@cero-base/cero 1.1.1 → 1.3.0

package/src/handle/index.js

@@ -9,7 +9,7 @@ import z32 from 'z32'
 import { Identity } from '@cero-base/core/identity'
 import { Database } from '@cero-base/core/database'
 import { Pairing } from '@cero-base/core/pairing'
-import { toId, grants } from '@cero-base/core/utils'
+import { toId, grants, addWriterPayload } from '@cero-base/core/utils'
 import { CeroError } from '@cero-base/core/errors'
 import { Blobs } from '@cero-base/core/blobs'
 import { FileServer } from '@cero-base/core/blobs/server'
@@ -42,6 +42,7 @@ export { Ref } from '../lib/utils.js'
  * @property {Uint8Array} [encryptionKey]      Existing encryption key.
  * @property {string} [namespace]              Corestore namespace.
  * @property {KeyPair} [keyPair]               Writer keypair.
+ * @property {boolean} [passive]               Join discovery server-only; flip later with `setActive`.
  * @property {boolean} [pair]                  When `false`, skips creating a `Pairing` session.
  *
  * @typedef {object} CreateChildOpts
@@ -132,6 +133,7 @@ export class Handle extends ReadyResource {
       encryptionKey: opts.encryptionKey,
       namespace: opts.namespace,
       keyPair: opts.keyPair,
+      passive: opts.passive,
       onerror: this._onerror
     })
     this.pair = null
@@ -156,6 +158,8 @@ export class Handle extends ReadyResource {
 
   async _close() {
     this.root._coreKeys.delete(b4a.toString(this.store.key, 'hex'))
+    if (this._blobs?.key) this.root._coreKeys.delete(b4a.toString(this._blobs.key, 'hex'))
+    for (const hex of this._blobKeys || []) this.root._coreKeys.delete(hex)
     for (const r of [...this._owned]) r.destroy?.()
     this._owned.clear()
     if (this._blobs) await this._blobs.close()
@@ -302,7 +306,7 @@ export class Handle extends ReadyResource {
             this.root._coreKeys.set(b4a.toString(this._blobs.key, 'hex'), this.store.encryptionKey)
           }
         })
-        .catch(() => {})
+        .catch(this._onerror)
     }
     return this._blobs
   }
@@ -359,6 +363,18 @@ export class Handle extends ReadyResource {
     await this.store.bee.update()
   }
 
+  /**
+   * Flip this handle's swarm announce mode — `setActive(false)` demotes an
+   * idle/background room to server-only (still reachable, stops searching);
+   * `setActive(true)` promotes it back on focus. Cheap, safe to call often.
+   *
+   * @param {boolean} active
+   * @returns {Promise<void>}
+   */
+  setActive(active) {
+    return this.store.setActive(active)
+  }
+
   /**
    * Mint a pairing invite for this handle.
    *
@@ -405,6 +421,11 @@ export class Handle extends ReadyResource {
       throw CeroError.INVALID(`role '${role}' exceeds the invite role '${candidate.invite.role}'`)
     }
 
+    // confirm must answer within the incoming pairing request's lifetime —
+    // any await before it (even ~100ms) and the response is dropped, the
+    // joiner times out. So the key is revealed before the membership writes
+    // land; if they fail the joiner holds the key un-admitted, which is
+    // recoverable (re-pair) and surfaced via onerror in _wireAccept.
     await candidate.confirm({ key: this.store.key, encryptionKey: this.store.encryptionKey })
 
     const ts = Date.now()
@@ -423,7 +444,9 @@ export class Handle extends ReadyResource {
       return
     }
 
-    const sig = this.identity.sign(b4a.concat([writerKey, this.store.writerKey]))
+    const sig = this.identity.sign(
+      addWriterPayload(this.store.key, writerKey, this.store.writerKey)
+    )
     await this.store.tx(async () => {
       await this.store.call('add-writer', {
         sig,
@@ -480,7 +503,7 @@ export class Handle extends ReadyResource {
       await child.store.call('add-writer', {
         master: this.identity.publicKey,
         writer: writerKey,
-        sig: this.identity.sign(b4a.concat([writerKey, child.store.writerKey]))
+        sig: this.identity.sign(addWriterPayload(child.store.key, writerKey, child.store.writerKey))
       })
       await child.store.call('add-member', {
         id: this.identity.id,
@@ -535,6 +558,10 @@ export class Handle extends ReadyResource {
       if (existing) return this._load(type, existing.id)
     }
 
+    // offline join: with nearby sync on, also rendezvous on the invite-derived
+    // BLE UUID for the duration of the join — pairing rides the injected link
+    const stopNearby = this.root.bluetooth ? this.root.bluetooth.announce(invite) : null
+
     const child = /** @type {Child} */ (
       await Handle.join(invite, {
         parent: this,
@@ -542,7 +569,7 @@ export class Handle extends ReadyResource {
         namespace: `${NS}/handle/${type}/${randomNs()}`,
         routes,
         timeout
-      })
+      }).finally(() => stopNearby?.())
     )
     // whenWritable timing out (host offline) is a normal failure — close the
     // fully-opened child rather than leak its Database/pairing/swarm session
@@ -607,7 +634,8 @@ export class Handle extends ReadyResource {
   async _reopen(type, id) {
     const { data } = await this.store.get('handles', id)
     if (!data) throw CeroError.UNKNOWN('handle', id)
-    if (data.type !== type) throw new Error(`handle ${id} is type ${data.type}, not ${type}`)
+    if (data.type !== type)
+      throw CeroError.INVALID(`handle ${id} is type ${data.type}, not ${type}`)
     let writer = await this._loadKeyPair(id)
     const firstTime = !writer
     if (firstTime) {
@@ -643,7 +671,7 @@ export class Handle extends ReadyResource {
   async suspend() {
     if (this.parent || this.closing || this.closed || this._suspended) return
     this._suspended = true
-    for (const c of this.children) if (c.pair) await c.pair.suspend()
+    await Promise.all([...this.children].map((c) => c.pair?.suspend()))
     await this.network.suspend()
     try {
       await this.store.store.suspend()
@@ -683,10 +711,10 @@ export class Handle extends ReadyResource {
   ) {
     const net = network || parent?.network
     const id = identity || parent?.identity
-    if (!net) throw new TypeError('network is required')
-    if (!id) throw new TypeError('identity is required')
-    if (!store && !parent) throw new TypeError('store is required')
-    if (!spec) throw new TypeError('spec is required')
+    if (!net) throw CeroError.REQUIRED('network')
+    if (!id) throw CeroError.REQUIRED('identity')
+    if (!store && !parent) throw CeroError.REQUIRED('store')
+    if (!spec) throw CeroError.REQUIRED('spec')
 
     const writer = Identity.randomKeyPair()
     const pair = new Pairing({ network: net, identity: id })

package/src/index.js

@@ -9,6 +9,7 @@ import { CeroError } from '@cero-base/core/errors'
 
 import { Handle, Ref } from './handle/index.js'
 import { Local } from './local/index.js'
+import { Bluetooth } from './bluetooth.js'
 import {
   put,
   set,
@@ -66,6 +67,9 @@ export { t, schema } from './lib/spec.js'
  * @property {(err: any) => void} [onerror]            Background-task error handler.
  * @property {boolean} [recovery]                      Recovery flow — wipe local state and re-claim a writer slot.
  * @property {number} [recoveryTimeout]                Max wait for peer data + writer capability during recovery.
+ * @property {Uint8Array} [storageKey]                 32-byte key encrypting local key material (master seed, device keypairs) at rest. Source it from the OS keychain — cero never stores it.
+ * @property {boolean} [extensions]                    `false` disables the bundled extensions (profileSync, handleSync) for this instance. Build with `{ extensions: false }` too so the spec matches.
+ * @property {boolean | { autoStart?: boolean, backend?: any }} [bluetooth]  `true` enables nearby (Bluetooth) sync via `me.bluetooth` (auto-started). `{ autoStart: false }` creates the facade without starting the radio — the app calls `me.bluetooth.start()`/`stop()` (user toggle). `backend` injects a bare-bluetooth-shaped backend (tests); absent backend on an unsupported host → `me.bluetooth.state === 'unsupported'`.
  */
 
 /**
@@ -93,24 +97,27 @@ export async function cero(dir, spec, opts = {}) {
   // lock leaks and a retry in the same process hits locked storage.
   try {
     await storage.ready()
+    await fs.promises.chmod(`${dir}/main`, 0o700)
     store = new Corestore(storage, { manifestVersion: 2 })
     await store.ready()
 
     if (spec.local && spec.meta?.local) {
-      local = new Local(null, spec, { store })
+      local = new Local(null, spec, { store, storageKey: opts.storageKey })
       await local.ready()
     }
 
     const identity = await resolveIdentity(opts, local)
     const writer = local ? (await local.store.get('keypair')).data : null
 
-    // Channel stamp: a storage remembers its channel; reopening it under a different channel is a
-    // misconfiguration that could leak data across networks, so reject it. Only when a channel is
-    // set (no channel = global, no stamp, unchanged).
-    if (local && opts.channel) {
-      const stored = (await local.store.get('environment')).data?.channel
-      if (stored == null) await local.store.set('environment', { channel: opts.channel })
-      else if (stored !== opts.channel) throw CeroError.CHANNEL_MISMATCH()
+    // Channel stamp: a storage remembers its channel; reopening it under a different channel —
+    // including no channel at all, which would silently rejoin the global network — is a
+    // misconfiguration that could leak data across networks, so reject it.
+    if (local) {
+      const stored = (await local.store.get('environment')).data?.channel ?? null
+      const wanted = opts.channel ?? null
+      if (stored == null && wanted != null)
+        await local.store.set('environment', { channel: wanted })
+      else if (stored != null && stored !== wanted) throw CeroError.CHANNEL_MISMATCH()
     }
 
     network = new Network({ bootstrap: opts.bootstrap, channel: opts.channel })
@@ -164,10 +171,28 @@ export async function cero(dir, spec, opts = {}) {
     if (opts.recovery) await me.recover({ timeout: opts.recoveryTimeout })
 
     for (const ext of internal.extensions) {
+      if (ext.bundled && opts.extensions === false) continue
       const off = await ext.setup?.(me)
       if (typeof off === 'function') me.once('close', off)
     }
 
+    if (opts.bluetooth) {
+      // `true` → defaults; `{ autoStart, backend }` → options. A bare backend
+      // object (pre-1.3 shape, has Central/Server) is still accepted.
+      const bt =
+        opts.bluetooth === true
+          ? {}
+          : opts.bluetooth.Central
+            ? { backend: opts.bluetooth }
+            : opts.bluetooth
+      me.bluetooth = new Bluetooth(me, {
+        backend: bt.backend || null,
+        autoStart: bt.autoStart !== false
+      })
+      me.once('close', () => me.bluetooth.close().catch(safetyCatch))
+      await me.bluetooth.ready()
+    }
+
     bind(me, null)
     return me
   } catch (err) {
@@ -205,7 +230,17 @@ export async function restore(me, phrase) {
   const { _dir: dir, spec, _opts: opts } = me
   // channel must carry over — without it the recovered instance rejoins the
   // global identity topic and never meets its channeled peers (recovery timeout).
-  const { name, bootstrap, isMobile, onerror, routes, recoveryTimeout, channel } = opts
+  const {
+    name,
+    bootstrap,
+    isMobile,
+    onerror,
+    routes,
+    recoveryTimeout,
+    channel,
+    storageKey,
+    extensions
+  } = opts
 
   await me.close()
   await fs.promises.rm(`${dir}/main`, { recursive: true, force: true })
@@ -218,6 +253,8 @@ export async function restore(me, phrase) {
     routes,
     recoveryTimeout,
     channel,
+    storageKey,
+    extensions,
     phrase,
     recovery: true
   })
@@ -242,11 +279,20 @@ cero.restore = restore
 cero.schema = schema
 cero.bind = bind
 cero.define = define
+// test-only escape hatch (cross-package tests reset/seed the registry)
 cero._internal = internal
 // A bare function is shorthand for a behavior-only extension: `{ setup: fn }`.
 // Accepts both `use(a, b)` and `use([a, b])` (and a mix) for easier composition.
-cero.use = (...exts) =>
-  internal.extensions.push(...exts.flat().map((e) => (typeof e === 'function' ? { setup: e } : e)))
+// A named extension replaces any registered one with the same name — so
+// `use(profileSync({ fields }))` reconfigures the bundled default instead of
+// doubling it.
+cero.use = (...exts) => {
+  for (const e of exts.flat().map((e) => (typeof e === 'function' ? { setup: e } : e))) {
+    const i = e.name ? internal.extensions.findIndex((x) => x.name === e.name) : -1
+    if (i >= 0) internal.extensions[i] = e
+    else internal.extensions.push(e)
+  }
+}
 
 async function resolveIdentity(opts, local) {
   if (opts.identity) return opts.identity

package/src/lib/internal.js

@@ -1,3 +1,9 @@
 // Process-wide registry for extensions registered via `cero.use()`.
 // `build()` folds in each extension's schema; `cero()` runs each setup.
-export const internal = { extensions: [] }
+// The bundled extensions are on by default — `cero.use(profileSync({...}))`
+// replaces a default by name, `{ extensions: false }` (on build and cero)
+// leaves them out entirely.
+import { profileSync } from '../extensions/profile-sync.js'
+import { handleSync } from '../extensions/handle-sync.js'
+
+export const internal = { extensions: [profileSync(), handleSync()] }

package/src/lib/operators.js

@@ -1,4 +1,5 @@
 import { Readable } from 'streamx'
+import b4a from 'b4a'
 
 import { encodeId, decodeId } from '@cero-base/core/blobs/codec'
 import { onAbort } from './utils.js'
@@ -30,11 +31,11 @@ export function resolveFile(handle, id, name) {
 /**
  * Insert (or overwrite by id) a row on `ref`. The `files` builtin is special:
  * `put(handle.files, { data, type, name? })` uploads the bytes to this handle's
- * blob store, records `{ id, name }`, and returns the resolved file.
+ * blob store, records `{ id, name }`, and resolves the file.
  *
  * @param {Ref} ref
  * @param {Record<string, any>} row
- * @returns {Promise<SingleResult | { id: string, name?: string, type: string, size: number, url: string }>}
+ * @returns {Promise<SingleResult>}
  */
 export const put = (ref, row) =>
   ref.name === 'files' ? putFile(ref, row) : ref.handle.store.put(ref.name, row)
@@ -47,7 +48,7 @@ async function putFile(ref, row) {
   const blobId = await handle.blobs.put(data)
   const id = encodeId(handle.blobs.key, blobId, type)
   await handle.store.call('add-file', { id, name })
-  return resolveFile(handle, id, name)
+  return { data: resolveFile(handle, id, name) }
 }
 
 /**
@@ -186,10 +187,13 @@ function registerBlobCore(handle, id) {
   if (!id || !handle.root?._coreKeys) return
   try {
     const { coreKey } = decodeId(id)
-    const hex = Buffer.from(coreKey).toString('hex')
+    const hex = b4a.toString(coreKey, 'hex')
     if (!handle.root._coreKeys.has(hex)) {
       handle.root._coreKeys.set(hex, handle.root.store.encryptionKey)
     }
+    // remember which handle read it, so close prunes the entry (re-registered
+    // on the next read if another handle still serves the same core)
+    if (handle !== handle.root) (handle._blobKeys ??= new Set()).add(hex)
   } catch {
     // ignore invalid ids
   }
@@ -239,28 +243,44 @@ export const watch = (ref, q, opts) => {
   const owner = ref.handle
   if (ref.kind !== 'handle') {
     const src = owner.store.watch(ref.name, q)
-    const out = new Readable({
-      destroy(cb) {
-        src.destroy()
-        cb(null)
-      }
-    })
-    src.on('data', (res) => out.push(resolveResult(ref, res)))
-    src.on('end', () => out.push(null))
-    src.on('error', (err) => out.destroy(err))
+    const out = snapshotStream(src, (res) => resolveResult(ref, res))
     return bindStream(owner, out, opts)
   }
   const source = parentStore(ref).watch('handles', q)
+  const out = snapshotStream(source, (snap) => normalize(snap?.data, ref.name))
+  return bindStream(owner, out, opts)
+}
+
+// Snapshots are idempotent — under a slow consumer hold only the NEWEST one
+// instead of queueing every intermediate (a busy room + un-drained reader
+// used to buffer full result sets without bound).
+function snapshotStream(src, map) {
+  let pending
+  let wanted = false
   const out = new Readable({
+    read(cb) {
+      wanted = true
+      flush()
+      cb(null)
+    },
     destroy(cb) {
-      source.destroy()
+      src.destroy()
       cb(null)
     }
   })
-  source.on('data', (snap) => out.push(normalize(snap?.data, ref.name)))
-  source.on('end', () => out.push(null))
-  source.on('error', (err) => out.destroy(err))
-  return bindStream(owner, out, opts)
+  const flush = () => {
+    if (!wanted || pending === undefined || out.destroyed) return
+    const snap = pending
+    pending = undefined
+    wanted = out.push(snap) !== false
+  }
+  src.on('data', (res) => {
+    pending = map(res)
+    flush()
+  })
+  src.on('end', () => out.push(null))
+  src.on('error', (err) => out.destroy(err))
+  return out
 }
 
 // Universal signal instantiator. Dispatch on the second arg:

package/src/local/index.js

@@ -9,6 +9,7 @@ import { attachRefs } from '../lib/utils.js'
  * @typedef {object} LocalOpts
  * @property {any} [root]   Pre-existing HypercoreStorage to reuse.
  * @property {any} [store]  Pre-existing Corestore to reuse.
+ * @property {Uint8Array} [storageKey]  32-byte key encrypting the local store at rest.
  */
 
 /**
@@ -22,7 +23,7 @@ export class Local extends ReadyResource {
    * @param {any} spec            Built cero spec — must include `spec.local.database` and `spec.meta.local`.
    * @param {LocalOpts} [opts]
    */
-  constructor(dir, spec, { root, store } = {}) {
+  constructor(dir, spec, { root, store, storageKey } = {}) {
     super()
     if (!root && !store && (typeof dir !== 'string' || !dir))
       throw CeroError.REQUIRED('dir, root, or store')
@@ -34,7 +35,8 @@ export class Local extends ReadyResource {
     this.store = Storage.bee(dir, {
       spec: { database: spec.local.database, meta: spec.meta.local },
       root,
-      store
+      store,
+      storageKey
     })
   }
 

package/src/rpc/client.js

@@ -152,7 +152,7 @@ const operators = {
   async put(name, row) {
     const codec = this._codec()
     const schema = this.schemaOf(name)
-    if (row && row.data != null) {
+    if (name === 'files') {
       const res = await this.rpc.addFile({
         handle: this.id,
         data: row.data,
@@ -225,7 +225,11 @@ const operators = {
       info?.kind === 'single'
         ? codec.decodeRow(schema, res.data)
         : codec.decodeRows(schema, res.data)
-    return { data: this._resolveFiles(name, raw), total: res.total, size: res.size }
+    return {
+      data: this._resolveFiles(name, raw),
+      total: res.total === -1 ? null : res.total,
+      size: res.size
+    }
   },
 
   /**
@@ -285,7 +289,11 @@ const operators = {
         refInfo.kind === 'single'
           ? (codec.decodeRow(schema, snap.data) ?? null)
           : codec.decodeRows(schema, snap.data)
-      out.push({ data: this._resolveFiles(name, raw), total: snap.total, size: snap.size })
+      out.push({
+        data: this._resolveFiles(name, raw),
+        total: snap.total === -1 ? null : snap.total,
+        size: snap.size
+      })
     })
     // end exactly once whether the wire ends or the server destroys it (handle close)
     let ended = false
@@ -320,8 +328,13 @@ const operators = {
    * @param {{ role?: string }} [opts]
    * @returns {Promise<string>}
    */
-  async invite({ role } = {}) {
-    const { invite } = await this.rpc.invite({ handle: this.id, role: role || '' })
+  async invite({ role, expiresIn, multiUse } = {}) {
+    const { invite } = await this.rpc.invite({
+      handle: this.id,
+      role: role || '',
+      expiresIn: expiresIn || 0,
+      multiUse: multiUse === true
+    })
     return invite
   },
 

package/src/rpc/server.js

@@ -88,7 +88,7 @@ export class Server extends RPCServer {
   /** Wire the `init` handler that lazily constructs the root cero handle. */
   _wireInit() {
     this.rpc.onInit(async () => {
-      if (this.me) throw new CeroError('CONFLICT', 'already initialized')
+      if (this.me) throw CeroError.CONFLICT('already initialized')
       this.me = await cero(this.storage, this.spec, this.opts)
       this.handles.set(this.me.id, this.me)
       await this.me.fileServer.listen()
@@ -104,7 +104,7 @@ export class Server extends RPCServer {
   /** Wire the `restore` handler that rebuilds the local store from a phrase. */
   _wireRestore() {
     this.rpc.onRestore(async ({ phrase }) => {
-      if (!this.me) throw new CeroError('NOT_READY', 'init')
+      if (!this.me) throw CeroError.NOT_READY('Server', 'server')
       this.me = await restore(this.me, phrase)
       this.handles = new Map([[this.me.id, this.me]])
       return this._identity()
@@ -144,7 +144,8 @@ export class Server extends RPCServer {
         r.kind === 'single'
           ? codec.encodeRow(r.schema, result.data)
           : codec.encodeRows(r.schema, result.data)
-      return { data, total: result.total ?? 0, size: result.size ?? 0 }
+      // total is int on the wire: -1 encodes "skipped" (null), see T2.1 lazy total
+      return { data, total: result.total ?? -1, size: result.size ?? 0 }
     })
 
     this.rpc.onGetOne(async ({ handle, ref, id, local }) => {
@@ -179,12 +180,30 @@ export class Server extends RPCServer {
         stream.destroy()
         return
       }
+      // keep-latest under IPC backpressure: snapshots are idempotent, so an
+      // un-drained wire holds one pending snapshot (newest wins) instead of
+      // queueing every intermediate result set — encode only what ships
+      let pending = null
+      let blocked = false
       const onData = (snap) => {
+        if (blocked) {
+          pending = snap
+          return
+        }
         const data =
           r.kind === 'single'
             ? codec.encodeRow(r.schema, snap.data)
             : codec.encodeRows(r.schema, snap.data)
-        stream.write({ data, total: snap.total ?? 0, size: snap.size ?? 0 })
+        blocked = stream.write({ data, total: snap.total ?? -1, size: snap.size ?? 0 }) === false
+        if (blocked) {
+          stream.once('drain', () => {
+            blocked = false
+            if (pending === null) return
+            const next = pending
+            pending = null
+            onData(next)
+          })
+        }
       }
       let set = this._watchStreams.get(handle)
       if (!set) this._watchStreams.set(handle, (set = new Set()))
@@ -208,9 +227,13 @@ export class Server extends RPCServer {
 
   /** Register invite/revoke/join RPC handlers. */
   _wirePairing() {
-    this.rpc.onInvite(async ({ handle, role }) => {
+    this.rpc.onInvite(async ({ handle, role, expiresIn, multiUse }) => {
       const h = this._resolve(handle)
-      const invite = await h.invite({ role: role || undefined })
+      const invite = await h.invite({
+        role: role || undefined,
+        expiresIn: expiresIn || undefined,
+        multiUse: multiUse === true
+      })
       return { invite }
     })
 
@@ -328,7 +351,7 @@ export class Server extends RPCServer {
   /** Wire the on-demand `seed` handler — surfaces the recovery phrase only when asked. */
   _wireSeed() {
     this.rpc.onSeed(async () => {
-      if (!this.me) throw new CeroError('NOT_READY', 'init')
+      if (!this.me) throw CeroError.NOT_READY('Server', 'server')
       return { phrase: this.me.identity.toPhrase() }
     })
   }

package/types/bluetooth.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `me.bluetooth` — the whole app-facing surface for nearby (Bluetooth) sync.
+ * Bluetooth is a cero feature, not a parallel API: it only changes how peers
+ * meet and carry bytes; capability-gated replication still decides what syncs.
+ *
+ * ```js
+ * const me = await cero(dir, spec, { channel, bluetooth: true })
+ * me.bluetooth.state          // 'unsupported' | 'unauthorized' | 'off' | 'waiting' | 'on'
+ * await me.bluetooth.start()
+ * me.bluetooth.peers          // Map of live BLE links
+ * me.bluetooth.on('update', () => {})
+ * ```
+ *
+ * @extends ReadyResource
+ */
+export class Bluetooth extends ReadyResource {
+    /**
+     * @param {object} handle           Root cero Handle (network + identity + channel).
+     * @param {object} [opts]
+     * @param {any} [opts.backend]      Injected bare-bluetooth-shaped backend (tests); lazy-loaded when absent.
+     * @param {boolean} [opts.autoStart]  Start on handle open (from `cero({ bluetooth: true })`).
+     */
+    constructor(handle: object, { backend, autoStart }?: {
+        backend?: any;
+        autoStart?: boolean;
+    });
+    _handle: any;
+    _backend: any;
+    _autoStart: boolean;
+    _transport: BluetoothTransport;
+    _name: any;
+    _announces: Set<any>;
+    /** @type {'unsupported'|'unauthorized'|'off'|'waiting'|'starting'|'on'} */
+    state: "unsupported" | "unauthorized" | "off" | "waiting" | "starting" | "on";
+    /**
+     * Offline join rendezvous. Both sides derive the same BLE service UUID from
+     * the invite, so they find each other with zero DHT: the host calls this
+     * while the invite QR is on screen; the joiner's `open(me.room, invite)`
+     * calls it automatically for the duration of the join. Returns a stop
+     * function — closing the QR must stop the advertisement so a photographed
+     * invite doesn't stay an ambient admission ticket. Auto-stops at the
+     * invite's expiry, on `bluetooth.stop()`, and on close.
+     *
+     * @param {string} invite  Z32 invite string.
+     * @returns {() => void}
+     */
+    announce(invite: string): () => void;
+    /** @returns {Map<string, any>} Live BLE links, keyed by peer node id. */
+    get peers(): Map<string, any>;
+    /**
+     * Begin advertising + scanning on the channel-derived UUID. Idempotent.
+     * No-op (stays `unsupported`) when no backend is present.
+     *
+     * @returns {Promise<void>}
+     */
+    start({ name }?: {}): Promise<void>;
+    /**
+     * Stop advertising/scanning and drop links. Idempotent. Sync stops; local
+     * data and the rest of the network (DHT) are untouched.
+     *
+     * @returns {Promise<void>}
+     */
+    stop(): Promise<void>;
+}
+import ReadyResource from 'ready-resource';
+import { BluetoothTransport } from '@cero-base/core/network/bluetooth';

package/types/build/index.d.ts

@@ -1,5 +1,6 @@
-export function build(specDir: any, schema: any, { ns }?: {
+export function build(specDir: any, schema: any, { ns, extensions }?: {
     ns?: string;
+    extensions?: boolean;
 }): Promise<void>;
 export { getHyperdbType } from "./builtins.js";
 export type Schema = import("@cero-base/core/schema").Schema;

package/types/build/schemas.d.ts

@@ -118,6 +118,8 @@ export const rpc: {
     'req-invite': {
         handle: import("@cero-base/core").Prim;
         role: import("@cero-base/core").Prim;
+        expiresIn: import("@cero-base/core").Prim;
+        multiUse: import("@cero-base/core").Prim;
     };
     'req-revoke': {
         handle: import("@cero-base/core").Prim;

package/types/extensions/handle-sync.d.ts

@@ -12,6 +12,8 @@
 export function handleSync({ fields }?: {
     fields?: Record<string, any>;
 }): {
+    name: string;
+    bundled: boolean;
     schema: {
         handles: {
             kind: "extend";

package/types/extensions/profile-sync.d.ts

@@ -10,6 +10,8 @@
 export function profileSync({ fields }?: {
     fields?: Record<string, any>;
 }): {
+    name: string;
+    bundled: boolean;
     schema: {
         profile: import("@cero-base/core").TypeDef;
         members: {