@kokuin/store-vault 0.0.0-stage → 0.1.0

package/lib/coordinator.js

@@ -0,0 +1,459 @@
+import { createVaultKeyReference, factorsFromDescriptors, getSuite, isSupportedSuite, recipientDIDForFactors, satisfiableFactors, vaultRevocationRecordID } from '@kokuin/vault';
+import { createCoordinatorContext, VaultNotFound } from './coordinator-context.js';
+import { createEntryFunctions } from './coordinator-entries.js';
+import { createOpenFunctions } from './coordinator-open.js';
+import { createRecordFunctions } from './coordinator-records.js';
+import { createRotateFunctions } from './coordinator-rotate.js';
+import { VaultWriteConflict } from './record-context.js';
+import { settleAll, settledValue } from './settle.js';
+export function createVaultCoordinator(params) {
+    const ctx = createCoordinatorContext(params);
+    const open = createOpenFunctions(ctx);
+    const records = createRecordFunctions(ctx);
+    const rotate = createRotateFunctions(ctx, open, records);
+    const entries = createEntryFunctions(ctx, open, records);
+    async function createKey(request) {
+        await ctx.authorize('createKey', 'administer', request);
+        const unique = params.runtime.getRandomValues(new Uint8Array(16));
+        const { keyID, keyUnique } = createVaultKeyReference(request.ownerDID, unique);
+        const key = {
+            ownerDID: request.ownerDID,
+            keyID,
+            version: 1,
+            suite: request.suite ?? 1,
+            state: 'active'
+        };
+        const suite = getSuite(key.suite);
+        let wrappings = request.wrappings;
+        if (wrappings === undefined) {
+            if (params.identity === null) throw new TypeError('An explicit wrapping or agreement identity is required');
+            const recipientDID = 'longForm' in params.identity && typeof params.identity.longForm === 'string' ? params.identity.longForm : params.identity.id;
+            wrappings = [
+                [
+                    {
+                        kind: 'did',
+                        recipientDID
+                    }
+                ]
+            ];
+        }
+        if (wrappings.length === 0) throw new TypeError('At least one wrapping is required');
+        const factorSets = wrappings;
+        const contentKey = suite.generateContentKey(params.runtime);
+        try {
+            await ctx.locked([
+                key
+            ], async (store)=>{
+                if (await store.getKey(key) !== undefined) throw new VaultWriteConflict();
+                // Key records and wraps are independent. Wrapping IDs are drawn in factor-set order.
+                const [chain, wrapped] = await settleAll([
+                    params.mode === 'replicated' ? ctx.keyRecords(key, store, keyUnique, request.consumer) : Promise.resolve({
+                        records: [],
+                        branchID: '',
+                        branchRecordID: ''
+                    }),
+                    settleAll(factorSets.map(async (factors)=>{
+                        const wrappingID = params.runtime.getRandomID();
+                        const result = await suite.wrap({
+                            runtime: params.runtime,
+                            contentKey,
+                            factors,
+                            wrappingID,
+                            keyID: key.keyID,
+                            keyVersion: 1,
+                            methods: params.methods
+                        });
+                        return {
+                            factors,
+                            wrappingID,
+                            result
+                        };
+                    }))
+                ]);
+                const rows = wrapped.map(({ factors, wrappingID, result })=>{
+                    return {
+                        ...key,
+                        wrappingID,
+                        keyVersion: 1,
+                        recipientDID: recipientDIDForFactors(factors),
+                        provenance: chain.branchID,
+                        ...result
+                    };
+                });
+                if (params.mode === 'replicated') {
+                    const output = [
+                        ...chain.records
+                    ];
+                    // Signing stays sequential: a failure stops the rest. HLC allocation and output order
+                    // follow the factor sets.
+                    for (const row of rows)output.push(await records.wrapping(row, chain, request.consumer ?? null));
+                    await ctx.write(store, output, {
+                        key: {
+                            ...key,
+                            expectedVersion: null,
+                            expectedBranches: []
+                        }
+                    }, request);
+                } else {
+                    await store.putKey(key);
+                    await store.putWrappings(rows);
+                }
+            });
+            return {
+                ownerDID: key.ownerDID,
+                keyID: key.keyID
+            };
+        } finally{
+            contentKey.fill(0);
+        }
+    }
+    async function rewrap(request, change) {
+        await ctx.locked([
+            request
+        ], async (store)=>{
+            const key = await ctx.key(request, store);
+            const [branch, branches, wrappings] = await settleAll([
+                ctx.branch(request, key.version, store),
+                ctx.branches(key, key.version, store),
+                store.listWrappings({
+                    ...key,
+                    keyVersion: key.version
+                })
+            ]);
+            const rows = wrappings.filter((w)=>{
+                return (params.mode === 'local' || w.provenance === branch.branchID) && w.descriptors.some((d)=>d.kind === 'did') && satisfiableFactors(w.descriptors, params.identity) !== null;
+            });
+            if (rows.length !== 1) throw new VaultNotFound();
+            const existing = rows[0];
+            if (existing === undefined) throw new VaultNotFound();
+            if (request.atVersion !== undefined && request.atVersion !== key.version) throw new VaultWriteConflict();
+            const evidence = await ctx.wrappingEvidence(existing, store);
+            const opened = await open.open({
+                ...request,
+                atVersion: key.version
+            }, store);
+            try {
+                const wrappingID = params.runtime.getRandomID();
+                const factors = change(factorsFromDescriptors(existing.descriptors, request.inputs));
+                const wrapped = await getSuite(opened.suite).wrap({
+                    runtime: params.runtime,
+                    contentKey: opened.contentKey,
+                    factors,
+                    wrappingID,
+                    keyID: key.keyID,
+                    keyVersion: key.version,
+                    methods: params.methods
+                });
+                const row = {
+                    ...existing,
+                    wrappingID,
+                    ...wrapped,
+                    recipientDID: recipientDIDForFactors(factors)
+                };
+                if (params.mode === 'local') {
+                    // Different wrapping IDs: the write and the delete are independent.
+                    await settleAll([
+                        store.putWrapping(row),
+                        store.deleteWrapping(existing)
+                    ]);
+                } else {
+                    // The verified evidence already holds the prior wrapping's authenticated metadata.
+                    if (evidence === undefined) throw new VaultNotFound();
+                    const consumer = evidence.op.claim.meta.consumer;
+                    const replacement = await records.wrapping(row, branch, consumer);
+                    const deletion = await ctx.signed('vault.wrapping', {
+                        ownerDID: key.ownerDID,
+                        id: existing.wrappingID
+                    }, null, {
+                        keyID: key.keyID,
+                        keyVersion: key.version,
+                        recipient: existing.recipientDID,
+                        consumer
+                    });
+                    await ctx.write(store, [
+                        replacement,
+                        deletion
+                    ], {
+                        key: {
+                            ...key,
+                            expectedVersion: key.version,
+                            expectedBranches: branches.map((b)=>b.branchID)
+                        }
+                    }, request);
+                }
+            } finally{
+                opened.contentKey.fill(0);
+            }
+        });
+        ctx.evict(request);
+    }
+    const coordinator = {
+        get records () {
+            if (ctx.records === undefined) throw new TypeError('Local coordinator has no records path');
+            return ctx.records;
+        },
+        createKey,
+        async openKey (request) {
+            await ctx.authorize('openKey', 'read', request);
+            return open.open(request);
+        },
+        async unlock (request) {
+            await ctx.authorize('unlock', 'read', request);
+            const opened = await open.open(request);
+            opened.contentKey.fill(0);
+        },
+        async lock (address) {
+            await ctx.authorize('lock', 'read', address);
+            ctx.evict(address);
+        },
+        async lockAll (ownerDID, call = {}) {
+            await ctx.authorize('lockAll', 'read', {
+                ownerDID,
+                ...call
+            });
+            ctx.evictAll(ownerDID);
+        },
+        async status (request) {
+            await ctx.authorize('status', 'read', request);
+            // Both reads run together. Their results are checked in the old order: key, suite, revocation.
+            const [keyRead, revokedRead] = await Promise.allSettled([
+                ctx.key(request),
+                open.revoked(request, params.store)
+            ]);
+            const key = settledValue(keyRead);
+            if (!isSupportedSuite(key.suite)) return {
+                state: 'unopenable'
+            };
+            const version = request.atVersion ?? key.version;
+            if (settledValue(revokedRead)) {
+                ctx.evict(request);
+                return {
+                    state: 'unopenable'
+                };
+            }
+            const branch = await ctx.branch(request, version);
+            const hit = ctx.cache.get(ctx.cacheID(request), version);
+            if (hit !== null) {
+                const matches = hit.branchID === branch.branchID;
+                hit.contentKey.fill(0);
+                if (matches) return {
+                    state: 'unlocked'
+                };
+            }
+            const options = (await params.store.listWrappings({
+                ...request,
+                keyVersion: version
+            })).filter((w)=>params.mode === 'local' || w.provenance === branch.branchID).map((w)=>satisfiableFactors(w.descriptors, params.identity)).filter((value)=>value !== null);
+            if (options.some((o)=>o.length === 0)) return {
+                state: 'available'
+            };
+            return options.length > 0 ? {
+                state: 'locked',
+                unlockOptions: options
+            } : {
+                state: 'unopenable'
+            };
+        },
+        async listKeys (ownerDID, call = {}) {
+            await ctx.authorize('listKeys', 'read', {
+                ownerDID,
+                ...call
+            });
+            return params.store.listKeys(ownerDID);
+        },
+        async setKeyState (request) {
+            await ctx.authorize('setKeyState', 'administer', request);
+            await ctx.locked([
+                request
+            ], async (store)=>{
+                if (params.mode === 'local') {
+                    await ctx.key(request, store);
+                    await store.setKeyState(request);
+                    return;
+                }
+                const [key, previous] = await settleAll([
+                    ctx.key(request, store),
+                    ctx.stored({
+                        type: 'vault.key',
+                        owner: request.ownerDID,
+                        id: request.keyID
+                    }, store)
+                ]);
+                const record = await ctx.signed('vault.key', {
+                    ownerDID: key.ownerDID,
+                    id: key.keyID
+                }, {
+                    suite: key.suite,
+                    state: request.state
+                }, {
+                    ...previous.op.claim.meta,
+                    keyID: key.keyID,
+                    keyUnique: previous.op.claim.meta.keyUnique,
+                    version: key.version,
+                    state: request.state,
+                    consumer: previous.op.claim.meta.consumer
+                });
+                await ctx.write(store, [
+                    record
+                ], {
+                    key: {
+                        ...key,
+                        expectedVersion: key.version
+                    }
+                }, request);
+            });
+            ctx.evict(request);
+        },
+        async deleteKey (request) {
+            await ctx.authorize('deleteKey', 'administer', request);
+            await ctx.locked([
+                request
+            ], async (store)=>{
+                if (params.mode === 'local') {
+                    await ctx.key(request, store);
+                    await store.deleteKey(request);
+                    return;
+                }
+                const [key, previous] = await settleAll([
+                    ctx.key(request, store),
+                    ctx.stored({
+                        type: 'vault.key',
+                        owner: request.ownerDID,
+                        id: request.keyID
+                    }, store)
+                ]);
+                const keyUnique = previous.op.claim.meta.keyUnique;
+                if (typeof keyUnique !== 'string') throw new VaultNotFound();
+                const record = await ctx.signed('vault.key', {
+                    ownerDID: key.ownerDID,
+                    id: key.keyID
+                }, null, {
+                    keyID: key.keyID,
+                    keyUnique,
+                    version: key.version,
+                    state: 'deleted',
+                    consumer: previous.op.claim.meta.consumer
+                });
+                await ctx.write(store, [
+                    record
+                ], {
+                    key: {
+                        ...key,
+                        expectedVersion: key.version
+                    }
+                }, request);
+            });
+            ctx.evict(request);
+        },
+        async grant (request) {
+            await ctx.authorize('grant', 'administer', request);
+            await ctx.locked([
+                request
+            ], async (store)=>{
+                const [key, revocations] = await settleAll([
+                    ctx.key(request, store),
+                    params.mode === 'replicated' ? ctx.recordsFor(store).listRevocations(request) : Promise.resolve([])
+                ]);
+                if (revocations.some((did)=>{
+                    return vaultRevocationRecordID(key.keyID, did) === vaultRevocationRecordID(key.keyID, request.recipientDID);
+                })) throw new VaultNotFound();
+                if (request.atVersion !== undefined && request.atVersion !== key.version) throw new VaultWriteConflict();
+                const opened = await open.open({
+                    ...request,
+                    atVersion: key.version
+                }, store);
+                try {
+                    const wrappingID = params.runtime.getRandomID();
+                    const wrapped = await getSuite(opened.suite).wrap({
+                        runtime: params.runtime,
+                        contentKey: opened.contentKey,
+                        factors: [
+                            {
+                                kind: 'did',
+                                recipientDID: request.recipientDID
+                            }
+                        ],
+                        wrappingID,
+                        keyID: key.keyID,
+                        keyVersion: key.version,
+                        methods: params.methods
+                    });
+                    const row = {
+                        ...key,
+                        wrappingID,
+                        keyVersion: key.version,
+                        recipientDID: recipientDIDForFactors([
+                            {
+                                kind: 'did',
+                                recipientDID: request.recipientDID
+                            }
+                        ]),
+                        provenance: opened.branchID,
+                        ...wrapped
+                    };
+                    if (params.mode === 'local') await store.putWrapping(row);
+                    else {
+                        const [branch, branches] = await settleAll([
+                            ctx.branch(key, key.version, store),
+                            ctx.branches(key, key.version, store)
+                        ]);
+                        const record = await records.wrapping(row, branch);
+                        await ctx.write(store, [
+                            record
+                        ], {
+                            key: {
+                                ...key,
+                                expectedVersion: key.version,
+                                expectedBranches: branches.map((b)=>b.branchID)
+                            }
+                        }, request);
+                    }
+                } finally{
+                    opened.contentKey.fill(0);
+                }
+            });
+        },
+        async addFactor (request) {
+            await ctx.authorize('addFactor', 'administer', request);
+            await rewrap(request, (factors)=>[
+                    ...factors,
+                    request.factor
+                ]);
+        },
+        async removeFactor (request) {
+            await ctx.authorize('removeFactor', 'administer', request);
+            await rewrap(request, (factors)=>{
+                if (!factors.some((f)=>f.kind === request.kind)) throw new VaultNotFound();
+                return factors.filter((f)=>f.kind !== request.kind);
+            });
+        },
+        async readEntry (request) {
+            await ctx.authorize('readEntry', 'read', request);
+            return ctx.read(async (store)=>{
+                const row = await store.getEntry(request);
+                if (row === undefined) throw new VaultNotFound();
+                await ctx.authorize('readEntry', 'read', {
+                    ...request,
+                    keyID: row.keyID
+                }, store);
+                await records.entryInfo(row, store);
+                return open.decrypt(row, {
+                    ...row,
+                    inputs: request.inputs
+                }, store);
+            });
+        },
+        async getEntry (request) {
+            await ctx.authorize('getEntry', 'read', request);
+            return params.store.getEntry(request);
+        },
+        async listEntries (request) {
+            await ctx.authorize('listEntries', 'read', request);
+            return params.store.listEntries(request);
+        },
+        ...entries,
+        ...rotate,
+        reendorse: records.reendorse
+    };
+    return coordinator;
+}

package/lib/definition.d.ts

@@ -0,0 +1,6 @@
+import type { StoreDefinition, StoreProvider } from '@hozon/db';
+import type { VaultStoreTables } from './tables.js';
+import type { VaultStoreAPI } from './types.js';
+export declare const VAULT_STORE: "vault";
+export declare const vaultStoreDefinition: StoreDefinition<VaultStoreTables, VaultStoreAPI>;
+export declare function getVaultStore(provider: StoreProvider): Promise<VaultStoreAPI>;

package/lib/definition.js

@@ -0,0 +1,12 @@
+import { createVaultStore } from './api.js';
+import { getVaultMigrations } from './migrations.js';
+export const VAULT_STORE = 'vault';
+export const vaultStoreDefinition = {
+    name: VAULT_STORE,
+    dependsOn: [],
+    migrations: getVaultMigrations,
+    createAPI: createVaultStore
+};
+export async function getVaultStore(provider) {
+    return provider.getStore(VAULT_STORE);
+}

package/lib/index.d.ts

@@ -0,0 +1,12 @@
+export { createVaultStore } from './api.js';
+export { createVaultCoordinator } from './coordinator.js';
+export { VaultKeyLocked, VaultNotAuthorized, VaultNotFound, VaultRepairPending, VaultSupersededBranch, } from './coordinator-context.js';
+export type * from './coordinator-types.js';
+export { getVaultStore, VAULT_STORE, vaultStoreDefinition } from './definition.js';
+export { VaultModeConflict, VaultWriteConflict } from './record-context.js';
+export { getVaultRecordsStore, VAULT_RECORDS_STORE, vaultRecordsStoreDefinition, } from './record-definition.js';
+export type * from './record-tables.js';
+export type { VaultRecords, VaultRecordsParams, VaultWritePreconditions } from './records.js';
+export { createVaultRecords, VaultRecordRowError, vaultRecordPortsFor } from './records.js';
+export type * from './tables.js';
+export type * from './types.js';

package/lib/index.js

@@ -0,0 +1,7 @@
+export { createVaultStore } from './api.js';
+export { createVaultCoordinator } from './coordinator.js';
+export { VaultKeyLocked, VaultNotAuthorized, VaultNotFound, VaultRepairPending, VaultSupersededBranch } from './coordinator-context.js';
+export { getVaultStore, VAULT_STORE, vaultStoreDefinition } from './definition.js';
+export { VaultModeConflict, VaultWriteConflict } from './record-context.js';
+export { getVaultRecordsStore, VAULT_RECORDS_STORE, vaultRecordsStoreDefinition } from './record-definition.js';
+export { createVaultRecords, VaultRecordRowError, vaultRecordPortsFor } from './records.js';

package/lib/migrations.d.ts

@@ -0,0 +1,2 @@
+import { type Migration, type MigrationContext } from '@hozon/db';
+export declare function getVaultMigrations(ctx: MigrationContext): Record<string, Migration>;

package/lib/migrations.js

@@ -0,0 +1,52 @@
+import { sql } from '@hozon/db';
+export function getVaultMigrations(ctx) {
+    const t = ctx.types;
+    const p = ctx.tablePrefix;
+    const hlcColumn = (column)=>{
+        const required = column.notNull();
+        return ctx.kind === 'postgres' ? required.modifyFront(sql`collate "C"`) : required;
+    };
+    return {
+        '0-init': {
+            async up (db) {
+                await db.schema.createTable('vault_keys').addColumn('owner_did', t.text, (c)=>c.notNull()).addColumn('key_id', t.text, (c)=>c.notNull()).addColumn('suite', 'integer', (c)=>c.notNull()).addColumn('version', 'integer', (c)=>c.notNull()).addColumn('state', t.text, (c)=>c.notNull()).addColumn('mode', t.text, (c)=>c.notNull().defaultTo('local')).addPrimaryKeyConstraint(`${p}_vault_keys_pkey`, [
+                    'owner_did',
+                    'key_id'
+                ]).execute();
+                await db.schema.createTable('vault_wrappings').addColumn('owner_did', t.text, (c)=>c.notNull()).addColumn('wrapping_id', t.text, (c)=>c.notNull()).addColumn('key_id', t.text, (c)=>c.notNull()).addColumn('key_version', 'integer', (c)=>c.notNull()).addColumn('descriptors', t.json, (c)=>c.notNull()).addColumn('descriptor_digest', t.text, (c)=>c.notNull()).addColumn('iv', t.binary, (c)=>c.notNull()).addColumn('wrapped_key', t.binary, (c)=>c.notNull()).addColumn('recipient_did', t.text).addColumn('provenance', t.text, (c)=>c.notNull()).addColumn('mode', t.text, (c)=>c.notNull().defaultTo('local')).addPrimaryKeyConstraint(`${p}_vault_wrappings_pkey`, [
+                    'owner_did',
+                    'wrapping_id'
+                ]).execute();
+                await db.schema.createIndex(`${p}_vault_wrappings_key_idx`).on('vault_wrappings').columns([
+                    'owner_did',
+                    'key_id',
+                    'key_version'
+                ]).execute();
+                await db.schema.createTable('vault_entries').addColumn('owner_did', t.text, (c)=>c.notNull()).addColumn('entry_id', t.text, (c)=>c.notNull()).addColumn('key_id', t.text, (c)=>c.notNull()).addColumn('key_version', 'integer', (c)=>c.notNull()).addColumn('kind', t.text, (c)=>c.notNull()).addColumn('label', t.text, (c)=>c.notNull()).addColumn('attributes', t.json, (c)=>c.notNull()).addColumn('iv', t.binary, (c)=>c.notNull()).addColumn('ciphertext', t.binary, (c)=>c.notNull()).addColumn('hlc', t.text, hlcColumn).addColumn('provenance', t.text, (c)=>c.notNull()).addColumn('mode', t.text, (c)=>c.notNull().defaultTo('local')).addPrimaryKeyConstraint(`${p}_vault_entries_pkey`, [
+                    'owner_did',
+                    'entry_id'
+                ]).execute();
+                for (const column of [
+                    'kind',
+                    'label'
+                ]){
+                    await db.schema.createIndex(`${p}_vault_entries_${column}_idx`).on('vault_entries').columns([
+                        'owner_did',
+                        'key_id',
+                        column
+                    ]).execute();
+                }
+                await db.schema.createIndex(`${p}_vault_entries_id_idx`).on('vault_entries').column('entry_id').execute();
+                await db.schema.createIndex(`${p}_vault_entries_hlc_idx`).on('vault_entries').column('hlc').execute();
+                if (ctx.kind === 'postgres') {
+                    await db.schema.createIndex(`${p}_vault_entries_attributes_idx`).on('vault_entries').using('gin').column('attributes').execute();
+                }
+            },
+            async down (db) {
+                await db.schema.dropTable('vault_entries').execute();
+                await db.schema.dropTable('vault_wrappings').execute();
+                await db.schema.dropTable('vault_keys').execute();
+            }
+        }
+    };
+}

package/lib/record-context.d.ts

@@ -0,0 +1,24 @@
+import type { Adapter } from '@hozon/adapter';
+import type { Kysely, StoreContext } from '@hozon/db';
+import type { DecisionKey } from './batch.js';
+import type { VaultRecordsTables } from './record-tables.js';
+import type { VaultStoreAPI } from './types.js';
+export type VaultDatabase = {
+    db: Kysely<VaultRecordsTables>;
+    adapter: Adapter;
+    context: StoreContext;
+};
+export declare const vaultDatabases: WeakMap<VaultStoreAPI, VaultDatabase>;
+export declare class VaultModeConflict extends Error {
+    constructor();
+}
+export declare class VaultWriteConflict extends Error {
+    constructor();
+}
+export declare function claimMode(db: Kysely<VaultRecordsTables>, key: {
+    type: string;
+    owner: string;
+    id: string;
+}, mode: 'local' | 'replicated'): Promise<void>;
+/** Claims every key for `mode`, in one insert and one read per statement chunk. */
+export declare function claimModes(db: Kysely<VaultRecordsTables>, keys: ReadonlyArray<DecisionKey>, mode: 'local' | 'replicated'): Promise<void>;

package/lib/record-context.js

@@ -0,0 +1,34 @@
+import { recordKeyText } from '@kokuin/records';
+import { DECISION_COLUMNS, insertDecisionClaims, selectDecisionModes, statementChunks } from './batch.js';
+import { settleAll } from './settle.js';
+export const vaultDatabases = new WeakMap();
+export class VaultModeConflict extends Error {
+    constructor(){
+        super('The record belongs to another vault storage mode');
+        this.name = 'VaultModeConflict';
+    }
+}
+export class VaultWriteConflict extends Error {
+    constructor(){
+        super('Vault write preconditions no longer hold');
+        this.name = 'VaultWriteConflict';
+    }
+}
+export async function claimMode(db, key, mode) {
+    await claimModes(db, [
+        key
+    ], mode);
+}
+/** Claims every key for `mode`, in one insert and one read per statement chunk. */ export async function claimModes(db, keys, mode) {
+    const unique = [
+        ...new Map(keys.map((key)=>[
+                recordKeyText(key),
+                key
+            ])).values()
+    ];
+    if (unique.length === 0) return;
+    const parts = statementChunks(unique, DECISION_COLUMNS);
+    await settleAll(parts.map((part)=>insertDecisionClaims(db, part, mode).execute()));
+    const stored = (await settleAll(parts.map((part)=>selectDecisionModes(db, part).execute()))).flat();
+    if (stored.length !== unique.length || stored.some((row)=>row.mode !== mode)) throw new VaultModeConflict();
+}

package/lib/record-definition.d.ts

@@ -0,0 +1,7 @@
+import type { StoreDefinition, StoreProvider } from '@hozon/db';
+import type { VaultDatabase } from './record-context.js';
+import type { VaultRecordsTables } from './record-tables.js';
+export declare const VAULT_RECORDS_STORE = "vault-records";
+/** Register separately to keep local-only databases free of replicated state. */
+export declare const vaultRecordsStoreDefinition: StoreDefinition<VaultRecordsTables, VaultDatabase>;
+export declare function getVaultRecordsStore(provider: StoreProvider, opKind?: string): Promise<VaultDatabase>;