@cloudbitmaps/roaring 0.16.0 → 0.18.0

package/dist/index.d.ts

@@ -23,8 +23,10 @@
  * `checkConsistency`, `exportSegments` — reuse the store's own drivers, so you never re-pass them (they need the
  * store built with a backend). See the README and the getting-started guide.
  */
-import type { BudgetOption, GenerationEntry, GenerationMetadata, LoadGuard, LoadInput, LoadOptions, LoadRefusal, LoadResult, RollbackResult, Clock, StorageChunkSource, ConsistencyReport, CostReport, DropResult, EstimateInput, ExportManifest, ExportOptions, ExportSink, IAuditSink, IStorageDriver, IKeystore, IMetricsSink, StorageBackend, PricingProfile, RetentionPolicy, RetireExpiredOptions, RetireExpiredResult, RetryPolicy, Rng, SetRetentionResult, PinnedAt, IdRange, SegmentRef, Workload } from '@cloudbitmaps/core';
+import type { BudgetOption, GenerationEntry, GenerationMetadata, LoadGuard, LoadInput, LoadOptions, LoadRefusal, LoadResult, ReapRegistryTombstonesOptions, ReapRegistryTombstonesResult, RollbackResult, Clock, StorageChunkSource, ConsistencyReport, CostReport, DropResult, EstimateInput, ExportManifest, ExportOptions, ExportSink, IAuditSink, IStorageDriver, IKeystore, IMetricsSink, StorageBackend, PricingProfile, RetentionPolicy, RetireExpiredOptions, RetireExpiredResult, RetryPolicy, Rng, SetRetentionResult, PinnedAt, IdRange, SegmentRef, Workload } from '@cloudbitmaps/core';
 import type { SegmentInfo } from '@cloudbitmaps/core';
+import type { CombineExpr, CombineManyFeedRecord, CombineManyOperandStats, CombineManyOutputStats, CombineManyStats } from '@cloudbitmaps/core';
+import { deserializePortable } from './roaring-codec.js';
 /**
  * Wiring for a {@link CloudRoaring} store. **Only `storage` is required** — the minimal call is
  * `new CloudRoaring({ storage: backend })`. A backend resolves generations with one strong read, reads
@@ -297,6 +299,142 @@ export interface EraseSubjectResult {
  * in prose means the compiler enforces it, and a caller's exhaustive `switch` has no dead branch.
  */
 export type MaterializeRefusal = Exclude<LoadRefusal, 'superseded'>;
+/**
+ * An expression over the operands of a {@link CloudRoaring.materializeMany} call: a string names an operand; a node holds
+ * exactly one of `and`, `or` or `andNot` over a non-empty list of expressions. `andNot` subtracts every entry after the
+ * first from the first, so it takes at least two. Plain JSON, so it can be logged and sent between tasks.
+ */
+export type Expr = CombineExpr;
+/** What the call did to one operand: see {@link MaterializeManyStats.operands}. */
+export type MaterializeManyOperandStats = CombineManyOperandStats;
+/** What the call did to one output: see {@link MaterializeManyStats.outputs}. */
+export type MaterializeManyOutputStats = CombineManyOutputStats;
+/**
+ * What a {@link CloudRoaring.materializeMany} call did: the groups it ran, its requests by class, the chunk-read budget it
+ * used, the most it held resident, and, for each operand, the generation it was pinned at, began at and ended at.
+ */
+export type MaterializeManyStats = CombineManyStats;
+/** One output of a {@link CloudRoaring.materializeMany} call. */
+export interface MaterializeManyOutput {
+    /** The segment this output becomes a new generation of. Not an operand of the call, and named by no other output. */
+    readonly dest: Segment;
+    /** What to compute. */
+    readonly expr: Expr;
+    /** Subtracted from the result, as the entries of an `andNot` after the first are. Pinned operands it names are re-checked before the publish. */
+    readonly exclude?: Expr[];
+    /** As on {@link MaterializeOptions}. */
+    readonly guard?: LoadGuard;
+    /** As on {@link MaterializeOptions}. */
+    readonly allowEmpty?: boolean;
+    /** As on {@link MaterializeOptions}. */
+    readonly metadata?: GenerationMetadata;
+    /** As on {@link MaterializeOptions}. */
+    readonly audit?: IAuditSink;
+    /** Generations to keep below the new one, as on {@link MaterializeOptions}; overrides the call's `keep`. */
+    readonly keep?: number;
+}
+/**
+ * One record of the feed of {@link CloudRoaring.materializeMany}: the ids some of the fed operands hold at one chunk key.
+ * `key` is `id >>> 16`, an integer from 0 to 65,535, never below the previous record's; a key may arrive as several
+ * consecutive records, each carrying some of the operands, and one record per key is the usual shape. `operands` maps a
+ * declared fed name to its ids at the key: a real `Uint32Array` (not an `Int32Array`, `Buffer`, array or look-alike),
+ * strictly ascending, every id inside the key. A name is given at most once per key, and an empty array is the same as
+ * leaving the name out. The record is copied as it arrives, so the caller may drop or reuse its arrays once it has yielded it.
+ */
+export type MaterializeManyFeedRecord = CombineManyFeedRecord;
+/**
+ * Operands that arrive as records in chunk-key order instead of being stored, for {@link MaterializeManyOptions.feed}.
+ * Outputs name a fed operand as they name a stored one.
+ */
+export interface MaterializeManyFeed {
+    /** The fed operand names, declared up front. A name is either stored or fed, never both. */
+    readonly names: string[];
+    /** The records, read once, in key order. */
+    readonly records: AsyncIterable<MaterializeManyFeedRecord>;
+    /**
+     * How many ids each fed operand holds over the whole feed, **required**: an object keyed by exactly `names`, or a
+     * function returning one (or a promise of one), called once after the last record and before any fed output is
+     * published. A feed whose count of ids for any operand differs (one that ended early, or skipped a key) refuses every
+     * fed output; so does a count that is missing, extra, thrown or rejected.
+     */
+    readonly counts: (() => Record<string, number> | Promise<Record<string, number>>) | Record<string, number>;
+}
+/** The options of {@link CloudRoaring.materializeMany}. */
+export interface MaterializeManyOptions extends IdRange {
+    /**
+     * The operands the expressions name: stored segments, and operands held in memory from {@link CloudRoaring.memory}. A held
+     * operand is accepted here and nowhere else.
+     */
+    readonly operands: Record<string, Segment | MemoryOperand>;
+    /** The outputs, in the order their results come back. */
+    readonly outputs: ReadonlyArray<MaterializeManyOutput>;
+    /**
+     * Generations to keep below each new one: a non-negative integer, **required**, since a materialisation otherwise keeps
+     * every generation and a call of a thousand outputs would leave a thousand uncollected destinations on every refresh.
+     * An output's own `keep` overrides it.
+     */
+    readonly keep: number;
+    /**
+     * Read every stored operand at the generation it has when the call starts, for the whole call (default `true`): the call
+     * pins each one that is not already pinned. It is one generation per operand, **not one instant across operands**.
+     * `false` reads each live, as a combine does, which can describe two generations of one operand and break its pruning, and runs
+     * **no re-check** of an operand an output subtracts: an opt-out list can move during the call and the outputs that subtract it are
+     * published (`stats.operands` still reports, from one read at the end, that it moved).
+     * An operand passed already pinned is used as it is whatever this says.
+     */
+    readonly pin?: boolean;
+    /**
+     * The most resident bytes the call counts at once, default 256 MiB: the buffered outputs, the operand streams, the
+     * chunks being evaluated and the plan, counted as resident memory. Past it, outputs run in groups and the operands are read
+     * again for each group. Process memory is more than the count (measured 1.6 to 5 times; see the guide).
+     */
+    readonly maxBufferedBytes?: number;
+    /**
+     * The most chunk reads the call may make, counted over all its groups. Default: the store's own `budget` when it was built
+     * with one (a ceiling below the plan throws `BudgetExceededError` before any chunk is read), else what the plan needs,
+     * with headroom. `false` lifts it. The budget used is in the result's stats.
+     */
+    readonly budget?: BudgetOption;
+    /** Outputs published at once, default 8. */
+    readonly publishConcurrency?: number;
+    /** Range requests held ahead per operand, default 1. */
+    readonly concurrency?: number;
+    /** As on every combine. */
+    readonly allowAbsentOperands?: boolean;
+    /**
+     * Operands fed as records in chunk-key order, beside the stored ones; an output names a fed operand as it names a stored
+     * one. **A feed is read once, so a call with one runs its outputs as one group, and `maxBufferedBytes` is then required**:
+     * the feed's records and the fed outputs are counted against it as they arrive, and a fed call fails as soon as the count
+     * passes it. A fed output is published only after the whole feed was read and every end-of-feed check passed.
+     */
+    readonly feed?: MaterializeManyFeed;
+    /**
+     * Fed and held operand names allowed to hold no id. A declared fed name that appears in no record is refused at the end
+     * of the feed, and a held operand that holds no id is refused before any request, because an operand that is empty is
+     * usually an upstream query that failed quietly. Naming something that is neither a fed nor a held operand is a
+     * {@link ValidationError}.
+     */
+    readonly mayBeEmpty?: readonly string[];
+}
+/**
+ * What one output of {@link CloudRoaring.materializeMany} came to: exactly what its `*Into` would have returned (a
+ * {@link MaterializeResult}, published or refused with its `reason`), or `{ published: false, error }` for what it would
+ * have thrown, or for what stopped it: a lost race ({@link WriteConflictError}), a publish whose outcome is unknown
+ * ({@link TransientError}), a damaged operand ({@link IntegrityError}), a lapsed lease ({@link LeaseExpiredError}), a
+ * pinned exclude that moved ({@link StaleOperandError}), memory ({@link BudgetExceededError}), or, for an output that names a
+ * fed operand, a bad feed ({@link ValidationError}) or an erasure in this store while the call ran ({@link StaleOperandError}
+ * with `reason: 'erased'`).
+ */
+export type MaterializeManyOutcome = MaterializeResult | {
+    readonly published: false;
+    readonly error: Error;
+};
+/** The result of {@link CloudRoaring.materializeMany}. */
+export interface MaterializeManyRun {
+    /** One per output, in the order given: one output's refusal or error never stops another. */
+    readonly outputs: MaterializeManyOutcome[];
+    readonly stats: MaterializeManyStats;
+}
 /** What an `*Into` verb wrote: the new generation of the destination, and whether it became current. */
 export interface MaterializeResult {
     /**
@@ -350,6 +488,13 @@ export declare class CloudRoaring {
     private readonly requireEncryption;
     /** Resolved store-level per-op budget (null = disabled); the admin scans use it, with a per-op override. */
     private readonly budget;
+    /**
+     * Moved at the start and at the end of each `eraseSubject` this store runs. A `materializeMany` call with a feed records
+     * it when it begins and is refused once it has moved: it reads caller memory, which no erasure can reach.
+     */
+    private erasureEpoch;
+    /** How many `eraseSubject` calls of this store are running: while any is, every check of the counter counts as moved. */
+    private erasuresRunning;
     /**
      * Refuse any option key the store does not take, at the top level or inside a group, naming each one.
      *
@@ -408,6 +553,147 @@ export declare class CloudRoaring {
      * **And by default it collects nothing**, unlike `load()`. See the `keep` default below.
      */
     private materialize;
+    /**
+     * **Hold a set of ids in memory**, to be an operand of {@link CloudRoaring.materializeMany} and of no other verb.
+     *
+     * ```ts
+     * const vip = await store.memory([7, 42, 99_001]);
+     * await store.materializeMany({ operands: { vip, engaged: store.segment('cond-engaged') }, outputs: [...], keep: 12 });
+     * vip.release();
+     * ```
+     *
+     * It takes what {@link CloudRoaring.load} takes as input (ids as a sync or async iterable or a typed array, `{ bitmap }`
+     * or `{ serialized }`) and checks it the same way, with the same errors: the size cap, the structure, the safe
+     * deserializer and each id's range. **Only a real `Uint32Array` skips the per-id range check**; any other typed array goes
+     * through it, so `Int32Array([-1])` and `Float64Array([1.5])` throw {@link ValidationError}. An object with an `ascending`
+     * key is refused: ids that arrive in key order are a `feed`. An empty set is accepted here, and refused by
+     * `materializeMany` unless its name is in `mayBeEmpty`.
+     *
+     * The ids are held as the chunks a stored generation would hold, until {@link MemoryOperand.release}; between calls that
+     * memory is the caller's, and during a call it counts against `maxBufferedBytes`. There is no size option: the load's
+     * own cap applies to a serialized input.
+     *
+     * **Erasure.** Only `eraseSubject` moves the store's counter (at its start and at its end). One that started in this store
+     * since the handle began to be made, or is still running, makes a call that reads the handle fail the outputs that read it with
+     * {@link StaleOperandError} (`reason: 'erased'`), before any request and again just before each publish. An erasure in
+     * another store or another process is not seen, nor are `dropSegment`, `eraseNamespace`, `destroySegment` and the free
+     * function `eraseIdFromSegment`, which do not move it: the handle is the caller's copy, so build it from the source of truth at
+     * the start of each refresh and release it at the end.
+     *
+     * @throws {ValidationError} where a load of the same input would.
+     */
+    memory(input: LoadInput): Promise<MemoryOperand>;
+    /**
+     * **Many outputs, each operand read once per group.** Each output is an expression over named stored operands (`and`, `or`, `andNot`, nested
+     * to depth 64) published as a new generation of its own `dest`, exactly as an `*Into` would publish it, but computed
+     * together: each operand's chunks are read once for all the outputs that use them, instead of once per output and
+     * once more for every scratch segment a nested expression would otherwise need.
+     *
+     * ```ts
+     * const run = await store.materializeMany({
+     *   operands: { us: store.segment('us'), engaged: store.segment('engaged'), optOut: store.segment('opt-out') },
+     *   outputs: [
+     *     { dest: store.segment('send-1'), expr: { and: ['us', 'engaged'] }, exclude: ['optOut'] },
+     *     { dest: store.segment('send-2'), expr: { andNot: ['us', 'engaged'] } },
+     *   ],
+     *   keep: 3,
+     * });
+     * run.outputs[0]; // a MaterializeResult, or { published: false, error }
+     * ```
+     *
+     * **Results.** `run.outputs[i]` is index-aligned with `outputs` and is exactly what output `i`'s `*Into` would have
+     * returned (a {@link MaterializeResult}: published, or refused with its `reason`), or `{ published: false, error }` for
+     * what it would have thrown. One output's refusal or error never stops another. The call itself throws only for bad
+     * input ({@link ValidationError} naming the output index and path, before any request), an operand that names no
+     * segment (unless `allowAbsentOperands`), and a `budget` its own plan exceeds, the last two before any chunk is read.
+     *
+     * **One generation per operand.** By default every stored operand is pinned for the call: read at the generation it had
+     * when the call started, however long the call runs and whatever loads land meanwhile. That is one generation per
+     * operand, not one instant across operands (two pins are two registry reads). `pin: false` reads live, as a combine does.
+     *
+     * **Every pinned operand an output subtracts is re-checked.** An output subtracts an operand when it is in its `exclude`
+     * or under any entry of an `andNot` after the first, at any depth. Immediately before the publishes the call re-reads the
+     * registry row of each such operand and compares its generation and incarnation with what was pinned (a name deleted and
+     * created again is a replacement though it is generation 0 again). If one was replaced, each output that subtracts it is
+     * not published and carries {@link StaleOperandError}; the others publish. It costs one registry read per such operand per
+     * group, and `stats.operands` carries every operand's pinned, start and end generation and whether it moved.
+     *
+     * **Memory.** Everything the pass holds resident is counted against `maxBufferedBytes` (default 256 MiB): each output's
+     * buffered chunks, the operand streams' ranges, the chunks being evaluated, and the plan itself, and a call whose plan alone
+     * passes it is refused before any chunk is read. When the outputs do not fit, they run in groups, each reading its operands
+     * once (so the operand reads grow with the total output size over the budget), and a group's buffers are released only as
+     * its publishes settle. A chunk count the index understated does not grow a group past the budget: the largest buffer is
+     * dropped and that output re-runs alone. An output that cannot fit alone has `BudgetExceededError` as its result. The count
+     * is the pass's own: process memory is more, measured at 1.6 times the ledger's high water on Linux and 2.5 to 5 times on
+     * macOS on the in-memory backend (the guide has the shapes and what is not counted).
+     *
+     * **Untrusted bytes.** Every operand chunk is decoded through the checks on untrusted tier data. A key an operand's index
+     * lists whose bytes are missing is an error for the outputs that read the operand, never an empty chunk.
+     *
+     * **Handles.** An expired or released handle anywhere in the call (an operand or a `dest`) is refused before any request,
+     * as on the `*Into` verbs. A leased operand's lease, and an operand's deadline, are checked before each chunk key
+     * is read: a lapse fails only the outputs that read that operand, never reads empty. Each `dest`'s lease and deadline
+     * are checked again just before its publish.
+     *
+     * **The chunk cache is bypassed:** the pass reads through the storage source and never writes the decoded-chunk cache, so
+     * a batch does not evict other readers' hot chunks. Each publish still invalidates its `dest` as an `*Into` does.
+     *
+     * **A limit of the form.** An output cannot name another output of the same call: a `dest` that is also an operand is
+     * refused. Chain two calls.
+     *
+     * **Held operands.** An operand may be a {@link MemoryOperand} from {@link CloudRoaring.memory}: ids the caller holds,
+     * read beside the stored ones and giving the same output byte for byte. It is read from memory (no request, and the
+     * shared chunk cache never sees it), counts against `maxBufferedBytes` while the call runs, and is refused when empty
+     * unless its name is in `mayBeEmpty`. A handle from another store, or a released one, is a {@link ValidationError}. An
+     * erasure in this store since the handle was made fails the outputs that read it with {@link StaleOperandError}
+     * (`reason: 'erased'`).
+     *
+     * **A feed.** `feed: { names, records, counts }` adds operands that arrive as records in chunk-key order, for conditions
+     * too many to hold or store. Each record is checked before the pass sees it (see {@link MaterializeManyFeedRecord}): a bad
+     * feed is refused, never read as fewer members, and **a fed output is published only after the whole feed was read and every
+     * end-of-feed check passed**, so a bad feed refuses every fed output and publishes none of them; outputs that name only
+     * stored operands are unaffected. At the end of the feed `counts` must equal the ids the feed held for each name, and a
+     * name that appeared in no record is refused unless it is in `mayBeEmpty`. A feed is read once, so the call runs its outputs
+     * as one group and **`maxBufferedBytes` is required**: each record is converted to compressed bitmaps as it arrives, the key
+     * in hand and its fed outputs are counted against the budget, and the call fails as soon as the count passes it, with
+     * {@link BudgetExceededError} for every fed output. **Erasure:** a fed call is refused at its next record, and before each
+     * fed publish, once `eraseSubject` has started in this store ({@link StaleOperandError}, `reason: 'erased'`).
+     *
+     * ```ts
+     * await store.materializeMany({
+     *   operands: { unsub: store.segment('global-unsub') },
+     *   feed: {
+     *     names: ['us', 'engaged'],
+     *     records: warehouseRecords(), // yields { key, operands: { us: Uint32Array, engaged: Uint32Array } } by key
+     *     counts: () => warehouseCounts(),
+     *   },
+     *   maxBufferedBytes: 512 * 1024 * 1024,
+     *   outputs: [{ dest: store.segment('send-1'), expr: { and: ['us', 'engaged'] }, exclude: ['unsub'] }],
+     *   keep: 12,
+     * });
+     * ```
+     */
+    materializeMany(options: MaterializeManyOptions): Promise<MaterializeManyRun>;
+    private epochNow;
+    /**
+     * Whether an erasure has started in this store since `at` was read, or was running when it was: one that is still
+     * running is seen by the count of those running, and one that has ended since by the counter, which its end moved.
+     * The one check every call that reads caller memory uses.
+     */
+    private epochMoved;
+    /** A call's feed with the store's erasure counter: read once here, checked by the combine before any record is read. */
+    private feedOf;
+    /**
+     * The registry row of `ref`, read straight from the registry, not from a snapshot: a re-check must see a move. With
+     * `fingerprint`, the current generation's object is opened too (one tail read, as a pin of it makes), and its
+     * fingerprint is returned beside the row: a generation's number is identified by its row and its object, since a number
+     * can be taken again once its object is gone.
+     */
+    private currentRowOf;
+    /** Throw what a read of `handle` must throw now: its lease error, or a refusal for a deadline that has passed. */
+    private assertReadable;
+    /** {@link assertReadable} for a destination, named by where it sits in the call. */
+    private assertWritable;
     /**
      * **Subject access (GDPR Art. 15 / CCPA right-to-know): which segments is this id a member of?**
      *
@@ -498,6 +784,7 @@ export declare class CloudRoaring {
         concurrency?: number;
         budget?: BudgetOption;
     }): Promise<EraseSubjectResult>;
+    private eraseSubjectRun;
     /**
      * Every generation still in the bucket for this segment, ascending, with the current one marked.
      *
@@ -657,24 +944,26 @@ export declare class CloudRoaring {
      * A refused load deletes the object it wrote before returning — it sits above `currentGen`, where generation
      * collection deliberately never looks — but only while the segment's registry row is unchanged or gone. Once
      * another write has changed the row, the generation number it holds may name another incarnation's live object,
-     * so it leaves the orphan rather than risk deleting live data. The orphan is an ordinary generation once a later
-     * one is current above it, and collection counts it within `keep`.
+     * so it leaves the orphan rather than risk deleting live data. No row's list names it, so it takes no place in a
+     * window, and a listing deletes it once a later generation is current above it.
      *
-     * **Collection is by name for the default `keep`.** With `keep` of 0 or 1, a load that found nothing above the
-     * pointer deletes the one generation its publish pushed out of the window and lists nothing; it lists the segment's
-     * objects on every sixteenth generation, and on any load that met an object above the pointer or whose check found
-     * the current generation's object gone, to take what the name-only passes leave, such as the generations an
-     * earlier, wider `keep` held. `keep` of 2 or more lists on every load. {@link LoadResult.collected} then names what
-     * the pass deleted by name, and that generation may have been gone already.
+     * **Collection is by name at any `keep` up to 64.** The segment's row records the generations a load keeps, so a load
+     * that found nothing above the pointer deletes the generations its publish pushed out of the window and lists
+     * nothing. It lists the segment's objects on every sixteenth generation, and on any load that met an object above the
+     * pointer or whose check found the current generation's object gone, to take what the name-only passes leave, such as
+     * an object a crashed load left below the pointer. A `keep` above 64 records no list and lists on every load, and so
+     * does the first load of a row that records none, which then records it. {@link LoadResult.collected} then names
+     * what the pass deleted by name, and one name may have been gone already.
      *
      * What it **throws** for is a fault rather than an outcome: invalid options or ids, and a crypto-shredded
      * segment (`ValidationError`); a key the keystore cannot provide (`KeyUnavailableError`); a current generation
      * that will not open when a guard has to read its size, which it does only when the row has no usable summary of it
-     * (`IntegrityError`); a driver failure; and a collection pass
-     * by listing that could not prove the segment was still the same one (`WriteConflictError`). That one, and a
-     * failure in the collection's own reads or deletes, can be raised **after** the publish already landed, so a throw
-     * does not by itself mean the load did not take effect — re-read the pointer rather than assuming. A collection by
-     * name that finds the segment changed returns an empty `collected` instead.
+     * (`IntegrityError`); a driver failure; and a fault in the collection's own reads, listing or deletes, or in the write
+     * that records the window (anything but a lost race). A collection fault can be raised **after** the publish already
+     * landed, so a throw does not by itself mean the load did not take effect — re-read the pointer rather than assuming.
+     * A collection, by name or by listing, that finds another writer has moved the row since the publish (a load, a
+     * rollback, a purge) stops and returns what it deleted in `collected`: a load that took effect does not throw for a
+     * race it won.
      *
      * **A `TransientError` from the registry write can leave the publish unsettled, and deletes nothing.** The
      * generation's object is sent again after a throttle where the backend allows it (a write id tells a first send
@@ -840,6 +1129,55 @@ export declare class CloudRoaring {
     retireExpired(options?: Omit<RetireExpiredOptions, 'now'> & {
         now?: number;
     }): Promise<RetireExpiredResult>;
+    /**
+     * **Remove the registry rows that releases before 0.12.0 left as `deleted: true` envelopes.** Those releases never
+     * removed a row they deleted, and no later call removes it either: it is invisible to every read, and every full
+     * listing of the registry still reads it (one GET each). This is the one call that removes them. It is an admin call,
+     * not a sweep, and nothing schedules it: run it once after the last process on a release before 0.12.0 is gone.
+     *
+     * ```ts
+     * const preview = await store.reapRegistryTombstones({ dryRun: true });
+     * console.log(`would remove ${preview.wouldReap} of ${preview.examined} rows read`);
+     *
+     * const done = await store.reapRegistryTombstones({ confirmNoLegacyWriters: true });
+     * if (done.limited) runAgain(); // `limit` (default 1,000) stopped the run with rows unread
+     * ```
+     *
+     * **What it removes.** Only a row that is `deleted: true` and whose token carries no incarnation id, which is what a
+     * release before 0.12.0 left, or a 0.12.0 or later release left by deleting a row born before 0.12.0 (both are safe to
+     * remove), whatever its `status`. It never touches a live row, a `destroyed` row that is not `deleted` (a crypto-shred's
+     * or a `dropSegment`'s tombstone: the attestation of an erasure, which it cannot tell from another), or a deleted row
+     * with an incarnation id, and it never touches a generation. **So it does not clean a bucket completely**: the
+     * `destroyed` tombstones `dropSegment` leaves stay, so do live rows written before 0.12.0, and so does a tombstone a
+     * 0.12.0 or later release wrote while `conditionalDelete` was off (GCS by default, S3 on a custom endpoint): every full
+     * listing still reads it, and this call neither removes it nor runs on such a store.
+     * It also covers the library's own bookkeeping rows when `namespace` is not set, by the same rule. The default
+     * namespace cannot be scoped to: leave `namespace` out to cover it.
+     *
+     * **The two things it asks.** `confirmNoLegacyWriters: true` is required for a real run (without it, a
+     * `ValidationError`, and nothing is requested): your statement that no process on a release before 0.12.0 writes
+     * this registry, since one that did would, re-creating a removed name, issue the removed row's tokens again. And the
+     * registry must apply a delete under a precondition: where its `conditionalDelete` capability is off (GCS by default,
+     * S3 on a custom endpoint) it throws `CapabilityError` before any request, dry run included. A registry that keeps
+     * no such rows (the in-memory and local-filesystem ones) throws `UnsupportedError`.
+     *
+     * **Each removal is fenced** on the version it read, so a `create` that lands over the envelope first wins, the
+     * delete is refused, and the row is counted as `skipped.raced` (which also counts a row already gone). That holds where
+     * the backend applies the precondition, which auto-detection checks (S3 only on an AWS host). On an endpoint that
+     * ignores `If-Match` (MinIO, fake-gcs-server), a `conditionalDelete: true` you set makes this an unfenced delete: run
+     * it with every writer stopped. On a versioned bucket a delete leaves a delete marker and the earlier version, record
+     * included, so the name is not erased from the bucket. A `create` that had already read the envelope and
+     * whose write meets the removal throws `WriteConflictError`, which this library does not retry: retry the create, and
+     * it finds no row and writes one.
+     *
+     * **Cost** over R rows read and E removed: `ceil(R / 1000)` LIST requests, R GETs and E DELETEs (a dry run, no
+     * DELETEs). `limit` bounds the removals, and the run stops listing once it is spent. **A run is not resumable**: each
+     * lists and reads from the start (R GETs whatever the `limit`), a dry run with a `limit` reports the same first rows
+     * every time, so `wouldReap` is a total only when `limited` is `false`, and `limited` is `true` whenever the limit was
+     * spent with keys left, removable or not. An unreadable object stops the run with an error naming its key, and
+     * removes nothing more: it may be a newer release's row. Scope the run with `namespace` to get past one.
+     */
+    reapRegistryTombstones(options?: ReapRegistryTombstonesOptions): Promise<ReapRegistryTombstonesResult>;
     /**
      * **Forget everything this store has cached about a segment.** Use it after destroying or retiring a segment
      * through a path this store did not perform itself.
@@ -883,6 +1221,8 @@ export declare class CloudRoaring {
      * those of a live read that fetched across a publish (see {@link PinnedStorageChunkSource.currentVersion}).
      */
     private pinSegment;
+    /** 16 hex digits from the store's `Rng`, which names the holder of one lease: unique, not secret. */
+    private mintHolder;
     /**
      * An engine reading every segment in `pins` at its pinned generation and everything else live, with the store's
      * retries, so a transient fault on a pinned read is retried as it would be on a live one.
@@ -1004,8 +1344,9 @@ export interface BaseCombineOptions extends IdRange {
  */
 export interface CombineOptions extends BaseCombineOptions {
     /**
-     * Segments whose ids are subtracted from the result. An **expired** handle here excludes nothing, in every
-     * combine — it is skipped without being read, exactly as in {@link Segment.andNot}.
+     * Segments whose ids are subtracted from the result. An **expired** handle here is refused, in every combine:
+     * the stream throws {@link ValidationError} naming it, before any request is made, exactly as in
+     * {@link Segment.andNot}.
      */
     readonly exclude?: Segment[];
 }
@@ -1053,7 +1394,7 @@ export interface MaterializeOptions extends CombineOptions {
      * recovery story can depend on a materialisation collecting nothing: `rollbackSegment` refuses a target that
      * has been collected. Pass a number to collect on the way through; `0` keeps only the
      * generation this call publishes. It collects by listing the destination, so it clears every generation below the
-     * new one beyond `keep`, however many earlier calls kept, where a `load()` deletes by name the one generation its
+     * new one beyond `keep`, however many earlier calls kept, where a `load()` deletes by name the generations its
      * publish pushes out of the window.
      */
     readonly keep?: number;
@@ -1096,6 +1437,32 @@ export interface IdStream extends AsyncIterable<number> {
  * solves the same problem the same way, by taking {@link BaseCombineOptions}.
  */
 export type AndNotIntoOptions = Omit<MaterializeOptions, 'exclude'>;
+/** What {@link Segment.pin} and {@link Segment.pinAt} take besides the generation. */
+export interface PinOptions {
+    /**
+     * Hold the pinned generation until this instant: epoch-**milliseconds**, after now and at most
+     * {@link MAX_LEASE_MS} (14 days) from it. A load's collection leaves a leased generation in the bucket until the lease
+     * ends, and a read of the handle after it throws {@link LeaseExpiredError}, never empty.
+     */
+    readonly leaseUntil?: number;
+}
+/** The lease a pinned handle holds, as {@link Segment.lease} reports it. */
+export interface Lease {
+    /** 16 hex digits naming this lease in the segment's registry row. */
+    readonly holder: string;
+    /** Epoch-ms the lease runs to on this store's clock. */
+    readonly until: number;
+}
+/**
+ * The generation {@link Segment.pinAt} reopens: what an earlier pin recorded in {@link Segment.pinnedAt}. The
+ * fingerprint is required, since a generation number is taken again after a purge and re-create.
+ */
+export interface PinAt {
+    /** The generation number an earlier pin held. */
+    readonly generation: number;
+    /** The fingerprint of that generation's object, from the earlier pin's `pinnedAt.fingerprint`. */
+    readonly fingerprint: string;
+}
 /** What {@link Segment.stat} answers: the generation a handle reads, its id count and its metadata. */
 export interface SegmentStat {
     /** The generation read, or `null` when the segment has none. */
@@ -1104,6 +1471,26 @@ export interface SegmentStat {
     /** The metadata the generation was loaded with; absent when it has none. */
     readonly metadata?: GenerationMetadata;
 }
+/**
+ * A set of ids held in memory by {@link CloudRoaring.memory}, to be an operand of {@link CloudRoaring.materializeMany}
+ * and of no other verb. The bytes are the caller's until {@link MemoryOperand.release}.
+ *
+ * It belongs to the store that made it. `eraseSubject` in that store, started after the handle began to be made or still
+ * running when it was, fails the outputs of a `materializeMany` call that read it with {@link StaleOperandError}
+ * (`reason: 'erased'`): the call does not throw, and its outputs that do not read the handle publish. Nothing else is
+ * seen: an erasure in another store or process, and
+ * `dropSegment`, `eraseNamespace`, `destroySegment` and the free function `eraseIdFromSegment`, do not move the counter.
+ */
+export declare class MemoryOperand {
+    private readonly view;
+    /** Not constructible: a handle comes from {@link CloudRoaring.memory}. */
+    private constructor();
+    /**
+     * Zero and drop the bytes it holds. Any later use throws {@link ValidationError}; releasing twice does nothing. A call
+     * still reading it fails the outputs that read it.
+     */
+    release(): void;
+}
 /**
  * A handle bound to one segment — the read verbs, plus the three `*Into` verbs that write a **new generation**
  * of another segment.
@@ -1130,6 +1517,13 @@ export declare class Segment {
      * pinned handle passed as an **operand** is still read at its pin rather than live.
      */
     readonly pinnedAt?: PinnedAt;
+    /**
+     * The lease this handle holds, when it came from `pin({ leaseUntil })`; `undefined` otherwise. It reports what was
+     * taken and does not change when the lease ends: a read after `lease.until` (or after {@link Segment.release}) throws
+     * {@link LeaseExpiredError}.
+     */
+    readonly lease?: Lease;
+    private readonly leaseHold?;
     /**
      * Not constructible: a handle comes from {@link CloudRoaring.segment}, which wires it to the store's engine,
      * caches and write path. The constructor takes those internals, so it is not part of the surface.
@@ -1161,11 +1555,20 @@ export declare class Segment {
      * 0, so a pin of the old segment never reads the new one: what it has already read still answers, as the
      * instant it pinned, and anything it would have to fetch fails with `NotFoundError`, as a swept pin's does.
      *
-     * **It is a hold, not a lease.** Nothing here stops a collection deleting the generation underneath
-     * you: a pinned read deliberately does **not** heal forward, because silently serving a different generation
-     * is the one thing a pin exists to prevent, so it fails instead. Size `keep` to cover your longest pinned
-     * job — see [Generations and `keep`](https://github.com/cloudbitmaps/cloudbitmaps/blob/main/docs/guide/loading.md#generations-and-keep) — or take the pin on a segment
-     * you are not collecting.
+     * **It is a hold, and `pin({ leaseUntil })` makes it a bounded one.** Without a lease nothing stops a collection
+     * deleting the generation underneath you: a pinned read deliberately does **not** heal forward, because silently
+     * serving a different generation is the one thing a pin exists to prevent, so it fails instead. Size `keep` to cover
+     * your longest pinned job — see [Generations and `keep`](https://github.com/cloudbitmaps/cloudbitmaps/blob/main/docs/guide/loading.md#generations-and-keep) — take the pin on a segment
+     * you are not collecting, or lease it.
+     *
+     * **A lease** (`leaseUntil`: epoch **milliseconds**, after now and at most 14 days out) keeps the generation out of
+     * a load's collection until then, from any process, and the pin is taken with it: the lease is written to the segment's
+     * row before the object is opened. A read of the handle after the lease, or after {@link Segment.release}, throws
+     * {@link LeaseExpiredError} at every read site, including when the handle is an operand or an `exclude` of a combine
+     * or the target of an `*Into`, and never reads empty. A stream checks the lease each time it reads a chunk. A segment
+     * holds at most 64 live leases ({@link LeaseLimitError}). A collector holds a lease 60 seconds past its end, which covers
+     * clocks that differ by that much. Erasure, shred, drop and retention expiry ignore a lease. See
+     * [Hold a generation for a job](https://github.com/cloudbitmaps/cloudbitmaps/blob/main/docs/guide/reading.md#hold-a-generation-for-a-job-a-lease).
      *
      * A segment with no current generation pins nothing and reads empty, exactly as it would unpinned. A pinned
      * segment whose row is later dropped or destroyed fails once it must open its object again, rather than go empty
@@ -1205,7 +1608,55 @@ export declare class Segment {
      * Needs a store built on the `.crbm` storage source (the default when you pass a backend or a raw driver). Throws
      * {@link UnsupportedError} on a store wired with a pre-built source that cannot pin.
      */
-    pin(): Promise<Segment>;
+    pin(options?: PinOptions): Promise<Segment>;
+    /**
+     * Hold what this pin names until `leaseUntil`, or `undefined` for a pin with no lease. Refuses an option it does not
+     * know, a value that is not epoch-milliseconds in the future, one past the longest lease, and one past the handle's own
+     * `expiresAt`, before any request is made.
+     */
+    private leaseUntilOf;
+    /**
+     * End this handle's lease now, so a load's collection may take its generation. Idempotent: a handle with no lease, or
+     * one already released, does nothing and makes no request. Every read of the handle after it throws
+     * {@link LeaseExpiredError} (reason `'released'`), including one already under way at its next chunk. A lease that has
+     * ended by its own time needs no release: this then makes no request either, and the registry row's entry is pruned
+     * by a later write. Otherwise it is one registry read and one write; a failure of either is thrown as the registry's own
+     * typed error, and the entry then holds until its time ends, `release()` being safe to call again.
+     */
+    release(): Promise<void>;
+    /**
+     * The error a read of this handle must throw, or `undefined` when it holds no lease or the lease is live. One property
+     * read on a handle with no lease. It is not {@link Segment.expired}: that rule reads empty, and a lease must never.
+     */
+    private leaseError;
+    /**
+     * Throw the first lease error among `handles`: this handle and every operand and exclude of a call. It runs before
+     * any `expiresAt` rule and before the engine, so no operand, exclude or cached reader can answer past a lease.
+     */
+    private assertLeases;
+    /**
+     * Reopen a generation a pin named earlier, as a pinned handle like the one {@link Segment.pin} returns, held at
+     * `at.generation` instead of the current one. Pass what the earlier pin recorded, `{ generation, fingerprint }`
+     * from its {@link Segment.pinnedAt}. A generation number alone is not an identity, since a purged and re-created
+     * name starts again at 0, so the fingerprint is required: a bare number, a malformed fingerprint or a key other
+     * than `generation` and `fingerprint` is a {@link ValidationError}. Identify a pin by its `generation` and
+     * `fingerprint`: the handle's `pinnedAt.version` can differ from the earlier pin's.
+     *
+     * Throws {@link NotFoundError} when the generation is gone (collected, purged, or on a crypto-shredded segment),
+     * is above the row's pointer, or is another object than the fingerprint names, and never reads empty. A rollback
+     * deletes nothing, so once a later load moves the pointer past a generation it rolled back from, that one can be
+     * reopened while its object is stored. Nothing keeps a generation alive unless you lease it: a later load's
+     * collection can delete it, which is sized by `keep` on every writer, or held by `options.leaseUntil` (see
+     * {@link PinOptions} and {@link Segment.pin}). A leased `pinAt` writes the lease before it verifies the object, and
+     * releases it if the verify fails; for a generation below the pointer, a collector that read the row before the lease
+     * landed can still delete the generation inside its own round trip, and the handle then fails with `NotFoundError`
+     * like any swept pin. A leased handle is checked at every read site as a leased `pin()` is. With a registry it costs one row read and one tail read,
+     * and a leased `pinAt` one conditional write to the row besides; the handle
+     * then reads as one from `pin()` does, including its failure on a chunk it has not cached once the generation is
+     * swept. Works for an encrypted segment. The first argument is an object so that fields can join it later; the lease
+     * is in `options`, the second.
+     */
+    pinAt(at: PinAt, options?: PinOptions): Promise<Segment>;
     /**
      * An opaque string that names this handle's segment, namespace included: two handles of one segment have the
      * same key, a live handle and its pins among them. Use it as a `Map` key or a log field when you track handles
@@ -1244,6 +1695,8 @@ export declare class Segment {
      * awaiting.
      */
     private refuseIfExpired;
+    /** `result` as is, or, when a handle of the call holds a lease, checking that lease each time it reads a chunk. */
+    private guarded;
     /**
      * Time an op with the injected clock and emit an `op` metric on completion (success or throw). Skipped
      * entirely when no sink is wired, so the default path pays nothing.
@@ -1301,9 +1754,40 @@ export declare class Segment {
      * without checking its options, as every read of one does.
      */
     iterate(options?: IdRange): IdStream;
+    /**
+     * **Pinned handles only.** The ids at 1-based ranks `n`, `2n`, `3n` …, counted over the ids in `(after, through]`
+     * when a range is given, ascending: `everyNth(1000)` yields the 1,000th id, then the 2,000th, and so on. A last
+     * partial window yields nothing, so a caller cutting a send into windows of `n` appends its own final end.
+     *
+     * It places each boundary from the per-chunk counts the pin already holds and reads only the chunks that hold one,
+     * each once however many boundaries it holds, so it reads at most one chunk per boundary and never more chunks
+     * than the object has. A range with `after` inside a chunk reads that chunk too, to count the ids at or below
+     * `after`, even when fewer than `n` ids remain above it; when the chunks in range hold fewer than `n` ids in all,
+     * nothing is fetched. `through` stops the read and no chunk past it is read, though a `through` inside a chunk may read that last chunk and
+     * yield nothing from it. The reads and the read-ahead window are
+     * those of {@link Segment.iterate}, and the per-op budget is charged before the first fetch, with an upper bound on
+     * the chunks the read can take. A pinned read after the generation is swept throws {@link NotFoundError}.
+     *
+     * The ranks come from the index's counts, which are trusted as {@link Segment.count} trusts them. A chunk that is
+     * read must hold the number of ids its index says, or the read throws {@link IntegrityError}; a chunk that is not
+     * read is not checked, so an index that is wrong about one, and, on an unencrypted object, still adds up to the footer's
+     * total, moves the ids after it to the wrong ranks. An encrypted object's index is authenticated and bound to the
+     * object, so a wrong count there needs the key.
+     *
+     * A live handle is refused with {@link UnsupportedError} at the first read, because its counts and its chunks could
+     * come from two generations and name the wrong id. `n` that is not a positive integer throws
+     * {@link ValidationError} at the first read, as does a bad bound. An expired handle reads empty.
+     *
+     * ```ts
+     * const audience = await store.segment('audience').pin();
+     * const ends: number[] = [];
+     * for await (const id of audience.everyNth(1_000)) ends.push(id); // the end of each window of 1,000
+     * ```
+     */
+    everyNth(n: number, options?: IdRange): AsyncIterable<number>;
     /**
      * The options a combine hands the engine, read once, when it is called ({@link readOptions}), with the `exclude`
-     * it was given, already reduced to its live handles ({@link liveExcludes}) and mapped down to the plain refs
+     * it was given ({@link excludesOf}) and mapped down to the plain refs
      * `core` takes. A method rather than a module function because `ref` is class-private — the encapsulation is
      * worth more than the free function.
      *
@@ -1313,15 +1797,23 @@ export declare class Segment {
      */
     private refsIn;
     /**
-     * The handles in `options.exclude` that have not expired. **An expired exclusion excludes nothing**, in every
-     * combine, so it is dropped here, before the engine is asked for anything: it is never fetched, never
-     * checked for absence, and never counted in the pin-consistency check. `exclude` is read once, so a getter sees
-     * one call.
+     * The handles in `options.exclude`, read once so a getter sees one call. With none this is one property read and
+     * a shared empty list; otherwise it is the caller's own array, so the common case allocates nothing.
+     */
+    private excludesOf;
+    /**
+     * The refusal for a combine whose **exclusion** has expired, or `undefined` when none has. Unlike an expired
+     * operand, which reads empty, an exclusion is a suppression or opt-out list: left out silently, the result
+     * would include the very ids it was passed to remove. So it is refused with a {@link ValidationError} naming each
+     * expired exclusion, as the `*Into` verbs refuse an expired handle.
      *
-     * With no `exclude` this is one property read and a shared empty list, and with none expired it returns the
-     * caller's own array, so the common case allocates nothing.
+     * It is judged against the injected clock when the combine is called, before the engine is asked for anything:
+     * no request is made, and an expired exclusion that names a segment that does not exist is refused as expired,
+     * not as an absent operand. It runs ahead of the expired-operand shortcuts, so a combine that would read empty
+     * anyway still refuses a lapsed exclusion. A stream already being read is not re-checked when an exclusion
+     * expires part-way, as an operand expiring part-way does not stop it either.
      */
-    private liveExcludes;
+    private expiredExcludes;
     /**
      * Chunk-skipping intersection: stream the ids in **this** segment AND every segment in `others`, ascending.
      * Fetches only the Storage chunks present in *all* operands (a key absent from any operand contributes nothing
@@ -1376,9 +1868,9 @@ export declare class Segment {
      * suppression list: at most one read per surviving key of `this`, so subtracting a 61,000-chunk global
      * opt-out list from a 40-chunk audience costs at most 40 reads, not 61,000.
      *
-     * An expired handle in `excludes` excludes nothing, and is skipped without being read; if every one has
-     * expired the result is `this` whole. An expired `this` is empty. `exclude` on `intersect` and `union` follows
-     * the same rule.
+     * An expired handle in `excludes` is refused, not skipped: the stream throws {@link ValidationError} naming it,
+     * before any request is made, because a lapsed suppression list would otherwise let through the ids it was
+     * passed to remove. An expired `this` is empty. `exclude` on `intersect` and `union` follows the same rule.
      *
      * To filter the *result of an intersection*, do not chain — pass `exclude` to {@link intersect} instead, so
      * the suppression folds into the same pass rather than materializing an intermediate segment first.
@@ -1399,5 +1891,6 @@ export declare class Segment {
         workload?: Workload;
     }): Promise<CostReport>;
 }
-export { MemoryStorage, LocalFsStorage, CrbmStorageChunkSource, destroySegment, eraseNamespace, excludingReservedRows, readRetentionPolicy, MIN_EXPIRES_AT_MS, InProcessKeystore, NodeAead, aadFor, CloudRoaringError, ValidationError, WriteConflictError, IntegrityError, NotFoundError, UnsupportedError, CapabilityError, TransientError, KeyUnavailableError, BudgetExceededError, isCloudRoaringError, isWriteConflictError, isTransientError, isNotFoundError, isIntegrityError, isValidationError, CrbmReader, BufferReader, CountingMetricsSink, RecordingAuditSink, DEFAULT_RETRY_POLICY, AWS_US_EAST_1_ONDEMAND, ELASTICACHE_REDIS_US_EAST_1_ONDEMAND, ONE_REDIS_HA_CLUSTER, } from '@cloudbitmaps/core';
-export type { Aead, AeadSealed, AuditEvent, BlobReader, BlobSink, Budget, BudgetOption, ChunkRef, Clock, CodecBitmap, CodecInterface, ConsistencyErrorEntry, ConsistencyIssue, ConsistencyReport, CostReport, CrbmCrypto, CrbmReaderOptions, CrbmStorageChunkSourceOptions, DestroyResult, ClearRegistrySummary, DropResult, EncodedChunk, EraseDeps, EstimateInput, ExportFailure, ExportFormat, ExportManifest, ExportOptions, ExportSink, ExportWriter, ExportedSegment, GenKey, GenerationEntry, GenerationMetadata, GovernanceMeta, IAuditSink, IKeystore, IMetricsSink, IRegistryDriver, IStorageDriver, IdRange, InProcessKeystoreOptions, LoadGuard, LoadInput, LoadOptions, LoadRefusal, LoadResult, LocalFsStorageOptions, MemoryStorageOptions, MetricEvent, MetricOpName, MetricsSnapshot, NewRegistryRecord, PinnedAt, PinnedObject, PortableBitmap, PricingProfile, RedisNodeType, RedisSizing, RegCaps, RegistryPatch, RegistryRecord, RegistryStatus, RegistrySummary, RegistryWriteOptions, RetentionPolicy, RetireEntry, RetireExpiredOptions, RetireExpiredResult, RetryPolicy, Rng, RollbackResult, SealedRegistrySummary, SegmentInfo, SegmentRef, SegmentSize, SegmentSizing, SetRetentionResult, StorageBackend, StorageCaps, StorageChunkSource, Token, Workload, WrappedDek, } from '@cloudbitmaps/core';
+export { deserializePortable };
+export { MemoryStorage, LocalFsStorage, CrbmStorageChunkSource, destroySegment, eraseNamespace, excludingReservedRows, readRetentionPolicy, MIN_EXPIRES_AT_MS, LEASE_SKEW_MS, MAX_LEASE_MS, MAX_LEASES_PER_SEGMENT, InProcessKeystore, NodeAead, aadFor, CloudRoaringError, ValidationError, WriteConflictError, IntegrityError, NotFoundError, UnsupportedError, CapabilityError, TransientError, KeyUnavailableError, BudgetExceededError, LeaseExpiredError, LeaseLimitError, StaleOperandError, isCloudRoaringError, isWriteConflictError, isTransientError, isNotFoundError, isIntegrityError, isValidationError, isLeaseExpiredError, isLeaseLimitError, isStaleOperandError, CrbmReader, BufferReader, CountingMetricsSink, RecordingAuditSink, DEFAULT_RETRY_POLICY, AWS_US_EAST_1_ONDEMAND, ELASTICACHE_REDIS_US_EAST_1_ONDEMAND, ONE_REDIS_HA_CLUSTER, } from '@cloudbitmaps/core';
+export type { Aead, AeadSealed, AuditEvent, BlobReader, BlobSink, Budget, BudgetOption, ChunkRef, Clock, CodecBitmap, CodecInterface, ConsistencyErrorEntry, ConsistencyIssue, ConsistencyReport, CostReport, CrbmCrypto, CrbmReaderOptions, CrbmStorageChunkSourceOptions, DestroyResult, ClearRegistrySummary, DropResult, EncodedChunk, EraseDeps, EstimateInput, ExportFailure, ExportFormat, ExportManifest, ExportOptions, ExportSink, ExportWriter, ExportedSegment, GenKey, GenerationEntry, GenerationMetadata, GovernanceMeta, IAuditSink, IKeystore, IMetricsSink, IRegistryDriver, IStorageDriver, IdRange, InProcessKeystoreOptions, LoadGuard, LoadInput, LoadOptions, LoadRefusal, LoadResult, LocalFsStorageOptions, MemoryStorageOptions, MetricEvent, MetricOpName, MetricsSnapshot, NewRegistryRecord, PinnedAt, PinnedObject, PortableBitmap, PricingProfile, RedisNodeType, RedisSizing, RegCaps, RegistryPatch, RegistryRecord, RegistryStatus, RegistrySummary, ReapRegistryTombstonesOptions, ReapRegistryTombstonesResult, RegistryWriteOptions, LeaseEntry, RetentionPolicy, RetireEntry, RetireExpiredOptions, RetireExpiredResult, RetryPolicy, Rng, RollbackResult, SealedRegistrySummary, SegmentInfo, SegmentRef, SegmentSize, SegmentSizing, SetRetentionResult, StorageBackend, StorageCaps, StorageChunkSource, Token, Workload, WrappedDek, } from '@cloudbitmaps/core';