@muhkoo/connect 0.7.0-alpha.5 → 0.9.0-alpha.0

package/dist/connect.d.ts

@@ -754,7 +754,13 @@ declare enum EventCoreEvents {
     DATA_SENT = "data_sent",
     MESSAGE = "message",
     GET_HISTORY = "get_history",
-    RECEIVED_HISTORY = "received_history"
+    RECEIVED_HISTORY = "received_history",
+    ONLINE = "online",
+    OFFLINE = "offline",
+    SYNCING = "syncing",
+    SYNC_PROGRESS = "sync_progress",
+    SYNC_COMPLETE = "sync_complete",
+    SYNC_ERROR = "sync_error"
 }
 /**
  * @public
@@ -1399,6 +1405,28 @@ declare function manifestToStat(manifest: FileManifest): FileStat;
  *                             skip a PUT they'd otherwise dedup-rewrite. The
  *                             server can ignore the optimization if it wants.
  */
+/**
+ * A content-addressed byte cache for shards (the offline layer's `ShardCache`
+ * satisfies this structurally). Declared here as a minimal interface so the
+ * storage layer doesn't import the offline module — keeping the dependency
+ * arrow one-way (offline → storage).
+ */
+interface ShardByteCache {
+    get(hash: string): Promise<Uint8Array | null>;
+    put(hash: string, bytes: Uint8Array): Promise<void>;
+}
+/**
+ * A peer block source (the p2p layer's `PeerExchange` satisfies this
+ * structurally). Consulted between the local cache and origin: a block fetched
+ * from a peer is verified by hash before use. Declared here so the storage layer
+ * doesn't import the p2p module (dependency arrow stays p2p → storage).
+ */
+interface PeerBlockSource {
+    getBlock(hash: string, opts?: {
+        timeoutMs?: number;
+    }): Promise<Uint8Array | null>;
+    announce(hash: string): void;
+}
 interface ShardClientOptions {
     /** Base URL of the accelerator (e.g. `https://muhkoo-accelerator.workers.dev`). */
     baseUrl: string;
@@ -1418,6 +1446,24 @@ interface ShardClientOptions {
      * Provided so callers can inject retries / auth / instrumentation.
      */
     fetch?: typeof fetch;
+    /**
+     * Optional offline byte cache. When present, GETs are served cache-first and
+     * populated on success, and PUTs write the cache before the network so a
+     * just-uploaded file reads back offline. See {@link ShardByteCache}.
+     */
+    cache?: ShardByteCache;
+    /**
+     * Called when a PUT can't reach the network (offline). Lets the caller queue
+     * the upload for replay on reconnect; the bytes are already in {@link cache}
+     * keyed by `hash`, so only the hash needs recording.
+     */
+    deferUpload?: (hash: string) => Promise<void>;
+    /**
+     * Optional peer block source. When present, GETs try peers between the local
+     * cache and origin (peer blocks are verified by hash); PUTs announce the new
+     * block to peers. Best-effort — any failure falls through to origin.
+     */
+    peers?: PeerBlockSource;
 }
 /**
  * Compute the lowercase hex SHA-256 of `bytes`. Available via WebCrypto in
@@ -1428,6 +1474,9 @@ declare class ShardClient {
     private readonly baseUrl;
     private readonly pathPrefix;
     private readonly fetchFn;
+    private readonly cache?;
+    private readonly deferUpload?;
+    private readonly peers?;
     constructor(opts: ShardClientOptions);
     /** Build the URL for a given shard hash — exposed for callers that want to log or pre-resolve. */
     urlForHash(hash: string): string;
@@ -2717,6 +2766,410 @@ declare class HttpClient {
     private request;
 }
 
+/**
+ * `LWWRegister` — a last-write-wins register CRDT, the conflict model for a
+ * `kv` value and for an app-state snapshot. A register holds a single value
+ * stamped with the {@link HlcTimestamp} of the write that produced it. Two
+ * concurrent writes converge to the one with the greater HLC; the loser is
+ * discarded. A delete is just a write that sets `deleted` (a tombstone), so a
+ * stale write that arrives after a newer delete can't resurrect the value.
+ *
+ * Because the HLC total-orders every write deterministically (down to a nodeId
+ * tiebreak), every replica that has seen the same set of writes lands on the
+ * same value — that's the convergence guarantee.
+ */
+interface LwwRegister<T> {
+    /** The current value, or `null` when tombstoned / never written. */
+    value: T | null;
+    /** HLC of the write that produced this state. */
+    hlc: string;
+    /** True when the latest write was a delete. */
+    deleted: boolean;
+}
+/** An empty register that loses to any real write. */
+declare function emptyRegister<T>(): LwwRegister<T>;
+/**
+ * Merge two register states, returning the winner (greater HLC). Pure: neither
+ * input is mutated. Used identically on the inbound change feed and on
+ * sync-replay reconciliation so there's exactly one definition of "who wins".
+ */
+declare function mergeRegister<T>(a: LwwRegister<T>, b: LwwRegister<T>): LwwRegister<T>;
+/** Build the register produced by a `set`. */
+declare function writeRegister<T>(value: T, hlc: string): LwwRegister<T>;
+/** Build the register produced by a `delete` (a tombstone at `hlc`). */
+declare function deleteRegister<T>(hlc: string): LwwRegister<T>;
+
+/**
+ * `ConnectivityManager` — the single source of truth for "are we online", which
+ * the offline layer needs to decide between a network call and a cache read, and
+ * to know when to flush the durable outbound queue.
+ *
+ * `navigator.onLine` alone lies often (captive portals, VPN flaps, a laptop
+ * that's "connected" to a network with no route), so we fuse three signals:
+ *   1. the browser `online`/`offline` events (coarse but free),
+ *   2. real fetch outcomes reported by {@link ../core/HttpClient} and the shard
+ *      client — a thrown `TypeError`/abort is the most reliable "offline" tell,
+ *      and a 2xx is the most reliable "online" tell,
+ *   3. the sync engine, which flips us to `syncing` while it drains the queue.
+ *
+ * The offline→online edge fires `onReconnect` (wired to the sync engine) so
+ * queued writes replay automatically. Transitions are debounced to avoid
+ * flapping the UI on a brief blip. State changes also emit on {@link EventCore}
+ * (`ONLINE`/`OFFLINE`/`SYNCING`) so apps can render a status indicator.
+ */
+type ConnectivityState = "online" | "offline" | "syncing";
+interface ConnectivityOptions {
+    /** Called on each offline→online transition (drives queue replay). */
+    onReconnect?: () => void;
+    /** Debounce window for offline transitions, ms. Default 1500. */
+    debounceMs?: number;
+}
+declare class ConnectivityManager {
+    private state;
+    private readonly listeners;
+    private readonly onReconnect?;
+    private readonly debounceMs;
+    private offlineTimer;
+    private started;
+    private readonly handleOnline;
+    private readonly handleOffline;
+    constructor(opts?: ConnectivityOptions);
+    /** Attach to the browser online/offline events. Safe to call in Node (no-op). */
+    start(): void;
+    stop(): void;
+    get current(): ConnectivityState;
+    get isOnline(): boolean;
+    /** Subscribe to state changes. Returns an unsubscribe function. */
+    onChange(cb: (state: ConnectivityState) => void): () => void;
+    /** Report a failed network attempt (thrown fetch / abort). */
+    reportFetchFailure(): void;
+    /** Report a successful network round-trip — strongest "we're online" signal. */
+    reportFetchSuccess(): void;
+    /** The sync engine entering its drain phase. */
+    markSyncing(): void;
+    /** The sync engine finished — settle back to online. */
+    markSynced(): void;
+    private markOnline;
+    private scheduleOffline;
+    private set;
+}
+
+type StoreName = "kv-cache" | "db-row-cache" | "db-query-cache" | "space-messages" | "space-cursors" | "outbound-queue" | "snapshots" | "hlc-state" | "meta";
+
+/**
+ * `OfflineStore` — the pluggable persistence interface the offline layer is
+ * built on, mirroring the {@link ../../core/Session.SessionStore} pattern. The
+ * default browser implementation is {@link ./IndexedDbStore}; environments
+ * without IndexedDB (Node, Workers, SSR) get {@link ./NoopStore}, whose every
+ * method resolves to empty so the namespace hooks become branch-free no-ops.
+ *
+ * Keys are plain strings (most are prefixed with the user's `commitment` to
+ * isolate users on a shared origin). Values are whatever the caller stores —
+ * the store is format-agnostic; CRDT/ciphertext shape is the namespace's
+ * concern.
+ */
+
+/** A durable outbound mutation awaiting replay on reconnect. */
+interface QueueEntry {
+    /** Auto-assigned monotonic sequence (insertion order). */
+    seq: number;
+    /** HLC stamp of the mutation — the order replays run in. */
+    hlc: string;
+    /** Client-generated id for idempotent replay / dedupe. */
+    clientId: string;
+    domain: "kv" | "db" | "file" | "space" | "snapshot";
+    /** Namespace method to re-invoke (e.g. `"set"`, `"update"`, `"sendMessage"`). */
+    method: string;
+    /** Serializable arguments captured at enqueue time. */
+    args: unknown;
+}
+interface OfflineEntry<T> {
+    key: string;
+    value: T;
+}
+interface OfflineStore {
+    /** False for {@link ./NoopStore} so hooks can skip all work cheaply. */
+    readonly enabled: boolean;
+    /** Resolve once the backing store is open and ready (no-op when disabled). */
+    ready(): Promise<void>;
+    get<T>(store: StoreName, key: string): Promise<T | null>;
+    put<T>(store: StoreName, key: string, value: T): Promise<void>;
+    delete(store: StoreName, key: string): Promise<void>;
+    /** Entries whose key starts with `prefix`, in ascending key order. */
+    prefix<T>(store: StoreName, prefix: string): Promise<Array<OfflineEntry<T>>>;
+    /** Entries whose key is in `[lower, upper)`, in ascending key order. */
+    range<T>(store: StoreName, lower: string, upper: string): Promise<Array<OfflineEntry<T>>>;
+    /** Every entry in a store, in ascending key order. */
+    all<T>(store: StoreName): Promise<Array<OfflineEntry<T>>>;
+    clear(store: StoreName): Promise<void>;
+    /** Append a mutation to the durable outbound queue; resolves with its seq. */
+    enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
+    /** Remove a drained queue entry by seq. */
+    dequeue(seq: number): Promise<void>;
+    /** All queued mutations, HLC-ordered (the order to replay them in). */
+    queued(): Promise<QueueEntry[]>;
+}
+
+/**
+ * `OutboundQueue` — the durable record of writes made while offline (or that
+ * failed mid-flight) plus the machinery to replay them on reconnect. This is
+ * what makes offline writes *survive a reload*: unlike the in-memory buffer in
+ * {@link ../transport/WSTransport}, every entry lives in IndexedDB until it has
+ * been acknowledged by the server.
+ *
+ * Each domain registers a **replayer** — a function that re-applies one queued
+ * mutation by re-invoking the real namespace method (with an `isReplay` flag so
+ * it doesn't re-enqueue). `drain()` replays entries in HLC order:
+ *   - success → remove the entry;
+ *   - permanent failure (4xx) → drop it and surface a `SYNC_ERROR` (a write the
+ *     server will never accept must not wedge the queue forever);
+ *   - transient/network failure → stop draining and leave the rest for the next
+ *     reconnect.
+ *
+ * Replays are idempotent by construction (kv/db are LWW-by-key, messages dedupe
+ * by `clientId`, file PUTs are content-addressed), so re-running a partially
+ * drained queue is safe.
+ */
+
+type Replayer = (entry: QueueEntry) => Promise<void>;
+declare class OutboundQueue {
+    private readonly store;
+    private readonly replayers;
+    private draining;
+    constructor(store: OfflineStore);
+    /** A domain registers how to replay its mutations. */
+    register(domain: QueueEntry["domain"], replayer: Replayer): void;
+    /** Record a mutation for later replay; resolves with its assigned seq. */
+    enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
+    /** Number of writes still awaiting sync. */
+    pending(): Promise<number>;
+    /**
+     * Replay queued mutations in HLC order. Coalesces concurrent calls into a
+     * single in-flight drain. Stops on the first transient failure, leaving the
+     * remaining entries for the next attempt.
+     */
+    drain(): Promise<void>;
+    private runDrain;
+}
+
+/**
+ * `SyncEngine` — orchestrates catch-up when the client comes back online. It's
+ * the thing wired to the {@link ConnectivityManager}'s offline→online edge.
+ *
+ * One `run()` does, in order:
+ *   1. **Guard** — only proceed when the session is authenticated and unlocked
+ *      (replays may need to re-seal/re-encrypt, and there's no point pushing
+ *      writes for a logged-out user).
+ *   2. **Drain** the durable {@link OutboundQueue} — push every offline write.
+ *   3. **Catch-up tasks** — domain-registered pulls that reconcile *inbound*
+ *      state we missed while offline (e.g. a Space paging history forward to its
+ *      last-seen handle). Registered by the namespaces.
+ *
+ * Concurrent triggers coalesce into a single in-flight run (a reconnect often
+ * fires several signals at once), mirroring `Client.recoverInFlight`.
+ */
+
+interface SyncEngineDeps {
+    queue: OutboundQueue;
+    connectivity: ConnectivityManager;
+    /** Proceed only when this returns true (authenticated + unlocked). */
+    canSync: () => boolean;
+}
+declare class SyncEngine {
+    private readonly deps;
+    private readonly catchUpTasks;
+    private running;
+    constructor(deps: SyncEngineDeps);
+    /** Register an inbound reconciliation task run after the queue drains. */
+    registerCatchUp(task: () => Promise<void>): () => void;
+    /** Drain + catch up. Concurrent calls share one in-flight run. */
+    run(): Promise<void>;
+    private execute;
+}
+
+/**
+ * `client.offline.snapshot` — a small, encrypted, app-state cache. Apps stash
+ * whatever they need to repaint instantly on a cold offline boot: the last open
+ * Space, a draft message, scroll position, the current route. It's deliberately
+ * separate from `client.kv`: snapshots are **local-only by default** (instant,
+ * never metered, never leave the device) and hold view state rather than domain
+ * data.
+ *
+ *   await client.offline.snapshot.save('ui', { route, openSpaceId, draft })
+ *   const ui = await client.offline.snapshot.load<UiState>('ui')
+ *
+ * Values are encrypted at rest with the same identity-derived {@link StorageCipher}
+ * as `client.kv`, so a snapshot is unreadable until the user unlocks — `load`
+ * returns `null` when locked or absent, and `save` throws {@link OfflineLockedError}.
+ * Conflict model is a single-writer LWW register (the latest save wins).
+ */
+
+interface SnapshotNamespaceDeps {
+    store: OfflineStore;
+    session: SessionState;
+    /** Stamp the saved record (LWW ordering); supplied by the OfflineManager. */
+    nextHlc: () => Promise<string>;
+}
+declare class SnapshotNamespace {
+    private readonly deps;
+    private cipher;
+    private cipherIdentity;
+    constructor(deps: SnapshotNamespaceDeps);
+    /** Persist `state` under `name` (encrypted). No-op when offline support is off. */
+    save<T = unknown>(name: string, state: T): Promise<void>;
+    /** Load and decrypt the snapshot `name`, or `null` if absent/locked. */
+    load<T = unknown>(name: string): Promise<T | null>;
+    /** Remove the snapshot `name`. */
+    delete(name: string): Promise<void>;
+    /** Names of all snapshots for the current user. */
+    list(): Promise<string[]>;
+    private key;
+    private commitment;
+    private requireCipher;
+}
+
+/**
+ * `ShardCache` — a Cache-API-backed store for file-shard bytes. Shards are
+ * content-addressed (the key IS the SHA-256 of the ciphertext), so caching them
+ * is uniquely safe: a cache hit is self-validating, immutable, and shareable
+ * across files. The Cache API (rather than IndexedDB) is the right home for
+ * large binary blobs — it streams, it's purpose-built for response bodies, and
+ * it has its own eviction.
+ *
+ * Keys are SYNTHETIC absolute URLs (`https://shard.muhkoo.local/<hash>`) rather
+ * than the real shard endpoint, so the cache is addressable by hash alone — the
+ * sync engine can re-PUT a deferred shard knowing only its hash, without
+ * reconstructing the accelerator URL. We never fetch these synthetic URLs; they
+ * exist only as cache keys.
+ *
+ * Every method degrades to a no-op / null where the Cache API is unavailable
+ * (Node, Workers, insecure contexts), so callers don't need to branch.
+ */
+declare class ShardCache {
+    static available(): boolean;
+    private key;
+    private open;
+    /** Cached shard bytes, or `null` on miss / when unavailable. */
+    get(hash: string): Promise<Uint8Array | null>;
+    /** Store shard bytes under their hash. Best-effort. */
+    put(hash: string, bytes: Uint8Array): Promise<void>;
+    /** Whether a shard is present in the cache. */
+    has(hash: string): Promise<boolean>;
+}
+
+/**
+ * `OfflineManager` — the object `client.offline` points at, and the single
+ * owner of everything the offline layer needs at runtime: the {@link
+ * OfflineStore}, the {@link HLC} (Hybrid Logical Clock), the {@link
+ * ConnectivityManager}, the durable {@link OutboundQueue}, the {@link
+ * SyncEngine}, and the {@link SnapshotNamespace}.
+ *
+ * The {@link ../core/Client} constructs one of these (always — it's a cheap
+ * no-op when offline support is off) and hands the namespaces the small set of
+ * primitives they need to participate: `nextHlc()` to stamp a write,
+ * `observeHlc()` to fold in a remote stamp, `enqueue()` to record an offline
+ * mutation, and `registerReplayer()`/`registerCatchUp()` to define how their
+ * domain re-syncs on reconnect. Keeping that wiring here means the namespaces
+ * stay decoupled from IndexedDB and the clock.
+ */
+
+interface OfflineManagerDeps {
+    store: OfflineStore;
+    session: SessionState;
+    /** Whether offline support is active (browser) vs a no-op (Node/Workers). */
+    enabled: boolean;
+}
+declare class OfflineManager {
+    /** True in browsers with IndexedDB; false when running over a NoopStore. */
+    readonly enabled: boolean;
+    readonly store: OfflineStore;
+    readonly connectivity: ConnectivityManager;
+    readonly queue: OutboundQueue;
+    readonly sync: SyncEngine;
+    /** `client.offline.snapshot` — encrypted app-state cache. */
+    readonly snapshot: SnapshotNamespace;
+    /** Cache-API store for file-shard bytes (browser only). */
+    readonly fileCache?: ShardCache;
+    private hlc;
+    private nodeId;
+    private readonly bootPromise;
+    private persistTimer;
+    constructor(deps: OfflineManagerDeps);
+    /**
+     * Queue a shard upload that couldn't reach the network. The bytes are
+     * already cached (keyed by `hash`), so only the hash is recorded; the file
+     * replayer re-PUTs from the cache on reconnect.
+     */
+    deferShardUpload(hash: string): Promise<void>;
+    /** Resolve once the clock + node id are loaded. */
+    ready(): Promise<void>;
+    /** Current connectivity state (`online` | `offline` | `syncing`). */
+    get status(): ConnectivityState;
+    /** Subscribe to connectivity changes. Returns an unsubscribe function. */
+    onStatusChange(cb: (state: ConnectivityState) => void): () => void;
+    /** Stamp a locally-generated write with a fresh, monotonic HLC. */
+    nextHlc(): Promise<string>;
+    /** Fold an observed remote HLC into the clock (call for inbound stamps). */
+    observeHlc(remote: string): Promise<void>;
+    /** A fresh client-generated id (idempotent replay / message dedupe). */
+    newClientId(): string;
+    /** Record an offline mutation for replay on reconnect. */
+    enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
+    /** A domain registers how to replay its queued mutations. */
+    registerReplayer(domain: QueueEntry["domain"], replayer: Replayer): void;
+    /** A domain registers an inbound catch-up task (run after the queue drains). */
+    registerCatchUp(task: () => Promise<void>): () => void;
+    /** Surface a network failure to connectivity tracking. */
+    reportFetchFailure(): void;
+    /** Surface a successful round-trip to connectivity tracking. */
+    reportFetchSuccess(): void;
+    /** Tear down listeners (tests / hot-reload). */
+    dispose(): void;
+    private boot;
+    /** Coalesce HLC-state writes — a burst of stamps persists once. */
+    private schedulePersist;
+}
+
+/**
+ * `KvCache` — the offline adapter for `client.kv`. Stores each value's
+ * ciphertext envelope (never plaintext) under `${commitment}|${collection}/${id}`
+ * as an LWW-Register stamped with an HLC, so reads work offline and concurrent
+ * writes converge (see {@link ./crdt/LWWRegister}). Deletes are causal
+ * tombstones — a stale write can't resurrect a key a newer delete removed.
+ *
+ * True cross-device convergence also needs the accelerator to honor the HLC
+ * (see the server's `kvmeta` sidecar); this adapter embeds the stamp now and
+ * degrades gracefully (last-writer-by-arrival) until that ships.
+ */
+
+type KvEntry = LwwRegister<unknown>;
+declare class KvCache {
+    private readonly manager;
+    private readonly store;
+    constructor(manager: OfflineManager);
+    get enabled(): boolean;
+    nextHlc(): Promise<string>;
+    newClientId(): string;
+    private key;
+    /** Read the cached register for `collection/id`, or null when absent. */
+    read(commitment: string, fullKey: string): Promise<KvEntry | null>;
+    /** Optimistically record a local `set` (ciphertext envelope + HLC). */
+    writeLocal(commitment: string, fullKey: string, envelope: unknown, hlc: string): Promise<void>;
+    /** Optimistically record a local `delete` (tombstone at HLC). */
+    deleteLocal(commitment: string, fullKey: string, hlc: string): Promise<void>;
+    /**
+     * Merge an authoritative value (from a GET refresh or a realtime frame) into
+     * the cache by HLC. When the server doesn't supply an HLC yet, treat it as
+     * "now-ish" by stamping our clock so a server value still beats stale local
+     * state but a fresh local write wins.
+     */
+    mergeRemote(commitment: string, fullKey: string, envelope: unknown | null, op: "set" | "delete", hlc?: string): Promise<void>;
+    /** Non-tombstoned full keys for a commitment (used for offline `list`). */
+    liveKeys(commitment: string): Promise<string[]>;
+    /** Queue a kv mutation for replay on reconnect. */
+    enqueue(method: "set" | "delete", args: unknown, hlc: string, clientId: string): Promise<void>;
+}
+
 /**
  * `client.kv` — per-user key/value storage backed by the accelerator's personal
  * space.
@@ -2746,6 +3199,8 @@ interface KvNamespaceDeps {
     session: SessionState;
     /** WebSocket base (ws/wss) for the change feed; derived from baseUrl. */
     wsBaseUrl: string;
+    /** Offline cache + queue. Undefined ⇒ no offline behavior (network-only). */
+    offline?: KvCache;
 }
 interface SetOptions {
     /** Encrypt the value at rest (default: true). */
@@ -2763,6 +3218,8 @@ declare class KvNamespace {
     private cipher;
     private cipherIdentity;
     constructor(deps: KvNamespaceDeps);
+    /** Replay one queued kv mutation (called by the sync engine). */
+    replay(entry: QueueEntry): Promise<void>;
     /** Store `value` under `collection`/`id` (encrypted at rest by default). */
     set<T = unknown>(collection: string, id: string, value: T, opts?: SetOptions): Promise<void>;
     /** Fetch the value at `collection`/`id`, or `null` if absent. */
@@ -2791,6 +3248,45 @@ declare class KvNamespace {
     private getCipher;
 }
 
+/**
+ * `DbCache` — the offline adapter for `client.db`. Unlike kv, db rows are
+ * server-plaintext, so they're cached as-is. The SDK doesn't know a table's
+ * primary-key column, so it caches schema-agnostically:
+ *   - `get(id)` results keyed by the requested id (`${table}|row|${id}`),
+ *   - `query(q)` result pages keyed by a stable hash of the query.
+ *
+ * Writes carry per-column HLC stamps (`_hlc`) so the accelerator's per-column
+ * LWW merge can converge concurrent edits; offline writes are queued and
+ * replayed. Optimistic row patches keep `get` fresh between sync cycles.
+ */
+
+interface DbQueryPage {
+    rows: Array<Record<string, unknown>>;
+    nextCursor: string | null;
+}
+/** Stable JSON for query-cache keys (sorted object keys → deterministic). */
+declare function stableStringify(value: unknown): string;
+declare class DbCache {
+    private readonly manager;
+    private readonly store;
+    constructor(manager: OfflineManager);
+    get enabled(): boolean;
+    nextHlc(): Promise<string>;
+    newClientId(): string;
+    /** Build the `{ [col]: hlc }` map for a write (one stamp across its columns). */
+    columnStamps(values: Record<string, unknown>, hlc: string): Record<string, string>;
+    private rowKey;
+    private queryKey;
+    readRow(table: string, id: string): Promise<Record<string, unknown> | null>;
+    writeRow(table: string, id: string, row: Record<string, unknown>): Promise<void>;
+    /** Shallow-merge a partial update into a cached row (optimistic). */
+    patchRow(table: string, id: string, values: Record<string, unknown>): Promise<void>;
+    deleteRow(table: string, id: string): Promise<void>;
+    readQuery(table: string, q: unknown): Promise<DbQueryPage | null>;
+    writeQuery(table: string, q: unknown, page: DbQueryPage): Promise<void>;
+    enqueue(method: "insert" | "update" | "delete", args: unknown, hlc: string, clientId: string): Promise<void>;
+}
+
 /**
  * `client.db` — the app's scalable database. A developer defines tables in the
  * Muhkoo portal (columns + indexes); each table is backed by its own Durable
@@ -2822,6 +3318,8 @@ declare class KvNamespace {
 
 interface DbNamespaceDeps {
     http: HttpClient;
+    /** Offline row/query cache + write queue. Undefined ⇒ network-only. */
+    offline?: DbCache;
 }
 /** Comparison operators allowed in a {@link DbQuery} `where` clause. */
 type DbFilterOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "like" | "likeStartsWith" | "likeContains";
@@ -2855,8 +3353,10 @@ interface DbQueryResult<T = Record<string, unknown>> {
 declare class DbTable<T extends Record<string, unknown> = Record<string, unknown>> {
     private readonly http;
     private readonly name;
-    constructor(http: HttpClient, name: string);
+    private readonly offline?;
+    constructor(http: HttpClient, name: string, offline?: DbCache | undefined);
     private base;
+    private rowUrl;
     /** Insert a row. Returns the created row and its primary-key value. */
     insert(values: Partial<T>): Promise<{
         row: T;
@@ -2884,6 +3384,8 @@ declare class DbNamespace {
      *   const todos = client.db.table<Todo>('todos');
      */
     table<T extends Record<string, unknown> = Record<string, unknown>>(name: string): DbTable<T>;
+    /** Replay one queued db mutation (called by the sync engine). */
+    replay(entry: QueueEntry): Promise<void>;
 }
 
 /**
@@ -2923,6 +3425,10 @@ interface FileNamespaceDeps {
      * deploy-time-precompiled environments). Forwarded to {@link FileStorage}.
      */
     rsWasmModule?: WebAssembly.Module;
+    /** Offline shard-byte cache (browser). Enables offline reads of cached files. */
+    shardCache?: ShardByteCache;
+    /** Queue a shard PUT that couldn't reach the network (offline). */
+    deferShardUpload?: (hash: string) => Promise<void>;
 }
 interface WriteFileOptions {
     /** SharedSpace the file is written to (obtain via `client.space`). */
@@ -3288,6 +3794,19 @@ declare class SpaceKeyring implements EpochKeyProvider {
  */
 
 type Listener = (e: CustomEvent) => void;
+/**
+ * A P2P swarm attached to a Space (the p2p layer's `PeerNetwork` satisfies this
+ * structurally — Space never imports the p2p module). `exchange` is consulted by
+ * the Space's file `ShardClient`; `start` runs peer discovery on connect; `close`
+ * tears the mesh down.
+ */
+interface AttachedPeerNetwork {
+    readonly exchange: PeerBlockSource;
+    start(): void;
+    close(): void;
+    gossip(data: Uint8Array): void;
+    onGossip(cb: (from: string, data: Uint8Array) => void): () => void;
+}
 interface SpaceFileMetadata {
     name: string;
     type: string;
@@ -3308,6 +3827,46 @@ interface SpaceMessageEvent {
      */
     handle: number;
     message: Message;
+    /**
+     * Sender-generated id, present on locally-originated messages (carried in the
+     * cleartext `cid` header). Lets the UI dedupe an optimistic send against its
+     * server echo, and the offline cache replace a pending entry with the real one.
+     */
+    clientId?: string;
+    /** True for an optimistic local send not yet acknowledged by the server. */
+    pending?: boolean;
+}
+/**
+ * One sealed message frame as cached for offline use. The `packet` is the
+ * ciphertext-bearing serialized {@link Packet} (decrypted lazily on read), so
+ * nothing readable is persisted. Structurally matches the offline layer's
+ * `MessageEntry`; declared here so the spaces module doesn't import `../offline`.
+ */
+interface CachedSpaceMessage {
+    handle: string;
+    packet: string | null;
+    op: "msg" | "edit" | "delete";
+    clientId?: string;
+    hlc?: string;
+    pending?: boolean;
+    deleted?: boolean;
+}
+/** The offline adapter a {@link Space} drives. Implemented by `SpaceCache`. */
+interface SpaceOfflineAdapter {
+    readonly enabled: boolean;
+    newClientId(): string;
+    nextHlc(): Promise<string>;
+    putMessage(spaceId: string, entry: CachedSpaceMessage): Promise<void>;
+    putDeleted(spaceId: string, handle: number): Promise<void>;
+    dropPending(spaceId: string, clientId: string): Promise<void>;
+    loadMessages(spaceId: string): Promise<CachedSpaceMessage[]>;
+    getCursor(spaceId: string): Promise<{
+        lastSeenHandle: number;
+        oldestHandle: number;
+    } | null>;
+    observeHandle(spaceId: string, handle: number): Promise<void>;
+    enqueueFrame(spaceId: string, frame: unknown, clientId: string, hlc: string): Promise<void>;
+    registerCatchUp(task: () => Promise<void>): () => void;
 }
 /**
  * An inbound ephemeral signal — an application broadcast the server relays to
@@ -3357,6 +3916,12 @@ interface SpaceDeps {
      * without a live websocket.
      */
     createChannel?: (url: string, myId: string) => SpaceChannelLike;
+    /** Offline shard-byte cache for room files (browser). */
+    shardCache?: ShardByteCache;
+    /** Queue a room-file shard PUT that couldn't reach the network. */
+    deferShardUpload?: (hash: string) => Promise<void>;
+    /** Offline message cache + send queue. Undefined ⇒ no offline behavior. */
+    offline?: SpaceOfflineAdapter;
 }
 /** The subset of {@link BroadcastChannel} a {@link Space} drives. */
 interface SpaceChannelLike {
@@ -3380,6 +3945,9 @@ declare class Space {
     /** Per-instance event bus for fan-out events (isolated across spaces). */
     private readonly events;
     private rawWired;
+    private catchUpUnsub;
+    /** Optional P2P swarm for this Space (block exchange among members). */
+    private peerNet;
     constructor(deps: SpaceDeps);
     /** The encoded space id (same as the transport name for fan-out spaces). */
     get id(): string;
@@ -3388,6 +3956,19 @@ declare class Space {
     /** Open the space websocket (resolves the ticket + identity lazily). */
     connect(): Promise<void>;
     disconnect(): void;
+    /** Attach a P2P swarm so this Space's file reads/writes can use peers. */
+    attachPeerNetwork(net: AttachedPeerNetwork): void;
+    /**
+     * Broadcast an app payload directly to connected Space peers over P2P,
+     * **bypassing the server** — for CRDT ops / high-frequency state (live
+     * cursors, presence, collaborative edits) you don't want to push through the
+     * relay. No-op when no P2P mesh is active (requires `client` `p2p`).
+     * Unlike {@link sendEphemeral} (server-relayed, metered, size-limited), this
+     * is peer-direct and fragments large payloads.
+     */
+    gossipToPeers(data: Uint8Array): void;
+    /** Subscribe to peer gossip ({@link gossipToPeers}). Returns an unsubscribe fn. */
+    onPeerGossip(handler: (from: string, data: Uint8Array) => void): () => void;
     /** Subscribe to a raw channel event. Buffered until `connect()` if early. */
     on(event: string, handler: Listener): void;
     off(event: string, handler: Listener): void;
@@ -3429,6 +4010,14 @@ declare class Space {
      * original author. Receivers get an {@link onMessageDeleted} event.
      */
     deleteMessage(handle: number): Promise<void>;
+    /**
+     * Decrypt and return the locally-cached message log for this space, in
+     * handle order (pending sends last). Works offline — the source is the
+     * IndexedDB cache populated by live frames + {@link history}. Apps call this
+     * on boot to paint instantly, then subscribe to {@link onMessage} for live
+     * updates. Returns `[]` when offline support is off.
+     */
+    cachedMessages(): Promise<SpaceMessageEvent[]>;
     /** Subscribe to in-place edits of persisted messages (new content at the same handle). */
     onMessageEdited(handler: (e: SpaceMessageEvent) => void): () => void;
     /** Subscribe to deletions of persisted messages. */
@@ -3440,7 +4029,7 @@ declare class Space {
      * indicators, presence, or live cursors are built on top of this. No-op if
      * the space isn't connected (ephemeral signals aren't worth queuing).
      */
-    sendEphemeral(subject: string, data: unknown): void;
+    sendEphemeral(subject: string, data: unknown, to?: string): void;
     /** Subscribe to inbound ephemeral signals. `from` is the authenticated sender. */
     onEphemeral(handler: (e: EphemeralEvent) => void): () => void;
     /** Subscribe to inbound join requests (for a key-holder to admit). */
@@ -3510,6 +4099,15 @@ declare class Space {
      * nothing to verify against → reject.
      */
     private verifySender;
+    /** Persist a decoded live/history/edit frame to the offline cache. */
+    private cacheFrame;
+    /**
+     * Inbound reconciliation run on reconnect: page the server's forward delta
+     * (`?since=<lastSeenHandle>`) to the head, pulling exactly the messages that
+     * landed while we were offline into the cache. Bounded so a long absence
+     * can't page forever. Falls back gracefully if the endpoint is unavailable.
+     */
+    private catchUp;
     private emitEvent;
     private requireKeyring;
     private requireCipher;
@@ -3642,9 +4240,22 @@ interface SpaceNamespaceDeps {
     wsBaseUrl: string;
     /** Optional PersonalSpace-backed cache of group keys (encrypted at rest). */
     cache?: SpaceKeyCache;
+    /** Offline manager — enables message caching + offline send replay. */
+    offline?: OfflineManager;
+    /** P2P swarm config — enables peer block exchange among Space members. */
+    p2p?: {
+        enabled?: boolean;
+        /** `() => new Worker(new URL(...))` to run the block engine off-thread. */
+        workerFactory?: () => Worker;
+        iceServers?: RTCIceServer[];
+        maxPeers?: number;
+    };
 }
 declare class SpaceNamespace {
     private readonly deps;
+    private spaceCache?;
+    /** Spaces built this session, by id — used to route offline send replays. */
+    private readonly openSpaces;
     constructor(deps: SpaceNamespaceDeps);
     /**
      * Create a new space: generate its keypair (public key = id), register
@@ -4089,6 +4700,34 @@ interface ClientOptions {
      * staging (`auth.staging.muhkoo.dev`) or a self-hosted deployment.
      */
     authBaseUrl?: string;
+    /**
+     * Offline support (`client.offline`) — transparent local caching + a durable
+     * write queue + CRDT sync. **On by default in browsers** (IndexedDB + Cache
+     * API present), a no-op everywhere else. Override to force it on/off or to
+     * supply a custom {@link OfflineStore}.
+     */
+    offline?: {
+        /** Force enable/disable. Default: auto-detect (browser on, Node off). */
+        enabled?: boolean;
+        /** Pluggable persistence. Default: IndexedDB in the browser. */
+        store?: OfflineStore;
+        /** Cache file-shard bytes in the Cache API. Default: true in the browser. */
+        cacheShards?: boolean;
+        /** Soft cap on durable-queue bytes before degrading to online-only. */
+        maxQueueBytes?: number;
+    };
+    /**
+     * Peer-to-peer block exchange (`client.space` files) among Space members,
+     * over WebRTC signaled on the Space relay. Best-effort — falls back to
+     * origin. **Opt-in** (browser only). Pass `workerFactory` to run the block
+     * engine off the main thread.
+     */
+    p2p?: {
+        enabled?: boolean;
+        workerFactory?: () => Worker;
+        iceServers?: RTCIceServer[];
+        maxPeers?: number;
+    };
 }
 declare class Client {
     readonly baseUrl: string;
@@ -4108,6 +4747,8 @@ declare class Client {
     readonly agents: AgentsNamespace;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
     readonly functions: FunctionsNamespace;
+    /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
+    readonly offline: OfflineManager;
     private readonly session;
     private readonly http;
     /** Subscribers notified when a session expires and can't be recovered. */
@@ -4268,6 +4909,697 @@ declare function ejectAgentTools(appClass: Function, opts?: {
     maxIterations?: number;
 }): AgentToolsConfig;
 
+/**
+ * Message-log helpers — the conflict model for a Space's message history.
+ *
+ * Messages are the easy CRDT: the accelerator assigns every persisted message a
+ * monotonic, zero-padded `handle` that already totally-orders the log, and the
+ * sealed body is immutable. So the "log" is just a grow-only set keyed by
+ * `handle`, and convergence is structural — no server change needed.
+ *
+ * The only subtleties this module encodes:
+ *   - **Optimistic sends** have no server handle yet. We key them by a
+ *     provisional handle that sorts *after* every real one, and tag them with
+ *     the sender's `clientId` so the real frame (carrying the same `clientId`)
+ *     can replace the placeholder instead of duplicating it.
+ *   - **Edits** are a per-message LWW register on the body (greater HLC wins).
+ *   - **Deletes** are a tombstone at the message's handle.
+ */
+type MessageOp = "msg" | "edit" | "delete";
+interface MessageEntry {
+    /** Server-assigned handle, or a {@link provisionalHandle} while pending. */
+    handle: string;
+    /** Sealed packet string (ciphertext at rest); `null` for a delete tombstone. */
+    packet: string | null;
+    op: MessageOp;
+    /** Sender-generated id, present on locally-originated sends for dedupe. */
+    clientId?: string;
+    /** HLC stamp — orders edits to the same message. */
+    hlc?: string;
+    /** True while an optimistic send has not yet been acked by the server. */
+    pending?: boolean;
+    deleted?: boolean;
+}
+/** IndexedDB key for a message within a space. */
+declare function messageKey(spaceId: string, handle: string): string;
+/**
+ * A handle for an un-acked optimistic message. Prefixed with `"~"` (0x7E),
+ * which sorts after every digit, so pending sends always appear at the tail of
+ * the handle-ordered log until the real handle arrives.
+ */
+declare function provisionalHandle(clientId: string): string;
+declare function isProvisional(handle: string): boolean;
+/**
+ * Merge two entries for the SAME handle. A delete always wins (tombstone); an
+ * edit wins over the entry it supersedes when its HLC is greater; otherwise the
+ * existing entry stands (a re-delivered `msg` is idempotent).
+ */
+declare function mergeMessage(local: MessageEntry | null, incoming: MessageEntry): MessageEntry;
+
+/**
+ * `SpaceCache` — the offline adapter a {@link ../spaces/Space} talks to. It
+ * persists sealed message frames (ciphertext at rest), tracks per-space sync
+ * cursors, and records offline sends in the durable queue. Kept as its own
+ * object (rather than wiring the Space straight to the store + clock) so the
+ * Space stays decoupled from IndexedDB and so the no-op path is a single
+ * `enabled` check.
+ *
+ * Messages are the structural CRDT (see {@link ./crdt/MessageLog}): the server
+ * assigns a monotonic `handle` that totally-orders the log, so the cache just
+ * stores frames keyed by a zero-padded handle (real) or a provisional key
+ * (pending sends, which sort to the tail until their echo arrives).
+ */
+
+/** Zero-pad a numeric server handle so string keys sort in handle order. */
+declare function padHandle(handle: number): string;
+interface SpaceCursor {
+    lastSeenHandle: number;
+    oldestHandle: number;
+    fullyBackfilled: boolean;
+}
+/**
+ * The surface a {@link ../spaces/Space} uses. Declared structurally on the
+ * Space side too (as `SpaceOfflineAdapter`) so the spaces module never imports
+ * the offline module.
+ */
+declare class SpaceCache {
+    private readonly manager;
+    private readonly store;
+    constructor(manager: OfflineManager);
+    get enabled(): boolean;
+    newClientId(): string;
+    nextHlc(): Promise<string>;
+    /** Persist a sealed message frame keyed by its (real or provisional) handle. */
+    putMessage(spaceId: string, entry: MessageEntry): Promise<void>;
+    /** Tombstone the message at `handle`. */
+    putDeleted(spaceId: string, handle: number): Promise<void>;
+    /** Drop a pending (optimistic) entry once its real echo has been stored. */
+    dropPending(spaceId: string, clientId: string): Promise<void>;
+    /** All cached frames for a space, in handle order (pending ones last). */
+    loadMessages(spaceId: string): Promise<MessageEntry[]>;
+    getCursor(spaceId: string): Promise<SpaceCursor | null>;
+    /** Advance the last-seen handle (monotonic) and track the oldest fetched. */
+    observeHandle(spaceId: string, handle: number): Promise<void>;
+    /** Queue a raw space frame for replay when the connection returns. */
+    enqueueFrame(spaceId: string, frame: unknown, clientId: string, hlc: string): Promise<void>;
+    /** Register an inbound catch-up task (forward/back history paging). */
+    registerCatchUp(task: () => Promise<void>): () => void;
+}
+
+/**
+ * Errors specific to the offline layer.
+ */
+/**
+ * Thrown when an offline read/write needs the user's identity (to decrypt or
+ * re-encrypt cached data) but the client is locked — typically right after a
+ * reload, where only the session token was restored and `unlock()` hasn't run
+ * yet. Distinct from the generic "not signed in" identity error so apps can
+ * specifically prompt the user to unlock to see their offline data.
+ */
+declare class OfflineLockedError extends Error {
+    constructor(message?: string);
+}
+
+/**
+ * Environment probe deciding whether the offline layer turns itself on. Offline
+ * support is **on by default in browsers** and a no-op everywhere else, so this
+ * is the gate the {@link ../core/Client} consults to pick {@link
+ * ./store/IndexedDbStore} vs {@link ./store/NoopStore}.
+ *
+ * We require all three web APIs the layer leans on — `indexedDB` (structured
+ * cache + durable queue), the Cache API (file-shard bytes), and a `window`
+ * (so we're in a real document with online/offline events) — and we *touch*
+ * them inside a try/catch, because some sandboxed or private-mode contexts
+ * expose the globals but throw on use (mirrors `defaultSessionStore`).
+ */
+declare function isOfflineCapable(): boolean;
+
+/**
+ * `IndexedDbStore` — the browser {@link OfflineStore}, backed by one IndexedDB
+ * database per origin (see {@link ./schema}). It opens lazily on first use and
+ * memoizes the connection. The queue methods sit on the autoincrement
+ * `outbound-queue` store and return mutations in HLC order for the sync engine.
+ *
+ * Construct only where `indexedDB` exists — {@link ../detect.isOfflineCapable}
+ * gates this, and the {@link ../../core/Client} falls back to {@link ./NoopStore}
+ * everywhere else.
+ */
+
+declare class IndexedDbStore implements OfflineStore {
+    readonly enabled = true;
+    private conn;
+    private opening;
+    private connect;
+    ready(): Promise<void>;
+    get<T>(store: StoreName, key: string): Promise<T | null>;
+    put<T>(store: StoreName, key: string, value: T): Promise<void>;
+    delete(store: StoreName, key: string): Promise<void>;
+    prefix<T>(store: StoreName, prefix: string): Promise<Array<OfflineEntry<T>>>;
+    range<T>(store: StoreName, lower: string, upper: string): Promise<Array<OfflineEntry<T>>>;
+    all<T>(store: StoreName): Promise<Array<OfflineEntry<T>>>;
+    clear(store: StoreName): Promise<void>;
+    enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
+    dequeue(seq: number): Promise<void>;
+    queued(): Promise<QueueEntry[]>;
+}
+
+/**
+ * `NoopStore` — the {@link OfflineStore} used wherever offline support is off
+ * (Node, Workers, SSR, or when a consumer disables it). Every read returns
+ * empty and every write is dropped, so the namespace hooks that call into it
+ * behave exactly as they did before the offline layer existed. `enabled` is
+ * `false` so hot paths can skip the call entirely.
+ */
+
+declare class NoopStore implements OfflineStore {
+    readonly enabled = false;
+    ready(): Promise<void>;
+    get<T>(_store: StoreName, _key: string): Promise<T | null>;
+    put<T>(_store: StoreName, _key: string, _value: T): Promise<void>;
+    delete(_store: StoreName, _key: string): Promise<void>;
+    prefix<T>(_store: StoreName, _prefix: string): Promise<Array<OfflineEntry<T>>>;
+    range<T>(_store: StoreName, _lower: string, _upper: string): Promise<Array<OfflineEntry<T>>>;
+    all<T>(_store: StoreName): Promise<Array<OfflineEntry<T>>>;
+    clear(_store: StoreName): Promise<void>;
+    enqueue(_entry: Omit<QueueEntry, "seq">): Promise<number>;
+    dequeue(_seq: number): Promise<void>;
+    queued(): Promise<QueueEntry[]>;
+}
+
+/** The smallest possible stamp — used as the "nothing stored yet" sentinel so a
+ *  first real write always wins (`compareHlc(real, ZERO_HLC) > 0`). */
+declare const ZERO_HLC: string;
+interface HlcParts {
+    /** Physical wall-clock time, milliseconds since the Unix epoch. */
+    wall: number;
+    /** Logical counter within `wall`. */
+    counter: number;
+    /** Stable per-install node id (tiebreak). */
+    nodeId: string;
+}
+/** Pack the three components into the sortable string form. */
+declare function pack(wall: number, counter: number, nodeId: string): string;
+/** Parse a packed stamp back into its components. Tolerates the empty/zero
+ *  sentinel. Throws on a malformed string so corruption surfaces loudly. */
+declare function unpack(stamp: string): HlcParts;
+/**
+ * Total order over packed HLC strings: negative if `a < b`, positive if
+ * `a > b`, `0` only when they are byte-identical. Because the fields are
+ * fixed-width and ordered (wall, counter, nodeId), a single string comparison
+ * already yields causal order — this helper just normalizes the result to the
+ * `-1 | 0 | 1` shape callers expect.
+ */
+declare function compareHlc(a: string, b: string): number;
+/** Convenience: is `a` strictly newer than `b`? */
+declare function isNewer(a: string, b: string): boolean;
+
+/**
+ * `HLC` — a Hybrid Logical Clock. Hands out monotonically increasing
+ * {@link HlcTimestamp} stamps that (a) track real time closely enough to be
+ * human-meaningful, yet (b) never go backwards, even across a reload or when a
+ * peer's clock is ahead of ours.
+ *
+ * Two operations, both the textbook HLC algorithm (Kulkarni et al.):
+ *   - `now()` — stamp a local event.
+ *   - `update(remote)` — observe a remote stamp (e.g. arriving on the realtime
+ *     change feed) and advance our clock past it, so any event we generate
+ *     afterwards is causally `> remote`.
+ *
+ * State is just `{ wall, counter }`; `nodeId` is fixed for the install. The
+ * owner ({@link ../OfflineManager}) seeds the clock from persisted state on
+ * boot and persists `getState()` after each tick so monotonicity survives page
+ * reloads — without that, a reload could mint a stamp that loses to one written
+ * seconds earlier.
+ */
+
+interface HlcState {
+    wall: number;
+    counter: number;
+}
+/** Injected physical-time source — defaults to `Date.now`. Overridable so
+ *  tests can drive the clock deterministically. */
+type PhysicalClock = () => number;
+declare class HLC {
+    private wall;
+    private counter;
+    private readonly nodeId;
+    private readonly physical;
+    constructor(nodeId: string, opts?: {
+        state?: HlcState | null;
+        physical?: PhysicalClock;
+    });
+    /** Stamp a locally-generated event. Advances the clock. */
+    now(): string;
+    /**
+     * Merge in an observed remote stamp and advance our clock strictly past it.
+     * Call this for every inbound HLC (change-feed frames, history rows) so the
+     * next `now()` is causally after anything we've seen.
+     */
+    update(remote: HlcParts): string;
+    /** The current stamp without advancing the clock. */
+    current(): string;
+    /** Serializable `{ wall, counter }` for persistence. */
+    getState(): HlcState;
+}
+
+/**
+ * `LWWMap` — a map of independent last-write-wins registers, one per column.
+ * This is the conflict model for a `db` row: two devices that edit *different*
+ * columns of the same row while offline both keep their edits (no lost update),
+ * and two that edit the *same* column converge to the greater-HLC write. A row
+ * delete is a causal tombstone (see {@link ./ORSet}); a later write to any
+ * column resurrects the row with just the surviving columns.
+ *
+ * This mirrors, on the client, exactly what the accelerator's `_muhkoo_crdt`
+ * sidecar does server-side — so a row materializes identically whether it was
+ * merged locally (offline) or by the server on replay.
+ */
+interface LwwMap {
+    /** Per-column value of the winning write. */
+    fields: Record<string, unknown>;
+    /** Per-column HLC of the winning write. */
+    columnHlc: Record<string, string>;
+    /** Row-delete tombstone HLC, or `null` when the row was never deleted. */
+    tombstone: string | null;
+}
+declare function emptyMap(): LwwMap;
+/** Apply a local column write (insert/update) at the given per-column HLCs. */
+declare function writeColumns(map: LwwMap, values: Record<string, unknown>, hlc: string): LwwMap;
+/** Apply a row delete at `hlc` (causal tombstone). */
+declare function tombstoneRow(map: LwwMap, hlc: string): LwwMap;
+/** Merge two row states column-by-column. Pure; neither input is mutated. */
+declare function mergeMap(a: LwwMap, b: LwwMap): LwwMap;
+/**
+ * Materialize the visible row from merged state, or `null` when the row is
+ * deleted. A column is visible only when its write is causally newer than the
+ * tombstone — so a delete hides every prior column, but a post-delete write to
+ * a column brings the row back with just that column populated.
+ */
+declare function materializeRow(map: LwwMap): Record<string, unknown> | null;
+
+/**
+ * Tombstone helpers shared by the LWW CRDTs. We don't need a full
+ * observed-remove set — every domain that deletes (kv keys, db rows) does so
+ * by stamping a delete with an HLC and keeping that stamp around. The only
+ * rule that matters is the causal one:
+ *
+ *   a delete at HLC `d` hides the value, but a *later* write at HLC `w > d`
+ *   resurrects it; a *stale* write at `w <= d` is dropped.
+ *
+ * Keeping the delete HLC (rather than physically forgetting the key) is what
+ * prevents a delayed offline write from "un-deleting" something a peer already
+ * removed. Callers GC tombstones older than any possible offline window.
+ */
+/**
+ * Does a write at `writeHlc` win against a tombstone at `tombstoneHlc`?
+ * `true` ⇒ the write applies (resurrecting a deleted item if needed); `false`
+ * ⇒ the tombstone still holds and the write is dropped. A missing tombstone
+ * (`null`) means there's nothing suppressing the write.
+ */
+declare function writeBeatsTombstone(writeHlc: string, tombstoneHlc: string | null): boolean;
+/**
+ * Does a delete at `deleteHlc` win against the latest write at `writeHlc`?
+ * `true` ⇒ the item is now tombstoned. Ties go to the delete (remove-wins) so
+ * that a delete and a write stamped in the same instant resolve deterministically
+ * toward removal.
+ */
+declare function deleteBeatsWrite(deleteHlc: string, writeHlc: string | null): boolean;
+
+/**
+ * `PeerExchange` — the thin façade the storage layer consults to try fetching a
+ * block from peers before falling back to origin. It satisfies the structural
+ * `PeerBlockSource` interface that {@link ../storage/transport/ShardClient}
+ * declares (so storage never imports the p2p module — the dependency arrow stays
+ * one-way, p2p → storage).
+ *
+ * It delegates to an {@link EngineHandle} — either an in-process {@link
+ * ./worker/blockEngine.BlockEngine} or the Web Worker proxy — so the same façade
+ * works whether the block engine runs on the main thread or off it.
+ */
+
+/** The subset of a block engine (in-process or worker-proxied) PeerExchange drives. */
+interface EngineHandle {
+    want(hash: string, timeoutMs: number): Promise<Uint8Array | null>;
+    announce(hash: string): void;
+}
+interface PeerExchangeOptions {
+    /** How long to wait for a peer before giving up to origin. Default 2500ms. */
+    timeoutMs?: number;
+}
+declare class PeerExchange implements PeerBlockSource {
+    private readonly engine;
+    private readonly timeoutMs;
+    constructor(engine: EngineHandle, opts?: PeerExchangeOptions);
+    getBlock(hash: string, opts?: {
+        timeoutMs?: number;
+    }): Promise<Uint8Array | null>;
+    announce(hash: string): void;
+}
+
+/**
+ * `SpaceSignaler` — WebRTC signaling carried over the Space's existing ephemeral
+ * relay. No new server channel: `Space.sendEphemeral`/`onEphemeral` already
+ * blind-relay `pub` frames stamped with the authenticated sender, so SDP
+ * offers/answers and ICE candidates ride a reserved subject (`__p2p__`) scoped
+ * to Space membership. The sender (`from`) is server-stamped and can't be
+ * spoofed; the payload is opaque to the server.
+ *
+ * Envelopes carry a `to` (a member id, or `"*"` for discovery) so the
+ * accelerator can optionally unicast peer-pair signaling instead of broadcasting
+ * (a small, backward-compatible `pub` enhancement); the client filters by `to`
+ * regardless.
+ */
+declare const P2P_SUBJECT = "__p2p__";
+type SignalKind = "hello" | "bye" | "offer" | "answer" | "ice";
+interface SignalEnvelope {
+    /** Target member id, or `"*"` to broadcast (discovery / departure). */
+    to: string;
+    kind: SignalKind;
+    data?: unknown;
+}
+/** The slice of {@link ../../spaces/Space.Space} the signaler needs. */
+interface SignalingSpace {
+    sendEphemeral(subject: string, data: unknown, to?: string): void;
+    onEphemeral(handler: (e: {
+        from: string;
+        subject: string;
+        data: unknown;
+    }) => void): () => void;
+}
+declare class SpaceSignaler {
+    private readonly space;
+    private readonly myId;
+    constructor(space: SignalingSpace, myId: string);
+    /** Send a signal to one peer (or `"*"`). */
+    send(to: string, kind: SignalKind, data?: unknown): void;
+    /** Announce/withdraw P2P availability to all Space members. */
+    broadcast(kind: SignalKind, data?: unknown): void;
+    /**
+     * Subscribe to inbound signals addressed to us (or broadcast). Skips our own
+     * echoes. Returns an unsubscribe function.
+     */
+    onSignal(cb: (from: string, kind: SignalKind, data: unknown) => void): () => void;
+}
+
+/**
+ * `PeerTransport` — the pluggable wire under the block engine. It moves opaque
+ * frames between Space peers; it knows nothing about blocks, hashes, or the
+ * protocol. {@link ./WebRtcTransport} implements it over RTCDataChannels today;
+ * a future libp2p/Helia transport can implement the same interface without the
+ * block engine or `ShardClient` changing.
+ *
+ * Implementations are responsible for fragmenting/ reassembling frames larger
+ * than the underlying channel's max message size (a 4 MiB shard won't fit in one
+ * `RTCDataChannel.send`); the engine always deals in whole frames.
+ */
+type PeerId = string;
+interface PeerTransport {
+    /** Currently connected peer ids. */
+    peers(): PeerId[];
+    /** Dial a discovered peer (optional — some transports connect implicitly). */
+    connectTo?(peer: PeerId): void;
+    /** Send a whole frame to one peer on `channel` (fragmented internally if needed). */
+    send(peer: PeerId, data: Uint8Array, channel?: number): void;
+    /** Send a whole frame to every connected peer on `channel`. */
+    broadcast(data: Uint8Array, channel?: number): void;
+    /** Subscribe to inbound (reassembled) frames. Returns an unsubscribe fn. */
+    onMessage(cb: (peer: PeerId, data: Uint8Array, channel: number) => void): () => void;
+    /** Subscribe to the connected-peer set changing. Returns an unsubscribe fn. */
+    onPeerChange(cb: (peers: PeerId[]) => void): () => void;
+    /** Tear down all connections. */
+    close(): void;
+}
+
+/**
+ * `BlockEngine` — the bitswap-lite want/have ledger. Host-agnostic: it speaks
+ * only to a {@link BlockStore} (get/put/has) and an `out` sink that ships
+ * encoded frames to a peer (or `"*"` to broadcast). The host wires `out` and
+ * `handleFrame` to a real transport — on the main thread or inside the Web
+ * Worker (see {@link ./engineClient}) — so this class is pure and unit-testable.
+ *
+ * It never sees keys: blocks are AES-GCM ciphertext, addressed by SHA-256. The
+ * one trust check is integrity — an inbound BLOCK is re-hashed and dropped on
+ * mismatch, so a malicious peer can't poison the store (the requester just
+ * falls back to origin).
+ */
+interface BlockStore {
+    get(hash: string): Promise<Uint8Array | null>;
+    put(hash: string, bytes: Uint8Array): Promise<void>;
+    has(hash: string): Promise<boolean>;
+}
+/** Ship an encoded frame to one peer, or `"*"` for every connected peer. */
+type OutSink = (target: string | "*", frame: Uint8Array) => void;
+/** Lowercase hex SHA-256 of `bytes` — injected so tests can stub it. */
+type Hasher = (bytes: Uint8Array) => Promise<string>;
+declare class BlockEngine {
+    private readonly store;
+    private readonly out;
+    private readonly hash;
+    private readonly wants;
+    constructor(store: BlockStore, out: OutSink, hash: Hasher);
+    /**
+     * Ask the swarm for a block. Resolves with the verified bytes, or `null` on
+     * timeout (caller then falls back to origin). Returns immediately if we
+     * already hold it; concurrent wants for the same hash share one request.
+     */
+    want(hash: string, timeoutMs: number): Promise<Uint8Array | null>;
+    /** Tell the swarm we now hold `hash` (so peers wanting it can pull from us). */
+    announce(hash: string): void;
+    /** Handle one inbound frame from `peer`. */
+    handleFrame(peer: string, frame: Uint8Array): Promise<void>;
+    /** Drop all pending waits (resolve null) — on teardown. */
+    close(): void;
+}
+
+/**
+ * `PeerNetwork` — the per-Space orchestrator that ties the pieces together on
+ * the main thread:
+ *
+ *   transport (WebRTC)  ⇄  engine host (Worker or in-process)  →  PeerExchange
+ *        ▲                                                            │
+ *        └────────────── signaling over the Space relay ─────────────┘
+ *
+ * It owns one {@link ./transport/WebRtcTransport} + one {@link
+ * ./worker/engineHost.EngineHost}, wires inbound frames to the engine and the
+ * engine's outbound frames back to the transport, runs peer discovery over the
+ * Space's ephemeral channel, and exposes a {@link ./PeerExchange.PeerExchange}
+ * for `ShardClient` to consult. Scope is one Space (private swarm).
+ *
+ * `engineHost` defaults to in-process; pass `workerFactory` to run the block
+ * engine off the main thread (the consumer's bundler resolves the worker URL).
+ */
+
+interface PeerNetworkOptions {
+    /** The Space (used for signaling over its ephemeral relay). */
+    space: SignalingSpace;
+    /** Our authenticated member id (the Space's `myId`). */
+    myId: string;
+    /** Blockstore for the in-process engine. Defaults to a `ShardCache`. */
+    store?: BlockStore;
+    /** Run the block engine in a Worker — `() => new Worker(new URL(...))`. */
+    workerFactory?: () => Worker;
+    iceServers?: RTCIceServer[];
+    maxPeers?: number;
+    /** Peer fetch timeout passed to PeerExchange. */
+    timeoutMs?: number;
+    /** Inject a transport (tests / a future libp2p transport). Default WebRTC. */
+    transport?: PeerTransport;
+}
+declare class PeerNetwork {
+    /** Pass this to a `ShardClient` as `peers`. */
+    readonly exchange: PeerExchange;
+    private readonly transport;
+    private readonly host;
+    private readonly signaler;
+    private readonly offs;
+    private readonly gossipCbs;
+    private closed;
+    constructor(opts: PeerNetworkOptions);
+    /**
+     * Begin peer discovery — broadcast a hello so existing members dial us and
+     * we learn them. Call once the signaling channel is live (the Space fires
+     * this on CONNECTED); safe to call again on reconnect.
+     */
+    start(): void;
+    /**
+     * Broadcast an app payload to all connected peers over the gossip channel —
+     * a direct, server-bypassing data path for CRDT ops / high-frequency state
+     * (cursors, presence, collaborative edits). Single-hop (no re-forwarding).
+     */
+    gossip(data: Uint8Array): void;
+    /** Subscribe to gossip from peers. Returns an unsubscribe function. */
+    onGossip(cb: (from: string, data: Uint8Array) => void): () => void;
+    /** Connected peer count (open data channels). */
+    peerCount(): number;
+    close(): void;
+}
+
+/**
+ * Whether this environment can do WebRTC peering. `RTCPeerConnection` is
+ * Window-only (absent in Node/Workers/SSR), so this gates whether a
+ * {@link ./PeerNetwork} can be built at all.
+ */
+declare function isP2pCapable(): boolean;
+
+/**
+ * `WebRtcTransport` — a {@link ./PeerTransport.PeerTransport} over RTCDataChannels,
+ * signaled by {@link ../signaling/SpaceSignaler}. Runs on the **main thread**
+ * (`RTCPeerConnection` is Window-only — not available in Workers), so the block
+ * engine lives in a Worker and this only shuttles bytes.
+ *
+ * Connection setup uses a deterministic initiator (the peer with the smaller id
+ * dials) to avoid offer/answer glare. STUN handles NAT traversal; there is no
+ * TURN — an unreachable peer simply never connects and the caller falls back to
+ * origin (P2P is best-effort).
+ *
+ * Frames (up to a 4 MiB shard) exceed an RTCDataChannel's max message size, so
+ * each frame is fragmented into `CHUNK`-sized pieces with a 12-byte header
+ * `[msgId u32][index u32][total u32]` and reassembled per peer.
+ */
+
+interface WebRtcTransportOptions {
+    iceServers?: RTCIceServer[];
+    /** Cap on simultaneous peer connections (mesh size). Default 8. */
+    maxPeers?: number;
+}
+declare class WebRtcTransport implements PeerTransport {
+    private readonly signaler;
+    private readonly myId;
+    private readonly conns;
+    private readonly msgCbs;
+    private readonly peerCbs;
+    private readonly offSignal;
+    private readonly iceServers;
+    private readonly maxPeers;
+    private nextMsgId;
+    constructor(signaler: SpaceSignaler, myId: PeerId, opts?: WebRtcTransportOptions);
+    peers(): PeerId[];
+    /** Dial a peer (no-op unless we're the deterministic initiator for the pair). */
+    connectTo(peerId: PeerId): void;
+    send(peer: PeerId, data: Uint8Array, channel?: number): void;
+    broadcast(data: Uint8Array, channel?: number): void;
+    onMessage(cb: (peer: PeerId, data: Uint8Array, channel: number) => void): () => void;
+    onPeerChange(cb: (peers: PeerId[]) => void): () => void;
+    close(): void;
+    private newPc;
+    private initiate;
+    private bindChannel;
+    private onSignal;
+    private drop;
+    private firePeerChange;
+    private sendFragmented;
+    private drain;
+    private onChunk;
+}
+
+/**
+ * `EngineHost` — the boundary {@link ../PeerNetwork} wires a transport to. It
+ * abstracts *where* the {@link ./blockEngine.BlockEngine} runs:
+ *   - {@link LocalEngineHost} runs it on the calling thread (tests, or a
+ *     fallback when the Web Worker can't be built by a consumer's bundler);
+ *   - the Worker proxy ({@link ./engineClient}) runs it off-thread.
+ *
+ * Either way the host exposes the same surface: drive `want`/`announce`, feed it
+ * inbound frames via `handleFrame`, and receive its outbound frames via
+ * `onOutbound` (which the network forwards to the transport).
+ */
+
+interface EngineHost {
+    want(hash: string, timeoutMs: number): Promise<Uint8Array | null>;
+    announce(hash: string): void;
+    /** Feed an inbound frame received from `peer` on the transport. */
+    handleFrame(peer: string, frame: Uint8Array): void;
+    /** Receive frames the engine wants to send (`"*"` = broadcast). */
+    onOutbound(cb: (target: string, frame: Uint8Array) => void): () => void;
+    close(): void;
+}
+/** Runs the engine in-process (main thread or test). */
+declare class LocalEngineHost implements EngineHost {
+    private readonly engine;
+    private readonly cbs;
+    constructor(store: BlockStore, hasher: Hasher);
+    want(hash: string, timeoutMs: number): Promise<Uint8Array | null>;
+    announce(hash: string): void;
+    handleFrame(peer: string, frame: Uint8Array): void;
+    onOutbound(cb: (target: string, frame: Uint8Array) => void): () => void;
+    close(): void;
+}
+
+/**
+ * `WorkerEngineHost` — the main-thread proxy to a {@link ./blockEngine.BlockEngine}
+ * running inside a dedicated Web Worker (so hashing, blockstore I/O, and the
+ * protocol codec stay off the main thread). It speaks the small message protocol
+ * in {@link ./blockEngine.worker} and satisfies {@link ./engineHost.EngineHost},
+ * so {@link ../PeerNetwork} treats it identically to the in-process host.
+ *
+ * Block bytes cross the worker boundary as **transferable** ArrayBuffers
+ * (zero-copy). Only encrypted blocks ever cross — keys never enter the worker.
+ */
+
+declare class WorkerEngineHost implements EngineHost {
+    private readonly worker;
+    private readonly wants;
+    private readonly cbs;
+    private nextId;
+    constructor(worker: Worker);
+    want(hash: string, timeoutMs: number): Promise<Uint8Array | null>;
+    announce(hash: string): void;
+    handleFrame(peer: string, frame: Uint8Array): void;
+    onOutbound(cb: (target: string, frame: Uint8Array) => void): () => void;
+    close(): void;
+}
+
+/**
+ * Bitswap-lite wire protocol for peer block exchange. Four frame types over a
+ * {@link ../transport/PeerTransport} data channel:
+ *
+ *   WANT(hash)         — "does anyone have this block?" / "send it to me"
+ *   HAVE(hash)         — "I hold this block" (announce / reply to a WANT)
+ *   BLOCK(hash, bytes) — the block itself (verified by hash on receipt)
+ *   CANCEL(hash)       — "stop, I got it elsewhere"
+ *
+ * Frames are compact binary so a 4 MiB shard isn't base64-bloated through JSON:
+ *
+ *   byte 0      : type (0 WANT | 1 HAVE | 2 BLOCK | 3 CANCEL)
+ *   bytes 1..33 : 32-byte raw SHA-256 of the block (our shard hash, hex-decoded)
+ *   bytes 33..  : payload (BLOCK only)
+ *
+ * Blocks are AES-GCM ciphertext, so a frame carries nothing readable; the hash
+ * is the capability check (the receiver re-hashes the payload and drops a
+ * mismatch). See {@link ./blockEngine}.
+ */
+declare enum FrameType {
+    WANT = 0,
+    HAVE = 1,
+    BLOCK = 2,
+    CANCEL = 3
+}
+interface DecodedFrame {
+    type: FrameType;
+    /** Lowercase hex SHA-256 (matches `shardHash`). */
+    hash: string;
+    /** Present only for {@link FrameType.BLOCK}. */
+    payload?: Uint8Array;
+}
+declare function encodeWant(hash: string): Uint8Array;
+declare function encodeHave(hash: string): Uint8Array;
+declare function encodeCancel(hash: string): Uint8Array;
+declare function encodeBlock(hash: string, payload: Uint8Array): Uint8Array;
+declare function decode(frame: Uint8Array): DecodedFrame;
+
+type protocol_DecodedFrame = DecodedFrame;
+type protocol_FrameType = FrameType;
+declare const protocol_FrameType: typeof FrameType;
+declare const protocol_decode: typeof decode;
+declare const protocol_encodeBlock: typeof encodeBlock;
+declare const protocol_encodeCancel: typeof encodeCancel;
+declare const protocol_encodeHave: typeof encodeHave;
+declare const protocol_encodeWant: typeof encodeWant;
+declare namespace protocol {
+  export { protocol_FrameType as FrameType, protocol_decode as decode, protocol_encodeBlock as encodeBlock, protocol_encodeCancel as encodeCancel, protocol_encodeHave as encodeHave, protocol_encodeWant as encodeWant };
+  export type { protocol_DecodedFrame as DecodedFrame };
+}
+
 /**
  * KeyringClient — HTTP implementation of {@link KeyringTransport} against the
  * accelerator's per-space keyring endpoints. All blobs are opaque to the
@@ -4328,5 +5660,5 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, VaultUnavailableError, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, toField, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
-export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvNamespaceDeps, LoginOptions, MessageBody, MessageDeletedEvent, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, PacketCipher, PacketHeaders, PacketOptions, Participant, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, RatchetState, ReceiveResult, RegisterParams, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardClientOptions, SharedSpaceClientOptions, SnarkProof, SpaceChannelLike, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, StorageChangeEvent, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, compareHlc, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, ConnectivityOptions, ConnectivityState, DbQueryPage, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, HlcParts, HlcState, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LoginOptions, LwwMap, LwwRegister, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, Participant, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StorageChangeEvent, StoreName, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };