@muhkoo/connect 0.10.14-alpha.0 → 0.12.0-alpha.0

package/dist/connect.d.ts

@@ -1897,7 +1897,7 @@ interface AuthSuccess {
 /** A vault factor record (M1.0 + M2 gated types). Wrap/iv are base64 AES-GCM; absent for phrase. */
 interface VaultFactor {
     id: string;
-    type: "password" | "passkey" | "phrase-marker" | "email" | "google";
+    type: "password" | "passkey" | "phrase-marker" | "email" | "google" | "device";
     wrap?: string;
     iv?: string;
     params?: Record<string, unknown>;
@@ -2009,7 +2009,9 @@ declare class AuthClient {
     /** Passkeys are per-origin: naming the caller's host returns THAT origin's
      *  passkey instead of whichever was enrolled first (which WebAuthn would
      *  refuse). Ignored for other factor types. */
-    rpId?: string): Promise<{
+    rpId?: string, 
+    /** Device factors are selected by id — a user may have many machines. */
+    factorId?: string): Promise<{
         factor: VaultFactor | null;
     }>;
     /**
@@ -2966,10 +2968,6 @@ interface ZkAuthDeps {
     circuits: CircuitUrls;
     session: SessionState;
 }
-/**
- * ZK identity auth. One instance per {@link Client}; reads/writes the shared
- * {@link SessionState}.
- */
 declare class ZkAuth {
     private readonly deps;
     constructor(deps: ZkAuthDeps);
@@ -3184,6 +3182,63 @@ declare class ZkAuth {
      * passwordless (passkey) login, both of which recover the same seed.
      */
     get seedBase64(): string | null;
+    /**
+     * Pair this machine, so it can unlock the account later without a password.
+     *
+     * Generates a random 32-byte key, wraps the master seed under it, and stores
+     * only the CIPHERTEXT in the vault as a `device` factor. The key is returned
+     * for the caller to persist locally and is never sent anywhere.
+     *
+     * The split is the point: the seed itself never lands on disk, and the
+     * server holds a blob it cannot open. Revoking the factor
+     * ({@link revokeDevice}) makes the local key inert immediately — which a
+     * stored master seed can never be, because nothing can reach out and
+     * un-store it.
+     *
+     * Returns the factor id and the key, both base64. Losing the key just means
+     * re-pairing; leaking it is equivalent to leaking the seed for as long as
+     * the factor exists, so store it with the tightest permissions available.
+     */
+    enrollDevice(label: string): Promise<{
+        factorId: string;
+        deviceKey: string;
+    }>;
+    /**
+     * Unlock using a key stored by {@link enrollDevice}.
+     *
+     * Fetches the wrapped seed and opens it locally. Establishes the encryption
+     * identity only — pair it with a session for calls that need one.
+     *
+     * Throws distinguishably: a REVOKED factor is gone from the vault and says
+     * so, where a wrong key fails to decrypt. A machine that has had its access
+     * withdrawn should be able to tell you that, not just "decryption failed".
+     */
+    unlockWithDevice(username: string, factorId: string, deviceKey: string): Promise<void>;
+    /** Paired machines, newest first. Metadata only — never the ciphertext. */
+    listDevices(): Promise<Array<{
+        id: string;
+        label?: string;
+        createdAt?: number;
+    }>>;
+    /** Withdraw a machine's access. Its stored key stops working immediately. */
+    revokeDevice(factorId: string): Promise<boolean>;
+    /**
+     * Restore an unlocked identity from a seed you already hold.
+     *
+     * The inverse of {@link seedBase64}, for hosts that persist the seed
+     * themselves rather than re-deriving it from a password: a CLI holding it in
+     * a 0600 file, a server-side tool, a test. Without this the seed is a
+     * one-way export and anything outside a browser has to run a full ZK login —
+     * circuits download and proof — on every single invocation.
+     *
+     * Establishes the ENCRYPTION identity only. It does not authenticate: pair
+     * it with a session token (`sessionStore`) for calls that need one.
+     *
+     * Treat a persisted seed as the master credential it is. It is not scoped
+     * and cannot be revoked server-side the way a session token can — rotating
+     * it means moving the identity.
