@muhkoo/connect 0.15.0-alpha.0 → 0.15.0-alpha.10

package/dist/connect.d.ts

@@ -1099,6 +1099,59 @@ declare class BroadcastChannel {
     private handleInboundFrame;
 }
 
+/**
+ * `HttpError` — thrown for any non-2xx accelerator response.
+ *
+ * In a module of its own so that `PaymentRequiredError` can extend it while
+ * `HttpClient`, which throws both, imports `PaymentRequiredError`: with the
+ * class in `HttpClient.ts`, the two modules would import each other, and
+ * whichever loaded second would extend a class not yet defined. `HttpClient`
+ * re-exports it, so `import { HttpError } from "./HttpClient"` still works.
+ */
+/** Thrown for any non-2xx accelerator response. Carries the HTTP status. */
+declare class HttpError extends Error {
+    readonly status: number;
+    readonly body?: unknown | undefined;
+    constructor(message: string, status: number, body?: unknown | undefined);
+}
+
+/**
+ * `PaymentRequiredError` — a write the accelerator refused for payment
+ * (accelerator spec 2026-10-06-paid-accounts-and-past-due, "Interfaces and
+ * contracts").
+ *
+ * The accelerator answers such a write with a 402 whose body carries one of
+ * three codes:
+ *   - `user_plan_required`: the app takes paid Muhkoo plans only, and the
+ *     signed-in user is on Free;
+ *   - `user_payment_past_due`: the user's own Muhkoo payment is past due. Only
+ *     first-party apps are told this; every other app is told
+ *     `user_plan_required` instead;
+ *   - `owner_payment_past_due`: the app owner's payment is past due, so the
+ *     app stores nothing new for anyone.
+ * Reads, sign-in and deletes still work in all three cases.
+ *
+ * Every other 402 — the Free-tier refusals that carry `quotaExceeded`,
+ * `requiresPaidTier` or `freeTierFull` — has no `code`, and stays a plain
+ * `HttpError`, as before.
+ */
+
+/** Why a write was refused for payment. A wire contract: these strings never change. */
+type PaymentRequiredCode = "user_plan_required" | "user_payment_past_due" | "owner_payment_past_due";
+/** Thrown for a 402 whose body carries one of the three {@link PaymentRequiredCode}s. */
+declare class PaymentRequiredError extends HttpError {
+    /** Why the write was refused. */
+    readonly code: PaymentRequiredCode;
+    /**
+     * Where to send the user: the portal's upgrade page or its billing page,
+     * as an absolute URL. Set only when the server sent an absolute http(s)
+     * URL. The relative `upgradeUrl` of the Free-tier refusals is never here:
+     * those are not this error.
+     */
+    readonly upgradeUrl?: string;
+    constructor(message: string, code: PaymentRequiredCode, body?: unknown, upgradeUrl?: string);
+}
+
 /**
  * Cloudflare-Workers-compatible Groth16 ZK proof verifier.
  *
@@ -2416,6 +2469,15 @@ interface ShardClientOptions {
      * Provided so callers can inject retries / auth / instrumentation.
      */
     fetch?: typeof fetch;
+    /**
+     * The same fetch with the client's silent re-authentication
+     * (`HttpClient.fetchWithRecovery`), used for uploads only. A paid-only
+     * app refuses a PUT made with a dead session with `401 session_required`;
+     * through this, the session is re-established once and the PUT sent
+     * again, which is safe because its bytes can be sent twice. Reads keep
+     * {@link fetch}. Defaults to {@link fetch}.
+     */
+    fetchWithRecovery?: typeof fetch;
     /**
      * Optional offline byte cache. When present, GETs are served cache-first and
      * populated on success, and PUTs write the cache before the network so a
@@ -2462,8 +2524,10 @@ declare class ShardClient {
     private readonly baseUrl;
     private readonly pathPrefix;
     private readonly fetchFn;
+    /** What a PUT goes through: {@link ShardClientOptions.fetchWithRecovery} when given, else {@link fetchFn}. */
+    private readonly putFn;
     private readonly cache?;
-    /** Hashes waiting for the next batch, each with everyone awaiting it. */
+    /** Hashes waiting for the next batch, each with everyone awaiting it and its size if a caller gave it. */
     private pendingShards;
     private batchTimer;
     /** False once the server is known not to have the batch route. */
@@ -2496,8 +2560,13 @@ declare class ShardClient {
     /**
      * Fetch a shard by hash. Throws if the server returns a non-200; returns
      * `null` for 404 so callers can distinguish "missing" from "errored".
+     *
+     * `size`, the shard's byte length when known (a manifest's `shardSize`),
+     * lets concurrent reads be batched within what the server will send.
      */
-    getShard(hash: string): Promise<Uint8Array | null>;
+    getShard(hash: string, opts?: {
+        size?: number;
+    }): Promise<Uint8Array | null>;
     /**
      * Fetch from origin, COALESCING concurrent requests into one batch.
      *
@@ -2520,6 +2589,8 @@ declare class ShardClient {
     private fetchFromOrigin;
     /** Send one batch of whatever has accumulated, and settle those callers. */
     private flushShardBatch;
+    /** POST one batch and settle everyone waiting on it. Never throws. */
+    private sendShardBatch;
     /** Fetch a shard from origin. Returns `null` for 404 (or offline when a
      *  cache is present, so RS recovery can proceed); throws otherwise. */
     private fetchOneFromOrigin;
@@ -2718,6 +2789,25 @@ declare class FileStorage {
      * origin) and per-chunk auth as {@link readFileFromShards}.
      */
     readChunksFromShards(manifest: FileManifest): AsyncGenerator<Uint8Array>;
+    /**
+     * Each chunk's plaintext, in order, with the next {@link READ_AHEAD_CHUNKS}
+     * already being fetched.
+     *
+     * One chunk at a time, a large file cost a full round trip per 4 MB chunk
+     * with nothing overlapping it: a 33 MB file was eight serial requests,
+     * each mostly waiting. Within a chunk the shard reads were already
+     * parallel; this overlaps the chunks too.
+     *
+     * Bounded on purpose: while the caller holds a yielded chunk, at most
+     * `1 + READ_AHEAD_CHUNKS` more are in flight, and nothing new starts until
+     * it asks for the next — a slow consumer of the stream is not run away
+     * from. A failure surfaces at its own chunk, in order; reads already
+     * started past it are let finish, their failures swallowed rather than
+     * left unhandled. If the caller stops early (`break` or `return()`), no
+     * further read starts and the ones in flight settle on their own; they are
+     * not awaited, so `return()` is not delayed by a slow shard.
+     */
+    private chunksInOrder;
     /** As {@link writeFileToShards}, plus POSTs the manifest to `input.spaceId`. */
     writeFile(input: WriteFileInput): Promise<FileStat>;
     /** As {@link readFileFromShards}, but fetches the manifest from a space first. */
@@ -3888,12 +3978,7 @@ interface HttpClientOptions {
      */
     onUnauthorized?: () => Promise<boolean>;
 }
-/** Thrown for any non-2xx accelerator response. Carries the HTTP status. */
-declare class HttpError extends Error {
-    readonly status: number;
-    readonly body?: unknown | undefined;
-    constructor(message: string, status: number, body?: unknown | undefined);
-}
+
 declare class HttpClient {
     readonly baseUrl: string;
     /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
@@ -4045,6 +4130,14 @@ interface QueueEntry {
     method: string;
     /** Serializable arguments captured at enqueue time. */
     args: unknown;
+    /**
+     * Whose write it is: the commitment of the user signed in when it was
+     * queued, stamped by `OutboundQueue.enqueue`. A drain sends only the
+     * signed-in user's entries, because every replayer builds its request
+     * from the session signed in when it runs. Absent on entries an older
+     * SDK queued, which any drain sends, as before.
+     */
+    commitment?: string;
 }
 interface OfflineEntry<T> {
     key: string;
@@ -4084,35 +4177,92 @@ interface OfflineStore {
  * mutation by re-invoking the real namespace method (with an `isReplay` flag so
  * it doesn't re-enqueue). `drain()` replays entries in HLC order:
  *   - success → remove the entry;
- *   - permanent failure (4xx, or a Space whose member list refuses this user)
- *     → drop it and surface a `SYNC_ERROR` (a write the server will never
- *     accept must not wedge the queue forever);
+ *   - refused for payment (`PaymentRequiredError`: the app takes paid plans
+ *     only, or someone's payment is past due) → keep it and everything after
+ *     it, stop, and surface a `SYNC_ERROR` with `dropped: false`. The server
+ *     accepts it once the user or the app owner pays, so it waits for the next
+ *     reconnect, or for `client.app.access()` to report the app allowed;
+ *   - permanent failure (any other 4xx, or a Space whose member list refuses
+ *     this user) → drop it and surface a `SYNC_ERROR` (a write the server will
+ *     never accept must not wedge the queue forever);
  *   - transient/network failure → stop draining and leave the rest for the next
  *     reconnect.
  *
  * Replays are idempotent by construction (kv/db are LWW-by-key, messages dedupe
  * by `clientId`, file PUTs are content-addressed), so re-running a partially
  * drained queue is safe.
+ *
+ * Every tab of an origin shares the queue. Given a `tryLock`, a drain runs
+ * only while holding `muhkoo:offline-drain:<commitment>`, so two tabs coming
+ * back online replay it once between them, not once each.
  */
 
 type Replayer = (entry: QueueEntry) => Promise<void>;
+/**
+ * Run `fn` holding lock `name` if no one else holds it: true once it has
+ * run, false - without running it - when another holder has it. Web Locks'
+ * `ifAvailable` in a browser tab; see `core/crossTab.ts`.
+ */
+type TryLock = (name: string, fn: () => Promise<void>) => Promise<boolean>;
+interface OutboundQueueOptions {
+    /**
+     * The lock that keeps two tabs from draining at once. Every tab of an
+     * origin shares one IndexedDB queue, and each replayed all of it when it
+     * came back online: two tabs, every queued write twice. Absent (Node,
+     * tests), every drain runs, as before.
+     */
+    tryLock?: TryLock;
+    /**
+     * The signed-in user: stamps each enqueued write, picks which writes a
+     * drain sends, and names the drain lock. With no one signed in, writes are
+     * unstamped and the drain runs unlocked.
+     */
+    commitment?: () => string | null;
+}
 declare class OutboundQueue {
     private readonly store;
+    private readonly opts;
     private readonly replayers;
     private draining;
-    constructor(store: OfflineStore);
+    constructor(store: OfflineStore, opts?: OutboundQueueOptions);
     /** A domain registers how to replay its mutations. */
     register(domain: QueueEntry["domain"], replayer: Replayer): void;
-    /** Record a mutation for later replay; resolves with its assigned seq. */
+    /**
+     * Record a mutation for later replay; resolves with its assigned seq.
+     * Stamped with the signed-in user's commitment, so that it is only ever
+     * sent under their session (see {@link waiting}).
+     */
     enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
-    /** Number of writes still awaiting sync. */
+    /** Number of writes still awaiting sync, every user's. */
     pending(): Promise<number>;
+    /**
+     * The writes a drain would send now, in order: the signed-in user's, and
+     * any an older SDK queued without saying whose they are. Every tab of an
+     * origin shares this queue, and every replayer builds its request from
+     * the session signed in when it runs, so another user's write sent now
+     * would land in this user's space, or overwrite their data. It stays
+     * queued, as it is, until its own user signs in on this device again.
+     */
+    waiting(): Promise<QueueEntry[]>;
+    /** True for an entry this drain may send: the signed-in user's, or one with no user. */
+    private sendable;
     /**
      * Replay queued mutations in HLC order. Coalesces concurrent calls into a
      * single in-flight drain. Stops on the first transient failure, leaving the
      * remaining entries for the next attempt.
      */
     drain(): Promise<void>;
+    /**
+     * One drain, holding the device-wide drain lock where there is one. A
+     * tab that finds another tab holding it leaves the queue to that one,
+     * which is replaying it already and removes each entry as it lands - so
+     * a drain after it finds only what it left.
+     */
+    private drainOnce;
+    /**
+     * One pass over the queue. False when a write refused for payment stopped
+     * it, which leaves that write and everything after it queued.
+     */
     private runDrain;
 }
 
@@ -4242,6 +4392,12 @@ interface OfflineManagerDeps {
     session: SessionState;
     /** Whether offline support is active (browser) vs a no-op (Node/Workers). */
     enabled: boolean;
+    /**
+     * The drain lock the tabs of this origin share - Web Locks in a browser
+     * tab. Absent, every tab drains the shared queue itself, as before. See
+     * `OutboundQueue`.
+     */
+    locks?: TryLock;
 }
 declare class OfflineManager {
     /** True in browsers with IndexedDB; false when running over a NoopStore. */
@@ -4265,6 +4421,16 @@ declare class OfflineManager {
      * replayer re-PUTs from the cache on reconnect.
      */
     deferShardUpload(hash: string): Promise<void>;
+    /**
+     * Replay the queue now, as a reconnect does, if anything is waiting in it.
+     * `client.app.access()` calls this each time it reports the app allowed,
+     * so writes kept after a refusal for payment go out once the user or the
+     * app owner has paid, without waiting for the next reconnect. One drain per
+     * call, never on a timer. With nothing of the signed-in user's queued it
+     * does not drain at all, so the app sees no "syncing". A drain also runs the
+     * catch-up tasks (Space history paging), as a reconnect does.
+     */
+    resume(): Promise<void>;
     /** Resolve once the clock + node id are loaded. */
     ready(): Promise<void>;
     /** Current connectivity state (`online` | `offline` | `syncing`). */
@@ -4328,8 +4494,12 @@ declare class KvCache {
      * state but a fresh local write wins.
      */
     mergeRemote(commitment: string, fullKey: string, envelope: unknown | null, op: "set" | "delete", hlc?: string): Promise<void>;
-    /** Non-tombstoned full keys for a commitment (used for offline `list`). */
-    liveKeys(commitment: string): Promise<string[]>;
+    /**
+     * Non-tombstoned full keys for a commitment that start with `prefix` (all
+     * of them by default), for offline `list`. The store scans the key range
+     * `${commitment}|${prefix}`, so other collections are never read.
+     */
+    liveKeys(commitment: string, prefix?: string): Promise<string[]>;
     /** Queue a kv mutation for replay on reconnect. */
     enqueue(method: "set" | "delete", args: unknown, hlc: string, clientId: string): Promise<void>;
 }
@@ -4341,6 +4511,7 @@ declare class KvCache {
  *   await client.kv.set('todos', id, { title, completed })
  *   const todo = await client.kv.get('todos', id)
  *   const ids  = await client.kv.list('todos')
+ *   const keys = await client.kv.keys('todos/')   // full keys, any prefix
  *   await client.kv.delete('todos', id)
  *   const off  = client.kv.on('change', e => …)   // realtime, cross-device
  *
@@ -4392,8 +4563,23 @@ declare class KvNamespace {
     get<T = unknown>(collection: string, id: string): Promise<T | null>;
     /** Delete `collection`/`id`. Returns whether the key existed. */
     delete(collection: string, id: string): Promise<boolean>;
-    /** List the ids present in `collection`. */
+    /**
+     * List the ids present in `collection`. The server filters by
+     * `${collection}/` and pages; values are not fetched.
+     */
     list(collection: string): Promise<string[]>;
+    /**
+     * Every key in the signed-in user's personal space that starts with
+     * `prefix` (all of them when it is ""), as full keys: `todos/t1`, not
+     * `t1`. Values are not fetched. The personal space is shared by every
+     * app the user signs into, so expect keys you did not write: the VFS's
+     * `vfs/…`, version control's `vcs/…`, the SDK's own `chat-keys` and
+     * `space-keys/…`.
+     *
+     * The local `startsWith` filter stays on purpose: a server older than
+     * the key index ignores `prefix` and returns every key.
+     */
+    keys(prefix?: string): Promise<string[]>;
     /** Reserved — server-side query is deferred (see the overhaul plan). */
     query(_collection: string, _filter?: unknown): Promise<never>;
     /**
@@ -5385,6 +5571,12 @@ interface SpaceDeps {
     httpBaseUrl: string;
     /** Header-injecting fetch from the client's HttpClient. */
     fetch: typeof fetch;
+    /**
+     * The same fetch with the client's silent 401 recovery (`HttpClient.fetchWithRecovery`). File uploads
+     * use it, so a PUT made with a dead session re-establishes the session once instead of failing.
+     * Defaults to {@link fetch}.
+     */
+    fetchWithRecovery?: typeof fetch;
     /** Resolves the user id used for the ratchet / member id (signed-in username). */
     myId: () => string;
     /** Resolves a short-lived WS upgrade ticket (or null when keyless). */
@@ -6521,6 +6713,68 @@ declare class AccessTokensNamespace {
     private path;
 }
 
+/**
+ * `client.app` — what the signed-in user may do in this app (accelerator spec
+ * 2026-10-06-paid-accounts-and-past-due, B6 and B8).
+ *
+ * An app's owner can turn on "Paid Muhkoo accounts only" in the portal. The
+ * accelerator then refuses a Free user's writes that add data, with a 402 the
+ * SDK throws as `PaymentRequiredError`. Reads, sign-in and deletes still work.
+ * The same refusal reaches every user of an app whose owner's payment is past
+ * due, whether or not the setting is on.
+ *
+ * `access()` asks up front, so an app can show the right screen before the
+ * first refusal.
+ */
+
+/** The answer of `GET /api/app/access`. */
+interface AppAccess {
+    /** The owner has turned on "Paid Muhkoo accounts only" for this app. */
+    paidAccountsOnly: boolean;
+    /** The signed-in user may add data in this app now. */
+    allowed: boolean;
+    /**
+     * Why not: the code a refused write carries. Read only when `allowed` is
+     * false, and only when it is one of the three codes.
+     */
+    reason?: PaymentRequiredCode;
+    /**
+     * Where to send the user, as an absolute URL: the portal's upgrade page
+     * for `user_plan_required`, with a way back to this app when the request
+     * came from one of its registered redirect URIs, or its billing page for
+     * `user_payment_past_due`. The accelerator sends it only for those two
+     * reasons: the user can do nothing about the owner's payment. Read only
+     * when `allowed` is false, and only when it is an absolute http(s) URL.
+     */
+    upgradeUrl?: string;
+}
+interface AppNamespaceDeps {
+    http: HttpClient;
+    /**
+     * Called each time `access()` answers `allowed: true`. The Client sends
+     * the writes its offline queue kept after a refusal for payment
+     * (`OfflineManager.resume`). A throw or a rejection is logged and ignored.
+     */
+    onAllowed?: () => Promise<void>;
+}
+declare class AppNamespace {
+    private readonly deps;
+    constructor(deps: AppNamespaceDeps);
+    /**
+     * Whether the signed-in user may add data in this app and, if not, why
+     * and where to send them. Needs the app key and a session; a stale session
+     * is re-established once, as for every request. The route is never
+     * refused for payment. Throws `HttpError` for anything else, among them a
+     * 401 without a session and a 404 from an accelerator older than the
+     * route.
+     *
+     * Each `allowed: true` also sends any writes the offline queue kept after
+     * a refusal for payment, without waiting for them. Call it after sign-in,
+     * and again when the user comes back from the portal.
+     */
+    access(): Promise<AppAccess>;
+}
+
 /**
  * Wire types for the VFS metadata layer.
  *
@@ -6657,8 +6911,14 @@ interface VfsStore {
     get(key: string): Promise<unknown | null>;
     put(key: string, value: unknown): Promise<void>;
     delete(key: string): Promise<void>;
-    /** Every key in the store — the personal space is shared, so this is NOT VFS-only. */
-    list(): Promise<string[]>;
+    /**
+     * Keys in the store that start with `prefix`, or every key without one.
+     * The personal space is shared, so this is NOT VFS-only. An implementation
+     * may ignore `prefix` and return more (the parameter is optional so that
+     * a store written for the old no-argument `list()` still fits), so callers
+     * filter what they get back.
+     */
+    list(prefix?: string): Promise<string[]>;
 }
 /** Raised when the master seed is not held, so the root key cannot be derived. */
 declare class VfsLockedError extends Error {
@@ -6724,6 +6984,114 @@ declare class VfsLimitError extends Error {
     constructor(limit: VfsLimitError["limit"], max: number, path: string, at: string, doing?: string);
 }
 
+/**
+ * How `client.vfs` orders writes of one directory record between the tabs of
+ * an app on one device. Internal: nothing re-exports this module, and it is
+ * not public API.
+ *
+ * The personal space keeps whichever write of a key arrives last, so two tabs
+ * that each edit a copy of a folder and write it lose one tab's edit. A
+ * coordinator gives every namespace on the device one lock per record, held
+ * from the decision to write until the write has landed or failed, and a
+ * count of each record's writes, which a writer stores before it lets go of
+ * the lock and the next holder reads to tell whether its copy is current.
+ * It also tells the others which record was written, as a hint: that can
+ * reach them after the next holder has decided, or never. And it gives
+ * each file or folder being moved or deleted a lock, which a move or delete
+ * of it elsewhere takes only if it is free, and refuses otherwise (see
+ * `holdMoving`). `Client` builds one
+ * from Web Locks and a BroadcastChannel in a browser tab (see
+ * `core/crossTab.ts`); without one, writes are ordered within one namespace
+ * only, as they always were.
+ */
+interface VfsCoordinator {
+    /**
+     * Run `fn` holding the device-wide lock for record `id`, and settle as it
+     * does. Where the runtime refuses the lock to this document, as it then
+     * does to every tab of the app, `fn` runs without it.
+     */
+    lock<T>(id: string, fn: () => Promise<T>): Promise<T>;
+    /** Tell every other namespace that this one has just written record `id`. Called while holding its lock. */
+    announce(id: string): void;
+    /**
+     * Call `handler` with the id of each record another namespace announces -
+     * or with null when announcements may have been missed, because this one
+     * has only just started hearing them, or now hears them for someone else,
+     * so that every record held must be taken as written elsewhere. Returns a
+     * function that stops it.
+     */
+    onAnnounce(handler: (id: string | null) => void): () => void;
+    /**
+     * Make sure announcements for whoever is signed in now are being heard.
+     * Cheap; called before every read of a record from the store, so that
+     * nothing is read before this namespace can hear of a later write of it.
+     */
+    listen(): void;
+    /**
+     * How often each record in `ids` has been written by any namespace on
+     * the device, for whoever is signed in: one counter each, in order, read
+     * at one moment from storage every tab of the app shares (IndexedDB, in
+     * a browser). Null where it cannot be told: the storage cannot be read,
+     * or does not answer within a few seconds, or a write of the record has
+     * begun and not been counted (see `begin`). Never rejects.
+     *
+     * A copy of a record fetched after its counter was read holds every
+     * write the counter counts. Read again once its holder has taken a lock
+     * that another tab held while it wrote the record - the record's own, or
+     * a move lock - a counter that has not moved says no other tab has
+     * written it since: unlike an announcement, a count is stored before
+     * the writer lets go of its locks. See `VfsNamespace.sendLocked`.
+     */
+    counters(ids: readonly string[]): Promise<Array<string | null>>;
+    /**
+     * Called holding record `id`'s lock, before deciding whether a copy of it
+     * is current: its counter as the last tab to write it left it - one whose
+     * write began and was never counted, which no copy holds, included. And
+     * from then, stored with it, a mark that a write of it has begun, which
+     * `counters` reports as null until `bump`: a tab that goes, or cannot
+     * count its write, in between leaves every tab reading the record again.
+     * Null when the storage could not be read and marked within a few
+     * seconds. Never rejects.
+     */
+    begin(id: string): Promise<string | null>;
+    /**
+     * Called holding record `id`'s lock, after `begin`, once the write has
+     * landed or failed, or nothing was written after all: count it, and
+     * resolve to the record's new counter once that is stored - so before
+     * the lock is let go of. Null when it could not be stored within a few
+     * seconds. Never rejects.
+     */
+    bump(id: string): Promise<string | null>;
+    /**
+     * Hold the lock that says entry `id` - a file or a folder, by its id in
+     * the tree - is being moved or deleted on this device, if no one holds
+     * it. Never waits: resolves to null when another holder has it, in this
+     * tab or another, and otherwise to the function that lets go of it. A
+     * tab that dies lets go of everything it held. With no one signed in it
+     * holds nothing, and resolves to a function that does nothing; so too
+     * where the runtime refuses the lock to this document, as it then does
+     * to every tab of the app.
+     *
+     * `shared` holds a folder's lock as a place on the way to where a move
+     * is putting something. Any number of shared holders hold it at once,
+     * in any tab; a holder that is not shared cannot have it while they do,
+     * nor they while it does.
+     *
+     * A move marks its entry before it puts it in its second place, and a
+     * mark cannot tell a move still writing from one that was interrupted.
+     * Another tab took the first for the second: it finished the move too,
+     * naming the entry in two places, or let go of what the move was about
+     * to put somewhere else. So a move holds this from before it marks until
+     * it has taken the entry from where it was, a delete holds it for all it
+     * is deleting, and either refuses when it cannot have it. A move also
+     * holds the folder it is moving into, and every folder above that one,
+     * shared, for as long: a move into a folder that another tab was
+     * deleting put what it moved in a record the delete then purged. See
+     * `VfsNamespace.rename` and `VfsNamespace.delete`.
+     */
+    holdMoving(id: string, shared?: boolean): Promise<(() => void) | null>;
+}
+
 /**
  * `client.vfs` — a real filesystem over Muhkoo primitives.
  *
@@ -6736,11 +7104,24 @@ declare class VfsLimitError extends Error {
  *
  * Every mutation is a read-modify-write of exactly ONE directory record, so a
  * write cannot leave the tree half-updated: either the parent names the new
- * child or it does not. Two tabs writing different directories never conflict;
- * two tabs writing the SAME directory resolve last-writer-wins at the personal
- * space, which carries an HLC per key. Orphaned records (a directory whose
- * parent entry lost the race) are unreachable rather than corrupting — they
- * cost storage until a future sweep, which is the trade this shape makes in
+ * child or it does not. A VFS write sends no HLC and the personal space has
+ * no compare-and-swap: of two writes of one key it keeps whichever arrives
+ * last.
+ *
+ * Within ONE namespace, writes of a record are sent one at a time, in the
+ * order they were made - edits made while one is in flight go out together
+ * in the next (see `queue`) - and a read that has to fetch a record waits for
+ * its write in flight (see `writing`). Every edit of a record is made to one
+ * in-memory copy of it, and that copy is what is written (see `mutate`).
+ *
+ * Between the tabs of an app on one device, a coordinator (`VfsCoordinator`;
+ * `Client` wires one in a browser tab) gives each record one lock, and a tab
+ * reads a record another tab has written again before its next write of it
+ * (see `sendLocked`). Between devices - or a browser and the CLI - two writes
+ * of the same directory are still last-writer-wins, and the other edit is
+ * lost: that takes a compare-and-swap at the server. Orphaned records (a
+ * directory whose parent entry lost the race) are unreachable rather than
+ * corrupting - they cost storage until a sweep, the trade this shape makes in
  * exchange for single-record writes.
  */
 
@@ -6757,6 +7138,8 @@ interface VfsContentStore {
     write(data: Uint8Array | Blob, meta: {
         name: string;
         type: string;
+    }, opts?: {
+        onProgress?: (done: number, total: number) => void;
     }): Promise<{
         manifest: FileManifest;
         size: number;
@@ -6805,6 +7188,13 @@ interface VfsNamespaceDeps {
         entries?: number;
         pathChars?: number;
     };
+    /**
+     * Orders writes of a record with the other tabs of this app on the
+     * device. `Client` passes one in a browser tab; without it - Node, a
+     * test, a runtime with no Web Locks - writes are ordered within this
+     * namespace only. See `VfsCoordinator`.
+     */
+    coordinator?: VfsCoordinator;
 }
 declare class VfsNamespace {
     private readonly deps;
@@ -6815,8 +7205,114 @@ declare class VfsNamespace {
      * The file tree re-lists constantly while typing, and every miss is a
      * network round trip plus a decrypt. Invalidated precisely on write rather
      * than by TTL — a stale directory listing shows files that are not there.
+     *
+     * What a cached read resolves to is also THE copy of that record: the one
+     * every edit of it is made to, and the one written. See `mutate`.
      */
     private cache;
+    /**
+     * Bumped by `clearCache`, which is for a change of identity.
+     *
+     * A read or write begun before it can finish after it, and what it read
+     * or wrote belongs to whoever was signed in before. So every record
+     * carries the generation it was read under, and none goes into the cache,
+     * or is edited as the cache's copy, under another.
+     */
+    private generation;
+    /**
+     * The record each promise in `cache` resolved to, and each write in
+     * `writing` is sending: what `editable` finds without waiting.
+     */
+    private readonly copyOf;
+    /**
+     * The write of each directory record still in flight, by id.
+     *
+     * Two writes of one record must land in the order they were made. The
+     * personal space has no compare-and-swap: of two writes of one key that
+     * are in flight together it keeps whichever request finishes last, and
+     * that is often the one sent first. Then the earlier write, sealed before
+     * the later edit was made, undoes it. That is how a file deleted forever
+     * from the Trash, while the move that put it there was still being
+     * written, came back. So each write waits for the one before it, and a
+     * read that has to fetch the record waits for its write too: see
+     * `openDirById`.
+     */
+    private readonly writing;
+    /**
+     * Every entry this namespace is moving right now, by id.
+     *
+     * A move between two directories marks the entry before it puts it in
+     * the second (see `rename`), and a mark is all a later operation can
+     * see. It cannot tell a move still writing from one that was
+     * interrupted, and was taken for the second: a delete that began after
+     * a move had marked a folder looked for the folder's other half, found
+     * none yet, and purged it while the move was putting it in its new
+     * place; a second move of a file finished the "interrupted" move and
+     * left it named in two places. So a move holds its entry here until it
+     * has taken it from where it was, and `rename` and `delete` refuse an
+     * entry that is here - or, for a delete, a folder holding one. A delete
+     * holds what it deletes the same way: see `deleting`.
+     *
+     * This set is one namespace's. With a coordinator, a move also holds
+     * the entry's move lock for every tab on the device, for as long as the
+     * entry is here: see `VfsCoordinator.holdMoving`.
+     */
+    private readonly inMotion;
+    /**
+     * What each delete under way in this namespace is deleting, by entry id,
+     * one set per delete: its target from the moment it has found the target
+     * not in `inMotion`, and everything it read below the target once it has
+     * read it. Each delete lets go of its own set when it is done.
+     *
+     * A delete waits after it has read what it will let go of: on more
+     * reads, and on a read of the whole tree for the other half of a move.
+     * A move of any of it that started meanwhile could put it in its new
+     * place, fail to take it from the old, and end, all before the delete's
+     * detach. Ended, it was no longer in `inMotion`; and an entry that was
+     * marked already showed no change. So the delete let go of what the
+     * move had just named somewhere else. Now `rename` refuses an entry that
+     * is here, or one on a way from the root that passes through a folder
+     * that is: everything below a delete's target, read yet or not.
+     */
+    private readonly deleting;
+    /**
+     * The write of each record that has not gone out yet, by id: the one
+     * the next edit of that record joins. See `queue`.
+     */
+    private readonly waiting;
+    /**
+     * Announcements heard from other tabs, counted. `heardAt` is the count
+     * at the last one for each record, `missedAt` the count when some may
+     * have been missed. A copy read after both holds every write announced:
+     * see `current`.
+     */
+    private hearing;
+    private missedAt;
+    private readonly heardAt;
+    /**
+     * Each record a write of which this namespace marked as begun and could
+     * not count, and has said so, until one is counted. And whether it has
+     * said that a write it could not mark or count may be lost, which it
+     * says only once. See `notCounted`.
+     */
+    private readonly uncounted;
+    private lossWarned;
+    /**
+     * The copy of each record this namespace is writing under the record's
+     * lock, by id, from when it has decided what to write until it has
+     * counted the write, or failed to. Its counter reads as unknown
+     * meanwhile, as this write has begun and is not counted yet, but the
+     * copy holds every write of the record another tab has counted, and no
+     * other tab can make one until this one lets go of the lock. See
+     * `dropStale`.
+     */
+    private readonly locked;
+    /**
+     * Each directory a `createDir` here has named whose write has not landed
+     * yet, by entry id: a promise that settles - and never rejects - once
+     * that write has landed or failed. See `mkdir`.
+     */
+    private readonly naming;
     private readonly historyLimit;
     private readonly maxEntries;
     private readonly maxPathChars;
@@ -6975,6 +7471,7 @@ declare class VfsNamespace {
      */
     writeFile(path: string, data: Uint8Array | string | Blob, opts?: {
         type?: string;
+        onProgress?: (done: number, total: number) => void;
     }): Promise<VfsStat>;
     /**
      * Delete a file, or a directory when `recursive`.
@@ -7037,8 +7534,12 @@ declare class VfsNamespace {
      * Delete metadata records no longer reachable from the root.
      *
      * These accumulate because every write touches exactly one record: if two
-     * tabs edit the same directory, last-writer-wins at the personal space can
-     * leave a child whose parent entry lost the race. Unreachable is harmless —
+     * devices edit the same directory - or two tabs, where there is no
+     * coordinator - the personal space keeps whichever put arrives last (a
+     * VFS write sends no HLC, and the space applies puts of one key in arrival
+     * order), which can leave a child whose parent entry lost the race. The
+     * per-record queue and the coordinator order writes within one device
+     * only. Unreachable is harmless —
      * it is invisible and undecryptable-by-nobody — but it costs storage, so
      * this reclaims it.
      *
@@ -7078,6 +7579,15 @@ declare class VfsNamespace {
      * the error names whichever asked first.
      */
     private openDirById;
+    /**
+     * Fetch record `id` from the store and open it. Whatever another tab
+     * announced before the fetch began is in what it returns (see
+     * `current`), and so is every write its counter counts: read here, or
+     * given as `counter` (see `OpenDir.counter`).
+     */
+    private fetchRecord;
+    /** Record `id`'s write counter now: see `OpenDir.counter`. */
+    private counterOf;
     /**
      * Turn a decrypted record into an OpenDir, or throw.
      *
@@ -7086,8 +7596,172 @@ declare class VfsNamespace {
      * aside in `hidden` instead: out of every read, but kept for the write.
      */
     private readRecord;
-    /** Apply an edit to a directory record and persist it. */
+    /**
+     * Apply an edit to a directory record and persist it.
+     *
+     * `dir` says which record - its id, key and path - and nothing more. The
+     * edit is made to THE copy of that record (see `editable`), which `dir`
+     * may no longer be, and that copy is what is written. Editing whichever
+     * copy the caller held let two copies of one record exist at once: an
+     * overwrite held its directory across storing the old version's
+     * history, a write of the directory failed meanwhile and dropped it from
+     * the cache, and a save that then read a second copy and stored it,
+     * successfully, was undone when the overwrite stored the first.
+     *
+     * So `edit` must take what it writes from the record it is given, not
+     * from anything read off `dir` before an await - and re-check whatever it
+     * relies on from then, throwing if another write changed it, before it
+     * changes anything. Returning false writes nothing after all.
+     *
+     * The write that carries the edit may carry others, made while an
+     * earlier write of the record was in flight (see `queue`): it lands, or
+     * fails, for all of them at once.
+     *
+     * With a coordinator, the edit may be made a second time, to the record
+     * as another tab left it, and refused then (see `replay`): an edit must
+     * check everything before it changes anything, and whatever it sets
+     * outside `node` and `record` must be safe to set again, since each run
+     * overwrites the last.
+     */
     private mutate;
+    /**
+     * The copy of `dir`'s record that edits are made to, if there is one
+     * without waiting: the one the cache holds, once read.
+     *
+     * Failing that, the one a write in flight is sending. The record was
+     * dropped from the cache - a change was reported, our own write's echo
+     * among them - and a read that came in since is waiting for that write,
+     * to answer with this very copy if it lands (see `openDirById`); if it
+     * fails, the write an edit now queues behind it carries the copy instead.
+     *
+     * Undefined when the record is not cached and nothing is writing it, or
+     * it is still being read: `reopen` waits for that. A record read before
+     * `clearCache` is edited as it is, as it always was. It is not the copy of
+     * anything the cache holds now, and must not be handed the next identity's.
+     */
+    private editable;
+    /**
+     * Read `dir`'s record - the cached read, or a fetch made once any write of
+     * it in flight has settled - and then find the copy edits are made to.
+     */
+    private reopen;
+    /** Make `dir` the cached copy of its record - unless the cache has been cleared since it was read. */
+    private adopt;
+    /** After an edit of `copy`: its time, and any entry it cannot read that the edit replaced. */
+    private touch;
+    /**
+     * The write that will carry the edit just made to `copy`.
+     *
+     * Writes of a record go out one at a time, each once the one before it
+     * has landed or failed (see `writing`), and each seals the record as it
+     * stands when it goes out. So a write still waiting carries every edit
+     * made while it waits, and an edit made then joins it instead of
+     * queueing a write of its own: a burst of edits of one directory while a
+     * write of it is in flight costs two writes, not one per edit. Each is a
+     * billed write; a 20-file upload into one folder cost twenty.
+     */
+    private queue;
+    /**
+     * Send `batch`: from here on, an edit of its record goes in the next
+     * write. With a coordinator, holding the lock every tab of the device
+     * takes to write this record - see `sendLocked`.
+     */
+    private send;
+    /** Stop `batch` taking more edits, as it is sealed. */
+    private close;
+    /**
+     * Send `batch` while no other tab can write its record.
+     *
+     * If another tab wrote the record since this copy was read, the copy is
+     * out of date, and writing it would undo that tab's write. So it is read
+     * again, here, under the lock, and every edit the batch carries is made
+     * again to what was read (see `replay`). A copy no other tab has written
+     * over is sent as it is: one tab on its own costs no extra request.
+     *
+     * Which it is, the record's write counter says (see
+     * `VfsCoordinator.counters`). Read once the lock is granted, it counts
+     * every write of the record another tab made, because each counts its
+     * write, and waits for the count to be stored, before it lets go of the
+     * lock. If it has moved since the copy was read, or cannot be told, the
+     * copy is read again. Whether this tab has heard of another tab's write
+     * does not decide it: an announcement can reach this tab after the
+     * lock does, or never. One it has heard of can only add a read.
+     *
+     * The write is counted once it has landed or failed - one that failed
+     * may have landed even so - and the other tabs are then told of it,
+     * all before the lock is let go of.
+     */
+    private sendLocked;
+    /**
+     * Say that a write of `copy`'s record could not be counted.
+     *
+     * `marked`: `VfsCoordinator.begin` stored its mark, which stays until a
+     * count can be stored, so every tab reads the record again before it
+     * writes it. Said once for each record, until a write of it is counted.
+     *
+     * Not marked, a tab whose IndexedDB works may take its copy for current
+     * and write it over this write. Said once for this namespace, whatever
+     * the record: where IndexedDB cannot be used at all, no write of any
+     * folder is counted, and a warning for each said nothing new. And only
+     * where another tab can count its writes can one be lost, which the
+     * warning says: where no tab can, every tab reads each folder again.
+     */
+    private notCounted;
+    /**
+     * Make every edit in `batch` again, in order, to `fresh` - the record as
+     * another tab left it - and make that the copy. An edit that no longer
+     * applies throws, as it would have the first time, and is left out; its
+     * caller gets what it threw. Every edit checks before it changes
+     * anything (see `mutate`), so one that throws has changed nothing. True
+     * when what is left changes the record, and so needs writing.
+     */
+    private replay;
+    /**
+     * Another tab wrote record `id` - or, null, this namespace may have
+     * missed some announcements. What the cache holds is read again when
+     * next asked for, as a change frame from the personal space would have
+     * it, and a copy read before then is read again before the next write
+     * of its record (see `current`). A hint, not a guarantee: an
+     * announcement can reach this tab after the next lock does, or never.
+     * What decides whether a copy may be written over, or relied on under a
+     * move's or a delete's locks, is the record's counter: see `sendLocked`
+     * and `dropStale`.
+     */
+    private heard;
+    /**
+     * Does `copy` hold every write of its record another tab has announced
+     * that this one has heard of? See `heard`. Only ever a reason to read it
+     * again, never to take it for current: see `sendLocked`.
+     */
+    private current;
+    /**
+     * Drop from the cache every copy of a record in `ids` that may not hold
+     * every write of it another tab has made: its counter has moved since
+     * the copy was read, or cannot be told, or the copy is still being read.
+     * Returns every id whose copy here is not known to be current - those,
+     * and those not cached - so that the next read of each fetches it again,
+     * once any write of it in flight here has landed or failed. Not a copy
+     * this tab is writing under its lock (see `locked`): its counter reads
+     * as unknown only because that write is not counted yet, and dropped,
+     * the next read would wait for the write.
+     *
+     * The counters are read in one go, after the caller has taken the locks
+     * it relies on: another tab counts each write of a record before it lets
+     * go of the locks it held while writing it, the record's own and any
+     * move lock, so what it wrote before letting go of one of them is
+     * counted by then. Its announcements may not have reached this tab yet,
+     * or ever. See `sendLocked`.
+     */
+    private dropStale;
+    /**
+     * Seal a directory record as it stands NOW and put it in the store.
+     *
+     * Read at the moment of sending, not when the edit was made, so a write
+     * that waited behind another carries every edit made to the record by
+     * then, its own included.
+     */
+    private writeRecord;
+    /** For `mkdir`: name a new, empty directory `path` in the one at `parentPath`. */
     private createDir;
     /**
      * Every directory record in a subtree, each once, opened - and nothing
@@ -7103,8 +7777,44 @@ declare class VfsNamespace {
      *
      * `moving` says whether anything in it is marked as half of an
      * interrupted move, which is what makes a delete look for the other half.
+     *
+     * `ids` is every entry id in it, and `shape` what each record named when
+     * it was read: see `currentSubtree`.
      */
     private subtree;
+    /**
+     * The records a recursive delete read, as they are now - or null when
+     * one has changed since in a way that purging it would get wrong.
+     *
+     * The delete decided what to let go of, and whether to look for the
+     * other half of a move, from what it read; then it waited, on reads and
+     * on the write of its parent. A record that is no longer named by the
+     * record it was read in has been moved out, and is not this delete's to
+     * purge; an entry marked since it was read is being moved, and is about
+     * to be named somewhere the delete never looked. Purging either purged
+     * the folder a move had just put somewhere else. Anything else - a file
+     * saved into one of them, or moved out - is purged as it now stands,
+     * which is why the copies to purge are what this returns.
+     *
+     * Synchronous, for an edit. A record whose copy is not to hand counts as
+     * changed.
+     *
+     * `held`, with a coordinator, is every entry whose move lock the delete
+     * holds. An entry named since the records were read - saved or moved in
+     * - is not among them, so nothing stops another tab moving it out while
+     * the delete writes the parent, and purging it then let go of what that
+     * move had put somewhere else. So with `held`, that counts as changed
+     * too, and the delete is tried again from the start.
+     */
+    private currentSubtree;
+    /**
+     * Hold the move lock of every entry in `ids` - see
+     * `VfsCoordinator.holdMoving` - or of none: null when another holder has
+     * any of them, and then nothing is held. Otherwise the function that
+     * lets go of them all. Asked for all at once: none of them waits.
+     * `shared` holds them as the folders a move goes into.
+     */
+    private holdAll;
     /**
      * Delete these records and let go of every file in them. The second half
      * of a recursive delete, run only once the subtree is detached. Cannot
@@ -7689,6 +8399,8 @@ declare class Client {
     readonly functions: FunctionsNamespace;
     /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
     readonly accessTokens: AccessTokensNamespace;
+    /** This app — `client.app.access()`: may the signed-in user add data here? */
+    readonly app: AppNamespace;
     /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
     readonly offline: OfflineManager;
     private readonly session;
@@ -8975,7 +9687,7 @@ declare function getId(row: {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-declare const VERSION = "0.15.0-alpha.0";
+declare const VERSION = "0.15.0-alpha.10";
 
 /**
  * The SDK's process-global logger.
@@ -9007,5 +9719,5 @@ declare global {
 }
 declare const appLogger: InstanceType<typeof Logger>;
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AdmissionState, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChatKeyCert, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, MemberView, MembershipEntry, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role$1 as Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, SpaceTrustCode, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AppNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PaymentRequiredError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AdmissionState, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AppAccess, AppNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChatKeyCert, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, MemberView, MembershipEntry, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PaymentRequiredCode, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role$1 as Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, SpaceTrustCode, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };