@dcasegr/skein 0.0.0-stage → 0.1.2

package/dist/host/signer.d.ts

@@ -0,0 +1,49 @@
+import { PrivateKey, type WalletInterface, type WalletProtocol } from "@bsv/sdk";
+export declare const INSTANCE_PROTOCOL: WalletProtocol;
+export declare const PROVIDER_PROTOCOL: WalletProtocol;
+/** The master secret: SKEIN_MASTER_KEY, else the file (created if absent). */
+export declare function masterKey(vars: Record<string, string | undefined>, home: string): PrivateKey;
+/** One-key mode (#160): the provisioned key's settings — SKEIN_KEY (hex) or SKEIN_KEY_FILE — if either is set. */
+export declare function oneKeySetting(vars: Record<string, string | undefined>): boolean;
+/**
+ * The one key (#160): SKEIN_KEY (hex), else the file SKEIN_KEY_FILE names, read and never made (the
+ * host is provisioned with it). Refused together with SKEIN_MASTER_KEY or SKEIN_MASTER_KEY_FILE.
+ */
+export declare function oneKey(vars: Record<string, string | undefined>): PrivateKey;
+/** The host's signer by its settings (#160): one-key mode when SKEIN_KEY / SKEIN_KEY_FILE is set, else the master key's (made if absent). */
+export declare function signerOf(vars: Record<string, string | undefined>, home: string): Signer;
+export declare class Signer {
+    private readonly deriver;
+    private readonly wallets;
+    readonly master: PrivateKey;
+    /** One-key mode (#160): the key every instance signs with (Signer.oneKey); undefined: the master's derivation per instance. */
+    readonly shared?: PrivateKey;
+    constructor(master: PrivateKey, shared?: boolean);
+    /** One-key mode (#160): every instance's key is `key` itself; providers and the certifier derive from it as from a master. */
+    static oneKey(key: PrivateKey): Signer;
+    /** An instance's root key: BRC-42 child of the master, key ID = the instance id. One-key mode: the key, for every id. */
+    instanceKey(id: string): PrivateKey;
+    /**
+     * An instance's libp2p peer key (#51, #129): a BRC-42 child of the
+     * instance's root key (instanceKey), protocol [2, "skein instance"], key ID
+     * `libp2p:<handle>`, counterparty self — the key whose public half the
+     * instance's signer answers for getPublicKey with those arguments. Not the
+     * root itself. Its peer ID is the identity multihash of the compressed key
+     * (p2p.ts peerIdOf).
+     */
+    peerKey(id: string): PrivateKey;
+    /** The instance's identity key (hex): what `skein-host add` records. */
+    identity(id: string): string;
+    /** The instance's signer: a ProtoWallet over its root key (a WalletInterface whose actions reject). */
+    wallet(id: string): WalletInterface;
+    /**
+     * A provider's key (#70: the HTTP proxy, the waker, the libp2p node, the
+     * broadcaster — providers.ts): a BRC-42 child of the master under
+     * PROVIDER_PROTOCOL, key ID = the provider's name. The same identity for
+     * every instance on this host; each genesis's address book names it. How a
+     * host obtains provider keys is its own business: this is this host's way.
+     */
+    providerKey(name: string): PrivateKey;
+    /** The certifier key (#100): BRC-169's trust anchor, providerKey("certifier"). */
+    certifierKey(): PrivateKey;
+}

package/dist/host/signer.js

@@ -0,0 +1,167 @@
+// The signer (#18, #29): one master secret held by the router, and
+// per instance a root key derived from it with BRC-42/43 — protocol
+// [2, "skein instance"], key ID = the instance id (its handle), counterparty
+// self — behind a ProtoWallet: getPublicKey, createSignature, encrypt,
+// decrypt, createHmac (and their verify halves), no storage, no actions. The
+// instance's identity key is that child's public key; provisioning an
+// instance is picking an id. The router answers the kernel's `wallet` import
+// from it in process (kernel.ts); the router has no identity of its own. Its
+// libp2p host (#51, #129) signs as a child of the INSTANCE's root key: [2,
+// "skein instance"], key ID `libp2p:<handle>`, counterparty self (peerKey) —
+// exactly what the instance's program gets when it asks its signer for that
+// public key, so a program knows its own peer ID. The master is only how this
+// host hands each instance its root. Its providers (#70: the HTTP proxy,
+// the waker, the libp2p node, the broadcaster — providers.ts) are third
+// children, one per provider for the whole host: [2, "skein provider"], key
+// ID = the provider's name (providerKey). The host's BRC-169 certifier key
+// (#100: the manifest's `metanet.trust.publicKey`, the signer of the handle
+// certificates — handles.ts) is the same derivation, key ID `certifier`: not
+// a provider — it takes no messages, and no address book names it.
