caller-awaited, bounded retry — the\n    // engine's OCC read-modify-write backoff and the driver transient-retry loop (`withRetry`). A pending\n    // backoff therefore always means unfinished awaited work, so the timer MUST keep the event loop alive until\n    // it resolves. Unref-ing it (the pre-fix behaviour) let a short-lived process — CLI, Lambda, a bare script —\n    // whose only remaining handle was the backoff timer exit 0 mid-retry, silently dropping the awaited write\n    // with neither an applied result nor a thrown error (surfaced by the T4 hot-row contention stress; see\n    // DECISIONS #16). Retries are bounded (`maxAttempts`/`maxRetries` + `maxDelayMs`), so a ref'd timer can only\n    // extend a process by the small remaining backoff budget of work that is genuinely still in flight.\n    return new Promise((resolve) => {\n      setTimeout(resolve, ms);\n    });\n  }\n}\n\n/** Default randomness for backoff jitter — lives outside `core/`, so `Math.random()` is allowed here. */\nclass SystemRng implements Rng {\n  next(): number {\n    return Math.random();\n  }\n}\n\nconst DEFAULT_CACHE_MAX_CHUNKS = 1024;\n/** Default in-flight fan-out for the admin scans (`subjectReport`/`eraseSubject`) — bounded, no thundering herd. */\nconst DEFAULT_ADMIN_CONCURRENCY = 8;\n/** Fail fast on a bad admin `concurrency` BEFORE the (potentially huge) registry scan, not after. */\nfunction validateConcurrency(concurrency: number | undefined): void {\n  if (concurrency !== undefined && (!Number.isInteger(concurrency) || concurrency < 1)) {\n    throw new ValidationError(`concurrency must be a positive integer; got ${concurrency}`);\n  }\n}\n\n/**\n * Tenancy guard for the global-scope admin scans (`subjectReport`/`eraseSubject`, Phase F). Ids live in ONE\n * global `[0, 2³²)` space shared across namespaces, so a namespace-less scan reaches into *every* tenant's\n * segments. Require an explicit `namespace`, or a deliberate `{ allNamespaces: true }` ack, so a fleet-wide\n * sweep is never the accidental default on a shared store.\n */\nfunction requireScope(options: { namespace?: string; allNamespaces?: boolean }, op: string): void {\n  if (options.namespace === undefined && options.allNamespaces !== true) {\n    throw new ValidationError(\n      `${op} scans the global id space across all namespaces — pass an explicit \\`namespace\\`, ` +\n        `or \\`{ allNamespaces: true }\\` to intentionally sweep the whole fleet`,\n    );\n  }\n}\n\n/**\n * Wiring for a {@link CloudRoaring} store. **Only `cold` and `warm` are required** — the minimal call is\n * `new CloudRoaring({ cold, warm })`. Add a `registry` to unlock eject / compaction / encryption and to skip the\n * cold list-scan (recommended for anything beyond a quick look). Everything else is **optional tuning with\n * sensible defaults** — resilience/retries are already on, the hot cache is bounded, metrics are a no-op — so\n * reach for them only when you need to.\n */\nexport interface CloudRoaringOptions {\n  /**\n   * Cold tier. Pass a **raw** {@link IColdDriver} (`S3ColdDriver`, `LocalFsColdDriver`, `MemoryColdDriver`, …)\n   * and the store wraps it in a {@link CrbmColdChunkSource} using `registry`/`keystore` below — the common case,\n   * so you wire each driver **once**. Or pass an already-built {@link ColdChunkSource} (`MemoryColdChunkSource`,\n   * or a `CrbmColdChunkSource` you configured with advanced reader options) to use as-is.\n   */\n  readonly cold: IColdDriver | ColdChunkSource;\n  /** Warm tier: the per-chunk delta store under OCC (`DynamoDbWarmDriver`, `LocalFsWarmDriver`, `MemoryWarmDriver`). */\n  readonly warm: IWarmDriver;\n  /**\n   * Authoritative registry — the per-segment `currentGen` pointer + wrapped-DEK holder. Applies when `cold` is a\n   * **raw driver**: it (a) resolves the current generation with one strong read instead of a cold `list`-scan,\n   * and (b) lets the store read **encrypted** segments (that's where wrapped DEKs live). Optional — a\n   * registry-less store reads the highest generation by list-scanning Cold (cleartext only). When you pass a\n   * pre-built `ColdChunkSource`, that source resolves its own generations, so a top-level `registry` is inert\n   * there and rejected as a wiring mistake — configure it on the source instead.\n   */\n  readonly registry?: IRegistryDriver;\n  /**\n   * Keystore for encryption-at-rest / crypto-shred (Phase 4e). Required to read encrypted segments; needs a\n   * `registry` (that's where wrapped DEKs are stored). Applied only when `cold` is a raw driver — when you pass a\n   * pre-built {@link ColdChunkSource}, configure the keystore on that source instead.\n   */\n  readonly keystore?: IKeystore;\n  /**\n   * Refuse to read a **cleartext** segment — a guard against silently reading data that should be encrypted.\n   * Needs a `registry`; applied only when `cold` is a raw driver. Off by default (encryption is opt-in).\n   */\n  readonly requireEncryption?: boolean;\n  /** Injected for deterministic tests; defaults to a system clock. */\n  readonly clock?: Clock;\n  /** Injected for deterministic tests; defaults to `Math.random`-backed. Drives backoff jitter. */\n  readonly rng?: Rng;\n  /** HOT cache ceiling (decoded Cold chunks). */\n  readonly cacheMaxChunks?: number;\n  /** Optional TTL on cached chunks (ms). */\n  readonly cacheTtlMs?: number;\n  /**\n   * How long (ms) the store trusts a segment's resolved `currentGen` before re-resolving it on the next read\n   * (default 2000) — the bound on read staleness after a compaction commits a new generation (gap #4). Applies\n   * only when `cold` is a raw driver **and** a `registry` is wired (the cheap `currentGen` read the refresh\n   * needs; a registry-less store pins per source lifetime). Lazy — no timer; ≤ one registry read per segment per\n   * window, opening a new reader only when the generation actually advanced.\n   */\n  readonly coldGenTtlMs?: number;\n  /**\n   * Ceiling on how many segments' `.crbm` readers (each holding a parsed index) the store keeps open at once\n   * (default 1024) — the steady-state memory bound for a long-running server that reads across many segments\n   * (gap #1). Past it the least-recently-used segment's reader is evicted; re-opening it later is one cheap tail\n   * GET. Applies only when `cold` is a raw driver (a pre-built `ColdChunkSource` manages its own reader cache).\n   */\n  readonly coldReaderCacheMax?: number;\n  /**\n   * Aggregate byte ceiling on the parsed `.crbm` indices the open readers hold (default 64 MiB) — the byte\n   * half of the gap #1 memory bound, complementing the `coldReaderCacheMax` *count* bound. A wide/dense\n   * segment's parsed index can be several MB, so a count-only bound could let the open readers pin ~GBs and\n   * blow a small heap (e.g. a 128 MB Lambda); this evicts the least-recently-used reader once the summed index\n   * footprint would exceed the ceiling — whichever of the count/byte bounds binds first. Lower it for\n   * memory-tight deployments that read across wide segments. Applies only when `cold` is a raw driver.\n   */\n  readonly coldReaderCacheMaxBytes?: number;\n  /**\n   * Resilience: by default every warm/cold call retries **transient** faults (throttling, 5xx, dropped\n   * connections) with bounded, jittered exponential backoff (see {@link DEFAULT_RETRY_POLICY}), and OCC\n   * conflicts back off between retries. Pass a {@link RetryPolicy} to tune it, or `false` to disable the\n   * transient-retry wrappers entirely (e.g. if your injected client already retries). Deterministic errors\n   * (`ValidationError`/`IntegrityError`/`WriteConflictError`/…) are never retried by this layer.\n   */\n  readonly retry?: RetryPolicy | false;\n  /** Backoff schedule between OCC conflict retries; defaults to a small, tight one. */\n  readonly occBackoff?: RetryPolicy;\n  /** Observability: called before each transient-retry backoff wait. */\n  readonly onRetry?: (info: { attempt: number; delayMs: number; err: unknown }) => void;\n  /**\n   * Observability sink (Phase 5a): receives typed metric events (cold GET/bytes, warm read/write, cache\n   * hit/miss, retries, intersection efficiency, op latency). Defaults to a no-op — emission is skipped\n   * entirely when unused (near-zero overhead). Any exception the sink throws is swallowed — metrics can\n   * never break a read/write.\n   */\n  readonly metrics?: IMetricsSink;\n  /**\n   * Warm read consistency for the READ paths (`has`/`count`/`iterate`/`intersect`). Default `'strong'`\n   * (read-your-writes). `'eventual'` trades read-after-write for **~½ the DynamoDB read cost** (a strong read\n   * bills 2× RCU) — a good fit for read-heavy, staleness-tolerant workloads (mirrors the cold tier's bounded\n   * eventual reads). The compaction/OCC write path is always strongly consistent regardless. No effect on the\n   * in-memory/LocalFs drivers (always strong). (Audit gap #9.)\n   */\n  readonly warmReadConsistency?: 'strong' | 'eventual';\n  /**\n   * Max Warm chunk writes in flight per `addMany`/`removeMany` (the bounded flusher). Default **1** (serial —\n   * unchanged). Raise it to fan distinct-chunk writes out for throughput on wide multi-chunk batches; each\n   * chunk is its own OCC row so this is safe, and (as before) a mid-flush failure can leave a partial result.\n   */\n  readonly writeConcurrency?: number;\n  /**\n   * Per-op **denial-of-wallet** budget (Decision #3 / invariant T3): the max backend requests a\n   * single `count`/`iterate`/`intersect`/`subjectReport`/`eraseSubject` may fan out into before it's refused\n   * with {@link BudgetExceededError} — so one runaway op can't drive unbounded RCU/GET cost on a shared backend.\n   * **On by default, generous** ({@link DEFAULT_BUDGET}: 1,000,000 requests — a normal op never hits it). Tune\n   * with `{ maxRequests }`, override per op (on `intersect`/`subjectReport`/`eraseSubject`), or set `false` to\n   * disable. The check is O(1) (before fan-out), so the hot path is untouched; per-request bytes are separately\n   * size-capped, so bounding requests transitively bounds bytes.\n   */\n  readonly budget?: BudgetOption;\n}\n\nexport interface SegmentOptions {\n  readonly namespace?: string;\n}\n\n/** A segment reference in a subject report / erasure ledger. */\nexport interface SubjectSegmentRef {\n  readonly segment: string;\n  readonly namespace?: string;\n}\n\n/** Result of {@link CloudRoaring.subjectReport} — the segments an id is a member of (over registered segments). */\nexport interface SubjectReport {\n  readonly id: number;\n  /** The registered segments the id is currently a member of. */\n  readonly segments: SubjectSegmentRef[];\n  /** How many registered segments were scanned (the completeness denominator). */\n  readonly scannedSegments: number;\n}\n\n/** One segment's entry in an erasure ledger (see {@link EraseSubjectResult}). */\nexport interface SubjectErasureEntry {\n  readonly segment: string;\n  readonly namespace?: string;\n  /** The id was present and a logical `remove` tombstone was written. */\n  readonly removed: boolean;\n  /**\n   * True iff *this call* committed a new generation with the segment's tombstones applied — the bit is\n   * physically gone from Cold (assuming no concurrent re-add of the id; see {@link CloudRoaring.eraseSubject}).\n   * `false` is **conservative**: the purge may have been deferred (`note:'leased-by-other'`) or already done by\n   * a concurrent daemon (`note:'clean'`); the logical removal holds regardless.\n   */\n  readonly physicallyPurged: boolean;\n  /** The generation that retired the bit (present when `physicallyPurged`). */\n  readonly toGen?: number;\n  /** Why physical purge wasn't committed by this call (compaction's `reason`, e.g. `'leased-by-other'`, `'clean'`). */\n  readonly note?: string;\n}\n\n/**\n * The erasure ledger returned by {@link CloudRoaring.eraseSubject} — your proof-of-deletion artifact. It is a\n * return value only (no library-side persistence): persist it / route it to your audit sink as you see fit.\n */\nexport interface EraseSubjectResult {\n  readonly id: number;\n  /** Per-segment records for the segments the id was erased from (absent segments are not listed). */\n  readonly erasedFrom: SubjectErasureEntry[];\n  /** How many registered segments were scanned. */\n  readonly scannedSegments: number;\n}\n\n/**\n * Resolve the `cold` option to a {@link ColdChunkSource} at construction (wiring-time only — no hot-path cost).\n *\n * `cold` is discriminated **structurally, without a brand**: a raw {@link IColdDriver} exposes `putImmutable`\n * (the byte-mover seam); a pre-built {@link ColdChunkSource} exposes `getChunk` (the engine's read seam). The\n * two interfaces are deliberately **disjoint** on these methods (an invariant the driver SDK maintains, pinned\n * by a test) — an object exposing *both* is ambiguous and rejected, as is one exposing *neither* (incl. a\n * nullish/non-object value from a JS caller): fail fast with a typed error rather than crash on a probe.\n *\n * A raw driver is wrapped into a {@link CrbmColdChunkSource} using the config's `registry`/`keystore`/\n * `requireEncryption`; a pre-built source is used as-is. Those three options are meaningful **only** on the\n * raw-driver path (a pre-built source carries its own registry/keystore) — pairing any of them with a source is\n * a wiring mistake, so reject it rather than silently ignore it. The `CrbmColdChunkSource` constructor enforces\n * the rest (a keystore / `requireEncryption` needs a registry; the driver needs range reads).\n *\n * Returns the resolved `source` (what the engine reads through) **and** the raw `driver` when one was passed —\n * the store keeps the raw driver so its in-process lifecycle helpers (`compact`/`eraseSubject`) can build\n * {@link CompactionDeps} without you re-passing drivers. `driver` is `undefined` for a pre-built source (there's\n * no underlying `IColdDriver` to compact through — those callers use the free functions).\n */\nfunction resolveColdSource(\n  options: CloudRoaringOptions,\n  clock: Pick<Clock, 'now'>,\n): {\n  source: ColdChunkSource;\n  driver: IColdDriver | undefined;\n} {\n  const cold: unknown = options.cold;\n  if (cold === null || typeof cold !== 'object') {\n    throw new ValidationError('`cold` must be an IColdDriver or a ColdChunkSource');\n  }\n  const hasGetChunk = typeof (cold as Partial<ColdChunkSource>).getChunk === 'function';\n  const hasPutImmutable = typeof (cold as Partial<IColdDriver>).putImmutable === 'function';\n  if (hasGetChunk && hasPutImmutable) {\n    throw new ValidationError(\n      '`cold` exposes both `getChunk` and `putImmutable` — ambiguous; pass an IColdDriver or a ColdChunkSource, not a hybrid',\n    );\n  }\n  if (!hasGetChunk && !hasPutImmutable) {\n    throw new ValidationError('`cold` must be an IColdDriver or a ColdChunkSource');\n  }\n  if (hasGetChunk) {\n    // Already a ColdChunkSource — used as-is. registry/keystore/requireEncryption only apply when the store\n    // builds the source from a raw driver; with a pre-built source they're inert, so reject them rather than\n    // mislead (configure them on the source you passed instead).\n    if (\n      options.registry !== undefined ||\n      options.keystore !== undefined ||\n      options.requireEncryption === true\n    ) {\n      throw new ValidationError(\n        'registry/keystore/requireEncryption apply only when `cold` is a raw IColdDriver; configure them on ' +\n          'the ColdChunkSource you passed instead',\n      );\n    }\n    return { source: cold as ColdChunkSource, driver: undefined };\n  }\n  // A raw IColdDriver → assemble the `.crbm` cold source with the store's registry/keystore; keep the raw\n  // driver for the store's lifecycle helpers.\n  const driver = cold as IColdDriver;\n  return {\n    source: new CrbmColdChunkSource(driver, {\n      registry: options.registry,\n      keystore: options.keystore,\n      requireEncryption: options.requireEncryption,\n      clock,\n      currentGenTtlMs: options.coldGenTtlMs,\n      maxOpenSegments: options.coldReaderCacheMax,\n      maxOpenIndexBytes: options.coldReaderCacheMaxBytes,\n    }),\n    driver,\n  };\n}\n\nexport class CloudRoaring {\n  private readonly engine: SegmentEngine;\n  private readonly clock: Clock;\n  private readonly metrics: IMetricsSink;\n  // The store's own drivers, kept so the in-process lifecycle helpers (`compact`/`eraseSubject`/`subjectReport`)\n  // reuse them instead of making you re-pass a CompactionDeps. `coldDriver` is set only when `cold` was a raw\n  // IColdDriver (a pre-built ColdChunkSource has no underlying driver to compact through).\n  private readonly coldDriver: IColdDriver | undefined;\n  private readonly warmDriver: IWarmDriver;\n  private readonly registry: IRegistryDriver | undefined;\n  private readonly keystore: IKeystore | undefined;\n  private readonly requireEncryption: boolean;\n  /** Resolved store-level per-op budget (null = disabled); the admin scans use it, with a per-op override. */\n  private readonly budget: Budget | null;\n\n  constructor(options: CloudRoaringOptions) {\n    const clock = options.clock ?? new SystemClock();\n    const rng = options.rng ?? new SystemRng();\n    // Wrap the user sink so a throwing/buggy sink can never break I/O (observability is best-effort).\n    const metrics = safeMetrics(options.metrics ?? NOOP_METRICS);\n    const cache = new BoundedLru<string, CodecBitmap>({\n      maxEntries: options.cacheMaxChunks ?? DEFAULT_CACHE_MAX_CHUNKS,\n      ttlMs: options.cacheTtlMs,\n      clock,\n    });\n    // Resolve the Cold seam to a ColdChunkSource: a raw IColdDriver is wrapped into the `.crbm` cold source\n    // here (with the store's registry/keystore) so drivers are wired once; a pre-built source is used as-is.\n    const resolved = resolveColdSource(options, clock);\n    let cold: ColdChunkSource = resolved.source;\n    // Resilience on by default: wrap the drivers so transient faults retry with jittered backoff. `false`\n    // opts out (e.g. the injected client already retries); a RetryPolicy tunes it. OCC backoff is wired\n    // separately into the engine (it owns the conflict-retry loop).\n    let warm = options.warm;\n    if (options.retry !== false) {\n      const retryOpts: RetryingOptions = {\n        clock,\n        rng,\n        policy: options.retry,\n        // Bridge transient-fault retries into the metrics stream, then call the user's own hook.\n        onRetry: (info) => {\n          metrics.onEvent({\n            kind: 'retry',\n            reason: 'transient',\n            attempt: info.attempt,\n            delayMs: info.delayMs,\n          });\n          options.onRetry?.(info);\n        },\n      };\n      warm = new RetryingWarmDriver(options.warm, retryOpts);\n      cold = new RetryingColdChunkSource(cold, retryOpts);\n    }\n    if (\n      options.writeConcurrency !== undefined &&\n      (!Number.isInteger(options.writeConcurrency) || options.writeConcurrency < 1)\n    ) {\n      throw new ValidationError(\n        `writeConcurrency must be a positive integer; got ${options.writeConcurrency}`,\n      );\n    }\n    // Resolve the denial-of-wallet budget once (validates; `false` ⇒ null = disabled) and share it between the\n    // engine (count/iterate/intersect) and the facade's admin scans (subjectReport/eraseSubject).\n    this.budget = resolveBudget(options.budget, DEFAULT_BUDGET);\n    const deps: EngineDeps = {\n      warm,\n      cold,\n      cache,\n      codec: roaringCodec, // the facade injects the flagship codec ([DECISIONS #58]); core stays codec-agnostic\n      clock,\n      rng,\n      occBackoff: options.occBackoff,\n      metrics,\n      warmReadConsistency: options.warmReadConsistency,\n      writeConcurrency: options.writeConcurrency,\n      budget: this.budget,\n    };\n    this.engine = new SegmentEngine(deps);\n    this.clock = clock;\n    this.metrics = metrics;\n    // Keep the raw drivers for the lifecycle helpers (see the fields above). Compaction/erasure use raw drivers\n    // exactly like the out-of-process daemon (`bin/compact-segments`) — a one-shot admin op surfaces a transient\n    // fault to the caller rather than retrying under the hood; the daemon re-runs the cycle.\n    this.coldDriver = resolved.driver;\n    this.warmDriver = options.warm;\n    this.registry = options.registry;\n    this.keystore = options.keystore;\n    this.requireEncryption = options.requireEncryption ?? false;\n  }\n\n  /**\n   * Build {@link CompactionDeps} from the store's own drivers, for the in-process lifecycle helpers\n   * ({@link compact} / {@link eraseSubject}). Requires the store to have been constructed with a **raw cold\n   * driver** (a pre-built `ColdChunkSource` has no underlying `IColdDriver` to compact through) and a `registry`\n   * (the authoritative `currentGen` pointer compaction swaps). Out-of-process callers use the `compactSegment`\n   * free function with explicit deps.\n   */\n  private compactionDeps(): CompactionDeps {\n    if (this.coldDriver === undefined) {\n      throw new UnsupportedError(\n        'compact/eraseSubject/checkConsistency need the store built with a raw cold driver (IColdDriver), not ' +\n          'a pre-built ColdChunkSource — or call the compactSegment/runConsistencyCheck free functions with ' +\n          'explicit deps',\n      );\n    }\n    if (this.registry === undefined) {\n      throw new UnsupportedError(\n        'compact/eraseSubject/checkConsistency need a `registry` in the store config',\n      );\n    }\n    return {\n      cold: this.coldDriver,\n      warm: this.warmDriver,\n      registry: this.registry,\n      clock: this.clock,\n      codec: roaringCodec, // facade injects the flagship codec ([DECISIONS #58])\n      keystore: this.keystore,\n      requireEncryption: this.requireEncryption,\n      metrics: this.metrics, // safe-wrapped sink → store.compact/eraseSubject emit `compaction` events (gap #2)\n    };\n  }\n\n  /** Get a handle to a segment. Validates the name/namespace grammar (finding S2). */\n  segment(name: string, options?: SegmentOptions): Segment {\n    const ref: SegmentRef = { segment: name, namespace: options?.namespace };\n    validateSegmentRef(ref);\n    return new Segment(this.engine, ref, this.clock, this.metrics);\n  }\n\n  /**\n   * **Subject access (GDPR Art. 15 / CCPA right-to-know): which segments is this id a member of?** (Phase 6b.)\n   *\n   * Enumerates the **registered** segments (via the store's own `registry`) and does a tier-merging `has(id)` on\n   * each — no drivers to re-pass. Complete only over registered segments (register your segments if you claim\n   * SAR support). There is deliberately **no `id → segments` reverse index** — that would tax every write for a\n   * rare request; this admin scan is `O(registered segments)` and touches no hot path\n   * (phases/06). Requires a `registry` in the store config\n   * (throws {@link UnsupportedError} otherwise).\n   */\n  async subjectReport(\n    id: number,\n    options: {\n      namespace?: string;\n      allNamespaces?: boolean;\n      concurrency?: number;\n      budget?: BudgetOption;\n    } = {},\n  ): Promise<SubjectReport> {\n    if (this.registry === undefined) {\n      throw new UnsupportedError('subjectReport needs a `registry` in the store config');\n    }\n    const registry = this.registry;\n    requireScope(options, 'subjectReport'); // tenancy: explicit namespace, or an { allNamespaces: true } ack\n    validateConcurrency(options.concurrency); // fail fast before the (possibly huge) registry scan\n    const budget = resolvePerOpBudget(options.budget, this.budget); // partial override inherits the store's tightening\n    splitId(id); // fail fast on a non-u32 id even when no segments are registered\n    const recs: RegistryRecord[] = [];\n    for await (const rec of registry.list(options.namespace)) recs.push(rec);\n    checkBudget(budget, recs.length, 'subjectReport'); // refuse a runaway scan before fanning out has()\n    // Bounded fan-out of the tier-merging has() across registered segments (was serial — one read per segment\n    // awaited in-loop). Order-preserving ⇒ deterministic result. Membership is read **strongly** regardless of\n    // the store's `warmReadConsistency` — a legal SAR must be read-your-writes, never miss a just-written add.\n    // A has() fault propagates (a report that can't read a segment must fail loud, not silently under-report).\n    const membership = await mapWithConcurrency(\n      recs,\n      options.concurrency ?? DEFAULT_ADMIN_CONCURRENCY,\n      async (rec): Promise<SubjectSegmentRef | null> => {\n        if (rec.status === 'destroyed') return null; // already unreadable — never a member\n        const ref: SegmentRef = { segment: rec.segment, namespace: rec.namespace };\n        return (await this.engine.has(ref, id, { consistent: true }))\n          ? { segment: rec.segment, namespace: rec.namespace }\n          : null;\n      },\n    );\n    const segments = membership.filter((m): m is SubjectSegmentRef => m !== null);\n    return { id, segments, scannedSegments: recs.length };\n  }\n\n  /**\n   * **Subject erasure (GDPR Art. 17): remove an id from every segment it's in, with a physical-deletion\n   * guarantee.** (Phase 6b.)\n   *\n   * For each **registered** segment the id is a member of: writes a logical `remove` tombstone (immediate) and\n   * then **force-compacts that segment now** — folding the tombstone into a fresh immutable generation so the\n   * bit is *physically* gone from Cold on return, even for an otherwise-idle/archival segment that organic\n   * compaction would never touch (the P13 fix). The returned per-segment record is your **erasure ledger** —\n   * persist it / route it to your audit sink as the proof of deletion; the physical-purge proof is\n   * compaction's own VERIFY step (a re-`has()` here would be unsound — a pinned cold source can still read the\n   * old generation; take a fresh generation view after erasing, exactly as with the compaction daemon).\n   *\n   * Uses the store's **own** drivers (raw cold + warm + registry), so the old integrator obligation to wire a\n   * matching `CompactionDeps` is gone — the `remove()` and the force-compaction provably run over the same tiers.\n   * Requires the store built with a **raw cold driver + registry** (throws {@link UnsupportedError} otherwise;\n   * a pre-built `ColdChunkSource` store has no `IColdDriver` to compact through — use the `compactSegment` free\n   * function there). **One contract remains** (an integrator obligation the library cannot check): **do not\n   * concurrently re-add the same id while erasing it.** A normal `add(id)` landing between the `remove` and the\n   * compaction clears the tombstone and folds the id back into the new generation\n   * (`effective = (cold ∪ adds) \\ removes`); `physicallyPurged` attests only that compaction committed a\n   * generation with the tombstones applied at pin time — quiesce writes for the subject during erasure.\n   *\n   * **A `physicallyPurged:false` entry means the logical removal holds but the physical purge didn't run this\n   * call** — either a daemon held a live lease (`note:'leased-by-other'`; the daemon finishes it), or the\n   * force-compaction hit an isolated fault (`note:'error: …'`; per-segment faults are caught so one segment\n   * can't discard the whole ledger). `physicallyPurged:false` is **conservative** (a concurrent daemon may\n   * already have purged the bit — `'clean'`). **Recovery:** follow up any `physicallyPurged:false` entry with\n   * `store.compact(ref)` (or let the daemon do it) — **re-running `eraseSubject` will NOT re-purge it**, because\n   * `has()` now reads false (the tombstone) so the segment is skipped as a non-member. The physical-purge proof\n   * is compaction's own VERIFY step (a re-`has()` here would be unsound: a pinned cold source can still read the\n   * old generation — take a fresh generation view after erasing, as with the daemon). Admin-only path;\n   * `O(registered segments)`, no hot-path cost. Per-subject crypto-shred is infeasible (a subject's bit is\n   * co-mingled in a shared container), so this is the single-subject erasure route; whole-segment/tenant erasure\n   * is the `destroySegment`/`eraseNamespace` free functions.\n   */\n  async eraseSubject(\n    id: number,\n    options: {\n      owner: string;\n      namespace?: string;\n      allNamespaces?: boolean;\n      audit?: IAuditSink;\n      concurrency?: number;\n      budget?: BudgetOption;\n    },\n  ): Promise<EraseSubjectResult> {\n    const compaction = this.compactionDeps();\n    // Validate the owner BEFORE the fan-out — a bad owner must fail fast, not after a `remove` tombstone is\n    // already written for the first segment (which would strand it: `has()` then reads false, so a retry skips it).\n    validateCompactionOptions({ owner: options.owner });\n    requireScope(options, 'eraseSubject'); // tenancy: explicit namespace, or an { allNamespaces: true } ack\n    validateConcurrency(options.concurrency); // fail fast before the (possibly huge) registry scan\n    const budget = resolvePerOpBudget(options.budget, this.budget); // partial override inherits the store's tightening\n    splitId(id); // fail fast on a non-u32 id even when nothing is registered\n    const recs: RegistryRecord[] = [];\n    for await (const rec of compaction.registry.list(options.namespace)) recs.push(rec);\n    checkBudget(budget, recs.length, 'eraseSubject'); // refuse a runaway scan before fanning out compactions\n    // Bounded fan-out (was serial). Each segment is an independent lease + generation, so force-compacting\n    // distinct segments concurrently is exactly what the sharded daemon does. Per-segment faults stay isolated\n    // INSIDE each task — one failure never aborts the ledger (mirrors runCompactionCycle) — and the pool\n    // preserves input order, so the ledger stays deterministic.\n    const entries = await mapWithConcurrency(\n      recs,\n      options.concurrency ?? DEFAULT_ADMIN_CONCURRENCY,\n      async (rec): Promise<SubjectErasureEntry | null> => {\n        if (rec.status === 'destroyed') return null; // already crypto-shredded — nothing to erase\n        const ref: SegmentRef = { segment: rec.segment, namespace: rec.namespace };\n        let removed = false;\n        try {\n          // Membership check INSIDE the isolation: a has() fault (corrupt segment) must become a recorded\n          // ledger entry, not abort the whole erasure. Read **strong** regardless of `warmReadConsistency` —\n          // an Art.17 erasure must never skip a segment because an eventual read hasn't caught up yet.\n          if (!(await this.engine.has(ref, id, { consistent: true }))) return null; // not a member — no tombstone\n          await this.engine.remove(ref, id); // logical erasure, immediate\n          removed = true;\n          // Physical erasure now: fold the tombstone into a fresh generation (fires regardless of the organic\n          // compaction trigger, so an idle/archival segment is still purged this call).\n          const result = await compactSegment(ref, compaction, {\n            owner: options.owner,\n            audit: options.audit,\n          });\n          return {\n            segment: rec.segment,\n            namespace: rec.namespace,\n            removed: true,\n            physicallyPurged: result.compacted,\n            toGen: result.toGen,\n            note: result.compacted ? undefined : result.reason,\n          };\n        } catch (err) {\n          // A thrown fault after the tombstone can't be recovered by re-running eraseSubject (has() now reads\n          // false → skipped). Record it as removed-but-not-purged; the caller recovers with `store.compact(ref)`.\n          return {\n            segment: rec.segment,\n            namespace: rec.namespace,\n            removed,\n            physicallyPurged: false,\n            note: `error: ${err instanceof Error ? err.message : String(err)}`,\n          };\n        }\n      },\n    );\n    const erasedFrom = entries.filter((e): e is SubjectErasureEntry => e !== null);\n    return { id, erasedFrom, scannedSegments: recs.length };\n  }\n\n  /**\n   * **Compact one segment now**, in-process, using the store's own drivers — a convenience over the\n   * {@link compactSegment} free function. Merges `(cold ∪ adds) \\ removes` into a fresh immutable generation,\n   * swaps `currentGen`, then version-fenced-purges the archived Warm rows. A no-op (`compacted:false`) when the\n   * segment has no dirty rows or a daemon holds a live lease — never throws on the normal contention/lease paths.\n   * Requires the store built with a **raw cold driver + registry** (throws {@link UnsupportedError} otherwise);\n   * like the daemon, it uses the raw drivers directly (a transient fault surfaces to you rather than retrying\n   * under the hood). **Not for the request/hot path** — it reads and rewrites a whole Cold generation (streaming,\n   * constant-memory, but full-segment I/O). Use the `compact-segments` daemon (`runCompactionCycle`) for routine\n   * background compaction; reach for `store.compact()` for occasional/manual one-shots — a maintenance endpoint,\n   * a small daemon-less deployment, or right after a targeted `remove`.\n   */\n  async compact(ref: SegmentRef, options: CompactionOptions): Promise<CompactionResult> {\n    validateSegmentRef(ref);\n    return compactSegment(ref, this.compactionDeps(), options);\n  }\n\n  /**\n   * **Cross-tier DR consistency check (audit gap #11).** After a restore/failover, verify every registered\n   * segment's `currentGen` actually has its `.crbm` present in Cold — catching a **torn restore** where the\n   * registry (`currentGen`) came back ahead of the object store, so a pointer references a generation that\n   * isn't there (reads would then throw). Read-only, bounded fan-out; run it at startup after a restore.\n   * Returns `{ checked, inconsistent }` — `inconsistent` empty ⇒ coherent; otherwise it names the segments to\n   * recover (restore the object store, or roll the registry back to a coherent point). Needs the store built\n   * with a **raw cold driver + a registry** (throws {@link UnsupportedError} otherwise). `destroyed`\n   * (crypto-shredded) segments are skipped. Pair it with the DR runbook (docs/guide/disaster-recovery.md).\n   */\n  async checkConsistency(\n    options: { namespace?: string; concurrency?: number } = {},\n  ): Promise<ConsistencyReport> {\n    const deps = this.compactionDeps(); // guards raw cold + registry; reuses the store's own drivers\n    return runConsistencyCheck({ cold: deps.cold, registry: deps.registry }, options);\n  }\n\n  /**\n   * **Export (\"eject\") every registered segment's current effective set** through the injected `sink`, using\n   * only public read APIs — so your data is readable **without CloudRoaring** (the exit path; see the README's\n   * \"Your data stays yours\"). `format: 'roaring'` (default) writes one **portable RoaringBitmap32** per segment\n   * (loadable by any roaring library); `'ndjson'` writes newline-delimited ids (zero-dependency, streaming).\n   * Enumerates via the store's **own** registry (needs one — throws {@link UnsupportedError} otherwise) so the\n   * enumeration and the read path provably share one registry; an all-warm segment not yet in the registry can be\n   * named via `options.candidates`. Encrypted segments are decrypted transparently **iff** this store was wired\n   * with their keystore — the export is therefore **cleartext**; protect it. Crypto-shredded segments are skipped.\n   * A segment that can't be read is isolated into the manifest's `failed[]` (the run continues), so \"a manifest\n   * exists\" means the run finished — check `failed`. The `export-segments` CLI wraps this with a filesystem sink.\n   */\n  async exportSegments(sink: ExportSink, options: ExportOptions = {}): Promise<ExportManifest> {\n    if (this.registry === undefined) {\n      throw new UnsupportedError('exportSegments needs a `registry` in the store config');\n    }\n    // Pass the codec: core's `runExport` is codec-agnostic and needs one for the `'roaring'` format.\n    return runExport(this, this.registry, sink, {\n      ...options,\n      codec: options.codec ?? roaringCodec,\n    });\n  }\n\n  /**\n   * Planning cost estimate (Phase 5b) — pure, no instance/data needed: sizing, sales, what-if. For a real,\n   * grounded report from live segment sizes, use `store.segment(name).costReport()`. See {@link CostReport}.\n   */\n  static estimateCost(input: EstimateInput): CostReport {\n    return estimateCost(input);\n  }\n}\n\n/**\n * A handle bound to one segment — the seven ops.\n *\n * **IDs must be integers in `[0, 2^32)`** (dense 32-bit). A non-integer / negative / out-of-range id\n * throws {@link ValidationError}.\n *\n * **`addMany`/`removeMany`/`intersectInto` are not atomic across chunks**: ids are grouped by chunk and\n * applied one chunk at a time, so if a later chunk fails (e.g. {@link WriteConflictError} after retries)\n * earlier chunks are already applied. Within a single chunk the update is atomic.\n */\nexport class Segment {\n  private readonly metricsOn: boolean;\n\n  constructor(\n    private readonly engine: SegmentEngine,\n    private readonly ref: SegmentRef,\n    private readonly clock: Clock,\n    private readonly metrics: IMetricsSink,\n  ) {\n    this.metricsOn = metrics !== NOOP_METRICS;\n  }\n\n  /**\n   * Time an op with the injected clock and emit an `op` metric on completion (success or throw). Skipped\n   * entirely when no sink is wired, so the default path pays nothing.\n   */\n  private async timed<T>(name: MetricOpName, fn: () => Promise<T>): Promise<T> {\n    if (!this.metricsOn) return fn();\n    const startedAt = this.clock.now();\n    try {\n      return await fn();\n    } finally {\n      this.metrics.onEvent({ kind: 'op', name, ms: Math.max(0, this.clock.now() - startedAt) });\n    }\n  }\n\n  /** Add an id (integer in `[0, 2^32)`). Throws {@link ValidationError} on a bad id. */\n  add(id: number): Promise<void> {\n    return this.timed('add', () => this.engine.add(this.ref, id));\n  }\n  /** Add many ids. Not atomic across chunks — see the class note. */\n  addMany(ids: Iterable<number>): Promise<void> {\n    return this.timed('addMany', () => this.engine.addMany(this.ref, ids));\n  }\n  /** Remove an id (integer in `[0, 2^32)`). Throws {@link ValidationError} on a bad id. */\n  remove(id: number): Promise<void> {\n    return this.timed('remove', () => this.engine.remove(this.ref, id));\n  }\n  /** Remove many ids. Not atomic across chunks — see the class note. */\n  removeMany(ids: Iterable<number>): Promise<void> {\n    return this.timed('removeMany', () => this.engine.removeMany(this.ref, ids));\n  }\n  has(id: number): Promise<boolean> {\n    return this.timed('has', () => this.engine.has(this.ref, id));\n  }\n  count(): Promise<number> {\n    return this.timed('count', () => this.engine.count(this.ref));\n  }\n  iterate(): AsyncIterable<number> {\n    return this.engine.iterate(this.ref);\n  }\n\n  /**\n   * Chunk-skipping intersection: stream the ids in **this** segment AND every segment in `others`, ascending.\n   * Fetches only the Cold chunks present in *all* operands (a key absent from any operand contributes nothing\n   * and is never downloaded), streaming under a bounded in-flight window — so the Cold footprint stays small\n   * (Lambda-friendly) regardless of segment size. Pass `concurrency` to tune that window (a positive integer).\n   * AND is commutative, so `a.intersect([b])` and `b.intersect([a])` yield the same ids. (Warm state is read\n   * up front, so total memory also carries each operand's Warm size — negligible under Topology-A.) Pass\n   * `budget` to override the store's per-op denial-of-wallet budget for this call (or `false` to lift it).\n   */\n  intersect(\n    others: Segment[],\n    options?: { concurrency?: number; budget?: BudgetOption },\n  ): AsyncIterable<number> {\n    return this.engine.intersect([this.ref, ...others.map((o) => o.ref)], options);\n  }\n\n  /**\n   * Materialize `this ∩ others…` **into** `dest` (added, not replaced). Streaming + bounded-memory, but\n   * **not atomic** across chunks — see {@link addMany}.\n   */\n  intersectInto(\n    dest: Segment,\n    others: Segment[],\n    options?: { concurrency?: number; batchSize?: number },\n  ): Promise<void> {\n    return this.timed('intersectInto', () =>\n      this.engine.intersectInto(dest.ref, [this.ref, ...others.map((o) => o.ref)], options),\n    );\n  }\n\n  /**\n   * Grounded cost report for this segment (Phase 5b): storage cost from its **real** `.crbm` size (exact,\n   * no payload reads); request cost from the supplied `workload` rates. A segment with no Cold generation\n   * reports zero storage. See {@link CostReport} — it always includes a verdict (incl. the lose-zone).\n   */\n  async costReport(options?: {\n    pricing?: PricingProfile;\n    workload?: Workload;\n    topology?: Topology;\n  }): Promise<CostReport> {\n    const canMeasure = this.engine.supportsColdSize;\n    const size = canMeasure ? await this.engine.segmentSize(this.ref) : null;\n    return groundedReport({\n      coldBytes: size?.sizeBytes ?? 0,\n      grounded: canMeasure,\n      workload: options?.workload,\n      topology: options?.topology,\n      pricing: options?.pricing,\n      extraNotes: canMeasure\n        ? undefined\n        : ['cold source has no sizeOf() — storage not measured, reported as $0.'],\n    });\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------\n// Re-export the whole codec-agnostic core so `@cloudbitmaps/roaring` stays the one name to know: every driver,\n// error, port, and helper an application needs is reachable from here exactly as it was before the family\n// split. (`@cloudbitmaps/core` arrives transitively — users never install it directly.)\n// ---------------------------------------------------------------------------------------------------\nexport * from '@cloudbitmaps/core';\n\n// ...with the codec-bound overrides layered on top. These four core entry points need a bitmap codec, which\n// core cannot default (it is codec-agnostic). Re-exporting them EXPLICITLY here shadows the same names from the\n// `export *` above, so every signature stays exactly as it was before the family split — e.g.\n// `bulkLoadCrbmGeneration(driver, key, ids)` still works with no options at all.\nexport {\n  bulkLoadCrbmGeneration,\n  compactSegment,\n  runCompactionCycle,\n  runExport,\n} from './codec-bound';\n\n// The roaring codec itself. `SafeBitmap` is public surface (`writeCrbmGeneration` takes them — the seed /\n// bulk-load path); `roaringCodec` is the `CodecInterface` this facade injects, exported so an advanced caller\n// can construct a `SegmentEngine` by hand.\nexport { SafeBitmap, roaringCodec } from './roaring-codec';\n\n/** Package version marker. Kept in sync with package.json at release. */\nexport const VERSION = '0.1.0-rc.0';\n"]}

package/dist/dynamodb/index.cjs

@@ -0,0 +1,14 @@
+'use strict';
+
+var dynamodb = require('@cloudbitmaps/core/dynamodb');
+
+
+
+Object.keys(dynamodb).forEach(function (k) {
+	if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
+		enumerable: true,
+		get: function () { return dynamodb[k]; }
+	});
+});
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/dynamodb/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.cjs","sourcesContent":[]}

package/dist/dynamodb/index.d.cts

@@ -0,0 +1 @@
+export * from '@cloudbitmaps/core/dynamodb';

package/dist/dynamodb/index.d.ts

@@ -0,0 +1 @@
+export * from '@cloudbitmaps/core/dynamodb';

package/dist/dynamodb/index.js

@@ -0,0 +1,3 @@
+export * from '@cloudbitmaps/core/dynamodb';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/dynamodb/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js","sourcesContent":[]}

package/dist/gcs/index.cjs

@@ -0,0 +1,14 @@
+'use strict';
+
+var gcs = require('@cloudbitmaps/core/gcs');
+
+
+
+Object.keys(gcs).forEach(function (k) {
+	if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
+		enumerable: true,
+		get: function () { return gcs[k]; }
+	});
+});
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/gcs/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.cjs","sourcesContent":[]}

package/dist/gcs/index.d.cts

@@ -0,0 +1 @@
+export * from '@cloudbitmaps/core/gcs';

package/dist/gcs/index.d.ts

@@ -0,0 +1 @@
+export * from '@cloudbitmaps/core/gcs';

package/dist/gcs/index.js

@@ -0,0 +1,3 @@
+export * from '@cloudbitmaps/core/gcs';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/gcs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js","sourcesContent":[]}