@dignetwork/dig-sdk 0.0.1-alpha.99 → 0.1.0

package/dist/dev-shim-Bgw8X2E9.d.cts

@@ -0,0 +1,118 @@
+/** The deploy-relevant subset of `dig.toml`, in the adapters' camelCase shape. */
+interface DigTomlConfig {
+    storeId?: string;
+    outputDir?: string;
+    buildCommand?: string;
+    message?: string;
+    network?: string;
+    remote?: string;
+    waitTimeout?: number;
+}
+/**
+ * Parse the deploy-relevant keys out of a `dig.toml` string. Unknown keys, tables, and nested
+ * structures are ignored. Returns only the keys actually present (so it composes cleanly under the
+ * precedence rules in resolveDeployConfig).
+ */
+declare function parseDigToml(text: string): DigTomlConfig;
+
+/** Per-call options a developer passes to the Vite plugin / Next adapter. */
+interface AdapterOptions {
+    /** On-chain store id (64-hex) to advance. Usually set in dig.toml instead. */
+    storeId?: string;
+    /** Built-output directory to publish. Defaults to the framework's output (or "dist"). */
+    outputDir?: string;
+    /** Shell build command for `digstore` to run. Omit when the adapter builds itself. */
+    buildCommand?: string;
+    /** Commit message for the new capsule. */
+    message?: string;
+    /** Chain network. Defaults to "mainnet". */
+    network?: string;
+    /** The `origin` remote to publish to (e.g. `dig://<storeId>`). */
+    remote?: string;
+    /** Seconds to wait for on-chain confirmation. */
+    waitTimeout?: number;
+}
+/** The fully resolved config a deploy runs with. Secrets are present only if env supplied them. */
+interface ResolvedDeployConfig {
+    storeId?: string;
+    outputDir: string;
+    buildCommand?: string;
+    message?: string;
+    network: string;
+    remote?: string;
+    waitTimeout?: number;
+    /** Publisher deploy key (64-hex). From env only. */
+    deployKey?: string;
+    /** Private-store secret salt (64-hex). From env only. */
+    salt?: string;
+}
+/** Inputs to resolution — kept explicit so it is a pure function (no process.env read inside). */
+interface ResolveInput {
+    options: AdapterOptions;
+    digToml: DigTomlConfig;
+    env: Record<string, string | undefined>;
+}
+/**
+ * Resolve the final deploy config. Precedence per field: options > env (DIGSTORE_*) > dig.toml >
+ * default. Secrets (deployKey, salt) are taken from env ONLY.
+ */
+declare function resolveDeployConfig(input: ResolveInput): ResolvedDeployConfig;
+
+/** Knobs for argv construction. */
+interface DeployArgsOptions {
+    /**
+     * The adapter already ran the framework build, so don't hand `--build-command` to digstore (it
+     * would rebuild). The output dir is staged as-is.
+     */
+    skipBuild?: boolean;
+}
+/**
+ * Build the argv for `digstore <argv>` from a resolved config. Always `deploy --json`. Only flags
+ * whose values are set are emitted. SECRETS (deployKey, salt) are intentionally excluded — they go
+ * through the env (buildDeployEnv) so they never appear in the process table.
+ */
+declare function buildDeployArgs(cfg: ResolvedDeployConfig, opts?: DeployArgsOptions): string[];
+/**
+ * The env overlay to merge onto the child process env: the SECRETS, passed out-of-band so they are
+ * never visible on the command line. Returns only the keys that have a value.
+ */
+declare function buildDeployEnv(cfg: ResolvedDeployConfig): Record<string, string>;
+/** The friendly, parsed outcome of a deploy. */
+interface DeployResult {
+    /** `storeId:rootHash` — the capsule identity (the ecosystem-vocabulary id the user shares). */
+    capsule: string;
+    /** Store identity (64-hex). */
+    storeId: string;
+    /** The new on-chain root (64-hex). */
+    root: string;
+    /** The dig:// URL naming this store (resolves through the network to the latest version). */
+    digUrl: string;
+    /** The human "view it" URL on DIGHub (the same one `digstore deploy` prints). */
+    hubUrl: string;
+    /** Whether the capsule was pushed to DIGHub (when the JSON reported it). */
+    pushed?: boolean;
+}
+/**
+ * Parse `digstore deploy --json` stdout into a DeployResult. digstore emits a single JSON object
+ * (with at least `capsule` and `root`); we also tolerate extra JSON log lines by scanning lines
+ * bottom-up for the first object that carries a `capsule`. Throws a clear error if none is found or
+ * the output isn't JSON at all.
+ */
+declare function parseDeployResult(stdout: string): DeployResult;
+
+/** A literal substring stamped into the shim so it is unmistakably a dev stub (asserted in tests). */
+declare const DEV_SHIM_MARKER = "dig-sdk:dev-wallet-shim";
+/** Options for the generated dev shim. */
+interface DevShimOptions {
+    /** Mock receive address the shim returns from `getAddress`. A clearly-fake default is used. */
+    address?: string;
+}
+/**
+ * Generate the dev-shim `<script>` body (no surrounding `<script>` tags). Inline it into the dev
+ * server's served HTML. It is an IIFE that installs `window.chia` ONLY if one is not already
+ * present, so the DIG Browser / a real extension always takes precedence. Eval-free and
+ * dependency-free — safe under a strict CSP.
+ */
+declare function devShimScript(options?: DevShimOptions): string;
+
+export { type AdapterOptions as A, type DeployArgsOptions as D, type ResolveInput as R, type DeployResult as a, DEV_SHIM_MARKER as b, type DevShimOptions as c, type DigTomlConfig as d, type ResolvedDeployConfig as e, buildDeployArgs as f, buildDeployEnv as g, devShimScript as h, parseDigToml as i, parseDeployResult as p, resolveDeployConfig as r };

package/dist/dev-shim-Bgw8X2E9.d.ts

@@ -0,0 +1,118 @@
+/** The deploy-relevant subset of `dig.toml`, in the adapters' camelCase shape. */
+interface DigTomlConfig {
+    storeId?: string;
+    outputDir?: string;
+    buildCommand?: string;
+    message?: string;
+    network?: string;
+    remote?: string;
+    waitTimeout?: number;
+}
+/**
+ * Parse the deploy-relevant keys out of a `dig.toml` string. Unknown keys, tables, and nested
+ * structures are ignored. Returns only the keys actually present (so it composes cleanly under the
+ * precedence rules in resolveDeployConfig).
+ */
+declare function parseDigToml(text: string): DigTomlConfig;
+
+/** Per-call options a developer passes to the Vite plugin / Next adapter. */
+interface AdapterOptions {
+    /** On-chain store id (64-hex) to advance. Usually set in dig.toml instead. */
+    storeId?: string;
+    /** Built-output directory to publish. Defaults to the framework's output (or "dist"). */
+    outputDir?: string;
+    /** Shell build command for `digstore` to run. Omit when the adapter builds itself. */
+    buildCommand?: string;
+    /** Commit message for the new capsule. */
+    message?: string;
+    /** Chain network. Defaults to "mainnet". */
+    network?: string;
+    /** The `origin` remote to publish to (e.g. `dig://<storeId>`). */
+    remote?: string;
+    /** Seconds to wait for on-chain confirmation. */
+    waitTimeout?: number;
+}
+/** The fully resolved config a deploy runs with. Secrets are present only if env supplied them. */
+interface ResolvedDeployConfig {
+    storeId?: string;
+    outputDir: string;
+    buildCommand?: string;
+    message?: string;
+    network: string;
+    remote?: string;
+    waitTimeout?: number;
+    /** Publisher deploy key (64-hex). From env only. */
+    deployKey?: string;
+    /** Private-store secret salt (64-hex). From env only. */
+    salt?: string;
+}
+/** Inputs to resolution — kept explicit so it is a pure function (no process.env read inside). */
+interface ResolveInput {
+    options: AdapterOptions;
+    digToml: DigTomlConfig;
+    env: Record<string, string | undefined>;
+}
+/**
+ * Resolve the final deploy config. Precedence per field: options > env (DIGSTORE_*) > dig.toml >
+ * default. Secrets (deployKey, salt) are taken from env ONLY.
+ */
+declare function resolveDeployConfig(input: ResolveInput): ResolvedDeployConfig;
+
+/** Knobs for argv construction. */
+interface DeployArgsOptions {
+    /**
+     * The adapter already ran the framework build, so don't hand `--build-command` to digstore (it
+     * would rebuild). The output dir is staged as-is.
+     */
+    skipBuild?: boolean;
+}
+/**
+ * Build the argv for `digstore <argv>` from a resolved config. Always `deploy --json`. Only flags
+ * whose values are set are emitted. SECRETS (deployKey, salt) are intentionally excluded — they go
+ * through the env (buildDeployEnv) so they never appear in the process table.
+ */
+declare function buildDeployArgs(cfg: ResolvedDeployConfig, opts?: DeployArgsOptions): string[];
+/**
+ * The env overlay to merge onto the child process env: the SECRETS, passed out-of-band so they are
+ * never visible on the command line. Returns only the keys that have a value.
+ */
+declare function buildDeployEnv(cfg: ResolvedDeployConfig): Record<string, string>;
+/** The friendly, parsed outcome of a deploy. */
+interface DeployResult {
+    /** `storeId:rootHash` — the capsule identity (the ecosystem-vocabulary id the user shares). */
+    capsule: string;
+    /** Store identity (64-hex). */
+    storeId: string;
+    /** The new on-chain root (64-hex). */
+    root: string;
+    /** The dig:// URL naming this store (resolves through the network to the latest version). */
+    digUrl: string;
+    /** The human "view it" URL on DIGHub (the same one `digstore deploy` prints). */
+    hubUrl: string;
+    /** Whether the capsule was pushed to DIGHub (when the JSON reported it). */
+    pushed?: boolean;
+}
+/**
+ * Parse `digstore deploy --json` stdout into a DeployResult. digstore emits a single JSON object
+ * (with at least `capsule` and `root`); we also tolerate extra JSON log lines by scanning lines
+ * bottom-up for the first object that carries a `capsule`. Throws a clear error if none is found or
+ * the output isn't JSON at all.
+ */
+declare function parseDeployResult(stdout: string): DeployResult;
+
+/** A literal substring stamped into the shim so it is unmistakably a dev stub (asserted in tests). */
+declare const DEV_SHIM_MARKER = "dig-sdk:dev-wallet-shim";
+/** Options for the generated dev shim. */
+interface DevShimOptions {
+    /** Mock receive address the shim returns from `getAddress`. A clearly-fake default is used. */
+    address?: string;
+}
+/**
+ * Generate the dev-shim `<script>` body (no surrounding `<script>` tags). Inline it into the dev
+ * server's served HTML. It is an IIFE that installs `window.chia` ONLY if one is not already
+ * present, so the DIG Browser / a real extension always takes precedence. Eval-free and
+ * dependency-free — safe under a strict CSP.
+ */
+declare function devShimScript(options?: DevShimOptions): string;
+
+export { type AdapterOptions as A, type DeployArgsOptions as D, type ResolveInput as R, type DeployResult as a, DEV_SHIM_MARKER as b, type DevShimOptions as c, type DigTomlConfig as d, type ResolvedDeployConfig as e, buildDeployArgs as f, buildDeployEnv as g, devShimScript as h, parseDigToml as i, parseDeployResult as p, resolveDeployConfig as r };

package/dist/dig-client-entry-BIzuZ7Rs.d.cts

@@ -0,0 +1,263 @@
+/** The read-crypto functions the SDK uses from the dig_client WASM. */
+interface DigClientWasm {
+    /** `retrieval_key = SHA-256(canonical rootless urn)`, lowercase hex. Empty key ⇒ index.html. */
+    retrievalKey(storeIdHex: string, resourceKey: string): string;
+    /** Derive the 32-byte AES-256 content key (lowercase hex). `saltHex` for a private store. */
+    deriveKey(storeIdHex: string, resourceKey: string, saltHex?: string | null): string;
+    /**
+     * Verify `ciphertext` is included under `trustedRootHex` via the base64 merkle `proofB64`.
+     * Returns true on success, false on ANY verification failure (a decoy returns false rather than
+     * throwing). Throws only on malformed inputs.
+     */
+    verifyInclusion(ciphertext: Uint8Array, proofB64: string, trustedRootHex: string): boolean;
+    /** AES-256-GCM-SIV-open a single chunk under an explicit 32-byte `keyHex`. Throws on tag fail. */
+    decryptChunk(keyHex: string, ciphertext: Uint8Array): Uint8Array;
+    /**
+     * Full read pipeline: gate (inclusion) then decrypt (URN key, split by `chunkLens`), returning
+     * plaintext bytes. `chunkLens` may be null/empty for a single-chunk resource.
+     */
+    decryptResource(storeIdHex: string, resourceKey: string, ciphertext: Uint8Array, proofB64: string, trustedRootHex: string, saltHex?: string | null, chunkLens?: Uint32Array | null): Uint8Array;
+    /** As `decryptResource`, returning UTF-8 text. */
+    decryptResourceToText(storeIdHex: string, resourceKey: string, ciphertext: Uint8Array, proofB64: string, trustedRootHex: string, saltHex?: string | null, chunkLens?: Uint32Array | null): string;
+    /** Seal a resource's plaintext as one GCM-SIV blob under its per-URN key (the encrypt inverse). */
+    encryptResource(storeIdHex: string, resourceKey: string, plaintext: Uint8Array, saltHex?: string | null): Uint8Array;
+    /** Reconstruct the canonical rootless URN string. */
+    reconstructUrn(storeIdHex: string, resourceKey: string): string;
+    /** Reconstruct a root-pinned display URN string. */
+    reconstructUrnWithRoot(storeIdHex: string, rootHex: string, resourceKey: string): string;
+    /** Library version (matches the crate version). */
+    version(): string;
+}
+
+/** A normalized `{ publicKey, signature }` pair from a wallet sign, both as `0x`-prefixed hex. */
+interface SignResult {
+    /** The signing public key (synthetic BLS key), `0x`-prefixed hex. */
+    publicKey: string | null;
+    /** The BLS signature, `0x`-prefixed hex (or the raw wallet string). */
+    signature: string | null;
+}
+/**
+ * The minimal injected-provider contract the SDK detects on `window.chia` (the DIG Browser's
+ * in-process wallet, or a compatible CHIP-0002 extension). Mirrors the DIG Browser provider:
+ * `request({ method, params })` returns the wallet's `data`; `connect(eager)` blocks on per-origin
+ * approval; `on`/`off` are EIP-1193-style event hooks.
+ */
+interface InjectedChiaProvider {
+    /** Unspoofable marker the DIG Browser provider sets; the SDK prefers a provider that has it. */
+    isDIG?: boolean;
+    /** Some providers expose a connected flag. */
+    isConnected?: boolean;
+    /** One CHIP-0002 RPC. Bare names auto-prefix to `chip0002_`; `chia_*` passes through. */
+    request(args: {
+        method: string;
+        params?: unknown;
+    }): Promise<unknown>;
+    /** Ask the wallet to approve this origin. Blocks until approved/rejected. */
+    connect?(eager?: boolean): Promise<unknown>;
+    on?(event: string, fn: (data: unknown) => void): void;
+    off?(event: string, fn: (data: unknown) => void): void;
+}
+declare global {
+    var chia: InjectedChiaProvider | undefined;
+    interface Window {
+        chia?: InjectedChiaProvider;
+    }
+}
+/** Which wallet transport is backing a `ChiaProvider`. */
+type WalletBackend = "injected" | "walletconnect";
+/** A connected wallet session, returned by `ChiaProvider.connect()`. */
+interface WalletSession {
+    /** The transport backing this session. */
+    backend: WalletBackend;
+    /** The CAIP-2 chain id (e.g. "chia:mainnet"). */
+    chain: string;
+    /**
+     * The session topic. For WalletConnect this is the real relay topic; for the injected backend
+     * it is a stable sentinel ("injected") — callers do not need to inspect it.
+     */
+    topic: string;
+    /** The wallet's receive address, when known at connect time. */
+    address?: string | null;
+}
+/** Options for `DigClient.read*` calls — chiefly which dig RPC endpoint to use. */
+interface ReadOptions {
+    /** dig RPC endpoint. Defaults to the public `https://rpc.dig.net`. */
+    rpc?: string;
+}
+/** The result of reading a resource by URN. */
+interface ReadResult {
+    /** Store identity (64-hex). */
+    storeId: string;
+    /** The on-chain generation root the content was verified against (or null if none supplied). */
+    root: string | null;
+    /** The resource path within the store. */
+    resourceKey: string;
+    /** Private-store salt used (or null). */
+    salt: string | null;
+    /**
+     * The resource bytes. When `decrypted` is true these are the authenticated plaintext; when
+     * false they are the RAW served ciphertext (a decoy / wrong-key / wrong-salt response is just
+     * opaque bytes — the model is oblivious, so this is never a "not found" verdict).
+     */
+    bytes: Uint8Array;
+    /** Advisory: did the served bytes' inclusion proof verify against `root`? */
+    verified: boolean;
+    /** Did the bytes decrypt+authenticate under this URN's derived key? */
+    decrypted: boolean;
+}
+/** The two root-independent keys a URN maps to (derived client-side, nothing sent to the network). */
+interface UrnKeys {
+    storeId: string;
+    root: string | null;
+    resourceKey: string;
+    salt: string | null;
+    /** `SHA-256(canonical rootless URN)`, lowercase hex — what the dig RPC is addressed by. */
+    retrievalKey: string;
+    /** The per-URN AES-256-GCM-SIV decryption key, lowercase hex. */
+    decryptionKey: string;
+}
+
+/** The default public dig RPC endpoint. */
+declare const DEFAULT_RPC = "https://rpc.dig.net";
+/** Options to construct a DigClient. */
+interface DigClientOptions {
+    /** dig RPC endpoint. Defaults to the public `https://rpc.dig.net`. */
+    rpc?: string;
+    /** Override `fetch` (e.g. an instrumented one). Defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+}
+/**
+ * The read-crypto client. Construct once and reuse — the wasm is loaded + SRI-verified lazily on
+ * the first read and memoized process/page-wide.
+ *
+ * @example
+ * const dig = new DigClient();
+ * const { bytes, decrypted } = await dig.read({
+ *   urn: "urn:dig:chia:<storeId>/index.html",
+ *   root: "<onchain-root-hex>",
+ * });
+ * if (decrypted) console.log(new TextDecoder().decode(bytes));
+ */
+declare class DigClient {
+    private readonly rpc;
+    private readonly fetchImpl;
+    constructor(options?: DigClientOptions);
+    /** Load (and SRI-verify) the read-crypto wasm. Exposed for callers that want the raw functions. */
+    wasm(): Promise<DigClientWasm>;
+    /** `retrieval_key = SHA-256(canonical rootless URN)`, lowercase hex. */
+    retrievalKey(storeId: string, resourceKey: string): Promise<string>;
+    /** Derive the per-URN AES-256-GCM-SIV key, lowercase hex. `salt` for a private store. */
+    deriveKey(storeId: string, resourceKey: string, salt?: string | null): Promise<string>;
+    /** Verify served `ciphertext` is included under `root` via the base64 merkle `proof`. */
+    verifyInclusion(ciphertext: Uint8Array, proof: string, root: string): Promise<boolean>;
+    /** Reconstruct the canonical rootless URN whose SHA-256 is the retrieval key. */
+    reconstructUrn(storeId: string, resourceKey: string): Promise<string>;
+    /**
+     * Derive, client-side, the two root-independent keys a URN maps to (retrieval + decryption).
+     * Nothing is sent to the network — pure local derivation via the wasm.
+     */
+    deriveUrnKeys(input: {
+        urn: string;
+        salt?: string | null;
+    }): Promise<UrnKeys>;
+    /**
+     * Fetch + verify + decrypt one resource by URN. `root` is the on-chain generation root to verify
+     * against (resolved by the caller from the chain); when omitted, the root embedded in the URN is
+     * used. Returns the bytes plus advisory `verified`/`decrypted` flags. NEVER throws "not found"
+     * (presence is unknowable) — it throws only on a transport failure.
+     */
+    read(input: {
+        urn: string;
+        root?: string | null;
+        salt?: string | null;
+    }, opts?: ReadOptions): Promise<ReadResult>;
+    /** As `read`, but decoding the plaintext to a UTF-8 string when it decrypts (else throws). */
+    readText(input: {
+        urn: string;
+        root?: string | null;
+        salt?: string | null;
+    }, opts?: ReadOptions): Promise<string>;
+    /**
+     * Read by explicit (storeId, resourceKey, root, salt) rather than a URN string. The oblivious
+     * download primitive the URN read is built on.
+     */
+    readResource(input: {
+        storeId: string;
+        resourceKey: string;
+        root: string;
+        salt?: string | null;
+    }, opts?: ReadOptions): Promise<ReadResult>;
+    private fetchCiphertext;
+    private rpcCall;
+}
+
+/** SHA-256 (lowercase hex) of vendor/dig_client_bg.wasm — the SRI digest. Fail closed on mismatch. */
+declare const DIG_CLIENT_WASM_SHA256 = "ff486be806f908a2a90780e499a04dbd34e10e3b97be0470cb9ee841a1e49e77";
+/** Optional explicit wasm inputs, for environments where auto-resolution can't find vendor/. */
+interface WasmConfig {
+    /**
+     * The wasm bytes (already loaded). When provided, SRI is still enforced unless `skipIntegrity`.
+     * Pass this in CSP-strict browsers where you fetch + verify the bytes yourself.
+     */
+    wasmBytes?: BufferSource;
+    /**
+     * URL to the wasm-bindgen glue module (vendor/dig_client.mjs) for browser dynamic import. When
+     * omitted in a browser, the loader tries to import the glue relative to this module.
+     */
+    glueUrl?: string;
+    /**
+     * URL to fetch the wasm bytes from (browser) when `wasmBytes` is not supplied. The fetched bytes
+     * are SRI-verified before init.
+     */
+    wasmUrl?: string;
+    /** Skip the SRI check. Only for tests / trusted custom builds — NOT recommended. */
+    skipIntegrity?: boolean;
+}
+/**
+ * Override how the read-crypto wasm is located/loaded. Call BEFORE the first `DigClient` read.
+ * Mainly for browsers without a bundler that resolves package files, or CSP-strict apps that fetch
+ * + verify the wasm bytes themselves and hand them in. Resets any cached instance.
+ */
+declare function configureWasm(config: WasmConfig): void;
+/**
+ * Load, SRI-verify, and instantiate the read-crypto wasm, returning its functions. Memoized — at
+ * most one init per process/page. Fails closed on an integrity mismatch.
+ */
+declare function loadDigClientWasm(): Promise<DigClientWasm>;
+
+/** The parts of a parsed DIG URN. `root`/`salt` are null when absent. */
+interface ParsedUrn {
+    /** Store identity (64-hex launcher id), lowercased. */
+    readonly storeId: string;
+    /** Generation root (64-hex), lowercased — or null for the root-independent form. */
+    readonly root: string | null;
+    /** Resource path within the store (verbatim, not lowercased). */
+    readonly resourceKey: string;
+    /** Private-store secret salt (hex), lowercased — or null for a public store. */
+    readonly salt: string | null;
+}
+/**
+ * Parse a DIG URN into its parts. Throws on a malformed URN.
+ *
+ * @example
+ * parseUrn("urn:dig:chia:" + "ab".repeat(32) + "/index.html")
+ * // → { storeId: "abab…", root: null, resourceKey: "index.html", salt: null }
+ */
+declare function parseUrn(raw: string): ParsedUrn;
+/** True iff `raw` is a syntactically valid DIG URN. Never throws. */
+declare function isUrn(raw: string): boolean;
+/**
+ * Reconstruct the canonical, root-INDEPENDENT URN string for a store + resource key:
+ * `urn:dig:chia:<store_id>/<resource_key>`. An empty resource key resolves to the default view
+ * `index.html`. This is the form whose SHA-256 is the retrieval key and whose bytes seed the AES
+ * key — matching the wasm's `reconstructUrn`.
+ */
+declare function reconstructUrn(storeId: string, resourceKey: string): string;
+/**
+ * Reconstruct a root-PINNED display URN: `urn:dig:chia:<store_id>:<root>/<resource_key>`. Useful
+ * for sharing a URN bound to a specific generation; the retrieval/AES keys still use the rootless
+ * form (`reconstructUrn`).
+ */
+declare function reconstructUrnWithRoot(storeId: string, root: string, resourceKey: string): string;
+
+export { DEFAULT_RPC as D, type InjectedChiaProvider as I, type ParsedUrn as P, type ReadOptions as R, type SignResult as S, type UrnKeys as U, type WalletBackend as W, type WalletSession as a, DIG_CLIENT_WASM_SHA256 as b, DigClient as c, type DigClientOptions as d, type DigClientWasm as e, type ReadResult as f, type WasmConfig as g, configureWasm as h, isUrn as i, reconstructUrnWithRoot as j, loadDigClientWasm as l, parseUrn as p, reconstructUrn as r };