@cero-base/cero 1.1.1 → 1.2.0

package/src/index.js

@@ -9,6 +9,7 @@ import { CeroError } from '@cero-base/core/errors'
 
 import { Handle, Ref } from './handle/index.js'
 import { Local } from './local/index.js'
+import { Bluetooth } from './bluetooth.js'
 import {
   put,
   set,
@@ -66,6 +67,9 @@ export { t, schema } from './lib/spec.js'
  * @property {(err: any) => void} [onerror]            Background-task error handler.
  * @property {boolean} [recovery]                      Recovery flow — wipe local state and re-claim a writer slot.
  * @property {number} [recoveryTimeout]                Max wait for peer data + writer capability during recovery.
+ * @property {Uint8Array} [storageKey]                 32-byte key encrypting local key material (master seed, device keypairs) at rest. Source it from the OS keychain — cero never stores it.
+ * @property {boolean} [extensions]                    `false` disables the bundled extensions (profileSync, handleSync) for this instance. Build with `{ extensions: false }` too so the spec matches.
+ * @property {boolean | any} [bluetooth]               `true` enables nearby (Bluetooth) sync via `me.bluetooth`; pass a bare-bluetooth-shaped backend to inject one. Absent backend → `me.bluetooth.state === 'unsupported'`.
  */
 
 /**
@@ -93,24 +97,27 @@ export async function cero(dir, spec, opts = {}) {
   // lock leaks and a retry in the same process hits locked storage.
   try {
     await storage.ready()
+    await fs.promises.chmod(`${dir}/main`, 0o700)
     store = new Corestore(storage, { manifestVersion: 2 })
     await store.ready()
 
     if (spec.local && spec.meta?.local) {
-      local = new Local(null, spec, { store })
+      local = new Local(null, spec, { store, storageKey: opts.storageKey })
       await local.ready()
     }
 
     const identity = await resolveIdentity(opts, local)
     const writer = local ? (await local.store.get('keypair')).data : null
 
-    // Channel stamp: a storage remembers its channel; reopening it under a different channel is a
-    // misconfiguration that could leak data across networks, so reject it. Only when a channel is
-    // set (no channel = global, no stamp, unchanged).
-    if (local && opts.channel) {
-      const stored = (await local.store.get('environment')).data?.channel
-      if (stored == null) await local.store.set('environment', { channel: opts.channel })
-      else if (stored !== opts.channel) throw CeroError.CHANNEL_MISMATCH()
+    // Channel stamp: a storage remembers its channel; reopening it under a different channel —
+    // including no channel at all, which would silently rejoin the global network — is a
+    // misconfiguration that could leak data across networks, so reject it.
+    if (local) {
+      const stored = (await local.store.get('environment')).data?.channel ?? null
+      const wanted = opts.channel ?? null
+      if (stored == null && wanted != null)
+        await local.store.set('environment', { channel: wanted })
+      else if (stored != null && stored !== wanted) throw CeroError.CHANNEL_MISMATCH()
     }
 
     network = new Network({ bootstrap: opts.bootstrap, channel: opts.channel })
@@ -164,10 +171,20 @@ export async function cero(dir, spec, opts = {}) {
     if (opts.recovery) await me.recover({ timeout: opts.recoveryTimeout })
 
     for (const ext of internal.extensions) {
+      if (ext.bundled && opts.extensions === false) continue
       const off = await ext.setup?.(me)
       if (typeof off === 'function') me.once('close', off)
     }
 
+    if (opts.bluetooth) {
+      me.bluetooth = new Bluetooth(me, {
+        backend: opts.bluetooth === true ? null : opts.bluetooth,
+        autoStart: true
+      })
+      me.once('close', () => me.bluetooth.close().catch(safetyCatch))
+      await me.bluetooth.ready()
+    }
+
     bind(me, null)
     return me
   } catch (err) {
@@ -205,7 +222,17 @@ export async function restore(me, phrase) {
   const { _dir: dir, spec, _opts: opts } = me
   // channel must carry over — without it the recovered instance rejoins the
   // global identity topic and never meets its channeled peers (recovery timeout).
-  const { name, bootstrap, isMobile, onerror, routes, recoveryTimeout, channel } = opts
+  const {
+    name,
+    bootstrap,
+    isMobile,
+    onerror,
+    routes,
+    recoveryTimeout,
+    channel,
+    storageKey,
+    extensions
+  } = opts
 
   await me.close()
   await fs.promises.rm(`${dir}/main`, { recursive: true, force: true })
@@ -218,6 +245,8 @@ export async function restore(me, phrase) {
     routes,
     recoveryTimeout,
     channel,
+    storageKey,
+    extensions,
     phrase,
     recovery: true
   })
@@ -242,11 +271,20 @@ cero.restore = restore
 cero.schema = schema
 cero.bind = bind
 cero.define = define
+// test-only escape hatch (cross-package tests reset/seed the registry)
 cero._internal = internal
 // A bare function is shorthand for a behavior-only extension: `{ setup: fn }`.
 // Accepts both `use(a, b)` and `use([a, b])` (and a mix) for easier composition.
-cero.use = (...exts) =>
-  internal.extensions.push(...exts.flat().map((e) => (typeof e === 'function' ? { setup: e } : e)))
+// A named extension replaces any registered one with the same name — so
+// `use(profileSync({ fields }))` reconfigures the bundled default instead of
+// doubling it.
+cero.use = (...exts) => {
+  for (const e of exts.flat().map((e) => (typeof e === 'function' ? { setup: e } : e))) {
+    const i = e.name ? internal.extensions.findIndex((x) => x.name === e.name) : -1
+    if (i >= 0) internal.extensions[i] = e
+    else internal.extensions.push(e)
+  }
+}
 
 async function resolveIdentity(opts, local) {
   if (opts.identity) return opts.identity

package/src/lib/internal.js

@@ -1,3 +1,9 @@
 // Process-wide registry for extensions registered via `cero.use()`.
 // `build()` folds in each extension's schema; `cero()` runs each setup.
-export const internal = { extensions: [] }
+// The bundled extensions are on by default — `cero.use(profileSync({...}))`
+// replaces a default by name, `{ extensions: false }` (on build and cero)
+// leaves them out entirely.
+import { profileSync } from '../extensions/profile-sync.js'
+import { handleSync } from '../extensions/handle-sync.js'
+
+export const internal = { extensions: [profileSync(), handleSync()] }

package/src/lib/operators.js

@@ -1,4 +1,5 @@
 import { Readable } from 'streamx'
+import b4a from 'b4a'
 
 import { encodeId, decodeId } from '@cero-base/core/blobs/codec'
 import { onAbort } from './utils.js'
@@ -30,11 +31,11 @@ export function resolveFile(handle, id, name) {
 /**
  * Insert (or overwrite by id) a row on `ref`. The `files` builtin is special:
  * `put(handle.files, { data, type, name? })` uploads the bytes to this handle's
- * blob store, records `{ id, name }`, and returns the resolved file.
+ * blob store, records `{ id, name }`, and resolves the file.
  *
  * @param {Ref} ref
  * @param {Record<string, any>} row
- * @returns {Promise<SingleResult | { id: string, name?: string, type: string, size: number, url: string }>}
+ * @returns {Promise<SingleResult>}
  */
 export const put = (ref, row) =>
   ref.name === 'files' ? putFile(ref, row) : ref.handle.store.put(ref.name, row)
@@ -47,7 +48,7 @@ async function putFile(ref, row) {
   const blobId = await handle.blobs.put(data)
   const id = encodeId(handle.blobs.key, blobId, type)
   await handle.store.call('add-file', { id, name })
-  return resolveFile(handle, id, name)
+  return { data: resolveFile(handle, id, name) }
 }
 
 /**
@@ -186,10 +187,13 @@ function registerBlobCore(handle, id) {
   if (!id || !handle.root?._coreKeys) return
   try {
     const { coreKey } = decodeId(id)
-    const hex = Buffer.from(coreKey).toString('hex')
+    const hex = b4a.toString(coreKey, 'hex')
     if (!handle.root._coreKeys.has(hex)) {
       handle.root._coreKeys.set(hex, handle.root.store.encryptionKey)
     }
+    // remember which handle read it, so close prunes the entry (re-registered
+    // on the next read if another handle still serves the same core)
+    if (handle !== handle.root) (handle._blobKeys ??= new Set()).add(hex)
   } catch {
     // ignore invalid ids
   }
@@ -239,28 +243,44 @@ export const watch = (ref, q, opts) => {
   const owner = ref.handle
   if (ref.kind !== 'handle') {
     const src = owner.store.watch(ref.name, q)
-    const out = new Readable({
-      destroy(cb) {
-        src.destroy()
-        cb(null)
-      }
-    })
-    src.on('data', (res) => out.push(resolveResult(ref, res)))
-    src.on('end', () => out.push(null))
-    src.on('error', (err) => out.destroy(err))
+    const out = snapshotStream(src, (res) => resolveResult(ref, res))
     return bindStream(owner, out, opts)
   }
   const source = parentStore(ref).watch('handles', q)
+  const out = snapshotStream(source, (snap) => normalize(snap?.data, ref.name))
+  return bindStream(owner, out, opts)
+}
+
+// Snapshots are idempotent — under a slow consumer hold only the NEWEST one
+// instead of queueing every intermediate (a busy room + un-drained reader
+// used to buffer full result sets without bound).
+function snapshotStream(src, map) {
+  let pending
+  let wanted = false
   const out = new Readable({
+    read(cb) {
+      wanted = true
+      flush()
+      cb(null)
+    },
     destroy(cb) {
-      source.destroy()
+      src.destroy()
       cb(null)
     }
   })
-  source.on('data', (snap) => out.push(normalize(snap?.data, ref.name)))
-  source.on('end', () => out.push(null))
-  source.on('error', (err) => out.destroy(err))
-  return bindStream(owner, out, opts)
+  const flush = () => {
+    if (!wanted || pending === undefined || out.destroyed) return
+    const snap = pending
+    pending = undefined
+    wanted = out.push(snap) !== false
+  }
+  src.on('data', (res) => {
+    pending = map(res)
+    flush()
+  })
+  src.on('end', () => out.push(null))
+  src.on('error', (err) => out.destroy(err))
+  return out
 }
 
 // Universal signal instantiator. Dispatch on the second arg:

package/src/local/index.js

@@ -9,6 +9,7 @@ import { attachRefs } from '../lib/utils.js'
  * @typedef {object} LocalOpts
  * @property {any} [root]   Pre-existing HypercoreStorage to reuse.
  * @property {any} [store]  Pre-existing Corestore to reuse.
+ * @property {Uint8Array} [storageKey]  32-byte key encrypting the local store at rest.
  */
 
 /**
@@ -22,7 +23,7 @@ export class Local extends ReadyResource {
    * @param {any} spec            Built cero spec — must include `spec.local.database` and `spec.meta.local`.
    * @param {LocalOpts} [opts]
    */
-  constructor(dir, spec, { root, store } = {}) {
+  constructor(dir, spec, { root, store, storageKey } = {}) {
     super()
     if (!root && !store && (typeof dir !== 'string' || !dir))
       throw CeroError.REQUIRED('dir, root, or store')
@@ -34,7 +35,8 @@ export class Local extends ReadyResource {
     this.store = Storage.bee(dir, {
       spec: { database: spec.local.database, meta: spec.meta.local },
       root,
-      store
+      store,
+      storageKey
     })
   }
 

package/src/rpc/client.js

@@ -152,7 +152,7 @@ const operators = {
   async put(name, row) {
     const codec = this._codec()
     const schema = this.schemaOf(name)
-    if (row && row.data != null) {
+    if (name === 'files') {
       const res = await this.rpc.addFile({
         handle: this.id,
         data: row.data,
@@ -225,7 +225,11 @@ const operators = {
       info?.kind === 'single'
         ? codec.decodeRow(schema, res.data)
         : codec.decodeRows(schema, res.data)
-    return { data: this._resolveFiles(name, raw), total: res.total, size: res.size }
+    return {
+      data: this._resolveFiles(name, raw),
+      total: res.total === -1 ? null : res.total,
+      size: res.size
+    }
   },
 
   /**
@@ -285,7 +289,11 @@ const operators = {
         refInfo.kind === 'single'
           ? (codec.decodeRow(schema, snap.data) ?? null)
           : codec.decodeRows(schema, snap.data)
-      out.push({ data: this._resolveFiles(name, raw), total: snap.total, size: snap.size })
+      out.push({
+        data: this._resolveFiles(name, raw),
+        total: snap.total === -1 ? null : snap.total,
+        size: snap.size
+      })
     })
     // end exactly once whether the wire ends or the server destroys it (handle close)
     let ended = false
@@ -320,8 +328,13 @@ const operators = {
    * @param {{ role?: string }} [opts]
    * @returns {Promise<string>}
    */
-  async invite({ role } = {}) {
-    const { invite } = await this.rpc.invite({ handle: this.id, role: role || '' })
+  async invite({ role, expiresIn, multiUse } = {}) {
+    const { invite } = await this.rpc.invite({
+      handle: this.id,
+      role: role || '',
+      expiresIn: expiresIn || 0,
+      multiUse: multiUse === true
+    })
     return invite
   },
 

package/src/rpc/server.js

@@ -88,7 +88,7 @@ export class Server extends RPCServer {
   /** Wire the `init` handler that lazily constructs the root cero handle. */
   _wireInit() {
     this.rpc.onInit(async () => {
-      if (this.me) throw new CeroError('CONFLICT', 'already initialized')
+      if (this.me) throw CeroError.CONFLICT('already initialized')
       this.me = await cero(this.storage, this.spec, this.opts)
       this.handles.set(this.me.id, this.me)
       await this.me.fileServer.listen()
@@ -104,7 +104,7 @@ export class Server extends RPCServer {
   /** Wire the `restore` handler that rebuilds the local store from a phrase. */
   _wireRestore() {
     this.rpc.onRestore(async ({ phrase }) => {
-      if (!this.me) throw new CeroError('NOT_READY', 'init')
+      if (!this.me) throw CeroError.NOT_READY('Server', 'server')
       this.me = await restore(this.me, phrase)
       this.handles = new Map([[this.me.id, this.me]])
       return this._identity()
@@ -144,7 +144,8 @@ export class Server extends RPCServer {
         r.kind === 'single'
           ? codec.encodeRow(r.schema, result.data)
           : codec.encodeRows(r.schema, result.data)
-      return { data, total: result.total ?? 0, size: result.size ?? 0 }
+      // total is int on the wire: -1 encodes "skipped" (null), see T2.1 lazy total
+      return { data, total: result.total ?? -1, size: result.size ?? 0 }
     })
 
     this.rpc.onGetOne(async ({ handle, ref, id, local }) => {
@@ -179,12 +180,30 @@ export class Server extends RPCServer {
         stream.destroy()
         return
       }
+      // keep-latest under IPC backpressure: snapshots are idempotent, so an
+      // un-drained wire holds one pending snapshot (newest wins) instead of
+      // queueing every intermediate result set — encode only what ships
+      let pending = null
+      let blocked = false
       const onData = (snap) => {
+        if (blocked) {
+          pending = snap
+          return
+        }
         const data =
           r.kind === 'single'
             ? codec.encodeRow(r.schema, snap.data)
             : codec.encodeRows(r.schema, snap.data)
-        stream.write({ data, total: snap.total ?? 0, size: snap.size ?? 0 })
+        blocked = stream.write({ data, total: snap.total ?? -1, size: snap.size ?? 0 }) === false
+        if (blocked) {
+          stream.once('drain', () => {
+            blocked = false
+            if (pending === null) return
+            const next = pending
+            pending = null
+            onData(next)
+          })
+        }
       }
       let set = this._watchStreams.get(handle)
       if (!set) this._watchStreams.set(handle, (set = new Set()))
@@ -208,9 +227,13 @@ export class Server extends RPCServer {
 
   /** Register invite/revoke/join RPC handlers. */
   _wirePairing() {
-    this.rpc.onInvite(async ({ handle, role }) => {
+    this.rpc.onInvite(async ({ handle, role, expiresIn, multiUse }) => {
       const h = this._resolve(handle)
-      const invite = await h.invite({ role: role || undefined })
+      const invite = await h.invite({
+        role: role || undefined,
+        expiresIn: expiresIn || undefined,
+        multiUse: multiUse === true
+      })
       return { invite }
     })
 
@@ -328,7 +351,7 @@ export class Server extends RPCServer {
   /** Wire the on-demand `seed` handler — surfaces the recovery phrase only when asked. */
   _wireSeed() {
     this.rpc.onSeed(async () => {
-      if (!this.me) throw new CeroError('NOT_READY', 'init')
+      if (!this.me) throw CeroError.NOT_READY('Server', 'server')
       return { phrase: this.me.identity.toPhrase() }
     })
   }

package/types/bluetooth.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `me.bluetooth` — the whole app-facing surface for nearby (Bluetooth) sync.
+ * Bluetooth is a cero feature, not a parallel API: it only changes how peers
+ * meet and carry bytes; capability-gated replication still decides what syncs.
+ *
+ * ```js
+ * const me = await cero(dir, spec, { channel, bluetooth: true })
+ * me.bluetooth.state          // 'unsupported' | 'unauthorized' | 'off' | 'waiting' | 'on'
+ * await me.bluetooth.start()
+ * me.bluetooth.peers          // Map of live BLE links
+ * me.bluetooth.on('update', () => {})
+ * ```
+ *
+ * @extends ReadyResource
+ */
+export class Bluetooth extends ReadyResource {
+    /**
+     * @param {object} handle           Root cero Handle (network + identity + channel).
+     * @param {object} [opts]
+     * @param {any} [opts.backend]      Injected bare-bluetooth-shaped backend (tests); lazy-loaded when absent.
+     * @param {boolean} [opts.autoStart]  Start on handle open (from `cero({ bluetooth: true })`).
+     */
+    constructor(handle: object, { backend, autoStart }?: {
+        backend?: any;
+        autoStart?: boolean;
+    });
+    _handle: any;
+    _backend: any;
+    _autoStart: boolean;
+    _transport: BluetoothTransport;
+    _announces: Set<any>;
+    /** @type {'unsupported'|'unauthorized'|'off'|'waiting'|'starting'|'on'} */
+    state: "unsupported" | "unauthorized" | "off" | "waiting" | "starting" | "on";
+    /**
+     * Offline join rendezvous. Both sides derive the same BLE service UUID from
+     * the invite, so they find each other with zero DHT: the host calls this
+     * while the invite QR is on screen; the joiner's `open(me.room, invite)`
+     * calls it automatically for the duration of the join. Returns a stop
+     * function — closing the QR must stop the advertisement so a photographed
+     * invite doesn't stay an ambient admission ticket. Auto-stops at the
+     * invite's expiry, on `bluetooth.stop()`, and on close.
+     *
+     * @param {string} invite  Z32 invite string.
+     * @returns {() => void}
+     */
+    announce(invite: string): () => void;
+    /** @returns {Map<string, any>} Live BLE links, keyed by peer node id. */
+    get peers(): Map<string, any>;
+    /**
+     * Begin advertising + scanning on the channel-derived UUID. Idempotent.
+     * No-op (stays `unsupported`) when no backend is present.
+     *
+     * @returns {Promise<void>}
+     */
+    start(): Promise<void>;
+    /**
+     * Stop advertising/scanning and drop links. Idempotent. Sync stops; local
+     * data and the rest of the network (DHT) are untouched.
+     *
+     * @returns {Promise<void>}
+     */
+    stop(): Promise<void>;
+}
+import ReadyResource from 'ready-resource';
+import { BluetoothTransport } from '@cero-base/core/network/bluetooth';

package/types/build/index.d.ts

@@ -1,5 +1,6 @@
-export function build(specDir: any, schema: any, { ns }?: {
+export function build(specDir: any, schema: any, { ns, extensions }?: {
     ns?: string;
+    extensions?: boolean;
 }): Promise<void>;
 export { getHyperdbType } from "./builtins.js";
 export type Schema = import("@cero-base/core/schema").Schema;

package/types/build/schemas.d.ts

@@ -118,6 +118,8 @@ export const rpc: {
     'req-invite': {
         handle: import("@cero-base/core").Prim;
         role: import("@cero-base/core").Prim;
+        expiresIn: import("@cero-base/core").Prim;
+        multiUse: import("@cero-base/core").Prim;
     };
     'req-revoke': {
         handle: import("@cero-base/core").Prim;

package/types/extensions/handle-sync.d.ts

@@ -12,6 +12,8 @@
 export function handleSync({ fields }?: {
     fields?: Record<string, any>;
 }): {
+    name: string;
+    bundled: boolean;
     schema: {
         handles: {
             kind: "extend";

package/types/extensions/profile-sync.d.ts

@@ -10,6 +10,8 @@
 export function profileSync({ fields }?: {
     fields?: Record<string, any>;
 }): {
+    name: string;
+    bundled: boolean;
     schema: {
         profile: import("@cero-base/core").TypeDef;
         members: {

package/types/handle/index.d.ts

@@ -20,6 +20,7 @@ export { Ref } from "../lib/utils.js";
  * @property {Uint8Array} [encryptionKey]      Existing encryption key.
  * @property {string} [namespace]              Corestore namespace.
  * @property {KeyPair} [keyPair]               Writer keypair.
+ * @property {boolean} [passive]               Join discovery server-only; flip later with `setActive`.
  * @property {boolean} [pair]                  When `false`, skips creating a `Pairing` session.
  *
  * @typedef {object} CreateChildOpts
@@ -195,6 +196,15 @@ export class Handle extends ReadyResource {
      * @returns {Promise<void>}
      */
     recover({ timeout }?: RecoverOpts): Promise<void>;
+    /**
+     * Flip this handle's swarm announce mode — `setActive(false)` demotes an
+     * idle/background room to server-only (still reachable, stops searching);
+     * `setActive(true)` promotes it back on focus. Cheap, safe to call often.
+     *
+     * @param {boolean} active
+     * @returns {Promise<void>}
+     */
+    setActive(active: boolean): Promise<void>;
     /**
      * Mint a pairing invite for this handle.
      *
@@ -368,6 +378,10 @@ export type HandleOpts = {
      * Writer keypair.
      */
     keyPair?: KeyPair;
+    /**
+     * Join discovery server-only; flip later with `setActive`.
+     */
+    passive?: boolean;
     /**
      * When `false`, skips creating a `Pairing` session.
      */

package/types/index.d.ts

@@ -17,6 +17,9 @@
  * @property {(err: any) => void} [onerror]            Background-task error handler.
  * @property {boolean} [recovery]                      Recovery flow — wipe local state and re-claim a writer slot.
  * @property {number} [recoveryTimeout]                Max wait for peer data + writer capability during recovery.
+ * @property {Uint8Array} [storageKey]                 32-byte key encrypting local key material (master seed, device keypairs) at rest. Source it from the OS keychain — cero never stores it.
+ * @property {boolean} [extensions]                    `false` disables the bundled extensions (profileSync, handleSync) for this instance. Build with `{ extensions: false }` too so the spec matches.
+ * @property {boolean | any} [bluetooth]               `true` enables nearby (Bluetooth) sync via `me.bluetooth`; pass a bare-bluetooth-shaped backend to inject one. Absent backend → `me.bluetooth.state === 'unsupported'`.
  */
 /**
  * Open (or create) a cero handle at `dir`. Sets up storage, network and
@@ -47,7 +50,7 @@ export namespace cero {
     export { bind };
     export { define };
     export { internal as _internal };
-    export function use(...exts: any[]): number;
+    export function use(...exts: any[]): void;
 }
 /**
  * Restore a cero instance from a mnemonic phrase. Closes the running
@@ -121,6 +124,18 @@ export type CeroOpts = {
      * Max wait for peer data + writer capability during recovery.
      */
     recoveryTimeout?: number;
+    /**
+     * 32-byte key encrypting local key material (master seed, device keypairs) at rest. Source it from the OS keychain — cero never stores it.
+     */
+    storageKey?: Uint8Array;
+    /**
+     * `false` disables the bundled extensions (profileSync, handleSync) for this instance. Build with `{ extensions: false }` too so the spec matches.
+     */
+    extensions?: boolean;
+    /**
+     * `true` enables nearby (Bluetooth) sync via `me.bluetooth`; pass a bare-bluetooth-shaped backend to inject one. Absent backend → `me.bluetooth.state === 'unsupported'`.
+     */
+    bluetooth?: boolean | any;
 };
 import { t } from './lib/spec.js';
 import { put } from './lib/operators.js';

package/types/lib/internal.d.ts

@@ -1,3 +1,24 @@
 export namespace internal {
-    let extensions: any[];
+    let extensions: ({
+        name: string;
+        bundled: boolean;
+        schema: {
+            profile: import("@cero-base/core").TypeDef;
+            members: {
+                kind: "extend";
+                fields: Record<string, import("@cero-base/core").Prim>;
+            };
+        };
+        setup(me: any): void;
+    } | {
+        name: string;
+        bundled: boolean;
+        schema: {
+            handles: {
+                kind: "extend";
+                fields: Record<string, import("@cero-base/core").Prim>;
+            };
+        };
+        setup(me: any): void;
+    })[];
 }

package/types/lib/operators.d.ts

@@ -45,13 +45,7 @@ export function bind(handle: any, arg: Record<string, any> | string | null): any
 export function define(map: Record<string, any>): void;
 /** Test seam: clear all registered operators. */
 export function _clearDefined(): void;
-export function put(ref: Ref, row: Record<string, any>): Promise<SingleResult | {
-    id: string;
-    name?: string;
-    type: string;
-    size: number;
-    url: string;
-}>;
+export function put(ref: Ref, row: Record<string, any>): Promise<SingleResult>;
 export function set(ref: Ref, row: Record<string, any>, opts?: {
     upsert?: boolean;
 }): Promise<SingleResult>;

package/types/local/index.d.ts

@@ -2,6 +2,7 @@
  * @typedef {object} LocalOpts
  * @property {any} [root]   Pre-existing HypercoreStorage to reuse.
  * @property {any} [store]  Pre-existing Corestore to reuse.
+ * @property {Uint8Array} [storageKey]  32-byte key encrypting the local store at rest.
  */
 /**
  * Per-device, single-writer storage for cero — holds the master seed,
@@ -14,7 +15,7 @@ export class Local extends ReadyResource {
      * @param {any} spec            Built cero spec — must include `spec.local.database` and `spec.meta.local`.
      * @param {LocalOpts} [opts]
      */
-    constructor(dir: string | null, spec: any, { root, store }?: LocalOpts);
+    constructor(dir: string | null, spec: any, { root, store, storageKey }?: LocalOpts);
     dir: string;
     spec: any;
     store: Storage;
@@ -28,6 +29,10 @@ export type LocalOpts = {
      * Pre-existing Corestore to reuse.
      */
     store?: any;
+    /**
+     * 32-byte key encrypting the local store at rest.
+     */
+    storageKey?: Uint8Array;
 };
 import ReadyResource from 'ready-resource';
 import { Storage } from '@cero-base/core/storage';

package/src/CLAUDE.md

@@ -1,3 +0,0 @@
-<claude-mem-context>
-
-</claude-mem-context>

package/src/build/CLAUDE.md

@@ -1,3 +0,0 @@
-<claude-mem-context>
-
-</claude-mem-context>

package/src/extensions/CLAUDE.md

@@ -1,3 +0,0 @@
-<claude-mem-context>
-
-</claude-mem-context>