+     */
+    unlockWithSeed(seedBase64: string): void;
     /** Poseidon commitment for an identity — the value the server stores. */
     private commitmentFor;
     /**
@@ -3766,6 +3821,8 @@ interface StorageChangeEvent<T = unknown> {
 }
 declare class KvNamespace {
     private readonly deps;
+    /** One personal-space socket, shared by every subscriber. */
+    private feed;
     private cipher;
     private cipherIdentity;
     constructor(deps: KvNamespaceDeps);
@@ -3789,6 +3846,20 @@ declare class KvNamespace {
      * Requires a `WebSocket` global (browsers; Node 22+ or a `ws` shim).
      */
     on<T = unknown>(event: "change", handler: (e: StorageChangeEvent<T>) => void): () => void;
+    /**
+     * Subscribe to the personal space's raw change feed.
+     *
+     * Every key this user owns crosses this socket, not only `client.kv`
+     * collections — the VFS keeps its directory records here too. Consumers get
+     * the frame untouched: no decryption, no offline-cache merge, because the
+     * value's meaning depends on which subsystem wrote it.
+     *
+     * The transport is SHARED and reference-counted. `WSTransport` namespaces
+     * its events by `id`, so two transports with the same id would cross wires
+     * on the shared event bus — and a second socket to the same Durable Object
+     * would be pure waste besides.
+     */
+    onRaw(handler: (frame: unknown) => void): () => void;
     private dispatchChange;
     /** Decode a stored value: decrypt envelopes, pass plaintext through. */
     private decode;
@@ -4915,9 +4986,20 @@ declare class SpaceNamespace {
      * Create a new space: generate its keypair (public key = id), register
      * metadata, mint the initial group key, and connect. Returns the open Space.
      */
+    /**
+     * Create a space.
+     *
+     * `messaging: false` registers the space and stops there — no group-key
+     * bootstrap and no WebSocket. Use it for a space that only ever holds
+     * FILES: each chunk carries its own key inside its manifest, so the group
+     * keyring buys nothing, and opening a socket makes the write path depend on
+     * a live connection. That dependency is wrong for a CLI, and it is what made
+     * the first VFS write hang forever instead of failing.
+     */
     createSpace(opts?: {
         historyPolicy?: HistoryPolicy;
         private?: boolean;
+        messaging?: boolean;
     }): Promise<Space>;
     /** Join an existing space by id (its public key). Resolves once a key arrives. */
     joinSpace(spaceId: string, opts?: {
@@ -5379,6 +5461,693 @@ declare class AccessTokensNamespace {
     private path;
 }
 
+/**
+ * Wire types for the VFS metadata layer.
+ *
+ * ## What is stored where
+ *
+ * The filesystem is a graph of **directory records**, one per directory, each
+ * held under a personal-space KV key and encrypted client-side. A record lists
+ * only its immediate children — so listing a directory is one fetch, and you
+ * only ever pay for the subtrees you actually open.
+ *
+ * File CONTENT is not here. Bytes are written with `client.storage.writeFile`
+ * exactly as any other file — into a real Space, with a real gated manifest —
+ * and the entry keeps the returned `FileManifest` as its handle.
+ * `client.storage.readByManifest(manifest)` then reconstructs the bytes from
+ * the content-addressed shard store with no space membership or directory
+ * lookup needed, which is what makes a file shareable by handing over the
+ * handle alone.
+ *
+ * This supersedes the flat personal mirror `writeFile` already maintains
+ * (`{spaceId, manifest}` keyed by manifest id): the same metadata, in the same
+ * personal space, arranged as a tree you can actually navigate.
+ *
+ * ## Why directories have stable random ids, not content hashes
+ *
+ * A git-style tree keys each directory by the hash of its contents, so writing
+ * one file rewrites every ancestor up to the root. Here a directory's id is
+ * random and permanent, so a file write touches exactly ONE record — its
+ * parent — and renaming or moving a directory edits only the parent entry
+ * while the whole subtree underneath stays byte-identical and untouched.
+ *
+ * ## Why a directory's key lives in its parent
+ *
+ * Only the root key is derived from the master seed. Every other directory has
+ * a random key stored in its parent's entry, which chains capabilities
+ * downward: handing someone `{id, key}` for `/apps/my-app` lets them walk that
+ * subtree and nothing else, because no key can be derived upward. That is the
+ * seam group-sharing hangs off later without re-encrypting the filesystem.
+ */
+
+/** Personal-space KV key holding a directory record. */
+declare const dirKey: (id: string) => string;
+/** Personal-space KV key holding one file's prior versions. */
+declare const historyKey: (id: string) => string;
+/** The root directory's id is fixed — it is the one node reached without a parent. */
+declare const ROOT_ID = "root";
+/** HKDF label for the seed-derived root key. Sits alongside `muhkoo-storage-v1`. */
+declare const VFS_ROOT_INFO = "muhkoo-vfs-v1";
+interface FileEntry {
+    kind: "file";
+    /**
+     * Stable identity, independent of name and location. Renaming a file keeps
+     * its id, so its version history follows it rather than being orphaned.
+     */
+    id: string;
+    /** The handle: everything needed to read the current bytes back. */
+    manifest: FileManifest;
+    /** Plaintext byte length. */
+    size: number;
+    mtime: number;
+    /**
+     * Count of prior versions in the file's history record.
+     *
+     * Denormalised on purpose: the file tree wants to show "3 versions" while
+     * listing a directory, and fetching every history record to answer that
+     * would defeat the point of keeping history out of the directory record.
+     */
+    versions?: number;
+}
+interface DirEntry {
+    kind: "dir";
+    /** Record id — `dirKey(id)` locates it. Permanent for the directory's life. */
+    id: string;
+    /** Base64 AES-256 key for that record. See the capability note above. */
+    key: string;
+    mtime: number;
+}
+type Entry = FileEntry | DirEntry;
+/** One directory record, as stored (before encryption). */
+interface DirNode {
+    v: 1;
+    /** Child name → entry. Names are unique within a directory, per filesystem. */
+    entries: Record<string, Entry>;
+    mtime: number;
+}
+/** A file's prior versions, newest first. Fetched only when asked for. */
+interface HistoryRecord {
+    v: 1;
+    versions: Array<{
+        manifest: FileManifest;
+        size: number;
+        mtime: number;
+    }>;
+}
+/** What `stat` and `list` hand back — a path-addressed view of an entry. */
+interface VfsStat {
+    path: string;
+    name: string;
+    kind: "file" | "dir";
+    size: number;
+    mtime: number;
+    versions: number;
+}
+/** The encrypted envelope every record is stored in. */
+interface SealedRecord {
+    v: 1;
+    /** Base64 12-byte AES-GCM IV. */
+    iv: string;
+    /** Base64 ciphertext with the 16-byte tag appended. */
+    ct: string;
+}
+/** The personal-space blob store the VFS persists through. */
+interface VfsStore {
+    get(key: string): Promise<unknown | null>;
+    put(key: string, value: unknown): Promise<void>;
+    delete(key: string): Promise<void>;
+    /** Every key in the store — the personal space is shared, so this is NOT VFS-only. */
+    list(): Promise<string[]>;
+}
+/** Raised when the master seed is not held, so the root key cannot be derived. */
+declare class VfsLockedError extends Error {
+    constructor();
+}
+/** Raised for a path that does not exist. */
+declare class VfsNotFoundError extends Error {
+    constructor(path: string);
+}
+/** Raised when an operation would clobber or misuse an existing entry. */
+declare class VfsConflictError extends Error {
+    constructor(message: string);
+}
+
+/**
+ * `client.vfs` — a real filesystem over Muhkoo primitives.
+ *
+ * Metadata is a graph of encrypted directory records in the user's personal
+ * space; file content is chunked, encrypted and stored in the global
+ * content-addressed shard store, referenced by manifest. See `types.ts` for
+ * why directories carry stable random ids and why each key lives in its parent.
+ *
+ * ## Consistency
+ *
+ * Every mutation is a read-modify-write of exactly ONE directory record, so a
+ * write cannot leave the tree half-updated: either the parent names the new
+ * child or it does not. Two tabs writing different directories never conflict;
+ * two tabs writing the SAME directory resolve last-writer-wins at the personal
+ * space, which carries an HLC per key. Orphaned records (a directory whose
+ * parent entry lost the race) are unreachable rather than corrupting — they
+ * cost storage until a future sweep, which is the trade this shape makes in
+ * exchange for single-record writes.
+ */
+
+/**
+ * The slice of content storage the VFS needs.
+ *
+ * Narrow on purpose: the VFS knows how to name and arrange things, not how to
+ * shard them. The adapter in `Client` resolves the content space and calls
+ * `client.storage.writeFile` unchanged — the file still lands in a real Space
+ * with a real gated manifest, and the VFS just keeps the handle somewhere
+ * better than a flat mirror.
