@muhkoo/connect 0.14.0-alpha.8 → 0.14.0-alpha.9

package/dist/connect.d.ts

@@ -5920,6 +5920,8 @@ interface FileEntry {
      * would defeat the point of keeping history out of the directory record.
      */
     versions?: number;
+    /** See `DirEntry.moving`. */
+    moving?: true;
 }
 interface DirEntry {
     kind: "dir";
@@ -5928,6 +5930,25 @@ interface DirEntry {
     /** Base64 AES-256 key for that record. See the capability note above. */
     key: string;
     mtime: number;
+    /**
+     * Set on both copies while a move between two directories is under way.
+     *
+     * A move writes two records, attaching before it detaches, and one that
+     * is interrupted leaves the same entry - the same directory record, or
+     * the same file id, content and history - named in both. This is how a
+     * delete of either copy knows to look for the other before letting go of
+     * anything. Cleared by the move's last write, and from the one copy left
+     * when a delete removes the other. Left in place, it costs a delete of
+     * that entry one read of the tree, and a file keeps every version that
+     * falls off its history.
+     *
+     * Not cleared when that last write is the one that fails: the move has
+     * otherwise finished, only one copy is named anywhere, and nothing comes
+     * back to unmark it. A retried move of the same entry carries the mark
+     * over. That copy then keeps what falls off its history for good - a
+     * storage cost, never a loss.
+     */
+    moving?: true;
 }
 type Entry = FileEntry | DirEntry;
 /** One directory record, as stored (before encryption). */
@@ -5983,6 +6004,57 @@ declare class VfsNotFoundError extends Error {
 declare class VfsConflictError extends Error {
     constructor(message: string);
 }
+/**
+ * Raised when a directory record cannot be read: it does not decrypt or parse
+ * with the key its parent holds, or it does but is not a shape this SDK can
+ * read - not an object, a version other than 1, `entries` missing or not a map.
+ *
+ * Thrown, never read as an empty directory. The next write into an "empty"
+ * directory would seal an empty record over the real one, and a record this
+ * version cannot read may simply be one a NEWER version wrote. Nor is the
+ * directory skipped: a sync that cannot see a subtree reads its absence as a
+ * deletion. The record is left exactly as stored; a recursive delete
+ * (`delete(path, { recursive: true })`) detaches it when the user wants it
+ * gone.
+ */
+declare class VfsCorruptRecordError extends Error {
+    /** The record's id - `dirKey(id)` is where it is stored. */
+    readonly id: string;
+    /** The path it was reached through, when known. A moved subtree can have two. */
+    readonly path?: string;
+    constructor(id: string, path: string | undefined, reason: string);
+}
+/**
+ * Raised when a walk or a copy would go past a size or depth ceiling, or a
+ * write would put a directory deeper than a walk reads.
+ *
+ * Thrown rather than returning what was gathered so far, because every caller
+ * of a walk treats a path that is missing from the result as a path that does
+ * not exist - and a sync then plans a deletion for it. A tree this large or
+ * deep is almost always one built to be expensive to read: directory records
+ * can point at the same directory many times over, so a handful of tiny
+ * records can describe more paths than there are atoms.
+ */
+declare class VfsLimitError extends Error {
+    /**
+     * Which ceiling was hit: total entries, total characters of path text,
+     * nesting depth, or - for a copy - how many places one directory may
+     * appear. Entries alone do not bound memory - a name may be 255 bytes, so
+     * one path can be ~16KB - which is why path text has its own.
+     */
+    readonly limit: "entries" | "pathChars" | "depth" | "shared";
+    /** The ceiling itself. */
+    readonly max: number;
+    /** Where the operation started, or for a write what it was asked to write. */
+    readonly path: string;
+    /**
+     * Where the ceiling was reached: the directory being listed, or for depth
+     * the entry one level too deep. Walking the tree to find the culprit would
+     * hit the same ceiling, so this is the only pointer the caller gets.
+     */
+    readonly at: string;
+    constructor(limit: VfsLimitError["limit"], max: number, path: string, at: string, doing?: string);
+}
 
 /**
  * `client.vfs` — a real filesystem over Muhkoo primitives.
@@ -6053,6 +6125,18 @@ interface VfsNamespaceDeps {
     seed: () => Uint8Array | null;
     /** Versions retained per file. */
     historyLimit?: number;
+    /**
+     * Ceilings for the operations that visit a whole subtree - `walk` (and so
+     * `glob`) and `copy`. `entries` is the most entries one call may visit;
+     * `pathChars` the most characters of path text, summed over every path it
+     * visits. The defaults are far past any real project; tests lower them so
+     * a hostile tree hits them in milliseconds. `Client` does not pass these,
+     * so `client.vfs` always has the defaults.
+     */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 declare class VfsNamespace {
     private readonly deps;
@@ -6066,6 +6150,8 @@ declare class VfsNamespace {
      */
     private cache;
     private readonly historyLimit;
+    private readonly maxEntries;
+    private readonly maxPathChars;
     constructor(deps: VfsNamespaceDeps);
     /**
      * The working directory relative paths resolve against.
@@ -6117,14 +6203,46 @@ declare class VfsNamespace {
     stat(path: string): Promise<VfsStat>;
     /** Immediate children of a directory. One record fetch. */
     list(path?: string): Promise<VfsStat[]>;
+    /**
+     * A directory's entries in listing order: directories first, then by name.
+     * Shared by `list` and `walk`, so a walk's output order is exactly the order
+     * of the listings it is made of.
+     */
+    private children;
     private warn;
     /**
      * Every file path under a prefix, depth-first.
      *
      * Deliberately separate from `list`: this walks the whole subtree, which is
      * one fetch per directory. Fine for a project, wrong as a default.
+     *
+     * Throws VfsLimitError past the entry budget or the depth ceiling, and
+     * VfsCorruptRecordError for a directory it cannot read, rather than
+     * returning part of the tree. Skips (with a warning) a directory that is
+     * one of its own ancestors.
      */
     walk(path?: string): Promise<string[]>;
+    /**
+     * Every entry under a prefix - directories as well as files - depth-first,
+     * each directory just before its contents. `walk` is this with the
+     * directories filtered out, so the two can never disagree about what is in
+     * a tree; version control uses this one because a commit records empty
+     * directories too.
+     */
+    walkEntries(path?: string): Promise<VfsStat[]>;
+    /**
+     * `walkEntries` without the list: `visit` is called with each entry in
+     * the same order, and for a file with its manifest - the handle
+     * `statManifest` gives, without resolving the path all over again, which
+     * on a deep tree cost far more than the walk itself. Null for a directory.
+     *
+     * For a caller that does not need every entry at once. Version control
+     * compares the working tree with a commit as it goes, where holding the
+     * whole walk beside the whole commit, and a map of one beside a map of
+     * the other, ran a 512MB heap out of memory inside the default budgets.
+     * The same guards and budgets as `walk`, which is built on this.
+     */
+    eachEntry(path: string, visit: (stat: VfsStat, manifest: FileManifest | null) => void): Promise<void>;
     readFile(path: string): Promise<Uint8Array>;
     readText(path: string): Promise<string>;
     /**
@@ -6170,6 +6288,16 @@ declare class VfsNamespace {
     mkdir(path: string, opts?: {
         recursive?: boolean;
     }): Promise<void>;
+    /**
+     * Refuse now what creating these directories with `mkdir -p` would refuse
+     * part way: one deeper than MAX_DEPTH, or a name on the way held by an
+     * entry this version cannot read. Writes nothing.
+     *
+     * For an operation that removes things before it writes - a checkout -
+     * so that a refusal comes before anything is gone. A FILE in the way is
+     * not refused: such an operation removes those first.
+     */
+    assertCreatable(dirs: Iterable<string>): Promise<void>;
     /**
      * Write a file, creating parent directories as needed.
      *
@@ -6183,10 +6311,10 @@ declare class VfsNamespace {
     /**
      * Delete a file, or a directory when `recursive`.
      *
-     * `keepContent` removes the entry WITHOUT releasing its shards. A checkout
-     * needs that: the file is leaving the working tree, but commits still
-     * reference the same manifest, and releasing would free content history
-     * depends on.
+     * `keepContent` removes the entry WITHOUT releasing its shards - or, for
+     * a directory, the shards of anything in it. A checkout needs that: the
+     * file is leaving the working tree, but commits still reference the same
+     * manifest, and releasing would free content history depends on.
      */
     delete(path: string, opts?: {
         recursive?: boolean;
@@ -6198,9 +6326,21 @@ declare class VfsNamespace {
      *
      * A directory move is O(1) regardless of how much is inside it — the
      * subtree records are not touched at all, because nothing in them records
-     * its own path.
+     * its own path. Except a move to a DEEPER place, which reads the subtree
+     * first: what is below must still be inside MAX_DEPTH once it is moved.
      */
     rename(from: string, to: string): Promise<void>;
+    /**
+     * Refuse to move the directory at `src` to `dst` when something in it
+     * would then be deeper than MAX_DEPTH from the root. Writes nothing.
+     *
+     * Measured only moving deeper, because it reads the whole subtree: one
+     * move of a 40-deep tree under a 30-deep directory was accepted when only
+     * the moved directory was measured, and every walk of the root threw from
+     * then on. A part that cannot be read cannot be measured, and does not
+     * stop the move - that record stops every walk above it already.
+     */
+    private assertFitsAt;
     /**
      * Copy a file or a directory tree.
      *
@@ -6262,25 +6402,158 @@ declare class VfsNamespace {
     /** Open a directory by path, creating nothing. Throws if it is missing. */
     private openDir;
     private openDirOrNull;
+    /** Open a directory by path, along with the id of every directory on the way to it. */
+    private openChain;
+    /**
+     * `path` is only for error messages. The cache is keyed by id, so when two
+     * paths reach one record - a move interrupted between attach and detach -
+     * the error names whichever asked first.
+     */
     private openDirById;
+    /**
+     * Turn a decrypted record into an OpenDir, or throw.
+     *
+     * The record is THROWN on, never read as empty, when its shape is wrong -
+     * see VfsCorruptRecordError. An individual entry of the wrong shape is set
+     * aside in `hidden` instead: out of every read, but kept for the write.
+     */
+    private readRecord;
     /** Apply an edit to a directory record and persist it. */
     private mutate;
     private createDir;
-    /** Recursively remove a subtree's records. Best-effort: unreachable ≠ fatal. */
+    /**
+     * Every directory record in a subtree, each once, opened - and nothing
+     * changed. The first half of a recursive delete; see `delete`.
+     *
+     * Once per id, so a record that references another inside the subtree
+     * cannot recurse forever, and a subtree reachable twice is not released
+     * twice. And never a directory in `above` - the root and everything else
+     * on the way down to the target - nor the root by any route. Deduplicating
+     * alone let an entry naming the root pull the whole filesystem into the
+     * delete, the root record included; a walk shows the same pointer as a
+     * cycle and skips it, so this skips it too.
+     *
+     * `moving` says whether anything in it is marked as half of an
+     * interrupted move, which is what makes a delete look for the other half.
+     */
+    private subtree;
+    /**
+     * Delete these records and let go of every file in them. The second half
+     * of a recursive delete, run only once the subtree is detached. Cannot
+     * throw: every step is best-effort, because unreachable is not fatal.
+     *
+     * With `elsewhere` - what the rest of the tree still names, read because
+     * something here is half of an interrupted move - a record still named
+     * elsewhere is kept, and so is a file.
+     */
     private purge;
+    /**
+     * Unmark what is left of an interrupted move once a delete has removed
+     * the other copy. Marked, a file keeps every version that falls off its
+     * history, because the other copy might hold it - for good, once there
+     * is no other copy - and every delete of the entry, or of a directory
+     * above it, reads the whole tree. Only when exactly one marked copy is
+     * left: more, and they are still shared. Best-effort, like everything
+     * after a detach; failing, it stays marked, which costs only that.
+     */
+    private settle;
+    /**
+     * Let go of files that are leaving the tree: each one's content, every
+     * version its history holds, and the history record. Best-effort, like
+     * everything after a detach.
+     *
+     * A file id still named elsewhere is one file with two names, left by an
+     * interrupted move: its content and history belong to the name that is
+     * staying, and all that changes hands is the key its history opens with.
+     * `keepContent` keeps every file's content and drops only its history
+     * record, as a checkout needs.
+     */
+    private letGo;
+    /**
+     * What the tree still names with one entry left out: every directory
+     * record, and every file id with a directory that holds it. Null when
+     * part of the tree cannot be read or followed, so the answer is unknown.
+     */
+    private namedElsewhere;
+    /**
+     * Everything reachable from the root: every directory record's id and
+     * key, and every file id with a directory that names it - following the
+     * entries hidden only for their name, which still reference what they
+     * point at. `skip` leaves one entry out: one about to be detached.
+     *
+     * Fetches up to WALK_CONCURRENCY records at once, each record once
+     * however often it is named. Throws VfsCorruptRecordError for a record a
+     * path reaches that cannot be read, unless `lenient`. `unknown` counts
+     * what could not be followed at all: an entry this version cannot read,
+     * and a record behind an unusable name that does not open - which no path
+     * can reach, and so no recursive delete can remove - or, `lenient`, any
+     * record that does not open.
+     */
+    private references;
     /**
      * Deep-copy an entry. Files reuse their manifest (no bytes move); each
      * directory gets a fresh id and key, so the copy is independent of the
      * original — writing into one must never appear in the other.
+     *
+     * `at` is the entry's SOURCE path, and `depth` how many directories deep
+     * from the root the copy of it will be. With `run.write` false this is the
+     * dry run: every check, no reference taken and no record stored.
      */
     private cloneEntry;
     /**
-     * Let go of a file's bytes: the current manifest and every retained
-     * version, then the history record itself.
+     * Let go of one file's bytes: its content, every version its history
+     * retains, and the history record itself.
+     *
+     * Each distinct manifest once. `copies` is every entry naming the file -
+     * two after an interrupted move, which may by now hold different
+     * versions - and `restore` puts a version back without taking a second
+     * reference, so its manifest is in the entry and in the history both.
+     * Releasing per mention released one reference twice, and so freed bytes
+     * a copy elsewhere, holding its own reference, still needed.
      */
     private releaseFile;
+    /**
+     * A file's history record, opened with the first of `keys` that opens
+     * it, and that key. Null when there is none, or none of them does.
+     */
+    private openHistory;
+    /**
+     * Seal a file's history with the key of the directory that holds it now.
+     *
+     * A history record is sealed with its directory's key, so a file moved
+     * to another directory carried a history its new directory could not
+     * open: every read of it, and every write to the file, failed from then
+     * on. Nothing to do when there is no history, when it opens with `to`
+     * already, or when none of the keys opens it.
+     */
+    private rekeyHistory;
+    /**
+     * The history of the file `entry` names as `name` in `parent`, and the
+     * key to seal it with from now on.
+     *
+     * A history is sealed with its directory's key - usually. The two halves
+     * of an interrupted move share one history, sealed with ONE of their
+     * directories' keys, and a file moved between directories by a version
+     * before `rename` re-sealed it still has its old directory's. So when the
+     * directory's own key does not open it, every key in the tree is tried,
+     * the other half's first: a read of the whole tree, and only then. It
+     * need not be read in full, or understood - an entry this version cannot
+     * follow may hide a key, but a key that opens the record is proof
+     * enough. Found, it is re-sealed with this directory's key, so the search
+     * is made once - except for half of a move, which keeps the key that
+     * opened it and so keeps working for both halves.
+     *
+     * No record, or a value that is not a sealed record at all, is an empty
+     * history, as it always was. One that no key opens is thrown on, with a
+     * message rather than a bare decryption error: writing an empty history
+     * over it would lose every version it holds.
+     */
     private readHistory;
-    /** Push `entry` onto its history record. Returns the new version count. */
+    /**
+     * Push `entry` onto its history record. Returns the new version count.
+     * `next` is the manifest the entry will hold once the caller has written
+     * it.
+     */
     private pushHistory;
 }
 
@@ -6386,21 +6659,88 @@ interface VcsNamespaceDeps {
     key: () => Promise<Uint8Array>;
     /** Who to record as the author. */
     author: () => string;
+    /**
+     * `entries` is the most tree entries one read of history may visit - one
+     * `status`, `diff` or `checkout` - and `pathChars` the most characters of
+     * path those entries may add up to. The defaults are far past any real
+     * project; tests lower them so a hostile tree hits them in milliseconds.
+     * `Client` does not pass these, so `client.vcs` always has the defaults.
+     */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 declare class Repo {
     private readonly slug;
     private readonly deps;
+    private readonly maxEntries;
+    private readonly maxPathChars;
+    /**
+     * How many directories deep below the project a tree may nest. The
+     * working tree may be written MAX_DEPTH directories below the root, and
+     * the project itself is some of those: a deeper tree would check out into
+     * something no walk will read, and `status` - and every checkout after,
+     * which walks the tree first - would throw from then on.
+     */
+    private readonly maxTreeDepth;
     constructor(slug: string, deps: VcsNamespaceDeps);
     private get root();
     /** Store an object, returning its hash and whether it was new. */
     private put;
+    /** Does this stored record open to an object with this hash? */
+    private holds;
+    /**
+     * Fetch an object, and prove it is the one that was asked for.
+     *
+     * Content addressing is only a guarantee if the address is checked. Without
+     * this a stored object could claim any hash - including its own, so a tree
+     * could contain itself and `status` would follow it for ever. Every object
+     * this repository has ever written verifies: `put` hashes exactly the value
+     * it seals, `canonical` is independent of key order and drops `undefined`
+     * exactly as JSON does, and hashing has never been versioned.
+     */
     private get;
+    /** A commit, checked to be one. See `commitProblem`. */
+    private readCommit;
+    /**
+     * Start a traversal of history: a budget shared by every branch of it, and
+     * a cache of the tree objects it has fetched.
+     *
+     * The cache matters for the same reason the budget does. Identical
+     * subtrees are one object, so a tree of honest-but-hostile shape is a
+     * handful of fetches and a vast number of paths; caching keeps it to the
+     * handful, and the budget stops the paths. It caches OBJECTS, never output
+     * - each name a shared subtree appears at is still listed.
+     */
+    private treeWalk;
+    /**
+     * A tree object's entries, checked and ready to walk.
+     *
+     * Returned in a null-prototype map, so a name like `constructor` is looked
+     * up as an entry and not found as an inherited property.
+     */
+    private readTree;
+    /**
+     * A record that is not an object - HEAD, a branch ref, the branch list,
+     * MERGE - opened. Null when there is none; `problem` when there is one
+     * that does not open. What is inside is the caller's to check.
+     */
+    private openRecord;
     private head;
     private setHead;
     private readRef;
+    /** A branch's commit, null when there is no such branch, or "unreadable". */
+    private refState;
     private writeRef;
     /** Every branch name in this repository. */
     branches(): Promise<string[]>;
+    /**
+     * The branch list, less any name a branch could not have been created
+     * with - left out with a warning, like an unreadable entry in a tree, so
+     * one planted name does not hide every real one.
+     */
+    private readIndex;
     /** The commit HEAD resolves to, or null in an empty repository. */
     current(): Promise<string | null>;
     /**
@@ -6418,7 +6758,27 @@ declare class Repo {
         theirs: string;
         name: string;
     } | null>;
-    /** Write a directory and everything under it, returning the tree's hash. */
+    /**
+     * Give up on a merge that stopped for conflicts: the next commit is an
+     * ordinary one, with one parent. The working tree is left as it is,
+     * conflict markers and all. To put it back, switch to the current branch
+     * with `discardChanges` — not `checkout`, which always leaves HEAD
+     * detached, so later commits would stop moving the branch.
+     *
+     * Also the way out when the record of the merge cannot be read, which
+     * would otherwise stop every commit.
+     */
+    abortMerge(): Promise<void>;
+    /**
+     * Write a directory and everything under it, returning the tree's hash.
+     *
+     * Reads the working tree through ONE `walkEntries`, rather than listing
+     * each directory by path and recursing. The recursion had no guard at all:
+     * a directory record that names itself - which anything holding the seed
+     * can plant - sent `commit` down /loop/loop/loop/... for ever. The walk has
+     * the cycle guard, the budget and the depth ceiling, so a commit records
+     * exactly the tree `status` compares it against.
+     */
     private writeTree;
     /** Commits reachable from HEAD, newest first. */
     log(limit?: number): Promise<LogEntry[]>;
@@ -6446,8 +6806,6 @@ declare class Repo {
      * trees for states nobody chose to keep.
      */
     status(): Promise<Change[]>;
-    /** The working tree as a path → entry map, mirroring `filesOf`. */
-    private workingFiles;
     /**
      * Turn what a person typed into a commit hash.
      *
@@ -6539,6 +6897,11 @@ interface VcsNamespaceOptions {
     /** The in-memory master seed, or null when locked. Read per call. */
     seed: () => Uint8Array | null;
     author: () => string;
+    /** See `VcsNamespaceDeps.limits`. */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
@@ -7865,7 +8228,7 @@ declare function getId(row: {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-declare const VERSION = "0.14.0-alpha.8";
+declare const VERSION = "0.14.0-alpha.9";
 
 /**
  * The SDK's process-global logger.
@@ -7897,5 +8260,5 @@ declare global {
 }
 declare const appLogger: InstanceType<typeof Logger>;
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
 export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };