@hesohq/verify-wasm 0.4.3 → 0.5.0-dev.81

package/heso_wasm.js

@@ -29,12 +29,16 @@ export class ActionVerdict {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.__wbg_get_actionverdict_trust_level(this.__wbg_ptr);
-            deferred1_0 = ret[0];
-            deferred1_1 = ret[1];
-            return getStringFromWasm0(ret[0], ret[1]);
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_actionverdict_trust_level(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
         } finally {
-            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
         }
     }
     /**
@@ -46,12 +50,16 @@ export class ActionVerdict {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.__wbg_get_actionverdict_verdict(this.__wbg_ptr);
-            deferred1_0 = ret[0];
-            deferred1_1 = ret[1];
-            return getStringFromWasm0(ret[0], ret[1]);
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_actionverdict_verdict(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
         } finally {
-            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
         }
     }
     /**
@@ -60,7 +68,7 @@ export class ActionVerdict {
      * @param {string} arg0
      */
     set trust_level(arg0) {
-        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_actionverdict_trust_level(this.__wbg_ptr, ptr0, len0);
     }
@@ -70,7 +78,7 @@ export class ActionVerdict {
      * @param {string} arg0
      */
     set verdict(arg0) {
-        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_actionverdict_verdict(this.__wbg_ptr, ptr0, len0);
     }
@@ -105,12 +113,16 @@ export class ApprovalTokenClaims {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.__wbg_get_approvaltokenclaims_approver_public_key(this.__wbg_ptr);
-            deferred1_0 = ret[0];
-            deferred1_1 = ret[1];
-            return getStringFromWasm0(ret[0], ret[1]);
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_approvaltokenclaims_approver_public_key(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
         } finally {
-            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
         }
     }
     /**
@@ -121,12 +133,16 @@ export class ApprovalTokenClaims {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.__wbg_get_approvaltokenclaims_decision(this.__wbg_ptr);
-            deferred1_0 = ret[0];
-            deferred1_1 = ret[1];
-            return getStringFromWasm0(ret[0], ret[1]);
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_approvaltokenclaims_decision(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
         } finally {
-            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
         }
     }
     /**
@@ -135,7 +151,7 @@ export class ApprovalTokenClaims {
      */
     get expiry_unix_secs() {
         const ret = wasm.__wbg_get_approvaltokenclaims_expiry_unix_secs(this.__wbg_ptr);
-        return ret;
+        return takeObject(ret);
     }
     /**
      * The 32-byte random nonce as a `Uint8Array`.
@@ -143,7 +159,7 @@ export class ApprovalTokenClaims {
      */
     get nonce() {
         const ret = wasm.__wbg_get_approvaltokenclaims_nonce(this.__wbg_ptr);
-        return ret;
+        return takeObject(ret);
     }
     /**
      * The scope string encoded in the token.
@@ -153,12 +169,16 @@ export class ApprovalTokenClaims {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.__wbg_get_approvaltokenclaims_scope(this.__wbg_ptr);
-            deferred1_0 = ret[0];
-            deferred1_1 = ret[1];
-            return getStringFromWasm0(ret[0], ret[1]);
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_approvaltokenclaims_scope(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
         } finally {
-            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
         }
     }
     /**
@@ -166,7 +186,7 @@ export class ApprovalTokenClaims {
      * @param {string} arg0
      */
     set approver_public_key(arg0) {
-        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_approvaltokenclaims_approver_public_key(this.__wbg_ptr, ptr0, len0);
     }
@@ -175,7 +195,7 @@ export class ApprovalTokenClaims {
      * @param {string} arg0
      */
     set decision(arg0) {
-        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_approvaltokenclaims_decision(this.__wbg_ptr, ptr0, len0);
     }
@@ -184,21 +204,21 @@ export class ApprovalTokenClaims {
      * @param {bigint} arg0
      */
     set expiry_unix_secs(arg0) {
-        wasm.__wbg_set_approvaltokenclaims_expiry_unix_secs(this.__wbg_ptr, arg0);
+        wasm.__wbg_set_approvaltokenclaims_expiry_unix_secs(this.__wbg_ptr, addHeapObject(arg0));
     }
     /**
      * The 32-byte random nonce as a `Uint8Array`.
      * @param {Uint8Array} arg0
      */
     set nonce(arg0) {
-        wasm.__wbg_set_approvaltokenclaims_nonce(this.__wbg_ptr, arg0);
+        wasm.__wbg_set_approvaltokenclaims_nonce(this.__wbg_ptr, addHeapObject(arg0));
     }
     /**
      * The scope string encoded in the token.
      * @param {string} arg0
      */
     set scope(arg0) {
-        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_approvaltokenclaims_scope(this.__wbg_ptr, ptr0, len0);
     }
@@ -230,26 +250,40 @@ export class ChainResult {
      * @returns {string | undefined}
      */
     get detail() {
-        const ret = wasm.__wbg_get_chainresult_detail(this.__wbg_ptr);
-        let v1;
-        if (ret[0] !== 0) {
-            v1 = getStringFromWasm0(ret[0], ret[1]).slice();
-            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_chainresult_detail(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
         }
-        return v1;
     }
     /**
      * Error kind string. Only set when `ok == false`.
      * @returns {string | undefined}
      */
     get error() {
-        const ret = wasm.__wbg_get_chainresult_error(this.__wbg_ptr);
-        let v1;
-        if (ret[0] !== 0) {
-            v1 = getStringFromWasm0(ret[0], ret[1]).slice();
-            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_chainresult_error(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
         }
-        return v1;
     }
     /**
      * Number of receipts verified. Only set when `ok == true`.
@@ -280,7 +314,7 @@ export class ChainResult {
      * @param {string | null} [arg0]
      */
     set detail(arg0) {
-        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         var len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_chainresult_detail(this.__wbg_ptr, ptr0, len0);
     }
@@ -289,7 +323,7 @@ export class ChainResult {
      * @param {string | null} [arg0]
      */
     set error(arg0) {
-        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         var len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_chainresult_error(this.__wbg_ptr, ptr0, len0);
     }
@@ -301,21 +335,739 @@ export class ChainResult {
         wasm.__wbg_set_chainresult_length(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
     }
     /**
-     * `true` when every link verified.
-     * @param {boolean} arg0
+     * `true` when every link verified.
+     * @param {boolean} arg0
+     */
+    set ok(arg0) {
+        wasm.__wbg_set_chainresult_ok(this.__wbg_ptr, arg0);
+    }
+    /**
+     * The `seq` at which the error occurred. Only set when `ok == false`.
+     * @param {number | null} [arg0]
+     */
+    set seq(arg0) {
+        wasm.__wbg_set_chainresult_seq(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+}
+if (Symbol.dispose) ChainResult.prototype[Symbol.dispose] = ChainResult.prototype.free;
+
+/**
+ * The result of an offline CloudTrail feed-completeness check.
+ */
+export class CloudTrailFeedVerdict {
+    static __wrap(ptr) {
+        const obj = Object.create(CloudTrailFeedVerdict.prototype);
+        obj.__wbg_ptr = ptr;
+        CloudTrailFeedVerdictFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        CloudTrailFeedVerdictFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_cloudtrailfeedverdict_free(ptr, 0);
+    }
+    /**
+     * 0-based head-first index at which the chain broke / a digest was rejected;
+     * `None` for `Complete`.
+     * @returns {number | undefined}
+     */
+    get broken_at() {
+        const ret = wasm.__wbg_get_cloudtrailfeedverdict_broken_at(this.__wbg_ptr);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * Number of hourly digests whose signature + chain link verified.
+     * @returns {number}
+     */
+    get digests_verified() {
+        const ret = wasm.__wbg_get_cloudtrailfeedverdict_digests_verified(this.__wbg_ptr);
+        return ret >>> 0;
+    }
+    /**
+     * `true` ONLY when an unbroken signed chain proved completeness back to the
+     * starting (genesis) digest — the single state that earns a third-party
+     * `feed_complete` claim. A `ChainGap` (disclosed gap) reports `false`.
+     * @returns {boolean}
+     */
+    get feed_complete() {
+        const ret = wasm.__wbg_get_cloudtrailfeedverdict_feed_complete(this.__wbg_ptr);
+        return ret !== 0;
+    }
+    /**
+     * The kind tag of the outcome: `"Complete"`, `"ChainGap"`, `"Empty"`,
+     * `"Malformed"`, `"NoMatchingKey"`, `"SignatureInvalid"`,
+     * `"PreviousHashMismatch"`, `"PreviousSignatureMismatch"`,
+     * `"PreviousObjectMismatch"`.
+     * @returns {string}
+     */
+    get kind() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_cloudtrailfeedverdict_kind(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Number of signed log files the verified digests committed to across the
+     * window. For `Complete` this is the SIGNED, COMPLETE inventory the window
+     * provably covers (no log file could have been added, removed, or modified
+     * without breaking the chain). `0` for non-window outcomes.
+     * @returns {number}
+     */
+    get signed_log_files_count() {
+        const ret = wasm.__wbg_get_cloudtrailfeedverdict_signed_log_files_count(this.__wbg_ptr);
+        return ret >>> 0;
+    }
+    /**
+     * The signed log-file inventory as a JSON array of
+     * `{s3_bucket, s3_object, hash_value, …}` — the proof page renders these so a
+     * third party can confirm WHICH files the window covers. `"[]"` for
+     * non-window outcomes.
+     * @returns {string}
+     */
+    get signed_log_files_json() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_cloudtrailfeedverdict_signed_log_files_json(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * `digestEndTime` of the head digest (window upper bound). `None` unless the
+     * outcome carries a window.
+     * @returns {string | undefined}
+     */
+    get window_end() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_cloudtrailfeedverdict_window_end(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * `digestEndTime` of the starting digest reached (`Complete`) or the last
+     * verified digest before the gap (`ChainGap`). `None` otherwise.
+     * @returns {string | undefined}
+     */
+    get window_start() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_cloudtrailfeedverdict_window_start(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * 0-based head-first index at which the chain broke / a digest was rejected;
+     * `None` for `Complete`.
+     * @param {number | null} [arg0]
+     */
+    set broken_at(arg0) {
+        wasm.__wbg_set_cloudtrailfeedverdict_broken_at(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+    /**
+     * Number of hourly digests whose signature + chain link verified.
+     * @param {number} arg0
+     */
+    set digests_verified(arg0) {
+        wasm.__wbg_set_cloudtrailfeedverdict_digests_verified(this.__wbg_ptr, arg0);
+    }
+    /**
+     * `true` ONLY when an unbroken signed chain proved completeness back to the
+     * starting (genesis) digest — the single state that earns a third-party
+     * `feed_complete` claim. A `ChainGap` (disclosed gap) reports `false`.
+     * @param {boolean} arg0
+     */
+    set feed_complete(arg0) {
+        wasm.__wbg_set_cloudtrailfeedverdict_feed_complete(this.__wbg_ptr, arg0);
+    }
+    /**
+     * The kind tag of the outcome: `"Complete"`, `"ChainGap"`, `"Empty"`,
+     * `"Malformed"`, `"NoMatchingKey"`, `"SignatureInvalid"`,
+     * `"PreviousHashMismatch"`, `"PreviousSignatureMismatch"`,
+     * `"PreviousObjectMismatch"`.
+     * @param {string} arg0
+     */
+    set kind(arg0) {
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_cloudtrailfeedverdict_kind(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * Number of signed log files the verified digests committed to across the
+     * window. For `Complete` this is the SIGNED, COMPLETE inventory the window
+     * provably covers (no log file could have been added, removed, or modified
+     * without breaking the chain). `0` for non-window outcomes.
+     * @param {number} arg0
+     */
+    set signed_log_files_count(arg0) {
+        wasm.__wbg_set_cloudtrailfeedverdict_signed_log_files_count(this.__wbg_ptr, arg0);
+    }
+    /**
+     * The signed log-file inventory as a JSON array of
+     * `{s3_bucket, s3_object, hash_value, …}` — the proof page renders these so a
+     * third party can confirm WHICH files the window covers. `"[]"` for
+     * non-window outcomes.
+     * @param {string} arg0
+     */
+    set signed_log_files_json(arg0) {
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_cloudtrailfeedverdict_signed_log_files_json(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * `digestEndTime` of the head digest (window upper bound). `None` unless the
+     * outcome carries a window.
+     * @param {string | null} [arg0]
+     */
+    set window_end(arg0) {
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_cloudtrailfeedverdict_window_end(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * `digestEndTime` of the starting digest reached (`Complete`) or the last
+     * verified digest before the gap (`ChainGap`). `None` otherwise.
+     * @param {string | null} [arg0]
+     */
+    set window_start(arg0) {
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_cloudtrailfeedverdict_window_start(this.__wbg_ptr, ptr0, len0);
+    }
+}
+if (Symbol.dispose) CloudTrailFeedVerdict.prototype[Symbol.dispose] = CloudTrailFeedVerdict.prototype.free;
+
+/**
+ * The kind-tagged verdict of [`verify_commitment_wasm`]. `verdict` is one of
+ * `"Valid"`, `"InvalidSignature"`, `"FingerprintMismatch"`, `"WrongAlgorithm"`,
+ * `"Malformed"`; a recipient accepts the commitment ONLY on `"Valid"`.
+ * `signer_fpr` carries the recomputed `blake3(pubkey)` fingerprint (only
+ * meaningful on `"Valid"`).
+ */
+export class CommitmentVerdict {
+    static __wrap(ptr) {
+        const obj = Object.create(CommitmentVerdict.prototype);
+        obj.__wbg_ptr = ptr;
+        CommitmentVerdictFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        CommitmentVerdictFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_commitmentverdict_free(ptr, 0);
+    }
+    /**
+     * The recomputed `blake3(pubkey)` fingerprint (only set on `"Valid"`).
+     * @returns {string}
+     */
+    get signer_fpr() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_commitmentverdict_signer_fpr(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * The verdict tag.
+     * @returns {string}
+     */
+    get verdict() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_commitmentverdict_verdict(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * The recomputed `blake3(pubkey)` fingerprint (only set on `"Valid"`).
+     * @param {string} arg0
+     */
+    set signer_fpr(arg0) {
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_commitmentverdict_signer_fpr(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * The verdict tag.
+     * @param {string} arg0
+     */
+    set verdict(arg0) {
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_commitmentverdict_verdict(this.__wbg_ptr, ptr0, len0);
+    }
+}
+if (Symbol.dispose) CommitmentVerdict.prototype[Symbol.dispose] = CommitmentVerdict.prototype.free;
+
+/**
+ * The base verdict + the rendered signed metrics + the offline-recomputed cost.
+ *
+ * `verdict` / `trust_level` are exactly what [`verify_action_receipt_wasm`]
+ * returns. The metric fields are the SIGNED values (the closed `status` /
+ * `token_source` enums rendered to their wire snake_case strings). `cost_display`
+ * / `recomputed_cost_micros` are RECOMPUTED from the rate card the caller passed
+ * in — `priced == false` (and both `None`) when that card does not price the
+ * model; never a guessed figure. `card_id_matches` tells the reader whether the
+ * card handed in is the one the receipt actually named.
+ */
+export class MetricsVerdict {
+    static __wrap(ptr) {
+        const obj = Object.create(MetricsVerdict.prototype);
+        obj.__wbg_ptr = ptr;
+        MetricsVerdictFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        MetricsVerdictFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_metricsverdict_free(ptr, 0);
+    }
+    /**
+     * Request bytes sent, when the transport exposed it.
+     * @returns {number | undefined}
+     */
+    get bytes_in() {
+        const ret = wasm.__wbg_get_metricsverdict_bytes_in(this.__wbg_ptr);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * Response bytes received, when the transport exposed it.
+     * @returns {number | undefined}
+     */
+    get bytes_out() {
+        const ret = wasm.__wbg_get_metricsverdict_bytes_out(this.__wbg_ptr);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * Whether the passed-in card is the one the receipt named.
+     * @returns {boolean}
+     */
+    get card_id_matches() {
+        const ret = wasm.__wbg_get_metricsverdict_card_id_matches(this.__wbg_ptr);
+        return ret !== 0;
+    }
+    /**
+     * Recomputed cost as a 6-decimal display string; `None` when not priced.
+     * @returns {string | undefined}
+     */
+    get cost_display() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_metricsverdict_cost_display(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * Wall-clock duration in whole milliseconds.
+     * @returns {number | undefined}
+     */
+    get duration_ms() {
+        const ret = wasm.__wbg_get_metricsverdict_duration_ms(this.__wbg_ptr);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * Whether the receipt carried a signed `metrics` block.
+     * @returns {boolean}
+     */
+    get has_metrics() {
+        const ret = wasm.__wbg_get_metricsverdict_has_metrics(this.__wbg_ptr);
+        return ret !== 0;
+    }
+    /**
+     * The `provider/model` key derived from the signed `action.fields`.
+     * @returns {string | undefined}
+     */
+    get model_key() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_metricsverdict_model_key(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * `true` iff the model is priced by the passed-in card.
+     * @returns {boolean}
+     */
+    get priced() {
+        const ret = wasm.__wbg_get_metricsverdict_priced(this.__wbg_ptr);
+        return ret !== 0;
+    }
+    /**
+     * The rate-card id AS NAMED in the signed receipt.
+     * @returns {string | undefined}
+     */
+    get rate_card_id() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_metricsverdict_rate_card_id(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * Recomputed cost in micro-USD (`BigInt`); `None` when not priced.
+     * @returns {bigint | undefined}
+     */
+    get recomputed_cost_micros() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_metricsverdict_recomputed_cost_micros(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r2 = getDataViewMemory0().getBigInt64(retptr + 8 * 1, true);
+            return r0 === 0 ? undefined : BigInt.asUintN(64, r2);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * Transport-level retries before this outcome.
+     * @returns {number | undefined}
+     */
+    get retries() {
+        const ret = wasm.__wbg_get_metricsverdict_retries(this.__wbg_ptr);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * Transport status code, when one applied.
+     * @returns {number | undefined}
+     */
+    get status_code() {
+        const ret = wasm.__wbg_get_metricsverdict_status_code(this.__wbg_ptr);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * Execution-outcome class, wire snake_case (`"ok"`, `"server_error"`, …).
+     * @returns {string | undefined}
+     */
+    get status() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_metricsverdict_status(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * Token-count source, wire snake_case (`"provider_reported"`/`"estimated"`).
+     * @returns {string | undefined}
+     */
+    get token_source() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_metricsverdict_token_source(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export3(r0, r1 * 1, 1);
+            }
+            return v1;
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
+    /**
+     * Provider-reported (or estimated) input tokens.
+     * @returns {number | undefined}
+     */
+    get tokens_in() {
+        const ret = wasm.__wbg_get_metricsverdict_tokens_in(this.__wbg_ptr);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * Provider-reported (or estimated) output tokens.
+     * @returns {number | undefined}
+     */
+    get tokens_out() {
+        const ret = wasm.__wbg_get_metricsverdict_tokens_out(this.__wbg_ptr);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * The re-derived trust level (`"L0"`/`"L1"`); `""` unless `verdict == "Valid"`.
+     * @returns {string}
+     */
+    get trust_level() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_metricsverdict_trust_level(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * The base `ActionOutcome` verdict tag (`"Valid"`, `"HashMismatch"`, …).
+     * @returns {string}
+     */
+    get verdict() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_metricsverdict_verdict(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Request bytes sent, when the transport exposed it.
+     * @param {number | null} [arg0]
+     */
+    set bytes_in(arg0) {
+        wasm.__wbg_set_metricsverdict_bytes_in(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+    /**
+     * Response bytes received, when the transport exposed it.
+     * @param {number | null} [arg0]
+     */
+    set bytes_out(arg0) {
+        wasm.__wbg_set_metricsverdict_bytes_out(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+    /**
+     * Whether the passed-in card is the one the receipt named.
+     * @param {boolean} arg0
+     */
+    set card_id_matches(arg0) {
+        wasm.__wbg_set_metricsverdict_card_id_matches(this.__wbg_ptr, arg0);
+    }
+    /**
+     * Recomputed cost as a 6-decimal display string; `None` when not priced.
+     * @param {string | null} [arg0]
+     */
+    set cost_display(arg0) {
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_metricsverdict_cost_display(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * Wall-clock duration in whole milliseconds.
+     * @param {number | null} [arg0]
+     */
+    set duration_ms(arg0) {
+        wasm.__wbg_set_metricsverdict_duration_ms(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+    /**
+     * Whether the receipt carried a signed `metrics` block.
+     * @param {boolean} arg0
+     */
+    set has_metrics(arg0) {
+        wasm.__wbg_set_metricsverdict_has_metrics(this.__wbg_ptr, arg0);
+    }
+    /**
+     * The `provider/model` key derived from the signed `action.fields`.
+     * @param {string | null} [arg0]
+     */
+    set model_key(arg0) {
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_metricsverdict_model_key(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * `true` iff the model is priced by the passed-in card.
+     * @param {boolean} arg0
+     */
+    set priced(arg0) {
+        wasm.__wbg_set_metricsverdict_priced(this.__wbg_ptr, arg0);
+    }
+    /**
+     * The rate-card id AS NAMED in the signed receipt.
+     * @param {string | null} [arg0]
+     */
+    set rate_card_id(arg0) {
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_metricsverdict_rate_card_id(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * Recomputed cost in micro-USD (`BigInt`); `None` when not priced.
+     * @param {bigint | null} [arg0]
+     */
+    set recomputed_cost_micros(arg0) {
+        wasm.__wbg_set_metricsverdict_recomputed_cost_micros(this.__wbg_ptr, !isLikeNone(arg0), isLikeNone(arg0) ? BigInt(0) : arg0);
+    }
+    /**
+     * Transport-level retries before this outcome.
+     * @param {number | null} [arg0]
+     */
+    set retries(arg0) {
+        wasm.__wbg_set_metricsverdict_retries(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+    /**
+     * Transport status code, when one applied.
+     * @param {number | null} [arg0]
+     */
+    set status_code(arg0) {
+        wasm.__wbg_set_metricsverdict_status_code(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+    /**
+     * Execution-outcome class, wire snake_case (`"ok"`, `"server_error"`, …).
+     * @param {string | null} [arg0]
+     */
+    set status(arg0) {
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_metricsverdict_status(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * Token-count source, wire snake_case (`"provider_reported"`/`"estimated"`).
+     * @param {string | null} [arg0]
+     */
+    set token_source(arg0) {
+        var ptr0 = isLikeNone(arg0) ? 0 : passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_metricsverdict_token_source(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * Provider-reported (or estimated) input tokens.
+     * @param {number | null} [arg0]
+     */
+    set tokens_in(arg0) {
+        wasm.__wbg_set_metricsverdict_tokens_in(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+    /**
+     * Provider-reported (or estimated) output tokens.
+     * @param {number | null} [arg0]
+     */
+    set tokens_out(arg0) {
+        wasm.__wbg_set_metricsverdict_tokens_out(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    }
+    /**
+     * The re-derived trust level (`"L0"`/`"L1"`); `""` unless `verdict == "Valid"`.
+     * @param {string} arg0
      */
-    set ok(arg0) {
-        wasm.__wbg_set_chainresult_ok(this.__wbg_ptr, arg0);
+    set trust_level(arg0) {
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_metricsverdict_trust_level(this.__wbg_ptr, ptr0, len0);
     }
     /**
-     * The `seq` at which the error occurred. Only set when `ok == false`.
-     * @param {number | null} [arg0]
+     * The base `ActionOutcome` verdict tag (`"Valid"`, `"HashMismatch"`, …).
+     * @param {string} arg0
      */
-    set seq(arg0) {
-        wasm.__wbg_set_chainresult_seq(this.__wbg_ptr, isLikeNone(arg0) ? Number.MAX_SAFE_INTEGER : (arg0) >>> 0);
+    set verdict(arg0) {
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_metricsverdict_verdict(this.__wbg_ptr, ptr0, len0);
     }
 }
-if (Symbol.dispose) ChainResult.prototype[Symbol.dispose] = ChainResult.prototype.free;
+if (Symbol.dispose) MetricsVerdict.prototype[Symbol.dispose] = MetricsVerdict.prototype.free;
 
 /**
  * The verified, decoded result of a delegation envelope.
@@ -343,7 +1095,7 @@ export class VerifiedDelegation {
      */
     get authorized_key() {
         const ret = wasm.__wbg_get_verifieddelegation_authorized_key(this.__wbg_ptr);
-        return ret;
+        return takeObject(ret);
     }
     /**
      * The envelope's expiry as Unix seconds (`BigInt`).
@@ -351,7 +1103,7 @@ export class VerifiedDelegation {
      */
     get expiry_unix_secs() {
         const ret = wasm.__wbg_get_verifieddelegation_expiry_unix_secs(this.__wbg_ptr);
-        return ret;
+        return takeObject(ret);
     }
     /**
      * The envelope's not_before as Unix seconds (`BigInt`).
@@ -359,7 +1111,7 @@ export class VerifiedDelegation {
      */
     get not_before_unix_secs() {
         const ret = wasm.__wbg_get_verifieddelegation_not_before_unix_secs(this.__wbg_ptr);
-        return ret;
+        return takeObject(ret);
     }
     /**
      * The scope the delegated authority was bound to.
@@ -369,12 +1121,16 @@ export class VerifiedDelegation {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.__wbg_get_verifieddelegation_scope(this.__wbg_ptr);
-            deferred1_0 = ret[0];
-            deferred1_1 = ret[1];
-            return getStringFromWasm0(ret[0], ret[1]);
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_verifieddelegation_scope(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
         } finally {
-            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
         }
     }
     /**
@@ -385,12 +1141,16 @@ export class VerifiedDelegation {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.__wbg_get_verifieddelegation_sub(this.__wbg_ptr);
-            deferred1_0 = ret[0];
-            deferred1_1 = ret[1];
-            return getStringFromWasm0(ret[0], ret[1]);
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.__wbg_get_verifieddelegation_sub(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            deferred1_0 = r0;
+            deferred1_1 = r1;
+            return getStringFromWasm0(r0, r1);
         } finally {
-            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export3(deferred1_0, deferred1_1, 1);
         }
     }
     /**
@@ -398,28 +1158,28 @@ export class VerifiedDelegation {
      * @param {Uint8Array} arg0
      */
     set authorized_key(arg0) {
-        wasm.__wbg_set_verifieddelegation_authorized_key(this.__wbg_ptr, arg0);
+        wasm.__wbg_set_verifieddelegation_authorized_key(this.__wbg_ptr, addHeapObject(arg0));
     }
     /**
      * The envelope's expiry as Unix seconds (`BigInt`).
      * @param {bigint} arg0
      */
     set expiry_unix_secs(arg0) {
-        wasm.__wbg_set_verifieddelegation_expiry_unix_secs(this.__wbg_ptr, arg0);
+        wasm.__wbg_set_verifieddelegation_expiry_unix_secs(this.__wbg_ptr, addHeapObject(arg0));
     }
     /**
      * The envelope's not_before as Unix seconds (`BigInt`).
      * @param {bigint} arg0
      */
     set not_before_unix_secs(arg0) {
-        wasm.__wbg_set_verifieddelegation_not_before_unix_secs(this.__wbg_ptr, arg0);
+        wasm.__wbg_set_verifieddelegation_not_before_unix_secs(this.__wbg_ptr, addHeapObject(arg0));
     }
     /**
      * The scope the delegated authority was bound to.
      * @param {string} arg0
      */
     set scope(arg0) {
-        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_verifieddelegation_scope(this.__wbg_ptr, ptr0, len0);
     }
@@ -428,7 +1188,7 @@ export class VerifiedDelegation {
      * @param {string} arg0
      */
     set sub(arg0) {
-        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const ptr0 = passStringToWasm0(arg0, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_verifieddelegation_sub(this.__wbg_ptr, ptr0, len0);
     }
@@ -443,13 +1203,21 @@ if (Symbol.dispose) VerifiedDelegation.prototype[Symbol.dispose] = VerifiedDeleg
  * @returns {Uint8Array}
  */
 export function actionCanonicalBytes(content_json) {
-    const ptr0 = passStringToWasm0(content_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.actionCanonicalBytes(ptr0, len0);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(content_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.actionCanonicalBytes(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return takeFromExternrefTable0(ret[0]);
 }
 
 /**
@@ -462,20 +1230,126 @@ export function anchoredContentHash(content_json) {
     let deferred3_0;
     let deferred3_1;
     try {
-        const ptr0 = passStringToWasm0(content_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(content_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.anchoredContentHash(ptr0, len0);
-        var ptr2 = ret[0];
-        var len2 = ret[1];
-        if (ret[3]) {
+        wasm.anchoredContentHash(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr2 = r0;
+        var len2 = r1;
+        if (r3) {
             ptr2 = 0; len2 = 0;
-            throw takeFromExternrefTable0(ret[2]);
+            throw takeObject(r2);
         }
         deferred3_0 = ptr2;
         deferred3_1 = len2;
         return getStringFromWasm0(ptr2, len2);
     } finally {
-        wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred3_0, deferred3_1, 1);
+    }
+}
+
+/**
+ * Assemble the on-the-wire approval-token frame from the detached signature the
+ * in-browser approver key produced over [`approval_token_payload_wasm`]. Pure
+ * assemble, no key. The base64 of these bytes is the bearer `token_b64`.
+ *
+ * Byte order (see [`heso_action::domain::approval_token_frame`], the ONE source —
+ * the kernel verifier parses EXACTLY this and rejects trailing bytes):
+ * `nonce(32) ++ expiry(BE8) ++ decision_tag(1) ++ scope_len(BE4) ++ scope
+ *   ++ signature(64) ++ pubkey(32)`
+ *
+ * `nonce`          — 32 raw bytes (Uint8Array); MUST equal the nonce signed over.
+ * `expiryUnixSecs` — token expiry as BigInt Unix seconds.
+ * `decision`       — `"approved"` or `"rejected"`.
+ * `scope`          — the UTF-8 scope string.
+ * `signature`      — 64 raw Ed25519 signature bytes (Uint8Array).
+ * `pubkey`         — 32 raw Ed25519 public-key bytes (Uint8Array).
+ * @param {Uint8Array} nonce
+ * @param {bigint} expiry_unix_secs
+ * @param {string} decision
+ * @param {string} scope
+ * @param {Uint8Array} signature
+ * @param {Uint8Array} pubkey
+ * @returns {Uint8Array}
+ */
+export function approvalTokenFrame(nonce, expiry_unix_secs, decision, scope, signature, pubkey) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(nonce, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(decision, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(scope, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passArray8ToWasm0(signature, wasm.__wbindgen_export);
+        const len3 = WASM_VECTOR_LEN;
+        const ptr4 = passArray8ToWasm0(pubkey, wasm.__wbindgen_export);
+        const len4 = WASM_VECTOR_LEN;
+        wasm.approvalTokenFrame(retptr, ptr0, len0, addHeapObject(expiry_unix_secs), ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Return the EXACT bytes the approver's Ed25519 key must sign for an approval
+ * token (the Option-C in-browser minter signs THESE, never any hand-rolled
+ * bytes). Mirrors [`l1_cosign_payload_wasm`]: pure assemble, no OsRng, no key —
+ * the browser holds the key, this only produces the payload a detached signer
+ * covers.
+ *
+ * Byte order (see [`heso_action::domain::approval_token_signed_payload`], the ONE
+ * source — the kernel verifier recomputes the identical bytes):
+ * `APPROVAL_TOKEN_SIGNING_DOMAIN ++ nonce(32) ++ expiry(BE8) ++ decision_tag(1)
+ *   ++ scope_len(BE4) ++ scope ++ action_canonical_bytes`
+ *
+ * `contentJson`       — the `ActionContent` JSON; canonicalized through the SAME
+ *                       RFC-8785 path as [`action_canonical_bytes_wasm`] (the
+ *                       browser MUST NOT hand-roll JCS).
+ * `nonce`             — 32 raw replay-prevention bytes (Uint8Array).
+ * `expiryUnixSecs`    — token expiry as BigInt Unix seconds.
+ * `decision`          — `"approved"` or `"rejected"` (the SEC-02 decision binding).
+ * `scope`             — the UTF-8 scope string.
+ * @param {string} content_json
+ * @param {Uint8Array} nonce
+ * @param {bigint} expiry_unix_secs
+ * @param {string} decision
+ * @param {string} scope
+ * @returns {Uint8Array}
+ */
+export function approvalTokenPayload(content_json, nonce, expiry_unix_secs, decision, scope) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(content_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(nonce, wasm.__wbindgen_export);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(decision, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(scope, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        wasm.approvalTokenPayload(retptr, ptr0, len0, ptr1, len1, addHeapObject(expiry_unix_secs), ptr2, len2, ptr3, len3);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
 }
 
@@ -490,22 +1364,91 @@ export function chainHashHex(prev_hex, action_hex) {
     let deferred4_0;
     let deferred4_1;
     try {
-        const ptr0 = passStringToWasm0(prev_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(prev_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(action_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const ptr1 = passStringToWasm0(action_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ret = wasm.chainHashHex(ptr0, len0, ptr1, len1);
-        var ptr3 = ret[0];
-        var len3 = ret[1];
-        if (ret[3]) {
+        wasm.chainHashHex(retptr, ptr0, len0, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr3 = r0;
+        var len3 = r1;
+        if (r3) {
             ptr3 = 0; len3 = 0;
-            throw takeFromExternrefTable0(ret[2]);
+            throw takeObject(r2);
         }
         deferred4_0 = ptr3;
         deferred4_1 = len3;
         return getStringFromWasm0(ptr3, len3);
     } finally {
-        wasm.__wbindgen_free(deferred4_0, deferred4_1, 1);
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred4_0, deferred4_1, 1);
+    }
+}
+
+/**
+ * PURE. Return the RFC-8785 (JCS) canonical bytes of a commitment envelope JSON
+ * string — the exact bytes the detached operator signature is computed over
+ * (after the `COMMITMENT_SIGNING_DOMAIN` prefix). Delegates to the single kernel
+ * JCS impl; never re-canonicalizes. Throws `[MALFORMED]` if the JSON does not
+ * parse as a `CommitmentEnvelope` and `[CANON]` if it cannot be canonicalized.
+ * @param {string} envelope_json
+ * @returns {Uint8Array}
+ */
+export function commitmentEnvelopeCanonicalBytes(envelope_json) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(envelope_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.commitmentEnvelopeCanonicalBytes(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * The **commitment fingerprint** of an Ed25519 public key: `blake3(raw_pubkey)`,
+ * the full 32-byte digest, lowercase 64-hex, NO prefix — the value the producer
+ * puts in the wire `signer_fpr`. DISTINCT from the `heso:`-prefixed Grade-0
+ * signer fingerprint. Throws `[MALFORMED]` if `pubkey_b64` is not base64 of
+ * exactly 32 bytes.
+ * @param {string} pubkey_b64
+ * @returns {string}
+ */
+export function commitmentFingerprint(pubkey_b64) {
+    let deferred3_0;
+    let deferred3_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(pubkey_b64, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.commitmentFingerprint(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr2 = r0;
+        var len2 = r1;
+        if (r3) {
+            ptr2 = 0; len2 = 0;
+            throw takeObject(r2);
+        }
+        deferred3_0 = ptr2;
+        deferred3_1 = len2;
+        return getStringFromWasm0(ptr2, len2);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred3_0, deferred3_1, 1);
     }
 }
 
@@ -519,20 +1462,26 @@ export function contentHash(content_json) {
     let deferred3_0;
     let deferred3_1;
     try {
-        const ptr0 = passStringToWasm0(content_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(content_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.contentHash(ptr0, len0);
-        var ptr2 = ret[0];
-        var len2 = ret[1];
-        if (ret[3]) {
+        wasm.contentHash(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr2 = r0;
+        var len2 = r1;
+        if (r3) {
             ptr2 = 0; len2 = 0;
-            throw takeFromExternrefTable0(ret[2]);
+            throw takeObject(r2);
         }
         deferred3_0 = ptr2;
         deferred3_1 = len2;
         return getStringFromWasm0(ptr2, len2);
     } finally {
-        wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred3_0, deferred3_1, 1);
     }
 }
 
@@ -575,15 +1524,23 @@ export function contentHash(content_json) {
  * @returns {Uint8Array}
  */
 export function l1CosignPayload(suspended_content_json, approver_record_json) {
-    const ptr0 = passStringToWasm0(suspended_content_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(approver_record_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len1 = WASM_VECTOR_LEN;
-    const ret = wasm.l1CosignPayload(ptr0, len0, ptr1, len1);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(suspended_content_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(approver_record_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.l1CosignPayload(retptr, ptr0, len0, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return takeFromExternrefTable0(ret[0]);
 }
 
 /**
@@ -594,11 +1551,52 @@ export function l1CosignPayload(suspended_content_json, approver_record_json) {
  * @param {string} toml_src
  */
 export function parsePolicy(toml_src) {
-    const ptr0 = passStringToWasm0(toml_src, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.parsePolicy(ptr0, len0);
-    if (ret[1]) {
-        throw takeFromExternrefTable0(ret[0]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(toml_src, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.parsePolicy(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        if (r1) {
+            throw takeObject(r0);
+        }
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Parse a C2SP signed-note checkpoint and return its `{origin, size, root_hex,
+ * text}` as a JSON string. Does NO signature verification — call
+ * `verifyNoteAgainstKey` for that. Throws `[NOTE]` on a malformed note.
+ * @param {string} note
+ * @returns {string}
+ */
+export function parseSignedNote(note) {
+    let deferred3_0;
+    let deferred3_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(note, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.parseSignedNote(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr2 = r0;
+        var len2 = r1;
+        if (r3) {
+            ptr2 = 0; len2 = 0;
+            throw takeObject(r2);
+        }
+        deferred3_0 = ptr2;
+        deferred3_1 = len2;
+        return getStringFromWasm0(ptr2, len2);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred3_0, deferred3_1, 1);
     }
 }
 
@@ -615,20 +1613,26 @@ export function policyRulesFromToml(toml_src) {
     let deferred3_0;
     let deferred3_1;
     try {
-        const ptr0 = passStringToWasm0(toml_src, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(toml_src, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.policyRulesFromToml(ptr0, len0);
-        var ptr2 = ret[0];
-        var len2 = ret[1];
-        if (ret[3]) {
+        wasm.policyRulesFromToml(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr2 = r0;
+        var len2 = r1;
+        if (r3) {
             ptr2 = 0; len2 = 0;
-            throw takeFromExternrefTable0(ret[2]);
+            throw takeObject(r2);
         }
         deferred3_0 = ptr2;
         deferred3_1 = len2;
         return getStringFromWasm0(ptr2, len2);
     } finally {
-        wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred3_0, deferred3_1, 1);
     }
 }
 
@@ -665,17 +1669,25 @@ export function policyRulesFromToml(toml_src) {
  * @returns {Uint8Array}
  */
 export function quorumCosignPayload(suspended_content_json, threshold, roster_json, approver_record_json) {
-    const ptr0 = passStringToWasm0(suspended_content_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(roster_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len1 = WASM_VECTOR_LEN;
-    const ptr2 = passStringToWasm0(approver_record_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len2 = WASM_VECTOR_LEN;
-    const ret = wasm.quorumCosignPayload(ptr0, len0, threshold, ptr1, len1, ptr2, len2);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(suspended_content_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(roster_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(approver_record_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.quorumCosignPayload(retptr, ptr0, len0, threshold, ptr1, len1, ptr2, len2);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return takeFromExternrefTable0(ret[0]);
 }
 
 /**
@@ -689,20 +1701,26 @@ export function ruleToSentence(rule_json) {
     let deferred3_0;
     let deferred3_1;
     try {
-        const ptr0 = passStringToWasm0(rule_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(rule_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.ruleToSentence(ptr0, len0);
-        var ptr2 = ret[0];
-        var len2 = ret[1];
-        if (ret[3]) {
+        wasm.ruleToSentence(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr2 = r0;
+        var len2 = r1;
+        if (r3) {
             ptr2 = 0; len2 = 0;
-            throw takeFromExternrefTable0(ret[2]);
+            throw takeObject(r2);
         }
         deferred3_0 = ptr2;
         deferred3_1 = len2;
         return getStringFromWasm0(ptr2, len2);
     } finally {
-        wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred3_0, deferred3_1, 1);
     }
 }
 
@@ -717,22 +1735,67 @@ export function shortHash(hex, prefix) {
     let deferred4_0;
     let deferred4_1;
     try {
-        const ptr0 = passStringToWasm0(hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        var ptr1 = isLikeNone(prefix) ? 0 : passStringToWasm0(prefix, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var ptr1 = isLikeNone(prefix) ? 0 : passStringToWasm0(prefix, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         var len1 = WASM_VECTOR_LEN;
-        const ret = wasm.shortHash(ptr0, len0, ptr1, len1);
-        var ptr3 = ret[0];
-        var len3 = ret[1];
-        if (ret[3]) {
+        wasm.shortHash(retptr, ptr0, len0, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr3 = r0;
+        var len3 = r1;
+        if (r3) {
+            ptr3 = 0; len3 = 0;
+            throw takeObject(r2);
+        }
+        deferred4_0 = ptr3;
+        deferred4_1 = len3;
+        return getStringFromWasm0(ptr3, len3);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred4_0, deferred4_1, 1);
+    }
+}
+
+/**
+ * The frozen top-tree leaf VALUE committing one org's epoch snapshot:
+ * `SHA-256(TOP_LEAF_DOMAIN || org_id(16) || epoch(BE8) || org_root(32))`,
+ * 64-hex. The stage-2 commitment a two-stage inclusion proof rides. Throws
+ * `[ORG]`/`[ROOT]` on malformed inputs.
+ * @param {string} org_id_hyphenated
+ * @param {bigint} epoch
+ * @param {string} org_root_hex
+ * @returns {string}
+ */
+export function topLeafValue(org_id_hyphenated, epoch, org_root_hex) {
+    let deferred4_0;
+    let deferred4_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(org_id_hyphenated, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(org_root_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.topLeafValue(retptr, ptr0, len0, epoch, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr3 = r0;
+        var len3 = r1;
+        if (r3) {
             ptr3 = 0; len3 = 0;
-            throw takeFromExternrefTable0(ret[2]);
+            throw takeObject(r2);
         }
         deferred4_0 = ptr3;
         deferred4_1 = len3;
         return getStringFromWasm0(ptr3, len3);
     } finally {
-        wasm.__wbindgen_free(deferred4_0, deferred4_1, 1);
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export3(deferred4_0, deferred4_1, 1);
     }
 }
 
@@ -745,11 +1808,18 @@ export function shortHash(hex, prefix) {
  * @param {string} rules_json
  */
 export function validateNoFloorBypass(rules_json) {
-    const ptr0 = passStringToWasm0(rules_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.validateNoFloorBypass(ptr0, len0);
-    if (ret[1]) {
-        throw takeFromExternrefTable0(ret[0]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(rules_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.validateNoFloorBypass(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        if (r1) {
+            throw takeObject(r0);
+        }
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
 }
 
@@ -768,12 +1838,41 @@ export function validateNoFloorBypass(rules_json) {
  * @returns {ActionVerdict}
  */
 export function verifyActionReceipt(receipt_bytes) {
-    const ptr0 = passArray8ToWasm0(receipt_bytes, wasm.__wbindgen_malloc);
+    const ptr0 = passArray8ToWasm0(receipt_bytes, wasm.__wbindgen_export);
     const len0 = WASM_VECTOR_LEN;
     const ret = wasm.verifyActionReceipt(ptr0, len0);
     return ActionVerdict.__wrap(ret);
 }
 
+/**
+ * Verify a single `ActionReceipt` AND render its signed metrics + recompute cost
+ * from the passed-in public rate card.
+ *
+ * Runs the EXISTING [`verify_action_receipt`] for the base outcome + trust level
+ * (so that path is byte-for-byte unchanged), then — when the receipt parses —
+ * renders the signed metrics and recomputes the cost via the pure
+ * `heso_action::metrics_view::metrics_view`. Never panics:
+ *
+ * - receipt fails to PARSE  ⇒ base verdict + `has_metrics: false` (no metrics).
+ * - rate card fails to PARSE ⇒ base verdict + rendered metrics, but `priced:
+ *   false` and `cost_display: None` (cost cannot be recomputed without a card).
+ * - everything parses        ⇒ full metrics + recomputed cost.
+ *
+ * `receipt_bytes`   — the raw `ActionReceipt` JSON bytes (`Uint8Array`).
+ * `rate_card_json`  — the public rate-card JSON the cost is recomputed from.
+ * @param {Uint8Array} receipt_bytes
+ * @param {string} rate_card_json
+ * @returns {MetricsVerdict}
+ */
+export function verifyActionReceiptWithRates(receipt_bytes, rate_card_json) {
+    const ptr0 = passArray8ToWasm0(receipt_bytes, wasm.__wbindgen_export);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(rate_card_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len1 = WASM_VECTOR_LEN;
+    const ret = wasm.verifyActionReceiptWithRates(ptr0, len0, ptr1, len1);
+    return MetricsVerdict.__wrap(ret);
+}
+
 /**
  * Verify a serialized approval token and return its decoded claims.
  *
@@ -799,19 +1898,27 @@ export function verifyActionReceipt(receipt_bytes) {
  * @returns {ApprovalTokenClaims}
  */
 export function verifyApprovalToken(token, action_canonical, now_unix_secs, seen_nonces, required_scope, required_decision, registered_keys_b64) {
-    const ptr0 = passArray8ToWasm0(token, wasm.__wbindgen_malloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passArray8ToWasm0(action_canonical, wasm.__wbindgen_malloc);
-    const len1 = WASM_VECTOR_LEN;
-    const ptr2 = passStringToWasm0(required_scope, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len2 = WASM_VECTOR_LEN;
-    const ptr3 = passStringToWasm0(required_decision, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len3 = WASM_VECTOR_LEN;
-    const ret = wasm.verifyApprovalToken(ptr0, len0, ptr1, len1, now_unix_secs, seen_nonces, ptr2, len2, ptr3, len3, registered_keys_b64);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(token, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(action_canonical, wasm.__wbindgen_export);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(required_scope, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(required_decision, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        wasm.verifyApprovalToken(retptr, ptr0, len0, ptr1, len1, addHeapObject(now_unix_secs), addHeapObject(seen_nonces), ptr2, len2, ptr3, len3, addHeapObject(registered_keys_b64));
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return ApprovalTokenClaims.__wrap(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return ApprovalTokenClaims.__wrap(ret[0]);
 }
 
 /**
@@ -822,13 +1929,91 @@ export function verifyApprovalToken(token, action_canonical, now_unix_secs, seen
  * @returns {ChainResult}
  */
 export function verifyChain(receipts_bytes) {
-    const ptr0 = passArray8ToWasm0(receipts_bytes, wasm.__wbindgen_malloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.verifyChain(ptr0, len0);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(receipts_bytes, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.verifyChain(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return ChainResult.__wrap(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * **REJECT-MORE-ONLY.** Verify an AWS CloudTrail signed digest-file chain
+ * **offline**, proving feed completeness from the frozen bundle bytes + the
+ * PINNED AWS public keys alone — no network, no AWS call, no HESO endpoint.
+ *
+ * `proof_json` is a [`heso_action::cloudtrail::CloudTrailFeedProof`] JSON: the
+ * digest chain (HEAD FIRST), the head's out-of-band `x-amz-meta-signature`, and
+ * the pinned per-Region AWS public keys (PKCS#1 DER, base64 — exactly as
+ * `ListPublicKeys` returns them; this verifier wraps them into SPKI internally,
+ * the #1 implementation trap handled once in the kernel).
+ *
+ * The AWS key is trusted **out of band** (CT pin-the-key model): a digest whose
+ * `digestPublicKeyFingerprint` matches no pinned key FAILS with
+ * `kind = "NoMatchingKey"`. The verdict separates `feed_complete` (window
+ * completeness, claimable to a third party for this STRONG rail) from a
+ * disclosed `ChainGap` — never collapsing a gap into a green badge.
+ *
+ * Throws `[CT_PARSE]` only if `proof_json` is not a valid `CloudTrailFeedProof`;
+ * every cryptographic / chain failure is a non-throwing kind tag instead.
+ * @param {string} proof_json
+ * @returns {CloudTrailFeedVerdict}
+ */
+export function verifyCloudTrailFeed(proof_json) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(proof_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.verifyCloudTrailFeed(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return CloudTrailFeedVerdict.__wrap(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return ChainResult.__wrap(ret[0]);
+}
+
+/**
+ * REJECT-MORE-ONLY. Verify a detached commitment-envelope signature in the
+ * browser — the recipient independently confirms a commitment the same way the
+ * cloud does.
+ *
+ * Parses `envelope_bytes` as a `CommitmentEnvelope`, re-canonicalizes VIA THE
+ * KERNEL, `verify_strict`-checks the detached Ed25519 signature under
+ * `COMMITMENT_SIGNING_DOMAIN`, and confirms the recomputed commitment
+ * fingerprint (`blake3(pubkey)`) equals `claimed_signer_fpr`. Produces ZERO new
+ * canonical/signed bytes. Never throws — every outcome is a kind-tagged
+ * [`CommitmentVerdict`].
+ * @param {Uint8Array} envelope_bytes
+ * @param {string} operator_pubkey_b64
+ * @param {string} detached_sig_b64
+ * @param {string} claimed_signer_fpr
+ * @returns {CommitmentVerdict}
+ */
+export function verifyCommitment(envelope_bytes, operator_pubkey_b64, detached_sig_b64, claimed_signer_fpr) {
+    const ptr0 = passArray8ToWasm0(envelope_bytes, wasm.__wbindgen_export);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(operator_pubkey_b64, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len1 = WASM_VECTOR_LEN;
+    const ptr2 = passStringToWasm0(detached_sig_b64, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len2 = WASM_VECTOR_LEN;
+    const ptr3 = passStringToWasm0(claimed_signer_fpr, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len3 = WASM_VECTOR_LEN;
+    const ret = wasm.verifyCommitment(ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3);
+    return CommitmentVerdict.__wrap(ret);
 }
 
 /**
@@ -843,17 +2028,25 @@ export function verifyChain(receipts_bytes) {
  * @returns {boolean}
  */
 export function verifyConsistency(old_size, old_root_hex, new_size, new_root_hex, proof_hashes_json) {
-    const ptr0 = passStringToWasm0(old_root_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(new_root_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len1 = WASM_VECTOR_LEN;
-    const ptr2 = passStringToWasm0(proof_hashes_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len2 = WASM_VECTOR_LEN;
-    const ret = wasm.verifyConsistency(old_size, ptr0, len0, new_size, ptr1, len1, ptr2, len2);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(old_root_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(new_root_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(proof_hashes_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.verifyConsistency(retptr, old_size, ptr0, len0, new_size, ptr1, len1, ptr2, len2);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return r0 !== 0;
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return ret[0] !== 0;
 }
 
 /**
@@ -881,23 +2074,31 @@ export function verifyConsistency(old_size, old_root_hex, new_size, new_root_hex
  * @returns {VerifiedDelegation}
  */
 export function verifyDelegation(wire, registered_operator_key, action_hash, approval_token, required_scope, required_decision, now_unix_secs) {
-    const ptr0 = passArray8ToWasm0(wire, wasm.__wbindgen_malloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passArray8ToWasm0(registered_operator_key, wasm.__wbindgen_malloc);
-    const len1 = WASM_VECTOR_LEN;
-    const ptr2 = passArray8ToWasm0(action_hash, wasm.__wbindgen_malloc);
-    const len2 = WASM_VECTOR_LEN;
-    const ptr3 = passArray8ToWasm0(approval_token, wasm.__wbindgen_malloc);
-    const len3 = WASM_VECTOR_LEN;
-    const ptr4 = passStringToWasm0(required_scope, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len4 = WASM_VECTOR_LEN;
-    const ptr5 = passStringToWasm0(required_decision, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len5 = WASM_VECTOR_LEN;
-    const ret = wasm.verifyDelegation(ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, now_unix_secs);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return VerifiedDelegation.__wrap(ret[0]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(wire, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(registered_operator_key, wasm.__wbindgen_export);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passArray8ToWasm0(action_hash, wasm.__wbindgen_export);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passArray8ToWasm0(approval_token, wasm.__wbindgen_export);
+        const len3 = WASM_VECTOR_LEN;
+        const ptr4 = passStringToWasm0(required_scope, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len4 = WASM_VECTOR_LEN;
+        const ptr5 = passStringToWasm0(required_decision, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len5 = WASM_VECTOR_LEN;
+        wasm.verifyDelegation(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, addHeapObject(now_unix_secs));
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return VerifiedDelegation.__wrap(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
 }
 
 /**
@@ -917,17 +2118,92 @@ export function verifyDelegation(wire, registered_operator_key, action_hash, app
  * @returns {boolean}
  */
 export function verifyInclusion(leaf_value_hex, index, size, root_hex, proof_hashes_json) {
-    const ptr0 = passStringToWasm0(leaf_value_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(root_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len1 = WASM_VECTOR_LEN;
-    const ptr2 = passStringToWasm0(proof_hashes_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len2 = WASM_VECTOR_LEN;
-    const ret = wasm.verifyInclusion(ptr0, len0, index, size, ptr1, len1, ptr2, len2);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(leaf_value_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(root_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(proof_hashes_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.verifyInclusion(retptr, ptr0, len0, index, size, ptr1, len1, ptr2, len2);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return r0 !== 0;
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Verify a parsed C2SP signed-note checkpoint against a PINNED Ed25519 log
+ * public key (base64, raw 32 bytes). Returns `true` iff at least one signature
+ * line is from the pinned key AND `verify_strict`s over the note text.
+ *
+ * The pinned key is supplied by the caller (trusted out of band, CT-style) — a
+ * note signed by any non-pinned key returns `false`. Throws `[NOTE]` if the
+ * note is malformed or `[KEY]` if the pubkey is not base64 of 32 bytes.
+ * @param {string} note
+ * @param {string} log_pubkey_b64
+ * @returns {boolean}
+ */
+export function verifyNoteAgainstKey(note, log_pubkey_b64) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(note, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(log_pubkey_b64, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.verifyNoteAgainstKey(retptr, ptr0, len0, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return r0 !== 0;
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Verify a single commit-and-reveal field reveal against its signed redaction
+ * marker — recompute `BLAKE3(salt ++ field_path ++ value)` and check equality
+ * with `marker.commitment`. The browser/offline counterpart to the Node
+ * `verifyRevealJs`: the missing half that lets a web auditor reveal-and-prove a
+ * redacted field with only the receipt + the customer-supplied sidecar.
+ *
+ * `reveal_json` — a `FieldReveal`: `{ field_path, salt_hex, value_json }`.
+ * `marker_json` — the matching `RedactionMarker` from the signed receipt.
+ *
+ * Returns `true` iff the reveal recomputes the marker's commitment.
+ * @param {string} reveal_json
+ * @param {string} marker_json
+ * @returns {boolean}
+ */
+export function verifyReveal(reveal_json, marker_json) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(reveal_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(marker_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.verifyReveal(retptr, ptr0, len0, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return r0 !== 0;
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return ret[0] !== 0;
 }
 
 /**
@@ -936,13 +2212,21 @@ export function verifyInclusion(leaf_value_hex, index, size, root_hex, proof_has
  * @returns {ChainResult}
  */
 export function verifySessionChain(receipts_bytes) {
-    const ptr0 = passArray8ToWasm0(receipts_bytes, wasm.__wbindgen_malloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.verifySessionChain(ptr0, len0);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(receipts_bytes, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.verifySessionChain(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return ChainResult.__wrap(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return ChainResult.__wrap(ret[0]);
 }
 
 /**
@@ -956,39 +2240,47 @@ export function verifySessionChain(receipts_bytes) {
  * @returns {ChainResult}
  */
 export function verifySessionChainWithRotation(receipts_bytes, producer_key, decision_key) {
-    const ptr0 = passArray8ToWasm0(receipts_bytes, wasm.__wbindgen_malloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(producer_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len1 = WASM_VECTOR_LEN;
-    var ptr2 = isLikeNone(decision_key) ? 0 : passStringToWasm0(decision_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    var len2 = WASM_VECTOR_LEN;
-    const ret = wasm.verifySessionChainWithRotation(ptr0, len0, ptr1, len1, ptr2, len2);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(receipts_bytes, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(producer_key, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        var ptr2 = isLikeNone(decision_key) ? 0 : passStringToWasm0(decision_key, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len2 = WASM_VECTOR_LEN;
+        wasm.verifySessionChainWithRotation(retptr, ptr0, len0, ptr1, len1, ptr2, len2);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return ChainResult.__wrap(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
     }
-    return ChainResult.__wrap(ret[0]);
 }
 function __wbg_get_imports() {
     const import0 = {
         __proto__: null,
         __wbg_Error_ef53bc310eb298a0: function(arg0, arg1) {
             const ret = Error(getStringFromWasm0(arg0, arg1));
-            return ret;
+            return addHeapObject(ret);
         },
         __wbg___wbindgen_bigint_get_as_i64_38130e98eecd467d: function(arg0, arg1) {
-            const v = arg1;
+            const v = getObject(arg1);
             const ret = typeof(v) === 'bigint' ? v : undefined;
             getDataViewMemory0().setBigInt64(arg0 + 8 * 1, isLikeNone(ret) ? BigInt(0) : ret, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
         },
         __wbg___wbindgen_jsval_eq_1068e624fa87f6ab: function(arg0, arg1) {
-            const ret = arg0 === arg1;
+            const ret = getObject(arg0) === getObject(arg1);
             return ret;
         },
         __wbg___wbindgen_string_get_72bdf95d3ae505b1: function(arg0, arg1) {
-            const obj = arg1;
+            const obj = getObject(arg1);
             const ret = typeof(obj) === 'string' ? obj : undefined;
-            var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
             var len1 = WASM_VECTOR_LEN;
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
@@ -997,44 +2289,42 @@ function __wbg_get_imports() {
             throw new Error(getStringFromWasm0(arg0, arg1));
         },
         __wbg_get_unchecked_33f6e5c9e2f2d6b2: function(arg0, arg1) {
-            const ret = arg0[arg1 >>> 0];
-            return ret;
+            const ret = getObject(arg0)[arg1 >>> 0];
+            return addHeapObject(ret);
         },
         __wbg_length_4a591ecaa01354d9: function(arg0) {
-            const ret = arg0.length;
+            const ret = getObject(arg0).length;
             return ret;
         },
         __wbg_length_66f1a4b2e9026940: function(arg0) {
-            const ret = arg0.length;
+            const ret = getObject(arg0).length;
             return ret;
         },
         __wbg_new_from_slice_18fa1f71286d66b8: function(arg0, arg1) {
             const ret = new Uint8Array(getArrayU8FromWasm0(arg0, arg1));
-            return ret;
+            return addHeapObject(ret);
         },
         __wbg_new_with_length_36a4998e27b014c5: function(arg0) {
             const ret = new Uint8Array(arg0 >>> 0);
-            return ret;
+            return addHeapObject(ret);
         },
         __wbg_prototypesetcall_3249fc62a0fafa30: function(arg0, arg1, arg2) {
-            Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), arg2);
+            Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), getObject(arg2));
         },
         __wbg_set_29c99a8aac1c01e5: function(arg0, arg1, arg2) {
-            arg0.set(getArrayU8FromWasm0(arg1, arg2));
+            getObject(arg0).set(getArrayU8FromWasm0(arg1, arg2));
         },
         __wbindgen_cast_0000000000000001: function(arg0) {
             // Cast intrinsic for `U64 -> Externref`.
             const ret = BigInt.asUintN(64, arg0);
-            return ret;
+            return addHeapObject(ret);
         },
-        __wbindgen_init_externref_table: function() {
-            const table = wasm.__wbindgen_externrefs;
-            const offset = table.grow(4);
-            table.set(0, undefined);
-            table.set(offset + 0, undefined);
-            table.set(offset + 1, null);
-            table.set(offset + 2, true);
-            table.set(offset + 3, false);
+        __wbindgen_object_clone_ref: function(arg0) {
+            const ret = getObject(arg0);
+            return addHeapObject(ret);
+        },
+        __wbindgen_object_drop_ref: function(arg0) {
+            takeObject(arg0);
         },
     };
     return {
@@ -1052,10 +2342,34 @@ const ApprovalTokenClaimsFinalization = (typeof FinalizationRegistry === 'undefi
 const ChainResultFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_chainresult_free(ptr, 1));
+const CloudTrailFeedVerdictFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_cloudtrailfeedverdict_free(ptr, 1));
+const CommitmentVerdictFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_commitmentverdict_free(ptr, 1));
+const MetricsVerdictFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_metricsverdict_free(ptr, 1));
 const VerifiedDelegationFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_verifieddelegation_free(ptr, 1));
 
+function addHeapObject(obj) {
+    if (heap_next === heap.length) heap.push(heap.length + 1);
+    const idx = heap_next;
+    heap_next = heap[idx];
+
+    heap[idx] = obj;
+    return idx;
+}
+
+function dropObject(idx) {
+    if (idx < 1028) return;
+    heap[idx] = heap_next;
+    heap_next = idx;
+}
+
 function getArrayU8FromWasm0(ptr, len) {
     ptr = ptr >>> 0;
     return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
@@ -1081,6 +2395,13 @@ function getUint8ArrayMemory0() {
     return cachedUint8ArrayMemory0;
 }
 
+function getObject(idx) { return heap[idx]; }
+
+let heap = new Array(1024).fill(undefined);
+heap.push(undefined, null, true, false);
+
+let heap_next = heap.length;
+
 function isLikeNone(x) {
     return x === undefined || x === null;
 }
@@ -1129,10 +2450,10 @@ function passStringToWasm0(arg, malloc, realloc) {
     return ptr;
 }
 
-function takeFromExternrefTable0(idx) {
-    const value = wasm.__wbindgen_externrefs.get(idx);
-    wasm.__externref_table_dealloc(idx);
-    return value;
+function takeObject(idx) {
+    const ret = getObject(idx);
+    dropObject(idx);
+    return ret;
 }
 
 let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
@@ -1171,7 +2492,6 @@ function __wbg_finalize_init(instance, module) {
     wasmModule = module;
     cachedDataViewMemory0 = null;
     cachedUint8ArrayMemory0 = null;
-    wasm.__wbindgen_start();
     return wasm;
 }