@muhkoo/connect 0.14.0-alpha.7 → 0.14.0-alpha.9

package/dist/connect.d.ts

@@ -535,116 +535,6 @@ declare class DoubleRatchet {
     setState(state: RatchetState): void;
 }
 
-type SnarkProof = Groth16Proof;
-
-interface ZkCompiled {
-    verificationKey: VerificationKey;
-}
-declare class AuthPublicInput {
-    commitment: string;
-    nonce: string;
-    ecdsaPubHash: string;
-    constructor(commitment: string, nonce: string, ecdsaPubHash: string);
-    toPublicSignals(): string[];
-}
-declare class Field {
-    private value;
-    static readonly FIELD_SIZE: bigint;
-    constructor(value: bigint | string | number);
-    toBigInt(): bigint;
-    toString(): string;
-    toHex(): string;
-    equals(other: Field): boolean;
-    static fromHex(hex: string): Field;
-}
-declare class Poseidon {
-    static hash(inputs: Field[]): Promise<Field>;
-}
-declare function encodeToHex(field: Field): string;
-declare function decodeFromHex(hexStr: string): Field;
-interface CircuitBufferConfig {
-    wasm: Uint8Array;
-    zkey: Uint8Array;
-    verificationKey: VerificationKey;
-}
-declare class HashKnowledge {
-    private static wasmBuffer?;
-    private static zkeyBuffer?;
-    private static verificationKey?;
-    static setCircuitBuffers(wasm: Uint8Array, zkey: Uint8Array, verificationKey: VerificationKey): void;
-    static compile(): Promise<ZkCompiled>;
-    static prove(secret: Field): Promise<{
-        proof: SnarkProof;
-        publicSignals: string[];
-    }>;
-    static verify(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
-}
-declare class PreimagePoK {
-    private static wasmBuffer?;
-    private static zkeyBuffer?;
-    private static verificationKey?;
-    static setCircuitBuffers(wasm: Uint8Array, zkey: Uint8Array, verificationKey: VerificationKey): void;
-    static compile(): Promise<ZkCompiled>;
-    static prove(publicInput: AuthPublicInput, secret: Field, salt: Field, ecdsaPub: Field): Promise<{
-        proof: SnarkProof;
-        publicSignals: string[];
-    }>;
-    static verify(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
-}
-declare function verifyHashKnowledge(proof: SnarkProof, expectedOutput?: Field, publicSignals?: string[]): Promise<boolean>;
-declare function verifyPreimagePoK(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
-declare function verify(programType: 'HashKnowledge' | 'PreimagePoK', proof: SnarkProof, options?: {
-    expectedOutput?: Field;
-    publicSignals?: string[];
-}): Promise<boolean>;
-declare function quickVerify(program: typeof HashKnowledge | typeof PreimagePoK, proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
-declare function initializeCircuits(config: {
-    hashKnowledge?: CircuitBufferConfig;
-    preimagePoK?: CircuitBufferConfig;
-}): void;
-declare function compilePrograms(): Promise<{
-    hashKnowledge: ZkCompiled;
-    preimagePoK: ZkCompiled;
-}>;
-
-interface AuthToken {
-    peerId: string;
-    timestamp: number;
-    signature: string;
-}
-declare class Authenticator {
-    private trustedKeys;
-    private zkVerificationKey;
-    initializeZK(): Promise<void>;
-    getZKVerificationKey(): VerificationKey | null;
-    addTrustedServer(serverId: string, publicKey: CryptoKey): void;
-    generateAuthToken(peerId: string, privateKey: CryptoKey): Promise<AuthToken>;
-    verifyAuthToken(token: AuthToken, clientPublicKey: CryptoKey): Promise<boolean>;
-    verifyZKProof(proof: any, publicInput: AuthPublicInput, storedCommitment: Field, ecdsaPub: CryptoKey): Promise<boolean>;
-}
-
-declare class DoubleRatchetManager {
-    private sessions;
-    private sessionStates;
-    private keyStore;
-    private _authenticator;
-    private registeredUsers;
-    private id;
-    constructor(id: string);
-    get authenticator(): Authenticator;
-    addTrustedServer(serverId: string, publicKey: CryptoKey): Promise<void>;
-    registerZK(clientId: string, secret: Field, salt: Field, ecdsaPub: CryptoKey): Promise<void>;
-    performHandshake(senderId: string, recipientId: string, zkProof: any, publicInput: AuthPublicInput, clientPublicKey: CryptoKey, // ECDH pub for session
-    clientAuthPublicKey: CryptoKey, // ECDSA pub for auth
-    authToken: AuthToken): Promise<void>;
-    initializeSession(senderId: string, recipientId: string, isClient?: boolean, sessionType?: 'global' | 'specific', sessionId?: string, zkProof?: any, publicInput?: AuthPublicInput, clientPublicKey?: CryptoKey, clientAuthPublicKey?: CryptoKey, clientEcdhPrivateKey?: CryptoKey, clientAuthPrivateKey?: CryptoKey): Promise<string>;
-    encrypt(senderId: string, recipientId: string, sessionId: string, plaintext: string, newDhKey?: boolean, sessionType?: 'global' | 'specific'): Promise<CipherMessage>;
-    decrypt(message: CipherMessage, isClient?: boolean): Promise<string>;
-    getSessionSharedSecret(sessionId: string): Promise<Uint8Array | null>;
-    private saveState;
-    private loadState;
-}
-
 /**
  * Per-chunk AES-256-GCM encryption with random keys and IVs.
  *
@@ -768,6 +658,11 @@ declare enum EventCoreEvents {
  */
 declare class EventCore {
     private static eventTarget;
+    /**
+     * `event -> (caller's handler -> the wrapper actually registered on the
+     * EventTarget)`. Two levels because one event can have many listeners and
+     * {@link off} must remove exactly the wrapper it registered for that caller.
+     */
     private static events;
     /**
      * @remarks Listen to an event.
@@ -928,7 +823,7 @@ declare class EncryptedSession {
  *
  * Hands raw frame strings up (via the `MESSAGE` event) and accepts raw frame
  * strings down (via `send`). Anything frame-shape, encryption, or serialization
- * related belongs in the layer above (e.g. `Network` for client↔server
+ * related belongs in the layer above (e.g. `BroadcastChannel` for client↔server
  * encrypted pipes, `BroadcastChannel` for multi-peer E2E rooms).
  *
  * Responsibilities:
@@ -1084,7 +979,7 @@ declare class WSTransport extends EventCore {
  *             anything else                 — passes through as `raw_frame`
  *                                              (the app decides what to do)
  *
- * **Event scoping.** Unlike `Network`, BroadcastChannel uses a per-instance
+ * **Event scoping.** BroadcastChannel uses a per-instance
  * `EventTarget`, so two channels (e.g. two rooms in the same app) don't
  * cross-contaminate each other's events.
  *
@@ -1209,1202 +1104,1625 @@ declare function initBn128Wasm(wasmModule?: WebAssembly.Module): Promise<Bn128Wa
  */
 declare function verifyGroth16(wasmInstance: WebAssembly.Instance, memory: WebAssembly.Memory, initialPFree: number, verificationKey: VerificationKey, proof: Groth16Proof, publicSignals: string[]): Promise<boolean>;
 
-/**
- * `PersonalSpaceClient` — the client-side counterpart to the accelerator's
- * `PersonalSpaceDO`. Wraps the `/api/personal/:commitment/*` HTTP protocol so
- * callers can `put` / `get` / `delete` / `list` per-user KV blobs without
- * thinking about challenges, nonces, or Groth16 proof generation.
- *
- * Every gated operation:
- *   1. Requests a one-shot challenge from the DO (`POST /challenge`).
- *   2. Converts the returned hex nonce into a BN254 field element.
- *   3. Generates a fresh Groth16 proof for the `preimagePoK` circuit using
- *      snarkjs, with the user's secret/salt/ecdsaPub as private inputs and
- *      `{commitment, nonce, ecdsaPubHash}` as public signals.
- *   4. POSTs the proof + publicSignals + (optional) value to the gated endpoint.
- *
- * snarkjs is loaded lazily (dynamic `import`) the first time a proof is
- * generated — it's an optional peer dependency that only the ZK-proof path
- * needs, so importing this module (or constructing a `Client`) never requires
- * it. Consumers using the proof path install `snarkjs`, or provide it via an
- * import map in the browser (see the README).
- *
- * Encryption of the stored values is the caller's responsibility — the DO
- * sees only opaque JSON. The companion `wrap.ts` helpers in this folder are
- * a convenient way to passphrase-encrypt a payload before putting it.
- */
-/**
- * Constructor options for {@link PersonalSpaceClient}.
- *
- * All of `secret`, `salt`, `ecdsaPub`, and `ecdsaPubHash` are decimal-encoded
- * BigInt strings (snarkjs convention). `commitment` is likewise decimal — it's
- * the Poseidon hash of `(secret, salt, ecdsaPubHash)`.
- */
-interface PersonalSpaceClientOptions {
-    /** Base URL of the accelerator, e.g. `http://localhost:8787`. */
-    baseUrl: string;
-    /** The user's Poseidon commitment as a decimal string (~78 digits). */
+type SnarkProof = Groth16Proof;
+
+interface ZkCompiled {
+    verificationKey: VerificationKey;
+}
+declare class AuthPublicInput {
     commitment: string;
-    /** ZK identity material — private inputs to the proof. Decimal BigInt string. */
-    secret: string;
-    /** ZK identity salt. Decimal BigInt string. */
-    salt: string;
-    /** Raw ECDSA public-key field representation. Decimal BigInt string. */
-    ecdsaPub: string;
-    /** Poseidon hash of `ecdsaPub`, used as a public signal. Decimal BigInt string. */
+    nonce: string;
     ecdsaPubHash: string;
-    /** Where the runtime can fetch the compiled circuit assets. */
-    circuits: {
-        /** URL of the `preimagePoK.wasm` witness generator. */
-        wasmUrl: string;
-        /** URL of the `preimagePoK_0001.zkey` proving key. */
-        zkeyUrl: string;
-    };
+    constructor(commitment: string, nonce: string, ecdsaPubHash: string);
+    toPublicSignals(): string[];
 }
-declare class PersonalSpaceClient {
-    private readonly baseUrl;
-    private readonly commitment;
-    private readonly secret;
-    private readonly salt;
-    private readonly ecdsaPub;
-    private readonly ecdsaPubHash;
-    private readonly wasmUrl;
-    private readonly zkeyUrl;
-    constructor(opts: PersonalSpaceClientOptions);
-    /** Store `value` under `key`, replacing any prior value. */
-    put(key: string, value: unknown): Promise<void>;
-    /** Fetch the value stored under `key`. Returns `null` if absent. */
-    get<T = unknown>(key: string): Promise<T | null>;
-    /** Remove `key` from the user's space. Returns whether the key existed. */
-    delete(key: string): Promise<boolean>;
-    /** List every key currently stored in the user's space. */
-    list(): Promise<string[]>;
-    /**
-     * Run the full pre-flight: ask the DO for a challenge, reduce the nonce to
-     * a field element, and generate a fresh Groth16 proof. Returns everything
-     * the gated endpoints need in their body.
-     */
-    private proveFreshChallenge;
-    /** Hit `POST /challenge` and return the issued nonce + ID. */
-    private requestChallenge;
-    /**
-     * Thin wrapper over `globalThis.fetch` so all methods share a single set of
-     * headers and body-encoding behaviour. `globalThis.fetch` is available in
-     * modern browsers, Node 18+, Workers, and Bun.
-     */
-    private fetch;
+declare class Field {
+    private value;
+    static readonly FIELD_SIZE: bigint;
+    constructor(value: bigint | string | number);
+    toBigInt(): bigint;
+    toString(): string;
+    toHex(): string;
+    equals(other: Field): boolean;
+    static fromHex(hex: string): Field;
 }
-
-/**
- * Wire types for the storage layer.
- *
- * The `FileManifest` is the single piece of metadata the system needs to
- * reassemble a file: per-chunk encryption material, RS parameters, and the
- * SHA-256 content hashes of every shard that belongs to the chunk. With the
- * manifest in hand, a reader can pull each shard from the open content-
- * addressed shard store, decode, decrypt, and concatenate to recover the
- * original bytes.
- *
- * The manifest itself lives inside a `SharedSpaceDO` (Phase B) which gates
- * access by ZK proof + ACL. Shards are stored in the open content-addressed
- * `ShardStoreDO` — anyone can put/get any shard, but without the manifest
- * (which has the keys) the ciphertext is just noise.
- */
-
-/**
- * One chunk's metadata. A file is the concatenation of `chunks` in order.
- *
- * - `originalSize` is the chunk's plaintext length, before AES-GCM expanded
- *   it by 16 bytes for the auth tag and before RS padded it for shard
- *   alignment.
- * - `ciphertextSize` is the AES-GCM output length (plaintext + 16). This is
- *   what the RS decoder trims back to.
- * - `shardHashes` lists every shard's SHA-256 in encoding order — the first
- *   `dataShards` are data shards, the trailing `parityShards` are parity.
- */
-interface ChunkManifest {
-    /** Stable per-chunk ID (uuid-like). Useful for client-side resume / dedup. */
-    id: string;
-    /** Position of this chunk in the file (0-indexed). */
-    chunkIndex: number;
-    /** Plaintext byte length of the chunk before encryption. */
-    originalSize: number;
-    /** AES-GCM ciphertext byte length (originalSize + 16 for the tag). */
-    ciphertextSize: number;
-    /** Number of RS data shards. */
-    dataShards: number;
-    /** Number of RS parity shards. */
-    parityShards: number;
-    /** Length in bytes of every shard (data and parity are equal). */
-    shardSize: number;
-    /** SHA-256 (hex) of each shard's ciphertext bytes, in shard order. */
-    shardHashes: string[];
-    /** Per-chunk AES-256-GCM key + IV. Plain in the manifest — gating happens at the SpaceDO. */
-    cipher: ChunkKeyMaterial;
+declare class Poseidon {
+    static hash(inputs: Field[]): Promise<Field>;
 }
-/**
- * Top-level manifest for a single stored file. Persisted in the user's
- * SharedSpace by file id; readable / writable per the space's ACL.
- */
-interface FileManifest {
-    /** Stable file ID. Assigned by the SDK at write time; used to read or delete. */
-    id: string;
-    /** Human-readable filename (display only — not used by the shard store). */
-    name: string;
-    /** Total plaintext byte length. Sum of chunk `originalSize`s. */
-    size: number;
-    /** MIME type the application supplied at write time. Opaque to storage. */
-    type: string;
-    /** Optional virtual path / folder hint for the application. */
-    path?: string;
-    /** When the file was last modified per the application (ms epoch). */
-    lastModified: number;
-    /** When this manifest was created on the SDK side (ms epoch). */
-    createdAt: number;
-    /** Ordered list of chunks. Concatenate them in index order to rebuild the file. */
-    chunks: ChunkManifest[];
-    /** SDK schema version. Bump on breaking manifest-shape changes. */
-    version: 1;
+declare function encodeToHex(field: Field): string;
+declare function decodeFromHex(hexStr: string): Field;
+interface CircuitBufferConfig {
+    wasm: Uint8Array;
+    zkey: Uint8Array;
+    verificationKey: VerificationKey;
 }
-/**
- * Lightweight summary returned by `FileStorage.writeFile` and surfaced in
- * directory-style listings. The full manifest is only fetched when actually
- * reassembling the file.
- */
-interface FileStat {
-    id: string;
-    name: string;
-    size: number;
-    type: string;
-    path?: string;
-    lastModified: number;
-    createdAt: number;
-    chunkCount: number;
-    shardCount: number;
+declare class HashKnowledge {
+    private static wasmBuffer?;
+    private static zkeyBuffer?;
+    private static verificationKey?;
+    static setCircuitBuffers(wasm: Uint8Array, zkey: Uint8Array, verificationKey: VerificationKey): void;
+    static compile(): Promise<ZkCompiled>;
+    static prove(secret: Field): Promise<{
+        proof: SnarkProof;
+        publicSignals: string[];
+    }>;
+    static verify(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
+}
+declare class PreimagePoK {
+    private static wasmBuffer?;
+    private static zkeyBuffer?;
+    private static verificationKey?;
+    static setCircuitBuffers(wasm: Uint8Array, zkey: Uint8Array, verificationKey: VerificationKey): void;
+    static compile(): Promise<ZkCompiled>;
+    static prove(publicInput: AuthPublicInput, secret: Field, salt: Field, ecdsaPub: Field): Promise<{
+        proof: SnarkProof;
+        publicSignals: string[];
+    }>;
+    static verify(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
+}
+declare function verifyHashKnowledge(proof: SnarkProof, expectedOutput?: Field, publicSignals?: string[]): Promise<boolean>;
+declare function verifyPreimagePoK(proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
+declare function verify(programType: 'HashKnowledge' | 'PreimagePoK', proof: SnarkProof, options?: {
+    expectedOutput?: Field;
+    publicSignals?: string[];
+}): Promise<boolean>;
+declare function quickVerify(program: typeof HashKnowledge | typeof PreimagePoK, proof: SnarkProof, publicSignals?: string[]): Promise<boolean>;
+declare function initializeCircuits(config: {
+    hashKnowledge?: CircuitBufferConfig;
+    preimagePoK?: CircuitBufferConfig;
+}): void;
+declare function compilePrograms(): Promise<{
+    hashKnowledge: ZkCompiled;
+    preimagePoK: ZkCompiled;
+}>;
+
+interface AuthToken {
+    peerId: string;
+    timestamp: number;
+    signature: string;
+}
+declare class Authenticator {
+    private trustedKeys;
+    private zkVerificationKey;
+    initializeZK(): Promise<void>;
+    getZKVerificationKey(): VerificationKey | null;
+    addTrustedServer(serverId: string, publicKey: CryptoKey): void;
+    generateAuthToken(peerId: string, privateKey: CryptoKey): Promise<AuthToken>;
+    verifyAuthToken(token: AuthToken, clientPublicKey: CryptoKey): Promise<boolean>;
+    verifyZKProof(proof: any, publicInput: AuthPublicInput, storedCommitment: Field, ecdsaPub: CryptoKey): Promise<boolean>;
+}
+
+declare class DoubleRatchetManager {
+    private sessions;
+    private sessionStates;
+    private keyStore;
+    private _authenticator;
+    private registeredUsers;
+    private id;
+    constructor(id: string);
+    get authenticator(): Authenticator;
+    addTrustedServer(serverId: string, publicKey: CryptoKey): Promise<void>;
+    registerZK(clientId: string, secret: Field, salt: Field, ecdsaPub: CryptoKey): Promise<void>;
+    performHandshake(senderId: string, recipientId: string, zkProof: any, publicInput: AuthPublicInput, clientPublicKey: CryptoKey, // ECDH pub for session
+    clientAuthPublicKey: CryptoKey, // ECDSA pub for auth
+    authToken: AuthToken): Promise<void>;
+    initializeSession(senderId: string, recipientId: string, isClient?: boolean, sessionType?: 'global' | 'specific', sessionId?: string, zkProof?: any, publicInput?: AuthPublicInput, clientPublicKey?: CryptoKey, clientAuthPublicKey?: CryptoKey, clientEcdhPrivateKey?: CryptoKey, clientAuthPrivateKey?: CryptoKey): Promise<string>;
+    encrypt(senderId: string, recipientId: string, sessionId: string, plaintext: string, newDhKey?: boolean, sessionType?: 'global' | 'specific'): Promise<CipherMessage>;
+    decrypt(message: CipherMessage, isClient?: boolean): Promise<string>;
+    getSessionSharedSecret(sessionId: string): Promise<Uint8Array | null>;
+    private saveState;
+    private loadState;
 }
-/** Distil a `FileManifest` into a `FileStat`. */
-declare function manifestToStat(manifest: FileManifest): FileStat;
 
 /**
- * HTTP client for the open content-addressed shard store.
- *
- * Each shard is named by the lowercase hex SHA-256 of its ciphertext bytes.
- * The server verifies the hash on PUT, so the address authenticates the
- * contents — there's no benefit to ACLing PUT/GET, and making them open
- * enables cross-user dedup down the line.
- *
- * Wire protocol:
- *   PUT  /api/shards/:hash    body: shard bytes (application/octet-stream)
- *                             200 { ok: true, hash, size, dedup: boolean }
- *                             400 if hash doesn't match body
+ * HTTP client for the accelerator's `/api/auth/*` endpoints.
  *
- *   GET  /api/shards/:hash    200 with shard bytes (application/octet-stream)
- *                             404 if absent
+ * Owns the wire shapes for register / challenge / authenticate / verify so
+ * the React SPA (and any future consumers) don't reimplement them. The ZK
+ * identity derivation + Groth16 proof generation stay on the application
+ * side — this client handles only the round-trips.
  *
- *   HEAD /api/shards/:hash    200 if present (no body) — used by callers to
- *                             skip a PUT they'd otherwise dedup-rewrite. The
- *                             server can ignore the optimization if it wants.
- */
-/**
- * A content-addressed byte cache for shards (the offline layer's `ShardCache`
- * satisfies this structurally). Declared here as a minimal interface so the
- * storage layer doesn't import the offline module — keeping the dependency
- * arrow one-way (offline → storage).
+ * Mirrors `PersonalSpaceClient` / `ShardClient` / `SharedSpaceClient`: takes
+ * a `baseUrl`, optional custom `fetch`, throws typed `Error`s on failure
+ * (with the worker's message inlined where available).
  */
-interface ShardByteCache {
-    get(hash: string): Promise<Uint8Array | null>;
-    put(hash: string, bytes: Uint8Array): Promise<void>;
+
+interface ZkRegisterRequest {
+    username: string;
+    /** Decimal-string Poseidon commitment. */
+    commitment: string;
+    /** Base64-encoded raw uncompressed ECDH public key (SEC1 0x04‖X‖Y). */
+    ecdhPublicKey: string;
+    /** Base64-encoded raw uncompressed ECDSA public key. */
+    ecdsaPublicKey: string;
+    email?: string | null;
 }
-/**
- * A peer block source (the p2p layer's `PeerExchange` satisfies this
- * structurally). Consulted between the local cache and origin: a block fetched
- * from a peer is verified by hash before use. Declared here so the storage layer
- * doesn't import the p2p module (dependency arrow stays p2p → storage).
- */
-interface PeerBlockSource {
-    getBlock(hash: string, opts?: {
-        timeoutMs?: number;
-    }): Promise<Uint8Array | null>;
-    announce(hash: string): void;
+interface ZkRegisterResponse {
+    success: boolean;
 }
-interface ShardClientOptions {
-    /** Base URL of the accelerator (e.g. `https://muhkoo-accelerator.workers.dev`). */
+interface ZkChallengeResponse {
+    challengeId: string;
+    /** Hex-encoded random nonce — caller reduces into a BN254 field element for the proof. */
+    nonce: string;
+    /** Decimal-string Poseidon commitment the server has on file for this user. */
+    commitment: string;
+}
+interface ZkAuthenticateRequest {
+    challengeId: string;
+    proof: {
+        commitment: string;
+        /** Original hex nonce from the challenge (NOT the field-reduced version). */
+        nonce: string;
+        response: {
+            proof: Groth16Proof;
+            publicSignals: string[];
+        };
+        /** Base64 ECDSA-SHA256 signature over `JSON.stringify(response.proof)`. */
+        signature: string;
+    };
+    rememberMe?: boolean;
+}
+interface AuthSuccess {
+    token: string;
+    username: string;
+}
+/** A vault factor record (M1.0 + M2 gated types). Wrap/iv are base64 AES-GCM; absent for phrase. */
+interface VaultFactor {
+    id: string;
+    type: "password" | "passkey" | "phrase-marker" | "email" | "google" | "device";
+    wrap?: string;
+    iv?: string;
+    params?: Record<string, unknown>;
+    label?: string;
+    createdAt?: number;
+    /** Display hint for gated factors ("m•••@gmail.com") — list responses only. */
+    masked?: string;
+    /** Passkey's origin (RP id) — list responses only. A passkey only unlocks
+     *  from this host or a subdomain of it, so apps on several hosts enroll one
+     *  per origin. */
+    rpId?: string;
+}
+interface AuthClientOptions {
+    /** Absolute URL of the accelerator worker (no trailing slash required). */
     baseUrl: string;
+    /** Optional custom fetch — defaults to `globalThis.fetch`. */
+    fetch?: typeof fetch;
+}
+declare class AuthClient {
+    private readonly baseUrl;
+    private readonly fetchFn;
+    constructor(opts: AuthClientOptions);
+    /** Submit ZK registration. Caller has already derived the identity + commitment. */
+    register(req: ZkRegisterRequest): Promise<ZkRegisterResponse>;
+    /** Request an auth challenge for `username` (server issues a fresh nonce). */
+    getChallenge(username: string): Promise<ZkChallengeResponse>;
+    /** Trade a challenge + proof for a session token. */
+    authenticate(req: ZkAuthenticateRequest): Promise<AuthSuccess>;
     /**
-     * Path prefix for the shard endpoints, joined to `baseUrl` before the
-     * hash. Defaults to `/api/shards`, which targets a global shard store
-     * (e.g. a dedicated `ShardStoreDO`). Pass a room-scoped value like
-     * `/api/spaces/{roomId}/shards` to keep shards bound to a specific
-     * `SharedSpaceDO` — that's the path the chat application uses today.
-     *
-     * Leading slash optional; trailing slash stripped. The final URL is
-     * always `${baseUrl}${normalizedPrefix}/${encodeURIComponent(hash)}`.
+     * Validate a previously stored session token. Returns `{ username }` on
+     * success; throws on 401/404 — caller uses that to drop a stale token
+     * when restoring a session after a reload.
      */
-    pathPrefix?: string;
+    verify(token: string): Promise<{
+        username: string;
+    }>;
+    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
+    oprfEvaluate(username: string, blinded: string): Promise<{
+        evaluated: string;
+    }>;
     /**
-     * Optional custom fetch implementation. Defaults to `globalThis.fetch`.
-     * Provided so callers can inject retries / auth / instrumentation.
-     */
-    fetch?: typeof fetch;
-    /**
-     * Optional offline byte cache. When present, GETs are served cache-first and
-     * populated on success, and PUTs write the cache before the network so a
-     * just-uploaded file reads back offline. See {@link ShardByteCache}.
-     */
-    cache?: ShardByteCache;
-    /**
-     * Coalesce concurrent origin reads into `POST {pathPrefix}/batch`. On by
-     * default: it is what keeps opening a project from costing one request per
-     * shard. Set false to force one-at-a-time — useful against a server without
-     * the route, though that is detected and handled automatically.
-     */
-    batchShards?: boolean;
-    /**
-     * Called when a PUT can't reach the network (offline). Lets the caller queue
-     * the upload for replay on reconnect; the bytes are already in {@link cache}
-     * keyed by `hash`, so only the hash needs recording.
-     */
-    deferUpload?: (hash: string) => Promise<void>;
-    /**
-     * Optional peer block source. When present, GETs try peers between the local
-     * cache and origin (peer blocks are verified by hash); PUTs announce the new
-     * block to peers. Best-effort — any failure falls through to origin.
-     */
-    peers?: PeerBlockSource;
-    /**
-     * When true, {@link ShardClient.putShard} returns as soon as the shard is
-     * written to {@link cache} and announced to {@link peers} — the origin PUT is
-     * fired in the BACKGROUND rather than awaited. This makes a large write's
-     * manifest available immediately (so a peer/worker can start pulling the
-     * shards over P2P right away) while origin catches up as a durable fallback.
-     * On a background-PUT failure the shard is handed to {@link deferUpload} (if
-     * present) for replay. Requires a {@link cache} so the bytes survive locally
-     * until the background upload lands. No-op without a cache.
+     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
+     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
+     * domains' evaluations. The recover token is consumed by this call.
      */
-    backgroundUpload?: boolean;
-}
-/**
- * Compute the lowercase hex SHA-256 of `bytes`. Available via WebCrypto in
- * every runtime this SDK targets.
- */
-declare function shardHash(bytes: Uint8Array): Promise<string>;
-declare class ShardClient {
-    private readonly baseUrl;
-    private readonly pathPrefix;
-    private readonly fetchFn;
-    private readonly cache?;
-    /** Hashes waiting for the next batch, each with everyone awaiting it. */
-    private pendingShards;
-    private batchTimer;
-    /** False once the server is known not to have the batch route. */
-    private batchSupported;
-    private readonly deferUpload?;
-    private readonly peers?;
-    private readonly backgroundUpload;
-    constructor(opts: ShardClientOptions);
-    /** Build the URL for a given shard hash — exposed for callers that want to log or pre-resolve. */
-    urlForHash(hash: string): string;
+    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string): Promise<{
+        evaluated: string;
+        evaluated2: string;
+    }>;
     /**
-     * Upload a shard. The server verifies SHA-256(body) matches `:hash` and
-     * rejects with 400 if not, so the caller is the source of truth on
-     * naming. Re-uploading an existing shard is idempotent — the server
-     * returns `dedup: true` in that case.
+     * Request an email OTP. With a session `token` this is the ENROLL flow
+     * (code sent to `email`); without one it's RECOVER (code sent to the
+     * account's enrolled address — the response is uniform either way).
      */
-    putShard(hash: string, bytes: Uint8Array): Promise<{
-        dedup: boolean;
+    emailOtpStart(opts: {
+        token?: string;
+        email?: string;
+        username?: string;
+    }): Promise<void>;
+    /** Trade an emailed code for a single-use verifyToken (+ the proven address). */
+    emailOtpVerify(opts: {
+        code: string;
+        token?: string;
+        username?: string;
+    }): Promise<{
+        verifyToken: string;
+        email: string;
     }>;
-    private bgActive;
-    private readonly bgQueue;
-    private static readonly BG_CONCURRENCY;
-    /** Queue a shard's origin PUT to run in the background under a concurrency
-     *  cap. Bytes are re-read from {@link cache} at upload time (not held in the
-     *  queue) so a large file's backlog doesn't pin a second copy in memory. */
-    private enqueueBackgroundUpload;
-    /** PUT the shard bytes to origin, verifying the server accepted them.
-     *  Used by the background-upload path; throws on network/HTTP failure. */
-    private uploadToOrigin;
     /**
-     * Fetch a shard by hash. Throws if the server returns a non-200; returns
-     * `null` for 404 so callers can distinguish "missing" from "errored".
+     * Verify a Google ID token (M2.3). With a session `token` it's the ENROLL
+     * gate; without, it's RECOVER/LOGIN (the Google account must already be
+     * linked). Returns a single-use verifyToken bound to the account's `sub`.
      */
-    getShard(hash: string): Promise<Uint8Array | null>;
+    googleVerify(opts: {
+        idToken: string;
+        token?: string;
+        username?: string;
+    }): Promise<{
+        verifyToken: string;
+        sub: string;
+        emailHint: string | null;
+    }>;
+    /** Mint a single-use authorization code for an app (called by the hosted page; session-authed). */
+    grant(token: string, body: {
+        appId: string;
+        redirectUri: string;
+        codeChallenge: string;
+        sealedKeys: string;
+    }): Promise<{
+        code: string;
+    }>;
+    /** Exchange an authorization code + PKCE verifier for the session + sealed key material. */
+    token(body: {
+        code: string;
+        codeVerifier: string;
+        appId?: string;
+    }): Promise<{
+        sessionToken: string;
+        username: string;
+        commitment: string;
+        sealedKeys: string;
+        appId: string;
+    }>;
     /**
-     * Fetch from origin, COALESCING concurrent requests into one batch.
-     *
-     * A shard is not a file. A project is thousands of small source modules,
-     * each split into shards, so reading one at a time made opening a project
-     * cost thousands of requests — 2,086 for a 519-file project. Latency, not
-     * bytes, is what that spends: Chromium took 18.4s over those requests and
-     * Brave, which filters every one, took 37.5s for identical work. Batching
-     * collapses whatever is in flight at the same moment into a single POST,
-     * which is why it helps most exactly where it hurt most.
-     *
-     * Callers are unchanged: `getShard` still asks for one shard and gets one
-     * shard. The window is a few milliseconds — long enough to gather the reads
-     * a concurrent walk issues together, short enough not to be felt by a lone
-     * read.
-     *
-     * Falls back permanently to one-at-a-time if the server has no batch route,
-     * so a new SDK keeps working against an older deployment.
+     * Read a factor record for `username` (returns an indistinguishable decoy if
+     * absent). Gated types (email) require the recover `verifyToken`.
      */
-    private fetchFromOrigin;
-    /** Send one batch of whatever has accumulated, and settle those callers. */
-    private flushShardBatch;
-    /** Fetch a shard from origin. Returns `null` for 404 (or offline when a
-     *  cache is present, so RS recovery can proceed); throws otherwise. */
-    private fetchOneFromOrigin;
+    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string, 
+    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
+     *  passkey instead of whichever was enrolled first (which WebAuthn would
+     *  refuse). Ignored for other factor types. */
+    rpId?: string, 
+    /** Device factors are selected by id — a user may have many machines. */
+    factorId?: string): Promise<{
+        factor: VaultFactor | null;
+    }>;
     /**
-     * Check whether a shard exists. Lets the caller skip a PUT they'd otherwise
-     * dedup-rewrite. The server can implement this as a HEAD or return a small
-     * JSON body — we don't depend on either.
+     * Add/replace a factor (session-authed; the seed is already wrapped
+     * client-side). Email factors additionally require (and consume) the
+     * enroll `verifyToken`; the stored address must be the verified one.
      */
-    hasShard(hash: string): Promise<boolean>;
+    vaultPutFactor(token: string, factor: VaultFactor, verifyToken?: string): Promise<{
+        ok: boolean;
+        id: string;
+    }>;
+    /** List the user's factor metadata (no ciphertext). Session-authed. */
+    vaultFactors(token: string): Promise<{
+        factors: VaultFactor[];
+        migrated: boolean;
+    }>;
+    /** Remove a factor by id (can't remove the last one). Session-authed. */
+    vaultDeleteFactor(token: string, id: string): Promise<{
+        deleted: boolean;
+    }>;
+    private json;
+    private parse;
 }
 
 /**
- * HTTP client for the gated file-manifest store on a SharedSpace
- * (`/api/spaces/:spaceId/files`).
+ * Deterministic ZK identity derivation from `(username, password)`.
  *
- * A "file" in a space is its **manifest** (per-chunk keys + the SHA-256 of each
- * global shard). The shard bytes live in the open `/api/shards` store; the
- * manifest is the capability. This client only moves manifests in/out of the
- * space's gated store.
+ * Same inputs on ANY device produce the same secret, salt, and P-256
+ * ECDSA + ECDH keypairs — which is what makes federated login from a
+ * fresh browser possible. There is no localStorage involvement: every
+ * register and login call re-derives the identity on demand.
  *
- * Authorization is **session-based**, consistent with the rest of the
- * SharedSpace (keyring, websocket): the SDK's credential-stamping `fetch`
- * (from {@link HttpClient}) attaches the app key + session token, the platform
- * validates the session and injects a trusted `X-Muhkoo-User-Context`, and the
- * DO authorizes on that + channel membership. There is no per-op Groth16 proof.
+ * Pipeline:
+ *   master_seed = PBKDF2-SHA256(password, "muhkoo-zk-v1:" || username, 200k iters)
+ *   secret      = HKDF-Expand-SHA256(master_seed, "zk-secret",  32 bytes) → hex
+ *   salt        = HKDF-Expand-SHA256(master_seed, "zk-salt",    32 bytes) → hex
+ *   ecdsa_priv  = HKDF-Expand-SHA256(master_seed, "ecdsa-priv", 32 bytes)
+ *   ecdh_priv   = HKDF-Expand-SHA256(master_seed, "ecdh-priv",  32 bytes)
  *
- * Wire protocol (server: `SharedSpaceDO`):
- *   POST   /api/spaces/:spaceId/files            body: { manifest }  → { ok, fileId }
- *   GET    /api/spaces/:spaceId/files                                → { files: FileStat[] }
- *   GET    /api/spaces/:spaceId/files/:fileId                        → { manifest }
- *   DELETE /api/spaces/:spaceId/files/:fileId                        → { ok, existed }
+ * P-256 public points are computed via `@noble/curves` (WebCrypto has no
+ * derive-public-from-private-scalar API), then both keypairs are imported
+ * into SubtleCrypto in JWK form so the rest of the crypto stack can keep
+ * using `crypto.subtle.sign` / `crypto.subtle.deriveBits`.
+ *
+ * Originally lived in `accelerator/public/js/zk-identity.js` and was ported
+ * to `muhkoo/web/src/zk/identity.ts`; consolidated here so the SDK owns
+ * identity derivation end-to-end.
  */
-
-interface SharedSpaceClientOptions {
-    /** Base URL of the accelerator (e.g. `https://api.muhkoo.dev`). */
-    baseUrl: string;
-    /**
-     * Credential-stamping fetch — pass {@link HttpClient.fetch} so requests
-     * carry the app key + session token. Defaults to `globalThis.fetch`
-     * (unauthenticated; only useful in tests).
-     */
-    fetch?: typeof fetch;
+interface ZkIdentity {
+    /** 32-byte secret, hex-encoded. Private witness for the ZK circuit. */
+    secretHex: string;
+    /** 32-byte salt, hex-encoded. Private witness for the ZK circuit. */
+    saltHex: string;
+    /** P-256 ECDSA keypair, used to sign auth proofs. */
+    ecdsaKeyPair: CryptoKeyPair;
+    /** P-256 ECDH keypair, used by the chat ratchet. */
+    ecdhKeyPair: CryptoKeyPair;
 }
-declare class SharedSpaceClient {
-    private readonly baseUrl;
-    private readonly fetchFn;
-    constructor(opts: SharedSpaceClientOptions);
-    /** Write a file manifest into the space. Requires space membership. */
-    writeFileManifest(spaceId: string, manifest: FileManifest): Promise<void>;
-    /** Read a file manifest by id. Requires space membership. */
-    readFileManifest(spaceId: string, fileId: string): Promise<FileManifest>;
-    /** Delete a file manifest by id. Requires space membership. */
-    deleteFileManifest(spaceId: string, fileId: string): Promise<boolean>;
-    /** List file summaries in the space. Requires space membership. */
-    listFiles(spaceId: string): Promise<FileStat[]>;
-    private filesBase;
-    private jsonRequest;
-}
-
 /**
- * `FileStorage` — top-level entry point for chunked, encrypted, erasure-coded
- * file storage.
- *
- * Pipeline for writing a file:
- *   1. Split the plaintext into fixed-size chunks (default 4 MiB).
- *   2. For each chunk:
- *        a. Generate a fresh AES-256-GCM key + 12-byte IV (`ChunkCipher`).
- *        b. Encrypt the chunk → ciphertext (plaintext.length + 16 bytes tag).
- *        c. Reed–Solomon encode the ciphertext into `dataShards + parityShards`
- *           equal-length shards (`ReedSolomonCodec`).
- *        d. PUT every shard to the content-addressed shard store, keyed by
- *           SHA-256 of the shard bytes (`ShardClient`).
- *   3. Build a `FileManifest` listing every chunk's keys, IVs, sizes, and
- *      the SHA-256 of every shard in order.
- *
- * Two ways to use the manifest:
- *   - {@link FileStorage.writeFileToShards} returns it to the caller, who is
- *     then responsible for delivering it to readers (e.g. by E2E-encrypting
- *     it as a chat message). The chat application takes this path.
- *   - {@link FileStorage.writeFile} additionally POSTs the manifest to a
- *     gated multi-user space (`SharedSpaceClient`) so any participant of the
- *     space can read the file by manifest id later.
+ * Derive a deterministic ZK identity from `(username, password)`.
  *
- * Reading is the inverse: {@link FileStorage.readFileFromShards} takes a
- * manifest and reassembles the plaintext; {@link FileStorage.readFile} first
- * fetches the manifest from the space.
+ * Same inputs always produce the same identity, on any device — that's
+ * what makes federated login work without dragging encrypted state across
+ * devices.
  */
-
-interface FileStorageOptions {
-    /** Talks to the content-addressed shard store. Always required. */
-    shards: ShardClient;
-    /**
-     * Talks to the gated multi-user space holding manifests + ACLs.
-     * Optional — only required by {@link FileStorage.writeFile} /
-     * {@link FileStorage.readFile} / {@link FileStorage.deleteFile} /
-     * {@link FileStorage.listFiles} / {@link FileStorage.readManifest}.
-     *
-     * Callers that ship the manifest themselves (e.g. via an encrypted chat
-     * message) can omit `space` and use the `*FromShards` / `*ToShards`
-     * methods directly.
-     */
-    space?: SharedSpaceClient;
-    /**
-     * Plaintext chunk size in bytes. After encryption each chunk gains 16
-     * bytes (GCM tag); after RS encoding the size is rounded up to a multiple
-     * of `dataShards` per chunk. Default 4 MiB — a balance between
-     * round-trip cost and parallelism on the upload path.
-     */
-    chunkSize?: number;
-    /** RS data shards per chunk (default 4). */
-    dataShards?: number;
-    /** RS parity shards per chunk (default 2). */
-    parityShards?: number;
-    /**
-     * Cap on concurrent shard uploads / downloads. Tune for the network. The
-     * default of 8 saturates most home connections without overwhelming the
-     * server's per-IP rate limiter.
-     */
-    concurrency?: number;
-    /**
-     * Optional pre-compiled RS WebAssembly module. Defaults to the bundled
-     * loader. Pass this in environments where the bundled loader path isn't
-     * available (vitest, deploy-time-precompiled CF Workers).
-     */
-    rsWasmModule?: WebAssembly.Module;
-}
+declare function deriveIdentity(username: string, password: string): Promise<ZkIdentity>;
 /**
- * Input to {@link FileStorage.writeFile} (which writes the manifest to a
- * `SharedSpaceClient`). Carries the destination `spaceId`.
+ * Legacy master-seed derivation: `PBKDF2(password, "muhkoo-zk-v1:"||username)`.
+ *
+ * This was the *only* path pre-vault, where the identity descended directly from
+ * the password. It's kept so existing accounts still re-derive their seed (and
+ * the vault can adopt that exact seed on migration, preserving the commitment).
+ * New accounts use a random seed (`vault.randomSeed`) instead, so their identity
+ * is no longer a function of the password.
  */
-interface WriteFileInput extends WriteToShardsInput {
-    /** Space to write the manifest to — must allow the caller `write`. */
-    spaceId: string;
-}
+declare function deriveMasterSeedFromPassword(username: string, password: string): Promise<Uint8Array>;
 /**
- * Input to {@link FileStorage.writeFileToShards} (which doesn't write a
- * manifest anywhere — that's the caller's job).
+ * Derive the (unchanged) ZK identity from a 32-byte **master seed**. The seed is
+ * HKDF-expanded into secret/salt + the P-256 ECDSA & ECDH keypairs exactly as
+ * before — so the resulting commitment is byte-identical for a given seed. The
+ * vault wraps THIS seed under each recovery factor.
  */
-interface WriteToShardsInput {
-    /** Raw data, a Blob, or a File. */
-    data: Uint8Array | Blob | File;
-    /** Application-supplied display metadata. */
-    metadata: {
-        name: string;
-        type: string;
-        path?: string;
-        lastModified?: number;
-    };
-    /**
-     * Optional pre-allocated file id. Defaults to a fresh one. Useful for
-     * resumable uploads: the same id always maps to the same manifest slot.
-     */
-    fileId?: string;
-    /**
-     * Optional upload-progress callback, invoked after each chunk finishes
-     * (`completed` of `total` chunks). Lets a UI show a progress bar. Called once
-     * with `(0, total)` before the first chunk so a bar can render immediately.
-     */
-    onProgress?: (completed: number, total: number) => void;
-}
-declare class FileStorage {
-    private readonly space;
-    private readonly shards;
-    private readonly chunkSize;
-    private readonly dataShards;
-    private readonly parityShards;
-    private readonly concurrency;
-    private readonly cipher;
-    private readonly codec;
-    private readonly rsWasmModule?;
-    constructor(opts: FileStorageOptions);
-    /**
-     * Chunk → encrypt → encode → upload-shards. Returns the resulting manifest
-     * along with a `FileStat` summary. The caller is responsible for storing
-     * or transmitting the manifest however it likes.
-     */
-    writeFileToShards(input: WriteToShardsInput): Promise<{
-        manifest: FileManifest;
-        stat: FileStat;
-    }>;
-    /**
-     * Inverse of {@link writeFileToShards}. Takes a manifest the caller
-     * obtained somehow (chat message, share link, etc.) and reassembles the
-     * plaintext. Throws if too many shards are missing or any chunk's auth
-     * tag fails.
-     */
-    readFileFromShards(manifest: FileManifest): Promise<{
-        data: Uint8Array;
-        stat: FileStat;
-    }>;
-    /**
-     * Streaming inverse of {@link writeFileToShards}: yields each chunk's
-     * decrypted plaintext in order WITHOUT concatenating. Peak memory stays at
-     * ~one chunk, so multi-GB files (which overflow a single `Uint8Array`) can be
-     * piped straight to a file/socket. Same shard sourcing (cache → peers →
-     * origin) and per-chunk auth as {@link readFileFromShards}.
-     */
-    readChunksFromShards(manifest: FileManifest): AsyncGenerator<Uint8Array>;
-    /** As {@link writeFileToShards}, plus POSTs the manifest to `input.spaceId`. */
-    writeFile(input: WriteFileInput): Promise<FileStat>;
-    /** As {@link readFileFromShards}, but fetches the manifest from a space first. */
-    readFile(spaceId: string, fileId: string): Promise<{
-        data: Uint8Array;
-        stat: FileStat;
-    }>;
-    /**
-     * Delete the manifest from a space. **Does not GC the shards** — those
-     * are content-addressed and may be referenced by other manifests.
-     * Garbage collection is a separate server-side concern (Phase D / D-ish).
-     */
-    deleteFile(spaceId: string, fileId: string): Promise<boolean>;
-    /** Convenience pass-through. */
-    listFiles(spaceId: string): Promise<FileStat[]>;
-    /** Read a manifest verbatim — useful for "share file" / export flows. */
-    readManifest(spaceId: string, fileId: string): Promise<FileManifest>;
-    private requireSpace;
-    /** Encrypt + encode + upload one chunk; return its manifest entry. */
-    private writeChunk;
-    /** Inverse of `writeChunk`. */
-    private readChunk;
-    /** Run `tasks` with at most `this.concurrency` in flight. */
-    private runWithConcurrency;
-}
+declare function deriveIdentityFromSeed(seed: Uint8Array): Promise<ZkIdentity>;
 
 /**
- * Reed–Solomon erasure-coding codec.
+ * Poseidon hash wrapper used by the ZK auth flow.
  *
- * Wraps the WASM-backed `encode` / `reconstruct` primitives in `wasm/rs.ts`
- * with shard-padding bookkeeping so callers can hand it any-length input and
- * get back uniform-size shards.
+ * Backed by `circomlibjs`'s `buildPoseidon`. Builder is lazy and cached
+ * because the JS-side Babyjubjub field reps take ~100ms to construct, and
+ * we'd rather not pay that on every page load.
  *
- * Usage:
- *   const codec = new ReedSolomonCodec();
- *   await codec.ready();
- *   const { shards, shardSize, originalSize } = codec.encode(plaintext, 4, 2);
- *   // 6 shards (4 data + 2 parity), each `shardSize` bytes
- *   // …ship them, lose up to 2, then …
- *   const recovered = codec.decode(shards, 2, deadIndexes, originalSize);
+ * Returns hashes as decimal-string BigInts — same format snarkjs and the
+ * `preimagePoK` circuit expect for inputs.
  *
- * Why the explicit `originalSize`: RS pads input to make every data shard the
- * same length. The decoder must trim that padding back off after recovery.
- * The caller is responsible for stashing `originalSize` somewhere durable
- * (the file manifest, in this codebase).
+ * Note: circomlibjs is `optionalDependencies` in connect's package.json.
+ * Consumers that use the ZK auth flow (browser/server, not workers) need
+ * it installed. The workers build does not import this module.
  */
-interface EncodeResult {
-    /** All `dataShards + parityShards` shards. All have length `shardSize`. */
-    shards: Uint8Array[];
-    /** Length of every shard (data and parity). */
-    shardSize: number;
-    /** Length of the original input before padding. Needed to trim on decode. */
-    originalSize: number;
-    /** How many of the leading shards are data (the rest are parity). */
-    dataShards: number;
-    /** How many parity shards trail the data shards. */
-    parityShards: number;
-}
-declare class ReedSolomonCodec {
-    /**
-     * Resolves once the WASM module is loaded; safe to call repeatedly.
-     *
-     * Pass `wasmModule` to use a pre-compiled module (e.g. in tests where the
-     * rollup-inlined loader path isn't available, or in CF Workers where you
-     * want to load the module at deploy time). Default path uses the bundled
-     * base64-inlined wasm — works in Node, browsers, and Workers.
-     */
-    ready(wasmModule?: WebAssembly.Module): Promise<void>;
-    /**
-     * Split `data` into `dataShards` equal-size chunks (zero-padded to fit),
-     * compute `parityShards` parity shards, and return all of them.
-     */
-    encode(data: Uint8Array, dataShards: number, parityShards: number): EncodeResult;
-    /**
-     * Reconstruct the original `data` from `shards`. Up to `parityShards`
-     * shards may be missing; for each missing shard, pass an empty
-     * `Uint8Array` placeholder at its position and list the position in
-     * `deadShardIndexes`.
+/**
+ * Poseidon-hash `inputs` and return the result as a decimal-string BigInt.
+ * Inputs are converted to BigInt — pass either bigints, numbers, or numeric
+ * strings.
+ */
+declare function poseidonHash(inputs: Array<bigint | string | number>): Promise<string>;
+
+/**
+ * Integrity pinning for the ZK circuit artifacts.
+ *
+ * THE PROBLEM. `generateAuthProof` hands the user's `secret` and `salt` — the
+ * inputs the whole zero-knowledge design exists to keep on the device — to a
+ * witness generator downloaded at runtime from the accelerator. That is the
+ * party the proof is meant to convince. With no integrity check, a malicious or
+ * compromised server serves a modified `preimagePoK.wasm` that copies `secret`
+ * into a public-signal slot (public signals are just `witness[1..nPublic]`), and
+ * the client forwards them without ever comparing against what it computed
+ * locally. The server then derives the `client.kv` at-rest key through
+ * `StorageCipher` and decrypts everything it stores. Controlling the `.zkey` is
+ * just as bad by itself: a subverted CRS breaks Groth16's zero-knowledge
+ * property outright.
+ *
+ * THE FIX. Fetch the bytes here, SHA-256 them against digests pinned at build
+ * time, and hand snarkjs verified BUFFERS rather than a URL it will fetch for
+ * itself. snarkjs accepts `Uint8Array` for both artifacts.
+ *
+ * THREAT-MODEL BOUNDARY, and why local paths are exempt. The attack is "a
+ * SERVER serves you a modified artifact". A filesystem path is not
+ * server-controlled — it is the caller's own machine — so non-`http(s)`
+ * specifiers pass through untouched (this is also what lets tests point at
+ * `circuits/build/` directly, where snarkjs reads them as paths under Node).
+ * Anything fetched over the network must be pinned, or explicitly opted out of
+ * with {@link CircuitIntegrity.allowUnpinned}.
+ *
+ * There is deliberately NO silent fallback. An unpinned `https:` URL throws
+ * rather than quietly proving with unverified bytes — the failure mode this
+ * codebase already has elsewhere (see the SHA-256-for-Poseidon substitution in
+ * `crypto/ZeroKnowledge.ts`) is exactly what makes a security control useless.
+ */
+/**
+ * SHA-256 of the `preimagePoK` artifacts this SDK version was built against.
+ *
+ * Verified identical to what the accelerator serves from
+ * `public/circuits/build/` at the time of pinning. **If the circuit is ever
+ * recompiled, these must be regenerated in the same commit as
+ * `PREIMAGE_POK_VERIFICATION_KEY`, or every login fails closed** — which is the
+ * intended direction for a mismatch.
+ *
+ * Regenerate with:
+ *   shasum -a 256 circuits/build/preimagePoK_js/preimagePoK.wasm \
+ *                 circuits/build/preimagePoK_0001.zkey
+ */
+declare const PINNED_CIRCUIT_DIGESTS: {
+    readonly preimagePoKWasm: "9230ce3a883ca11e618639ac14fe0048b5dc4491c77b1dde3e41eb0896c33e10";
+    readonly preimagePoKZkey: "087f4ef09b6afbacad8e47b0029ded408a0ac3b5c9d5a1624e94c06bc258b871";
+};
+/** Integrity options carried alongside a circuit URL. */
+interface CircuitIntegrity {
+    /** Expected SHA-256 of the witness generator, lowercase hex. */
+    wasmSha256?: string;
+    /** Expected SHA-256 of the proving key, lowercase hex. */
+    zkeySha256?: string;
+    /**
+     * Proceed without verification for network-fetched artifacts.
      *
-     * `originalSize` is required so the trailing zero-padding can be trimmed.
+     * DANGEROUS: it re-opens the attack described in this module's docs. Only
+     * for local development against a circuit you compiled yourself and have
+     * not yet pinned.
      */
-    decode(shards: Uint8Array[], parityShards: number, deadShardIndexes: number[], originalSize: number): Uint8Array;
+    allowUnpinned?: boolean;
+}
+/** Thrown when a fetched artifact does not match its pinned digest. */
+declare class CircuitIntegrityError extends Error {
+    readonly url: string;
+    readonly expected: string;
+    readonly actual: string;
+    constructor(url: string, expected: string, actual: string);
 }
 
 /**
- * Universal wasm-bindgen glue for `wasm-reed-solomon-erasure` (v0.2.2 — Rust
- * Reed–Solomon erasure-coding library compiled with `wasm-pack --target nodejs`).
+ * Groth16 proof generation for the `preimagePoK` circuit.
  *
- * The upstream npm package ships `wasm_reed_solomon_erasure.js` which uses
- * `require('fs').readFileSync()` to load the WASM file at module load time —
- * that hard-codes Node and breaks browsers / CF Workers. This file is a port
- * of that glue with the Node-only pieces removed:
- *
- *   - `TextDecoder` is taken from the global (available in Node 12+, every
- *     modern browser, and Workers — no `require('util')`).
- *   - The WASM module is loaded via the rollup-inlined `.wasm` import, the
- *     same `targetEnv: 'auto-inline'` path the bn128 verifier uses. Works in
- *     Node, browser, and Workers without runtime fs access.
+ * The circuit proves knowledge of `(secret, salt, ecdsaPub)` such that
+ *   commitment = Poseidon(secret, salt, Poseidon(ecdsaPub))
+ * while only revealing `(commitment, nonce, ecdsaPubHash)` as public signals.
  *
- * Only the two public functions consumers actually need (`encode` and
- * `reconstruct`) are exported. The rest is the wbindgen heap-table dance.
+ * Circuit assets (wasm + zkey) are served by the accelerator worker. Their
+ * URLs are a required argument of {@link generateAuthProof} — there is no
+ * default. The web app constructs them relative to its configured worker
+ * `baseUrl` so the SPA can target either the local wrangler dev or a deployed
+ * worker depending on `VITE_WORKER_URL`.
+ */
+
+interface CircuitUrls extends CircuitIntegrity {
+    /** preimagePoK.wasm — the circuit's witness generator. */
+    wasmUrl: string;
+    /** preimagePoK_0001.zkey — the proving key. */
+    zkeyUrl: string;
+}
+/**
+ * Canonical {@link CircuitUrls} for the `preimagePoK` login circuit, anchored
+ * at a base URL where the accelerator serves the circuit assets out of
+ * `circuits/build/`. The filenames here are fixed by the circom build output
+ * (the witness generator lands inside a `preimagePoK_js/` directory); callers
+ * shouldn't hard-code them. `Client` uses this to default its `circuits`
+ * option, and `PersonalSpaceClient` consumers can pass `defaultCircuitUrls(baseUrl)`.
+ */
+declare function defaultCircuitUrls(baseUrl: string): CircuitUrls;
+/**
+ * Reduce any hex/decimal/byte input to a decimal-string field element in
+ * `[0, FIELD_SIZE)`. snarkjs and the `preimagePoK` circuit both want decimal
+ * strings; everything else gets normalized here.
  *
- * Encoding:
- *   `encode(dataShards: Uint8Array[], parityShard: number)` → array of
- *   `dataShards.length + parityShard` Uint8Arrays. The first N are the input
- *   shards unchanged; the trailing M are the freshly computed parity shards.
- *   All shards are the same length — caller is responsible for padding the
- *   data into equal-size data shards.
+ * **Behavior is intentionally byte-for-byte compatible with the legacy
+ * `accelerator/public/js/zk-snarkjs-client.js#toField`.** Diverging produces
+ * different commitments than accounts registered via the legacy flow,
+ * which locks those users out forever — the worker stores whatever
+ * commitment the client sent at register time and compares it as a string
+ * at login time.
  *
- * Reconstruction:
- *   `reconstruct(corruptedShards, parityShard, deadIndexes)` → fully recovered
- *   array. Pass placeholders (empty Uint8Arrays) at the dead indexes; the
- *   reconstructor fills them in. Up to `parityShard` shards may be missing.
+ * In particular: a 32+ char string of hex chars is always treated as hex,
+ * even if every character happens to be 0-9 with no a-f letters. An
+ * earlier version of this function gated the hex branch on "has at least
+ * one letter" — that broke the digit-only-hex edge case (rare in practice,
+ * but real). DO NOT add that letter check back.
  */
+declare function toField(value: string | bigint | number): string;
 /**
- * Load and instantiate the WASM module. Idempotent — repeated calls await the
- * same one-shot promise.
+ * Build the user's Poseidon commitment binding `(secret, salt, ecdsaPubHash)`.
+ * Same formula the worker verifies against on register and authenticate.
+ */
+declare function buildCommitment(secretHex: string, saltHex: string, ecdsaPubHex: string): Promise<string>;
+/**
+ * Generate a Groth16 proof for the `preimagePoK` circuit. Public signals end
+ * up `[commitment, nonce, ecdsaPubHash]` — the worker checks the commitment
+ * matches the stored one and the nonce matches the issued challenge nonce
+ * reduced into the field.
  *
- * Two ways to initialize, matching the pattern used by `workers/groth16-verifier`:
- *   1. `await initRsWasm()` — uses the bundled .wasm (base64-inlined at build
- *      time by `@rollup/plugin-wasm`). Works in any runtime that allows
- *      runtime `WebAssembly.compile()`.
- *   2. `await initRsWasm(myWasmModule)` — accepts a pre-compiled
- *      `WebAssembly.Module`. Useful when the bundled loader path isn't
- *      available (vitest, CF Workers wanting deploy-time precompile, etc.).
+ * Throws if circuit URLs are unreachable or snarkjs decides the inputs are
+ * malformed.
  */
-declare function initRsWasm(wasmModule?: WebAssembly.Module): Promise<void>;
+declare function generateAuthProof(args: {
+    secretHex: string;
+    saltHex: string;
+    ecdsaPubHex: string;
+    nonceHex: string;
+    /** Required — caller supplies URLs scoped to the worker they want to talk to. */
+    circuits: CircuitUrls;
+}): Promise<{
+    proof: Groth16Proof;
+    publicSignals: string[];
+    commitment: string;
+    nonceField: string;
+    ecdsaPubHash: string;
+}>;
 
 /**
- * HTTP client for the accelerator's `/api/auth/*` endpoints.
+ * Conversions between SubtleCrypto `CryptoKey`s and the wire formats the
+ * accelerator's auth endpoints + `preimagePoK` circuit expect.
  *
- * Owns the wire shapes for register / challenge / authenticate / verify so
- * the React SPA (and any future consumers) don't reimplement them. The ZK
- * identity derivation + Groth16 proof generation stay on the application
- * side — this client handles only the round-trips.
+ * Two outputs we need from an ECDSA `CryptoKey`:
+ *   - **base64 raw**  — passed to `/api/auth/zk-register` as
+ *                       `ecdsaPublicKey` / `ecdhPublicKey`. (Name is historical;
+ *                       the legacy client called it `exportPublicKeyToBase58`
+ *                       but actually used base64 — kept as base64.)
+ *   - **hex raw**     — fed to the proof as `ecdsaPub` input; the circuit
+ *                       reduces it into a field element.
  *
- * Mirrors `PersonalSpaceClient` / `ShardClient` / `SharedSpaceClient`: takes
- * a `baseUrl`, optional custom `fetch`, throws typed `Error`s on failure
- * (with the worker's message inlined where available).
+ * Both go through `crypto.subtle.exportKey("raw", ...)` which yields the
+ * uncompressed SEC1 form (`0x04 || X || Y`).
  */
+/** Raw uncompressed (`0x04 || X || Y`) public key bytes, as lowercase hex. */
+declare function exportPublicKeyHex(publicKey: CryptoKey): Promise<string>;
+/** Raw uncompressed public key as base64 — wire format for the auth endpoints. */
+declare function exportPublicKeyBase64(publicKey: CryptoKey): Promise<string>;
+/** Sign a UTF-8 `message` with an ECDSA private key. Returns base64. */
+declare function signMessage(message: string, privateKey: CryptoKey): Promise<string>;
 
-interface ZkRegisterRequest {
-    username: string;
-    /** Decimal-string Poseidon commitment. */
-    commitment: string;
-    /** Base64-encoded raw uncompressed ECDH public key (SEC1 0x04‖X‖Y). */
-    ecdhPublicKey: string;
-    /** Base64-encoded raw uncompressed ECDSA public key. */
-    ecdsaPublicKey: string;
-    email?: string | null;
-}
-interface ZkRegisterResponse {
-    success: boolean;
-}
-interface ZkChallengeResponse {
-    challengeId: string;
-    /** Hex-encoded random nonce — caller reduces into a BN254 field element for the proof. */
-    nonce: string;
-    /** Decimal-string Poseidon commitment the server has on file for this user. */
-    commitment: string;
-}
-interface ZkAuthenticateRequest {
-    challengeId: string;
-    proof: {
-        commitment: string;
-        /** Original hex nonce from the challenge (NOT the field-reduced version). */
-        nonce: string;
-        response: {
-            proof: Groth16Proof;
-            publicSignals: string[];
-        };
-        /** Base64 ECDSA-SHA256 signature over `JSON.stringify(response.proof)`. */
-        signature: string;
-    };
-    rememberMe?: boolean;
-}
-interface AuthSuccess {
-    token: string;
-    username: string;
-}
-/** A vault factor record (M1.0 + M2 gated types). Wrap/iv are base64 AES-GCM; absent for phrase. */
-interface VaultFactor {
-    id: string;
-    type: "password" | "passkey" | "phrase-marker" | "email" | "google" | "device";
-    wrap?: string;
-    iv?: string;
-    params?: Record<string, unknown>;
-    label?: string;
-    createdAt?: number;
-    /** Display hint for gated factors ("m•••@gmail.com") — list responses only. */
-    masked?: string;
-    /** Passkey's origin (RP id) — list responses only. A passkey only unlocks
-     *  from this host or a subdomain of it, so apps on several hosts enroll one
-     *  per origin. */
-    rpId?: string;
-}
-interface AuthClientOptions {
-    /** Absolute URL of the accelerator worker (no trailing slash required). */
-    baseUrl: string;
-    /** Optional custom fetch — defaults to `globalThis.fetch`. */
-    fetch?: typeof fetch;
+/**
+ * Hosted-auth handoff crypto (auth.muhkoo.dev — AUTH_HOSTED_PLAN.md §3).
+ *
+ * The hosted page authenticates the user and ends up holding the master seed.
+ * To pass it to the developer's app without it ever sitting server-readable or
+ * landing in browser history:
+ *
+ *   1. {@link sealSeed} generates a one-time key K_t, AES-256-GCM-seals the seed
+ *      under it, and returns the ciphertext envelope (`sealedKeys`, stored in
+ *      the grant the server relays but can't read) plus K_t (`fragmentKey`,
+ *      placed ONLY in the redirect URL fragment — fragments never hit a server).
+ *   2. The app exchanges the code for `sealedKeys`, reads K_t from the fragment,
+ *      and {@link unsealSeed} recovers the seed, then strips the fragment.
+ *
+ * Trust-equivalent to today's embedded SDK (the app still ends up with the
+ * seed) while moving credential entry onto the Muhkoo origin. The envelope is
+ * versioned so a future per-app-key handoff (v2) can swap in without a protocol
+ * change.
+ *
+ * ## v2 — device pairing (TV / no-redirect handoff)
+ *
+ * v1's K_t rides in the redirect URL *fragment*, which works only because the
+ * receiving app is a browser page that can read `location.hash`. A TV app has
+ * no redirect to receive: it polls. So v2 keeps the *entire* v1 shape — the
+ * server relays a sealed envelope it cannot read — and replaces only the key
+ * agreement:
+ *
+ *   - the TV generates an ephemeral P-256 ECDH keypair in memory and publishes
+ *     the public half ({@link generateDevicePairingKeypair});
+ *   - the hosted page (the component that already holds the unlocked seed and
+ *     already owns sealing) seals *to that public key* with a fresh ephemeral
+ *     keypair of its own ({@link sealSeedToDevice}) — ECDH → HKDF-SHA256 →
+ *     AES-256-GCM;
+ *   - the TV recovers the seed with its private key
+ *     ({@link unsealSeedFromDevice}).
+ *
+ * The server stores and relays the v2 envelope byte-for-byte, exactly as it
+ * does for v1, and can read neither. The one thing ECDH cannot supply is proof
+ * that the public key the hosted page sealed to is *the TV's* rather than an
+ * attacker's — that is what {@link pairingVerificationCode} is for, and it is
+ * the only MITM defence in the flow (see the entropy note on that function).
+ */
+interface SealedHandoff {
+    /** base64 JSON envelope — relayed by the server in the grant; server-opaque. */
+    sealedKeys: string;
+    /** base64url one-time key — rides ONLY in the redirect URL fragment. */
+    fragmentKey: string;
 }
-declare class AuthClient {
-    private readonly baseUrl;
-    private readonly fetchFn;
-    constructor(opts: AuthClientOptions);
-    /** Submit ZK registration. Caller has already derived the identity + commitment. */
-    register(req: ZkRegisterRequest): Promise<ZkRegisterResponse>;
-    /** Request an auth challenge for `username` (server issues a fresh nonce). */
-    getChallenge(username: string): Promise<ZkChallengeResponse>;
-    /** Trade a challenge + proof for a session token. */
-    authenticate(req: ZkAuthenticateRequest): Promise<AuthSuccess>;
+/** Seal the master seed under a fresh one-time key for the redirect handoff. */
+declare function sealSeed(seed: Uint8Array): Promise<SealedHandoff>;
+/** Recover the master seed from the sealed envelope + the fragment key. */
+declare function unsealSeed(sealedKeys: string, fragmentKey: string): Promise<Uint8Array>;
+/**
+ * Alphabet for the pairing verification code: 30 symbols, every confusable pair
+ * removed in BOTH directions — no `0`/`O`, no `1`/`I`/`L`, and no `U` (which is
+ * read as `V` on the low-resolution, far-viewed type a TV renders). Because the
+ * user compares this string across two screens by eye, unambiguity beats the
+ * convenience of a power-of-two alphabet; the derivation below rejection-samples
+ * to avoid the modulo bias that costs us.
+ */
+declare const PAIRING_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTVWXYZ23456789";
+/** Length of the pairing verification code, in characters. 30^8 ≈ 39.3 bits. */
+declare const PAIRING_CODE_LENGTH = 8;
+/** An ephemeral ECDH keypair generated by the pairing device (the TV). */
+interface DevicePairingKeypair {
+    /** base64 raw (SEC1 uncompressed, 65 bytes) public key — safe to publish. */
+    publicKeyB64: string;
     /**
-     * Validate a previously stored session token. Returns `{ username }` on
-     * success; throws on 401/404 — caller uses that to drop a stale token
-     * when restoring a session after a reload.
-     */
-    verify(token: string): Promise<{
-        username: string;
-    }>;
-    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
-    oprfEvaluate(username: string, blinded: string): Promise<{
-        evaluated: string;
-    }>;
-    /**
-     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
-     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
-     * domains' evaluations. The recover token is consumed by this call.
-     */
-    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string): Promise<{
-        evaluated: string;
-        evaluated2: string;
-    }>;
-    /**
-     * Request an email OTP. With a session `token` this is the ENROLL flow
-     * (code sent to `email`); without one it's RECOVER (code sent to the
-     * account's enrolled address — the response is uniform either way).
+     * Non-extractable private half. In-memory only, one per pairing attempt:
+     * it is never persisted and never leaves the device, so a captured pairing
+     * transcript is undecryptable once the attempt ends.
      */
-    emailOtpStart(opts: {
-        token?: string;
-        email?: string;
-        username?: string;
-    }): Promise<void>;
-    /** Trade an emailed code for a single-use verifyToken (+ the proven address). */
-    emailOtpVerify(opts: {
-        code: string;
-        token?: string;
-        username?: string;
-    }): Promise<{
-        verifyToken: string;
-        email: string;
-    }>;
+    privateKey: CryptoKey;
+}
+/**
+ * (Device side) Generate the ephemeral P-256 ECDH keypair for one pairing
+ * attempt. Call this once per attempt and throw it away when the attempt ends —
+ * reusing a keypair across attempts would let an old, observed ciphertext be
+ * decrypted by whoever later obtains the key.
+ */
+declare function generateDevicePairingKeypair(): Promise<DevicePairingKeypair>;
+/**
+ * (Hosted-page side) Seal the master seed *to a device's* pairing public key.
+ *
+ * A fresh ephemeral keypair is generated per call and its public half is
+ * carried in the envelope (`epk`), so sealing the same seed to the same device
+ * twice yields unrelated ciphertext — and the sealer retains nothing that could
+ * later reopen the envelope.
+ *
+ * Returns the v2 `sealedKeys` string, which slots into exactly the same server
+ * field as v1: relayed verbatim, never read.
+ */
+declare function sealSeedToDevice(seed: Uint8Array, devicePublicKeyB64: string): Promise<string>;
+/**
+ * (Device side) Recover the master seed from a v2 envelope using the ephemeral
+ * private key from {@link generateDevicePairingKeypair}.
+ *
+ * Throws on any tamper: a substituted `epk` yields a different shared secret
+ * (or fails point validation outright), and any edit to `iv`/`ct` fails the
+ * AES-GCM tag. There is no path that returns partially-authenticated bytes.
+ *
+ * `devicePublicKeyB64` is the caller's OWN public half (from
+ * {@link generateDevicePairingKeypair}). It is required, not optional, because
+ * it is mixed into the KDF — see {@link deriveDeviceSealKey} for why binding the
+ * recipient matters. A device always holds both halves, so this costs nothing.
+ */
+declare function unsealSeedFromDevice(sealedKeys: string, privateKey: CryptoKey, devicePublicKeyB64: string): Promise<Uint8Array>;
+/**
+ * Short code derived deterministically from the device's pairing public key,
+ * displayed on BOTH the TV and the approving browser so the human can confirm
+ * they match before approving.
+ *
+ * ## What this is worth (be honest about it)
+ *
+ * ~39.3 bits (30^8), rendered in an unambiguous 30-symbol alphabet and grouped
+ * as `XXXX-XXXX` for comparison. Alongside the recipient-key binding in
+ * {@link deriveDeviceSealKey}, this is what stops a substituted device key: the
+ * KDF rejects a *negated* key, and this code is what a human uses to reject a
+ * wholly *attacker-generated* one, which the crypto cannot detect on its own —
+ * ECDH proves nothing about WHOSE public key it is.
+ *
+ * Two attacks, and what each actually costs:
+ *
+ *   1. **Online grind.** Generate keypairs until one's code equals the honest
+ *      TV's. ~2^39 trials. Naively that reads as "keygen + hash", but a real
+ *      attacker never generates keys: walking `P_{i+1} = P_i + G` while tracking
+ *      `d_i = d_0 + i` makes each trial one point-add plus one derivation. With
+ *      a plain hash that is well under a core-day — which is why this uses
+ *      PBKDF2-SHA256 at {@link PAIRING_CODE_ITERATIONS} iterations instead. The
+ *      work factor applies per trial, pushing the same grind to the order of
+ *      10^5 core-days. The target is also only learned when pairing starts, so
+ *      the grind is online against the pairing TTL (keep it minutes).
+ *   2. **Precomputed table.** The reason this is not a plain hash. A table over
+ *      candidate keys is computed once and reused forever; with SHA-256 that is
+ *      cheap enough to be the preferred attack. The iteration count multiplies
+ *      the table's build cost by the same 2 * 10^5.
+ *
+ * Neither is a proof of security, and an adversary with ASIC-scale hardware
+ * changes these numbers. If the margin is ever judged insufficient, raise
+ * {@link PAIRING_CODE_LENGTH} — 10 characters buys ~49 bits for two more
+ * characters of human comparison, and is display-only: it does not touch the
+ * envelope or the wire format.
+ *
+ * The cost is paid once per pairing, on two idle devices, so ~200k iterations
+ * is imperceptible here in a way it would not be on a hot path.
+ */
+declare function pairingVerificationCode(devicePublicKeyB64: string): Promise<string>;
+interface Pkce {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/** Generate a PKCE verifier + S256 challenge for the authorize→token exchange. */
+declare function generatePkce(): Promise<Pkce>;
+/** A random URL-safe value for the OAuth `state` (CSRF binding on the callback). */
+declare function randomState(): string;
+
+/**
+ * `deviceStore` — at-rest persistence for a paired device (the TV).
+ *
+ * A device that has completed {@link HostedAuth.startDevicePairing} holds the
+ * account's **master seed**. Android WebView has no WebAuthn, so the passkey
+ * wrapping used elsewhere isn't available, and re-pairing on every cold start
+ * is not acceptable UX for a set-top box. So the seed is persisted, encrypted:
+ *
+ * | Item                     | Where                                | Form |
+ * | ------------------------ | ------------------------------------ | ---- |
+ * | wrapping key             | IndexedDB (`muhkoo.device.v1`)       | `CryptoKey`, AES-GCM-256, **non-extractable** |
+ * | device identity keypair  | IndexedDB (`muhkoo.device.v1`)       | `CryptoKeyPair`, ECDSA P-256, private half **non-extractable** |
+ * | sealed identity blob     | localStorage `muhkoo.tv.identity.v1` | `{"v":1,"iv":…,"ct":…}` over `JSON{username, commitment, seed(b64), pairedAt}` |
+ *
+ * The split is deliberate — ciphertext in one backend, key in another, and the
+ * key non-extractable so JS can *use* it but not export it.
+ *
+ * ## Be honest about what this is worth
+ *
+ * **This is obfuscation, not protection.** It raises the cost of a casual
+ * `localStorage` dump to "nothing useful", and that is all:
+ *
+ *   - **XSS on the device origin** cannot *exfiltrate* the wrapping key (it is
+ *     non-extractable) but can absolutely call `decrypt` and read the seed. The
+ *     only mitigation is that there is no third-party script in the shell —
+ *     enforce a strict CSP with no `unsafe-inline`, no CDN, no remote fonts.
+ *   - **ADB / root / a backup extraction / a forensic image recovers the seed.**
+ *     The IndexedDB LevelDB files hold the AES key bytes in the clear; WebCrypto
+ *     "non-extractable" is a JS-API boundary, not an OS one. **A stolen device is
+ *     a stolen identity.**
+ *
+ * That is not an implementation shortcut, it is the shape of the problem: any
+ * wrapping key usable without user interaction lives somewhere equally readable
+ * on a keyboard-less device with no hardware key store exposed to WebView.
+ * Reduce the blast radius with `android:allowBackup="false"`,
+ * `android:debuggable="false"`, a strict CSP, and by storing *only* the 32-byte
+ * seed + username + commitment (never a session token, never a recovery phrase).
+ *
+ * ## Documented upgrade path — no protocol change
+ *
+ * If the native shell exposes a Keystore bridge:
+ *
+ * ```java
+ * @JavascriptInterface public String wrap(String b64plain);    // AES-GCM, StrongBox when present
+ * @JavascriptInterface public String unwrap(String b64cipher);
+ * ```
+ *
+ * this module prefers `globalThis.MuhkooKeystore` automatically and falls back
+ * to the WebCrypto scheme otherwise. The Keystore key is hardware-backed and
+ * non-exportable at the OS level, so a copied filesystem image alone becomes
+ * useless. Nothing on the wire, in the endpoint contracts, or in the SDK surface
+ * changes — only the two functions below do, internally.
+ *
+ * ## Degradation
+ *
+ * Nothing here throws at import time. On a runtime with neither backend (SSR,
+ * Workers, Node) the module still loads: {@link loadDeviceIdentity} returns
+ * `null`, {@link persistDeviceIdentity} throws a typed
+ * {@link DeviceStoreUnavailableError} the caller can swallow, and
+ * {@link deviceIdentityKey} falls back to an **in-memory** keypair for the
+ * lifetime of the process (so pairing still works; the device is just never
+ * recognised as "known" on a later run).
+ */
+/** localStorage key holding the AES-GCM-sealed identity blob. */
+declare const DEVICE_IDENTITY_STORAGE_KEY = "muhkoo.tv.identity.v1";
+/** IndexedDB database holding the non-extractable keys. */
+declare const DEVICE_KEY_DB_NAME = "muhkoo.device.v1";
+/** What a paired device persists. The seed **is** the identity — treat it as such. */
+interface PersistedDeviceIdentity {
+    username: string;
+    /** Decimal-string Poseidon commitment. Pinned: a later pairing that yields a
+     *  different commitment for this device must be refused, not adopted. */
+    commitment: string;
+    /** The 32-byte master seed. */
+    seed: Uint8Array;
+    pairedAt: number;
+}
+/** Thrown when persistence is impossible (no IndexedDB and/or no localStorage). */
+declare class DeviceStoreUnavailableError extends Error {
+    constructor(what: string);
+}
+/** Key/value store for live `CryptoKey` objects (IndexedDB in the browser). */
+interface DeviceKeyVault {
+    get(id: string): Promise<unknown | null>;
+    put(id: string, value: unknown): Promise<void>;
+    /** Delete the entire store — used by `clearDeviceIdentity`. */
+    destroy(): Promise<void>;
+}
+/** String store for the sealed blob (localStorage in the browser). */
+interface DeviceBlobStore {
+    get(key: string): string | null;
+    set(key: string, value: string): void;
+    remove(key: string): void;
+}
+/** The native Keystore bridge, when the shell provides one (see module docs). */
+interface MuhkooKeystoreBridge {
+    wrap(b64plain: string): string | Promise<string>;
+    unwrap(b64cipher: string): string | Promise<string>;
+}
+/**
+ * Point the store at explicit backends (or `null` to force "unavailable"), and
+ * reset the memoized device keypair. Testing / embedding seam — pass `{}` to
+ * restore the default browser backends.
+ */
+declare function configureDeviceStore(opts?: {
+    keys?: DeviceKeyVault | null;
+    blobs?: DeviceBlobStore | null;
+    keystore?: MuhkooKeystoreBridge | null;
+}): void;
+/**
+ * True when {@link deviceIdentityKey} had to fall back to an in-memory keypair
+ * because no key vault was available. Such a device can pair, but will never be
+ * recognised as "known" afterwards (so approval always needs a fresh factor).
+ */
+declare function deviceIdentityIsEphemeral(): boolean;
+/**
+ * The device's **persistent** ECDSA P-256 identity keypair, created on first
+ * call. This is not a browser fingerprint — it is a key, and every
+ * `POST /api/auth/device/code` proves possession of it. Without that proof,
+ * "known device" would be an unauthenticated string anyone could claim in order
+ * to skip the approver's re-authentication.
+ *
+ * The private half is non-extractable and never leaves IndexedDB as bytes.
+ */
+declare function deviceIdentityKey(): Promise<CryptoKeyPair>;
+/** `base64url(SHA-256(raw SEC1 device identity public key))` — 43 chars. */
+declare function deviceFingerprint(): Promise<string>;
+/** Whether a sealed identity blob exists. Cheap: no crypto, no IndexedDB, no network. */
+declare function hasDeviceIdentity(): Promise<boolean>;
+/**
+ * Seal and store the identity. Throws {@link DeviceStoreUnavailableError} when
+ * there is nowhere to put it — callers should treat that as "this device won't
+ * resume", not as a pairing failure.
+ */
+declare function persistDeviceIdentity(v: PersistedDeviceIdentity): Promise<void>;
+/**
+ * Recover the persisted identity, or `null` when there is none / it can't be
+ * opened (wiped IndexedDB, a different browser profile, a corrupted blob).
+ * Never throws — a cold start with unreadable storage must fall back to a fresh
+ * pairing, not to an error screen.
+ */
+declare function loadDeviceIdentity(): Promise<PersistedDeviceIdentity | null>;
+/**
+ * Wipe everything: the sealed blob **and** the whole key database — so the
+ * wrapping key never outlives the ciphertext it opens, and the device identity
+ * key is regenerated (a re-pair is then correctly treated as a new device).
+ */
+declare function clearDeviceIdentity(): Promise<void>;
+
+/**
+ * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
+ *
+ * A passkey becomes a device-bound, platform-synced source of a stable secret:
+ * for a fixed salt, the authenticator's PRF returns the same 32 bytes, which we
+ * HKDF into an AES key that wraps the master seed. The server never sees the
+ * passkey — it's purely a local key source; the ZK proof remains the server auth.
+ *
+ * BROWSER ONLY (`navigator.credentials`). The PRF extension fields aren't in the
+ * standard DOM types yet, so they're reached through narrow casts.
+ */
+/** Whether this environment can do WebAuthn at all. (PRF support is checked at enroll.) */
+declare function passkeySupported(): boolean;
+/**
+ * Whether this browser's authenticator can do the **PRF extension** our passkey
+ * factor needs. A browser can save passkeys (e.g. for password autofill) yet not
+ * expose PRF — PRF is what derives the stable secret we wrap the seed under, so a
+ * passkey without it is useless to us.
+ *
+ * Uses `PublicKeyCredential.getClientCapabilities()` (the `extension:prf` cap)
+ * where available. Returns:
+ *   - `true`  — PRF is supported,
+ *   - `false` — definitively NOT supported (hide the option),
+ *   - `null`  — couldn't determine (older browser without the capabilities API);
+ *              the caller may optimistically allow and let enroll surface a real
+ *              error if it turns out PRF isn't there.
+ */
+declare function passkeyPrfCapable(): Promise<boolean | null>;
+/** Best-effort registrable RP id — the host. Apps spanning subdomains should pass
+ *  the parent domain (e.g. "muhkoo.dev") explicitly. */
+declare function defaultRpId(): string;
+/**
+ * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
+ *
+ * WebAuthn only accepts an RP id that is the origin's own host or a registrable
+ * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
+ * `app.example.net`, and one enrolled on a full host is unusable from a sibling
+ * host. An app served on BOTH a custom domain and the platform host therefore
+ * needs one passkey per origin.
+ *
+ * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
+ * a raw "The requested RPID did not match the origin or related origins", which
+ * is a dead end for the user. Checking first lets the caller fall back to normal
+ * sign-in (and offer to enroll a passkey for this origin) instead.
+ */
+declare function rpIdUsableForOrigin(rpId: string | undefined | null, host?: string): boolean;
+/**
+ * Would {@link AuthNamespace.loginWithPasskey} accept a factor recorded with
+ * this `rpId`, from `host`?
+ *
+ * This is deliberately NOT the same as {@link rpIdUsableForOrigin}. That answers
+ * a raw WebAuthn question and is `false` for a missing rpId. But a factor with
+ * NO recorded rpId predates per-origin enrolment, and `loginWithPasskey`
+ * resolves it as `params.rpId ?? host` — so it IS usable, from anywhere.
+ *
+ * Callers deciding "should I even try a passkey here?" must use this one.
+ * Reaching for `rpIdUsableForOrigin` instead silently excludes every legacy
+ * passkey holder, which has locked real users out of production twice.
+ *
+ * The `?? host` fallback applies to nullish only, matching `loginWithPasskey`:
+ * an empty-string rpId stays unusable rather than resolving to the host.
+ */
+declare function passkeyUsableFromOrigin(rpId: string | undefined | null, host?: string): boolean;
+/** Thrown when the account's passkey belongs to a different origin. Callers
+ *  should treat this as "no passkey here" and fall back to another factor. */
+declare class PasskeyOriginError extends Error {
+    readonly code = "passkey_wrong_origin";
+    constructor(message?: string);
+}
+interface PasskeyEnrollment {
+    credentialId: Uint8Array;
+    prfSalt: Uint8Array;
+    prfOutput: Uint8Array;
+}
+/**
+ * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
+ * the PRF output for that salt. Throws if the authenticator can't do PRF.
+ */
+declare function createPasskeyWithPrf(opts: {
+    rpId: string;
+    rpName: string;
+    username: string;
+}): Promise<PasskeyEnrollment>;
+/** Evaluate a passkey's PRF for `salt` → 32 bytes. Used at recover/login. */
+declare function evaluatePasskeyPrf(rpId: string, credentialId: Uint8Array, salt: Uint8Array): Promise<Uint8Array>;
+
+/**
+ * `PersonalSpaceClient` — the client-side counterpart to the accelerator's
+ * `PersonalSpaceDO`. Wraps the `/api/personal/:commitment/*` HTTP protocol so
+ * callers can `put` / `get` / `delete` / `list` per-user KV blobs without
+ * thinking about challenges, nonces, or Groth16 proof generation.
+ *
+ * Every gated operation:
+ *   1. Requests a one-shot challenge from the DO (`POST /challenge`).
+ *   2. Converts the returned hex nonce into a BN254 field element.
+ *   3. Generates a fresh Groth16 proof for the `preimagePoK` circuit using
+ *      snarkjs, with the user's secret/salt/ecdsaPub as private inputs and
+ *      `{commitment, nonce, ecdsaPubHash}` as public signals.
+ *   4. POSTs the proof + publicSignals + (optional) value to the gated endpoint.
+ *
+ * snarkjs is loaded lazily (dynamic `import`) the first time a proof is
+ * generated — it's an optional peer dependency that only the ZK-proof path
+ * needs, so importing this module (or constructing a `Client`) never requires
+ * it. Consumers using the proof path install `snarkjs`, or provide it via an
+ * import map in the browser (see the README).
+ *
+ * Encryption of the stored values is the caller's responsibility — the DO
+ * sees only opaque JSON. The companion `wrap.ts` helpers in this folder are
+ * a convenient way to passphrase-encrypt a payload before putting it.
+ */
+
+/**
+ * Constructor options for {@link PersonalSpaceClient}.
+ *
+ * All of `secret`, `salt`, `ecdsaPub`, and `ecdsaPubHash` are decimal-encoded
+ * BigInt strings (snarkjs convention). `commitment` is likewise decimal — it's
+ * the Poseidon hash of `(secret, salt, ecdsaPubHash)`.
+ */
+interface PersonalSpaceClientOptions {
+    /** Base URL of the accelerator, e.g. `http://localhost:8787`. */
+    baseUrl: string;
+    /** The user's Poseidon commitment as a decimal string (~78 digits). */
+    commitment: string;
+    /** ZK identity material — private inputs to the proof. Decimal BigInt string. */
+    secret: string;
+    /** ZK identity salt. Decimal BigInt string. */
+    salt: string;
+    /** Raw ECDSA public-key field representation. Decimal BigInt string. */
+    ecdsaPub: string;
+    /** Poseidon hash of `ecdsaPub`, used as a public signal. Decimal BigInt string. */
+    ecdsaPubHash: string;
     /**
-     * Verify a Google ID token (M2.3). With a session `token` it's the ENROLL
-     * gate; without, it's RECOVER/LOGIN (the Google account must already be
-     * linked). Returns a single-use verifyToken bound to the account's `sub`.
+     * Where the runtime can fetch the compiled circuit assets, and the digests
+     * to verify them against. Prefer `defaultCircuitUrls(baseUrl)`, which pins
+     * them — this client passes `secret` and `salt` to the witness generator as
+     * private witnesses, so an unverified one can exfiltrate them. See
+     * `src/auth/circuitIntegrity.ts`.
      */
-    googleVerify(opts: {
-        idToken: string;
-        token?: string;
-        username?: string;
-    }): Promise<{
-        verifyToken: string;
-        sub: string;
-        emailHint: string | null;
-    }>;
-    /** Mint a single-use authorization code for an app (called by the hosted page; session-authed). */
-    grant(token: string, body: {
-        appId: string;
-        redirectUri: string;
-        codeChallenge: string;
-        sealedKeys: string;
-    }): Promise<{
-        code: string;
-    }>;
-    /** Exchange an authorization code + PKCE verifier for the session + sealed key material. */
-    token(body: {
-        code: string;
-        codeVerifier: string;
-        appId?: string;
-    }): Promise<{
-        sessionToken: string;
-        username: string;
-        commitment: string;
-        sealedKeys: string;
-        appId: string;
-    }>;
+    circuits: CircuitIntegrity & {
+        /** URL of the `preimagePoK.wasm` witness generator. */
+        wasmUrl: string;
+        /** URL of the `preimagePoK_0001.zkey` proving key. */
+        zkeyUrl: string;
+    };
+}
+declare class PersonalSpaceClient {
+    private readonly baseUrl;
+    private readonly commitment;
+    private readonly secret;
+    private readonly salt;
+    private readonly ecdsaPub;
+    private readonly ecdsaPubHash;
+    private readonly circuits;
+    constructor(opts: PersonalSpaceClientOptions);
+    /** Store `value` under `key`, replacing any prior value. */
+    put(key: string, value: unknown): Promise<void>;
+    /** Fetch the value stored under `key`. Returns `null` if absent. */
+    get<T = unknown>(key: string): Promise<T | null>;
+    /** Remove `key` from the user's space. Returns whether the key existed. */
+    delete(key: string): Promise<boolean>;
+    /** List every key currently stored in the user's space. */
+    list(): Promise<string[]>;
     /**
-     * Read a factor record for `username` (returns an indistinguishable decoy if
-     * absent). Gated types (email) require the recover `verifyToken`.
+     * Run the full pre-flight: ask the DO for a challenge, reduce the nonce to
+     * a field element, and generate a fresh Groth16 proof. Returns everything
+     * the gated endpoints need in their body.
      */
-    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string, 
-    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
-     *  passkey instead of whichever was enrolled first (which WebAuthn would
-     *  refuse). Ignored for other factor types. */
-    rpId?: string, 
-    /** Device factors are selected by id — a user may have many machines. */
-    factorId?: string): Promise<{
-        factor: VaultFactor | null;
-    }>;
+    private proveFreshChallenge;
+    /** Hit `POST /challenge` and return the issued nonce + ID. */
+    private requestChallenge;
     /**
-     * Add/replace a factor (session-authed; the seed is already wrapped
-     * client-side). Email factors additionally require (and consume) the
-     * enroll `verifyToken`; the stored address must be the verified one.
+     * Thin wrapper over `globalThis.fetch` so all methods share a single set of
+     * headers and body-encoding behaviour. `globalThis.fetch` is available in
+     * modern browsers, Node 18+, Workers, and Bun.
      */
-    vaultPutFactor(token: string, factor: VaultFactor, verifyToken?: string): Promise<{
-        ok: boolean;
-        id: string;
-    }>;
-    /** List the user's factor metadata (no ciphertext). Session-authed. */
-    vaultFactors(token: string): Promise<{
-        factors: VaultFactor[];
-        migrated: boolean;
-    }>;
-    /** Remove a factor by id (can't remove the last one). Session-authed. */
-    vaultDeleteFactor(token: string, id: string): Promise<{
-        deleted: boolean;
-    }>;
-    private json;
-    private parse;
+    private fetch;
+}
+
+/**
+ * Wire types for the storage layer.
+ *
+ * The `FileManifest` is the single piece of metadata the system needs to
+ * reassemble a file: per-chunk encryption material, RS parameters, and the
+ * SHA-256 content hashes of every shard that belongs to the chunk. With the
+ * manifest in hand, a reader can pull each shard from the open content-
+ * addressed shard store, decode, decrypt, and concatenate to recover the
+ * original bytes.
+ *
+ * The manifest itself lives inside a `SharedSpaceDO` (Phase B) which gates
+ * access by ZK proof + ACL. Shards are stored in the open content-addressed
+ * `ShardStoreDO` — anyone can put/get any shard, but without the manifest
+ * (which has the keys) the ciphertext is just noise.
+ */
+
+/**
+ * One chunk's metadata. A file is the concatenation of `chunks` in order.
+ *
+ * - `originalSize` is the chunk's plaintext length, before AES-GCM expanded
+ *   it by 16 bytes for the auth tag and before RS padded it for shard
+ *   alignment.
+ * - `ciphertextSize` is the AES-GCM output length (plaintext + 16). This is
+ *   what the RS decoder trims back to.
+ * - `shardHashes` lists every shard's SHA-256 in encoding order — the first
+ *   `dataShards` are data shards, the trailing `parityShards` are parity.
+ */
+interface ChunkManifest {
+    /** Stable per-chunk ID (uuid-like). Useful for client-side resume / dedup. */
+    id: string;
+    /** Position of this chunk in the file (0-indexed). */
+    chunkIndex: number;
+    /** Plaintext byte length of the chunk before encryption. */
+    originalSize: number;
+    /** AES-GCM ciphertext byte length (originalSize + 16 for the tag). */
+    ciphertextSize: number;
+    /** Number of RS data shards. */
+    dataShards: number;
+    /** Number of RS parity shards. */
+    parityShards: number;
+    /** Length in bytes of every shard (data and parity are equal). */
+    shardSize: number;
+    /** SHA-256 (hex) of each shard's ciphertext bytes, in shard order. */
+    shardHashes: string[];
+    /** Per-chunk AES-256-GCM key + IV. Plain in the manifest — gating happens at the SpaceDO. */
+    cipher: ChunkKeyMaterial;
+}
+/**
+ * Top-level manifest for a single stored file. Persisted in the user's
+ * SharedSpace by file id; readable / writable per the space's ACL.
+ */
+interface FileManifest {
+    /** Stable file ID. Assigned by the SDK at write time; used to read or delete. */
+    id: string;
+    /** Human-readable filename (display only — not used by the shard store). */
+    name: string;
+    /** Total plaintext byte length. Sum of chunk `originalSize`s. */
+    size: number;
+    /** MIME type the application supplied at write time. Opaque to storage. */
+    type: string;
+    /** Optional virtual path / folder hint for the application. */
+    path?: string;
+    /** When the file was last modified per the application (ms epoch). */
+    lastModified: number;
+    /** When this manifest was created on the SDK side (ms epoch). */
+    createdAt: number;
+    /** Ordered list of chunks. Concatenate them in index order to rebuild the file. */
+    chunks: ChunkManifest[];
+    /** SDK schema version. Bump on breaking manifest-shape changes. */
+    version: 1;
+}
+/**
+ * Lightweight summary returned by `FileStorage.writeFile` and surfaced in
+ * directory-style listings. The full manifest is only fetched when actually
+ * reassembling the file.
+ */
+interface FileStat {
+    id: string;
+    name: string;
+    size: number;
+    type: string;
+    path?: string;
+    lastModified: number;
+    createdAt: number;
+    chunkCount: number;
+    shardCount: number;
 }
+/** Distil a `FileManifest` into a `FileStat`. */
+declare function manifestToStat(manifest: FileManifest): FileStat;
 
 /**
- * Deterministic ZK identity derivation from `(username, password)`.
+ * HTTP client for the open content-addressed shard store.
  *
- * Same inputs on ANY device produce the same secret, salt, and P-256
- * ECDSA + ECDH keypairs — which is what makes federated login from a
- * fresh browser possible. There is no localStorage involvement: every
- * register and login call re-derives the identity on demand.
+ * Each shard is named by the lowercase hex SHA-256 of its ciphertext bytes.
+ * The server verifies the hash on PUT, so the address authenticates the
+ * contents — there's no benefit to ACLing PUT/GET, and making them open
+ * enables cross-user dedup down the line.
  *
- * Pipeline:
- *   master_seed = PBKDF2-SHA256(password, "muhkoo-zk-v1:" || username, 200k iters)
- *   secret      = HKDF-Expand-SHA256(master_seed, "zk-secret",  32 bytes) → hex
- *   salt        = HKDF-Expand-SHA256(master_seed, "zk-salt",    32 bytes) → hex
- *   ecdsa_priv  = HKDF-Expand-SHA256(master_seed, "ecdsa-priv", 32 bytes)
- *   ecdh_priv   = HKDF-Expand-SHA256(master_seed, "ecdh-priv",  32 bytes)
+ * Wire protocol:
+ *   PUT  /api/shards/:hash    body: shard bytes (application/octet-stream)
+ *                             200 { ok: true, hash, size, dedup: boolean }
+ *                             400 if hash doesn't match body
  *
- * P-256 public points are computed via `@noble/curves` (WebCrypto has no
- * derive-public-from-private-scalar API), then both keypairs are imported
- * into SubtleCrypto in JWK form so the rest of the crypto stack can keep
- * using `crypto.subtle.sign` / `crypto.subtle.deriveBits`.
+ *   GET  /api/shards/:hash    200 with shard bytes (application/octet-stream)
+ *                             404 if absent
  *
- * Originally lived in `accelerator/public/js/zk-identity.js` and was ported
- * to `muhkoo/web/src/zk/identity.ts`; consolidated here so the SDK owns
- * identity derivation end-to-end.
+ *   HEAD /api/shards/:hash    200 if present (no body) — used by callers to
+ *                             skip a PUT they'd otherwise dedup-rewrite. The
+ *                             server can ignore the optimization if it wants.
  */
-interface ZkIdentity {
-    /** 32-byte secret, hex-encoded. Private witness for the ZK circuit. */
-    secretHex: string;
-    /** 32-byte salt, hex-encoded. Private witness for the ZK circuit. */
-    saltHex: string;
-    /** P-256 ECDSA keypair, used to sign auth proofs. */
-    ecdsaKeyPair: CryptoKeyPair;
-    /** P-256 ECDH keypair, used by the chat ratchet. */
-    ecdhKeyPair: CryptoKeyPair;
-}
 /**
- * Derive a deterministic ZK identity from `(username, password)`.
- *
- * Same inputs always produce the same identity, on any device — that's
- * what makes federated login work without dragging encrypted state across
- * devices.
+ * A content-addressed byte cache for shards (the offline layer's `ShardCache`
+ * satisfies this structurally). Declared here as a minimal interface so the
+ * storage layer doesn't import the offline module — keeping the dependency
+ * arrow one-way (offline → storage).
  */
-declare function deriveIdentity(username: string, password: string): Promise<ZkIdentity>;
+interface ShardByteCache {
+    get(hash: string): Promise<Uint8Array | null>;
+    put(hash: string, bytes: Uint8Array): Promise<void>;
+}
 /**
- * Legacy master-seed derivation: `PBKDF2(password, "muhkoo-zk-v1:"||username)`.
- *
- * This was the *only* path pre-vault, where the identity descended directly from
- * the password. It's kept so existing accounts still re-derive their seed (and
- * the vault can adopt that exact seed on migration, preserving the commitment).
- * New accounts use a random seed (`vault.randomSeed`) instead, so their identity
- * is no longer a function of the password.
+ * A peer block source (the p2p layer's `PeerExchange` satisfies this
+ * structurally). Consulted between the local cache and origin: a block fetched
+ * from a peer is verified by hash before use. Declared here so the storage layer
+ * doesn't import the p2p module (dependency arrow stays p2p → storage).
  */
-declare function deriveMasterSeedFromPassword(username: string, password: string): Promise<Uint8Array>;
+interface PeerBlockSource {
+    getBlock(hash: string, opts?: {
+        timeoutMs?: number;
+    }): Promise<Uint8Array | null>;
+    announce(hash: string): void;
+}
+interface ShardClientOptions {
+    /** Base URL of the accelerator (e.g. `https://muhkoo-accelerator.workers.dev`). */
+    baseUrl: string;
+    /**
+     * Path prefix for the shard endpoints, joined to `baseUrl` before the
+     * hash. Defaults to `/api/shards`, which targets a global shard store
+     * (e.g. a dedicated `ShardStoreDO`). Pass a room-scoped value like
+     * `/api/spaces/{roomId}/shards` to keep shards bound to a specific
+     * `SharedSpaceDO` — that's the path the chat application uses today.
+     *
+     * Leading slash optional; trailing slash stripped. The final URL is
+     * always `${baseUrl}${normalizedPrefix}/${encodeURIComponent(hash)}`.
+     */
+    pathPrefix?: string;
+    /**
+     * Optional custom fetch implementation. Defaults to `globalThis.fetch`.
+     * Provided so callers can inject retries / auth / instrumentation.
+     */
+    fetch?: typeof fetch;
+    /**
+     * Optional offline byte cache. When present, GETs are served cache-first and
+     * populated on success, and PUTs write the cache before the network so a
+     * just-uploaded file reads back offline. See {@link ShardByteCache}.
+     */
+    cache?: ShardByteCache;
+    /**
+     * Coalesce concurrent origin reads into `POST {pathPrefix}/batch`. On by
+     * default: it is what keeps opening a project from costing one request per
+     * shard. Set false to force one-at-a-time — useful against a server without
+     * the route, though that is detected and handled automatically.
+     */
+    batchShards?: boolean;
+    /**
+     * Called when a PUT can't reach the network (offline). Lets the caller queue
+     * the upload for replay on reconnect; the bytes are already in {@link cache}
+     * keyed by `hash`, so only the hash needs recording.
+     */
+    deferUpload?: (hash: string) => Promise<void>;
+    /**
+     * Optional peer block source. When present, GETs try peers between the local
+     * cache and origin (peer blocks are verified by hash); PUTs announce the new
+     * block to peers. Best-effort — any failure falls through to origin.
+     */
+    peers?: PeerBlockSource;
+    /**
+     * When true, {@link ShardClient.putShard} returns as soon as the shard is
+     * written to {@link cache} and announced to {@link peers} — the origin PUT is
+     * fired in the BACKGROUND rather than awaited. This makes a large write's
+     * manifest available immediately (so a peer/worker can start pulling the
+     * shards over P2P right away) while origin catches up as a durable fallback.
+     * On a background-PUT failure the shard is handed to {@link deferUpload} (if
+     * present) for replay. Requires a {@link cache} so the bytes survive locally
+     * until the background upload lands. No-op without a cache.
+     */
+    backgroundUpload?: boolean;
+}
 /**
- * Derive the (unchanged) ZK identity from a 32-byte **master seed**. The seed is
- * HKDF-expanded into secret/salt + the P-256 ECDSA & ECDH keypairs exactly as
- * before — so the resulting commitment is byte-identical for a given seed. The
- * vault wraps THIS seed under each recovery factor.
+ * Compute the lowercase hex SHA-256 of `bytes`. Available via WebCrypto in
+ * every runtime this SDK targets.
  */
-declare function deriveIdentityFromSeed(seed: Uint8Array): Promise<ZkIdentity>;
+declare function shardHash(bytes: Uint8Array): Promise<string>;
+declare class ShardClient {
+    private readonly baseUrl;
+    private readonly pathPrefix;
+    private readonly fetchFn;
+    private readonly cache?;
+    /** Hashes waiting for the next batch, each with everyone awaiting it. */
+    private pendingShards;
+    private batchTimer;
+    /** False once the server is known not to have the batch route. */
+    private batchSupported;
+    private readonly deferUpload?;
+    private readonly peers?;
+    private readonly backgroundUpload;
+    constructor(opts: ShardClientOptions);
+    /** Build the URL for a given shard hash — exposed for callers that want to log or pre-resolve. */
+    urlForHash(hash: string): string;
+    /**
+     * Upload a shard. The server verifies SHA-256(body) matches `:hash` and
+     * rejects with 400 if not, so the caller is the source of truth on
+     * naming. Re-uploading an existing shard is idempotent — the server
+     * returns `dedup: true` in that case.
+     */
+    putShard(hash: string, bytes: Uint8Array): Promise<{
+        dedup: boolean;
+    }>;
+    private bgActive;
+    private readonly bgQueue;
+    private static readonly BG_CONCURRENCY;
+    /** Queue a shard's origin PUT to run in the background under a concurrency
+     *  cap. Bytes are re-read from {@link cache} at upload time (not held in the
+     *  queue) so a large file's backlog doesn't pin a second copy in memory. */
+    private enqueueBackgroundUpload;
+    /** PUT the shard bytes to origin, verifying the server accepted them.
+     *  Used by the background-upload path; throws on network/HTTP failure. */
+    private uploadToOrigin;
+    /**
+     * Fetch a shard by hash. Throws if the server returns a non-200; returns
+     * `null` for 404 so callers can distinguish "missing" from "errored".
+     */
+    getShard(hash: string): Promise<Uint8Array | null>;
+    /**
+     * Fetch from origin, COALESCING concurrent requests into one batch.
+     *
+     * A shard is not a file. A project is thousands of small source modules,
+     * each split into shards, so reading one at a time made opening a project
+     * cost thousands of requests — 2,086 for a 519-file project. Latency, not
+     * bytes, is what that spends: Chromium took 18.4s over those requests and
+     * Brave, which filters every one, took 37.5s for identical work. Batching
+     * collapses whatever is in flight at the same moment into a single POST,
+     * which is why it helps most exactly where it hurt most.
+     *
+     * Callers are unchanged: `getShard` still asks for one shard and gets one
+     * shard. The window is a few milliseconds — long enough to gather the reads
+     * a concurrent walk issues together, short enough not to be felt by a lone
+     * read.
+     *
+     * Falls back permanently to one-at-a-time if the server has no batch route,
+     * so a new SDK keeps working against an older deployment.
+     */
+    private fetchFromOrigin;
+    /** Send one batch of whatever has accumulated, and settle those callers. */
+    private flushShardBatch;
+    /** Fetch a shard from origin. Returns `null` for 404 (or offline when a
+     *  cache is present, so RS recovery can proceed); throws otherwise. */
+    private fetchOneFromOrigin;
+    /**
+     * Check whether a shard exists. Lets the caller skip a PUT they'd otherwise
+     * dedup-rewrite. The server can implement this as a HEAD or return a small
+     * JSON body — we don't depend on either.
+     */
+    hasShard(hash: string): Promise<boolean>;
+}
 
 /**
- * Poseidon hash wrapper used by the ZK auth flow.
- *
- * Backed by `circomlibjs`'s `buildPoseidon`. Builder is lazy and cached
- * because the JS-side Babyjubjub field reps take ~100ms to construct, and
- * we'd rather not pay that on every page load.
- *
- * Returns hashes as decimal-string BigInts — same format snarkjs and the
- * `preimagePoK` circuit expect for inputs.
+ * HTTP client for the gated file-manifest store on a SharedSpace
+ * (`/api/spaces/:spaceId/files`).
  *
- * Note: circomlibjs is `optionalDependencies` in connect's package.json.
- * Consumers that use the ZK auth flow (browser/server, not workers) need
- * it installed. The workers build does not import this module.
- */
-/**
- * Poseidon-hash `inputs` and return the result as a decimal-string BigInt.
- * Inputs are converted to BigInt — pass either bigints, numbers, or numeric
- * strings.
- */
-declare function poseidonHash(inputs: Array<bigint | string | number>): Promise<string>;
-
-/**
- * Groth16 proof generation for the `preimagePoK` circuit.
+ * A "file" in a space is its **manifest** (per-chunk keys + the SHA-256 of each
+ * global shard). The shard bytes live in the open `/api/shards` store; the
+ * manifest is the capability. This client only moves manifests in/out of the
+ * space's gated store.
  *
- * The circuit proves knowledge of `(secret, salt, ecdsaPub)` such that
- *   commitment = Poseidon(secret, salt, Poseidon(ecdsaPub))
- * while only revealing `(commitment, nonce, ecdsaPubHash)` as public signals.
+ * Authorization is **session-based**, consistent with the rest of the
+ * SharedSpace (keyring, websocket): the SDK's credential-stamping `fetch`
+ * (from {@link HttpClient}) attaches the app key + session token, the platform
+ * validates the session and injects a trusted `X-Muhkoo-User-Context`, and the
+ * DO authorizes on that + channel membership. There is no per-op Groth16 proof.
  *
- * Circuit assets (wasm + zkey) are served by the accelerator worker. Their
- * URLs are a required argument of {@link generateAuthProof} — there is no
- * default. The web app constructs them relative to its configured worker
- * `baseUrl` so the SPA can target either the local wrangler dev or a deployed
- * worker depending on `VITE_WORKER_URL`.
+ * Wire protocol (server: `SharedSpaceDO`):
+ *   POST   /api/spaces/:spaceId/files            body: { manifest }  → { ok, fileId }
+ *   GET    /api/spaces/:spaceId/files                                → { files: FileStat[] }
+ *   GET    /api/spaces/:spaceId/files/:fileId                        → { manifest }
+ *   DELETE /api/spaces/:spaceId/files/:fileId                        → { ok, existed }
  */
 
-interface CircuitUrls {
-    /** preimagePoK.wasm — the circuit's witness generator. */
-    wasmUrl: string;
-    /** preimagePoK_0001.zkey — the proving key. */
-    zkeyUrl: string;
+interface SharedSpaceClientOptions {
+    /** Base URL of the accelerator (e.g. `https://api.muhkoo.dev`). */
+    baseUrl: string;
+    /**
+     * Credential-stamping fetch — pass {@link HttpClient.fetch} so requests
+     * carry the app key + session token. Defaults to `globalThis.fetch`
+     * (unauthenticated; only useful in tests).
+     */
+    fetch?: typeof fetch;
+}
+declare class SharedSpaceClient {
+    private readonly baseUrl;
+    private readonly fetchFn;
+    constructor(opts: SharedSpaceClientOptions);
+    /** Write a file manifest into the space. Requires space membership. */
+    writeFileManifest(spaceId: string, manifest: FileManifest): Promise<void>;
+    /** Read a file manifest by id. Requires space membership. */
+    readFileManifest(spaceId: string, fileId: string): Promise<FileManifest>;
+    /** Delete a file manifest by id. Requires space membership. */
+    deleteFileManifest(spaceId: string, fileId: string): Promise<boolean>;
+    /** List file summaries in the space. Requires space membership. */
+    listFiles(spaceId: string): Promise<FileStat[]>;
+    private filesBase;
+    private jsonRequest;
 }
-/**
- * Canonical {@link CircuitUrls} for the `preimagePoK` login circuit, anchored
- * at a base URL where the accelerator serves the circuit assets out of
- * `circuits/build/`. The filenames here are fixed by the circom build output
- * (the witness generator lands inside a `preimagePoK_js/` directory); callers
- * shouldn't hard-code them. `Client` uses this to default its `circuits`
- * option, and `PersonalSpaceClient` consumers can pass `defaultCircuitUrls(baseUrl)`.
- */
-declare function defaultCircuitUrls(baseUrl: string): CircuitUrls;
-/**
- * Reduce any hex/decimal/byte input to a decimal-string field element in
- * `[0, FIELD_SIZE)`. snarkjs and the `preimagePoK` circuit both want decimal
- * strings; everything else gets normalized here.
- *
- * **Behavior is intentionally byte-for-byte compatible with the legacy
- * `accelerator/public/js/zk-snarkjs-client.js#toField`.** Diverging produces
- * different commitments than accounts registered via the legacy flow,
- * which locks those users out forever — the worker stores whatever
- * commitment the client sent at register time and compares it as a string
- * at login time.
- *
- * In particular: a 32+ char string of hex chars is always treated as hex,
- * even if every character happens to be 0-9 with no a-f letters. An
- * earlier version of this function gated the hex branch on "has at least
- * one letter" — that broke the digit-only-hex edge case (rare in practice,
- * but real). DO NOT add that letter check back.
- */
-declare function toField(value: string | bigint | number): string;
-/**
- * Build the user's Poseidon commitment binding `(secret, salt, ecdsaPubHash)`.
- * Same formula the worker verifies against on register and authenticate.
- */
-declare function buildCommitment(secretHex: string, saltHex: string, ecdsaPubHex: string): Promise<string>;
-/**
- * Generate a Groth16 proof for the `preimagePoK` circuit. Public signals end
- * up `[commitment, nonce, ecdsaPubHash]` — the worker checks the commitment
- * matches the stored one and the nonce matches the issued challenge nonce
- * reduced into the field.
- *
- * Throws if circuit URLs are unreachable or snarkjs decides the inputs are
- * malformed.
- */
-declare function generateAuthProof(args: {
-    secretHex: string;
-    saltHex: string;
-    ecdsaPubHex: string;
-    nonceHex: string;
-    /** Required — caller supplies URLs scoped to the worker they want to talk to. */
-    circuits: CircuitUrls;
-}): Promise<{
-    proof: Groth16Proof;
-    publicSignals: string[];
-    commitment: string;
-    nonceField: string;
-    ecdsaPubHash: string;
-}>;
-
-/**
- * Conversions between SubtleCrypto `CryptoKey`s and the wire formats the
- * accelerator's auth endpoints + `preimagePoK` circuit expect.
- *
- * Two outputs we need from an ECDSA `CryptoKey`:
- *   - **base64 raw**  — passed to `/api/auth/zk-register` as
- *                       `ecdsaPublicKey` / `ecdhPublicKey`. (Name is historical;
- *                       the legacy client called it `exportPublicKeyToBase58`
- *                       but actually used base64 — kept as base64.)
- *   - **hex raw**     — fed to the proof as `ecdsaPub` input; the circuit
- *                       reduces it into a field element.
- *
- * Both go through `crypto.subtle.exportKey("raw", ...)` which yields the
- * uncompressed SEC1 form (`0x04 || X || Y`).
- */
-/** Raw uncompressed (`0x04 || X || Y`) public key bytes, as lowercase hex. */
-declare function exportPublicKeyHex(publicKey: CryptoKey): Promise<string>;
-/** Raw uncompressed public key as base64 — wire format for the auth endpoints. */
-declare function exportPublicKeyBase64(publicKey: CryptoKey): Promise<string>;
-/** Sign a UTF-8 `message` with an ECDSA private key. Returns base64. */
-declare function signMessage(message: string, privateKey: CryptoKey): Promise<string>;
 
 /**
- * Hosted-auth handoff crypto (auth.muhkoo.dev — AUTH_HOSTED_PLAN.md §3).
- *
- * The hosted page authenticates the user and ends up holding the master seed.
- * To pass it to the developer's app without it ever sitting server-readable or
- * landing in browser history:
- *
- *   1. {@link sealSeed} generates a one-time key K_t, AES-256-GCM-seals the seed
- *      under it, and returns the ciphertext envelope (`sealedKeys`, stored in
- *      the grant the server relays but can't read) plus K_t (`fragmentKey`,
- *      placed ONLY in the redirect URL fragment — fragments never hit a server).
- *   2. The app exchanges the code for `sealedKeys`, reads K_t from the fragment,
- *      and {@link unsealSeed} recovers the seed, then strips the fragment.
- *
- * Trust-equivalent to today's embedded SDK (the app still ends up with the
- * seed) while moving credential entry onto the Muhkoo origin. The envelope is
- * versioned so a future per-app-key handoff (v2) can swap in without a protocol
- * change.
- *
- * ## v2 — device pairing (TV / no-redirect handoff)
+ * `FileStorage` — top-level entry point for chunked, encrypted, erasure-coded
+ * file storage.
  *
- * v1's K_t rides in the redirect URL *fragment*, which works only because the
- * receiving app is a browser page that can read `location.hash`. A TV app has
- * no redirect to receive: it polls. So v2 keeps the *entire* v1 shape — the
- * server relays a sealed envelope it cannot read — and replaces only the key
- * agreement:
+ * Pipeline for writing a file:
+ *   1. Split the plaintext into fixed-size chunks (default 4 MiB).
+ *   2. For each chunk:
+ *        a. Generate a fresh AES-256-GCM key + 12-byte IV (`ChunkCipher`).
+ *        b. Encrypt the chunk → ciphertext (plaintext.length + 16 bytes tag).
+ *        c. Reed–Solomon encode the ciphertext into `dataShards + parityShards`
+ *           equal-length shards (`ReedSolomonCodec`).
+ *        d. PUT every shard to the content-addressed shard store, keyed by
+ *           SHA-256 of the shard bytes (`ShardClient`).
+ *   3. Build a `FileManifest` listing every chunk's keys, IVs, sizes, and
+ *      the SHA-256 of every shard in order.
  *
- *   - the TV generates an ephemeral P-256 ECDH keypair in memory and publishes
- *     the public half ({@link generateDevicePairingKeypair});
- *   - the hosted page (the component that already holds the unlocked seed and
- *     already owns sealing) seals *to that public key* with a fresh ephemeral
- *     keypair of its own ({@link sealSeedToDevice}) — ECDH → HKDF-SHA256 →
- *     AES-256-GCM;
- *   - the TV recovers the seed with its private key
- *     ({@link unsealSeedFromDevice}).
+ * Two ways to use the manifest:
+ *   - {@link FileStorage.writeFileToShards} returns it to the caller, who is
+ *     then responsible for delivering it to readers (e.g. by E2E-encrypting
+ *     it as a chat message). The chat application takes this path.
+ *   - {@link FileStorage.writeFile} additionally POSTs the manifest to a
+ *     gated multi-user space (`SharedSpaceClient`) so any participant of the
+ *     space can read the file by manifest id later.
  *
- * The server stores and relays the v2 envelope byte-for-byte, exactly as it
- * does for v1, and can read neither. The one thing ECDH cannot supply is proof
- * that the public key the hosted page sealed to is *the TV's* rather than an
- * attacker's — that is what {@link pairingVerificationCode} is for, and it is
- * the only MITM defence in the flow (see the entropy note on that function).
- */
-interface SealedHandoff {
-    /** base64 JSON envelope — relayed by the server in the grant; server-opaque. */
-    sealedKeys: string;
-    /** base64url one-time key — rides ONLY in the redirect URL fragment. */
-    fragmentKey: string;
-}
-/** Seal the master seed under a fresh one-time key for the redirect handoff. */
-declare function sealSeed(seed: Uint8Array): Promise<SealedHandoff>;
-/** Recover the master seed from the sealed envelope + the fragment key. */
-declare function unsealSeed(sealedKeys: string, fragmentKey: string): Promise<Uint8Array>;
-/**
- * Alphabet for the pairing verification code: 30 symbols, every confusable pair
- * removed in BOTH directions — no `0`/`O`, no `1`/`I`/`L`, and no `U` (which is
- * read as `V` on the low-resolution, far-viewed type a TV renders). Because the
- * user compares this string across two screens by eye, unambiguity beats the
- * convenience of a power-of-two alphabet; the derivation below rejection-samples
- * to avoid the modulo bias that costs us.
+ * Reading is the inverse: {@link FileStorage.readFileFromShards} takes a
+ * manifest and reassembles the plaintext; {@link FileStorage.readFile} first
+ * fetches the manifest from the space.
  */
-declare const PAIRING_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTVWXYZ23456789";
-/** Length of the pairing verification code, in characters. 30^8 ≈ 39.3 bits. */
-declare const PAIRING_CODE_LENGTH = 8;
-/** An ephemeral ECDH keypair generated by the pairing device (the TV). */
-interface DevicePairingKeypair {
-    /** base64 raw (SEC1 uncompressed, 65 bytes) public key — safe to publish. */
-    publicKeyB64: string;
+
+interface FileStorageOptions {
+    /** Talks to the content-addressed shard store. Always required. */
+    shards: ShardClient;
+    /**
+     * Talks to the gated multi-user space holding manifests + ACLs.
+     * Optional — only required by {@link FileStorage.writeFile} /
+     * {@link FileStorage.readFile} / {@link FileStorage.deleteFile} /
+     * {@link FileStorage.listFiles} / {@link FileStorage.readManifest}.
+     *
+     * Callers that ship the manifest themselves (e.g. via an encrypted chat
+     * message) can omit `space` and use the `*FromShards` / `*ToShards`
+     * methods directly.
+     */
+    space?: SharedSpaceClient;
+    /**
+     * Plaintext chunk size in bytes. After encryption each chunk gains 16
+     * bytes (GCM tag); after RS encoding the size is rounded up to a multiple
+     * of `dataShards` per chunk. Default 4 MiB — a balance between
+     * round-trip cost and parallelism on the upload path.
+     */
+    chunkSize?: number;
+    /** RS data shards per chunk (default 4). */
+    dataShards?: number;
+    /** RS parity shards per chunk (default 2). */
+    parityShards?: number;
     /**
-     * Non-extractable private half. In-memory only, one per pairing attempt:
-     * it is never persisted and never leaves the device, so a captured pairing
-     * transcript is undecryptable once the attempt ends.
+     * Cap on concurrent shard uploads / downloads. Tune for the network. The
+     * default of 8 saturates most home connections without overwhelming the
+     * server's per-IP rate limiter.
      */
-    privateKey: CryptoKey;
+    concurrency?: number;
+    /**
+     * Optional pre-compiled RS WebAssembly module. Defaults to the bundled
+     * loader. Pass this in environments where the bundled loader path isn't
+     * available (vitest, deploy-time-precompiled CF Workers).
+     */
+    rsWasmModule?: WebAssembly.Module;
 }
 /**
- * (Device side) Generate the ephemeral P-256 ECDH keypair for one pairing
- * attempt. Call this once per attempt and throw it away when the attempt ends —
- * reusing a keypair across attempts would let an old, observed ciphertext be
- * decrypted by whoever later obtains the key.
+ * Input to {@link FileStorage.writeFile} (which writes the manifest to a
+ * `SharedSpaceClient`). Carries the destination `spaceId`.
  */
-declare function generateDevicePairingKeypair(): Promise<DevicePairingKeypair>;
+interface WriteFileInput extends WriteToShardsInput {
+    /** Space to write the manifest to — must allow the caller `write`. */
+    spaceId: string;
+}
 /**
- * (Hosted-page side) Seal the master seed *to a device's* pairing public key.
- *
- * A fresh ephemeral keypair is generated per call and its public half is
- * carried in the envelope (`epk`), so sealing the same seed to the same device
- * twice yields unrelated ciphertext — and the sealer retains nothing that could
- * later reopen the envelope.
- *
- * Returns the v2 `sealedKeys` string, which slots into exactly the same server
- * field as v1: relayed verbatim, never read.
+ * Input to {@link FileStorage.writeFileToShards} (which doesn't write a
+ * manifest anywhere — that's the caller's job).
  */
-declare function sealSeedToDevice(seed: Uint8Array, devicePublicKeyB64: string): Promise<string>;
+interface WriteToShardsInput {
+    /** Raw data, a Blob, or a File. */
+    data: Uint8Array | Blob | File;
+    /** Application-supplied display metadata. */
+    metadata: {
+        name: string;
+        type: string;
+        path?: string;
+        lastModified?: number;
+    };
+    /**
+     * Optional pre-allocated file id. Defaults to a fresh one. Useful for
+     * resumable uploads: the same id always maps to the same manifest slot.
+     */
+    fileId?: string;
+    /**
+     * Optional upload-progress callback, invoked after each chunk finishes
+     * (`completed` of `total` chunks). Lets a UI show a progress bar. Called once
+     * with `(0, total)` before the first chunk so a bar can render immediately.
+     */
+    onProgress?: (completed: number, total: number) => void;
+}
+declare class FileStorage {
+    private readonly space;
+    private readonly shards;
+    private readonly chunkSize;
+    private readonly dataShards;
+    private readonly parityShards;
+    private readonly concurrency;
+    private readonly cipher;
+    private readonly codec;
+    private readonly rsWasmModule?;
+    constructor(opts: FileStorageOptions);
+    /**
+     * Chunk → encrypt → encode → upload-shards. Returns the resulting manifest
+     * along with a `FileStat` summary. The caller is responsible for storing
+     * or transmitting the manifest however it likes.
+     */
+    writeFileToShards(input: WriteToShardsInput): Promise<{
+        manifest: FileManifest;
+        stat: FileStat;
+    }>;
+    /**
+     * Inverse of {@link writeFileToShards}. Takes a manifest the caller
+     * obtained somehow (chat message, share link, etc.) and reassembles the
+     * plaintext. Throws if too many shards are missing or any chunk's auth
+     * tag fails.
+     */
+    readFileFromShards(manifest: FileManifest): Promise<{
+        data: Uint8Array;
+        stat: FileStat;
+    }>;
+    /**
+     * Streaming inverse of {@link writeFileToShards}: yields each chunk's
+     * decrypted plaintext in order WITHOUT concatenating. Peak memory stays at
+     * ~one chunk, so multi-GB files (which overflow a single `Uint8Array`) can be
+     * piped straight to a file/socket. Same shard sourcing (cache → peers →
+     * origin) and per-chunk auth as {@link readFileFromShards}.
+     */
+    readChunksFromShards(manifest: FileManifest): AsyncGenerator<Uint8Array>;
+    /** As {@link writeFileToShards}, plus POSTs the manifest to `input.spaceId`. */
+    writeFile(input: WriteFileInput): Promise<FileStat>;
+    /** As {@link readFileFromShards}, but fetches the manifest from a space first. */
+    readFile(spaceId: string, fileId: string): Promise<{
+        data: Uint8Array;
+        stat: FileStat;
+    }>;
+    /**
+     * Delete the manifest from a space. **Does not GC the shards** — those
+     * are content-addressed and may be referenced by other manifests.
+     * Garbage collection is a separate server-side concern (Phase D / D-ish).
+     */
+    deleteFile(spaceId: string, fileId: string): Promise<boolean>;
+    /** Convenience pass-through. */
+    listFiles(spaceId: string): Promise<FileStat[]>;
+    /** Read a manifest verbatim — useful for "share file" / export flows. */
+    readManifest(spaceId: string, fileId: string): Promise<FileManifest>;
+    private requireSpace;
+    /** Encrypt + encode + upload one chunk; return its manifest entry. */
+    private writeChunk;
+    /** Inverse of `writeChunk`. */
+    private readChunk;
+    /** Run `tasks` with at most `this.concurrency` in flight. */
+    private runWithConcurrency;
+}
+
 /**
- * (Device side) Recover the master seed from a v2 envelope using the ephemeral
- * private key from {@link generateDevicePairingKeypair}.
+ * Reed–Solomon erasure-coding codec.
  *
- * Throws on any tamper: a substituted `epk` yields a different shared secret
- * (or fails point validation outright), and any edit to `iv`/`ct` fails the
- * AES-GCM tag. There is no path that returns partially-authenticated bytes.
+ * Wraps the WASM-backed `encode` / `reconstruct` primitives in `wasm/rs.ts`
+ * with shard-padding bookkeeping so callers can hand it any-length input and
+ * get back uniform-size shards.
  *
- * `devicePublicKeyB64` is the caller's OWN public half (from
- * {@link generateDevicePairingKeypair}). It is required, not optional, because
- * it is mixed into the KDF — see {@link deriveDeviceSealKey} for why binding the
- * recipient matters. A device always holds both halves, so this costs nothing.
+ * Usage:
+ *   const codec = new ReedSolomonCodec();
+ *   await codec.ready();
+ *   const { shards, shardSize, originalSize } = codec.encode(plaintext, 4, 2);
+ *   // 6 shards (4 data + 2 parity), each `shardSize` bytes
+ *   // …ship them, lose up to 2, then …
+ *   const recovered = codec.decode(shards, 2, deadIndexes, originalSize);
+ *
+ * Why the explicit `originalSize`: RS pads input to make every data shard the
+ * same length. The decoder must trim that padding back off after recovery.
+ * The caller is responsible for stashing `originalSize` somewhere durable
+ * (the file manifest, in this codebase).
  */
-declare function unsealSeedFromDevice(sealedKeys: string, privateKey: CryptoKey, devicePublicKeyB64: string): Promise<Uint8Array>;
+interface EncodeResult {
+    /** All `dataShards + parityShards` shards. All have length `shardSize`. */
+    shards: Uint8Array[];
+    /** Length of every shard (data and parity). */
+    shardSize: number;
+    /** Length of the original input before padding. Needed to trim on decode. */
+    originalSize: number;
+    /** How many of the leading shards are data (the rest are parity). */
+    dataShards: number;
+    /** How many parity shards trail the data shards. */
+    parityShards: number;
+}
+declare class ReedSolomonCodec {
+    /**
+     * Resolves once the WASM module is loaded; safe to call repeatedly.
+     *
+     * Pass `wasmModule` to use a pre-compiled module (e.g. in tests where the
+     * rollup-inlined loader path isn't available, or in CF Workers where you
+     * want to load the module at deploy time). Default path uses the bundled
+     * base64-inlined wasm — works in Node, browsers, and Workers.
+     */
+    ready(wasmModule?: WebAssembly.Module): Promise<void>;
+    /**
+     * Split `data` into `dataShards` equal-size chunks (zero-padded to fit),
+     * compute `parityShards` parity shards, and return all of them.
+     */
+    encode(data: Uint8Array, dataShards: number, parityShards: number): EncodeResult;
+    /**
+     * Reconstruct the original `data` from `shards`. Up to `parityShards`
+     * shards may be missing; for each missing shard, pass an empty
+     * `Uint8Array` placeholder at its position and list the position in
+     * `deadShardIndexes`.
+     *
+     * `originalSize` is required so the trailing zero-padding can be trimmed.
+     */
+    decode(shards: Uint8Array[], parityShards: number, deadShardIndexes: number[], originalSize: number): Uint8Array;
+}
+
 /**
- * Short code derived deterministically from the device's pairing public key,
- * displayed on BOTH the TV and the approving browser so the human can confirm
- * they match before approving.
+ * Universal wasm-bindgen glue for `wasm-reed-solomon-erasure` (v0.2.2 — Rust
+ * Reed–Solomon erasure-coding library compiled with `wasm-pack --target nodejs`).
  *
- * ## What this is worth (be honest about it)
+ * The upstream npm package ships `wasm_reed_solomon_erasure.js` which uses
+ * `require('fs').readFileSync()` to load the WASM file at module load time —
+ * that hard-codes Node and breaks browsers / CF Workers. This file is a port
+ * of that glue with the Node-only pieces removed:
  *
- * ~39.3 bits (30^8), rendered in an unambiguous 30-symbol alphabet and grouped
- * as `XXXX-XXXX` for comparison. Alongside the recipient-key binding in
- * {@link deriveDeviceSealKey}, this is what stops a substituted device key: the
- * KDF rejects a *negated* key, and this code is what a human uses to reject a
- * wholly *attacker-generated* one, which the crypto cannot detect on its own —
- * ECDH proves nothing about WHOSE public key it is.
+ *   - `TextDecoder` is taken from the global (available in Node 12+, every
+ *     modern browser, and Workers — no `require('util')`).
+ *   - The WASM module is loaded via the rollup-inlined `.wasm` import, the
+ *     same `targetEnv: 'auto-inline'` path the bn128 verifier uses. Works in
+ *     Node, browser, and Workers without runtime fs access.
  *
- * Two attacks, and what each actually costs:
+ * Only the two public functions consumers actually need (`encode` and
+ * `reconstruct`) are exported. The rest is the wbindgen heap-table dance.
  *
- *   1. **Online grind.** Generate keypairs until one's code equals the honest
- *      TV's. ~2^39 trials. Naively that reads as "keygen + hash", but a real
- *      attacker never generates keys: walking `P_{i+1} = P_i + G` while tracking
- *      `d_i = d_0 + i` makes each trial one point-add plus one derivation. With
- *      a plain hash that is well under a core-day — which is why this uses
- *      PBKDF2-SHA256 at {@link PAIRING_CODE_ITERATIONS} iterations instead. The
- *      work factor applies per trial, pushing the same grind to the order of
- *      10^5 core-days. The target is also only learned when pairing starts, so
- *      the grind is online against the pairing TTL (keep it minutes).
- *   2. **Precomputed table.** The reason this is not a plain hash. A table over
- *      candidate keys is computed once and reused forever; with SHA-256 that is
- *      cheap enough to be the preferred attack. The iteration count multiplies
- *      the table's build cost by the same 2 * 10^5.
+ * Encoding:
+ *   `encode(dataShards: Uint8Array[], parityShard: number)` → array of
+ *   `dataShards.length + parityShard` Uint8Arrays. The first N are the input
+ *   shards unchanged; the trailing M are the freshly computed parity shards.
+ *   All shards are the same length — caller is responsible for padding the
+ *   data into equal-size data shards.
  *
- * Neither is a proof of security, and an adversary with ASIC-scale hardware
- * changes these numbers. If the margin is ever judged insufficient, raise
- * {@link PAIRING_CODE_LENGTH} — 10 characters buys ~49 bits for two more
- * characters of human comparison, and is display-only: it does not touch the
- * envelope or the wire format.
+ * Reconstruction:
+ *   `reconstruct(corruptedShards, parityShard, deadIndexes)` → fully recovered
+ *   array. Pass placeholders (empty Uint8Arrays) at the dead indexes; the
+ *   reconstructor fills them in. Up to `parityShard` shards may be missing.
+ */
+/**
+ * Load and instantiate the WASM module. Idempotent — repeated calls await the
+ * same one-shot promise.
  *
- * The cost is paid once per pairing, on two idle devices, so ~200k iterations
- * is imperceptible here in a way it would not be on a hot path.
+ * Two ways to initialize, matching the pattern used by `workers/groth16-verifier`:
+ *   1. `await initRsWasm()` — uses the bundled .wasm (base64-inlined at build
+ *      time by `@rollup/plugin-wasm`). Works in any runtime that allows
+ *      runtime `WebAssembly.compile()`.
+ *   2. `await initRsWasm(myWasmModule)` — accepts a pre-compiled
+ *      `WebAssembly.Module`. Useful when the bundled loader path isn't
+ *      available (vitest, CF Workers wanting deploy-time precompile, etc.).
  */
-declare function pairingVerificationCode(devicePublicKeyB64: string): Promise<string>;
-interface Pkce {
-    codeVerifier: string;
-    codeChallenge: string;
-}
-/** Generate a PKCE verifier + S256 challenge for the authorize→token exchange. */
-declare function generatePkce(): Promise<Pkce>;
-/** A random URL-safe value for the OAuth `state` (CSRF binding on the callback). */
-declare function randomState(): string;
+declare function initRsWasm(wasmModule?: WebAssembly.Module): Promise<void>;
 
 /**
  * `SessionState` — the in-memory source of truth for "who is signed in" on a
@@ -5602,6 +5920,8 @@ interface FileEntry {
      * would defeat the point of keeping history out of the directory record.
      */
     versions?: number;
+    /** See `DirEntry.moving`. */
+    moving?: true;
 }
 interface DirEntry {
     kind: "dir";
@@ -5610,6 +5930,25 @@ interface DirEntry {
     /** Base64 AES-256 key for that record. See the capability note above. */
     key: string;
     mtime: number;
+    /**
+     * Set on both copies while a move between two directories is under way.
+     *
+     * A move writes two records, attaching before it detaches, and one that
+     * is interrupted leaves the same entry - the same directory record, or
+     * the same file id, content and history - named in both. This is how a
+     * delete of either copy knows to look for the other before letting go of
+     * anything. Cleared by the move's last write, and from the one copy left
+     * when a delete removes the other. Left in place, it costs a delete of
+     * that entry one read of the tree, and a file keeps every version that
+     * falls off its history.
+     *
+     * Not cleared when that last write is the one that fails: the move has
+     * otherwise finished, only one copy is named anywhere, and nothing comes
+     * back to unmark it. A retried move of the same entry carries the mark
+     * over. That copy then keeps what falls off its history for good - a
+     * storage cost, never a loss.
+     */
+    moving?: true;
 }
 type Entry = FileEntry | DirEntry;
 /** One directory record, as stored (before encryption). */
@@ -5665,6 +6004,57 @@ declare class VfsNotFoundError extends Error {
 declare class VfsConflictError extends Error {
     constructor(message: string);
 }
+/**
+ * Raised when a directory record cannot be read: it does not decrypt or parse
+ * with the key its parent holds, or it does but is not a shape this SDK can
+ * read - not an object, a version other than 1, `entries` missing or not a map.
+ *
+ * Thrown, never read as an empty directory. The next write into an "empty"
+ * directory would seal an empty record over the real one, and a record this
+ * version cannot read may simply be one a NEWER version wrote. Nor is the
+ * directory skipped: a sync that cannot see a subtree reads its absence as a
+ * deletion. The record is left exactly as stored; a recursive delete
+ * (`delete(path, { recursive: true })`) detaches it when the user wants it
+ * gone.
+ */
+declare class VfsCorruptRecordError extends Error {
+    /** The record's id - `dirKey(id)` is where it is stored. */
+    readonly id: string;
+    /** The path it was reached through, when known. A moved subtree can have two. */
+    readonly path?: string;
+    constructor(id: string, path: string | undefined, reason: string);
+}
+/**
+ * Raised when a walk or a copy would go past a size or depth ceiling, or a
+ * write would put a directory deeper than a walk reads.
+ *
+ * Thrown rather than returning what was gathered so far, because every caller
+ * of a walk treats a path that is missing from the result as a path that does
+ * not exist - and a sync then plans a deletion for it. A tree this large or
+ * deep is almost always one built to be expensive to read: directory records
+ * can point at the same directory many times over, so a handful of tiny
+ * records can describe more paths than there are atoms.
+ */
+declare class VfsLimitError extends Error {
+    /**
+     * Which ceiling was hit: total entries, total characters of path text,
+     * nesting depth, or - for a copy - how many places one directory may
+     * appear. Entries alone do not bound memory - a name may be 255 bytes, so
+     * one path can be ~16KB - which is why path text has its own.
+     */
+    readonly limit: "entries" | "pathChars" | "depth" | "shared";
+    /** The ceiling itself. */
+    readonly max: number;
+    /** Where the operation started, or for a write what it was asked to write. */
+    readonly path: string;
+    /**
+     * Where the ceiling was reached: the directory being listed, or for depth
+     * the entry one level too deep. Walking the tree to find the culprit would
+     * hit the same ceiling, so this is the only pointer the caller gets.
+     */
+    readonly at: string;
+    constructor(limit: VfsLimitError["limit"], max: number, path: string, at: string, doing?: string);
+}
 
 /**
  * `client.vfs` — a real filesystem over Muhkoo primitives.
@@ -5735,6 +6125,18 @@ interface VfsNamespaceDeps {
     seed: () => Uint8Array | null;
     /** Versions retained per file. */
     historyLimit?: number;
+    /**
+     * Ceilings for the operations that visit a whole subtree - `walk` (and so
+     * `glob`) and `copy`. `entries` is the most entries one call may visit;
+     * `pathChars` the most characters of path text, summed over every path it
+     * visits. The defaults are far past any real project; tests lower them so
+     * a hostile tree hits them in milliseconds. `Client` does not pass these,
+     * so `client.vfs` always has the defaults.
+     */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 declare class VfsNamespace {
     private readonly deps;
@@ -5748,6 +6150,8 @@ declare class VfsNamespace {
      */
     private cache;
     private readonly historyLimit;
+    private readonly maxEntries;
+    private readonly maxPathChars;
     constructor(deps: VfsNamespaceDeps);
     /**
      * The working directory relative paths resolve against.
@@ -5799,14 +6203,46 @@ declare class VfsNamespace {
     stat(path: string): Promise<VfsStat>;
     /** Immediate children of a directory. One record fetch. */
     list(path?: string): Promise<VfsStat[]>;
+    /**
+     * A directory's entries in listing order: directories first, then by name.
+     * Shared by `list` and `walk`, so a walk's output order is exactly the order
+     * of the listings it is made of.
+     */
+    private children;
     private warn;
     /**
      * Every file path under a prefix, depth-first.
      *
      * Deliberately separate from `list`: this walks the whole subtree, which is
      * one fetch per directory. Fine for a project, wrong as a default.
+     *
+     * Throws VfsLimitError past the entry budget or the depth ceiling, and
+     * VfsCorruptRecordError for a directory it cannot read, rather than
+     * returning part of the tree. Skips (with a warning) a directory that is
+     * one of its own ancestors.
      */
     walk(path?: string): Promise<string[]>;
+    /**
+     * Every entry under a prefix - directories as well as files - depth-first,
+     * each directory just before its contents. `walk` is this with the
+     * directories filtered out, so the two can never disagree about what is in
+     * a tree; version control uses this one because a commit records empty
+     * directories too.
+     */
+    walkEntries(path?: string): Promise<VfsStat[]>;
+    /**
+     * `walkEntries` without the list: `visit` is called with each entry in
+     * the same order, and for a file with its manifest - the handle
+     * `statManifest` gives, without resolving the path all over again, which
+     * on a deep tree cost far more than the walk itself. Null for a directory.
+     *
+     * For a caller that does not need every entry at once. Version control
+     * compares the working tree with a commit as it goes, where holding the
+     * whole walk beside the whole commit, and a map of one beside a map of
+     * the other, ran a 512MB heap out of memory inside the default budgets.
+     * The same guards and budgets as `walk`, which is built on this.
+     */
+    eachEntry(path: string, visit: (stat: VfsStat, manifest: FileManifest | null) => void): Promise<void>;
     readFile(path: string): Promise<Uint8Array>;
     readText(path: string): Promise<string>;
     /**
@@ -5852,6 +6288,16 @@ declare class VfsNamespace {
     mkdir(path: string, opts?: {
         recursive?: boolean;
     }): Promise<void>;
+    /**
+     * Refuse now what creating these directories with `mkdir -p` would refuse
+     * part way: one deeper than MAX_DEPTH, or a name on the way held by an
+     * entry this version cannot read. Writes nothing.
+     *
+     * For an operation that removes things before it writes - a checkout -
+     * so that a refusal comes before anything is gone. A FILE in the way is
+     * not refused: such an operation removes those first.
+     */
+    assertCreatable(dirs: Iterable<string>): Promise<void>;
     /**
      * Write a file, creating parent directories as needed.
      *
@@ -5865,10 +6311,10 @@ declare class VfsNamespace {
     /**
      * Delete a file, or a directory when `recursive`.
      *
-     * `keepContent` removes the entry WITHOUT releasing its shards. A checkout
-     * needs that: the file is leaving the working tree, but commits still
-     * reference the same manifest, and releasing would free content history
-     * depends on.
+     * `keepContent` removes the entry WITHOUT releasing its shards - or, for
+     * a directory, the shards of anything in it. A checkout needs that: the
+     * file is leaving the working tree, but commits still reference the same
+     * manifest, and releasing would free content history depends on.
      */
     delete(path: string, opts?: {
         recursive?: boolean;
@@ -5880,9 +6326,21 @@ declare class VfsNamespace {
      *
      * A directory move is O(1) regardless of how much is inside it — the
      * subtree records are not touched at all, because nothing in them records
-     * its own path.
+     * its own path. Except a move to a DEEPER place, which reads the subtree
+     * first: what is below must still be inside MAX_DEPTH once it is moved.
      */
     rename(from: string, to: string): Promise<void>;
+    /**
+     * Refuse to move the directory at `src` to `dst` when something in it
+     * would then be deeper than MAX_DEPTH from the root. Writes nothing.
+     *
+     * Measured only moving deeper, because it reads the whole subtree: one
+     * move of a 40-deep tree under a 30-deep directory was accepted when only
+     * the moved directory was measured, and every walk of the root threw from
+     * then on. A part that cannot be read cannot be measured, and does not
+     * stop the move - that record stops every walk above it already.
+     */
+    private assertFitsAt;
     /**
      * Copy a file or a directory tree.
      *
@@ -5944,25 +6402,158 @@ declare class VfsNamespace {
     /** Open a directory by path, creating nothing. Throws if it is missing. */
     private openDir;
     private openDirOrNull;
+    /** Open a directory by path, along with the id of every directory on the way to it. */
+    private openChain;
+    /**
+     * `path` is only for error messages. The cache is keyed by id, so when two
+     * paths reach one record - a move interrupted between attach and detach -
+     * the error names whichever asked first.
+     */
     private openDirById;
+    /**
+     * Turn a decrypted record into an OpenDir, or throw.
+     *
+     * The record is THROWN on, never read as empty, when its shape is wrong -
+     * see VfsCorruptRecordError. An individual entry of the wrong shape is set
+     * aside in `hidden` instead: out of every read, but kept for the write.
+     */
+    private readRecord;
     /** Apply an edit to a directory record and persist it. */
     private mutate;
     private createDir;
-    /** Recursively remove a subtree's records. Best-effort: unreachable ≠ fatal. */
+    /**
+     * Every directory record in a subtree, each once, opened - and nothing
+     * changed. The first half of a recursive delete; see `delete`.
+     *
+     * Once per id, so a record that references another inside the subtree
+     * cannot recurse forever, and a subtree reachable twice is not released
+     * twice. And never a directory in `above` - the root and everything else
+     * on the way down to the target - nor the root by any route. Deduplicating
+     * alone let an entry naming the root pull the whole filesystem into the
+     * delete, the root record included; a walk shows the same pointer as a
+     * cycle and skips it, so this skips it too.
+     *
+     * `moving` says whether anything in it is marked as half of an
+     * interrupted move, which is what makes a delete look for the other half.
+     */
+    private subtree;
+    /**
+     * Delete these records and let go of every file in them. The second half
+     * of a recursive delete, run only once the subtree is detached. Cannot
+     * throw: every step is best-effort, because unreachable is not fatal.
+     *
+     * With `elsewhere` - what the rest of the tree still names, read because
+     * something here is half of an interrupted move - a record still named
+     * elsewhere is kept, and so is a file.
+     */
     private purge;
+    /**
+     * Unmark what is left of an interrupted move once a delete has removed
+     * the other copy. Marked, a file keeps every version that falls off its
+     * history, because the other copy might hold it - for good, once there
+     * is no other copy - and every delete of the entry, or of a directory
+     * above it, reads the whole tree. Only when exactly one marked copy is
+     * left: more, and they are still shared. Best-effort, like everything
+     * after a detach; failing, it stays marked, which costs only that.
+     */
+    private settle;
+    /**
+     * Let go of files that are leaving the tree: each one's content, every
+     * version its history holds, and the history record. Best-effort, like
+     * everything after a detach.
+     *
+     * A file id still named elsewhere is one file with two names, left by an
+     * interrupted move: its content and history belong to the name that is
+     * staying, and all that changes hands is the key its history opens with.
+     * `keepContent` keeps every file's content and drops only its history
+     * record, as a checkout needs.
+     */
+    private letGo;
+    /**
+     * What the tree still names with one entry left out: every directory
+     * record, and every file id with a directory that holds it. Null when
+     * part of the tree cannot be read or followed, so the answer is unknown.
+     */
+    private namedElsewhere;
+    /**
+     * Everything reachable from the root: every directory record's id and
+     * key, and every file id with a directory that names it - following the
+     * entries hidden only for their name, which still reference what they
+     * point at. `skip` leaves one entry out: one about to be detached.
+     *
+     * Fetches up to WALK_CONCURRENCY records at once, each record once
+     * however often it is named. Throws VfsCorruptRecordError for a record a
+     * path reaches that cannot be read, unless `lenient`. `unknown` counts
+     * what could not be followed at all: an entry this version cannot read,
+     * and a record behind an unusable name that does not open - which no path
+     * can reach, and so no recursive delete can remove - or, `lenient`, any
+     * record that does not open.
+     */
+    private references;
     /**
      * Deep-copy an entry. Files reuse their manifest (no bytes move); each
      * directory gets a fresh id and key, so the copy is independent of the
      * original — writing into one must never appear in the other.
+     *
+     * `at` is the entry's SOURCE path, and `depth` how many directories deep
+     * from the root the copy of it will be. With `run.write` false this is the
+     * dry run: every check, no reference taken and no record stored.
      */
     private cloneEntry;
     /**
-     * Let go of a file's bytes: the current manifest and every retained
-     * version, then the history record itself.
+     * Let go of one file's bytes: its content, every version its history
+     * retains, and the history record itself.
+     *
+     * Each distinct manifest once. `copies` is every entry naming the file -
+     * two after an interrupted move, which may by now hold different
+     * versions - and `restore` puts a version back without taking a second
+     * reference, so its manifest is in the entry and in the history both.
+     * Releasing per mention released one reference twice, and so freed bytes
+     * a copy elsewhere, holding its own reference, still needed.
      */
     private releaseFile;
+    /**
+     * A file's history record, opened with the first of `keys` that opens
+     * it, and that key. Null when there is none, or none of them does.
+     */
+    private openHistory;
+    /**
+     * Seal a file's history with the key of the directory that holds it now.
+     *
+     * A history record is sealed with its directory's key, so a file moved
+     * to another directory carried a history its new directory could not
+     * open: every read of it, and every write to the file, failed from then
+     * on. Nothing to do when there is no history, when it opens with `to`
+     * already, or when none of the keys opens it.
+     */
+    private rekeyHistory;
+    /**
+     * The history of the file `entry` names as `name` in `parent`, and the
+     * key to seal it with from now on.
+     *
+     * A history is sealed with its directory's key - usually. The two halves
+     * of an interrupted move share one history, sealed with ONE of their
+     * directories' keys, and a file moved between directories by a version
+     * before `rename` re-sealed it still has its old directory's. So when the
+     * directory's own key does not open it, every key in the tree is tried,
+     * the other half's first: a read of the whole tree, and only then. It
+     * need not be read in full, or understood - an entry this version cannot
+     * follow may hide a key, but a key that opens the record is proof
+     * enough. Found, it is re-sealed with this directory's key, so the search
+     * is made once - except for half of a move, which keeps the key that
+     * opened it and so keeps working for both halves.
+     *
+     * No record, or a value that is not a sealed record at all, is an empty
+     * history, as it always was. One that no key opens is thrown on, with a
+     * message rather than a bare decryption error: writing an empty history
+     * over it would lose every version it holds.
+     */
     private readHistory;
-    /** Push `entry` onto its history record. Returns the new version count. */
+    /**
+     * Push `entry` onto its history record. Returns the new version count.
+     * `next` is the manifest the entry will hold once the caller has written
+     * it.
+     */
     private pushHistory;
 }
 
@@ -6068,21 +6659,88 @@ interface VcsNamespaceDeps {
     key: () => Promise<Uint8Array>;
     /** Who to record as the author. */
     author: () => string;
+    /**
+     * `entries` is the most tree entries one read of history may visit - one
+     * `status`, `diff` or `checkout` - and `pathChars` the most characters of
+     * path those entries may add up to. The defaults are far past any real
+     * project; tests lower them so a hostile tree hits them in milliseconds.
+     * `Client` does not pass these, so `client.vcs` always has the defaults.
+     */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 declare class Repo {
     private readonly slug;
     private readonly deps;
+    private readonly maxEntries;
+    private readonly maxPathChars;
+    /**
+     * How many directories deep below the project a tree may nest. The
+     * working tree may be written MAX_DEPTH directories below the root, and
+     * the project itself is some of those: a deeper tree would check out into
+     * something no walk will read, and `status` - and every checkout after,
+     * which walks the tree first - would throw from then on.
+     */
+    private readonly maxTreeDepth;
     constructor(slug: string, deps: VcsNamespaceDeps);
     private get root();
     /** Store an object, returning its hash and whether it was new. */
     private put;
+    /** Does this stored record open to an object with this hash? */
+    private holds;
+    /**
+     * Fetch an object, and prove it is the one that was asked for.
+     *
+     * Content addressing is only a guarantee if the address is checked. Without
+     * this a stored object could claim any hash - including its own, so a tree
+     * could contain itself and `status` would follow it for ever. Every object
+     * this repository has ever written verifies: `put` hashes exactly the value
+     * it seals, `canonical` is independent of key order and drops `undefined`
+     * exactly as JSON does, and hashing has never been versioned.
+     */
     private get;
+    /** A commit, checked to be one. See `commitProblem`. */
+    private readCommit;
+    /**
+     * Start a traversal of history: a budget shared by every branch of it, and
+     * a cache of the tree objects it has fetched.
+     *
+     * The cache matters for the same reason the budget does. Identical
+     * subtrees are one object, so a tree of honest-but-hostile shape is a
+     * handful of fetches and a vast number of paths; caching keeps it to the
+     * handful, and the budget stops the paths. It caches OBJECTS, never output
+     * - each name a shared subtree appears at is still listed.
+     */
+    private treeWalk;
+    /**
+     * A tree object's entries, checked and ready to walk.
+     *
+     * Returned in a null-prototype map, so a name like `constructor` is looked
+     * up as an entry and not found as an inherited property.
+     */
+    private readTree;
+    /**
+     * A record that is not an object - HEAD, a branch ref, the branch list,
+     * MERGE - opened. Null when there is none; `problem` when there is one
+     * that does not open. What is inside is the caller's to check.
+     */
+    private openRecord;
     private head;
     private setHead;
     private readRef;
+    /** A branch's commit, null when there is no such branch, or "unreadable". */
+    private refState;
     private writeRef;
     /** Every branch name in this repository. */
     branches(): Promise<string[]>;
+    /**
+     * The branch list, less any name a branch could not have been created
+     * with - left out with a warning, like an unreadable entry in a tree, so
+     * one planted name does not hide every real one.
+     */
+    private readIndex;
     /** The commit HEAD resolves to, or null in an empty repository. */
     current(): Promise<string | null>;
     /**
@@ -6100,7 +6758,27 @@ declare class Repo {
         theirs: string;
         name: string;
     } | null>;
-    /** Write a directory and everything under it, returning the tree's hash. */
+    /**
+     * Give up on a merge that stopped for conflicts: the next commit is an
+     * ordinary one, with one parent. The working tree is left as it is,
+     * conflict markers and all. To put it back, switch to the current branch
+     * with `discardChanges` — not `checkout`, which always leaves HEAD
+     * detached, so later commits would stop moving the branch.
+     *
+     * Also the way out when the record of the merge cannot be read, which
+     * would otherwise stop every commit.
+     */
+    abortMerge(): Promise<void>;
+    /**
+     * Write a directory and everything under it, returning the tree's hash.
+     *
+     * Reads the working tree through ONE `walkEntries`, rather than listing
+     * each directory by path and recursing. The recursion had no guard at all:
+     * a directory record that names itself - which anything holding the seed
+     * can plant - sent `commit` down /loop/loop/loop/... for ever. The walk has
+     * the cycle guard, the budget and the depth ceiling, so a commit records
+     * exactly the tree `status` compares it against.
+     */
     private writeTree;
     /** Commits reachable from HEAD, newest first. */
     log(limit?: number): Promise<LogEntry[]>;
@@ -6128,8 +6806,6 @@ declare class Repo {
      * trees for states nobody chose to keep.
      */
     status(): Promise<Change[]>;
-    /** The working tree as a path → entry map, mirroring `filesOf`. */
-    private workingFiles;
     /**
      * Turn what a person typed into a commit hash.
      *
@@ -6221,6 +6897,11 @@ interface VcsNamespaceOptions {
     /** The in-memory master seed, or null when locked. Read per call. */
     seed: () => Uint8Array | null;
     author: () => string;
+    /** See `VcsNamespaceDeps.limits`. */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
@@ -6317,205 +6998,56 @@ declare class Client {
     /** Per-user key/value storage — `client.kv.set(...)`, etc. */
     readonly kv: KvNamespace;
     /** App scalable database — `client.db.table('todos').query(...)`, etc. */
-    readonly db: DbNamespace;
-    /** File storage — `client.storage.writeFile(...)`, etc. */
-    readonly storage: StorageNamespace;
-    /** Filesystem over the personal space: directories, versions, real paths. */
-    readonly vfs: VfsNamespace;
-    /** Version control over the VFS: commits, branches, merges — per project. */
-    readonly vcs: VcsNamespace;
-    /** Realtime messaging — `client.message.subscribe(...)`, etc. */
-    readonly message: MessageNamespace;
-    /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
-    readonly space: SpaceNamespace;
-    /** Programmable Agents — `client.agents.create(appId, …)`, etc. */
-    readonly agents: AgentsNamespace;
-    /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
-    readonly functions: FunctionsNamespace;
-    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
-    readonly accessTokens: AccessTokensNamespace;
-    /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
-    readonly offline: OfflineManager;
-    private readonly session;
-    private readonly http;
-    /** Subscribers notified when a session expires and can't be recovered. */
-    private readonly sessionExpiredHandlers;
-    /** Shared in-flight recovery so a burst of 401s triggers one re-auth. */
-    private recoverInFlight;
-    constructor(options?: ClientOptions);
-    /** The currently signed-in user, or `null`. */
-    get user(): AuthUser | null;
-    /** Whether a token-bearing session is active. */
-    get isAuthenticated(): boolean;
-    /**
-     * Subscribe to session expiry that couldn't be silently recovered (the
-     * user's identity wasn't in memory to re-prove — typically after a reload
-     * where only the token was persisted, and that token has since gone stale).
-     * This is the signal to send the user back to the login screen.
-     *
-     * Returns an unsubscribe function.
-     *
-     *   const off = client.onSessionExpired(() => router.push('/login'));
-     */
-    onSessionExpired(handler: () => void): () => void;
-    /**
-     * Attempt a silent re-auth of the current user. Concurrent callers share a
-     * single in-flight attempt (a stale token usually 401s several requests at
-     * once — we re-auth once, not once per request). On failure the
-     * session-expired event fires so the app can react. Exposed so apps can
-     * also drive recovery proactively (e.g. on `visibilitychange`).
-     */
-    recoverSession(): Promise<boolean>;
-}
-
-/**
- * `deviceStore` — at-rest persistence for a paired device (the TV).
- *
- * A device that has completed {@link HostedAuth.startDevicePairing} holds the
- * account's **master seed**. Android WebView has no WebAuthn, so the passkey
- * wrapping used elsewhere isn't available, and re-pairing on every cold start
- * is not acceptable UX for a set-top box. So the seed is persisted, encrypted:
- *
- * | Item                     | Where                                | Form |
- * | ------------------------ | ------------------------------------ | ---- |
- * | wrapping key             | IndexedDB (`muhkoo.device.v1`)       | `CryptoKey`, AES-GCM-256, **non-extractable** |
- * | device identity keypair  | IndexedDB (`muhkoo.device.v1`)       | `CryptoKeyPair`, ECDSA P-256, private half **non-extractable** |
- * | sealed identity blob     | localStorage `muhkoo.tv.identity.v1` | `{"v":1,"iv":…,"ct":…}` over `JSON{username, commitment, seed(b64), pairedAt}` |
- *
- * The split is deliberate — ciphertext in one backend, key in another, and the
- * key non-extractable so JS can *use* it but not export it.
- *
- * ## Be honest about what this is worth
- *
- * **This is obfuscation, not protection.** It raises the cost of a casual
- * `localStorage` dump to "nothing useful", and that is all:
- *
- *   - **XSS on the device origin** cannot *exfiltrate* the wrapping key (it is
- *     non-extractable) but can absolutely call `decrypt` and read the seed. The
- *     only mitigation is that there is no third-party script in the shell —
- *     enforce a strict CSP with no `unsafe-inline`, no CDN, no remote fonts.
- *   - **ADB / root / a backup extraction / a forensic image recovers the seed.**
- *     The IndexedDB LevelDB files hold the AES key bytes in the clear; WebCrypto
- *     "non-extractable" is a JS-API boundary, not an OS one. **A stolen device is
- *     a stolen identity.**
- *
- * That is not an implementation shortcut, it is the shape of the problem: any
- * wrapping key usable without user interaction lives somewhere equally readable
- * on a keyboard-less device with no hardware key store exposed to WebView.
- * Reduce the blast radius with `android:allowBackup="false"`,
- * `android:debuggable="false"`, a strict CSP, and by storing *only* the 32-byte
- * seed + username + commitment (never a session token, never a recovery phrase).
- *
- * ## Documented upgrade path — no protocol change
- *
- * If the native shell exposes a Keystore bridge:
- *
- * ```java
- * @JavascriptInterface public String wrap(String b64plain);    // AES-GCM, StrongBox when present
- * @JavascriptInterface public String unwrap(String b64cipher);
- * ```
- *
- * this module prefers `globalThis.MuhkooKeystore` automatically and falls back
- * to the WebCrypto scheme otherwise. The Keystore key is hardware-backed and
- * non-exportable at the OS level, so a copied filesystem image alone becomes
- * useless. Nothing on the wire, in the endpoint contracts, or in the SDK surface
- * changes — only the two functions below do, internally.
- *
- * ## Degradation
- *
- * Nothing here throws at import time. On a runtime with neither backend (SSR,
- * Workers, Node) the module still loads: {@link loadDeviceIdentity} returns
- * `null`, {@link persistDeviceIdentity} throws a typed
- * {@link DeviceStoreUnavailableError} the caller can swallow, and
- * {@link deviceIdentityKey} falls back to an **in-memory** keypair for the
- * lifetime of the process (so pairing still works; the device is just never
- * recognised as "known" on a later run).
- */
-/** localStorage key holding the AES-GCM-sealed identity blob. */
-declare const DEVICE_IDENTITY_STORAGE_KEY = "muhkoo.tv.identity.v1";
-/** IndexedDB database holding the non-extractable keys. */
-declare const DEVICE_KEY_DB_NAME = "muhkoo.device.v1";
-/** What a paired device persists. The seed **is** the identity — treat it as such. */
-interface PersistedDeviceIdentity {
-    username: string;
-    /** Decimal-string Poseidon commitment. Pinned: a later pairing that yields a
-     *  different commitment for this device must be refused, not adopted. */
-    commitment: string;
-    /** The 32-byte master seed. */
-    seed: Uint8Array;
-    pairedAt: number;
-}
-/** Thrown when persistence is impossible (no IndexedDB and/or no localStorage). */
-declare class DeviceStoreUnavailableError extends Error {
-    constructor(what: string);
-}
-/** Key/value store for live `CryptoKey` objects (IndexedDB in the browser). */
-interface DeviceKeyVault {
-    get(id: string): Promise<unknown | null>;
-    put(id: string, value: unknown): Promise<void>;
-    /** Delete the entire store — used by `clearDeviceIdentity`. */
-    destroy(): Promise<void>;
-}
-/** String store for the sealed blob (localStorage in the browser). */
-interface DeviceBlobStore {
-    get(key: string): string | null;
-    set(key: string, value: string): void;
-    remove(key: string): void;
-}
-/** The native Keystore bridge, when the shell provides one (see module docs). */
-interface MuhkooKeystoreBridge {
-    wrap(b64plain: string): string | Promise<string>;
-    unwrap(b64cipher: string): string | Promise<string>;
+    readonly db: DbNamespace;
+    /** File storage — `client.storage.writeFile(...)`, etc. */
+    readonly storage: StorageNamespace;
+    /** Filesystem over the personal space: directories, versions, real paths. */
+    readonly vfs: VfsNamespace;
+    /** Version control over the VFS: commits, branches, merges — per project. */
+    readonly vcs: VcsNamespace;
+    /** Realtime messaging — `client.message.subscribe(...)`, etc. */
+    readonly message: MessageNamespace;
+    /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
+    readonly space: SpaceNamespace;
+    /** Programmable Agents — `client.agents.create(appId, …)`, etc. */
+    readonly agents: AgentsNamespace;
+    /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
+    readonly functions: FunctionsNamespace;
+    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
+    readonly accessTokens: AccessTokensNamespace;
+    /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
+    readonly offline: OfflineManager;
+    private readonly session;
+    private readonly http;
+    /** Subscribers notified when a session expires and can't be recovered. */
+    private readonly sessionExpiredHandlers;
+    /** Shared in-flight recovery so a burst of 401s triggers one re-auth. */
+    private recoverInFlight;
+    constructor(options?: ClientOptions);
+    /** The currently signed-in user, or `null`. */
+    get user(): AuthUser | null;
+    /** Whether a token-bearing session is active. */
+    get isAuthenticated(): boolean;
+    /**
+     * Subscribe to session expiry that couldn't be silently recovered (the
+     * user's identity wasn't in memory to re-prove — typically after a reload
+     * where only the token was persisted, and that token has since gone stale).
+     * This is the signal to send the user back to the login screen.
+     *
+     * Returns an unsubscribe function.
+     *
+     *   const off = client.onSessionExpired(() => router.push('/login'));
+     */
+    onSessionExpired(handler: () => void): () => void;
+    /**
+     * Attempt a silent re-auth of the current user. Concurrent callers share a
+     * single in-flight attempt (a stale token usually 401s several requests at
+     * once — we re-auth once, not once per request). On failure the
+     * session-expired event fires so the app can react. Exposed so apps can
+     * also drive recovery proactively (e.g. on `visibilitychange`).
+     */
+    recoverSession(): Promise<boolean>;
 }
-/**
- * Point the store at explicit backends (or `null` to force "unavailable"), and
- * reset the memoized device keypair. Testing / embedding seam — pass `{}` to
- * restore the default browser backends.
- */
-declare function configureDeviceStore(opts?: {
-    keys?: DeviceKeyVault | null;
-    blobs?: DeviceBlobStore | null;
-    keystore?: MuhkooKeystoreBridge | null;
-}): void;
-/**
- * True when {@link deviceIdentityKey} had to fall back to an in-memory keypair
- * because no key vault was available. Such a device can pair, but will never be
- * recognised as "known" afterwards (so approval always needs a fresh factor).
- */
-declare function deviceIdentityIsEphemeral(): boolean;
-/**
- * The device's **persistent** ECDSA P-256 identity keypair, created on first
- * call. This is not a browser fingerprint — it is a key, and every
- * `POST /api/auth/device/code` proves possession of it. Without that proof,
- * "known device" would be an unauthenticated string anyone could claim in order
- * to skip the approver's re-authentication.
- *
- * The private half is non-extractable and never leaves IndexedDB as bytes.
- */
-declare function deviceIdentityKey(): Promise<CryptoKeyPair>;
-/** `base64url(SHA-256(raw SEC1 device identity public key))` — 43 chars. */
-declare function deviceFingerprint(): Promise<string>;
-/** Whether a sealed identity blob exists. Cheap: no crypto, no IndexedDB, no network. */
-declare function hasDeviceIdentity(): Promise<boolean>;
-/**
- * Seal and store the identity. Throws {@link DeviceStoreUnavailableError} when
- * there is nowhere to put it — callers should treat that as "this device won't
- * resume", not as a pairing failure.
- */
-declare function persistDeviceIdentity(v: PersistedDeviceIdentity): Promise<void>;
-/**
- * Recover the persisted identity, or `null` when there is none / it can't be
- * opened (wiped IndexedDB, a different browser profile, a corrupted blob).
- * Never throws — a cold start with unreadable storage must fall back to a fresh
- * pairing, not to an error screen.
- */
-declare function loadDeviceIdentity(): Promise<PersistedDeviceIdentity | null>;
-/**
- * Wipe everything: the sealed blob **and** the whole key database — so the
- * wrapping key never outlives the ciphertext it opens, and the device identity
- * key is regenerated (a re-pair is then correctly treated as a new device).
- */
-declare function clearDeviceIdentity(): Promise<void>;
 
 /**
  * Three-way line merge.
@@ -6558,92 +7090,6 @@ declare function merge3Text(base: string, ours: string, theirs: string, labels?:
     conflicted: boolean;
 };
 
-/**
- * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
- *
- * A passkey becomes a device-bound, platform-synced source of a stable secret:
- * for a fixed salt, the authenticator's PRF returns the same 32 bytes, which we
- * HKDF into an AES key that wraps the master seed. The server never sees the
- * passkey — it's purely a local key source; the ZK proof remains the server auth.
- *
- * BROWSER ONLY (`navigator.credentials`). The PRF extension fields aren't in the
- * standard DOM types yet, so they're reached through narrow casts.
- */
-/** Whether this environment can do WebAuthn at all. (PRF support is checked at enroll.) */
-declare function passkeySupported(): boolean;
-/**
- * Whether this browser's authenticator can do the **PRF extension** our passkey
- * factor needs. A browser can save passkeys (e.g. for password autofill) yet not
- * expose PRF — PRF is what derives the stable secret we wrap the seed under, so a
- * passkey without it is useless to us.
- *
- * Uses `PublicKeyCredential.getClientCapabilities()` (the `extension:prf` cap)
- * where available. Returns:
- *   - `true`  — PRF is supported,
- *   - `false` — definitively NOT supported (hide the option),
- *   - `null`  — couldn't determine (older browser without the capabilities API);
- *              the caller may optimistically allow and let enroll surface a real
- *              error if it turns out PRF isn't there.
- */
-declare function passkeyPrfCapable(): Promise<boolean | null>;
-/** Best-effort registrable RP id — the host. Apps spanning subdomains should pass
- *  the parent domain (e.g. "muhkoo.dev") explicitly. */
-declare function defaultRpId(): string;
-/**
- * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
- *
- * WebAuthn only accepts an RP id that is the origin's own host or a registrable
- * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
- * `app.example.net`, and one enrolled on a full host is unusable from a sibling
- * host. An app served on BOTH a custom domain and the platform host therefore
- * needs one passkey per origin.
- *
- * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
- * a raw "The requested RPID did not match the origin or related origins", which
- * is a dead end for the user. Checking first lets the caller fall back to normal
- * sign-in (and offer to enroll a passkey for this origin) instead.
- */
-declare function rpIdUsableForOrigin(rpId: string | undefined | null, host?: string): boolean;
-/**
- * Would {@link AuthNamespace.loginWithPasskey} accept a factor recorded with
- * this `rpId`, from `host`?
- *
- * This is deliberately NOT the same as {@link rpIdUsableForOrigin}. That answers
- * a raw WebAuthn question and is `false` for a missing rpId. But a factor with
- * NO recorded rpId predates per-origin enrolment, and `loginWithPasskey`
- * resolves it as `params.rpId ?? host` — so it IS usable, from anywhere.
- *
- * Callers deciding "should I even try a passkey here?" must use this one.
- * Reaching for `rpIdUsableForOrigin` instead silently excludes every legacy
- * passkey holder, which has locked real users out of production twice.
- *
- * The `?? host` fallback applies to nullish only, matching `loginWithPasskey`:
- * an empty-string rpId stays unusable rather than resolving to the host.
- */
-declare function passkeyUsableFromOrigin(rpId: string | undefined | null, host?: string): boolean;
-/** Thrown when the account's passkey belongs to a different origin. Callers
- *  should treat this as "no passkey here" and fall back to another factor. */
-declare class PasskeyOriginError extends Error {
-    readonly code = "passkey_wrong_origin";
-    constructor(message?: string);
-}
-interface PasskeyEnrollment {
-    credentialId: Uint8Array;
-    prfSalt: Uint8Array;
-    prfOutput: Uint8Array;
-}
-/**
- * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
- * the PRF output for that salt. Throws if the authenticator can't do PRF.
- */
-declare function createPasskeyWithPrf(opts: {
-    rpId: string;
-    rpName: string;
-    username: string;
-}): Promise<PasskeyEnrollment>;
-/** Evaluate a passkey's PRF for `salt` → 32 bytes. Used at recover/login. */
-declare function evaluatePasskeyPrf(rpId: string, credentialId: Uint8Array, salt: Uint8Array): Promise<Uint8Array>;
-
 /**
  * Muhkoo app decorators — declare your app's agent-facing surface in code, then
  * "eject" a system prompt you hand to a Programmable Agent.
@@ -7548,5 +7994,271 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, ReauthRequiredError, ReedSolomonCodec, Repo, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, generateAuthProof, generateDevicePairingKeypair, generatePkce, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbQueryPage, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+declare class Logger {
+    private prefix;
+    private logLevel;
+    private console;
+    private showCaller;
+    level: string;
+    constructor(prefix?: string, LOGLEVEL?: string, showCaller?: boolean);
+    private shouldLog;
+    /**
+     * Extract caller information from stack trace
+     */
+    private getCallerInfo;
+    /**
+     * Format caller info for display
+     */
+    private formatCallerInfo;
+    setLevel(level: string): void;
+    setShowCaller(show: boolean): void;
+    info(...args: any[]): void;
+    log(...args: any[]): void;
+    verbose(...args: any[]): void;
+    success(...args: any[]): void;
+    warn(...args: any[]): void;
+    error(...args: any[]): void;
+    debug(...args: any[]): void;
+    assert(condition?: boolean, ...data: any[]): void;
+    clear(): void;
+    count(label?: string): void;
+    countReset(label?: string): void;
+    dir(item?: any, options?: any): void;
+    dirxml(...data: any[]): void;
+    group(...data: any[]): void;
+    groupCollapsed(...data: any[]): void;
+    groupEnd(): void;
+    table(tabularData?: any, properties?: string[]): void;
+    time(label?: string): void;
+    timeEnd(label?: string): void;
+    timeLog(label?: string, ...data: any[]): void;
+    trace(...data: any[]): void;
+    profile(label?: string): void;
+    profileEnd(label?: string): void;
+    timeStamp(label?: string): void;
+}
+
+declare const log: Logger;
+
+declare global {
+    interface Console {
+        success(...args: any[]): void;
+        verbose(...args: any[]): void;
+    }
+}
+
+/**
+ * Byte conversion helpers usable in both Node and the browser.
+ *
+ * Replaces Node's `Buffer` API for the small set of operations we actually
+ * need in the crypto layer: hex/base64/base64url encode + decode, and array
+ * concatenation. Lets `DoubleRatchet`, `KeyStore`, etc. compile against
+ * platforms without `Buffer` (browsers, CF Workers).
+ */
+/** Encode a byte array as a lowercase hex string. */
+declare function toHex(bytes: Uint8Array): string;
+/** Decode a hex string into a byte array. Accepts upper/lowercase; rejects odd-length input. */
+declare function fromHex(hex: string): Uint8Array<ArrayBuffer>;
+/** Encode a byte array as a standard base64 string. */
+declare function toBase64(bytes: Uint8Array): string;
+/** Decode a standard base64 string to bytes. */
+declare function fromBase64(b64: string): Uint8Array<ArrayBuffer>;
+/** Encode a byte array as a base64url string (no padding). */
+declare function toBase64Url(bytes: Uint8Array): string;
+/** Decode a base64url string (with or without padding) to bytes. */
+declare function fromBase64Url(b64url: string): Uint8Array<ArrayBuffer>;
+/** Concatenate any number of byte arrays into a single Uint8Array. */
+declare function concatBytes(...arrays: (Uint8Array | ArrayBuffer)[]): Uint8Array<ArrayBuffer>;
+/** Encode a UTF-8 string as bytes. Thin wrapper around TextEncoder for symmetry. */
+declare function utf8Encode(s: string): Uint8Array<ArrayBuffer>;
+/** Decode UTF-8 bytes to a string. */
+declare function utf8Decode(bytes: Uint8Array): string;
+
+/**
+ * @public
+ * @remarks Asserts the basic type of a variable
+ * @param value - The value to check
+ * @param type - The expected type
+ *
+ * @throws Error - If the type of the value does not match the expected type
+ *
+ */
+declare function assertType<T>(value: unknown, typeOrConstructors: string | (new (...args: any[]) => any) | (new (...args: any[]) => any)[]): asserts value is T;
+/**
+ * @public
+ * @remarks Encodes a string to Base58
+ * @param input - the data to encode, must be a cloneable object
+ * @returns string
+ */
+declare function base58Encode(input: ArrayBuffer | string): string;
+/**
+ * @public
+ * @remarks Decodes a Base58 string to a Uint8Array
+ * @param input - the Base58 string to decode
+ * @returns Uint8Array
+ */
+declare function base58Decode(input: string): ArrayBuffer;
+/**
+ * @public
+ * @remarks Generates a checksum for a given input
+ * @param input - The input to generate a checksum for as a string
+ * @returns string
+ */
+declare function generateChecksum(input: string): string;
+/**
+ * @public
+ * @remarks Verifies a checksum for a given input
+ * @param input - The input to verify as a string
+ * @param checksum - The checksum to verify as a string
+ * @returns boolean
+ */
+declare function verifyChecksum(input: string, checksum: string): boolean;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a given packet
+ * @returns string
+ */
+declare function _packetId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a given object
+ * @returns string
+ *
+ */
+declare function _objectId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a given user
+ * @returns string
+ *
+ */
+declare function _userId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a given account
+ * @returns string
+ *
+ */
+declare function _accountId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a socket
+ * @returns string
+ *
+ */
+declare function _socketId(): string;
+/**
+ * @internal
+ * @remarks Generates a random UUID for a message
+ * @returns string
+ */
+declare function _messageId(): string;
+/**
+ * @public
+ * @remarks Generates a random UUID and base58 encodes it
+ * @returns string
+ */
+declare function generateId(): string;
+/**
+ * @public
+ * @remarks Serializes data to a base58 encoded string
+ * @param data - The data to serialize
+ * @typeParam T - The type of the data to serialize
+ * @returns base58 encoded string
+ */
+declare function serialize<T>(data: T): string;
+/**
+ * @public
+ * @remarks Deserializes a base58 encoded string to data
+ * @param base58String - The base58 encoded string to deserialize
+ * @returns Deserialized data
+ */
+declare function deserialize<T>(base58String: string): T;
+/**
+ * @public
+ * @remarks Retries a method a specified number of times with a delay between each attempt, this is a decorator
+ * @param retries - The number of times to retry the method
+ * @param delay - The delay in milliseconds between each attempt
+ */
+declare function Retry(retries?: number, delay?: number): MethodDecorator;
+/**
+ * @public
+ * @remarks Waits for a class property to be ready before executing a method, this is a decorator.
+ * @param readyPropertyName - The class property to check for readiness
+ */
+declare function Ready(readyPropertyName?: string): MethodDecorator | PropertyDecorator;
+/**
+ * Converts bytes into a more human-friendly format (e.g., KB, MB, GB).
+ * @internal
+ * @param bytes - The number of bytes to convert.
+ * @param decimals - The number of decimals to display (default is 2).
+ * @returns A formatted string representing the size in appropriate units.
+ */
+declare function _formatBytes(bytes: number, decimals?: number): string;
+/**
+ * Retrieves the IP address(es) for a given hostname using Cloudflare's DNS-over-HTTPS service.
+ *
+ * This function queries the Cloudflare DNS API to resolve the provided hostname to its corresponding
+ * IPv4 address(es) (A records). It returns an array of IP addresses or logs an error if the resolution fails.
+ *
+ * @param hostname - The hostname to resolve (e.g., "example.com").
+ * @returns A promise that resolves to an array of IP addresses (strings) associated with the hostname.
+ *          If no IP addresses are found or an error occurs, an empty array or undefined may be returned.
+ * @throws Error If the DNS query fails due to a network error or invalid response from the server.
+ * @public
+ * @example
+ * ```typescript
+ * import { log } from '@muhkoo/connect/utilities';
+ * getIPAddress("example.com").then(ips => log.debug(ips));
+ * // Output: ["93.184.216.34"]
+ * ```
+ */
+declare function getIPAddress(hostname: string): Promise<any>;
+declare function isNumber(value: string | number): boolean;
+declare function getId(row: {
+    insertId?: number;
+    id?: number;
+}): number;
+
+/**
+ * SDK build version — stamped to the console when a {@link Client} is created.
+ *
+ * During active development, bump the `-alpha.N` suffix whenever we ship a build
+ * so we can confirm in the browser console that the page is running the build we
+ * expect (and isn't serving a stale cached bundle). Keep this in sync with
+ * `package.json` `version`.
+ */
+declare const VERSION = "0.14.0-alpha.9";
+
+/**
+ * The SDK's process-global logger.
+ *
+ * Eight modules under `src/` read a bare `appLogger` off `globalThis` rather
+ * than importing one (`src/crypto/{KeyStore,DoubleRatchet,DoubleRatchetManager,
+ * Authenticator}.ts`, `src/core/Client.ts`,
+ * `src/core/namespaces/HostedAuth.ts`, `src/events/EventCore.ts`), so the
+ * binding has to exist before any of them runs, and the `declare global` below
+ * is what makes that typecheck.
+ *
+ * This module is the single place that bootstrap happens. It previously lived
+ * inline in three entry files — `src/browser/index.ts`, `src/workers/index.ts`,
+ * and `src/core/index.ts` (which `src/server/index.ts` picked up as an import
+ * side effect) — three copies that could drift.
+ *
+ * `??=` makes it idempotent, so importing it from several entries in one
+ * process is safe and the first writer wins.
+ *
+ * KNOWN HAZARD: package.json declares `"sideEffects": false`, which entitles a
+ * tree-shaker to drop a module imported purely for effect. The entries import
+ * this one for its `export`s as well, so it survives today — but the durable
+ * fix is to convert those eight bare reads into real imports of `appLogger`
+ * from here, which removes the reliance on a global entirely.
+ */
+
+declare global {
+    var appLogger: InstanceType<typeof Logger>;
+}
+declare const appLogger: InstanceType<typeof Logger>;
+
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };