@muhkoo/connect 0.14.0-alpha.6 → 0.14.0-alpha.8

package/dist/connect.d.ts

@@ -535,116 +535,6 @@ declare class DoubleRatchet {
     setState(state: RatchetState): void;
 }
 
-type SnarkProof = Groth16Proof;
-
-interface ZkCompiled {
-    verificationKey: VerificationKey;
-}
-declare class AuthPublicInput {
-    commitment: string;
-    nonce: string;
-    ecdsaPubHash: string;
-    constructor(commitment: string, nonce: string, ecdsaPubHash: string);
-    toPublicSignals(): string[];
-}
-declare class Field {
-    private value;
-    static readonly FIELD_SIZE: bigint;
-    constructor(value: bigint | string | number);
-    toBigInt(): bigint;
-    toString(): string;
-    toHex(): string;
-    equals(other: Field): boolean;
-    static fromHex(hex: string): Field;
-}
-declare class Poseidon {
-    static hash(inputs: Field[]): Promise<Field>;
-}
-declare function encodeToHex(field: Field): string;
-declare function decodeFromHex(hexStr: string): Field;
-interface CircuitBufferConfig {
-    wasm: Uint8Array;
-    zkey: Uint8Array;
-    verificationKey: VerificationKey;
-}
-declare class HashKnowledge {
-    private static wasmBuffer?;
-    private static zkeyBuffer?;
-    private static verificationKey?;
-    static setCircuitBuffers(wasm: Uint8Array, zkey: Uint8Array, verificationKey: VerificationKey): void;
-    static compile(): Promise<ZkCompiled>;
-    static prove(secret: Field): Promise<{
-        proof: SnarkProof;
-        publicSignals: string[];
-    }>;
-    static verify(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
-}
-declare class PreimagePoK {
-    private static wasmBuffer?;
-    private static zkeyBuffer?;
-    private static verificationKey?;
-    static setCircuitBuffers(wasm: Uint8Array, zkey: Uint8Array, verificationKey: VerificationKey): void;
-    static compile(): Promise<ZkCompiled>;
-    static prove(publicInput: AuthPublicInput, secret: Field, salt: Field, ecdsaPub: Field): Promise<{
-        proof: SnarkProof;
-        publicSignals: string[];
-    }>;
-    static verify(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
-}
-declare function verifyHashKnowledge(proof: SnarkProof, expectedOutput?: Field, publicSignals?: string[]): Promise<boolean>;
-declare function verifyPreimagePoK(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
-declare function verify(programType: 'HashKnowledge' | 'PreimagePoK', proof: SnarkProof, options?: {
-    expectedOutput?: Field;
-    publicSignals?: string[];
-}): Promise<boolean>;
-declare function quickVerify(program: typeof HashKnowledge | typeof PreimagePoK, proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
-declare function initializeCircuits(config: {
-    hashKnowledge?: CircuitBufferConfig;
-    preimagePoK?: CircuitBufferConfig;
-}): void;
-declare function compilePrograms(): Promise<{
-    hashKnowledge: ZkCompiled;
-    preimagePoK: ZkCompiled;
-}>;
-
-interface AuthToken {
-    peerId: string;
-    timestamp: number;
-    signature: string;
-}
-declare class Authenticator {
-    private trustedKeys;
-    private zkVerificationKey;
-    initializeZK(): Promise<void>;
-    getZKVerificationKey(): VerificationKey | null;
-    addTrustedServer(serverId: string, publicKey: CryptoKey): void;
-    generateAuthToken(peerId: string, privateKey: CryptoKey): Promise<AuthToken>;
-    verifyAuthToken(token: AuthToken, clientPublicKey: CryptoKey): Promise<boolean>;
-    verifyZKProof(proof: any, publicInput: AuthPublicInput, storedCommitment: Field, ecdsaPub: CryptoKey): Promise<boolean>;
-}
-
-declare class DoubleRatchetManager {
-    private sessions;
-    private sessionStates;
-    private keyStore;
-    private _authenticator;
-    private registeredUsers;
-    private id;
-    constructor(id: string);
-    get authenticator(): Authenticator;
-    addTrustedServer(serverId: string, publicKey: CryptoKey): Promise<void>;
-    registerZK(clientId: string, secret: Field, salt: Field, ecdsaPub: CryptoKey): Promise<void>;
-    performHandshake(senderId: string, recipientId: string, zkProof: any, publicInput: AuthPublicInput, clientPublicKey: CryptoKey, // ECDH pub for session
-    clientAuthPublicKey: CryptoKey, // ECDSA pub for auth
-    authToken: AuthToken): Promise<void>;
-    initializeSession(senderId: string, recipientId: string, isClient?: boolean, sessionType?: 'global' | 'specific', sessionId?: string, zkProof?: any, publicInput?: AuthPublicInput, clientPublicKey?: CryptoKey, clientAuthPublicKey?: CryptoKey, clientEcdhPrivateKey?: CryptoKey, clientAuthPrivateKey?: CryptoKey): Promise<string>;
-    encrypt(senderId: string, recipientId: string, sessionId: string, plaintext: string, newDhKey?: boolean, sessionType?: 'global' | 'specific'): Promise<CipherMessage>;
-    decrypt(message: CipherMessage, isClient?: boolean): Promise<string>;
-    getSessionSharedSecret(sessionId: string): Promise<Uint8Array | null>;
-    private saveState;
-    private loadState;
-}
-
 /**
  * Per-chunk AES-256-GCM encryption with random keys and IVs.
  *
@@ -768,6 +658,11 @@ declare enum EventCoreEvents {
  */
 declare class EventCore {
     private static eventTarget;
+    /**
+     * `event -> (caller's handler -> the wrapper actually registered on the
+     * EventTarget)`. Two levels because one event can have many listeners and
+     * {@link off} must remove exactly the wrapper it registered for that caller.
+     */
     private static events;
     /**
      * @remarks Listen to an event.
@@ -928,7 +823,7 @@ declare class EncryptedSession {
  *
  * Hands raw frame strings up (via the `MESSAGE` event) and accepts raw frame
  * strings down (via `send`). Anything frame-shape, encryption, or serialization
- * related belongs in the layer above (e.g. `Network` for client↔server
+ * related belongs in the layer above (e.g. `BroadcastChannel` for client↔server
  * encrypted pipes, `BroadcastChannel` for multi-peer E2E rooms).
  *
  * Responsibilities:
@@ -1084,7 +979,7 @@ declare class WSTransport extends EventCore {
  *             anything else                 — passes through as `raw_frame`
  *                                              (the app decides what to do)
  *
- * **Event scoping.** Unlike `Network`, BroadcastChannel uses a per-instance
+ * **Event scoping.** BroadcastChannel uses a per-instance
  * `EventTarget`, so two channels (e.g. two rooms in the same app) don't
  * cross-contaminate each other's events.
  *
@@ -1209,1202 +1104,1625 @@ declare function initBn128Wasm(wasmModule?: WebAssembly.Module): Promise<Bn128Wa
  */
 declare function verifyGroth16(wasmInstance: WebAssembly.Instance, memory: WebAssembly.Memory, initialPFree: number, verificationKey: VerificationKey, proof: Groth16Proof, publicSignals: string[]): Promise<boolean>;
 
-/**
- * `PersonalSpaceClient` — the client-side counterpart to the accelerator's
- * `PersonalSpaceDO`. Wraps the `/api/personal/:commitment/*` HTTP protocol so
- * callers can `put` / `get` / `delete` / `list` per-user KV blobs without
- * thinking about challenges, nonces, or Groth16 proof generation.
- *
- * Every gated operation:
- *   1. Requests a one-shot challenge from the DO (`POST /challenge`).
- *   2. Converts the returned hex nonce into a BN254 field element.
- *   3. Generates a fresh Groth16 proof for the `preimagePoK` circuit using
- *      snarkjs, with the user's secret/salt/ecdsaPub as private inputs and
- *      `{commitment, nonce, ecdsaPubHash}` as public signals.
- *   4. POSTs the proof + publicSignals + (optional) value to the gated endpoint.
- *
- * snarkjs is loaded lazily (dynamic `import`) the first time a proof is
- * generated — it's an optional peer dependency that only the ZK-proof path
- * needs, so importing this module (or constructing a `Client`) never requires
- * it. Consumers using the proof path install `snarkjs`, or provide it via an
- * import map in the browser (see the README).
- *
- * Encryption of the stored values is the caller's responsibility — the DO
- * sees only opaque JSON. The companion `wrap.ts` helpers in this folder are
- * a convenient way to passphrase-encrypt a payload before putting it.
- */
-/**
- * Constructor options for {@link PersonalSpaceClient}.
- *
- * All of `secret`, `salt`, `ecdsaPub`, and `ecdsaPubHash` are decimal-encoded
- * BigInt strings (snarkjs convention). `commitment` is likewise decimal — it's
- * the Poseidon hash of `(secret, salt, ecdsaPubHash)`.
- */
-interface PersonalSpaceClientOptions {
-    /** Base URL of the accelerator, e.g. `http://localhost:8787`. */
-    baseUrl: string;
-    /** The user's Poseidon commitment as a decimal string (~78 digits). */
+type SnarkProof = Groth16Proof;
+
+interface ZkCompiled {
+    verificationKey: VerificationKey;
+}
+declare class AuthPublicInput {
     commitment: string;
-    /** ZK identity material — private inputs to the proof. Decimal BigInt string. */
-    secret: string;
-    /** ZK identity salt. Decimal BigInt string. */
-    salt: string;
-    /** Raw ECDSA public-key field representation. Decimal BigInt string. */
-    ecdsaPub: string;
-    /** Poseidon hash of `ecdsaPub`, used as a public signal. Decimal BigInt string. */
+    nonce: string;
     ecdsaPubHash: string;
-    /** Where the runtime can fetch the compiled circuit assets. */
-    circuits: {
-        /** URL of the `preimagePoK.wasm` witness generator. */
-        wasmUrl: string;
-        /** URL of the `preimagePoK_0001.zkey` proving key. */
-        zkeyUrl: string;
-    };
+    constructor(commitment: string, nonce: string, ecdsaPubHash: string);
+    toPublicSignals(): string[];
 }
-declare class PersonalSpaceClient {
-    private readonly baseUrl;
-    private readonly commitment;
-    private readonly secret;
-    private readonly salt;
-    private readonly ecdsaPub;
-    private readonly ecdsaPubHash;
-    private readonly wasmUrl;
-    private readonly zkeyUrl;
-    constructor(opts: PersonalSpaceClientOptions);
-    /** Store `value` under `key`, replacing any prior value. */
-    put(key: string, value: unknown): Promise<void>;
-    /** Fetch the value stored under `key`. Returns `null` if absent. */
-    get<T = unknown>(key: string): Promise<T | null>;
-    /** Remove `key` from the user's space. Returns whether the key existed. */
-    delete(key: string): Promise<boolean>;
-    /** List every key currently stored in the user's space. */
-    list(): Promise<string[]>;
-    /**
-     * Run the full pre-flight: ask the DO for a challenge, reduce the nonce to
-     * a field element, and generate a fresh Groth16 proof. Returns everything
-     * the gated endpoints need in their body.
-     */
-    private proveFreshChallenge;
-    /** Hit `POST /challenge` and return the issued nonce + ID. */
-    private requestChallenge;
-    /**
-     * Thin wrapper over `globalThis.fetch` so all methods share a single set of
-     * headers and body-encoding behaviour. `globalThis.fetch` is available in
-     * modern browsers, Node 18+, Workers, and Bun.
-     */
-    private fetch;
+declare class Field {
+    private value;
+    static readonly FIELD_SIZE: bigint;
+    constructor(value: bigint | string | number);
+    toBigInt(): bigint;
+    toString(): string;
+    toHex(): string;
+    equals(other: Field): boolean;
+    static fromHex(hex: string): Field;
 }
-
-/**
- * Wire types for the storage layer.
- *
- * The `FileManifest` is the single piece of metadata the system needs to
- * reassemble a file: per-chunk encryption material, RS parameters, and the
- * SHA-256 content hashes of every shard that belongs to the chunk. With the
- * manifest in hand, a reader can pull each shard from the open content-
- * addressed shard store, decode, decrypt, and concatenate to recover the
- * original bytes.
- *
- * The manifest itself lives inside a `SharedSpaceDO` (Phase B) which gates
- * access by ZK proof + ACL. Shards are stored in the open content-addressed
- * `ShardStoreDO` — anyone can put/get any shard, but without the manifest
- * (which has the keys) the ciphertext is just noise.
- */
-
-/**
- * One chunk's metadata. A file is the concatenation of `chunks` in order.
- *
- * - `originalSize` is the chunk's plaintext length, before AES-GCM expanded
- *   it by 16 bytes for the auth tag and before RS padded it for shard
- *   alignment.
- * - `ciphertextSize` is the AES-GCM output length (plaintext + 16). This is
- *   what the RS decoder trims back to.
- * - `shardHashes` lists every shard's SHA-256 in encoding order — the first
- *   `dataShards` are data shards, the trailing `parityShards` are parity.
- */
-interface ChunkManifest {
-    /** Stable per-chunk ID (uuid-like). Useful for client-side resume / dedup. */
-    id: string;
-    /** Position of this chunk in the file (0-indexed). */
-    chunkIndex: number;
-    /** Plaintext byte length of the chunk before encryption. */
-    originalSize: number;
-    /** AES-GCM ciphertext byte length (originalSize + 16 for the tag). */
-    ciphertextSize: number;
-    /** Number of RS data shards. */
-    dataShards: number;
-    /** Number of RS parity shards. */
-    parityShards: number;
-    /** Length in bytes of every shard (data and parity are equal). */
-    shardSize: number;
-    /** SHA-256 (hex) of each shard's ciphertext bytes, in shard order. */
-    shardHashes: string[];
-    /** Per-chunk AES-256-GCM key + IV. Plain in the manifest — gating happens at the SpaceDO. */
-    cipher: ChunkKeyMaterial;
+declare class Poseidon {
+    static hash(inputs: Field[]): Promise<Field>;
 }
+declare function encodeToHex(field: Field): string;
+declare function decodeFromHex(hexStr: string): Field;
+interface CircuitBufferConfig {
+    wasm: Uint8Array;
+    zkey: Uint8Array;
+    verificationKey: VerificationKey;
+}
+declare class HashKnowledge {
+    private static wasmBuffer?;
+    private static zkeyBuffer?;
+    private static verificationKey?;
+    static setCircuitBuffers(wasm: Uint8Array, zkey: Uint8Array, verificationKey: VerificationKey): void;
+    static compile(): Promise<ZkCompiled>;
+    static prove(secret: Field): Promise<{
+        proof: SnarkProof;
+        publicSignals: string[];
+    }>;
+    static verify(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
+}
+declare class PreimagePoK {
+    private static wasmBuffer?;
+    private static zkeyBuffer?;
+    private static verificationKey?;
+    static setCircuitBuffers(wasm: Uint8Array, zkey: Uint8Array, verificationKey: VerificationKey): void;
+    static compile(): Promise<ZkCompiled>;
+    static prove(publicInput: AuthPublicInput, secret: Field, salt: Field, ecdsaPub: Field): Promise<{
+        proof: SnarkProof;
+        publicSignals: string[];
+    }>;
+    static verify(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
+}
+declare function verifyHashKnowledge(proof: SnarkProof, expectedOutput?: Field, publicSignals?: string[]): Promise<boolean>;
+declare function verifyPreimagePoK(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
+declare function verify(programType: 'HashKnowledge' | 'PreimagePoK', proof: SnarkProof, options?: {
+    expectedOutput?: Field;
+    publicSignals?: string[];
+}): Promise<boolean>;
+declare function quickVerify(program: typeof HashKnowledge | typeof PreimagePoK, proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
+declare function initializeCircuits(config: {
+    hashKnowledge?: CircuitBufferConfig;
+    preimagePoK?: CircuitBufferConfig;
+}): void;
+declare function compilePrograms(): Promise<{
+    hashKnowledge: ZkCompiled;
+    preimagePoK: ZkCompiled;
+}>;
+
+interface AuthToken {
+    peerId: string;
+    timestamp: number;
+    signature: string;
+}
+declare class Authenticator {
+    private trustedKeys;
+    private zkVerificationKey;
+    initializeZK(): Promise<void>;
+    getZKVerificationKey(): VerificationKey | null;
+    addTrustedServer(serverId: string, publicKey: CryptoKey): void;
+    generateAuthToken(peerId: string, privateKey: CryptoKey): Promise<AuthToken>;
+    verifyAuthToken(token: AuthToken, clientPublicKey: CryptoKey): Promise<boolean>;
+    verifyZKProof(proof: any, publicInput: AuthPublicInput, storedCommitment: Field, ecdsaPub: CryptoKey): Promise<boolean>;
+}
+
+declare class DoubleRatchetManager {
+    private sessions;
+    private sessionStates;
+    private keyStore;
+    private _authenticator;
+    private registeredUsers;
+    private id;
+    constructor(id: string);
+    get authenticator(): Authenticator;
+    addTrustedServer(serverId: string, publicKey: CryptoKey): Promise<void>;
+    registerZK(clientId: string, secret: Field, salt: Field, ecdsaPub: CryptoKey): Promise<void>;
+    performHandshake(senderId: string, recipientId: string, zkProof: any, publicInput: AuthPublicInput, clientPublicKey: CryptoKey, // ECDH pub for session
+    clientAuthPublicKey: CryptoKey, // ECDSA pub for auth
+    authToken: AuthToken): Promise<void>;
+    initializeSession(senderId: string, recipientId: string, isClient?: boolean, sessionType?: 'global' | 'specific', sessionId?: string, zkProof?: any, publicInput?: AuthPublicInput, clientPublicKey?: CryptoKey, clientAuthPublicKey?: CryptoKey, clientEcdhPrivateKey?: CryptoKey, clientAuthPrivateKey?: CryptoKey): Promise<string>;
+    encrypt(senderId: string, recipientId: string, sessionId: string, plaintext: string, newDhKey?: boolean, sessionType?: 'global' | 'specific'): Promise<CipherMessage>;
+    decrypt(message: CipherMessage, isClient?: boolean): Promise<string>;
+    getSessionSharedSecret(sessionId: string): Promise<Uint8Array | null>;
+    private saveState;
+    private loadState;
+}
+
 /**
- * Top-level manifest for a single stored file. Persisted in the user's
- * SharedSpace by file id; readable / writable per the space's ACL.
+ * HTTP client for the accelerator's `/api/auth/*` endpoints.
+ *
+ * Owns the wire shapes for register / challenge / authenticate / verify so
+ * the React SPA (and any future consumers) don't reimplement them. The ZK
+ * identity derivation + Groth16 proof generation stay on the application
+ * side — this client handles only the round-trips.
+ *
+ * Mirrors `PersonalSpaceClient` / `ShardClient` / `SharedSpaceClient`: takes
+ * a `baseUrl`, optional custom `fetch`, throws typed `Error`s on failure
+ * (with the worker's message inlined where available).
  */
-interface FileManifest {
-    /** Stable file ID. Assigned by the SDK at write time; used to read or delete. */
+
+interface ZkRegisterRequest {
+    username: string;
+    /** Decimal-string Poseidon commitment. */
+    commitment: string;
+    /** Base64-encoded raw uncompressed ECDH public key (SEC1 0x04‖X‖Y). */
+    ecdhPublicKey: string;
+    /** Base64-encoded raw uncompressed ECDSA public key. */
+    ecdsaPublicKey: string;
+    email?: string | null;
+}
+interface ZkRegisterResponse {
+    success: boolean;
+}
+interface ZkChallengeResponse {
+    challengeId: string;
+    /** Hex-encoded random nonce — caller reduces into a BN254 field element for the proof. */
+    nonce: string;
+    /** Decimal-string Poseidon commitment the server has on file for this user. */
+    commitment: string;
+}
+interface ZkAuthenticateRequest {
+    challengeId: string;
+    proof: {
+        commitment: string;
+        /** Original hex nonce from the challenge (NOT the field-reduced version). */
+        nonce: string;
+        response: {
+            proof: Groth16Proof;
+            publicSignals: string[];
+        };
+        /** Base64 ECDSA-SHA256 signature over `JSON.stringify(response.proof)`. */
+        signature: string;
+    };
+    rememberMe?: boolean;
+}
+interface AuthSuccess {
+    token: string;
+    username: string;
+}
+/** A vault factor record (M1.0 + M2 gated types). Wrap/iv are base64 AES-GCM; absent for phrase. */
+interface VaultFactor {
     id: string;
-    /** Human-readable filename (display only — not used by the shard store). */
-    name: string;
-    /** Total plaintext byte length. Sum of chunk `originalSize`s. */
-    size: number;
-    /** MIME type the application supplied at write time. Opaque to storage. */
-    type: string;
-    /** Optional virtual path / folder hint for the application. */
-    path?: string;
-    /** When the file was last modified per the application (ms epoch). */
-    lastModified: number;
-    /** When this manifest was created on the SDK side (ms epoch). */
-    createdAt: number;
-    /** Ordered list of chunks. Concatenate them in index order to rebuild the file. */
-    chunks: ChunkManifest[];
-    /** SDK schema version. Bump on breaking manifest-shape changes. */
-    version: 1;
+    type: "password" | "passkey" | "phrase-marker" | "email" | "google" | "device";
+    wrap?: string;
+    iv?: string;
+    params?: Record<string, unknown>;
+    label?: string;
+    createdAt?: number;
+    /** Display hint for gated factors ("m•••@gmail.com") — list responses only. */
+    masked?: string;
+    /** Passkey's origin (RP id) — list responses only. A passkey only unlocks
+     *  from this host or a subdomain of it, so apps on several hosts enroll one
+     *  per origin. */
+    rpId?: string;
+}
+interface AuthClientOptions {
+    /** Absolute URL of the accelerator worker (no trailing slash required). */
+    baseUrl: string;
+    /** Optional custom fetch — defaults to `globalThis.fetch`. */
+    fetch?: typeof fetch;
+}
+declare class AuthClient {
+    private readonly baseUrl;
+    private readonly fetchFn;
+    constructor(opts: AuthClientOptions);
+    /** Submit ZK registration. Caller has already derived the identity + commitment. */
+    register(req: ZkRegisterRequest): Promise<ZkRegisterResponse>;
+    /** Request an auth challenge for `username` (server issues a fresh nonce). */
+    getChallenge(username: string): Promise<ZkChallengeResponse>;
+    /** Trade a challenge + proof for a session token. */
+    authenticate(req: ZkAuthenticateRequest): Promise<AuthSuccess>;
+    /**
+     * Validate a previously stored session token. Returns `{ username }` on
+     * success; throws on 401/404 — caller uses that to drop a stale token
+     * when restoring a session after a reload.
+     */
+    verify(token: string): Promise<{
+        username: string;
+    }>;
+    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
+    oprfEvaluate(username: string, blinded: string): Promise<{
+        evaluated: string;
+    }>;
+    /**
+     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
+     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
+     * domains' evaluations. The recover token is consumed by this call.
+     */
+    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string): Promise<{
+        evaluated: string;
+        evaluated2: string;
+    }>;
+    /**
+     * Request an email OTP. With a session `token` this is the ENROLL flow
+     * (code sent to `email`); without one it's RECOVER (code sent to the
+     * account's enrolled address — the response is uniform either way).
+     */
+    emailOtpStart(opts: {
+        token?: string;
+        email?: string;
+        username?: string;
+    }): Promise<void>;
+    /** Trade an emailed code for a single-use verifyToken (+ the proven address). */
+    emailOtpVerify(opts: {
+        code: string;
+        token?: string;
+        username?: string;
+    }): Promise<{
+        verifyToken: string;
+        email: string;
+    }>;
+    /**
+     * Verify a Google ID token (M2.3). With a session `token` it's the ENROLL
+     * gate; without, it's RECOVER/LOGIN (the Google account must already be
+     * linked). Returns a single-use verifyToken bound to the account's `sub`.
+     */
+    googleVerify(opts: {
+        idToken: string;
+        token?: string;
+        username?: string;
+    }): Promise<{
+        verifyToken: string;
+        sub: string;
+        emailHint: string | null;
+    }>;
+    /** Mint a single-use authorization code for an app (called by the hosted page; session-authed). */
+    grant(token: string, body: {
+        appId: string;
+        redirectUri: string;
+        codeChallenge: string;
+        sealedKeys: string;
+    }): Promise<{
+        code: string;
+    }>;
+    /** Exchange an authorization code + PKCE verifier for the session + sealed key material. */
+    token(body: {
+        code: string;
+        codeVerifier: string;
+        appId?: string;
+    }): Promise<{
+        sessionToken: string;
+        username: string;
+        commitment: string;
+        sealedKeys: string;
+        appId: string;
+    }>;
+    /**
+     * Read a factor record for `username` (returns an indistinguishable decoy if
+     * absent). Gated types (email) require the recover `verifyToken`.
+     */
+    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string, 
+    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
+     *  passkey instead of whichever was enrolled first (which WebAuthn would
+     *  refuse). Ignored for other factor types. */
+    rpId?: string, 
+    /** Device factors are selected by id — a user may have many machines. */
+    factorId?: string): Promise<{
+        factor: VaultFactor | null;
+    }>;
+    /**
+     * Add/replace a factor (session-authed; the seed is already wrapped
+     * client-side). Email factors additionally require (and consume) the
+     * enroll `verifyToken`; the stored address must be the verified one.
+     */
+    vaultPutFactor(token: string, factor: VaultFactor, verifyToken?: string): Promise<{
+        ok: boolean;
+        id: string;
+    }>;
+    /** List the user's factor metadata (no ciphertext). Session-authed. */
+    vaultFactors(token: string): Promise<{
+        factors: VaultFactor[];
+        migrated: boolean;
+    }>;
+    /** Remove a factor by id (can't remove the last one). Session-authed. */
+    vaultDeleteFactor(token: string, id: string): Promise<{
+        deleted: boolean;
+    }>;
+    private json;
+    private parse;
+}
+
+/**
+ * Deterministic ZK identity derivation from `(username, password)`.
+ *
+ * Same inputs on ANY device produce the same secret, salt, and P-256
+ * ECDSA + ECDH keypairs — which is what makes federated login from a
+ * fresh browser possible. There is no localStorage involvement: every
+ * register and login call re-derives the identity on demand.
+ *
+ * Pipeline:
+ *   master_seed = PBKDF2-SHA256(password, "muhkoo-zk-v1:" || username, 200k iters)
+ *   secret      = HKDF-Expand-SHA256(master_seed, "zk-secret",  32 bytes) → hex
+ *   salt        = HKDF-Expand-SHA256(master_seed, "zk-salt",    32 bytes) → hex
+ *   ecdsa_priv  = HKDF-Expand-SHA256(master_seed, "ecdsa-priv", 32 bytes)
+ *   ecdh_priv   = HKDF-Expand-SHA256(master_seed, "ecdh-priv",  32 bytes)
+ *
+ * P-256 public points are computed via `@noble/curves` (WebCrypto has no
+ * derive-public-from-private-scalar API), then both keypairs are imported
+ * into SubtleCrypto in JWK form so the rest of the crypto stack can keep
+ * using `crypto.subtle.sign` / `crypto.subtle.deriveBits`.
+ *
+ * Originally lived in `accelerator/public/js/zk-identity.js` and was ported
+ * to `muhkoo/web/src/zk/identity.ts`; consolidated here so the SDK owns
+ * identity derivation end-to-end.
+ */
+interface ZkIdentity {
+    /** 32-byte secret, hex-encoded. Private witness for the ZK circuit. */
+    secretHex: string;
+    /** 32-byte salt, hex-encoded. Private witness for the ZK circuit. */
+    saltHex: string;
+    /** P-256 ECDSA keypair, used to sign auth proofs. */
+    ecdsaKeyPair: CryptoKeyPair;
+    /** P-256 ECDH keypair, used by the chat ratchet. */
+    ecdhKeyPair: CryptoKeyPair;
+}
+/**
+ * Derive a deterministic ZK identity from `(username, password)`.
+ *
+ * Same inputs always produce the same identity, on any device — that's
+ * what makes federated login work without dragging encrypted state across
+ * devices.
+ */
+declare function deriveIdentity(username: string, password: string): Promise<ZkIdentity>;
+/**
+ * Legacy master-seed derivation: `PBKDF2(password, "muhkoo-zk-v1:"||username)`.
+ *
+ * This was the *only* path pre-vault, where the identity descended directly from
+ * the password. It's kept so existing accounts still re-derive their seed (and
+ * the vault can adopt that exact seed on migration, preserving the commitment).
+ * New accounts use a random seed (`vault.randomSeed`) instead, so their identity
+ * is no longer a function of the password.
+ */
+declare function deriveMasterSeedFromPassword(username: string, password: string): Promise<Uint8Array>;
+/**
+ * Derive the (unchanged) ZK identity from a 32-byte **master seed**. The seed is
+ * HKDF-expanded into secret/salt + the P-256 ECDSA & ECDH keypairs exactly as
+ * before — so the resulting commitment is byte-identical for a given seed. The
+ * vault wraps THIS seed under each recovery factor.
+ */
+declare function deriveIdentityFromSeed(seed: Uint8Array): Promise<ZkIdentity>;
+
+/**
+ * Poseidon hash wrapper used by the ZK auth flow.
+ *
+ * Backed by `circomlibjs`'s `buildPoseidon`. Builder is lazy and cached
+ * because the JS-side Babyjubjub field reps take ~100ms to construct, and
+ * we'd rather not pay that on every page load.
+ *
+ * Returns hashes as decimal-string BigInts — same format snarkjs and the
+ * `preimagePoK` circuit expect for inputs.
+ *
+ * Note: circomlibjs is `optionalDependencies` in connect's package.json.
+ * Consumers that use the ZK auth flow (browser/server, not workers) need
+ * it installed. The workers build does not import this module.
+ */
+/**
+ * Poseidon-hash `inputs` and return the result as a decimal-string BigInt.
+ * Inputs are converted to BigInt — pass either bigints, numbers, or numeric
+ * strings.
+ */
+declare function poseidonHash(inputs: Array<bigint | string | number>): Promise<string>;
+
+/**
+ * Integrity pinning for the ZK circuit artifacts.
+ *
+ * THE PROBLEM. `generateAuthProof` hands the user's `secret` and `salt` — the
+ * inputs the whole zero-knowledge design exists to keep on the device — to a
+ * witness generator downloaded at runtime from the accelerator. That is the
+ * party the proof is meant to convince. With no integrity check, a malicious or
+ * compromised server serves a modified `preimagePoK.wasm` that copies `secret`
+ * into a public-signal slot (public signals are just `witness[1..nPublic]`), and
+ * the client forwards them without ever comparing against what it computed
+ * locally. The server then derives the `client.kv` at-rest key through
+ * `StorageCipher` and decrypts everything it stores. Controlling the `.zkey` is
+ * just as bad by itself: a subverted CRS breaks Groth16's zero-knowledge
+ * property outright.
+ *
+ * THE FIX. Fetch the bytes here, SHA-256 them against digests pinned at build
+ * time, and hand snarkjs verified BUFFERS rather than a URL it will fetch for
+ * itself. snarkjs accepts `Uint8Array` for both artifacts.
+ *
+ * THREAT-MODEL BOUNDARY, and why local paths are exempt. The attack is "a
+ * SERVER serves you a modified artifact". A filesystem path is not
+ * server-controlled — it is the caller's own machine — so non-`http(s)`
+ * specifiers pass through untouched (this is also what lets tests point at
+ * `circuits/build/` directly, where snarkjs reads them as paths under Node).
+ * Anything fetched over the network must be pinned, or explicitly opted out of
+ * with {@link CircuitIntegrity.allowUnpinned}.
+ *
+ * There is deliberately NO silent fallback. An unpinned `https:` URL throws
+ * rather than quietly proving with unverified bytes — the failure mode this
+ * codebase already has elsewhere (see the SHA-256-for-Poseidon substitution in
+ * `crypto/ZeroKnowledge.ts`) is exactly what makes a security control useless.
+ */
+/**
+ * SHA-256 of the `preimagePoK` artifacts this SDK version was built against.
+ *
+ * Verified identical to what the accelerator serves from
+ * `public/circuits/build/` at the time of pinning. **If the circuit is ever
+ * recompiled, these must be regenerated in the same commit as
+ * `PREIMAGE_POK_VERIFICATION_KEY`, or every login fails closed** — which is the
+ * intended direction for a mismatch.
+ *
+ * Regenerate with:
+ *   shasum -a 256 circuits/build/preimagePoK_js/preimagePoK.wasm \
+ *                 circuits/build/preimagePoK_0001.zkey
+ */
+declare const PINNED_CIRCUIT_DIGESTS: {
+    readonly preimagePoKWasm: "9230ce3a883ca11e618639ac14fe0048b5dc4491c77b1dde3e41eb0896c33e10";
+    readonly preimagePoKZkey: "087f4ef09b6afbacad8e47b0029ded408a0ac3b5c9d5a1624e94c06bc258b871";
+};
+/** Integrity options carried alongside a circuit URL. */
+interface CircuitIntegrity {
+    /** Expected SHA-256 of the witness generator, lowercase hex. */
+    wasmSha256?: string;
+    /** Expected SHA-256 of the proving key, lowercase hex. */
+    zkeySha256?: string;
+    /**
+     * Proceed without verification for network-fetched artifacts.
+     *
+     * DANGEROUS: it re-opens the attack described in this module's docs. Only
+     * for local development against a circuit you compiled yourself and have
+     * not yet pinned.
+     */
+    allowUnpinned?: boolean;
+}
+/** Thrown when a fetched artifact does not match its pinned digest. */
+declare class CircuitIntegrityError extends Error {
+    readonly url: string;
+    readonly expected: string;
+    readonly actual: string;
+    constructor(url: string, expected: string, actual: string);
+}
+
+/**
+ * Groth16 proof generation for the `preimagePoK` circuit.
+ *
+ * The circuit proves knowledge of `(secret, salt, ecdsaPub)` such that
+ *   commitment = Poseidon(secret, salt, Poseidon(ecdsaPub))
+ * while only revealing `(commitment, nonce, ecdsaPubHash)` as public signals.
+ *
+ * Circuit assets (wasm + zkey) are served by the accelerator worker. Their
+ * URLs are a required argument of {@link generateAuthProof} — there is no
+ * default. The web app constructs them relative to its configured worker
+ * `baseUrl` so the SPA can target either the local wrangler dev or a deployed
+ * worker depending on `VITE_WORKER_URL`.
+ */
+
+interface CircuitUrls extends CircuitIntegrity {
+    /** preimagePoK.wasm — the circuit's witness generator. */
+    wasmUrl: string;
+    /** preimagePoK_0001.zkey — the proving key. */
+    zkeyUrl: string;
+}
+/**
+ * Canonical {@link CircuitUrls} for the `preimagePoK` login circuit, anchored
+ * at a base URL where the accelerator serves the circuit assets out of
+ * `circuits/build/`. The filenames here are fixed by the circom build output
+ * (the witness generator lands inside a `preimagePoK_js/` directory); callers
+ * shouldn't hard-code them. `Client` uses this to default its `circuits`
+ * option, and `PersonalSpaceClient` consumers can pass `defaultCircuitUrls(baseUrl)`.
+ */
+declare function defaultCircuitUrls(baseUrl: string): CircuitUrls;
+/**
+ * Reduce any hex/decimal/byte input to a decimal-string field element in
+ * `[0, FIELD_SIZE)`. snarkjs and the `preimagePoK` circuit both want decimal
+ * strings; everything else gets normalized here.
+ *
+ * **Behavior is intentionally byte-for-byte compatible with the legacy
+ * `accelerator/public/js/zk-snarkjs-client.js#toField`.** Diverging produces
+ * different commitments than accounts registered via the legacy flow,
+ * which locks those users out forever — the worker stores whatever
+ * commitment the client sent at register time and compares it as a string
+ * at login time.
+ *
+ * In particular: a 32+ char string of hex chars is always treated as hex,
+ * even if every character happens to be 0-9 with no a-f letters. An
+ * earlier version of this function gated the hex branch on "has at least
+ * one letter" — that broke the digit-only-hex edge case (rare in practice,
+ * but real). DO NOT add that letter check back.
+ */
+declare function toField(value: string | bigint | number): string;
+/**
+ * Build the user's Poseidon commitment binding `(secret, salt, ecdsaPubHash)`.
+ * Same formula the worker verifies against on register and authenticate.
+ */
+declare function buildCommitment(secretHex: string, saltHex: string, ecdsaPubHex: string): Promise<string>;
+/**
+ * Generate a Groth16 proof for the `preimagePoK` circuit. Public signals end
+ * up `[commitment, nonce, ecdsaPubHash]` — the worker checks the commitment
+ * matches the stored one and the nonce matches the issued challenge nonce
+ * reduced into the field.
+ *
+ * Throws if circuit URLs are unreachable or snarkjs decides the inputs are
+ * malformed.
+ */
+declare function generateAuthProof(args: {
+    secretHex: string;
+    saltHex: string;
+    ecdsaPubHex: string;
+    nonceHex: string;
+    /** Required — caller supplies URLs scoped to the worker they want to talk to. */
+    circuits: CircuitUrls;
+}): Promise<{
+    proof: Groth16Proof;
+    publicSignals: string[];
+    commitment: string;
+    nonceField: string;
+    ecdsaPubHash: string;
+}>;
+
+/**
+ * Conversions between SubtleCrypto `CryptoKey`s and the wire formats the
+ * accelerator's auth endpoints + `preimagePoK` circuit expect.
+ *
+ * Two outputs we need from an ECDSA `CryptoKey`:
+ *   - **base64 raw**  — passed to `/api/auth/zk-register` as
+ *                       `ecdsaPublicKey` / `ecdhPublicKey`. (Name is historical;
+ *                       the legacy client called it `exportPublicKeyToBase58`
+ *                       but actually used base64 — kept as base64.)
+ *   - **hex raw**     — fed to the proof as `ecdsaPub` input; the circuit
+ *                       reduces it into a field element.
+ *
+ * Both go through `crypto.subtle.exportKey("raw", ...)` which yields the
+ * uncompressed SEC1 form (`0x04 || X || Y`).
+ */
+/** Raw uncompressed (`0x04 || X || Y`) public key bytes, as lowercase hex. */
+declare function exportPublicKeyHex(publicKey: CryptoKey): Promise<string>;
+/** Raw uncompressed public key as base64 — wire format for the auth endpoints. */
+declare function exportPublicKeyBase64(publicKey: CryptoKey): Promise<string>;
+/** Sign a UTF-8 `message` with an ECDSA private key. Returns base64. */
+declare function signMessage(message: string, privateKey: CryptoKey): Promise<string>;
+
+/**
+ * Hosted-auth handoff crypto (auth.muhkoo.dev — AUTH_HOSTED_PLAN.md §3).
+ *
+ * The hosted page authenticates the user and ends up holding the master seed.
+ * To pass it to the developer's app without it ever sitting server-readable or
+ * landing in browser history:
+ *
+ *   1. {@link sealSeed} generates a one-time key K_t, AES-256-GCM-seals the seed
+ *      under it, and returns the ciphertext envelope (`sealedKeys`, stored in
+ *      the grant the server relays but can't read) plus K_t (`fragmentKey`,
+ *      placed ONLY in the redirect URL fragment — fragments never hit a server).
+ *   2. The app exchanges the code for `sealedKeys`, reads K_t from the fragment,
+ *      and {@link unsealSeed} recovers the seed, then strips the fragment.
+ *
+ * Trust-equivalent to today's embedded SDK (the app still ends up with the
+ * seed) while moving credential entry onto the Muhkoo origin. The envelope is
+ * versioned so a future per-app-key handoff (v2) can swap in without a protocol
+ * change.
+ *
+ * ## v2 — device pairing (TV / no-redirect handoff)
+ *
+ * v1's K_t rides in the redirect URL *fragment*, which works only because the
+ * receiving app is a browser page that can read `location.hash`. A TV app has
+ * no redirect to receive: it polls. So v2 keeps the *entire* v1 shape — the
+ * server relays a sealed envelope it cannot read — and replaces only the key
+ * agreement:
+ *
+ *   - the TV generates an ephemeral P-256 ECDH keypair in memory and publishes
+ *     the public half ({@link generateDevicePairingKeypair});
+ *   - the hosted page (the component that already holds the unlocked seed and
+ *     already owns sealing) seals *to that public key* with a fresh ephemeral
+ *     keypair of its own ({@link sealSeedToDevice}) — ECDH → HKDF-SHA256 →
+ *     AES-256-GCM;
+ *   - the TV recovers the seed with its private key
+ *     ({@link unsealSeedFromDevice}).
+ *
+ * The server stores and relays the v2 envelope byte-for-byte, exactly as it
+ * does for v1, and can read neither. The one thing ECDH cannot supply is proof
+ * that the public key the hosted page sealed to is *the TV's* rather than an
+ * attacker's — that is what {@link pairingVerificationCode} is for, and it is
+ * the only MITM defence in the flow (see the entropy note on that function).
+ */
+interface SealedHandoff {
+    /** base64 JSON envelope — relayed by the server in the grant; server-opaque. */
+    sealedKeys: string;
+    /** base64url one-time key — rides ONLY in the redirect URL fragment. */
+    fragmentKey: string;
+}
+/** Seal the master seed under a fresh one-time key for the redirect handoff. */
+declare function sealSeed(seed: Uint8Array): Promise<SealedHandoff>;
+/** Recover the master seed from the sealed envelope + the fragment key. */
+declare function unsealSeed(sealedKeys: string, fragmentKey: string): Promise<Uint8Array>;
+/**
+ * Alphabet for the pairing verification code: 30 symbols, every confusable pair
+ * removed in BOTH directions — no `0`/`O`, no `1`/`I`/`L`, and no `U` (which is
+ * read as `V` on the low-resolution, far-viewed type a TV renders). Because the
+ * user compares this string across two screens by eye, unambiguity beats the
+ * convenience of a power-of-two alphabet; the derivation below rejection-samples
+ * to avoid the modulo bias that costs us.
+ */
+declare const PAIRING_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTVWXYZ23456789";
+/** Length of the pairing verification code, in characters. 30^8 ≈ 39.3 bits. */
+declare const PAIRING_CODE_LENGTH = 8;
+/** An ephemeral ECDH keypair generated by the pairing device (the TV). */
+interface DevicePairingKeypair {
+    /** base64 raw (SEC1 uncompressed, 65 bytes) public key — safe to publish. */
+    publicKeyB64: string;
+    /**
+     * Non-extractable private half. In-memory only, one per pairing attempt:
+     * it is never persisted and never leaves the device, so a captured pairing
+     * transcript is undecryptable once the attempt ends.
+     */
+    privateKey: CryptoKey;
+}
+/**
+ * (Device side) Generate the ephemeral P-256 ECDH keypair for one pairing
+ * attempt. Call this once per attempt and throw it away when the attempt ends —
+ * reusing a keypair across attempts would let an old, observed ciphertext be
+ * decrypted by whoever later obtains the key.
+ */
+declare function generateDevicePairingKeypair(): Promise<DevicePairingKeypair>;
+/**
+ * (Hosted-page side) Seal the master seed *to a device's* pairing public key.
+ *
+ * A fresh ephemeral keypair is generated per call and its public half is
+ * carried in the envelope (`epk`), so sealing the same seed to the same device
+ * twice yields unrelated ciphertext — and the sealer retains nothing that could
+ * later reopen the envelope.
+ *
+ * Returns the v2 `sealedKeys` string, which slots into exactly the same server
+ * field as v1: relayed verbatim, never read.
+ */
+declare function sealSeedToDevice(seed: Uint8Array, devicePublicKeyB64: string): Promise<string>;
+/**
+ * (Device side) Recover the master seed from a v2 envelope using the ephemeral
+ * private key from {@link generateDevicePairingKeypair}.
+ *
+ * Throws on any tamper: a substituted `epk` yields a different shared secret
+ * (or fails point validation outright), and any edit to `iv`/`ct` fails the
+ * AES-GCM tag. There is no path that returns partially-authenticated bytes.
+ *
+ * `devicePublicKeyB64` is the caller's OWN public half (from
+ * {@link generateDevicePairingKeypair}). It is required, not optional, because
+ * it is mixed into the KDF — see {@link deriveDeviceSealKey} for why binding the
+ * recipient matters. A device always holds both halves, so this costs nothing.
+ */
+declare function unsealSeedFromDevice(sealedKeys: string, privateKey: CryptoKey, devicePublicKeyB64: string): Promise<Uint8Array>;
+/**
+ * Short code derived deterministically from the device's pairing public key,
+ * displayed on BOTH the TV and the approving browser so the human can confirm
+ * they match before approving.
+ *
+ * ## What this is worth (be honest about it)
+ *
+ * ~39.3 bits (30^8), rendered in an unambiguous 30-symbol alphabet and grouped
+ * as `XXXX-XXXX` for comparison. Alongside the recipient-key binding in
+ * {@link deriveDeviceSealKey}, this is what stops a substituted device key: the
+ * KDF rejects a *negated* key, and this code is what a human uses to reject a
+ * wholly *attacker-generated* one, which the crypto cannot detect on its own —
+ * ECDH proves nothing about WHOSE public key it is.
+ *
+ * Two attacks, and what each actually costs:
+ *
+ *   1. **Online grind.** Generate keypairs until one's code equals the honest
+ *      TV's. ~2^39 trials. Naively that reads as "keygen + hash", but a real
+ *      attacker never generates keys: walking `P_{i+1} = P_i + G` while tracking
+ *      `d_i = d_0 + i` makes each trial one point-add plus one derivation. With
+ *      a plain hash that is well under a core-day — which is why this uses
+ *      PBKDF2-SHA256 at {@link PAIRING_CODE_ITERATIONS} iterations instead. The
+ *      work factor applies per trial, pushing the same grind to the order of
+ *      10^5 core-days. The target is also only learned when pairing starts, so
+ *      the grind is online against the pairing TTL (keep it minutes).
+ *   2. **Precomputed table.** The reason this is not a plain hash. A table over
+ *      candidate keys is computed once and reused forever; with SHA-256 that is
+ *      cheap enough to be the preferred attack. The iteration count multiplies
+ *      the table's build cost by the same 2 * 10^5.
+ *
+ * Neither is a proof of security, and an adversary with ASIC-scale hardware
+ * changes these numbers. If the margin is ever judged insufficient, raise
+ * {@link PAIRING_CODE_LENGTH} — 10 characters buys ~49 bits for two more
+ * characters of human comparison, and is display-only: it does not touch the
+ * envelope or the wire format.
+ *
+ * The cost is paid once per pairing, on two idle devices, so ~200k iterations
+ * is imperceptible here in a way it would not be on a hot path.
+ */
+declare function pairingVerificationCode(devicePublicKeyB64: string): Promise<string>;
+interface Pkce {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/** Generate a PKCE verifier + S256 challenge for the authorize→token exchange. */
+declare function generatePkce(): Promise<Pkce>;
+/** A random URL-safe value for the OAuth `state` (CSRF binding on the callback). */
+declare function randomState(): string;
+
+/**
+ * `deviceStore` — at-rest persistence for a paired device (the TV).
+ *
+ * A device that has completed {@link HostedAuth.startDevicePairing} holds the
+ * account's **master seed**. Android WebView has no WebAuthn, so the passkey
+ * wrapping used elsewhere isn't available, and re-pairing on every cold start
+ * is not acceptable UX for a set-top box. So the seed is persisted, encrypted:
+ *
+ * | Item                     | Where                                | Form |
+ * | ------------------------ | ------------------------------------ | ---- |
+ * | wrapping key             | IndexedDB (`muhkoo.device.v1`)       | `CryptoKey`, AES-GCM-256, **non-extractable** |
+ * | device identity keypair  | IndexedDB (`muhkoo.device.v1`)       | `CryptoKeyPair`, ECDSA P-256, private half **non-extractable** |
+ * | sealed identity blob     | localStorage `muhkoo.tv.identity.v1` | `{"v":1,"iv":…,"ct":…}` over `JSON{username, commitment, seed(b64), pairedAt}` |
+ *
+ * The split is deliberate — ciphertext in one backend, key in another, and the
+ * key non-extractable so JS can *use* it but not export it.
+ *
+ * ## Be honest about what this is worth
+ *
+ * **This is obfuscation, not protection.** It raises the cost of a casual
+ * `localStorage` dump to "nothing useful", and that is all:
+ *
+ *   - **XSS on the device origin** cannot *exfiltrate* the wrapping key (it is
+ *     non-extractable) but can absolutely call `decrypt` and read the seed. The
+ *     only mitigation is that there is no third-party script in the shell —
+ *     enforce a strict CSP with no `unsafe-inline`, no CDN, no remote fonts.
+ *   - **ADB / root / a backup extraction / a forensic image recovers the seed.**
+ *     The IndexedDB LevelDB files hold the AES key bytes in the clear; WebCrypto
+ *     "non-extractable" is a JS-API boundary, not an OS one. **A stolen device is
+ *     a stolen identity.**
+ *
+ * That is not an implementation shortcut, it is the shape of the problem: any
+ * wrapping key usable without user interaction lives somewhere equally readable
+ * on a keyboard-less device with no hardware key store exposed to WebView.
+ * Reduce the blast radius with `android:allowBackup="false"`,
+ * `android:debuggable="false"`, a strict CSP, and by storing *only* the 32-byte
+ * seed + username + commitment (never a session token, never a recovery phrase).
+ *
+ * ## Documented upgrade path — no protocol change
+ *
+ * If the native shell exposes a Keystore bridge:
+ *
+ * ```java
+ * @JavascriptInterface public String wrap(String b64plain);    // AES-GCM, StrongBox when present
+ * @JavascriptInterface public String unwrap(String b64cipher);
+ * ```
+ *
+ * this module prefers `globalThis.MuhkooKeystore` automatically and falls back
+ * to the WebCrypto scheme otherwise. The Keystore key is hardware-backed and
+ * non-exportable at the OS level, so a copied filesystem image alone becomes
+ * useless. Nothing on the wire, in the endpoint contracts, or in the SDK surface
+ * changes — only the two functions below do, internally.
+ *
+ * ## Degradation
+ *
+ * Nothing here throws at import time. On a runtime with neither backend (SSR,
+ * Workers, Node) the module still loads: {@link loadDeviceIdentity} returns
+ * `null`, {@link persistDeviceIdentity} throws a typed
+ * {@link DeviceStoreUnavailableError} the caller can swallow, and
+ * {@link deviceIdentityKey} falls back to an **in-memory** keypair for the
+ * lifetime of the process (so pairing still works; the device is just never
+ * recognised as "known" on a later run).
+ */
+/** localStorage key holding the AES-GCM-sealed identity blob. */
+declare const DEVICE_IDENTITY_STORAGE_KEY = "muhkoo.tv.identity.v1";
+/** IndexedDB database holding the non-extractable keys. */
+declare const DEVICE_KEY_DB_NAME = "muhkoo.device.v1";
+/** What a paired device persists. The seed **is** the identity — treat it as such. */
+interface PersistedDeviceIdentity {
+    username: string;
+    /** Decimal-string Poseidon commitment. Pinned: a later pairing that yields a
+     *  different commitment for this device must be refused, not adopted. */
+    commitment: string;
+    /** The 32-byte master seed. */
+    seed: Uint8Array;
+    pairedAt: number;
+}
+/** Thrown when persistence is impossible (no IndexedDB and/or no localStorage). */
+declare class DeviceStoreUnavailableError extends Error {
+    constructor(what: string);
+}
+/** Key/value store for live `CryptoKey` objects (IndexedDB in the browser). */
+interface DeviceKeyVault {
+    get(id: string): Promise<unknown | null>;
+    put(id: string, value: unknown): Promise<void>;
+    /** Delete the entire store — used by `clearDeviceIdentity`. */
+    destroy(): Promise<void>;
+}
+/** String store for the sealed blob (localStorage in the browser). */
+interface DeviceBlobStore {
+    get(key: string): string | null;
+    set(key: string, value: string): void;
+    remove(key: string): void;
+}
+/** The native Keystore bridge, when the shell provides one (see module docs). */
+interface MuhkooKeystoreBridge {
+    wrap(b64plain: string): string | Promise<string>;
+    unwrap(b64cipher: string): string | Promise<string>;
 }
 /**
- * Lightweight summary returned by `FileStorage.writeFile` and surfaced in
- * directory-style listings. The full manifest is only fetched when actually
- * reassembling the file.
+ * Point the store at explicit backends (or `null` to force "unavailable"), and
+ * reset the memoized device keypair. Testing / embedding seam — pass `{}` to
+ * restore the default browser backends.
  */
-interface FileStat {
-    id: string;
-    name: string;
-    size: number;
-    type: string;
-    path?: string;
-    lastModified: number;
-    createdAt: number;
-    chunkCount: number;
-    shardCount: number;
-}
-/** Distil a `FileManifest` into a `FileStat`. */
-declare function manifestToStat(manifest: FileManifest): FileStat;
-
+declare function configureDeviceStore(opts?: {
+    keys?: DeviceKeyVault | null;
+    blobs?: DeviceBlobStore | null;
+    keystore?: MuhkooKeystoreBridge | null;
+}): void;
 /**
- * HTTP client for the open content-addressed shard store.
- *
- * Each shard is named by the lowercase hex SHA-256 of its ciphertext bytes.
- * The server verifies the hash on PUT, so the address authenticates the
- * contents — there's no benefit to ACLing PUT/GET, and making them open
- * enables cross-user dedup down the line.
- *
- * Wire protocol:
- *   PUT  /api/shards/:hash    body: shard bytes (application/octet-stream)
- *                             200 { ok: true, hash, size, dedup: boolean }
- *                             400 if hash doesn't match body
- *
- *   GET  /api/shards/:hash    200 with shard bytes (application/octet-stream)
- *                             404 if absent
+ * True when {@link deviceIdentityKey} had to fall back to an in-memory keypair
+ * because no key vault was available. Such a device can pair, but will never be
+ * recognised as "known" afterwards (so approval always needs a fresh factor).
+ */
+declare function deviceIdentityIsEphemeral(): boolean;
+/**
+ * The device's **persistent** ECDSA P-256 identity keypair, created on first
+ * call. This is not a browser fingerprint — it is a key, and every
+ * `POST /api/auth/device/code` proves possession of it. Without that proof,
+ * "known device" would be an unauthenticated string anyone could claim in order
+ * to skip the approver's re-authentication.
  *
- *   HEAD /api/shards/:hash    200 if present (no body) — used by callers to
- *                             skip a PUT they'd otherwise dedup-rewrite. The
- *                             server can ignore the optimization if it wants.
+ * The private half is non-extractable and never leaves IndexedDB as bytes.
  */
+declare function deviceIdentityKey(): Promise<CryptoKeyPair>;
+/** `base64url(SHA-256(raw SEC1 device identity public key))` — 43 chars. */
+declare function deviceFingerprint(): Promise<string>;
+/** Whether a sealed identity blob exists. Cheap: no crypto, no IndexedDB, no network. */
+declare function hasDeviceIdentity(): Promise<boolean>;
 /**
- * A content-addressed byte cache for shards (the offline layer's `ShardCache`
- * satisfies this structurally). Declared here as a minimal interface so the
- * storage layer doesn't import the offline module — keeping the dependency
- * arrow one-way (offline → storage).
+ * Seal and store the identity. Throws {@link DeviceStoreUnavailableError} when
+ * there is nowhere to put it — callers should treat that as "this device won't
+ * resume", not as a pairing failure.
  */
-interface ShardByteCache {
-    get(hash: string): Promise<Uint8Array | null>;
-    put(hash: string, bytes: Uint8Array): Promise<void>;
-}
+declare function persistDeviceIdentity(v: PersistedDeviceIdentity): Promise<void>;
 /**
- * A peer block source (the p2p layer's `PeerExchange` satisfies this
- * structurally). Consulted between the local cache and origin: a block fetched
- * from a peer is verified by hash before use. Declared here so the storage layer
- * doesn't import the p2p module (dependency arrow stays p2p → storage).
+ * Recover the persisted identity, or `null` when there is none / it can't be
+ * opened (wiped IndexedDB, a different browser profile, a corrupted blob).
+ * Never throws — a cold start with unreadable storage must fall back to a fresh
+ * pairing, not to an error screen.
  */
-interface PeerBlockSource {
-    getBlock(hash: string, opts?: {
-        timeoutMs?: number;
-    }): Promise<Uint8Array | null>;
-    announce(hash: string): void;
-}
-interface ShardClientOptions {
-    /** Base URL of the accelerator (e.g. `https://muhkoo-accelerator.workers.dev`). */
-    baseUrl: string;
-    /**
-     * Path prefix for the shard endpoints, joined to `baseUrl` before the
-     * hash. Defaults to `/api/shards`, which targets a global shard store
-     * (e.g. a dedicated `ShardStoreDO`). Pass a room-scoped value like
-     * `/api/spaces/{roomId}/shards` to keep shards bound to a specific
-     * `SharedSpaceDO` — that's the path the chat application uses today.
-     *
-     * Leading slash optional; trailing slash stripped. The final URL is
-     * always `${baseUrl}${normalizedPrefix}/${encodeURIComponent(hash)}`.
-     */
-    pathPrefix?: string;
-    /**
-     * Optional custom fetch implementation. Defaults to `globalThis.fetch`.
-     * Provided so callers can inject retries / auth / instrumentation.
-     */
-    fetch?: typeof fetch;
-    /**
-     * Optional offline byte cache. When present, GETs are served cache-first and
-     * populated on success, and PUTs write the cache before the network so a
-     * just-uploaded file reads back offline. See {@link ShardByteCache}.
-     */
-    cache?: ShardByteCache;
-    /**
-     * Coalesce concurrent origin reads into `POST {pathPrefix}/batch`. On by
-     * default: it is what keeps opening a project from costing one request per
-     * shard. Set false to force one-at-a-time — useful against a server without
-     * the route, though that is detected and handled automatically.
-     */
-    batchShards?: boolean;
-    /**
-     * Called when a PUT can't reach the network (offline). Lets the caller queue
-     * the upload for replay on reconnect; the bytes are already in {@link cache}
-     * keyed by `hash`, so only the hash needs recording.
-     */
-    deferUpload?: (hash: string) => Promise<void>;
-    /**
-     * Optional peer block source. When present, GETs try peers between the local
-     * cache and origin (peer blocks are verified by hash); PUTs announce the new
-     * block to peers. Best-effort — any failure falls through to origin.
-     */
-    peers?: PeerBlockSource;
-    /**
-     * When true, {@link ShardClient.putShard} returns as soon as the shard is
-     * written to {@link cache} and announced to {@link peers} — the origin PUT is
-     * fired in the BACKGROUND rather than awaited. This makes a large write's
-     * manifest available immediately (so a peer/worker can start pulling the
-     * shards over P2P right away) while origin catches up as a durable fallback.
-     * On a background-PUT failure the shard is handed to {@link deferUpload} (if
-     * present) for replay. Requires a {@link cache} so the bytes survive locally
-     * until the background upload lands. No-op without a cache.
-     */
-    backgroundUpload?: boolean;
-}
+declare function loadDeviceIdentity(): Promise<PersistedDeviceIdentity | null>;
 /**
- * Compute the lowercase hex SHA-256 of `bytes`. Available via WebCrypto in
- * every runtime this SDK targets.
+ * Wipe everything: the sealed blob **and** the whole key database — so the
+ * wrapping key never outlives the ciphertext it opens, and the device identity
+ * key is regenerated (a re-pair is then correctly treated as a new device).
  */
-declare function shardHash(bytes: Uint8Array): Promise<string>;
-declare class ShardClient {
-    private readonly baseUrl;
-    private readonly pathPrefix;
-    private readonly fetchFn;
-    private readonly cache?;
-    /** Hashes waiting for the next batch, each with everyone awaiting it. */
-    private pendingShards;
-    private batchTimer;
-    /** False once the server is known not to have the batch route. */
-    private batchSupported;
-    private readonly deferUpload?;
-    private readonly peers?;
-    private readonly backgroundUpload;
-    constructor(opts: ShardClientOptions);
-    /** Build the URL for a given shard hash — exposed for callers that want to log or pre-resolve. */
-    urlForHash(hash: string): string;
-    /**
-     * Upload a shard. The server verifies SHA-256(body) matches `:hash` and
-     * rejects with 400 if not, so the caller is the source of truth on
-     * naming. Re-uploading an existing shard is idempotent — the server
-     * returns `dedup: true` in that case.
-     */
-    putShard(hash: string, bytes: Uint8Array): Promise<{
-        dedup: boolean;
-    }>;
-    private bgActive;
-    private readonly bgQueue;
-    private static readonly BG_CONCURRENCY;
-    /** Queue a shard's origin PUT to run in the background under a concurrency
-     *  cap. Bytes are re-read from {@link cache} at upload time (not held in the
-     *  queue) so a large file's backlog doesn't pin a second copy in memory. */
-    private enqueueBackgroundUpload;
-    /** PUT the shard bytes to origin, verifying the server accepted them.
-     *  Used by the background-upload path; throws on network/HTTP failure. */
-    private uploadToOrigin;
-    /**
-     * Fetch a shard by hash. Throws if the server returns a non-200; returns
-     * `null` for 404 so callers can distinguish "missing" from "errored".
-     */
-    getShard(hash: string): Promise<Uint8Array | null>;
-    /**
-     * Fetch from origin, COALESCING concurrent requests into one batch.
-     *
-     * A shard is not a file. A project is thousands of small source modules,
-     * each split into shards, so reading one at a time made opening a project
-     * cost thousands of requests — 2,086 for a 519-file project. Latency, not
-     * bytes, is what that spends: Chromium took 18.4s over those requests and
-     * Brave, which filters every one, took 37.5s for identical work. Batching
-     * collapses whatever is in flight at the same moment into a single POST,
-     * which is why it helps most exactly where it hurt most.
-     *
-     * Callers are unchanged: `getShard` still asks for one shard and gets one
-     * shard. The window is a few milliseconds — long enough to gather the reads
-     * a concurrent walk issues together, short enough not to be felt by a lone
-     * read.
-     *
-     * Falls back permanently to one-at-a-time if the server has no batch route,
-     * so a new SDK keeps working against an older deployment.
-     */
-    private fetchFromOrigin;
-    /** Send one batch of whatever has accumulated, and settle those callers. */
-    private flushShardBatch;
-    /** Fetch a shard from origin. Returns `null` for 404 (or offline when a
-     *  cache is present, so RS recovery can proceed); throws otherwise. */
-    private fetchOneFromOrigin;
-    /**
-     * Check whether a shard exists. Lets the caller skip a PUT they'd otherwise
-     * dedup-rewrite. The server can implement this as a HEAD or return a small
-     * JSON body — we don't depend on either.
-     */
-    hasShard(hash: string): Promise<boolean>;
-}
+declare function clearDeviceIdentity(): Promise<void>;
 
 /**
- * HTTP client for the gated file-manifest store on a SharedSpace
- * (`/api/spaces/:spaceId/files`).
- *
- * A "file" in a space is its **manifest** (per-chunk keys + the SHA-256 of each
- * global shard). The shard bytes live in the open `/api/shards` store; the
- * manifest is the capability. This client only moves manifests in/out of the
- * space's gated store.
+ * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
+ *
+ * A passkey becomes a device-bound, platform-synced source of a stable secret:
+ * for a fixed salt, the authenticator's PRF returns the same 32 bytes, which we
+ * HKDF into an AES key that wraps the master seed. The server never sees the
+ * passkey — it's purely a local key source; the ZK proof remains the server auth.
+ *
+ * BROWSER ONLY (`navigator.credentials`). The PRF extension fields aren't in the
+ * standard DOM types yet, so they're reached through narrow casts.
+ */
+/** Whether this environment can do WebAuthn at all. (PRF support is checked at enroll.) */
+declare function passkeySupported(): boolean;
+/**
+ * Whether this browser's authenticator can do the **PRF extension** our passkey
+ * factor needs. A browser can save passkeys (e.g. for password autofill) yet not
+ * expose PRF — PRF is what derives the stable secret we wrap the seed under, so a
+ * passkey without it is useless to us.
+ *
+ * Uses `PublicKeyCredential.getClientCapabilities()` (the `extension:prf` cap)
+ * where available. Returns:
+ *   - `true`  — PRF is supported,
+ *   - `false` — definitively NOT supported (hide the option),
+ *   - `null`  — couldn't determine (older browser without the capabilities API);
+ *              the caller may optimistically allow and let enroll surface a real
+ *              error if it turns out PRF isn't there.
+ */
+declare function passkeyPrfCapable(): Promise<boolean | null>;
+/** Best-effort registrable RP id — the host. Apps spanning subdomains should pass
+ *  the parent domain (e.g. "muhkoo.dev") explicitly. */
+declare function defaultRpId(): string;
+/**
+ * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
  *
- * Authorization is **session-based**, consistent with the rest of the
- * SharedSpace (keyring, websocket): the SDK's credential-stamping `fetch`
- * (from {@link HttpClient}) attaches the app key + session token, the platform
- * validates the session and injects a trusted `X-Muhkoo-User-Context`, and the
- * DO authorizes on that + channel membership. There is no per-op Groth16 proof.
+ * WebAuthn only accepts an RP id that is the origin's own host or a registrable
+ * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
+ * `app.example.net`, and one enrolled on a full host is unusable from a sibling
+ * host. An app served on BOTH a custom domain and the platform host therefore
+ * needs one passkey per origin.
  *
- * Wire protocol (server: `SharedSpaceDO`):
- *   POST   /api/spaces/:spaceId/files            body: { manifest }  → { ok, fileId }
- *   GET    /api/spaces/:spaceId/files                                → { files: FileStat[] }
- *   GET    /api/spaces/:spaceId/files/:fileId                        → { manifest }
- *   DELETE /api/spaces/:spaceId/files/:fileId                        → { ok, existed }
+ * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
+ * a raw "The requested RPID did not match the origin or related origins", which
+ * is a dead end for the user. Checking first lets the caller fall back to normal
+ * sign-in (and offer to enroll a passkey for this origin) instead.
  */
-
-interface SharedSpaceClientOptions {
-    /** Base URL of the accelerator (e.g. `https://api.muhkoo.dev`). */
-    baseUrl: string;
-    /**
-     * Credential-stamping fetch — pass {@link HttpClient.fetch} so requests
-     * carry the app key + session token. Defaults to `globalThis.fetch`
-     * (unauthenticated; only useful in tests).
-     */
-    fetch?: typeof fetch;
-}
-declare class SharedSpaceClient {
-    private readonly baseUrl;
-    private readonly fetchFn;
-    constructor(opts: SharedSpaceClientOptions);
-    /** Write a file manifest into the space. Requires space membership. */
-    writeFileManifest(spaceId: string, manifest: FileManifest): Promise<void>;
-    /** Read a file manifest by id. Requires space membership. */
-    readFileManifest(spaceId: string, fileId: string): Promise<FileManifest>;
-    /** Delete a file manifest by id. Requires space membership. */
-    deleteFileManifest(spaceId: string, fileId: string): Promise<boolean>;
-    /** List file summaries in the space. Requires space membership. */
-    listFiles(spaceId: string): Promise<FileStat[]>;
-    private filesBase;
-    private jsonRequest;
-}
-
+declare function rpIdUsableForOrigin(rpId: string | undefined | null, host?: string): boolean;
 /**
- * `FileStorage` — top-level entry point for chunked, encrypted, erasure-coded
- * file storage.
+ * Would {@link AuthNamespace.loginWithPasskey} accept a factor recorded with
+ * this `rpId`, from `host`?
  *
- * Pipeline for writing a file:
- *   1. Split the plaintext into fixed-size chunks (default 4 MiB).
- *   2. For each chunk:
- *        a. Generate a fresh AES-256-GCM key + 12-byte IV (`ChunkCipher`).
- *        b. Encrypt the chunk → ciphertext (plaintext.length + 16 bytes tag).
- *        c. Reed–Solomon encode the ciphertext into `dataShards + parityShards`
- *           equal-length shards (`ReedSolomonCodec`).
- *        d. PUT every shard to the content-addressed shard store, keyed by
- *           SHA-256 of the shard bytes (`ShardClient`).
- *   3. Build a `FileManifest` listing every chunk's keys, IVs, sizes, and
- *      the SHA-256 of every shard in order.
+ * This is deliberately NOT the same as {@link rpIdUsableForOrigin}. That answers
+ * a raw WebAuthn question and is `false` for a missing rpId. But a factor with
+ * NO recorded rpId predates per-origin enrolment, and `loginWithPasskey`
+ * resolves it as `params.rpId ?? host` — so it IS usable, from anywhere.
  *
- * Two ways to use the manifest:
- *   - {@link FileStorage.writeFileToShards} returns it to the caller, who is
- *     then responsible for delivering it to readers (e.g. by E2E-encrypting
- *     it as a chat message). The chat application takes this path.
- *   - {@link FileStorage.writeFile} additionally POSTs the manifest to a
- *     gated multi-user space (`SharedSpaceClient`) so any participant of the
- *     space can read the file by manifest id later.
+ * Callers deciding "should I even try a passkey here?" must use this one.
+ * Reaching for `rpIdUsableForOrigin` instead silently excludes every legacy
+ * passkey holder, which has locked real users out of production twice.
  *
- * Reading is the inverse: {@link FileStorage.readFileFromShards} takes a
- * manifest and reassembles the plaintext; {@link FileStorage.readFile} first
- * fetches the manifest from the space.
+ * The `?? host` fallback applies to nullish only, matching `loginWithPasskey`:
+ * an empty-string rpId stays unusable rather than resolving to the host.
  */
-
-interface FileStorageOptions {
-    /** Talks to the content-addressed shard store. Always required. */
-    shards: ShardClient;
-    /**
-     * Talks to the gated multi-user space holding manifests + ACLs.
-     * Optional — only required by {@link FileStorage.writeFile} /
-     * {@link FileStorage.readFile} / {@link FileStorage.deleteFile} /
-     * {@link FileStorage.listFiles} / {@link FileStorage.readManifest}.
-     *
-     * Callers that ship the manifest themselves (e.g. via an encrypted chat
-     * message) can omit `space` and use the `*FromShards` / `*ToShards`
-     * methods directly.
-     */
-    space?: SharedSpaceClient;
-    /**
-     * Plaintext chunk size in bytes. After encryption each chunk gains 16
-     * bytes (GCM tag); after RS encoding the size is rounded up to a multiple
-     * of `dataShards` per chunk. Default 4 MiB — a balance between
-     * round-trip cost and parallelism on the upload path.
-     */
-    chunkSize?: number;
-    /** RS data shards per chunk (default 4). */
-    dataShards?: number;
-    /** RS parity shards per chunk (default 2). */
-    parityShards?: number;
-    /**
-     * Cap on concurrent shard uploads / downloads. Tune for the network. The
-     * default of 8 saturates most home connections without overwhelming the
-     * server's per-IP rate limiter.
-     */
-    concurrency?: number;
-    /**
-     * Optional pre-compiled RS WebAssembly module. Defaults to the bundled
-     * loader. Pass this in environments where the bundled loader path isn't
-     * available (vitest, deploy-time-precompiled CF Workers).
-     */
-    rsWasmModule?: WebAssembly.Module;
+declare function passkeyUsableFromOrigin(rpId: string | undefined | null, host?: string): boolean;
+/** Thrown when the account's passkey belongs to a different origin. Callers
+ *  should treat this as "no passkey here" and fall back to another factor. */
+declare class PasskeyOriginError extends Error {
+    readonly code = "passkey_wrong_origin";
+    constructor(message?: string);
 }
-/**
- * Input to {@link FileStorage.writeFile} (which writes the manifest to a
- * `SharedSpaceClient`). Carries the destination `spaceId`.
- */
-interface WriteFileInput extends WriteToShardsInput {
-    /** Space to write the manifest to — must allow the caller `write`. */
-    spaceId: string;
+interface PasskeyEnrollment {
+    credentialId: Uint8Array;
+    prfSalt: Uint8Array;
+    prfOutput: Uint8Array;
 }
 /**
- * Input to {@link FileStorage.writeFileToShards} (which doesn't write a
- * manifest anywhere — that's the caller's job).
+ * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
+ * the PRF output for that salt. Throws if the authenticator can't do PRF.
  */
-interface WriteToShardsInput {
-    /** Raw data, a Blob, or a File. */
-    data: Uint8Array | Blob | File;
-    /** Application-supplied display metadata. */
-    metadata: {
-        name: string;
-        type: string;
-        path?: string;
-        lastModified?: number;
-    };
-    /**
-     * Optional pre-allocated file id. Defaults to a fresh one. Useful for
-     * resumable uploads: the same id always maps to the same manifest slot.
-     */
-    fileId?: string;
-    /**
-     * Optional upload-progress callback, invoked after each chunk finishes
-     * (`completed` of `total` chunks). Lets a UI show a progress bar. Called once
-     * with `(0, total)` before the first chunk so a bar can render immediately.
-     */
-    onProgress?: (completed: number, total: number) => void;
-}
-declare class FileStorage {
-    private readonly space;
-    private readonly shards;
-    private readonly chunkSize;
-    private readonly dataShards;
-    private readonly parityShards;
-    private readonly concurrency;
-    private readonly cipher;
-    private readonly codec;
-    private readonly rsWasmModule?;
-    constructor(opts: FileStorageOptions);
-    /**
-     * Chunk → encrypt → encode → upload-shards. Returns the resulting manifest
-     * along with a `FileStat` summary. The caller is responsible for storing
-     * or transmitting the manifest however it likes.
-     */
-    writeFileToShards(input: WriteToShardsInput): Promise<{
-        manifest: FileManifest;
-        stat: FileStat;
-    }>;
-    /**
-     * Inverse of {@link writeFileToShards}. Takes a manifest the caller
-     * obtained somehow (chat message, share link, etc.) and reassembles the
-     * plaintext. Throws if too many shards are missing or any chunk's auth
-     * tag fails.
-     */
-    readFileFromShards(manifest: FileManifest): Promise<{
-        data: Uint8Array;
-        stat: FileStat;
-    }>;
-    /**
-     * Streaming inverse of {@link writeFileToShards}: yields each chunk's
-     * decrypted plaintext in order WITHOUT concatenating. Peak memory stays at
-     * ~one chunk, so multi-GB files (which overflow a single `Uint8Array`) can be
-     * piped straight to a file/socket. Same shard sourcing (cache → peers →
-     * origin) and per-chunk auth as {@link readFileFromShards}.
-     */
-    readChunksFromShards(manifest: FileManifest): AsyncGenerator<Uint8Array>;
-    /** As {@link writeFileToShards}, plus POSTs the manifest to `input.spaceId`. */
-    writeFile(input: WriteFileInput): Promise<FileStat>;
-    /** As {@link readFileFromShards}, but fetches the manifest from a space first. */
-    readFile(spaceId: string, fileId: string): Promise<{
-        data: Uint8Array;
-        stat: FileStat;
-    }>;
-    /**
-     * Delete the manifest from a space. **Does not GC the shards** — those
-     * are content-addressed and may be referenced by other manifests.
-     * Garbage collection is a separate server-side concern (Phase D / D-ish).
-     */
-    deleteFile(spaceId: string, fileId: string): Promise<boolean>;
-    /** Convenience pass-through. */
-    listFiles(spaceId: string): Promise<FileStat[]>;
-    /** Read a manifest verbatim — useful for "share file" / export flows. */
-    readManifest(spaceId: string, fileId: string): Promise<FileManifest>;
-    private requireSpace;
-    /** Encrypt + encode + upload one chunk; return its manifest entry. */
-    private writeChunk;
-    /** Inverse of `writeChunk`. */
-    private readChunk;
-    /** Run `tasks` with at most `this.concurrency` in flight. */
-    private runWithConcurrency;
-}
+declare function createPasskeyWithPrf(opts: {
+    rpId: string;
+    rpName: string;
+    username: string;
+}): Promise<PasskeyEnrollment>;
+/** Evaluate a passkey's PRF for `salt` → 32 bytes. Used at recover/login. */
+declare function evaluatePasskeyPrf(rpId: string, credentialId: Uint8Array, salt: Uint8Array): Promise<Uint8Array>;
 
 /**
- * Reed–Solomon erasure-coding codec.
+ * `PersonalSpaceClient` — the client-side counterpart to the accelerator's
+ * `PersonalSpaceDO`. Wraps the `/api/personal/:commitment/*` HTTP protocol so
+ * callers can `put` / `get` / `delete` / `list` per-user KV blobs without
+ * thinking about challenges, nonces, or Groth16 proof generation.
+ *
+ * Every gated operation:
+ *   1. Requests a one-shot challenge from the DO (`POST /challenge`).
+ *   2. Converts the returned hex nonce into a BN254 field element.
+ *   3. Generates a fresh Groth16 proof for the `preimagePoK` circuit using
+ *      snarkjs, with the user's secret/salt/ecdsaPub as private inputs and
+ *      `{commitment, nonce, ecdsaPubHash}` as public signals.
+ *   4. POSTs the proof + publicSignals + (optional) value to the gated endpoint.
  *
- * Wraps the WASM-backed `encode` / `reconstruct` primitives in `wasm/rs.ts`
- * with shard-padding bookkeeping so callers can hand it any-length input and
- * get back uniform-size shards.
+ * snarkjs is loaded lazily (dynamic `import`) the first time a proof is
+ * generated — it's an optional peer dependency that only the ZK-proof path
+ * needs, so importing this module (or constructing a `Client`) never requires
+ * it. Consumers using the proof path install `snarkjs`, or provide it via an
+ * import map in the browser (see the README).
  *
- * Usage:
- *   const codec = new ReedSolomonCodec();
- *   await codec.ready();
- *   const { shards, shardSize, originalSize } = codec.encode(plaintext, 4, 2);
- *   // 6 shards (4 data + 2 parity), each `shardSize` bytes
- *   // …ship them, lose up to 2, then …
- *   const recovered = codec.decode(shards, 2, deadIndexes, originalSize);
+ * Encryption of the stored values is the caller's responsibility — the DO
+ * sees only opaque JSON. The companion `wrap.ts` helpers in this folder are
+ * a convenient way to passphrase-encrypt a payload before putting it.
+ */
+
+/**
+ * Constructor options for {@link PersonalSpaceClient}.
  *
- * Why the explicit `originalSize`: RS pads input to make every data shard the
- * same length. The decoder must trim that padding back off after recovery.
- * The caller is responsible for stashing `originalSize` somewhere durable
- * (the file manifest, in this codebase).
+ * All of `secret`, `salt`, `ecdsaPub`, and `ecdsaPubHash` are decimal-encoded
+ * BigInt strings (snarkjs convention). `commitment` is likewise decimal — it's
+ * the Poseidon hash of `(secret, salt, ecdsaPubHash)`.
  */
-interface EncodeResult {
-    /** All `dataShards + parityShards` shards. All have length `shardSize`. */
-    shards: Uint8Array[];
-    /** Length of every shard (data and parity). */
-    shardSize: number;
-    /** Length of the original input before padding. Needed to trim on decode. */
-    originalSize: number;
-    /** How many of the leading shards are data (the rest are parity). */
-    dataShards: number;
-    /** How many parity shards trail the data shards. */
-    parityShards: number;
-}
-declare class ReedSolomonCodec {
+interface PersonalSpaceClientOptions {
+    /** Base URL of the accelerator, e.g. `http://localhost:8787`. */
+    baseUrl: string;
+    /** The user's Poseidon commitment as a decimal string (~78 digits). */
+    commitment: string;
+    /** ZK identity material — private inputs to the proof. Decimal BigInt string. */
+    secret: string;
+    /** ZK identity salt. Decimal BigInt string. */
+    salt: string;
+    /** Raw ECDSA public-key field representation. Decimal BigInt string. */
+    ecdsaPub: string;
+    /** Poseidon hash of `ecdsaPub`, used as a public signal. Decimal BigInt string. */
+    ecdsaPubHash: string;
     /**
-     * Resolves once the WASM module is loaded; safe to call repeatedly.
-     *
-     * Pass `wasmModule` to use a pre-compiled module (e.g. in tests where the
-     * rollup-inlined loader path isn't available, or in CF Workers where you
-     * want to load the module at deploy time). Default path uses the bundled
-     * base64-inlined wasm — works in Node, browsers, and Workers.
+     * Where the runtime can fetch the compiled circuit assets, and the digests
+     * to verify them against. Prefer `defaultCircuitUrls(baseUrl)`, which pins
+     * them — this client passes `secret` and `salt` to the witness generator as
+     * private witnesses, so an unverified one can exfiltrate them. See
+     * `src/auth/circuitIntegrity.ts`.
      */
-    ready(wasmModule?: WebAssembly.Module): Promise<void>;
+    circuits: CircuitIntegrity & {
+        /** URL of the `preimagePoK.wasm` witness generator. */
+        wasmUrl: string;
+        /** URL of the `preimagePoK_0001.zkey` proving key. */
+        zkeyUrl: string;
+    };
+}
+declare class PersonalSpaceClient {
+    private readonly baseUrl;
+    private readonly commitment;
+    private readonly secret;
+    private readonly salt;
+    private readonly ecdsaPub;
+    private readonly ecdsaPubHash;
+    private readonly circuits;
+    constructor(opts: PersonalSpaceClientOptions);
+    /** Store `value` under `key`, replacing any prior value. */
+    put(key: string, value: unknown): Promise<void>;
+    /** Fetch the value stored under `key`. Returns `null` if absent. */
+    get<T = unknown>(key: string): Promise<T | null>;
+    /** Remove `key` from the user's space. Returns whether the key existed. */
+    delete(key: string): Promise<boolean>;
+    /** List every key currently stored in the user's space. */
+    list(): Promise<string[]>;
     /**
-     * Split `data` into `dataShards` equal-size chunks (zero-padded to fit),
-     * compute `parityShards` parity shards, and return all of them.
+     * Run the full pre-flight: ask the DO for a challenge, reduce the nonce to
+     * a field element, and generate a fresh Groth16 proof. Returns everything
+     * the gated endpoints need in their body.
      */
-    encode(data: Uint8Array, dataShards: number, parityShards: number): EncodeResult;
+    private proveFreshChallenge;
+    /** Hit `POST /challenge` and return the issued nonce + ID. */
+    private requestChallenge;
     /**
-     * Reconstruct the original `data` from `shards`. Up to `parityShards`
-     * shards may be missing; for each missing shard, pass an empty
-     * `Uint8Array` placeholder at its position and list the position in
-     * `deadShardIndexes`.
-     *
-     * `originalSize` is required so the trailing zero-padding can be trimmed.
+     * Thin wrapper over `globalThis.fetch` so all methods share a single set of
+     * headers and body-encoding behaviour. `globalThis.fetch` is available in
+     * modern browsers, Node 18+, Workers, and Bun.
      */
-    decode(shards: Uint8Array[], parityShards: number, deadShardIndexes: number[], originalSize: number): Uint8Array;
+    private fetch;
 }
 
 /**
- * Universal wasm-bindgen glue for `wasm-reed-solomon-erasure` (v0.2.2 — Rust
- * Reed–Solomon erasure-coding library compiled with `wasm-pack --target nodejs`).
- *
- * The upstream npm package ships `wasm_reed_solomon_erasure.js` which uses
- * `require('fs').readFileSync()` to load the WASM file at module load time —
- * that hard-codes Node and breaks browsers / CF Workers. This file is a port
- * of that glue with the Node-only pieces removed:
- *
- *   - `TextDecoder` is taken from the global (available in Node 12+, every
- *     modern browser, and Workers — no `require('util')`).
- *   - The WASM module is loaded via the rollup-inlined `.wasm` import, the
- *     same `targetEnv: 'auto-inline'` path the bn128 verifier uses. Works in
- *     Node, browser, and Workers without runtime fs access.
- *
- * Only the two public functions consumers actually need (`encode` and
- * `reconstruct`) are exported. The rest is the wbindgen heap-table dance.
- *
- * Encoding:
- *   `encode(dataShards: Uint8Array[], parityShard: number)` → array of
- *   `dataShards.length + parityShard` Uint8Arrays. The first N are the input
- *   shards unchanged; the trailing M are the freshly computed parity shards.
- *   All shards are the same length — caller is responsible for padding the
- *   data into equal-size data shards.
+ * Wire types for the storage layer.
  *
- * Reconstruction:
- *   `reconstruct(corruptedShards, parityShard, deadIndexes)` → fully recovered
- *   array. Pass placeholders (empty Uint8Arrays) at the dead indexes; the
- *   reconstructor fills them in. Up to `parityShard` shards may be missing.
- */
-/**
- * Load and instantiate the WASM module. Idempotent — repeated calls await the
- * same one-shot promise.
+ * The `FileManifest` is the single piece of metadata the system needs to
+ * reassemble a file: per-chunk encryption material, RS parameters, and the
+ * SHA-256 content hashes of every shard that belongs to the chunk. With the
+ * manifest in hand, a reader can pull each shard from the open content-
+ * addressed shard store, decode, decrypt, and concatenate to recover the
+ * original bytes.
  *
- * Two ways to initialize, matching the pattern used by `workers/groth16-verifier`:
- *   1. `await initRsWasm()` — uses the bundled .wasm (base64-inlined at build
- *      time by `@rollup/plugin-wasm`). Works in any runtime that allows
- *      runtime `WebAssembly.compile()`.
- *   2. `await initRsWasm(myWasmModule)` — accepts a pre-compiled
- *      `WebAssembly.Module`. Useful when the bundled loader path isn't
- *      available (vitest, CF Workers wanting deploy-time precompile, etc.).
+ * The manifest itself lives inside a `SharedSpaceDO` (Phase B) which gates
+ * access by ZK proof + ACL. Shards are stored in the open content-addressed
+ * `ShardStoreDO` — anyone can put/get any shard, but without the manifest
+ * (which has the keys) the ciphertext is just noise.
  */
-declare function initRsWasm(wasmModule?: WebAssembly.Module): Promise<void>;
 
 /**
- * HTTP client for the accelerator's `/api/auth/*` endpoints.
- *
- * Owns the wire shapes for register / challenge / authenticate / verify so
- * the React SPA (and any future consumers) don't reimplement them. The ZK
- * identity derivation + Groth16 proof generation stay on the application
- * side — this client handles only the round-trips.
+ * One chunk's metadata. A file is the concatenation of `chunks` in order.
  *
- * Mirrors `PersonalSpaceClient` / `ShardClient` / `SharedSpaceClient`: takes
- * a `baseUrl`, optional custom `fetch`, throws typed `Error`s on failure
- * (with the worker's message inlined where available).
+ * - `originalSize` is the chunk's plaintext length, before AES-GCM expanded
+ *   it by 16 bytes for the auth tag and before RS padded it for shard
+ *   alignment.
+ * - `ciphertextSize` is the AES-GCM output length (plaintext + 16). This is
+ *   what the RS decoder trims back to.
+ * - `shardHashes` lists every shard's SHA-256 in encoding order — the first
+ *   `dataShards` are data shards, the trailing `parityShards` are parity.
  */
-
-interface ZkRegisterRequest {
-    username: string;
-    /** Decimal-string Poseidon commitment. */
-    commitment: string;
-    /** Base64-encoded raw uncompressed ECDH public key (SEC1 0x04‖X‖Y). */
-    ecdhPublicKey: string;
-    /** Base64-encoded raw uncompressed ECDSA public key. */
-    ecdsaPublicKey: string;
-    email?: string | null;
-}
-interface ZkRegisterResponse {
-    success: boolean;
-}
-interface ZkChallengeResponse {
-    challengeId: string;
-    /** Hex-encoded random nonce — caller reduces into a BN254 field element for the proof. */
-    nonce: string;
-    /** Decimal-string Poseidon commitment the server has on file for this user. */
-    commitment: string;
-}
-interface ZkAuthenticateRequest {
-    challengeId: string;
-    proof: {
-        commitment: string;
-        /** Original hex nonce from the challenge (NOT the field-reduced version). */
-        nonce: string;
-        response: {
-            proof: Groth16Proof;
-            publicSignals: string[];
-        };
-        /** Base64 ECDSA-SHA256 signature over `JSON.stringify(response.proof)`. */
-        signature: string;
-    };
-    rememberMe?: boolean;
+interface ChunkManifest {
+    /** Stable per-chunk ID (uuid-like). Useful for client-side resume / dedup. */
+    id: string;
+    /** Position of this chunk in the file (0-indexed). */
+    chunkIndex: number;
+    /** Plaintext byte length of the chunk before encryption. */
+    originalSize: number;
+    /** AES-GCM ciphertext byte length (originalSize + 16 for the tag). */
+    ciphertextSize: number;
+    /** Number of RS data shards. */
+    dataShards: number;
+    /** Number of RS parity shards. */
+    parityShards: number;
+    /** Length in bytes of every shard (data and parity are equal). */
+    shardSize: number;
+    /** SHA-256 (hex) of each shard's ciphertext bytes, in shard order. */
+    shardHashes: string[];
+    /** Per-chunk AES-256-GCM key + IV. Plain in the manifest — gating happens at the SpaceDO. */
+    cipher: ChunkKeyMaterial;
 }
-interface AuthSuccess {
-    token: string;
-    username: string;
+/**
+ * Top-level manifest for a single stored file. Persisted in the user's
+ * SharedSpace by file id; readable / writable per the space's ACL.
+ */
+interface FileManifest {
+    /** Stable file ID. Assigned by the SDK at write time; used to read or delete. */
+    id: string;
+    /** Human-readable filename (display only — not used by the shard store). */
+    name: string;
+    /** Total plaintext byte length. Sum of chunk `originalSize`s. */
+    size: number;
+    /** MIME type the application supplied at write time. Opaque to storage. */
+    type: string;
+    /** Optional virtual path / folder hint for the application. */
+    path?: string;
+    /** When the file was last modified per the application (ms epoch). */
+    lastModified: number;
+    /** When this manifest was created on the SDK side (ms epoch). */
+    createdAt: number;
+    /** Ordered list of chunks. Concatenate them in index order to rebuild the file. */
+    chunks: ChunkManifest[];
+    /** SDK schema version. Bump on breaking manifest-shape changes. */
+    version: 1;
 }
-/** A vault factor record (M1.0 + M2 gated types). Wrap/iv are base64 AES-GCM; absent for phrase. */
-interface VaultFactor {
+/**
+ * Lightweight summary returned by `FileStorage.writeFile` and surfaced in
+ * directory-style listings. The full manifest is only fetched when actually
+ * reassembling the file.
+ */
+interface FileStat {
     id: string;
-    type: "password" | "passkey" | "phrase-marker" | "email" | "google" | "device";
-    wrap?: string;
-    iv?: string;
-    params?: Record<string, unknown>;
-    label?: string;
-    createdAt?: number;
-    /** Display hint for gated factors ("m•••@gmail.com") — list responses only. */
-    masked?: string;
-    /** Passkey's origin (RP id) — list responses only. A passkey only unlocks
-     *  from this host or a subdomain of it, so apps on several hosts enroll one
-     *  per origin. */
-    rpId?: string;
+    name: string;
+    size: number;
+    type: string;
+    path?: string;
+    lastModified: number;
+    createdAt: number;
+    chunkCount: number;
+    shardCount: number;
 }
-interface AuthClientOptions {
-    /** Absolute URL of the accelerator worker (no trailing slash required). */
+/** Distil a `FileManifest` into a `FileStat`. */
+declare function manifestToStat(manifest: FileManifest): FileStat;
+
+/**
+ * HTTP client for the open content-addressed shard store.
+ *
+ * Each shard is named by the lowercase hex SHA-256 of its ciphertext bytes.
+ * The server verifies the hash on PUT, so the address authenticates the
+ * contents — there's no benefit to ACLing PUT/GET, and making them open
+ * enables cross-user dedup down the line.
+ *
+ * Wire protocol:
+ *   PUT  /api/shards/:hash    body: shard bytes (application/octet-stream)
+ *                             200 { ok: true, hash, size, dedup: boolean }
+ *                             400 if hash doesn't match body
+ *
+ *   GET  /api/shards/:hash    200 with shard bytes (application/octet-stream)
+ *                             404 if absent
+ *
+ *   HEAD /api/shards/:hash    200 if present (no body) — used by callers to
+ *                             skip a PUT they'd otherwise dedup-rewrite. The
+ *                             server can ignore the optimization if it wants.
+ */
+/**
+ * A content-addressed byte cache for shards (the offline layer's `ShardCache`
+ * satisfies this structurally). Declared here as a minimal interface so the
+ * storage layer doesn't import the offline module — keeping the dependency
+ * arrow one-way (offline → storage).
+ */
+interface ShardByteCache {
+    get(hash: string): Promise<Uint8Array | null>;
+    put(hash: string, bytes: Uint8Array): Promise<void>;
+}
+/**
+ * A peer block source (the p2p layer's `PeerExchange` satisfies this
+ * structurally). Consulted between the local cache and origin: a block fetched
+ * from a peer is verified by hash before use. Declared here so the storage layer
+ * doesn't import the p2p module (dependency arrow stays p2p → storage).
+ */
+interface PeerBlockSource {
+    getBlock(hash: string, opts?: {
+        timeoutMs?: number;
+    }): Promise<Uint8Array | null>;
+    announce(hash: string): void;
+}
+interface ShardClientOptions {
+    /** Base URL of the accelerator (e.g. `https://muhkoo-accelerator.workers.dev`). */
     baseUrl: string;
-    /** Optional custom fetch — defaults to `globalThis.fetch`. */
+    /**
+     * Path prefix for the shard endpoints, joined to `baseUrl` before the
+     * hash. Defaults to `/api/shards`, which targets a global shard store
+     * (e.g. a dedicated `ShardStoreDO`). Pass a room-scoped value like
+     * `/api/spaces/{roomId}/shards` to keep shards bound to a specific
+     * `SharedSpaceDO` — that's the path the chat application uses today.
+     *
+     * Leading slash optional; trailing slash stripped. The final URL is
+     * always `${baseUrl}${normalizedPrefix}/${encodeURIComponent(hash)}`.
+     */
+    pathPrefix?: string;
+    /**
+     * Optional custom fetch implementation. Defaults to `globalThis.fetch`.
+     * Provided so callers can inject retries / auth / instrumentation.
+     */
     fetch?: typeof fetch;
-}
-declare class AuthClient {
-    private readonly baseUrl;
-    private readonly fetchFn;
-    constructor(opts: AuthClientOptions);
-    /** Submit ZK registration. Caller has already derived the identity + commitment. */
-    register(req: ZkRegisterRequest): Promise<ZkRegisterResponse>;
-    /** Request an auth challenge for `username` (server issues a fresh nonce). */
-    getChallenge(username: string): Promise<ZkChallengeResponse>;
-    /** Trade a challenge + proof for a session token. */
-    authenticate(req: ZkAuthenticateRequest): Promise<AuthSuccess>;
     /**
-     * Validate a previously stored session token. Returns `{ username }` on
-     * success; throws on 401/404 — caller uses that to drop a stale token
-     * when restoring a session after a reload.
+     * Optional offline byte cache. When present, GETs are served cache-first and
+     * populated on success, and PUTs write the cache before the network so a
+     * just-uploaded file reads back offline. See {@link ShardByteCache}.
      */
-    verify(token: string): Promise<{
-        username: string;
-    }>;
-    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
-    oprfEvaluate(username: string, blinded: string): Promise<{
-        evaluated: string;
-    }>;
+    cache?: ShardByteCache;
     /**
-     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
-     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
-     * domains' evaluations. The recover token is consumed by this call.
+     * Coalesce concurrent origin reads into `POST {pathPrefix}/batch`. On by
+     * default: it is what keeps opening a project from costing one request per
+     * shard. Set false to force one-at-a-time — useful against a server without
+     * the route, though that is detected and handled automatically.
      */
-    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string): Promise<{
-        evaluated: string;
-        evaluated2: string;
-    }>;
+    batchShards?: boolean;
     /**
-     * Request an email OTP. With a session `token` this is the ENROLL flow
-     * (code sent to `email`); without one it's RECOVER (code sent to the
-     * account's enrolled address — the response is uniform either way).
+     * Called when a PUT can't reach the network (offline). Lets the caller queue
+     * the upload for replay on reconnect; the bytes are already in {@link cache}
+     * keyed by `hash`, so only the hash needs recording.
      */
-    emailOtpStart(opts: {
-        token?: string;
-        email?: string;
-        username?: string;
-    }): Promise<void>;
-    /** Trade an emailed code for a single-use verifyToken (+ the proven address). */
-    emailOtpVerify(opts: {
-        code: string;
-        token?: string;
-        username?: string;
-    }): Promise<{
-        verifyToken: string;
-        email: string;
-    }>;
+    deferUpload?: (hash: string) => Promise<void>;
     /**
-     * Verify a Google ID token (M2.3). With a session `token` it's the ENROLL
-     * gate; without, it's RECOVER/LOGIN (the Google account must already be
-     * linked). Returns a single-use verifyToken bound to the account's `sub`.
+     * Optional peer block source. When present, GETs try peers between the local
+     * cache and origin (peer blocks are verified by hash); PUTs announce the new
+     * block to peers. Best-effort — any failure falls through to origin.
      */
-    googleVerify(opts: {
-        idToken: string;
-        token?: string;
-        username?: string;
-    }): Promise<{
-        verifyToken: string;
-        sub: string;
-        emailHint: string | null;
-    }>;
-    /** Mint a single-use authorization code for an app (called by the hosted page; session-authed). */
-    grant(token: string, body: {
-        appId: string;
-        redirectUri: string;
-        codeChallenge: string;
-        sealedKeys: string;
-    }): Promise<{
-        code: string;
-    }>;
-    /** Exchange an authorization code + PKCE verifier for the session + sealed key material. */
-    token(body: {
-        code: string;
-        codeVerifier: string;
-        appId?: string;
-    }): Promise<{
-        sessionToken: string;
-        username: string;
-        commitment: string;
-        sealedKeys: string;
-        appId: string;
+    peers?: PeerBlockSource;
+    /**
+     * When true, {@link ShardClient.putShard} returns as soon as the shard is
+     * written to {@link cache} and announced to {@link peers} — the origin PUT is
+     * fired in the BACKGROUND rather than awaited. This makes a large write's
+     * manifest available immediately (so a peer/worker can start pulling the
+     * shards over P2P right away) while origin catches up as a durable fallback.
+     * On a background-PUT failure the shard is handed to {@link deferUpload} (if
+     * present) for replay. Requires a {@link cache} so the bytes survive locally
+     * until the background upload lands. No-op without a cache.
+     */
+    backgroundUpload?: boolean;
+}
+/**
+ * Compute the lowercase hex SHA-256 of `bytes`. Available via WebCrypto in
+ * every runtime this SDK targets.
+ */
+declare function shardHash(bytes: Uint8Array): Promise<string>;
+declare class ShardClient {
+    private readonly baseUrl;
+    private readonly pathPrefix;
+    private readonly fetchFn;
+    private readonly cache?;
+    /** Hashes waiting for the next batch, each with everyone awaiting it. */
+    private pendingShards;
+    private batchTimer;
+    /** False once the server is known not to have the batch route. */
+    private batchSupported;
+    private readonly deferUpload?;
+    private readonly peers?;
+    private readonly backgroundUpload;
+    constructor(opts: ShardClientOptions);
+    /** Build the URL for a given shard hash — exposed for callers that want to log or pre-resolve. */
+    urlForHash(hash: string): string;
+    /**
+     * Upload a shard. The server verifies SHA-256(body) matches `:hash` and
+     * rejects with 400 if not, so the caller is the source of truth on
+     * naming. Re-uploading an existing shard is idempotent — the server
+     * returns `dedup: true` in that case.
+     */
+    putShard(hash: string, bytes: Uint8Array): Promise<{
+        dedup: boolean;
     }>;
+    private bgActive;
+    private readonly bgQueue;
+    private static readonly BG_CONCURRENCY;
+    /** Queue a shard's origin PUT to run in the background under a concurrency
+     *  cap. Bytes are re-read from {@link cache} at upload time (not held in the
+     *  queue) so a large file's backlog doesn't pin a second copy in memory. */
+    private enqueueBackgroundUpload;
+    /** PUT the shard bytes to origin, verifying the server accepted them.
+     *  Used by the background-upload path; throws on network/HTTP failure. */
+    private uploadToOrigin;
     /**
-     * Read a factor record for `username` (returns an indistinguishable decoy if
-     * absent). Gated types (email) require the recover `verifyToken`.
+     * Fetch a shard by hash. Throws if the server returns a non-200; returns
+     * `null` for 404 so callers can distinguish "missing" from "errored".
+     */
+    getShard(hash: string): Promise<Uint8Array | null>;
+    /**
+     * Fetch from origin, COALESCING concurrent requests into one batch.
+     *
+     * A shard is not a file. A project is thousands of small source modules,
+     * each split into shards, so reading one at a time made opening a project
+     * cost thousands of requests — 2,086 for a 519-file project. Latency, not
+     * bytes, is what that spends: Chromium took 18.4s over those requests and
+     * Brave, which filters every one, took 37.5s for identical work. Batching
+     * collapses whatever is in flight at the same moment into a single POST,
+     * which is why it helps most exactly where it hurt most.
+     *
+     * Callers are unchanged: `getShard` still asks for one shard and gets one
+     * shard. The window is a few milliseconds — long enough to gather the reads
+     * a concurrent walk issues together, short enough not to be felt by a lone
+     * read.
+     *
+     * Falls back permanently to one-at-a-time if the server has no batch route,
+     * so a new SDK keeps working against an older deployment.
      */
-    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string, 
-    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
-     *  passkey instead of whichever was enrolled first (which WebAuthn would
-     *  refuse). Ignored for other factor types. */
-    rpId?: string, 
-    /** Device factors are selected by id — a user may have many machines. */
-    factorId?: string): Promise<{
-        factor: VaultFactor | null;
-    }>;
+    private fetchFromOrigin;
+    /** Send one batch of whatever has accumulated, and settle those callers. */
+    private flushShardBatch;
+    /** Fetch a shard from origin. Returns `null` for 404 (or offline when a
+     *  cache is present, so RS recovery can proceed); throws otherwise. */
+    private fetchOneFromOrigin;
     /**
-     * Add/replace a factor (session-authed; the seed is already wrapped
-     * client-side). Email factors additionally require (and consume) the
-     * enroll `verifyToken`; the stored address must be the verified one.
+     * Check whether a shard exists. Lets the caller skip a PUT they'd otherwise
+     * dedup-rewrite. The server can implement this as a HEAD or return a small
+     * JSON body — we don't depend on either.
      */
-    vaultPutFactor(token: string, factor: VaultFactor, verifyToken?: string): Promise<{
-        ok: boolean;
-        id: string;
-    }>;
-    /** List the user's factor metadata (no ciphertext). Session-authed. */
-    vaultFactors(token: string): Promise<{
-        factors: VaultFactor[];
-        migrated: boolean;
-    }>;
-    /** Remove a factor by id (can't remove the last one). Session-authed. */
-    vaultDeleteFactor(token: string, id: string): Promise<{
-        deleted: boolean;
-    }>;
-    private json;
-    private parse;
+    hasShard(hash: string): Promise<boolean>;
 }
 
 /**
- * Deterministic ZK identity derivation from `(username, password)`.
- *
- * Same inputs on ANY device produce the same secret, salt, and P-256
- * ECDSA + ECDH keypairs — which is what makes federated login from a
- * fresh browser possible. There is no localStorage involvement: every
- * register and login call re-derives the identity on demand.
+ * HTTP client for the gated file-manifest store on a SharedSpace
+ * (`/api/spaces/:spaceId/files`).
  *
- * Pipeline:
- *   master_seed = PBKDF2-SHA256(password, "muhkoo-zk-v1:" || username, 200k iters)
- *   secret      = HKDF-Expand-SHA256(master_seed, "zk-secret",  32 bytes) → hex
- *   salt        = HKDF-Expand-SHA256(master_seed, "zk-salt",    32 bytes) → hex
- *   ecdsa_priv  = HKDF-Expand-SHA256(master_seed, "ecdsa-priv", 32 bytes)
- *   ecdh_priv   = HKDF-Expand-SHA256(master_seed, "ecdh-priv",  32 bytes)
+ * A "file" in a space is its **manifest** (per-chunk keys + the SHA-256 of each
+ * global shard). The shard bytes live in the open `/api/shards` store; the
+ * manifest is the capability. This client only moves manifests in/out of the
+ * space's gated store.
  *
- * P-256 public points are computed via `@noble/curves` (WebCrypto has no
- * derive-public-from-private-scalar API), then both keypairs are imported
- * into SubtleCrypto in JWK form so the rest of the crypto stack can keep
- * using `crypto.subtle.sign` / `crypto.subtle.deriveBits`.
+ * Authorization is **session-based**, consistent with the rest of the
+ * SharedSpace (keyring, websocket): the SDK's credential-stamping `fetch`
+ * (from {@link HttpClient}) attaches the app key + session token, the platform
+ * validates the session and injects a trusted `X-Muhkoo-User-Context`, and the
+ * DO authorizes on that + channel membership. There is no per-op Groth16 proof.
  *
- * Originally lived in `accelerator/public/js/zk-identity.js` and was ported
- * to `muhkoo/web/src/zk/identity.ts`; consolidated here so the SDK owns
- * identity derivation end-to-end.
+ * Wire protocol (server: `SharedSpaceDO`):
+ *   POST   /api/spaces/:spaceId/files            body: { manifest }  → { ok, fileId }
+ *   GET    /api/spaces/:spaceId/files                                → { files: FileStat[] }
+ *   GET    /api/spaces/:spaceId/files/:fileId                        → { manifest }
+ *   DELETE /api/spaces/:spaceId/files/:fileId                        → { ok, existed }
  */
-interface ZkIdentity {
-    /** 32-byte secret, hex-encoded. Private witness for the ZK circuit. */
-    secretHex: string;
-    /** 32-byte salt, hex-encoded. Private witness for the ZK circuit. */
-    saltHex: string;
-    /** P-256 ECDSA keypair, used to sign auth proofs. */
-    ecdsaKeyPair: CryptoKeyPair;
-    /** P-256 ECDH keypair, used by the chat ratchet. */
-    ecdhKeyPair: CryptoKeyPair;
+
+interface SharedSpaceClientOptions {
+    /** Base URL of the accelerator (e.g. `https://api.muhkoo.dev`). */
+    baseUrl: string;
+    /**
+     * Credential-stamping fetch — pass {@link HttpClient.fetch} so requests
+     * carry the app key + session token. Defaults to `globalThis.fetch`
+     * (unauthenticated; only useful in tests).
+     */
+    fetch?: typeof fetch;
+}
+declare class SharedSpaceClient {
+    private readonly baseUrl;
+    private readonly fetchFn;
+    constructor(opts: SharedSpaceClientOptions);
+    /** Write a file manifest into the space. Requires space membership. */
+    writeFileManifest(spaceId: string, manifest: FileManifest): Promise<void>;
+    /** Read a file manifest by id. Requires space membership. */
+    readFileManifest(spaceId: string, fileId: string): Promise<FileManifest>;
+    /** Delete a file manifest by id. Requires space membership. */
+    deleteFileManifest(spaceId: string, fileId: string): Promise<boolean>;
+    /** List file summaries in the space. Requires space membership. */
+    listFiles(spaceId: string): Promise<FileStat[]>;
+    private filesBase;
+    private jsonRequest;
 }
-/**
- * Derive a deterministic ZK identity from `(username, password)`.
- *
- * Same inputs always produce the same identity, on any device — that's
- * what makes federated login work without dragging encrypted state across
- * devices.
- */
-declare function deriveIdentity(username: string, password: string): Promise<ZkIdentity>;
-/**
- * Legacy master-seed derivation: `PBKDF2(password, "muhkoo-zk-v1:"||username)`.
- *
- * This was the *only* path pre-vault, where the identity descended directly from
- * the password. It's kept so existing accounts still re-derive their seed (and
- * the vault can adopt that exact seed on migration, preserving the commitment).
- * New accounts use a random seed (`vault.randomSeed`) instead, so their identity
- * is no longer a function of the password.
- */
-declare function deriveMasterSeedFromPassword(username: string, password: string): Promise<Uint8Array>;
-/**
- * Derive the (unchanged) ZK identity from a 32-byte **master seed**. The seed is
- * HKDF-expanded into secret/salt + the P-256 ECDSA & ECDH keypairs exactly as
- * before — so the resulting commitment is byte-identical for a given seed. The
- * vault wraps THIS seed under each recovery factor.
- */
-declare function deriveIdentityFromSeed(seed: Uint8Array): Promise<ZkIdentity>;
 
 /**
- * Poseidon hash wrapper used by the ZK auth flow.
- *
- * Backed by `circomlibjs`'s `buildPoseidon`. Builder is lazy and cached
- * because the JS-side Babyjubjub field reps take ~100ms to construct, and
- * we'd rather not pay that on every page load.
- *
- * Returns hashes as decimal-string BigInts — same format snarkjs and the
- * `preimagePoK` circuit expect for inputs.
+ * `FileStorage` — top-level entry point for chunked, encrypted, erasure-coded
+ * file storage.
  *
- * Note: circomlibjs is `optionalDependencies` in connect's package.json.
- * Consumers that use the ZK auth flow (browser/server, not workers) need
- * it installed. The workers build does not import this module.
- */
-/**
- * Poseidon-hash `inputs` and return the result as a decimal-string BigInt.
- * Inputs are converted to BigInt — pass either bigints, numbers, or numeric
- * strings.
- */
-declare function poseidonHash(inputs: Array<bigint | string | number>): Promise<string>;
-
-/**
- * Groth16 proof generation for the `preimagePoK` circuit.
+ * Pipeline for writing a file:
+ *   1. Split the plaintext into fixed-size chunks (default 4 MiB).
+ *   2. For each chunk:
+ *        a. Generate a fresh AES-256-GCM key + 12-byte IV (`ChunkCipher`).
+ *        b. Encrypt the chunk → ciphertext (plaintext.length + 16 bytes tag).
+ *        c. Reed–Solomon encode the ciphertext into `dataShards + parityShards`
+ *           equal-length shards (`ReedSolomonCodec`).
+ *        d. PUT every shard to the content-addressed shard store, keyed by
+ *           SHA-256 of the shard bytes (`ShardClient`).
+ *   3. Build a `FileManifest` listing every chunk's keys, IVs, sizes, and
+ *      the SHA-256 of every shard in order.
  *
- * The circuit proves knowledge of `(secret, salt, ecdsaPub)` such that
- *   commitment = Poseidon(secret, salt, Poseidon(ecdsaPub))
- * while only revealing `(commitment, nonce, ecdsaPubHash)` as public signals.
+ * Two ways to use the manifest:
+ *   - {@link FileStorage.writeFileToShards} returns it to the caller, who is
+ *     then responsible for delivering it to readers (e.g. by E2E-encrypting
+ *     it as a chat message). The chat application takes this path.
+ *   - {@link FileStorage.writeFile} additionally POSTs the manifest to a
+ *     gated multi-user space (`SharedSpaceClient`) so any participant of the
+ *     space can read the file by manifest id later.
  *
- * Circuit assets (wasm + zkey) are served by the accelerator worker. Their
- * URLs are a required argument of {@link generateAuthProof} — there is no
- * default. The web app constructs them relative to its configured worker
- * `baseUrl` so the SPA can target either the local wrangler dev or a deployed
- * worker depending on `VITE_WORKER_URL`.
+ * Reading is the inverse: {@link FileStorage.readFileFromShards} takes a
+ * manifest and reassembles the plaintext; {@link FileStorage.readFile} first
+ * fetches the manifest from the space.
  */
 
-interface CircuitUrls {
-    /** preimagePoK.wasm — the circuit's witness generator. */
-    wasmUrl: string;
-    /** preimagePoK_0001.zkey — the proving key. */
-    zkeyUrl: string;
-}
-/**
- * Canonical {@link CircuitUrls} for the `preimagePoK` login circuit, anchored
- * at a base URL where the accelerator serves the circuit assets out of
- * `circuits/build/`. The filenames here are fixed by the circom build output
- * (the witness generator lands inside a `preimagePoK_js/` directory); callers
- * shouldn't hard-code them. `Client` uses this to default its `circuits`
- * option, and `PersonalSpaceClient` consumers can pass `defaultCircuitUrls(baseUrl)`.
- */
-declare function defaultCircuitUrls(baseUrl: string): CircuitUrls;
-/**
- * Reduce any hex/decimal/byte input to a decimal-string field element in
- * `[0, FIELD_SIZE)`. snarkjs and the `preimagePoK` circuit both want decimal
- * strings; everything else gets normalized here.
- *
- * **Behavior is intentionally byte-for-byte compatible with the legacy
- * `accelerator/public/js/zk-snarkjs-client.js#toField`.** Diverging produces
- * different commitments than accounts registered via the legacy flow,
- * which locks those users out forever — the worker stores whatever
- * commitment the client sent at register time and compares it as a string
- * at login time.
- *
- * In particular: a 32+ char string of hex chars is always treated as hex,
- * even if every character happens to be 0-9 with no a-f letters. An
- * earlier version of this function gated the hex branch on "has at least
- * one letter" — that broke the digit-only-hex edge case (rare in practice,
- * but real). DO NOT add that letter check back.
- */
-declare function toField(value: string | bigint | number): string;
-/**
- * Build the user's Poseidon commitment binding `(secret, salt, ecdsaPubHash)`.
- * Same formula the worker verifies against on register and authenticate.
- */
-declare function buildCommitment(secretHex: string, saltHex: string, ecdsaPubHex: string): Promise<string>;
+interface FileStorageOptions {
+    /** Talks to the content-addressed shard store. Always required. */
+    shards: ShardClient;
+    /**
+     * Talks to the gated multi-user space holding manifests + ACLs.
+     * Optional — only required by {@link FileStorage.writeFile} /
+     * {@link FileStorage.readFile} / {@link FileStorage.deleteFile} /
+     * {@link FileStorage.listFiles} / {@link FileStorage.readManifest}.
+     *
+     * Callers that ship the manifest themselves (e.g. via an encrypted chat
+     * message) can omit `space` and use the `*FromShards` / `*ToShards`
+     * methods directly.
+     */
+    space?: SharedSpaceClient;
+    /**
+     * Plaintext chunk size in bytes. After encryption each chunk gains 16
+     * bytes (GCM tag); after RS encoding the size is rounded up to a multiple
+     * of `dataShards` per chunk. Default 4 MiB — a balance between
+     * round-trip cost and parallelism on the upload path.
+     */
+    chunkSize?: number;
+    /** RS data shards per chunk (default 4). */
+    dataShards?: number;
+    /** RS parity shards per chunk (default 2). */
+    parityShards?: number;
+    /**
+     * Cap on concurrent shard uploads / downloads. Tune for the network. The
+     * default of 8 saturates most home connections without overwhelming the
+     * server's per-IP rate limiter.
+     */
+    concurrency?: number;
+    /**
+     * Optional pre-compiled RS WebAssembly module. Defaults to the bundled
+     * loader. Pass this in environments where the bundled loader path isn't
+     * available (vitest, deploy-time-precompiled CF Workers).
+     */
+    rsWasmModule?: WebAssembly.Module;
+}
 /**
- * Generate a Groth16 proof for the `preimagePoK` circuit. Public signals end
- * up `[commitment, nonce, ecdsaPubHash]` — the worker checks the commitment
- * matches the stored one and the nonce matches the issued challenge nonce
- * reduced into the field.
- *
- * Throws if circuit URLs are unreachable or snarkjs decides the inputs are
- * malformed.
+ * Input to {@link FileStorage.writeFile} (which writes the manifest to a
+ * `SharedSpaceClient`). Carries the destination `spaceId`.
  */
-declare function generateAuthProof(args: {
-    secretHex: string;
-    saltHex: string;
-    ecdsaPubHex: string;
-    nonceHex: string;
-    /** Required — caller supplies URLs scoped to the worker they want to talk to. */
-    circuits: CircuitUrls;
-}): Promise<{
-    proof: Groth16Proof;
-    publicSignals: string[];
-    commitment: string;
-    nonceField: string;
-    ecdsaPubHash: string;
-}>;
-
+interface WriteFileInput extends WriteToShardsInput {
+    /** Space to write the manifest to — must allow the caller `write`. */
+    spaceId: string;
+}
 /**
- * Conversions between SubtleCrypto `CryptoKey`s and the wire formats the
- * accelerator's auth endpoints + `preimagePoK` circuit expect.
- *
- * Two outputs we need from an ECDSA `CryptoKey`:
- *   - **base64 raw**  — passed to `/api/auth/zk-register` as
- *                       `ecdsaPublicKey` / `ecdhPublicKey`. (Name is historical;
- *                       the legacy client called it `exportPublicKeyToBase58`
- *                       but actually used base64 — kept as base64.)
- *   - **hex raw**     — fed to the proof as `ecdsaPub` input; the circuit
- *                       reduces it into a field element.
- *
- * Both go through `crypto.subtle.exportKey("raw", ...)` which yields the
- * uncompressed SEC1 form (`0x04 || X || Y`).
+ * Input to {@link FileStorage.writeFileToShards} (which doesn't write a
+ * manifest anywhere — that's the caller's job).
  */
-/** Raw uncompressed (`0x04 || X || Y`) public key bytes, as lowercase hex. */
-declare function exportPublicKeyHex(publicKey: CryptoKey): Promise<string>;
-/** Raw uncompressed public key as base64 — wire format for the auth endpoints. */
-declare function exportPublicKeyBase64(publicKey: CryptoKey): Promise<string>;
-/** Sign a UTF-8 `message` with an ECDSA private key. Returns base64. */
-declare function signMessage(message: string, privateKey: CryptoKey): Promise<string>;
+interface WriteToShardsInput {
+    /** Raw data, a Blob, or a File. */
+    data: Uint8Array | Blob | File;
+    /** Application-supplied display metadata. */
+    metadata: {
+        name: string;
+        type: string;
+        path?: string;
+        lastModified?: number;
+    };
+    /**
+     * Optional pre-allocated file id. Defaults to a fresh one. Useful for
+     * resumable uploads: the same id always maps to the same manifest slot.
+     */
+    fileId?: string;
+    /**
+     * Optional upload-progress callback, invoked after each chunk finishes
+     * (`completed` of `total` chunks). Lets a UI show a progress bar. Called once
+     * with `(0, total)` before the first chunk so a bar can render immediately.
+     */
+    onProgress?: (completed: number, total: number) => void;
+}
+declare class FileStorage {
+    private readonly space;
+    private readonly shards;
+    private readonly chunkSize;
+    private readonly dataShards;
+    private readonly parityShards;
+    private readonly concurrency;
+    private readonly cipher;
+    private readonly codec;
+    private readonly rsWasmModule?;
+    constructor(opts: FileStorageOptions);
+    /**
+     * Chunk → encrypt → encode → upload-shards. Returns the resulting manifest
+     * along with a `FileStat` summary. The caller is responsible for storing
+     * or transmitting the manifest however it likes.
+     */
+    writeFileToShards(input: WriteToShardsInput): Promise<{
+        manifest: FileManifest;
+        stat: FileStat;
+    }>;
+    /**
+     * Inverse of {@link writeFileToShards}. Takes a manifest the caller
+     * obtained somehow (chat message, share link, etc.) and reassembles the
+     * plaintext. Throws if too many shards are missing or any chunk's auth
+     * tag fails.
+     */
+    readFileFromShards(manifest: FileManifest): Promise<{
+        data: Uint8Array;
+        stat: FileStat;
+    }>;
+    /**
+     * Streaming inverse of {@link writeFileToShards}: yields each chunk's
+     * decrypted plaintext in order WITHOUT concatenating. Peak memory stays at
+     * ~one chunk, so multi-GB files (which overflow a single `Uint8Array`) can be
+     * piped straight to a file/socket. Same shard sourcing (cache → peers →
+     * origin) and per-chunk auth as {@link readFileFromShards}.
+     */
+    readChunksFromShards(manifest: FileManifest): AsyncGenerator<Uint8Array>;
+    /** As {@link writeFileToShards}, plus POSTs the manifest to `input.spaceId`. */
+    writeFile(input: WriteFileInput): Promise<FileStat>;
+    /** As {@link readFileFromShards}, but fetches the manifest from a space first. */
+    readFile(spaceId: string, fileId: string): Promise<{
+        data: Uint8Array;
+        stat: FileStat;
+    }>;
+    /**
+     * Delete the manifest from a space. **Does not GC the shards** — those
+     * are content-addressed and may be referenced by other manifests.
+     * Garbage collection is a separate server-side concern (Phase D / D-ish).
+     */
+    deleteFile(spaceId: string, fileId: string): Promise<boolean>;
+    /** Convenience pass-through. */
+    listFiles(spaceId: string): Promise<FileStat[]>;
+    /** Read a manifest verbatim — useful for "share file" / export flows. */
+    readManifest(spaceId: string, fileId: string): Promise<FileManifest>;
+    private requireSpace;
+    /** Encrypt + encode + upload one chunk; return its manifest entry. */
+    private writeChunk;
+    /** Inverse of `writeChunk`. */
+    private readChunk;
+    /** Run `tasks` with at most `this.concurrency` in flight. */
+    private runWithConcurrency;
+}
 
 /**
- * Hosted-auth handoff crypto (auth.muhkoo.dev — AUTH_HOSTED_PLAN.md §3).
- *
- * The hosted page authenticates the user and ends up holding the master seed.
- * To pass it to the developer's app without it ever sitting server-readable or
- * landing in browser history:
- *
- *   1. {@link sealSeed} generates a one-time key K_t, AES-256-GCM-seals the seed
- *      under it, and returns the ciphertext envelope (`sealedKeys`, stored in
- *      the grant the server relays but can't read) plus K_t (`fragmentKey`,
- *      placed ONLY in the redirect URL fragment — fragments never hit a server).
- *   2. The app exchanges the code for `sealedKeys`, reads K_t from the fragment,
- *      and {@link unsealSeed} recovers the seed, then strips the fragment.
- *
- * Trust-equivalent to today's embedded SDK (the app still ends up with the
- * seed) while moving credential entry onto the Muhkoo origin. The envelope is
- * versioned so a future per-app-key handoff (v2) can swap in without a protocol
- * change.
- *
- * ## v2 — device pairing (TV / no-redirect handoff)
+ * Reed–Solomon erasure-coding codec.
  *
- * v1's K_t rides in the redirect URL *fragment*, which works only because the
- * receiving app is a browser page that can read `location.hash`. A TV app has
- * no redirect to receive: it polls. So v2 keeps the *entire* v1 shape — the
- * server relays a sealed envelope it cannot read — and replaces only the key
- * agreement:
+ * Wraps the WASM-backed `encode` / `reconstruct` primitives in `wasm/rs.ts`
+ * with shard-padding bookkeeping so callers can hand it any-length input and
+ * get back uniform-size shards.
  *
- *   - the TV generates an ephemeral P-256 ECDH keypair in memory and publishes
- *     the public half ({@link generateDevicePairingKeypair});
- *   - the hosted page (the component that already holds the unlocked seed and
- *     already owns sealing) seals *to that public key* with a fresh ephemeral
- *     keypair of its own ({@link sealSeedToDevice}) — ECDH → HKDF-SHA256 →
- *     AES-256-GCM;
- *   - the TV recovers the seed with its private key
- *     ({@link unsealSeedFromDevice}).
+ * Usage:
+ *   const codec = new ReedSolomonCodec();
+ *   await codec.ready();
+ *   const { shards, shardSize, originalSize } = codec.encode(plaintext, 4, 2);
+ *   // 6 shards (4 data + 2 parity), each `shardSize` bytes
+ *   // …ship them, lose up to 2, then …
+ *   const recovered = codec.decode(shards, 2, deadIndexes, originalSize);
  *
- * The server stores and relays the v2 envelope byte-for-byte, exactly as it
- * does for v1, and can read neither. The one thing ECDH cannot supply is proof
- * that the public key the hosted page sealed to is *the TV's* rather than an
- * attacker's — that is what {@link pairingVerificationCode} is for, and it is
- * the only MITM defence in the flow (see the entropy note on that function).
+ * Why the explicit `originalSize`: RS pads input to make every data shard the
+ * same length. The decoder must trim that padding back off after recovery.
+ * The caller is responsible for stashing `originalSize` somewhere durable
+ * (the file manifest, in this codebase).
  */
-interface SealedHandoff {
-    /** base64 JSON envelope — relayed by the server in the grant; server-opaque. */
-    sealedKeys: string;
-    /** base64url one-time key — rides ONLY in the redirect URL fragment. */
-    fragmentKey: string;
+interface EncodeResult {
+    /** All `dataShards + parityShards` shards. All have length `shardSize`. */
+    shards: Uint8Array[];
+    /** Length of every shard (data and parity). */
+    shardSize: number;
+    /** Length of the original input before padding. Needed to trim on decode. */
+    originalSize: number;
+    /** How many of the leading shards are data (the rest are parity). */
+    dataShards: number;
+    /** How many parity shards trail the data shards. */
+    parityShards: number;
 }
-/** Seal the master seed under a fresh one-time key for the redirect handoff. */
-declare function sealSeed(seed: Uint8Array): Promise<SealedHandoff>;
-/** Recover the master seed from the sealed envelope + the fragment key. */
-declare function unsealSeed(sealedKeys: string, fragmentKey: string): Promise<Uint8Array>;
-/**
- * Alphabet for the pairing verification code: 30 symbols, every confusable pair
- * removed in BOTH directions — no `0`/`O`, no `1`/`I`/`L`, and no `U` (which is
- * read as `V` on the low-resolution, far-viewed type a TV renders). Because the
- * user compares this string across two screens by eye, unambiguity beats the
- * convenience of a power-of-two alphabet; the derivation below rejection-samples
- * to avoid the modulo bias that costs us.
- */
-declare const PAIRING_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTVWXYZ23456789";
-/** Length of the pairing verification code, in characters. 30^8 ≈ 39.3 bits. */
-declare const PAIRING_CODE_LENGTH = 8;
-/** An ephemeral ECDH keypair generated by the pairing device (the TV). */
-interface DevicePairingKeypair {
-    /** base64 raw (SEC1 uncompressed, 65 bytes) public key — safe to publish. */
-    publicKeyB64: string;
+declare class ReedSolomonCodec {
     /**
-     * Non-extractable private half. In-memory only, one per pairing attempt:
-     * it is never persisted and never leaves the device, so a captured pairing
-     * transcript is undecryptable once the attempt ends.
+     * Resolves once the WASM module is loaded; safe to call repeatedly.
+     *
+     * Pass `wasmModule` to use a pre-compiled module (e.g. in tests where the
+     * rollup-inlined loader path isn't available, or in CF Workers where you
+     * want to load the module at deploy time). Default path uses the bundled
+     * base64-inlined wasm — works in Node, browsers, and Workers.
      */
-    privateKey: CryptoKey;
+    ready(wasmModule?: WebAssembly.Module): Promise<void>;
+    /**
+     * Split `data` into `dataShards` equal-size chunks (zero-padded to fit),
+     * compute `parityShards` parity shards, and return all of them.
+     */
+    encode(data: Uint8Array, dataShards: number, parityShards: number): EncodeResult;
+    /**
+     * Reconstruct the original `data` from `shards`. Up to `parityShards`
+     * shards may be missing; for each missing shard, pass an empty
+     * `Uint8Array` placeholder at its position and list the position in
+     * `deadShardIndexes`.
+     *
+     * `originalSize` is required so the trailing zero-padding can be trimmed.
+     */
+    decode(shards: Uint8Array[], parityShards: number, deadShardIndexes: number[], originalSize: number): Uint8Array;
 }
+
 /**
- * (Device side) Generate the ephemeral P-256 ECDH keypair for one pairing
- * attempt. Call this once per attempt and throw it away when the attempt ends —
- * reusing a keypair across attempts would let an old, observed ciphertext be
- * decrypted by whoever later obtains the key.
- */
-declare function generateDevicePairingKeypair(): Promise<DevicePairingKeypair>;
-/**
- * (Hosted-page side) Seal the master seed *to a device's* pairing public key.
+ * Universal wasm-bindgen glue for `wasm-reed-solomon-erasure` (v0.2.2 — Rust
+ * Reed–Solomon erasure-coding library compiled with `wasm-pack --target nodejs`).
  *
- * A fresh ephemeral keypair is generated per call and its public half is
- * carried in the envelope (`epk`), so sealing the same seed to the same device
- * twice yields unrelated ciphertext — and the sealer retains nothing that could
- * later reopen the envelope.
+ * The upstream npm package ships `wasm_reed_solomon_erasure.js` which uses
+ * `require('fs').readFileSync()` to load the WASM file at module load time —
+ * that hard-codes Node and breaks browsers / CF Workers. This file is a port
+ * of that glue with the Node-only pieces removed:
  *
- * Returns the v2 `sealedKeys` string, which slots into exactly the same server
- * field as v1: relayed verbatim, never read.
- */
-declare function sealSeedToDevice(seed: Uint8Array, devicePublicKeyB64: string): Promise<string>;
-/**
- * (Device side) Recover the master seed from a v2 envelope using the ephemeral
- * private key from {@link generateDevicePairingKeypair}.
+ *   - `TextDecoder` is taken from the global (available in Node 12+, every
+ *     modern browser, and Workers — no `require('util')`).
+ *   - The WASM module is loaded via the rollup-inlined `.wasm` import, the
+ *     same `targetEnv: 'auto-inline'` path the bn128 verifier uses. Works in
+ *     Node, browser, and Workers without runtime fs access.
  *
- * Throws on any tamper: a substituted `epk` yields a different shared secret
- * (or fails point validation outright), and any edit to `iv`/`ct` fails the
- * AES-GCM tag. There is no path that returns partially-authenticated bytes.
+ * Only the two public functions consumers actually need (`encode` and
+ * `reconstruct`) are exported. The rest is the wbindgen heap-table dance.
  *
- * `devicePublicKeyB64` is the caller's OWN public half (from
- * {@link generateDevicePairingKeypair}). It is required, not optional, because
- * it is mixed into the KDF — see {@link deriveDeviceSealKey} for why binding the
- * recipient matters. A device always holds both halves, so this costs nothing.
+ * Encoding:
+ *   `encode(dataShards: Uint8Array[], parityShard: number)` → array of
+ *   `dataShards.length + parityShard` Uint8Arrays. The first N are the input
+ *   shards unchanged; the trailing M are the freshly computed parity shards.
+ *   All shards are the same length — caller is responsible for padding the
+ *   data into equal-size data shards.
+ *
+ * Reconstruction:
+ *   `reconstruct(corruptedShards, parityShard, deadIndexes)` → fully recovered
+ *   array. Pass placeholders (empty Uint8Arrays) at the dead indexes; the
+ *   reconstructor fills them in. Up to `parityShard` shards may be missing.
  */
-declare function unsealSeedFromDevice(sealedKeys: string, privateKey: CryptoKey, devicePublicKeyB64: string): Promise<Uint8Array>;
 /**
- * Short code derived deterministically from the device's pairing public key,
- * displayed on BOTH the TV and the approving browser so the human can confirm
- * they match before approving.
- *
- * ## What this is worth (be honest about it)
- *
- * ~39.3 bits (30^8), rendered in an unambiguous 30-symbol alphabet and grouped
- * as `XXXX-XXXX` for comparison. Alongside the recipient-key binding in
- * {@link deriveDeviceSealKey}, this is what stops a substituted device key: the
- * KDF rejects a *negated* key, and this code is what a human uses to reject a
- * wholly *attacker-generated* one, which the crypto cannot detect on its own —
- * ECDH proves nothing about WHOSE public key it is.
- *
- * Two attacks, and what each actually costs:
- *
- *   1. **Online grind.** Generate keypairs until one's code equals the honest
- *      TV's. ~2^39 trials. Naively that reads as "keygen + hash", but a real
- *      attacker never generates keys: walking `P_{i+1} = P_i + G` while tracking
- *      `d_i = d_0 + i` makes each trial one point-add plus one derivation. With
- *      a plain hash that is well under a core-day — which is why this uses
- *      PBKDF2-SHA256 at {@link PAIRING_CODE_ITERATIONS} iterations instead. The
- *      work factor applies per trial, pushing the same grind to the order of
- *      10^5 core-days. The target is also only learned when pairing starts, so
- *      the grind is online against the pairing TTL (keep it minutes).
- *   2. **Precomputed table.** The reason this is not a plain hash. A table over
- *      candidate keys is computed once and reused forever; with SHA-256 that is
- *      cheap enough to be the preferred attack. The iteration count multiplies
- *      the table's build cost by the same 2 * 10^5.
- *
- * Neither is a proof of security, and an adversary with ASIC-scale hardware
- * changes these numbers. If the margin is ever judged insufficient, raise
- * {@link PAIRING_CODE_LENGTH} — 10 characters buys ~49 bits for two more
- * characters of human comparison, and is display-only: it does not touch the
- * envelope or the wire format.
+ * Load and instantiate the WASM module. Idempotent — repeated calls await the
+ * same one-shot promise.
  *
- * The cost is paid once per pairing, on two idle devices, so ~200k iterations
- * is imperceptible here in a way it would not be on a hot path.
+ * Two ways to initialize, matching the pattern used by `workers/groth16-verifier`:
+ *   1. `await initRsWasm()` — uses the bundled .wasm (base64-inlined at build
+ *      time by `@rollup/plugin-wasm`). Works in any runtime that allows
+ *      runtime `WebAssembly.compile()`.
+ *   2. `await initRsWasm(myWasmModule)` — accepts a pre-compiled
+ *      `WebAssembly.Module`. Useful when the bundled loader path isn't
+ *      available (vitest, CF Workers wanting deploy-time precompile, etc.).
  */
-declare function pairingVerificationCode(devicePublicKeyB64: string): Promise<string>;
-interface Pkce {
-    codeVerifier: string;
-    codeChallenge: string;
-}
-/** Generate a PKCE verifier + S256 challenge for the authorize→token exchange. */
-declare function generatePkce(): Promise<Pkce>;
-/** A random URL-safe value for the OAuth `state` (CSRF binding on the callback). */
-declare function randomState(): string;
+declare function initRsWasm(wasmModule?: WebAssembly.Module): Promise<void>;
 
 /**
  * `SessionState` — the in-memory source of truth for "who is signed in" on a
@@ -6317,205 +6635,56 @@ declare class Client {
     /** Per-user key/value storage — `client.kv.set(...)`, etc. */
     readonly kv: KvNamespace;
     /** App scalable database — `client.db.table('todos').query(...)`, etc. */
-    readonly db: DbNamespace;
-    /** File storage — `client.storage.writeFile(...)`, etc. */
-    readonly storage: StorageNamespace;
-    /** Filesystem over the personal space: directories, versions, real paths. */
-    readonly vfs: VfsNamespace;
-    /** Version control over the VFS: commits, branches, merges — per project. */
-    readonly vcs: VcsNamespace;
-    /** Realtime messaging — `client.message.subscribe(...)`, etc. */
-    readonly message: MessageNamespace;
-    /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
-    readonly space: SpaceNamespace;
-    /** Programmable Agents — `client.agents.create(appId, …)`, etc. */
-    readonly agents: AgentsNamespace;
-    /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
-    readonly functions: FunctionsNamespace;
-    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
-    readonly accessTokens: AccessTokensNamespace;
-    /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
-    readonly offline: OfflineManager;
-    private readonly session;
-    private readonly http;
-    /** Subscribers notified when a session expires and can't be recovered. */
-    private readonly sessionExpiredHandlers;
-    /** Shared in-flight recovery so a burst of 401s triggers one re-auth. */
-    private recoverInFlight;
-    constructor(options?: ClientOptions);
-    /** The currently signed-in user, or `null`. */
-    get user(): AuthUser | null;
-    /** Whether a token-bearing session is active. */
-    get isAuthenticated(): boolean;
-    /**
-     * Subscribe to session expiry that couldn't be silently recovered (the
-     * user's identity wasn't in memory to re-prove — typically after a reload
-     * where only the token was persisted, and that token has since gone stale).
-     * This is the signal to send the user back to the login screen.
-     *
-     * Returns an unsubscribe function.
-     *
-     *   const off = client.onSessionExpired(() => router.push('/login'));
-     */
-    onSessionExpired(handler: () => void): () => void;
-    /**
-     * Attempt a silent re-auth of the current user. Concurrent callers share a
-     * single in-flight attempt (a stale token usually 401s several requests at
-     * once — we re-auth once, not once per request). On failure the
-     * session-expired event fires so the app can react. Exposed so apps can
-     * also drive recovery proactively (e.g. on `visibilitychange`).
-     */
-    recoverSession(): Promise<boolean>;
-}
-
-/**
- * `deviceStore` — at-rest persistence for a paired device (the TV).
- *
- * A device that has completed {@link HostedAuth.startDevicePairing} holds the
- * account's **master seed**. Android WebView has no WebAuthn, so the passkey
- * wrapping used elsewhere isn't available, and re-pairing on every cold start
- * is not acceptable UX for a set-top box. So the seed is persisted, encrypted:
- *
- * | Item                     | Where                                | Form |
- * | ------------------------ | ------------------------------------ | ---- |
- * | wrapping key             | IndexedDB (`muhkoo.device.v1`)       | `CryptoKey`, AES-GCM-256, **non-extractable** |
- * | device identity keypair  | IndexedDB (`muhkoo.device.v1`)       | `CryptoKeyPair`, ECDSA P-256, private half **non-extractable** |
- * | sealed identity blob     | localStorage `muhkoo.tv.identity.v1` | `{"v":1,"iv":…,"ct":…}` over `JSON{username, commitment, seed(b64), pairedAt}` |
- *
- * The split is deliberate — ciphertext in one backend, key in another, and the
- * key non-extractable so JS can *use* it but not export it.
- *
- * ## Be honest about what this is worth
- *
- * **This is obfuscation, not protection.** It raises the cost of a casual
- * `localStorage` dump to "nothing useful", and that is all:
- *
- *   - **XSS on the device origin** cannot *exfiltrate* the wrapping key (it is
- *     non-extractable) but can absolutely call `decrypt` and read the seed. The
- *     only mitigation is that there is no third-party script in the shell —
- *     enforce a strict CSP with no `unsafe-inline`, no CDN, no remote fonts.
- *   - **ADB / root / a backup extraction / a forensic image recovers the seed.**
- *     The IndexedDB LevelDB files hold the AES key bytes in the clear; WebCrypto
- *     "non-extractable" is a JS-API boundary, not an OS one. **A stolen device is
- *     a stolen identity.**
- *
- * That is not an implementation shortcut, it is the shape of the problem: any
- * wrapping key usable without user interaction lives somewhere equally readable
- * on a keyboard-less device with no hardware key store exposed to WebView.
- * Reduce the blast radius with `android:allowBackup="false"`,
- * `android:debuggable="false"`, a strict CSP, and by storing *only* the 32-byte
- * seed + username + commitment (never a session token, never a recovery phrase).
- *
- * ## Documented upgrade path — no protocol change
- *
- * If the native shell exposes a Keystore bridge:
- *
- * ```java
- * @JavascriptInterface public String wrap(String b64plain);    // AES-GCM, StrongBox when present
- * @JavascriptInterface public String unwrap(String b64cipher);
- * ```
- *
- * this module prefers `globalThis.MuhkooKeystore` automatically and falls back
- * to the WebCrypto scheme otherwise. The Keystore key is hardware-backed and
- * non-exportable at the OS level, so a copied filesystem image alone becomes
- * useless. Nothing on the wire, in the endpoint contracts, or in the SDK surface
- * changes — only the two functions below do, internally.
- *
- * ## Degradation
- *
- * Nothing here throws at import time. On a runtime with neither backend (SSR,
- * Workers, Node) the module still loads: {@link loadDeviceIdentity} returns
- * `null`, {@link persistDeviceIdentity} throws a typed
- * {@link DeviceStoreUnavailableError} the caller can swallow, and
- * {@link deviceIdentityKey} falls back to an **in-memory** keypair for the
- * lifetime of the process (so pairing still works; the device is just never
- * recognised as "known" on a later run).
- */
-/** localStorage key holding the AES-GCM-sealed identity blob. */
-declare const DEVICE_IDENTITY_STORAGE_KEY = "muhkoo.tv.identity.v1";
-/** IndexedDB database holding the non-extractable keys. */
-declare const DEVICE_KEY_DB_NAME = "muhkoo.device.v1";
-/** What a paired device persists. The seed **is** the identity — treat it as such. */
-interface PersistedDeviceIdentity {
-    username: string;
-    /** Decimal-string Poseidon commitment. Pinned: a later pairing that yields a
-     *  different commitment for this device must be refused, not adopted. */
-    commitment: string;
-    /** The 32-byte master seed. */
-    seed: Uint8Array;
-    pairedAt: number;
-}
-/** Thrown when persistence is impossible (no IndexedDB and/or no localStorage). */
-declare class DeviceStoreUnavailableError extends Error {
-    constructor(what: string);
-}
-/** Key/value store for live `CryptoKey` objects (IndexedDB in the browser). */
-interface DeviceKeyVault {
-    get(id: string): Promise<unknown | null>;
-    put(id: string, value: unknown): Promise<void>;
-    /** Delete the entire store — used by `clearDeviceIdentity`. */
-    destroy(): Promise<void>;
-}
-/** String store for the sealed blob (localStorage in the browser). */
-interface DeviceBlobStore {
-    get(key: string): string | null;
-    set(key: string, value: string): void;
-    remove(key: string): void;
-}
-/** The native Keystore bridge, when the shell provides one (see module docs). */
-interface MuhkooKeystoreBridge {
-    wrap(b64plain: string): string | Promise<string>;
-    unwrap(b64cipher: string): string | Promise<string>;
+    readonly db: DbNamespace;
+    /** File storage — `client.storage.writeFile(...)`, etc. */
+    readonly storage: StorageNamespace;
+    /** Filesystem over the personal space: directories, versions, real paths. */
+    readonly vfs: VfsNamespace;
+    /** Version control over the VFS: commits, branches, merges — per project. */
+    readonly vcs: VcsNamespace;
+    /** Realtime messaging — `client.message.subscribe(...)`, etc. */
+    readonly message: MessageNamespace;
+    /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
+    readonly space: SpaceNamespace;
+    /** Programmable Agents — `client.agents.create(appId, …)`, etc. */
+    readonly agents: AgentsNamespace;
+    /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
+    readonly functions: FunctionsNamespace;
+    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
+    readonly accessTokens: AccessTokensNamespace;
+    /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
+    readonly offline: OfflineManager;
+    private readonly session;
+    private readonly http;
+    /** Subscribers notified when a session expires and can't be recovered. */
+    private readonly sessionExpiredHandlers;
+    /** Shared in-flight recovery so a burst of 401s triggers one re-auth. */
+    private recoverInFlight;
+    constructor(options?: ClientOptions);
+    /** The currently signed-in user, or `null`. */
+    get user(): AuthUser | null;
+    /** Whether a token-bearing session is active. */
+    get isAuthenticated(): boolean;
+    /**
+     * Subscribe to session expiry that couldn't be silently recovered (the
+     * user's identity wasn't in memory to re-prove — typically after a reload
+     * where only the token was persisted, and that token has since gone stale).
+     * This is the signal to send the user back to the login screen.
+     *
+     * Returns an unsubscribe function.
+     *
+     *   const off = client.onSessionExpired(() => router.push('/login'));
+     */
+    onSessionExpired(handler: () => void): () => void;
+    /**
+     * Attempt a silent re-auth of the current user. Concurrent callers share a
+     * single in-flight attempt (a stale token usually 401s several requests at
+     * once — we re-auth once, not once per request). On failure the
+     * session-expired event fires so the app can react. Exposed so apps can
+     * also drive recovery proactively (e.g. on `visibilitychange`).
+     */
+    recoverSession(): Promise<boolean>;
 }
-/**
- * Point the store at explicit backends (or `null` to force "unavailable"), and
- * reset the memoized device keypair. Testing / embedding seam — pass `{}` to
- * restore the default browser backends.
- */
-declare function configureDeviceStore(opts?: {
-    keys?: DeviceKeyVault | null;
-    blobs?: DeviceBlobStore | null;
-    keystore?: MuhkooKeystoreBridge | null;
-}): void;
-/**
- * True when {@link deviceIdentityKey} had to fall back to an in-memory keypair
- * because no key vault was available. Such a device can pair, but will never be
- * recognised as "known" afterwards (so approval always needs a fresh factor).
- */
-declare function deviceIdentityIsEphemeral(): boolean;
-/**
- * The device's **persistent** ECDSA P-256 identity keypair, created on first
- * call. This is not a browser fingerprint — it is a key, and every
- * `POST /api/auth/device/code` proves possession of it. Without that proof,
- * "known device" would be an unauthenticated string anyone could claim in order
- * to skip the approver's re-authentication.
- *
- * The private half is non-extractable and never leaves IndexedDB as bytes.
- */
-declare function deviceIdentityKey(): Promise<CryptoKeyPair>;
-/** `base64url(SHA-256(raw SEC1 device identity public key))` — 43 chars. */
-declare function deviceFingerprint(): Promise<string>;
-/** Whether a sealed identity blob exists. Cheap: no crypto, no IndexedDB, no network. */
-declare function hasDeviceIdentity(): Promise<boolean>;
-/**
- * Seal and store the identity. Throws {@link DeviceStoreUnavailableError} when
- * there is nowhere to put it — callers should treat that as "this device won't
- * resume", not as a pairing failure.
- */
-declare function persistDeviceIdentity(v: PersistedDeviceIdentity): Promise<void>;
-/**
- * Recover the persisted identity, or `null` when there is none / it can't be
- * opened (wiped IndexedDB, a different browser profile, a corrupted blob).
- * Never throws — a cold start with unreadable storage must fall back to a fresh
- * pairing, not to an error screen.
- */
-declare function loadDeviceIdentity(): Promise<PersistedDeviceIdentity | null>;
-/**
- * Wipe everything: the sealed blob **and** the whole key database — so the
- * wrapping key never outlives the ciphertext it opens, and the device identity
- * key is regenerated (a re-pair is then correctly treated as a new device).
- */
-declare function clearDeviceIdentity(): Promise<void>;
 
 /**
  * Three-way line merge.
@@ -6558,92 +6727,6 @@ declare function merge3Text(base: string, ours: string, theirs: string, labels?:
     conflicted: boolean;
 };
 
-/**
- * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
- *
- * A passkey becomes a device-bound, platform-synced source of a stable secret:
- * for a fixed salt, the authenticator's PRF returns the same 32 bytes, which we
- * HKDF into an AES key that wraps the master seed. The server never sees the
- * passkey — it's purely a local key source; the ZK proof remains the server auth.
- *
- * BROWSER ONLY (`navigator.credentials`). The PRF extension fields aren't in the
- * standard DOM types yet, so they're reached through narrow casts.
- */
-/** Whether this environment can do WebAuthn at all. (PRF support is checked at enroll.) */
-declare function passkeySupported(): boolean;
-/**
- * Whether this browser's authenticator can do the **PRF extension** our passkey
- * factor needs. A browser can save passkeys (e.g. for password autofill) yet not
- * expose PRF — PRF is what derives the stable secret we wrap the seed under, so a
- * passkey without it is useless to us.
- *
- * Uses `PublicKeyCredential.getClientCapabilities()` (the `extension:prf` cap)
- * where available. Returns:
- *   - `true`  — PRF is supported,
- *   - `false` — definitively NOT supported (hide the option),
- *   - `null`  — couldn't determine (older browser without the capabilities API);
- *              the caller may optimistically allow and let enroll surface a real
- *              error if it turns out PRF isn't there.
- */
-declare function passkeyPrfCapable(): Promise<boolean | null>;
-/** Best-effort registrable RP id — the host. Apps spanning subdomains should pass
- *  the parent domain (e.g. "muhkoo.dev") explicitly. */
-declare function defaultRpId(): string;
-/**
- * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
- *
- * WebAuthn only accepts an RP id that is the origin's own host or a registrable
- * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
- * `app.example.net`, and one enrolled on a full host is unusable from a sibling
- * host. An app served on BOTH a custom domain and the platform host therefore
- * needs one passkey per origin.
- *
- * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
- * a raw "The requested RPID did not match the origin or related origins", which
- * is a dead end for the user. Checking first lets the caller fall back to normal
- * sign-in (and offer to enroll a passkey for this origin) instead.
- */
-declare function rpIdUsableForOrigin(rpId: string | undefined | null, host?: string): boolean;
-/**
- * Would {@link AuthNamespace.loginWithPasskey} accept a factor recorded with
- * this `rpId`, from `host`?
- *
- * This is deliberately NOT the same as {@link rpIdUsableForOrigin}. That answers
- * a raw WebAuthn question and is `false` for a missing rpId. But a factor with
- * NO recorded rpId predates per-origin enrolment, and `loginWithPasskey`
- * resolves it as `params.rpId ?? host` — so it IS usable, from anywhere.
- *
- * Callers deciding "should I even try a passkey here?" must use this one.
- * Reaching for `rpIdUsableForOrigin` instead silently excludes every legacy
- * passkey holder, which has locked real users out of production twice.
- *
- * The `?? host` fallback applies to nullish only, matching `loginWithPasskey`:
- * an empty-string rpId stays unusable rather than resolving to the host.
- */
-declare function passkeyUsableFromOrigin(rpId: string | undefined | null, host?: string): boolean;
-/** Thrown when the account's passkey belongs to a different origin. Callers
- *  should treat this as "no passkey here" and fall back to another factor. */
-declare class PasskeyOriginError extends Error {
-    readonly code = "passkey_wrong_origin";
-    constructor(message?: string);
-}
-interface PasskeyEnrollment {
-    credentialId: Uint8Array;
-    prfSalt: Uint8Array;
-    prfOutput: Uint8Array;
-}
-/**
- * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
- * the PRF output for that salt. Throws if the authenticator can't do PRF.
- */
-declare function createPasskeyWithPrf(opts: {
-    rpId: string;
-    rpName: string;
-    username: string;
-}): Promise<PasskeyEnrollment>;
-/** Evaluate a passkey's PRF for `salt` → 32 bytes. Used at recover/login. */
-declare function evaluatePasskeyPrf(rpId: string, credentialId: Uint8Array, salt: Uint8Array): Promise<Uint8Array>;
-
 /**
  * Muhkoo app decorators — declare your app's agent-facing surface in code, then
  * "eject" a system prompt you hand to a Programmable Agent.
@@ -7548,5 +7631,271 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, ReauthRequiredError, ReedSolomonCodec, Repo, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, generateAuthProof, generateDevicePairingKeypair, generatePkce, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbQueryPage, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+declare class Logger {
+    private prefix;
+    private logLevel;
+    private console;
+    private showCaller;
+    level: string;
+    constructor(prefix?: string, LOGLEVEL?: string, showCaller?: boolean);
+    private shouldLog;
+    /**
+     * Extract caller information from stack trace
+     */
+    private getCallerInfo;
+    /**
+     * Format caller info for display
+     */
+    private formatCallerInfo;
+    setLevel(level: string): void;
+    setShowCaller(show: boolean): void;
+    info(...args: any[]): void;
+    log(...args: any[]): void;
+    verbose(...args: any[]): void;
+    success(...args: any[]): void;
+    warn(...args: any[]): void;
+    error(...args: any[]): void;
+    debug(...args: any[]): void;
+    assert(condition?: boolean, ...data: any[]): void;
+    clear(): void;
+    count(label?: string): void;
+    countReset(label?: string): void;
+    dir(item?: any, options?: any): void;
+    dirxml(...data: any[]): void;
+    group(...data: any[]): void;
+    groupCollapsed(...data: any[]): void;
+    groupEnd(): void;
+    table(tabularData?: any, properties?: string[]): void;
+    time(label?: string): void;
+    timeEnd(label?: string): void;
+    timeLog(label?: string, ...data: any[]): void;
+    trace(...data: any[]): void;
+    profile(label?: string): void;
+    profileEnd(label?: string): void;
+    timeStamp(label?: string): void;
+}
+
+declare const log: Logger;
+
+declare global {
+    interface Console {
+        success(...args: any[]): void;
+        verbose(...args: any[]): void;
+    }
+}
+
+/**
+ * Byte conversion helpers usable in both Node and the browser.
+ *
+ * Replaces Node's `Buffer` API for the small set of operations we actually
+ * need in the crypto layer: hex/base64/base64url encode + decode, and array
+ * concatenation. Lets `DoubleRatchet`, `KeyStore`, etc. compile against
+ * platforms without `Buffer` (browsers, CF Workers).
+ */
+/** Encode a byte array as a lowercase hex string. */
+declare function toHex(bytes: Uint8Array): string;
+/** Decode a hex string into a byte array. Accepts upper/lowercase; rejects odd-length input. */
+declare function fromHex(hex: string): Uint8Array<ArrayBuffer>;
+/** Encode a byte array as a standard base64 string. */
+declare function toBase64(bytes: Uint8Array): string;
+/** Decode a standard base64 string to bytes. */
+declare function fromBase64(b64: string): Uint8Array<ArrayBuffer>;
+/** Encode a byte array as a base64url string (no padding). */
+declare function toBase64Url(bytes: Uint8Array): string;
+/** Decode a base64url string (with or without padding) to bytes. */
+declare function fromBase64Url(b64url: string): Uint8Array<ArrayBuffer>;
+/** Concatenate any number of byte arrays into a single Uint8Array. */
+declare function concatBytes(...arrays: (Uint8Array | ArrayBuffer)[]): Uint8Array<ArrayBuffer>;
+/** Encode a UTF-8 string as bytes. Thin wrapper around TextEncoder for symmetry. */
+declare function utf8Encode(s: string): Uint8Array<ArrayBuffer>;
+/** Decode UTF-8 bytes to a string. */
+declare function utf8Decode(bytes: Uint8Array): string;
+
+/**
+ * @public
+ * @remarks Asserts the basic type of a variable
+ * @param value - The value to check
+ * @param type - The expected type
+ *
+ * @throws Error - If the type of the value does not match the expected type
+ *
+ */
+declare function assertType<T>(value: unknown, typeOrConstructors: string | (new (...args: any[]) => any) | (new (...args: any[]) => any)[]): asserts value is T;
+/**
+ * @public
+ * @remarks Encodes a string to Base58
+ * @param input - the data to encode, must be a cloneable object
+ * @returns string
+ */
+declare function base58Encode(input: ArrayBuffer | string): string;
+/**
+ * @public
+ * @remarks Decodes a Base58 string to a Uint8Array
+ * @param input - the Base58 string to decode
+ * @returns Uint8Array
+ */
+declare function base58Decode(input: string): ArrayBuffer;
+/**
+ * @public
+ * @remarks Generates a checksum for a given input
+ * @param input - The input to generate a checksum for as a string
+ * @returns string
+ */
+declare function generateChecksum(input: string): string;
+/**
+ * @public
+ * @remarks Verifies a checksum for a given input
+ * @param input - The input to verify as a string
+ * @param checksum - The checksum to verify as a string
+ * @returns boolean
+ */
+declare function verifyChecksum(input: string, checksum: string): boolean;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a given packet
+ * @returns string
+ */
+declare function _packetId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a given object
+ * @returns string
+ *
+ */
+declare function _objectId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a given user
+ * @returns string
+ *
+ */
+declare function _userId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a given account
+ * @returns string
+ *
+ */
+declare function _accountId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a socket
+ * @returns string
+ *
+ */
+declare function _socketId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a message
+ * @returns string
+ */
+declare function _messageId(): string;
+/**
+ * @public
+ * @remarks Generates a random UUID and base58 encodes it
+ * @returns string
+ */
+declare function generateId(): string;
+/**
+ * @public
+ * @remarks Serializes data to a base58 encoded string
+ * @param data - The data to serialize
+ * @typeParam T - The type of the data to serialize
+ * @returns base58 encoded string
+ */
+declare function serialize<T>(data: T): string;
+/**
+ * @public
+ * @remarks Deserializes a base58 encoded string to data
+ * @param base58String - The base58 encoded string to deserialize
+ * @returns Deserialized data
+ */
+declare function deserialize<T>(base58String: string): T;
+/**
+ * @public
+ * @remarks Retries a method a specified number of times with a delay between each attempt, this is a decorator
+ * @param retries - The number of times to retry the method
+ * @param delay - The delay in milliseconds between each attempt
+ */
+declare function Retry(retries?: number, delay?: number): MethodDecorator;
+/**
+ * @public
+ * @remarks Waits for a class property to be ready before executing a method, this is a decorator.
+ * @param readyPropertyName - The class property to check for readiness
+ */
+declare function Ready(readyPropertyName?: string): MethodDecorator | PropertyDecorator;
+/**
+ * Converts bytes into a more human-friendly format (e.g., KB, MB, GB).
+ * @internal
+ * @param bytes - The number of bytes to convert.
+ * @param decimals - The number of decimals to display (default is 2).
+ * @returns A formatted string representing the size in appropriate units.
+ */
+declare function _formatBytes(bytes: number, decimals?: number): string;
+/**
+ * Retrieves the IP address(es) for a given hostname using Cloudflare's DNS-over-HTTPS service.
+ *
+ * This function queries the Cloudflare DNS API to resolve the provided hostname to its corresponding
+ * IPv4 address(es) (A records). It returns an array of IP addresses or logs an error if the resolution fails.
+ *
+ * @param hostname - The hostname to resolve (e.g., "example.com").
+ * @returns A promise that resolves to an array of IP addresses (strings) associated with the hostname.
+ *          If no IP addresses are found or an error occurs, an empty array or undefined may be returned.
+ * @throws Error If the DNS query fails due to a network error or invalid response from the server.
+ * @public
+ * @example
+ * ```typescript
+ * import { log } from '@muhkoo/connect/utilities';
+ * getIPAddress("example.com").then(ips => log.debug(ips));
+ * // Output: ["93.184.216.34"]
+ * ```
+ */
+declare function getIPAddress(hostname: string): Promise<any>;
+declare function isNumber(value: string | number): boolean;
+declare function getId(row: {
+    insertId?: number;
+    id?: number;
+}): number;
+
+/**
+ * SDK build version — stamped to the console when a {@link Client} is created.
+ *
+ * During active development, bump the `-alpha.N` suffix whenever we ship a build
+ * so we can confirm in the browser console that the page is running the build we
+ * expect (and isn't serving a stale cached bundle). Keep this in sync with
+ * `package.json` `version`.
+ */
+declare const VERSION = "0.14.0-alpha.8";
+
+/**
+ * The SDK's process-global logger.
+ *
+ * Eight modules under `src/` read a bare `appLogger` off `globalThis` rather
+ * than importing one (`src/crypto/{KeyStore,DoubleRatchet,DoubleRatchetManager,
+ * Authenticator}.ts`, `src/core/Client.ts`,
+ * `src/core/namespaces/HostedAuth.ts`, `src/events/EventCore.ts`), so the
+ * binding has to exist before any of them runs, and the `declare global` below
+ * is what makes that typecheck.
+ *
+ * This module is the single place that bootstrap happens. It previously lived
+ * inline in three entry files — `src/browser/index.ts`, `src/workers/index.ts`,
+ * and `src/core/index.ts` (which `src/server/index.ts` picked up as an import
+ * side effect) — three copies that could drift.
+ *
+ * `??=` makes it idempotent, so importing it from several entries in one
+ * process is safe and the first writer wins.
+ *
+ * KNOWN HAZARD: package.json declares `"sideEffects": false`, which entitles a
+ * tree-shaker to drop a module imported purely for effect. The entries import
+ * this one for its `export`s as well, so it survives today — but the durable
+ * fix is to convert those eight bare reads into real imports of `appLogger`
+ * from here, which removes the reliance on a global entirely.
+ */
+
+declare global {
+    var appLogger: InstanceType<typeof Logger>;
+}
+declare const appLogger: InstanceType<typeof Logger>;
+
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };