@massalabs/gossip-sdk 0.1.1-dev.20260903185520 → 0.2.1-dev.20260903192154

package/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+## 0.2.0
+
+### Breaking changes
+
+- `Queries.userProfiles.updateById(userId, data)` now returns
+  `Promise<boolean>` instead of `Promise<void>`. It resolves to `true` when a
+  profile row matched the user ID and `false` when no row existed. Callers that
+  only await the operation can continue ignoring the result; typed wrappers and
+  test doubles must adopt the boolean return contract.
+- `GossipSdk.publicKeys` is a borrowed session-owned WASM wrapper. It is valid
+  only while that session is open, becomes invalid when `closeSession()` or
+  `destroy()` disposes the session, and must not be freed by callers. Code that
+  needs serialized key bytes after logout must copy them before closing.
+- Legacy biometric-only credentials and pre-password classic or secure-storage
+  account state are intentionally not migrated by this release. Users upgrading
+  from those formats must reset local app storage and create their accounts
+  again; legacy import is not supported.
+- Secure-storage onboarding now requires the atomic candidate lifecycle exposed
+  by `secureStorageBeginOnboardingCandidate()`,
+  `secureStorageCommitOnboardingCandidate()`, and
+  `secureStorageAbortOnboardingCandidate()`. Every created account must be
+  locked before one final commit or abort, and commit/abort reject with
+  `SESSION_OPEN` while an SDK session remains open. Fresh stores also require
+  versioned backend account-generation metadata.
+
+### Security and reliability
+
+- Account passwords are mandatory and biometric login stores one password-only
+  credential without account metadata.
+- Onboarding and portable import commit the same source-neutral generation
+  record with a fresh random epoch for idempotent encrypted-account migration.
+- Onboarding prepares all accounts and fresh cover slots in a bounded in-memory
+  candidate, then installs the complete three-slot generation atomically.
+  Process death before activation exposes no account; death after activation
+  preserves the whole batch.
+- Onboarding rollback and transient/session key disposal preserve cleanup and
+  ownership boundaries.
+- Secure-storage allocation, cover traffic, namespace writes, SQL transactions,
+  lock, flush, and close share durable recovery and FIFO ordering boundaries.
+- Public-key publication preserves confirmed POST times across local persistence
+  retries without redundant network publication.

package/README.md

@@ -121,6 +121,37 @@ await sdk.openSession({
 await sdk.closeSession();
 ```
 
+### Atomic secure-storage onboarding
+
+A fresh secure-storage backend accepts account creation only inside one atomic
+candidate. Begin once, create and durably lock every account, then commit the
+complete generation or abort it:
+
+```typescript
+await sdk.secureStorageBeginOnboardingCandidate();
+try {
+  for (const account of accounts) {
+    await sdk.secureStorageCreate(account.slot, account.password);
+    // Write this account's encrypted profile/session data here.
+    await sdk.secureStorageLock();
+  }
+  await sdk.secureStorageCommitOnboardingCandidate();
+} catch (error) {
+  if (sdk.isSessionOpen) await sdk.closeSession();
+  if (sdk.storageState === 'unlocked') await sdk.secureStorageLock();
+  await sdk.secureStorageAbortOnboardingCandidate().catch(() => {});
+  throw error;
+}
+```
+
+`secureStorageCommitOnboardingCandidate()` and
+`secureStorageAbortOnboardingCandidate()` reject with `SESSION_OPEN` while an
+SDK session is open. Process termination before commit discards the in-memory
+candidate; one successful commit activates all three slots together. Both
+onboarding and portable import expose the same source-neutral
+`accountGenerationEpoch`, which encrypted per-account migrations can use as an
+idempotency key.
+
 ## Service APIs
 
 All services are available after `openSession()` is called.

package/THIRD_PARTY_NOTICES.txt

@@ -900,9 +900,9 @@ License: MIT OR Apache-2.0
 Source: registry+https://github.com/rust-lang/crates.io-index
 License text references: 0218327e7a480793, 4cada0bd02ea3692
 
-Cargo: pq-rerand@0.1.0
+Cargo: pq-rerand@0.2.0
 License: NOASSERTION (UNRESOLVED)
-Source: git+https://github.com/massalabs/pq-rerand?rev=1d5f9d1afd6f06383fffc0aa3a362774ba35d45f#1d5f9d1afd6f06383fffc0aa3a362774ba35d45f
+Source: git+https://github.com/massalabs/pq-rerand?rev=9a5a48beb0af01b0f23e5b68e2c6b53e38e7eb2a#9a5a48beb0af01b0f23e5b68e2c6b53e38e7eb2a
 License text references: none found
 Review note: No license declaration or license file was found at the pinned revision.
 
@@ -986,11 +986,6 @@ License: MIT OR Apache-2.0
 Source: registry+https://github.com/rust-lang/crates.io-index
 License text references: 90eb64f0279b0d94, 6df43f6f4b5d4587, 209fbbe0ad52d923
 
-Cargo: rand_distr@0.4.3
-License: MIT OR Apache-2.0
-Source: registry+https://github.com/rust-lang/crates.io-index
-License text references: 90eb64f0279b0d94, 6df43f6f4b5d4587, a771e4354f6b3ad4
-
 Cargo: rand_xorshift@0.4.0
 License: MIT OR Apache-2.0
 Source: registry+https://github.com/rust-lang/crates.io-index
@@ -1001,7 +996,7 @@ License: MIT OR Apache-2.0
 Source: registry+https://github.com/rust-lang/crates.io-index
 License text references: d902d7d4433c0809, d7bb236e93b1117d
 
-Cargo: rayon@1.11.0
+Cargo: rayon@1.12.0
 License: MIT OR Apache-2.0
 Source: registry+https://github.com/rust-lang/crates.io-index
 License text references: a60eea8175145316, 0621878e61f0d0fd
@@ -2201,7 +2196,7 @@ SOFTWARE.
 Text reference: 0621878e61f0d0fd
 SHA-256: 0621878e61f0d0fda054bcbe02df75192c28bde1ecc8289cbd86aeba2dd72720
 File names: LICENSE-MIT
-Used by: Cargo:rayon-core@1.13.0, Cargo:rayon@1.11.0
+Used by: Cargo:rayon-core@1.13.0, Cargo:rayon@1.12.0
 
 Copyright (c) 2010 The Rust Project Developers
 
@@ -6363,7 +6358,7 @@ the BSD 1-Clause License <LICENSE-BSD-1> or
 Text reference: 6df43f6f4b5d4587
 SHA-256: 6df43f6f4b5d4587f3d8d71e45532c688fd168afa5fe89d571cb32fa09c4ef51
 File names: LICENSE-APACHE
-Used by: Cargo:rand_core@0.6.4, Cargo:rand_core@0.9.3, Cargo:rand_distr@0.4.3
+Used by: Cargo:rand_core@0.6.4, Cargo:rand_core@0.9.3
 
                               Apache License
                         Version 2.0, January 2004
@@ -8724,7 +8719,7 @@ SOFTWARE.
 Text reference: 90eb64f0279b0d94
 SHA-256: 90eb64f0279b0d9432accfa6023ff803bc4965212383697eee27a0f426d5f8d5
 File names: COPYRIGHT
-Used by: Cargo:rand@0.8.5, Cargo:rand@0.9.2, Cargo:rand_chacha@0.3.1, Cargo:rand_chacha@0.9.0, Cargo:rand_core@0.6.4, Cargo:rand_core@0.9.3, Cargo:rand_distr@0.4.3, Cargo:rand_xorshift@0.4.0
+Used by: Cargo:rand@0.8.5, Cargo:rand@0.9.2, Cargo:rand_chacha@0.3.1, Cargo:rand_chacha@0.9.0, Cargo:rand_core@0.6.4, Cargo:rand_core@0.9.3, Cargo:rand_xorshift@0.4.0
 
 Copyrights in the Rand project are retained by their contributors. No
 copyright assignment is required to contribute to the Rand project.
@@ -9346,7 +9341,7 @@ SOFTWARE.
 Text reference: a60eea8175145316
 SHA-256: a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2
 File names: LICENSE-APACHE
-Used by: Cargo:ark-ff-asm@0.3.0, Cargo:ark-ff-macros@0.3.0, Cargo:ark-ff@0.3.0, Cargo:ark-serialize@0.3.0, Cargo:ark-std@0.3.0, Cargo:ark-std@0.4.0, Cargo:ark-std@0.5.0, Cargo:arrayvec@0.7.6, Cargo:autocfg@1.5.0, Cargo:bitflags@2.11.0, Cargo:bs58@0.5.1, Cargo:bumpalo@3.19.0, Cargo:camino@1.2.2, Cargo:cc@1.2.39, Cargo:cfg-if@1.0.3, Cargo:crossbeam-deque@0.8.6, Cargo:crossbeam-epoch@0.9.18, Cargo:crossbeam-utils@0.8.21, Cargo:curve25519-dalek-derive@0.1.1, Cargo:derivative@2.2.0, Cargo:displaydoc@0.2.5, Cargo:either@1.15.0, Cargo:equivalent@1.0.2, Cargo:errno@0.3.14, Cargo:fastrand@2.4.1, Cargo:ff@0.13.1, Cargo:find-msvc-tools@0.1.2, Cargo:fnv@1.0.7, Cargo:fs-err@2.11.0, Cargo:glob@0.3.3, Cargo:group@0.13.0, Cargo:hashbrown@0.16.1, Cargo:heck@0.5.0, Cargo:indexmap@2.13.1, Cargo:itertools@0.10.5, Cargo:itertools@0.13.0, Cargo:js-sys@0.3.81, Cargo:linux-raw-sys@0.11.0, Cargo:log@0.4.28, Cargo:num-bigint@0.4.6, Cargo:num-complex@0.4.6, Cargo:num-integer@0.1.46, Cargo:num-iter@0.1.45, Cargo:num-rational@0.4.2, Cargo:num-traits@0.2.19, Cargo:num@0.4.3, Cargo:once_cell@1.21.3, Cargo:percent-encoding@2.3.2, Cargo:pest@2.8.6, Cargo:plain@0.2.3, Cargo:proptest@1.11.0, Cargo:rayon-core@1.13.0, Cargo:rayon@1.11.0, Cargo:regex-syntax@0.8.10, Cargo:rustc-hex@2.1.0, Cargo:rustc_version@0.3.3, Cargo:rustc_version@0.4.1, Cargo:rustix@1.1.2, Cargo:rusty-fork@0.3.1, Cargo:semver-parser@0.10.3, Cargo:semver@0.11.0, Cargo:syn@1.0.109, Cargo:tempfile@3.23.0, Cargo:ucd-trie@0.1.7, Cargo:unicode-segmentation@1.13.2, Cargo:unicode-xid@0.2.6, Cargo:uuid@1.18.1, Cargo:version_check@0.9.5, Cargo:wait-timeout@0.2.1, Cargo:wasi@0.11.1+wasi-snapshot-preview1, Cargo:wasi@0.14.7+wasi-0.2.4, Cargo:wasm-bindgen-backend@0.2.104, Cargo:wasm-bindgen-macro-support@0.2.104, Cargo:wasm-bindgen-macro@0.2.104, Cargo:wasm-bindgen-shared@0.2.104, Cargo:wasm-bindgen@0.2.104, Cargo:web-sys@0.3.81, Cargo:wit-bindgen@0.46.0
+Used by: Cargo:ark-ff-asm@0.3.0, Cargo:ark-ff-macros@0.3.0, Cargo:ark-ff@0.3.0, Cargo:ark-serialize@0.3.0, Cargo:ark-std@0.3.0, Cargo:ark-std@0.4.0, Cargo:ark-std@0.5.0, Cargo:arrayvec@0.7.6, Cargo:autocfg@1.5.0, Cargo:bitflags@2.11.0, Cargo:bs58@0.5.1, Cargo:bumpalo@3.19.0, Cargo:camino@1.2.2, Cargo:cc@1.2.39, Cargo:cfg-if@1.0.3, Cargo:crossbeam-deque@0.8.6, Cargo:crossbeam-epoch@0.9.18, Cargo:crossbeam-utils@0.8.21, Cargo:curve25519-dalek-derive@0.1.1, Cargo:derivative@2.2.0, Cargo:displaydoc@0.2.5, Cargo:either@1.15.0, Cargo:equivalent@1.0.2, Cargo:errno@0.3.14, Cargo:fastrand@2.4.1, Cargo:ff@0.13.1, Cargo:find-msvc-tools@0.1.2, Cargo:fnv@1.0.7, Cargo:fs-err@2.11.0, Cargo:glob@0.3.3, Cargo:group@0.13.0, Cargo:hashbrown@0.16.1, Cargo:heck@0.5.0, Cargo:indexmap@2.13.1, Cargo:itertools@0.10.5, Cargo:itertools@0.13.0, Cargo:js-sys@0.3.81, Cargo:linux-raw-sys@0.11.0, Cargo:log@0.4.28, Cargo:num-bigint@0.4.6, Cargo:num-complex@0.4.6, Cargo:num-integer@0.1.46, Cargo:num-iter@0.1.45, Cargo:num-rational@0.4.2, Cargo:num-traits@0.2.19, Cargo:num@0.4.3, Cargo:once_cell@1.21.3, Cargo:percent-encoding@2.3.2, Cargo:pest@2.8.6, Cargo:plain@0.2.3, Cargo:proptest@1.11.0, Cargo:rayon-core@1.13.0, Cargo:rayon@1.12.0, Cargo:regex-syntax@0.8.10, Cargo:rustc-hex@2.1.0, Cargo:rustc_version@0.3.3, Cargo:rustc_version@0.4.1, Cargo:rustix@1.1.2, Cargo:rusty-fork@0.3.1, Cargo:semver-parser@0.10.3, Cargo:semver@0.11.0, Cargo:syn@1.0.109, Cargo:tempfile@3.23.0, Cargo:ucd-trie@0.1.7, Cargo:unicode-segmentation@1.13.2, Cargo:unicode-xid@0.2.6, Cargo:uuid@1.18.1, Cargo:version_check@0.9.5, Cargo:wait-timeout@0.2.1, Cargo:wasi@0.11.1+wasi-snapshot-preview1, Cargo:wasi@0.14.7+wasi-0.2.4, Cargo:wasm-bindgen-backend@0.2.104, Cargo:wasm-bindgen-macro-support@0.2.104, Cargo:wasm-bindgen-macro@0.2.104, Cargo:wasm-bindgen-shared@0.2.104, Cargo:wasm-bindgen@0.2.104, Cargo:web-sys@0.3.81, Cargo:wit-bindgen@0.46.0
 
                               Apache License
                         Version 2.0, January 2004
@@ -9963,39 +9958,6 @@ Used by: npm:google-protobuf@3.21.4
 
 ------------------------------------------------------------------------------
 
-Text reference: a771e4354f6b3ad4
-SHA-256: a771e4354f6b3ad4c92da1a5c9a239b6c291527db869632ecea4f20e24ca1135
-File names: LICENSE-MIT
-Used by: Cargo:rand_distr@0.4.3
-
-Copyright 2018 Developers of the Rand project
-
-Permission is hereby granted, free of charge, to any
-person obtaining a copy of this software and associated
-documentation files (the "Software"), to deal in the
-Software without restriction, including without
-limitation the rights to use, copy, modify, merge,
-publish, distribute, sublicense, and/or sell copies of
-the Software, and to permit persons to whom the Software
-is furnished to do so, subject to the following
-conditions:
-
-The above copyright notice and this permission notice
-shall be included in all copies or substantial portions
-of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
-ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
-TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
-SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
-IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-DEALINGS IN THE SOFTWARE.
-
-------------------------------------------------------------------------------
-
 Text reference: a825bd853ab71619
 SHA-256: a825bd853ab71619a4923d7b4311221427848070ff44d990da39b0b274c1683f
 File names: LICENSE-MIT

package/dist/api/restClient.js

@@ -23,14 +23,13 @@ export class RestClient {
     async makeRequest(url, options) {
         let lastError = null;
         for (let attempt = 1; attempt <= this.retryAttempts; attempt++) {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.timeout);
             try {
-                const controller = new AbortController();
-                const timeoutId = setTimeout(() => controller.abort(), this.timeout);
                 const response = await fetch(url, {
                     ...options,
                     signal: controller.signal,
                 });
-                clearTimeout(timeoutId);
                 if (!response.ok) {
                     throw new Error(`HTTP ${response.status}: ${response.statusText}`);
                 }
@@ -45,6 +44,9 @@ export class RestClient {
                     await new Promise(resolve => setTimeout(resolve, delay));
                 }
             }
+            finally {
+                clearTimeout(timeoutId);
+            }
         }
         return {
             success: false,

package/dist/assets/generated/wasm/gossip_wasm.d.ts

@@ -1,5 +1,13 @@
 /* tslint:disable */
 /* eslint-disable */
+export function start(): void;
+/**
+ * Generates user keys from a passphrase.
+ *
+ * Derives all gossip keys (DSA, KEM, Massa, EVM) in a single WASM call so
+ * the passphrase crosses the JS boundary only once.
+ */
+export function generate_user_keys(passphrase: string): UserKeys;
 /**
  * Encrypts data using AES-256-SIV authenticated encryption.
  *
@@ -33,14 +41,6 @@
  * ```
  */
 export function aead_encrypt(key: EncryptionKey, nonce: Nonce, plaintext: Uint8Array, aad: Uint8Array): Uint8Array;
-/**
- * Generates user keys from a passphrase.
- *
- * Derives all gossip keys (DSA, KEM, Massa, EVM) in a single WASM call so
- * the passphrase crosses the JS boundary only once.
- */
-export function generate_user_keys(passphrase: string): UserKeys;
-export function start(): void;
 /**
  * Decrypts data using AES-256-SIV authenticated encryption.
  *

package/dist/assets/generated/wasm/gossip_wasm.js

@@ -117,11 +117,8 @@ function isLikeNone(x) {
     return x === undefined || x === null;
 }
 
-function passArray8ToWasm0(arg, malloc) {
-    const ptr = malloc(arg.length * 1, 1) >>> 0;
-    getUint8ArrayMemory0().set(arg, ptr / 1);
-    WASM_VECTOR_LEN = arg.length;
-    return ptr;
+export function start() {
+    wasm.start();
 }
 
 function takeFromExternrefTable0(idx) {
@@ -129,12 +126,36 @@ function takeFromExternrefTable0(idx) {
     wasm.__externref_table_dealloc(idx);
     return value;
 }
+/**
+ * Generates user keys from a passphrase.
+ *
+ * Derives all gossip keys (DSA, KEM, Massa, EVM) in a single WASM call so
+ * the passphrase crosses the JS boundary only once.
+ * @param {string} passphrase
+ * @returns {UserKeys}
+ */
+export function generate_user_keys(passphrase) {
+    const ptr0 = passStringToWasm0(passphrase, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ret = wasm.generate_user_keys(ptr0, len0);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return UserKeys.__wrap(ret[0]);
+}
 
 function _assertClass(instance, klass) {
     if (!(instance instanceof klass)) {
         throw new Error(`expected instance of ${klass.name}`);
     }
 }
+
+function passArray8ToWasm0(arg, malloc) {
+    const ptr = malloc(arg.length * 1, 1) >>> 0;
+    getUint8ArrayMemory0().set(arg, ptr / 1);
+    WASM_VECTOR_LEN = arg.length;
+    return ptr;
+}
 /**
  * Encrypts data using AES-256-SIV authenticated encryption.
  *
@@ -185,28 +206,6 @@ export function aead_encrypt(key, nonce, plaintext, aad) {
     return v3;
 }
 
-/**
- * Generates user keys from a passphrase.
- *
- * Derives all gossip keys (DSA, KEM, Massa, EVM) in a single WASM call so
- * the passphrase crosses the JS boundary only once.
- * @param {string} passphrase
- * @returns {UserKeys}
- */
-export function generate_user_keys(passphrase) {
-    const ptr0 = passStringToWasm0(passphrase, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.generate_user_keys(ptr0, len0);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return UserKeys.__wrap(ret[0]);
-}
-
-export function start() {
-    wasm.start();
-}
-
 /**
  * Decrypts data using AES-256-SIV authenticated encryption.
  *

package/dist/assets/generated/wasm-secureStorage/secureStorage.d.ts

@@ -1,22 +1,6 @@
 /* tslint:disable */
 /* eslint-disable */
 export function initSecureStorage(domain: string, backend: string): Promise<void>;
-export function idbHasData(): Promise<boolean>;
-export function provisionStorage(): void;
-export function allocateSession(slot: number, password: Uint8Array): void;
-export function flushEncrypted(): Promise<void>;
-export function openDatabase(): void;
-export function closeDatabase(): void;
-/**
- * Run a SQL statement with bound parameters.
- *
- * `params` is a JS array of values; supported types are number, string,
- * Uint8Array, null, and bigint. Returns rows as a JS array of arrays
- * (positional column values), matching the Drizzle sqlite-proxy contract.
- */
-export function execSql(sql: string, params: Array<any>): ExecResult;
-export function unlockSession(password: Uint8Array): boolean;
-export function lockSession(): void;
 /**
  * Permanently destroy the data of the currently unlocked slot.
  *
@@ -33,10 +17,100 @@ export function lockSession(): void;
  */
 export function destroySession(namespaces: Uint8Array): void;
 export function coverTrafficTick(namespace: number): void;
+/**
+ * Strictly validate one version-1 logical keypair record without unlocking it.
+ * Browser streaming export/import uses this bounded bridge so TypeScript never
+ * reimplements pq-rerand's canonical parser.
+ */
+export function validatePortableKeypair(value: Uint8Array): void;
+export function openDatabase(): void;
+export function closeDatabase(): void;
+/**
+ * Run a SQL statement with bound parameters.
+ *
+ * `params` is a JS array of values; supported types are number, string,
+ * Uint8Array, null, and bigint. Returns rows as a JS array of arrays
+ * (positional column values), matching the Drizzle sqlite-proxy contract.
+ */
+export function execSql(sql: string, params: Array<any>): ExecResult;
+/**
+ * Strictly validate one version-1 encrypted block record.
+ */
+export function validatePortableBlock(value: Uint8Array): void;
 export function writeNamespaceData(namespace: number, offset: number, data: Uint8Array): void;
 export function readNamespaceData(namespace: number, offset: number, len: number): Uint8Array;
 export function namespaceDataLength(namespace: number): number;
 export function clearNamespace(namespace: number): void;
+/**
+ * Verify that this worker still owns the active IndexedDB generation.
+ */
+export function verifyStorageGeneration(): Promise<void>;
+/**
+ * Called by the worker when an allocation or destruction transaction rejects.
+ * This prevents a later cover-traffic flush from durably carrying the failed
+ * lifecycle operation. The recovered state is always locked.
+ */
+export function reloadDurableStorage(): Promise<void>;
+/**
+ * Abandon a poisoned SQLite transaction and restore its last durable image
+ * while retaining the current unlocked session keys. No pending VFS bytes are
+ * flushed: closing SQLite rolls back its in-memory journal, then the IndexedDB
+ * cache is reloaded before a fresh database handle is opened.
+ */
+export function resetSqlDatabaseToDurable(): Promise<void>;
+export function flushEncrypted(): Promise<void>;
+export function beginOnboardingCandidate(): void;
+export function exportOnboardingCandidate(): Uint8Array;
+export function activateOnboardingGeneration(): Promise<void>;
+/**
+ * Generate fresh current-suite keypairs for all slots at once. Every public
+ * key changes, so comparing source and destination cannot reveal selection.
+ */
+export function finalizeOuterMigration(): Array<any>;
+/**
+ * Transform one complete fixed-slot block coordinate.
+ */
+export function migrateOuterBlockBatch(namespace: number, block_index: number, values: Array<any>): Array<any>;
+export function finishOuterMigrationNamespace(namespace: number, source_block_count: number): void;
+export function endOuterMigration(): void;
+export function idbHasData(): Promise<boolean>;
+export function provisionStorage(): void;
+export function allocateSession(slot: number, password: Uint8Array): void;
+export function unlockSession(password: Uint8Array): boolean;
+export function lockSession(): void;
+export function endOnboardingCandidate(): void;
+/**
+ * Replace this terminal worker's active backend with an isolated in-memory
+ * portable candidate and authenticate its keypairs without exposing the
+ * matched slot to JavaScript.
+ */
+export function beginCandidatePreview(domain: string, password: Uint8Array, keypairs: Array<any>): boolean;
+/**
+ * Admit one canonical candidate block. Only namespace 0 blocks belonging to
+ * the internally authenticated slot are retained; callers never learn which
+ * slot matched.
+ */
+export function appendCandidatePreviewBlock(slot: number, namespace: number, block_index: number, data: Uint8Array): void;
+/**
+ * Load the candidate namespace length and open SQLite without write authority.
+ */
+export function finishCandidatePreview(): void;
+/**
+ * Project only bounded public profile fields inside WASM. The security JSON
+ * is validated and zeroized in Rust and never crosses the worker bridge.
+ */
+export function queryCandidatePreview(): any;
+export function endCandidatePreview(): Promise<void>;
+/**
+ * Begin password admission for one validated candidate. Only opaque plan
+ * state is retained; no transformed/mixed-version generation is emitted.
+ */
+export function beginOuterMigration(domain: string, keypairs: Array<any>): void;
+/**
+ * Admit one password with all-slot constant work. The owned WASM copy is
+ * zeroized before return and a generic false discloses no matched slot.
+ */
+export function admitOuterMigrationPassword(password: Uint8Array): boolean;
 export function initThreadPool(num_threads: number): Promise<any>;
 export function wbg_rayon_start_worker(receiver: number): void;
 /**
@@ -67,23 +141,43 @@ export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembl
 
 export interface InitOutput {
   readonly __wbg_execresult_free: (a: number, b: number) => void;
+  readonly activateOnboardingGeneration: () => any;
+  readonly admitOuterMigrationPassword: (a: number, b: number) => [number, number, number];
   readonly allocateSession: (a: number, b: number, c: number) => [number, number];
+  readonly appendCandidatePreviewBlock: (a: number, b: number, c: number, d: number, e: number) => [number, number];
+  readonly beginCandidatePreview: (a: number, b: number, c: number, d: number, e: any) => [number, number, number];
+  readonly beginOnboardingCandidate: () => [number, number];
+  readonly beginOuterMigration: (a: number, b: number, c: any) => [number, number];
   readonly clearNamespace: (a: number) => [number, number];
   readonly closeDatabase: () => [number, number];
   readonly coverTrafficTick: (a: number) => [number, number];
   readonly destroySession: (a: number, b: number) => [number, number];
+  readonly endCandidatePreview: () => any;
+  readonly endOnboardingCandidate: () => [number, number];
+  readonly endOuterMigration: () => void;
   readonly execSql: (a: number, b: number, c: any) => [number, number, number];
   readonly execresult_lastInsertRowId: (a: number) => number;
   readonly execresult_rows: (a: number) => any;
+  readonly exportOnboardingCandidate: () => [number, number, number, number];
+  readonly finalizeOuterMigration: () => [number, number, number];
+  readonly finishCandidatePreview: () => [number, number];
+  readonly finishOuterMigrationNamespace: (a: number, b: number) => [number, number];
   readonly flushEncrypted: () => any;
   readonly idbHasData: () => any;
   readonly initSecureStorage: (a: number, b: number, c: number, d: number) => any;
   readonly lockSession: () => [number, number];
+  readonly migrateOuterBlockBatch: (a: number, b: number, c: any) => [number, number, number];
   readonly namespaceDataLength: (a: number) => [number, number, number];
   readonly openDatabase: () => [number, number];
   readonly provisionStorage: () => [number, number];
+  readonly queryCandidatePreview: () => [number, number, number];
   readonly readNamespaceData: (a: number, b: number, c: number) => [number, number, number, number];
+  readonly reloadDurableStorage: () => any;
+  readonly resetSqlDatabaseToDurable: () => any;
   readonly unlockSession: (a: number, b: number) => [number, number, number];
+  readonly validatePortableBlock: (a: number, b: number) => [number, number];
+  readonly validatePortableKeypair: (a: number, b: number) => [number, number];
+  readonly verifyStorageGeneration: () => any;
   readonly writeNamespaceData: (a: number, b: number, c: number, d: number) => [number, number];
   readonly __wbg_wbg_rayon_poolbuilder_free: (a: number, b: number) => void;
   readonly initThreadPool: (a: number) => any;
@@ -110,11 +204,11 @@ export interface InitOutput {
   readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
   readonly __wbindgen_export_7: WebAssembly.Table;
   readonly __externref_table_dealloc: (a: number) => void;
-  readonly closure112_externref_shim: (a: number, b: number, c: any) => void;
-  readonly wasm_bindgen_3f82e0ab9dbbc377___convert__closures_____invoke______: (a: number, b: number) => void;
-  readonly closure56_externref_shim_multivalue_shim: (a: number, b: number, c: any) => [number, number];
-  readonly closure678_externref_shim: (a: number, b: number, c: any) => void;
-  readonly closure723_externref_shim: (a: number, b: number, c: any, d: any) => void;
+  readonly closure127_externref_shim: (a: number, b: number, c: any) => void;
+  readonly wasm_bindgen_c8f7f980e6f4097b___convert__closures_____invoke______: (a: number, b: number) => void;
+  readonly closure83_externref_shim_multivalue_shim: (a: number, b: number, c: any) => [number, number];
+  readonly closure702_externref_shim: (a: number, b: number, c: any) => void;
+  readonly closure758_externref_shim: (a: number, b: number, c: any, d: any) => void;
   readonly __wbindgen_thread_destroy: (a?: number, b?: number, c?: number) => void;
   readonly __wbindgen_start: (a: number) => void;
 }