+//
+// Custody (dev): the secret is a file, `$SKEIN_HOME/master.key` (64 hex
+// digits, mode 0600), made on first use; `SKEIN_MASTER_KEY` (hex) overrides
+// it, `SKEIN_MASTER_KEY_FILE` names another file. KMS/hardware later, behind
+// the same calls.
+//
+// One-key mode (#160): a host provisioned with ONE private key —
+// `SKEIN_KEY_FILE` (a file, 64 hex digits, read and never made: the host is
+// provisioned) or `SKEIN_KEY` (hex); never together with the master key
+// settings. Its signer (Signer.oneKey) answers for every instance with that
+// key directly: instanceKey(id) is the key for every id, so every instance's
+// identity is its public key and its wallet one ProtoWallet over it. The
+// peer key is the key's child [2, "skein instance"], key ID `libp2p`,
+// counterparty self — the same for every id — and a program's
+// getPublicKey([2, "skein instance"], `libp2p:<handle>`, self) is answered
+// with that child: the lookup is by handle as it is in master-key mode, the
+// derivation rule ignores the handle (David, 2026-10-28: "all derive the same
+// way"). The providers' keys and the certifier key are derived from the key
+// as they are from the master. signerOf picks the mode.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { KeyDeriver, PrivateKey, ProtoWallet } from "@bsv/sdk";
+import { ephemeralWallet, keyWallet } from "../wallet.js";
+export const INSTANCE_PROTOCOL = [2, "skein instance"];
+export const PROVIDER_PROTOCOL = [2, "skein provider"];
+/** The master secret: SKEIN_MASTER_KEY, else the file (created if absent). */
+export function masterKey(vars, home) {
+    if (vars.SKEIN_MASTER_KEY)
+        return PrivateKey.fromHex(vars.SKEIN_MASTER_KEY.trim());
+    const file = vars.SKEIN_MASTER_KEY_FILE || join(home, "master.key");
+    if (!existsSync(file)) {
+        mkdirSync(dirname(file), { recursive: true });
+        writeFileSync(file, `${PrivateKey.fromRandom().toHex().padStart(64, "0")}\n`, { mode: 0o600, flag: "wx" });
+    }
+    return PrivateKey.fromHex(readFileSync(file, "utf8").trim());
+}
+/** One-key mode (#160): the provisioned key's settings — SKEIN_KEY (hex) or SKEIN_KEY_FILE — if either is set. */
+export function oneKeySetting(vars) {
+    return !!(vars.SKEIN_KEY || vars.SKEIN_KEY_FILE);
+}
+/**
+ * The one key (#160): SKEIN_KEY (hex), else the file SKEIN_KEY_FILE names, read and never made (the
+ * host is provisioned with it). Refused together with SKEIN_MASTER_KEY or SKEIN_MASTER_KEY_FILE.
+ */
+export function oneKey(vars) {
+    if (vars.SKEIN_MASTER_KEY || vars.SKEIN_MASTER_KEY_FILE)
+        throw new Error("SKEIN_KEY / SKEIN_KEY_FILE (one key for every instance) and SKEIN_MASTER_KEY / SKEIN_MASTER_KEY_FILE (a key derived per instance) are two modes: set one");
+    if (vars.SKEIN_KEY && vars.SKEIN_KEY_FILE)
+        throw new Error("SKEIN_KEY and SKEIN_KEY_FILE: set one");
+    if (vars.SKEIN_KEY)
+        return PrivateKey.fromHex(vars.SKEIN_KEY.trim());
+    const file = vars.SKEIN_KEY_FILE;
+    if (!existsSync(file))
+        throw new Error(`SKEIN_KEY_FILE ${file}: no such file (a one-key host is provisioned with its key: it is never made here)`);
+    return PrivateKey.fromHex(readFileSync(file, "utf8").trim());
+}
+/** The host's signer by its settings (#160): one-key mode when SKEIN_KEY / SKEIN_KEY_FILE is set, else the master key's (made if absent). */
+export function signerOf(vars, home) {
+    return oneKeySetting(vars) ? Signer.oneKey(oneKey(vars)) : new Signer(masterKey(vars, home));
+}
+/** Whether a getPublicKey asks for an instance's peer key by handle: [2, "skein instance"], key ID `libp2p:<handle>`, counterparty self. */
+function peerLookup(args) {
+    if (args.identityKey || !args.protocolID || typeof args.keyID !== "string" || !args.keyID.startsWith("libp2p:"))
+        return false;
+    const [level, name] = args.protocolID;
+    return level === INSTANCE_PROTOCOL[0] && typeof name === "string" && name.trim().toLowerCase() === INSTANCE_PROTOCOL[1] && (args.counterparty === undefined || args.counterparty === "self");
+}
+/**
+ * The one-key host's signer wallet (#160): a ProtoWallet over the key whose getPublicKey for an
+ * instance's peer key by handle ([2, "skein instance"], `libp2p:<handle>`, self) answers the one peer
+ * key (Signer.peerKey: key ID `libp2p`), whatever the handle. Everything else is the ProtoWallet's.
+ */
+class OneKeyWallet extends ProtoWallet {
+    peer;
+    constructor(key, peer) {
+        super(key);
+        this.peer = peer.toPublicKey().toString();
+    }
+    async getPublicKey(args) {
+        if (peerLookup(args))
+            return { publicKey: this.peer };
+        return await super.getPublicKey(args);
+    }
+}
+export class Signer {
+    deriver;
+    wallets = new Map();
+    master;
+    /** One-key mode (#160): the key every instance signs with (Signer.oneKey); undefined: the master's derivation per instance. */
+    shared;
+    constructor(master, shared = false) {
+        this.master = master;
+        this.deriver = new KeyDeriver(master);
+        if (shared)
+            this.shared = master;
+    }
+    /** One-key mode (#160): every instance's key is `key` itself; providers and the certifier derive from it as from a master. */
+    static oneKey(key) {
+        return new Signer(key, true);
+    }
+    /** An instance's root key: BRC-42 child of the master, key ID = the instance id. One-key mode: the key, for every id. */
+    instanceKey(id) {
+        if (this.shared)
+            return this.shared;
+        return this.deriver.derivePrivateKey(INSTANCE_PROTOCOL, id, "self");
+    }
+    /**
+     * An instance's libp2p peer key (#51, #129): a BRC-42 child of the
+     * instance's root key (instanceKey), protocol [2, "skein instance"], key ID
+     * `libp2p:<handle>`, counterparty self — the key whose public half the
+     * instance's signer answers for getPublicKey with those arguments. Not the
+     * root itself. Its peer ID is the identity multihash of the compressed key
+     * (p2p.ts peerIdOf).
+     */
+    peerKey(id) {
+        // #160: one-key mode — the key's child, key ID `libp2p`, the same for every id (the handle is ignored).
+        if (this.shared)
+            return this.deriver.derivePrivateKey(INSTANCE_PROTOCOL, "libp2p", "self");
+        return new KeyDeriver(this.instanceKey(id)).derivePrivateKey(INSTANCE_PROTOCOL, `libp2p:${id}`, "self");
+    }
+    /** The instance's identity key (hex): what `skein-host add` records. */
+    identity(id) {
+        return this.instanceKey(id).toPublicKey().toString();
+    }
+    /** The instance's signer: a ProtoWallet over its root key (a WalletInterface whose actions reject). */
+    wallet(id) {
+        // #160: one-key mode — one wallet for every instance, its peer-key lookup answered by OneKeyWallet.
+        const k = this.shared ? "" : id;
+        let w = this.wallets.get(k);
+        if (!w)
+            this.wallets.set(k, (w = this.shared ? keyWallet(this.shared, new OneKeyWallet(this.shared, this.peerKey(id))) : ephemeralWallet(this.instanceKey(id))));
+        return w;
+    }
+    /**
+     * A provider's key (#70: the HTTP proxy, the waker, the libp2p node, the
+     * broadcaster — providers.ts): a BRC-42 child of the master under
+     * PROVIDER_PROTOCOL, key ID = the provider's name. The same identity for
+     * every instance on this host; each genesis's address book names it. How a
+     * host obtains provider keys is its own business: this is this host's way.
+     */
+    providerKey(name) {
+        return this.deriver.derivePrivateKey(PROVIDER_PROTOCOL, name, "self");
+    }
+    /** The certifier key (#100): BRC-169's trust anchor, providerKey("certifier"). */
+    certifierKey() {
+        return this.providerKey("certifier");
+    }
+}

package/dist/host/store-sqlite.d.ts

@@ -0,0 +1,39 @@
+import { DatabaseSync } from "node:sqlite";
+/** Open (and make) the host's database: the three tables, WAL. */
+export declare function openHostDb(path: string, o?: {
+    readOnly?: boolean;
+}): DatabaseSync;
+/**
+ * One set of the host's database as the shim's store: an instance's (with the chain exception), or
+ * the host chain's (`set` = host/chain). `readOnly`: a replay's source.
+ */
+export declare class SqliteSetStore {
+    readonly db: DatabaseSync;
+    readonly set: string;
+    readonly readOnly: boolean;
+    private tx;
+    private q;
+    constructor(db: DatabaseSync, set: string, o?: {
+        readOnly?: boolean;
+    });
+    private args;
+    getBlock(cid: Uint8Array): Uint8Array | undefined;
+    hasBlock(cid: Uint8Array): boolean;
+    putBlock(cid: Uint8Array, bytes: Uint8Array): boolean;
+    getPointer(name: string): Uint8Array | undefined;
+    setPointer(name: string, cid: Uint8Array): boolean;
+    begin(): void;
+    commit(): boolean;
+    rollback(): void;
+    /** Every block the set holds (a replay's source: the raw modules first; a checkpoint's extras). */
+    entries(): Generator<[Uint8Array, Uint8Array]>;
+}
+/** Whether the set has committed a state (its index's `state` pointer). */
+export declare function setHasState(db: DatabaseSync, set: string): boolean;
+/**
+ * A set as a native kernel's store file (kernel-zig/src/sqlite_store.zig: `blocks(cid, bytes)`,
+ * `pointers(name, cid)`): the set's blocks and those of `host/chain` (what it reads through the
+ * chain exception), its pointers — what `skein-kernel replay` takes (the two kernels agree:
+ * requirement 1's proof). `out` must not exist.
+ */
+export declare function exportSet(dbPath: string, set: string, out: string): void;

package/dist/host/store-sqlite.js

@@ -0,0 +1,170 @@
+// The host's store (the settled split, 2026-10-31): ONE SQLite database for the
+// whole host (node's built-in `node:sqlite`, synchronous), every instance a
+// SET of it — the store interface of the wasm kernel's shim (kernel-zig/web/
+// kernel.js MemoryStore: getBlock/hasBlock/putBlock/getPointer/setPointer/
+// begin/commit/rollback), so the machine asks for a record by CID, writes
+// under its heads, and never knows where it lives (requirement 5).
+//
+//   blocks(cid BLOB PRIMARY KEY, bytes BLOB)          each block once for the host
+//   members(set TEXT, cid BLOB, PRIMARY KEY(set, cid)) what each set holds
+//   pointers(set TEXT, name TEXT, cid BLOB, PRIMARY KEY(set, name))
+//
+// An instance's view: a read answers when the CID is in its own set OR in the
+// `host/chain` set (the chain exception, decided 2026-10-27: the host's header
+// chain is the one shared read); a write goes to its own set. The `host/chain`
+// set is written only by the host's chain holder (a view with no chain
+// exception of its own). A batch (begin … commit) is one SQLite transaction at
+// commit: reads see the batch, rollback drops it. Every worker opens its own
+// connection (WAL; a writer waits on SQLite's lock, `busy_timeout`, for
+// another worker's commit).
+//
+// host.db's `store` for such an instance: `sqlite:<db path>` (the set: its
+// handle); its spec `sqlite:<db path>#<set>` (index-store.ts).
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { CHAIN_SET } from "../runtime/index-store.js";
+const key = (b) => Buffer.from(b.buffer, b.byteOffset, b.byteLength).toString("latin1");
+/** Open (and make) the host's database: the three tables, WAL. */
+export function openHostDb(path, o = {}) {
+    if (!o.readOnly)
+        mkdirSync(dirname(path), { recursive: true });
+    const db = new DatabaseSync(path, o.readOnly ? { readOnly: true } : {});
+    db.exec("PRAGMA busy_timeout = 60000");
+    if (!o.readOnly) {
+        db.exec("PRAGMA journal_mode = WAL");
+        db.exec("PRAGMA synchronous = NORMAL");
+        db.exec(`CREATE TABLE IF NOT EXISTS blocks (cid BLOB PRIMARY KEY, bytes BLOB NOT NULL) WITHOUT ROWID;
+      CREATE TABLE IF NOT EXISTS members ("set" TEXT NOT NULL, cid BLOB NOT NULL, PRIMARY KEY ("set", cid)) WITHOUT ROWID;
+      CREATE TABLE IF NOT EXISTS pointers ("set" TEXT NOT NULL, name TEXT NOT NULL, cid BLOB NOT NULL, PRIMARY KEY ("set", name)) WITHOUT ROWID;`);
+    }
+    return db;
+}
+/**
+ * One set of the host's database as the shim's store: an instance's (with the chain exception), or
+ * the host chain's (`set` = host/chain). `readOnly`: a replay's source.
+ */
+export class SqliteSetStore {
+    db;
+    set;
+    readOnly;
+    tx = null;
+    q;
+    constructor(db, set, o = {}) {
+        this.db = db;
+        this.set = set;
+        this.readOnly = !!o.readOnly;
+        const sets = set === CHAIN_SET ? 'm."set" = ?1' : '(m."set" = ?1 OR m."set" = ?2)';
+        this.q = {
+            get: db.prepare(`SELECT b.bytes FROM members m JOIN blocks b ON b.cid = m.cid WHERE m.cid = ?3 AND ${sets} LIMIT 1`),
+            has: db.prepare(`SELECT 1 FROM members m WHERE m.cid = ?3 AND ${sets} LIMIT 1`),
+            putBlock: db.prepare("INSERT OR IGNORE INTO blocks (cid, bytes) VALUES (?, ?)"),
+            putMember: db.prepare(`INSERT OR IGNORE INTO members ("set", cid) VALUES (?, ?)`),
+            ptr: db.prepare(`SELECT cid FROM pointers WHERE "set" = ? AND name = ?`),
+            setPtr: db.prepare(`INSERT INTO pointers ("set", name, cid) VALUES (?, ?, ?) ON CONFLICT ("set", name) DO UPDATE SET cid = excluded.cid`),
+        };
+    }
+    args(cid) { return [this.set, CHAIN_SET, cid]; }
+    getBlock(cid) {
+        const t = this.tx?.blocks.get(key(cid));
+        if (t)
+            return t[1];
+        const r = this.q.get.get(...this.args(cid));
+        return r ? new Uint8Array(r.bytes) : undefined;
+    }
+    hasBlock(cid) {
+        if (this.tx?.blocks.has(key(cid)))
+            return true;
+        return this.q.has.get(...this.args(cid)) !== undefined;
+    }
+    putBlock(cid, bytes) {
+        if (this.readOnly)
+            return false;
+        if (this.tx) {
+            this.tx.blocks.set(key(cid), [cid, bytes]);
+            return true;
+        }
+        this.q.putBlock.run(cid, bytes);
+        this.q.putMember.run(this.set, cid);
+        return true;
+    }
+    getPointer(name) {
+        if (this.tx?.pointers.has(name))
+            return this.tx.pointers.get(name);
+        const r = this.q.ptr.get(this.set, name);
+        return r ? new Uint8Array(r.cid) : undefined;
+    }
+    setPointer(name, cid) {
+        if (this.readOnly)
+            return false;
+        if (this.tx) {
+            this.tx.pointers.set(name, cid);
+            return true;
+        }
+        this.q.setPtr.run(this.set, name, cid);
+        return true;
+    }
+    begin() { this.tx = { blocks: new Map(), pointers: new Map() }; }
+    commit() {
+        const t = this.tx;
+        this.tx = null;
+        if (!t || (t.blocks.size === 0 && t.pointers.size === 0))
+            return true;
+        this.db.exec("BEGIN IMMEDIATE");
+        try {
+            for (const [cid, bytes] of t.blocks.values()) {
+                this.q.putBlock.run(cid, bytes);
+                this.q.putMember.run(this.set, cid);
+            }
+            for (const [name, cid] of t.pointers)
+                this.q.setPtr.run(this.set, name, cid);
+            this.db.exec("COMMIT");
+        }
+        catch (e) {
+            this.db.exec("ROLLBACK");
+            throw e;
+        }
+        return true;
+    }
+    rollback() { this.tx = null; }
+    /** Every block the set holds (a replay's source: the raw modules first; a checkpoint's extras). */
+    *entries() {
+        for (const r of this.db.prepare(`SELECT m.cid, b.bytes FROM members m JOIN blocks b ON b.cid = m.cid WHERE m."set" = ?`).iterate(this.set))
+            yield [new Uint8Array(r.cid), new Uint8Array(r.bytes)];
+    }
+}
+/** Whether the set has committed a state (its index's `state` pointer). */
+export function setHasState(db, set) {
+    try {
+        return db.prepare(`SELECT 1 FROM pointers WHERE "set" = ? AND name = 'state'`).get(set) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A set as a native kernel's store file (kernel-zig/src/sqlite_store.zig: `blocks(cid, bytes)`,
+ * `pointers(name, cid)`): the set's blocks and those of `host/chain` (what it reads through the
+ * chain exception), its pointers — what `skein-kernel replay` takes (the two kernels agree:
+ * requirement 1's proof). `out` must not exist.
+ */
+export function exportSet(dbPath, set, out) {
+    const src = new DatabaseSync(dbPath, { readOnly: true });
+    const dst = new DatabaseSync(out);
+    try {
+        dst.exec(`CREATE TABLE blocks (cid BLOB PRIMARY KEY, bytes BLOB NOT NULL) WITHOUT ROWID;
+      CREATE TABLE pointers (name TEXT PRIMARY KEY, cid BLOB NOT NULL) WITHOUT ROWID;`);
+        const put = dst.prepare("INSERT OR IGNORE INTO blocks (cid, bytes) VALUES (?, ?)");
+        dst.exec("BEGIN");
+        for (const r of src.prepare(`SELECT b.cid, b.bytes FROM members m JOIN blocks b ON b.cid = m.cid WHERE m."set" = ? OR m."set" = ?`).iterate(set, CHAIN_SET))
+            put.run(r.cid, r.bytes);
+        const ptr = dst.prepare("INSERT INTO pointers (name, cid) VALUES (?, ?)");
+        for (const r of src.prepare(`SELECT name, cid FROM pointers WHERE "set" = ?`).all(set))
+            ptr.run(r.name, r.cid);
+        dst.exec("COMMIT");
+    }
+    finally {
+        src.close();
+        dst.close();
+    }
+}

package/dist/host/stores.d.ts

@@ -0,0 +1,43 @@
+import { type CID } from "../runtime/cid.ts";
+import { type IndexStore } from "../runtime/index-store.ts";
+import type { SqliteStore } from "../runtime/sqlite.ts";
+/** A store, whichever backend: a file (index-store.ts openStoreFile), or an LMDB set, read only. */
+export declare function openStoreFile(spec: string, o?: {
+    readOnly?: boolean;
+}): SqliteStore;
+/** Whether a store is there to read: the file; for an LMDB set, its state pointer (the kernel has committed). */
+export declare function storeExists(spec: string): boolean;
+/**
+ * A set of an LMDB environment through the index (#96), read only: the same reader as a SQLite
+ * file's, with the kernel's gate — a block is there if the set holds it, or the chain's set does
+ * (#133); one only another set holds is absent. Each state read takes a fresh snapshot.
+ */
+export declare function openLmdbStore(dir: string, set: string): IndexStore;
+/**
+ * A set of the host's SQLite database (the settled split), read only, through the index: the same
+ * reader as a file's, with the gate the wasm host's store keeps (store-sqlite.ts) — a block is there
+ * if the set holds it, or the `host/chain` set does. Its own read-only connection, closed with it.
+ */
+export declare function openSqliteSetStore(path: string, set: string): IndexStore;
+/** The host chain as it stands (#156): its record's CID, tip height and hash; undefined when empty. */
+export type HostChain = {
+    root: CID;
+    height: number;
+    hash: string;
+};
+/**
+ * The host chain a store sees (#156): a RocksDB database's (the kernel process's `chain` frame over
+ * its host-read socket), or a SQLite file's or an LMDB set's own (a serve instance's: the pointer
+ * `host/chain` and the record it names, read directly).
+ */
+export declare function readHostChain(spec: string): HostChain | undefined;
+/** Every block a store holds (a SQLite file's `blocks`; an LMDB set's members), for a checkpoint's extras. */
+export declare function storeBlocks(spec: string): Generator<{
+    cid: CID;
+    bytes: Uint8Array;
+}>;
+/**
+ * A set of the one-process kernel's RocksDB database (#158), read only, through the kernel: blocks by
+ * CID through the set's gate (what the instance holds), the state pointer read on every state read.
+ */
+export declare function openRocksStore(dir: string, set: string): IndexStore;