@kokuin/store-vault 0.0.0-stage → 0.1.0

package/lib/record-definition.js

@@ -0,0 +1,93 @@
+import { withStoreTransaction } from '@hozon/db';
+export const VAULT_RECORDS_STORE = 'vault-records';
+function migrations(ctx) {
+    const t = ctx.types;
+    const p = ctx.tablePrefix;
+    return {
+        '0-init': {
+            async up (db) {
+                await db.schema.createTable('vault_record_domain').addColumn('singleton', 'integer', (c)=>c.primaryKey()).addColumn('op_kind', t.text, (c)=>c.notNull()).execute();
+                await db.schema.createTable('vault_decisions').addColumn('type', t.text, (c)=>c.notNull()).addColumn('owner', t.text, (c)=>c.notNull()).addColumn('id', t.text, (c)=>c.notNull()).addColumn('mode', t.text, (c)=>c.notNull()).addColumn('content_digest', t.text).addColumn('decision_hlc', t.text).addPrimaryKeyConstraint(`${p}_vault_decisions_pkey`, [
+                    'type',
+                    'owner',
+                    'id'
+                ]).execute();
+                for (const table of [
+                    'vault_records',
+                    'vault_entry_candidates'
+                ]){
+                    let builder = db.schema.createTable(table).addColumn('type', t.text, (c)=>c.notNull()).addColumn('owner', t.text, (c)=>c.notNull()).addColumn('id', t.text, (c)=>c.notNull()).addColumn('hlc', t.text, (c)=>c.notNull()).addColumn('op_jwt', t.text, (c)=>c.notNull()).addColumn('op_hash', t.text, (c)=>c.notNull()).addColumn('payload', t.binary).addColumn('payload_digest', t.text).addColumn('deleted', 'integer', (c)=>c.notNull()).addColumn('meta', t.json, (c)=>c.notNull());
+                    if (table === 'vault_entry_candidates') {
+                        builder = builder.addColumn('key_id', t.text, (c)=>c.notNull()).addColumn('key_version', 'integer', (c)=>c.notNull()).addColumn('branch_id', t.text, (c)=>c.notNull());
+                    }
+                    await builder.addPrimaryKeyConstraint(`${p}_${table}_pkey`, [
+                        'type',
+                        'owner',
+                        'id',
+                        'op_hash'
+                    ]).execute();
+                }
+                await db.schema.createIndex(`${p}_vault_candidates_key_idx`).on('vault_entry_candidates').columns([
+                    'owner',
+                    'key_id',
+                    'key_version'
+                ]).execute();
+                await db.schema.createTable('vault_key_branches').addColumn('owner_did', t.text, (c)=>c.notNull()).addColumn('key_id', t.text, (c)=>c.notNull()).addColumn('key_version', 'integer', (c)=>c.notNull()).addColumn('record_id', t.text, (c)=>c.notNull()).addColumn('branch_id', t.text, (c)=>c.notNull()).addColumn('op_jwt', t.text, (c)=>c.notNull()).addPrimaryKeyConstraint(`${p}_vault_branches_pkey`, [
+                    'owner_did',
+                    'record_id'
+                ]).execute();
+                await db.schema.createIndex(`${p}_vault_branches_key_idx`).on('vault_key_branches').columns([
+                    'owner_did',
+                    'key_id',
+                    'key_version'
+                ]).execute();
+                await db.schema.createTable('vault_revocations').addColumn('owner_did', t.text, (c)=>c.notNull()).addColumn('key_id', t.text, (c)=>c.notNull()).addColumn('recipient_did', t.text, (c)=>c.notNull()).addPrimaryKeyConstraint(`${p}_vault_revocations_pkey`, [
+                    'owner_did',
+                    'key_id',
+                    'recipient_did'
+                ]).execute();
+            },
+            async down (db) {
+                for (const table of [
+                    'vault_revocations',
+                    'vault_key_branches',
+                    'vault_entry_candidates',
+                    'vault_records',
+                    'vault_decisions',
+                    'vault_record_domain'
+                ])await db.schema.dropTable(table).execute();
+            }
+        }
+    };
+}
+/** Register separately to keep local-only databases free of replicated state. */ export const vaultRecordsStoreDefinition = {
+    name: VAULT_RECORDS_STORE,
+    dependsOn: [
+        'vault'
+    ],
+    migrations,
+    createAPI: (db, adapter, context)=>({
+            db,
+            adapter,
+            context
+        })
+};
+export async function getVaultRecordsStore(provider, opKind) {
+    if (opKind !== undefined) {
+        if (typeof opKind !== 'string' || opKind.length === 0) throw new TypeError('An explicit operation kind is required');
+        if (provider.isTransactionBound) throw new Error('Initialise the vault operation kind outside caller transactions');
+    }
+    const storage = await provider.getStore(VAULT_RECORDS_STORE);
+    if (opKind !== undefined) {
+        // Bind without vault key locks, before any caller transaction can apply records.
+        await withStoreTransaction(storage.db, async (db)=>{
+            await db.insertInto('vault_record_domain').values({
+                singleton: 1,
+                op_kind: opKind
+            }).onConflict((oc)=>oc.column('singleton').doNothing()).execute();
+            const row = await db.selectFrom('vault_record_domain').selectAll().executeTakeFirstOrThrow();
+            if (row.op_kind !== opKind) throw new TypeError('Vault records store belongs to another operation kind');
+        });
+    }
+    return storage;
+}

package/lib/record-tables.d.ts

@@ -0,0 +1,47 @@
+import type { VaultStoreTables } from './tables.js';
+export type VaultRecordTable = {
+    type: string;
+    owner: string;
+    id: string;
+    hlc: string;
+    op_jwt: string;
+    op_hash: string;
+    payload: Uint8Array | null;
+    payload_digest: string | null;
+    deleted: number;
+    meta: Record<string, unknown>;
+};
+export type VaultKeyBranchTable = {
+    owner_did: string;
+    key_id: string;
+    key_version: number;
+    record_id: string;
+    branch_id: string;
+    op_jwt: string;
+};
+export type VaultRecordsTables = VaultStoreTables & {
+    vault_records: VaultRecordTable;
+    vault_decisions: {
+        type: string;
+        owner: string;
+        id: string;
+        mode: 'local' | 'replicated';
+        content_digest: string | null;
+        decision_hlc: string | null;
+    };
+    vault_record_domain: {
+        singleton: number;
+        op_kind: string;
+    };
+    vault_entry_candidates: VaultRecordTable & {
+        key_id: string;
+        key_version: number;
+        branch_id: string;
+    };
+    vault_key_branches: VaultKeyBranchTable;
+    vault_revocations: {
+        owner_did: string;
+        key_id: string;
+        recipient_did: string;
+    };
+};

package/lib/record-tables.js

@@ -0,0 +1 @@
+export { };

package/lib/records-adapter.d.ts

@@ -0,0 +1,3 @@
+import type { RecordStoreAdapter } from '@kokuin/records';
+import type { Bound } from './records-rows.js';
+export declare function makeAdapter(bound: Bound): RecordStoreAdapter;

package/lib/records-adapter.js

@@ -0,0 +1,197 @@
+import { chunk, withKeyLocks, withStoreTransaction } from '@hozon/db';
+import { recordClaimDigest, recordKeyText, recordPayloadMatches, recordSignerKey, verifySignedRecord } from '@kokuin/records';
+import { vaultRecordMeta } from '@kokuin/vault';
+import { upsertReplicatedDecision } from './batch.js';
+import { getVaultStore } from './definition.js';
+import { VaultModeConflict } from './record-context.js';
+import { getVaultRecordsStore } from './record-definition.js';
+import { projection } from './records-projection.js';
+import { assertDomain, boundAdapters, checked, decision, deleteCopies, GET_MANY_CHUNK, groupRows, supported, VaultRecordRowError, values, whereKey } from './records-rows.js';
+import { settleAll } from './settle.js';
+export function makeAdapter(bound) {
+    const { db } = bound;
+    const adapter = {
+        isTransaction: db.isTransaction,
+        async transaction (fn) {
+            return bound.context.provider.withTransaction(async (provider)=>{
+                const storage = await getVaultRecordsStore(provider);
+                const innerBound = {
+                    ...bound,
+                    ...storage,
+                    store: await getVaultStore(provider),
+                    locks: []
+                };
+                const inner = makeAdapter(innerBound);
+                return withStoreTransaction(storage.db, async ()=>{
+                    await assertDomain(innerBound);
+                    try {
+                        return await fn(inner);
+                    } finally{
+                        for (const lock of [
+                            ...innerBound.locks ?? []
+                        ].reverse())lock.release();
+                        await Promise.all((innerBound.locks ?? []).map((lock)=>lock.task));
+                    }
+                });
+            });
+        },
+        async get (key) {
+            await assertDomain(bound);
+            if (!supported(key.type)) return null;
+            return withStoreTransaction(db, async (tx)=>{
+                return decision(await whereKey(tx, key).orderBy('op_hash').execute(), bound);
+            });
+        },
+        async getMany (keys) {
+            await assertDomain(bound);
+            const wanted = new Map(keys.filter((key)=>supported(key.type)).map((key)=>[
+                    recordKeyText(key),
+                    key
+                ]));
+            const loadChunk = async (addresses)=>{
+                return withStoreTransaction(db, async (tx)=>{
+                    return tx.selectFrom('vault_records').selectAll().where((eb)=>{
+                        return eb.or(addresses.map((key)=>{
+                            return eb.and([
+                                eb('type', '=', key.type),
+                                eb('owner', '=', key.owner),
+                                eb('id', '=', key.id)
+                            ]);
+                        }));
+                    }).orderBy('op_hash').execute();
+                });
+            };
+            const chunks = await settleAll(chunk(wanted.values(), GET_MANY_CHUNK).map(loadChunk));
+            const groups = [
+                ...groupRows(chunks.flat())
+            ];
+            const decisions = await settleAll(groups.map(([, rows])=>decision(rows, bound)));
+            const result = new Map();
+            for (const [index, [key]] of groups.entries()){
+                const value = decisions[index];
+                if (value !== null && value !== undefined) result.set(key, value);
+            }
+            return result;
+        },
+        async list (types) {
+            await assertDomain(bound);
+            const selected = [
+                ...new Set(types.filter(supported))
+            ];
+            if (selected.length === 0) return [];
+            const rows = await withStoreTransaction(db, async (tx)=>{
+                return tx.selectFrom('vault_records').selectAll().where('type', 'in', selected).orderBy('type').orderBy('owner').orderBy('id').orderBy('op_hash').execute();
+            });
+            const groups = [
+                ...groupRows(rows).values()
+            ];
+            const decisions = await Promise.allSettled(groups.map((group)=>decision(group, bound)));
+            const result = [];
+            // Callbacks and non-row failures keep group order.
+            for (const [index, outcome] of decisions.entries()){
+                if (outcome.status === 'fulfilled') {
+                    if (outcome.value !== null) result.push(outcome.value);
+                    continue;
+                }
+                const error = outcome.reason;
+                if (!(error instanceof VaultRecordRowError)) throw error;
+                const row = groups[index]?.[0];
+                if (row !== undefined) bound.params.onCorruptRow?.({
+                    type: row.type,
+                    id: row.id,
+                    error
+                });
+            }
+            return result;
+        },
+        async lock (keys) {
+            if (!bound.context.provider.isTransactionBound || bound.locks === undefined) throw new Error('Record locks require an adapter transaction');
+            if (keys.some((key)=>key.type !== 'vault.key')) throw new TypeError('Unknown vault lock namespace');
+            const entered = Promise.withResolvers();
+            const released = Promise.withResolvers();
+            // Keep hozon's queue held through authoritative reads and all apply effects.
+            const task = withKeyLocks(bound.context.provider, 'vault_keys', keys.map((key)=>[
+                    key.key
+                ]), async (provider)=>{
+                bound.context = {
+                    ...bound.context,
+                    provider
+                };
+                bound.store = await getVaultStore(provider);
+                entered.resolve();
+                await released.promise;
+            });
+            bound.locks.push({
+                release: ()=>released.resolve(),
+                task
+            });
+            await Promise.race([
+                entered.promise,
+                task
+            ]);
+        },
+        async putCopy (record) {
+            if (!db.isTransaction) throw new Error('Copy persistence requires the apply transaction');
+            await assertDomain(bound);
+            const op = await verifySignedRecord(record, bound.opKind, bound.params.methods);
+            if (op === null || !supported(record.type) || !recordPayloadMatches(record, op.claim)) throw new Error('Invalid vault record copy');
+            const type = record.type;
+            if (vaultRecordMeta(type, op.claim) === null) throw new Error('Invalid vault record metadata');
+            const previousRows = await whereKey(db, record).orderBy('op_hash').execute();
+            const previous = await decision(previousRows, bound);
+            const contentDigest = recordClaimDigest(op.claim);
+            const decisionHLC = typeof op.claim.meta.version === 'string' ? op.claim.meta.version : op.claim.hlc;
+            const same = previous?.contentDigest === contentDigest && previous.decisionHLC === decisionHLC;
+            const incomingSigner = recordSignerKey(op.issuer, record.opJWT);
+            // One check per prior row, shared by both passes. The first failure in row order wins.
+            const priors = await settleAll(previousRows.map((row)=>checked(row, bound)));
+            let keepHash = record.opHash;
+            for (const [index, row] of previousRows.entries()){
+                const prior = priors[index] ?? null;
+                if (same && prior !== null && recordSignerKey(prior.op.issuer, prior.copy.opJWT) === incomingSigner && row.op_hash < keepHash) keepHash = row.op_hash;
+            }
+            if (!same) {
+                await db.deleteFrom('vault_records').where('type', '=', record.type).where('owner', '=', record.owner).where('id', '=', record.id).execute();
+                await projection(record, op, bound);
+            } else {
+                const dropped = previousRows.filter((row, index)=>{
+                    const prior = priors[index] ?? null;
+                    return prior === null || recordSignerKey(prior.op.issuer, prior.copy.opJWT) === incomingSigner && row.op_hash !== keepHash;
+                }).map((row)=>row.op_hash);
+                if (dropped.length > 0) await deleteCopies(db, record, dropped);
+            }
+            if (keepHash === record.opHash) await db.insertInto('vault_records').values(values(record, op, bound)).onConflict((oc)=>oc.columns([
+                    'type',
+                    'owner',
+                    'id',
+                    'op_hash'
+                ]).doNothing()).execute();
+            // Claims the key for replicated mode and records the decision in one statement. A key
+            // held in local mode is left alone and counts no row.
+            const claimed = await upsertReplicatedDecision(db, {
+                type: record.type,
+                owner: record.owner,
+                id: record.id,
+                content_digest: contentDigest,
+                decision_hlc: decisionHLC
+            }).executeTakeFirstOrThrow();
+            if (claimed.numInsertedOrUpdatedRows === 0n) throw new VaultModeConflict();
+        },
+        async pruneCopy (key, signerDID) {
+            if (!db.isTransaction) throw new Error('Copy pruning requires the apply transaction');
+            const current = await adapter.get(key);
+            if (current === null) return;
+            const verified = await Promise.all(current.copies.map(async (copy)=>{
+                return {
+                    copy,
+                    op: await verifySignedRecord(copy, bound.opKind, bound.params.methods)
+                };
+            }));
+            if (!verified.some(({ op })=>op !== null && op.issuer !== signerDID)) return;
+            const dropped = verified.filter(({ op })=>op?.issuer === signerDID).map(({ copy })=>copy.opHash);
+            if (dropped.length > 0) await deleteCopies(db, key, dropped);
+        }
+    };
+    boundAdapters.set(adapter, bound);
+    return adapter;
+}

package/lib/records-ports.d.ts

@@ -0,0 +1,4 @@
+import type { RecordStoreAdapter } from '@kokuin/records';
+import type { VaultRecordPorts } from '@kokuin/vault';
+/** Resolve effects only through an adapter bound to the apply transaction. */
+export declare function vaultRecordPortsFor(store: RecordStoreAdapter): VaultRecordPorts;

package/lib/records-ports.js

@@ -0,0 +1,72 @@
+import { withStoreTransaction } from '@hozon/db';
+import { recordPayloadMatches, verifySignedRecord } from '@kokuin/records';
+import { vaultRecordMeta, vaultRevocationRecordID } from '@kokuin/vault';
+import { selectWrappings, statementChunks } from './batch.js';
+import { VaultModeConflict } from './record-context.js';
+import { assertDomain, boundAdapters, values } from './records-rows.js';
+import { settleAll } from './settle.js';
+/** Resolve effects only through an adapter bound to the apply transaction. */ export function vaultRecordPortsFor(store) {
+    const bound = boundAdapters.get(store) ?? boundAdapters.get(store.adapterForType?.('vault.entry'));
+    if (bound === undefined) throw new Error('Vault adapter is unavailable for effect ports');
+    const { db } = bound;
+    return {
+        async retainEntryCandidate (record) {
+            if (!db.isTransaction) throw new Error('Candidate retention requires the apply transaction');
+            const op = await verifySignedRecord(record, bound.opKind, bound.params.methods);
+            if (op === null || !recordPayloadMatches(record, op.claim) || vaultRecordMeta('vault.entry', op.claim) === null) throw new Error('Invalid entry candidate');
+            await db.insertInto('vault_entry_candidates').values({
+                ...values(record, op, bound),
+                key_id: op.claim.meta.keyID,
+                key_version: op.claim.meta.keyVersion,
+                branch_id: op.claim.meta.branchID ?? ''
+            }).onConflict((oc)=>oc.columns([
+                    'type',
+                    'owner',
+                    'id',
+                    'op_hash'
+                ]).doNothing()).execute();
+        },
+        async listRevocations (address) {
+            await assertDomain(bound);
+            const rows = await withStoreTransaction(db, async (tx)=>{
+                return tx.selectFrom('vault_revocations').select('recipient_did').where('owner_did', '=', address.ownerDID).where('key_id', '=', address.keyID).orderBy('recipient_did').execute();
+            });
+            return rows.map((row)=>row.recipient_did);
+        },
+        async dropRevokedWrappings (address) {
+            if (!db.isTransaction) throw new Error('Wrapping suppression requires the apply transaction');
+            const [revocations, wrappings] = await settleAll([
+                this.listRevocations(address),
+                bound.store.listWrappings(address)
+            ]);
+            const denied = new Set(revocations.map((did)=>vaultRevocationRecordID(address.keyID, did)));
+            const revoked = wrappings.filter((row)=>{
+                const recipients = [
+                    row.recipientDID,
+                    ...row.descriptors.filter((d)=>d.kind === 'did').map((d)=>d.params.recipient)
+                ];
+                return recipients.some((recipient)=>{
+                    return typeof recipient === 'string' && denied.has(vaultRevocationRecordID(address.keyID, recipient));
+                });
+            }).map((row)=>({
+                    owner_did: row.ownerDID,
+                    wrapping_id: row.wrappingID
+                }));
+            if (revoked.length === 0) return;
+            const parts = statementChunks(revoked, 2);
+            const held = await settleAll(parts.map((part)=>selectWrappings(db, part).execute()));
+            // Denial never deletes an unrelated local record.
+            if (held.flat().some((row)=>row.mode === 'local')) throw new VaultModeConflict();
+            await settleAll(parts.map((part)=>{
+                return db.deleteFrom('vault_wrappings').where((eb)=>{
+                    return eb.or(part.map((row)=>{
+                        return eb.and([
+                            eb('owner_did', '=', row.owner_did),
+                            eb('wrapping_id', '=', row.wrapping_id)
+                        ]);
+                    }));
+                }).execute();
+            }));
+        }
+    };
+}

package/lib/records-projection.d.ts

@@ -0,0 +1,3 @@
+import type { SignedRecord, VerifiedRecordOp } from '@kokuin/records';
+import type { Bound } from './records-rows.js';
+export declare function projection(record: SignedRecord, op: VerifiedRecordOp, bound: Bound): Promise<void>;

package/lib/records-projection.js

@@ -0,0 +1,105 @@
+import { decodeVaultRecord } from '@kokuin/vault';
+import { VaultModeConflict } from './record-context.js';
+export async function projection(record, op, bound) {
+    const { db, adapter } = bound;
+    const type = record.type;
+    const table = type === 'vault.key' ? 'vault_keys' : type === 'vault.entry' ? 'vault_entries' : type === 'vault.wrapping' ? 'vault_wrappings' : null;
+    if (table !== null) {
+        const column = type === 'vault.key' ? 'key_id' : type === 'vault.entry' ? 'entry_id' : 'wrapping_id';
+        const existing = await db.selectFrom(table).select('mode').where('owner_did', '=', record.owner).where(column, '=', record.id).executeTakeFirst();
+        if (existing?.mode === 'local') throw new VaultModeConflict();
+        // The caller, `putCopy`, claims the decision for replicated mode in the same transaction.
+        if (record.payload === null) {
+            await db.deleteFrom(table).where('owner_did', '=', record.owner).where(column, '=', record.id).execute();
+            return;
+        }
+    }
+    const decoded = decodeVaultRecord(record, op.claim.meta);
+    switch(decoded.type){
+        case 'vault.key':
+            {
+                const row = {
+                    owner_did: decoded.owner,
+                    key_id: decoded.id,
+                    suite: decoded.payload.suite,
+                    version: decoded.meta.version,
+                    state: decoded.payload.state,
+                    mode: 'replicated'
+                };
+                await db.insertInto('vault_keys').values(row).onConflict((oc)=>oc.columns([
+                        'owner_did',
+                        'key_id'
+                    ]).doUpdateSet(row)).execute();
+                break;
+            }
+        case 'vault.wrapping':
+            {
+                const row = {
+                    owner_did: decoded.owner,
+                    wrapping_id: decoded.id,
+                    key_id: decoded.meta.keyID,
+                    key_version: decoded.meta.keyVersion,
+                    descriptors: adapter.encodeJSON(decoded.payload.descriptors),
+                    descriptor_digest: decoded.payload.descriptorDigest,
+                    iv: adapter.encodeBinary(decoded.payload.iv),
+                    wrapped_key: adapter.encodeBinary(decoded.payload.wrappedKey),
+                    recipient_did: decoded.meta.recipient,
+                    provenance: decoded.meta.branchID,
+                    mode: 'replicated'
+                };
+                await db.insertInto('vault_wrappings').values(row).onConflict((oc)=>oc.columns([
+                        'owner_did',
+                        'wrapping_id'
+                    ]).doUpdateSet(row)).execute();
+                break;
+            }
+        case 'vault.entry':
+            {
+                const row = {
+                    owner_did: decoded.owner,
+                    entry_id: decoded.id,
+                    key_id: decoded.meta.keyID,
+                    key_version: decoded.meta.keyVersion,
+                    kind: decoded.meta.kind,
+                    label: decoded.meta.label,
+                    attributes: adapter.encodeJSON(decoded.meta.attributes),
+                    iv: adapter.encodeBinary(decoded.payload.iv),
+                    ciphertext: adapter.encodeBinary(decoded.payload.ciphertext),
+                    hlc: decoded.hlc,
+                    provenance: decoded.meta.branchID,
+                    mode: 'replicated'
+                };
+                await db.insertInto('vault_entries').values(row).onConflict((oc)=>oc.columns([
+                        'owner_did',
+                        'entry_id'
+                    ]).doUpdateSet(row)).execute();
+                break;
+            }
+        case 'vault.key-branch':
+            {
+                const row = {
+                    owner_did: decoded.owner,
+                    key_id: decoded.meta.keyID,
+                    key_version: decoded.meta.keyVersion,
+                    record_id: decoded.id,
+                    branch_id: decoded.meta.branchID,
+                    op_jwt: decoded.payload.opJWT
+                };
+                await db.insertInto('vault_key_branches').values(row).onConflict((oc)=>oc.columns([
+                        'owner_did',
+                        'record_id'
+                    ]).doUpdateSet(row)).execute();
+                break;
+            }
+        case 'vault.revocation':
+            await db.insertInto('vault_revocations').values({
+                owner_did: decoded.owner,
+                key_id: decoded.meta.keyID,
+                recipient_did: decoded.meta.revokedDID
+            }).onConflict((oc)=>oc.columns([
+                    'owner_did',
+                    'key_id',
+                    'recipient_did'
+                ]).doNothing()).execute();
+    }
+}

package/lib/records-rows.d.ts

@@ -0,0 +1,54 @@
+import type { Kysely } from '@hozon/db';
+import type { RecordDecision, RecordKey, RecordStoreAdapter, SignedRecord, VerifiedRecordOp } from '@kokuin/records';
+import type { VaultDatabase } from './record-context.js';
+import type { VaultRecordsTables, VaultRecordTable } from './record-tables.js';
+import type { VaultRecordsParams } from './records.js';
+import type { VaultStoreAPI } from './types.js';
+export declare class VaultRecordRowError extends Error {
+    #private;
+    constructor(key: RecordKey & {
+        cause?: unknown;
+    });
+    get type(): string;
+    get id(): string;
+}
+export type CheckedRecord = {
+    copy: SignedRecord;
+    op: VerifiedRecordOp;
+};
+export type HeldLock = {
+    release: () => void;
+    task: Promise<void>;
+};
+export type Bound = VaultDatabase & {
+    opKind: string;
+    params: VaultRecordsParams;
+    store: VaultStoreAPI;
+    locks?: Array<HeldLock>;
+    /** Set once the domain row matched this adapter's operation kind. */
+    domainChecked?: boolean;
+};
+export declare const GET_MANY_CHUNK = 160;
+export declare const boundAdapters: WeakMap<RecordStoreAdapter, Bound>;
+export declare const acceptedKinds: WeakMap<VaultStoreAPI, string>;
+export declare function supported(type: string): boolean;
+export declare function json(value: unknown): unknown;
+export declare function groupRows(rows: Array<VaultRecordTable>): Map<string, Array<VaultRecordTable>>;
+/** Deletes the named copies of one record, in statements of at most `PARAMETER_BUDGET` binds. */
+export declare function deleteCopies(db: Kysely<VaultRecordsTables>, key: RecordKey, opHashes: Array<string>): Promise<void>;
+export declare function whereKey(db: Kysely<VaultRecordsTables>, key: RecordKey): import("@hozon/db").SelectQueryBuilder<VaultRecordsTables, "vault_records", {
+    hlc: string;
+    type: string;
+    owner: string;
+    id: string;
+    op_jwt: string;
+    op_hash: string;
+    payload: Uint8Array<ArrayBufferLike> | null;
+    payload_digest: string | null;
+    deleted: number;
+    meta: Record<string, unknown>;
+}>;
+export declare function assertDomain(bound: Bound): Promise<void>;
+export declare function checked(row: VaultRecordTable, bound: Bound): Promise<CheckedRecord | null>;
+export declare function decision(rows: Array<VaultRecordTable>, bound: Bound): Promise<RecordDecision | null>;
+export declare function values(record: SignedRecord, op: VerifiedRecordOp, bound: Bound): VaultRecordTable;