+ */
+interface VfsContentStore {
+    write(data: Uint8Array | Blob, meta: {
+        name: string;
+        type: string;
+    }): Promise<{
+        manifest: FileManifest;
+        size: number;
+    }>;
+    read(manifest: FileManifest): Promise<Uint8Array>;
+    /**
+     * Drop a reference to a manifest's shards.
+     *
+     * Shards are content-addressed and reference-counted, so deleting a file is
+     * not enough to reclaim the bytes — without this, every version ever
+     * written stays on disk and billed forever. Best-effort: a failure here
+     * leaks storage but must not block the delete.
+     */
+    release(manifest: FileManifest): Promise<void>;
+    /**
+     * Take an ADDITIONAL reference to shards that already exist.
+     *
+     * Needed when a manifest gains a second owner without new bytes being
+     * written — copying a file. Without it the copy holds a handle to shards
+     * with a refcount of one, and deleting the original frees the bytes out
+     * from under it.
+     */
+    retain(manifest: FileManifest): Promise<void>;
+}
+interface VfsNamespaceDeps {
+    store: VfsStore;
+    /**
+     * Subscribe to the personal space's raw change feed, if the runtime has one.
+     * Optional so the VFS works headlessly (a CLI, a test) with no socket.
+     */
+    subscribe?: (handler: (frame: unknown) => void) => () => void;
+    content: VfsContentStore;
+    /** The in-memory master seed, or null when locked. Read per call — it can change. */
+    seed: () => Uint8Array | null;
+    /** Versions retained per file. */
+    historyLimit?: number;
+}
+declare class VfsNamespace {
+    private readonly deps;
+    private rootKey;
+    /**
+     * Decrypted directory records, by id.
+     *
+     * The file tree re-lists constantly while typing, and every miss is a
+     * network round trip plus a decrypt. Invalidated precisely on write rather
+     * than by TTL — a stale directory listing shows files that are not there.
+     */
+    private cache;
+    private readonly historyLimit;
+    constructor(deps: VfsNamespaceDeps);
+    /**
+     * The working directory relative paths resolve against.
+     *
+     * Kept here rather than left to each caller so that a CLI, a script and the
+     * SDK all agree on what "here" means — the alternative is every consumer
+     * re-implementing `cd`, and disagreeing about `..`.
+     */
+    private _cwd;
+    /** The current working directory. Always absolute. */
+    get cwd(): string;
+    /**
+     * Change the working directory.
+     *
+     * Verifies the target is a real directory, so a typo fails here — where the
+     * message can name the path — rather than turning every later relative path
+     * into a confusing "does not exist".
+     */
+    cd(path: string): Promise<string>;
+    /** Resolve a path against the working directory. Absolute paths pass through. */
+    resolve(path: string): string;
+    /** True when the master seed is held, so the root key can be derived. */
+    get unlocked(): boolean;
+    /**
+     * Drop every cached record.
+     *
+     * Call after signing in as someone else — the cache is keyed by directory
+     * id with no notion of whose filesystem it came from, and serving one
+     * identity's directories to another would be the worst possible bug here.
+     */
+    clearCache(): void;
+    /**
+     * Call `handler` when this filesystem changes somewhere else — another tab,
+     * another machine, the CLI.
+     *
+     * Deliberately a NOTIFICATION, not a diff: the frame names a record id, and
+     * a record id is not a path (paths are resolved by walking, and the walk is
+     * what the change may have invalidated). So the cache is dropped and the
+     * caller re-reads whatever it is actually showing. Trying to translate a
+     * record id back into a path would mean maintaining a reverse index that
+     * could itself go stale.
+     *
+     * Returns an unsubscribe function. A runtime with no socket (a CLI) gets a
+     * no-op rather than an error — watching is an optimisation, never required
+     * for correctness.
+     */
+    watch(handler: () => void): () => void;
+    exists(path: string): Promise<boolean>;
+    stat(path: string): Promise<VfsStat>;
+    /** Immediate children of a directory. One record fetch. */
+    list(path?: string): Promise<VfsStat[]>;
+    /**
+     * Every file path under a prefix, depth-first.
+     *
+     * Deliberately separate from `list`: this walks the whole subtree, which is
+     * one fetch per directory. Fine for a project, wrong as a default.
+     */
+    walk(path?: string): Promise<string[]>;
+    readFile(path: string): Promise<Uint8Array>;
+    readText(path: string): Promise<string>;
+    /**
+     * A file's manifest — the handle itself, without reading the bytes.
+     *
+     * Version control records manifests rather than content, so a commit costs
+     * a hash and a reference, not a copy.
+     */
+    statManifest(path: string): Promise<{
+        manifest: FileManifest;
+        size: number;
+    }>;
+    /**
+     * Read content by its manifest, wherever it came from.
+     *
+     * A merge needs the COMMON ANCESTOR's version of a file, which by definition
+     * is not in the working tree any more. The manifest is the whole capability,
+     * so no path lookup is involved.
+     */
+    readByManifest(manifest: FileManifest): Promise<Uint8Array>;
+    /**
+     * Pin content that something other than the working tree depends on.
+     *
+     * A commit references a manifest, so it is an OWNER of that content — without
+     * a reference of its own, deleting the file from the working tree would free
+     * shards the history still needs, and checking out an older commit would find
+     * the content gone. (It did, in test.)
+     */
+    retainManifest(manifest: FileManifest): Promise<void>;
+    /**
+     * Point a path at content that already exists.
+     *
+     * This is how a checkout restores a file: the bytes are in the shard store
+     * already, so nothing is uploaded or downloaded — only the directory record
+     * changes. Takes a reference, because a second path now depends on those
+     * shards.
+     */
+    writeManifest(path: string, manifest: FileManifest, size: number): Promise<VfsStat>;
+    /**
+     * Create a directory. `recursive` creates missing parents and tolerates an
+     * existing target, matching `mkdir -p`.
+     */
+    mkdir(path: string, opts?: {
+        recursive?: boolean;
+    }): Promise<void>;
+    /**
+     * Write a file, creating parent directories as needed.
+     *
+     * The previous version is pushed onto the file's history record before the
+     * directory entry is replaced, so an interrupted write can lose the new
+     * version but never the old one.
+     */
+    writeFile(path: string, data: Uint8Array | string | Blob, opts?: {
+        type?: string;
+    }): Promise<VfsStat>;
+    /**
+     * Delete a file, or a directory when `recursive`.
+     *
+     * `keepContent` removes the entry WITHOUT releasing its shards. A checkout
+     * needs that: the file is leaving the working tree, but commits still
+     * reference the same manifest, and releasing would free content history
+     * depends on.
+     */
+    delete(path: string, opts?: {
+        recursive?: boolean;
+        keepContent?: boolean;
+    }): Promise<void>;
+    /**
+     * Move or rename. Works across directories, which is the same operation:
+     * detach the entry from one parent and attach it to another.
+     *
+     * A directory move is O(1) regardless of how much is inside it — the
+     * subtree records are not touched at all, because nothing in them records
+     * its own path.
+     */
+    rename(from: string, to: string): Promise<void>;
+    /**
+     * Copy a file or a directory tree.
+     *
+     * Copying a FILE moves no bytes: content is immutable and content-addressed,
+     * so the new entry simply points at the same manifest. A 200 MB asset
+     * duplicates in one small metadata write, and the shard store already holds
+     * exactly one copy of it.
+     *
+     * The copy gets a NEW file id, so it does not inherit or share history —
+     * two paths sharing an id would mean saving one silently pushed a version
+     * onto the other.
+     */
+    copy(from: string, to: string): Promise<VfsStat>;
+    /**
+     * Paths matching a glob, relative to the whole filesystem.
+     *
+     * Matching happens on the client over a walk of the tree, so the cost is one
+     * record fetch per directory — cheap for a project, and worth knowing before
+     * pointing it at the root of a large filesystem. Use `walk` when the prefix
+     * already narrows it.
+     */
+    glob(pattern: string, opts?: {
+        from?: string;
+    }): Promise<string[]>;
+    /**
+     * Delete metadata records no longer reachable from the root.
+     *
+     * These accumulate because every write touches exactly one record: if two
+     * tabs edit the same directory, last-writer-wins at the personal space can
+     * leave a child whose parent entry lost the race. Unreachable is harmless —
+     * it is invisible and undecryptable-by-nobody — but it costs storage, so
+     * this reclaims it.
+     *
+     * Deliberately explicit, never automatic: a sweep racing another tab's
+     * in-flight write could delete a record that is about to be referenced.
+     * Run it when the filesystem is idle.
+     */
+    sweep(opts?: {
+        force?: boolean;
+    }): Promise<{
+        removed: string[];
+    }>;
+    /** Prior versions of a file, newest first. One record fetch. */
+    history(path: string): Promise<Array<{
+        size: number;
+        mtime: number;
+    }>>;
+    /**
+     * Restore a prior version, where 0 is the most recent one.
+     *
+     * The current version is pushed onto history first, so restoring is itself
+     * undoable rather than a one-way door.
+     */
+    restore(path: string, index?: number): Promise<VfsStat>;
+    private expectFile;
+    /** Resolve a path to its entry, or null. Root has no entry of its own. */
+    private find;
+    private root;
+    /** Open a directory by path, creating nothing. Throws if it is missing. */
+    private openDir;
+    private openDirOrNull;
+    private openDirById;
+    /** Apply an edit to a directory record and persist it. */
+    private mutate;
+    private createDir;
+    /** Recursively remove a subtree's records. Best-effort: unreachable ≠ fatal. */
+    private purge;
+    /**
+     * Deep-copy an entry. Files reuse their manifest (no bytes move); each
+     * directory gets a fresh id and key, so the copy is independent of the
+     * original — writing into one must never appear in the other.
+     */
+    private cloneEntry;
+    /**
+     * Let go of a file's bytes: the current manifest and every retained
+     * version, then the history record itself.
+     */
+    private releaseFile;
+    private readHistory;
+    /** Push `entry` onto its history record. Returns the new version count. */
+    private pushHistory;
+}
+
+/**
+ * Object model for version control over the VFS. See `docs/VCS_DESIGN.md`.
+ *
+ * Two spaces, deliberately: the WORKING TREE (`/apps/<slug>`) uses mutable
+ * random directory ids so a file write touches one record; the REPOSITORY
+ * (here) is content-addressed so a commit means the same thing forever. Git
+ * makes the same split, for the same reason.
+ */
+
+/** A file in a commit. The manifest IS the content — there are no blob objects. */
+interface TreeFile {
+    kind: "file";
+    manifest: FileManifest;
+    size: number;
+}
+/** A subdirectory, by the hash of its own tree object. */
+interface TreeDir {
+    kind: "tree";
+    hash: string;
+}
+type TreeEntry = TreeFile | TreeDir;
+/**
+ * One directory, frozen.
+ *
+ * Addressed by the hash of its canonical form, so an unchanged directory has
+ * the same hash in every commit containing it — a deep project costs one new
+ * tree per CHANGED directory, not one per commit.
+ */
+interface Tree {
+    v: 1;
+    entries: Record<string, TreeEntry>;
+}
+interface Commit {
+    v: 1;
+    /** Hash of the root tree. */
+    tree: string;
+    /**
+     * Ancestors. An ARRAY because a merge has two; the first commit has none.
+     * Order matters: `parents[0]` is the branch being committed onto.
+     */
+    parents: string[];
+    message: string;
+    author: string;
+    at: number;
+}
+/** Where a branch points, or a specific commit when detached. */
+type Head = {
+    branch: string;
+} | {
+    detached: string;
+};
+/** A single change between two trees. */
+interface Change {
+    path: string;
+    kind: "added" | "removed" | "modified";
+}
+/** A path the merge could not settle on its own. */
+interface Conflict {
+    path: string;
+    /** `binary` cannot be merged at all — the user picks a side. */
+    reason: "content" | "binary" | "modify-delete";
+}
+interface MergeResult {
+    /** "up-to-date" and "fast-forward" do no three-way work at all. */
+    kind: "up-to-date" | "fast-forward" | "merged" | "conflicted";
+    commit?: string;
+    conflicts: Conflict[];
+}
+interface LogEntry {
+    hash: string;
+    message: string;
+    author: string;
+    at: number;
+    parents: string[];
+}
+/** Storage keys. Namespaced per project so repositories cannot collide. */
+declare const objectKey: (slug: string, hash: string) => string;
+declare const refKey: (slug: string, name: string) => string;
+declare const headKey: (slug: string) => string;
+declare const refsIndexKey: (slug: string) => string;
+/** An in-progress merge: what to make the second parent when it is committed. */
+declare const mergeKey: (slug: string) => string;
+declare const DEFAULT_BRANCH = "main";
+declare class VcsError extends Error {
+    constructor(message: string);
+}
+
+/**
+ * `client.vcs` — version control for a project in the VFS.
+ *
+ * Phase 1: objects, commit, log, checkout, diff. Branches and merge build on
+ * this; see `docs/VCS_DESIGN.md` for the whole shape and for why the repository
+ * is content-addressed while the working tree is not.
+ */
+
+interface VcsNamespaceDeps {
+    vfs: VfsNamespace;
+    store: VfsStore;
+    /** The key repository objects are sealed with — the project's own. */
+    key: () => Promise<Uint8Array>;
+    /** Who to record as the author. */
+    author: () => string;
+}
+declare class Repo {
+    private readonly slug;
+    private readonly deps;
+    constructor(slug: string, deps: VcsNamespaceDeps);
+    private get root();
+    /** Store an object, returning its hash and whether it was new. */
+    private put;
+    private get;
+    private head;
+    private setHead;
+    private readRef;
+    private writeRef;
+    /** Every branch name in this repository. */
+    branches(): Promise<string[]>;
+    /** The commit HEAD resolves to, or null in an empty repository. */
+    current(): Promise<string | null>;
+    /**
+     * Freeze the working tree as a commit.
+     *
+     * Trees are written bottom-up so a directory's hash is known before its
+     * parent references it. Nothing is written to the shard store: file entries
+     * carry the manifest the VFS already holds.
+     */
+    commit(message: string, parents?: string[]): Promise<string>;
+    /** Move whatever HEAD points at onto a new commit. */
+    private advance;
+    /** The other side of a merge that stopped for conflicts, if any. */
+    pendingMerge(): Promise<{
+        theirs: string;
+        name: string;
+    } | null>;
+    /** Write a directory and everything under it, returning the tree's hash. */
+    private writeTree;
+    /** Commits reachable from HEAD, newest first. */
+    log(limit?: number): Promise<LogEntry[]>;
+    /**
+     * What changed between two commits.
+     *
+     * Identical subtree hashes prune the walk: an untouched directory is one
+     * comparison regardless of how much is inside it. That is the payoff for
+     * content-addressing the trees.
+     */
+    diff(fromHash: string | null, toHash: string): Promise<Change[]>;
+    private diffTrees;
+    /**
+     * Replace the working tree with a commit's.
+     *
+     * Moves no file content: entries carry manifests the shard store already
+     * holds, so this rewrites directory records only.
+     */
+    /**
+     * What has changed since the last commit.
+     *
+     * Compares the WORKING TREE against HEAD without writing any objects: the
+     * common case is answering "anything to commit?", and a `status` that
+     * quietly stored a tree object every time would litter the repository with
+     * trees for states nobody chose to keep.
+     */
+    status(): Promise<Change[]>;
+    /** The working tree as a path → entry map, mirroring `filesOf`. */
+    private workingFiles;
+    /**
+     * Turn what a person typed into a commit hash.
+     *
+     * Accepts a branch name, `HEAD`, a full or abbreviated hash, and trailing
+     * `^` / `~n` to walk back through parents — so `show abc123^` means "the
+     * commit before that one" the way anyone who has used git expects.
+     */
+    resolve(rev: string): Promise<string>;
+    /** A hash prefix a person typed → the one commit it names. */
+    private expand;
+    /**
+     * Put one file back to the way it was in a commit.
+     *
+     * Scoped to a path on purpose — recovering one file you broke should not
+     * mean rewinding everything else you have done since.
+     */
+    restore(path: string, rev?: string): Promise<void>;
+    checkout(commitHash: string, opts?: {
+        discardChanges?: boolean;
+    }): Promise<void>;
+    /** Make the working tree match a commit, leaving HEAD alone. */
+    private materialise;
+    /** Project-relative path → absolute VFS path. */
+    private abs;
+    private collect;
+    /** Create a branch at a commit (HEAD by default). Does not switch to it. */
+    branch(name: string, at?: string): Promise<string>;
+    /**
+     * Move onto a branch, bringing the working tree with it.
+     *
+     * Unlike {@link checkout}, this ATTACHES head: later commits advance the
+     * branch. Checking out a bare commit deliberately does not, so that
+     * committing from a historical state cannot silently rewrite a branch.
+     */
+    switchTo(name: string, opts?: {
+        discardChanges?: boolean;
+    }): Promise<void>;
+    /**
+     * Refuse to overwrite work that was never recorded.
+     *
+     * Moving between commits REPLACES the working tree, so uncommitted edits
+     * are gone — and unlike an ordinary overwrite, the person did not ask for
+     * anything to be written. Naming the files is the point: "you have changes"
+     * with no list leaves them guessing what they are about to lose.
+     */
+    private guardWorkingTree;
+    /** The branch HEAD is on, or null when detached. */
+    currentBranch(): Promise<string | null>;
+    /**
+     * Merge another branch into the current one.
+     *
+     * Every part of this is client-side by necessity: the server holds
+     * ciphertext and cannot compare versions, so base, ours and theirs are all
+     * fetched and decrypted here.
+     */
+    merge(name: string, opts?: {
+        discardChanges?: boolean;
+    }): Promise<MergeResult>;
+    /** Decide one path. Returns a conflict when it cannot be settled. */
+    private settlePath;
+    private take;
+    /**
+     * The most recent commit reachable from both.
+     *
+     * Walks our ancestry into a set, then theirs breadth-first until it hits it —
+     * so the first match is the nearest, which is what a three-way merge needs.
+     */
+    mergeBase(a: string, b: string): Promise<string | null>;
+    /** Every file in a commit, by path. */
+    private filesOf;
+}
+/**
+ * Version control over the VFS.
+ *
+ * One repository per project, addressed by slug — the same slug the VFS stores
+ * that project's working tree under. `client.vcs.open("my-app")` is the whole
+ * entry point.
+ */
+declare class VcsNamespace {
+    private readonly deps;
+    private readonly repos;
+    constructor(deps: VcsNamespaceOptions);
+    /** The repository for one project. Cheap and cached; creates nothing. */
+    open(slug: string): Repo;
+}
+interface VcsNamespaceOptions {
+    vfs: VfsNamespace;
+    store: VfsStore;
+    /** The in-memory master seed, or null when locked. Read per call. */
+    seed: () => Uint8Array | null;
+    author: () => string;
+}
+
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
 declare const DEFAULT_BASE_URL = "https://api.muhkoo.dev";
 /** The hosted auth SPA — the default {@link ClientOptions.authBaseUrl}. */
@@ -5476,6 +6245,10 @@ declare class Client {
     readonly db: DbNamespace;
     /** File storage — `client.storage.writeFile(...)`, etc. */
     readonly storage: StorageNamespace;
+    /** Filesystem over the personal space: directories, versions, real paths. */
+    readonly vfs: VfsNamespace;
+    /** Version control over the VFS: commits, branches, merges — per project. */
+    readonly vcs: VcsNamespace;
     /** Realtime messaging — `client.message.subscribe(...)`, etc. */
     readonly message: MessageNamespace;
     /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
@@ -5669,6 +6442,47 @@ declare function loadDeviceIdentity(): Promise<PersistedDeviceIdentity | null>;
  */
 declare function clearDeviceIdentity(): Promise<void>;
 
+/**
+ * Three-way line merge.
+ *
+ * Given a common ancestor and two descendants, produce the combined text — or
+ * report the regions where both sides changed the same lines differently.
+ *
+ * The server cannot do any of this: it holds ciphertext and cannot compare
+ * versions, so merging is entirely a client concern and has to be exact here.
+ */
+interface MergeRegionConflict {
+    /** 1-based line where the conflict begins in the merged output. */
+    line: number;
+    ours: string[];
+    theirs: string[];
+}
+interface Merge3Result {
+    lines: string[];
+    conflicts: MergeRegionConflict[];
+}
+/**
+ * Merge `ours` and `theirs` over their common ancestor `base`.
+ *
+ * A region where only one side changed takes that side. A region where both
+ * made the SAME change takes it once — two people fixing the same typo is not a
+ * conflict. Only genuinely divergent edits conflict.
+ */
+declare function merge3(base: string[], ours: string[], theirs: string[]): Merge3Result;
+/**
+ * Merge to text, writing conflict markers where the sides diverged.
+ *
+ * Markers rather than a bespoke format: they are what every developer already
+ * knows how to resolve, and resolving becomes ordinary editing.
+ */
+declare function merge3Text(base: string, ours: string, theirs: string, labels?: {
+    ours: string;
+    theirs: string;
+}): {
+    text: string;
+    conflicted: boolean;
+};
+
 /**
  * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
  *
@@ -6659,5 +7473,5 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DevicePairingError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ReauthRequiredError, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, generateAuthProof, generateDevicePairingKeypair, generatePkce, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbQueryPage, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LoginOptions, LwwMap, LwwRegister, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DevicePairingError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, ReauthRequiredError, ReedSolomonCodec, Repo, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, generateAuthProof, generateDevicePairingKeypair, generatePkce, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbQueryPage, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };