@muhkoo/connect 0.14.0-alpha.8 → 0.15.0-alpha.0

package/dist/connect.d.ts

@@ -160,14 +160,14 @@ type Permission = 'read' | 'write' | 'delete' | 'admin' | 'share' | 'invite';
 /**
  * Role types
  */
-type Role = 'owner' | 'admin' | 'editor' | 'viewer' | 'member';
+type Role$1 = 'owner' | 'admin' | 'editor' | 'viewer' | 'member';
 /**
  * ACL Entry - grants permissions to a user (identified by public key)
  */
 interface ACLEntry {
     subject: string;
     permissions: Permission[];
-    role?: Role;
+    role?: Role$1;
     expiresAt?: number;
     conditions?: {
         ipAllowlist?: string[];
@@ -194,7 +194,7 @@ interface ACL {
  */
 interface Participant {
     publicKey: string;
-    role: Role;
+    role: Role$1;
     addedAt: number;
     addedBy: string;
     customPermissions?: Permission[];
@@ -434,20 +434,51 @@ interface DehydratedKeys {
     ecdsaPub: string;
     ecdsaPriv: string;
 }
+/** A member's own ECDH and ECDSA pairs, held outside the store until {@link KeyStore.replaceOwnKeyPair}. */
+interface OwnKeyPair {
+    ecdh: KeyPair;
+    ecdsa: AuthKeyPair;
+}
 declare class KeyStore {
     private static instance;
     private _keys;
     private _authKeys;
+    /** The exact pairs marked vault-backed, so a pair written over them later is never taken for them. */
+    private _vaultBacked;
     private constructor();
     static getInstance(): KeyStore;
     get keys(): Map<string, KeyPair>;
     get authKeys(): Map<string, AuthKeyPair>;
     generateOwnKeyPair(id: string): Promise<KeyPair>;
     storeRemotePublicKeys(id: string, ecdhPublicKey: CryptoKey, ecdsaPublicKey: CryptoKey): Promise<void>;
+    /** Generate an own pair without touching the store; {@link replaceOwnKeyPair} puts it in place. */
+    generateKeyPair(): Promise<OwnKeyPair>;
     hydrateKeyPair(id: string, dehydrated: DehydratedKeys): Promise<void>;
+    /** Import a dehydrated pair without touching the store; {@link replaceOwnKeyPair} puts it in place. */
+    importKeyPair(dehydrated: DehydratedKeys): Promise<OwnKeyPair>;
     getKeyPair(id: string): KeyPair | null;
     getAuthKeyPair(id: string): AuthKeyPair | null;
+    /** Record that the pair `id` holds now came from the seed-wrapped vault (ChatKeyVault). */
+    markVaultBacked(id: string): void;
+    /**
+     * Put `pair` in place as `id`'s own pair and mark it vault-backed, in one
+     * synchronous step: whatever `id` held before is dropped, so a pair minted
+     * while the vault pair was being fetched or generated is never kept and
+     * marked in its place (design §3.3).
+     */
+    replaceOwnKeyPair(id: string, pair: OwnKeyPair): void;
+    /**
+     * Whether `id`'s own pair was loaded from, or persisted to, the vault in this
+     * tab, and is still the very pair that was marked. A Space identity must be
+     * vault-backed (design §3.3): any other pair, such as one minted by a locked
+     * DM subscription, never takes part, even one that lands over the marked pair.
+     */
+    isVaultBacked(id: string): boolean;
+    /** Drop every key held for `id` (SpecA §6.4 `KeyStore.forget`). */
+    forget(id: string): void;
     dehydrateKeyPair(id: string): Promise<DehydratedKeys>;
+    /** Dehydrate a pair that is not (yet) in the store, in the same format as {@link dehydrateKeyPair}. */
+    exportKeyPair(pair: OwnKeyPair): Promise<DehydratedKeys>;
     getRawEcdsaPublicKey(id: string): Promise<Uint8Array | null>;
     packDehydratedKeys(id: string): Promise<string>;
     hydrateFromPacked(id: string, masterKey: string): Promise<void>;
@@ -522,7 +553,6 @@ declare class DoubleRatchet {
     private sessionType;
     private maxSkip;
     private overlapPeriod;
-    private windowSize;
     constructor(senderId: string, recipientId: string, sessionType: 'global' | 'specific', isClient?: boolean);
     private hkdf;
     initializeSession(isClient?: boolean): Promise<void>;
@@ -885,6 +915,8 @@ interface WSTransportOptions {
      * auto-response. Default `"pong"`.
      */
     pongFrame?: string;
+    /** A close with one of these codes is terminal: no reconnect, `DISCONNECTED` carries `{code, reason}`; `resume()` restarts. */
+    terminalCloseCodes?: number[];
 }
 declare class WSTransport extends EventCore {
     /**
@@ -917,11 +949,14 @@ declare class WSTransport extends EventCore {
     private pongFrame;
     private heartbeatTimer;
     private pongTimer;
+    private readonly terminalCloseCodes;
     constructor(opts: WSTransportOptions);
     /** Open the socket. Resolves when CONNECTED fires. Rejects on first error. */
     connect(): Promise<void>;
     /** Close the socket and stop reconnecting. */
     disconnect(): void;
+    /** Restart reconnecting after a terminal close or `disconnect()`; the next URL comes from `urlProvider`. */
+    resume(): void;
     /**
      * Send a raw frame. If currently disconnected, the frame is queued and sent
      * after the next successful reconnect (up to `maxQueueSize`).
@@ -1035,6 +1070,8 @@ declare class BroadcastChannel {
     connect(): Promise<void>;
     /** Close the WebSocket and stop reconnecting. */
     disconnect(): void;
+    /** Reconnect after a terminal close (see `terminalCloseCodes`) or `disconnect()`, on a fresh `urlProvider` URL. */
+    resume(): void;
     /**
      * Send our `keyExchange` frame to the room. Idempotent — only sends on the
      * first call. Call this once your higher-level handshake (e.g. sending a
@@ -1214,6 +1251,68 @@ declare class DoubleRatchetManager {
     private loadState;
 }
 
+/**
+ * OPRF (Oblivious PRF) — RFC 9497, ristretto255-SHA512, mode 0x00.
+ *
+ * Used to gate the password/recovery factors of the identity vault
+ * ({@link ./vault}). The wrap key for a password factor is
+ * `HKDF(OPRF(serverKey, scrypt(password)))`, so:
+ *   - the client cannot derive the wrap key offline (it needs the server's
+ *     secret-keyed evaluation), and
+ *   - the server learns nothing — it only ever sees a *blinded* group element,
+ *     never the password or the resulting key.
+ *
+ * Net effect: a stolen vault blob is NOT offline-crackable; every guess costs a
+ * round-trip to a rate-limited server endpoint. The same OPRF backs the M2
+ * Google/email factors.
+ *
+ * Thin wrapper over `@noble/curves`' vetted `ristretto255_oprf` so the protocol
+ * (blind / blindEvaluate / finalize) lives in one named place. CLIENT uses
+ * {@link oprfBlind} + {@link oprfFinalize}.
+ *
+ * The `oprfDeriveKey` / `oprfBlindEvaluate` helpers here are the SERVER half,
+ * but note they are used only by this repo's tests. The accelerator does NOT
+ * import them: it has an independent implementation in its own
+ * `src/services/oprf.ts`, also built directly on `@noble/curves`. (An earlier
+ * version of this comment claimed the accelerator's VaultDO imported them; it
+ * does not — it imports `@muhkoo/connect` in exactly two files, both for
+ * Groth16 verification.) Any protocol change therefore has to land in BOTH
+ * repos in lockstep.
+ *
+ * KNOWN WEAKNESS — mode 0x00, tracked as audit finding C4 and NOT fixed here.
+ * This uses RFC 9497 base mode: the server returns a bare evaluation with no
+ * DLEQ proof, and {@link oprfFinalize} verifies nothing. A hostile server can
+ * answer `{evaluated: blinded}` (i.e. k=1); the unblinded point is then just
+ * `H(input)` and the wrap key collapses to a pure function of public strings,
+ * destroying the offline-uncrackability guarantee stated above.
+ *
+ * The fix is `ristretto255_oprf.voprf` (mode 0x01) with the server's public key
+ * pinned as a build-time constant and the proof verified on every finalize.
+ * noble's `voprf` variant is already present and unused. It cannot be done
+ * client-side alone: the wire response (`{evaluated}` / `{evaluated, evaluated2}`)
+ * carries no proof field, and the pinned public keys must correspond to the
+ * accelerator's actual K1/K2 secrets. Changing only this file would break login
+ * against the live server.
+ */
+/**
+ * The RFC 9497 mode this client speaks, declared on every evaluation request.
+ *
+ * Declaring it is what lets the server refuse loudly instead of answering in a
+ * mode we did not ask for — the silent substitution that IS audit finding C4.
+ * A server too old to know the field drops it and answers in base mode, which is
+ * what we asked for anyway, so sending it is safe in both directions and imposes
+ * no deploy ordering.
+ *
+ * NOT to be confused with the vault's KEY VERSION, a different axis that also
+ * uses small integers: there, `2` means "per-account key". Here `2` means POPRF.
+ * The server half of these constants is `accelerator/src/services/oprf.ts` and
+ * MUST hold the same numbers.
+ */
+declare const OPRF_PROTOCOL_BASE = 0;
+/** RFC 9497 mode 0x02 — the fix for C4. Reserved; no deployment serves it yet. */
+declare const OPRF_PROTOCOL_POPRF = 2;
+type OprfProtocol = typeof OPRF_PROTOCOL_BASE | typeof OPRF_PROTOCOL_POPRF;
+
 /**
  * HTTP client for the accelerator's `/api/auth/*` endpoints.
  *
@@ -1227,6 +1326,21 @@ declare class DoubleRatchetManager {
  * (with the worker's message inlined where available).
  */
 
+/**
+ * A non-2xx response from `/api/auth/*`, carrying the HTTP status and the
+ * worker's machine-readable `code` alongside its human `error` string.
+ *
+ * Exists because the status used to be discarded: every failure arrived as a
+ * bare `Error` whose only distinguishing feature was its message, so classifying
+ * one meant regex-matching a sentence the server is free to reword. See
+ * `VaultUnavailableError`, which still does exactly that for rate limits.
+ */
+declare class AuthHttpError extends Error {
+    readonly label: string;
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(label: string, status: number, code: string | undefined, detail: string);
+}
 interface ZkRegisterRequest {
     username: string;
     /** Decimal-string Poseidon commitment. */
@@ -1306,16 +1420,24 @@ declare class AuthClient {
     verify(token: string): Promise<{
         username: string;
     }>;
-    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
-    oprfEvaluate(username: string, blinded: string): Promise<{
+    /**
+     * Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key.
+     *
+     * `oprfProtocol` declares the RFC 9497 mode this client speaks so the server
+     * can refuse rather than answer in a different one. A server too old to know
+     * the field drops it and answers in base mode, so this is safe against any
+     * deployment.
+     */
+    oprfEvaluate(username: string, blinded: string, oprfProtocol?: OprfProtocol): Promise<{
         evaluated: string;
     }>;
     /**
-     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
-     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
-     * domains' evaluations. The recover token is consumed by this call.
+     * Gated OPRF evaluation (M2 — email/google factors). Requires a live
+     * `verifyToken` from {@link emailOtpVerify}; returns BOTH keys'
+     * evaluations (K1 and K2, both operated by Muhkoo). The recover token is
+     * consumed by this call.
      */
-    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string): Promise<{
+    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string, oprfProtocol?: OprfProtocol): Promise<{
         evaluated: string;
         evaluated2: string;
     }>;
@@ -2896,6 +3018,11 @@ interface HostedAuthDeps {
     /** Sleep used by the poll loop. Injectable so tests don't burn wall-clock. */
     sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
 }
+/**
+ * A same-origin path the app may be sent back to after sign-in. It starts with
+ * "/", not "//", and has no backslash or control characters (design §4.4.9).
+ */
+declare function isSameOriginPath(p: unknown): p is string;
 /** One in-flight pairing attempt. Hold it; pass it back into poll/wait/cancel. */
 interface DevicePairingSession {
     /** Opaque; carry it back into poll/wait/cancel. Never render it. */
@@ -3048,13 +3175,15 @@ declare class HostedAuth {
      * (App side) Begin hosted login: stash a PKCE verifier + state, then send
      * the browser to the hosted authorize page. Returns the URL it redirects to
      * (also useful for popup mode / tests). `redirectUri` must be registered for
-     * the app in the portal.
+     * the app in the portal. `returnTo`, a same-origin path, rides the stash and
+     * comes back from {@link handleCallback}; anything else is refused here.
      */
     login(opts: {
         appId: string;
         redirectUri: string;
         redirect?: boolean;
         prompt?: "login";
+        returnTo?: string;
     }): Promise<string>;
     /**
      * (App side) Send the user to centralized account & security management on
@@ -3071,9 +3200,12 @@ declare class HostedAuth {
     /**
      * (App side) Complete login on the callback URL: verify state, exchange the
      * code (+ PKCE verifier) for the session, unseal the seed from the fragment,
-     * establish the session, and scrub the URL. Returns the signed-in user.
+     * establish the session, and scrub the URL. Returns the signed-in user, with
+     * the `returnTo` passed to {@link login} when it is still a same-origin path.
      */
-    handleCallback(): Promise<AuthUser>;
+    handleCallback(): Promise<AuthUser & {
+        returnTo?: string;
+    }>;
     /**
      * (Hosted-page side) Finish an /authorize request after the user has
      * authenticated here: seal the in-memory seed, mint the grant, and return
@@ -3299,6 +3431,24 @@ declare function formatUserCode(canonical: string): string;
 declare class VaultUnavailableError extends Error {
     constructor(cause?: unknown);
 }
+/**
+ * The vault refused the OPRF protocol this client speaks.
+ *
+ * Distinct from {@link VaultUnavailableError} because the remedy is different and
+ * the two used to be conflated: "unavailable" means retry, and a version mismatch
+ * never resolves by retrying — it resolves by updating the app (or the server).
+ *
+ * Critically, this must NOT be caught into the
+ * `vaultSeed ?? deriveMasterSeedFromPassword(...)` fallback in `login`/`unlock`.
+ * That fallback is correct for an account with no password factor, and wrong for
+ * a refusal: it derives a different seed, and on a legacy-migrated account —
+ * where the fallback seed happens to be the right one — it would let
+ * `migrateLegacyPasswordFactor` rewrite the factor as a side effect of a failure
+ * the user was never shown.
+ */
+declare class VaultProtocolMismatchError extends Error {
+    constructor(cause?: unknown);
+}
 /**
  * A stored device pairing that the account has since revoked.
  *
@@ -3428,15 +3578,16 @@ declare class ZkAuth {
     recoverWithPhrase(username: string, mnemonic: string, opts?: LoginOptions): Promise<AuthUser>;
     /**
      * Add an **email** as a recovery + login factor (M2 verification-gated:
-     * the server only releases the split-key OPRF eval after the address is
+     * the server only releases the gated OPRF eval after the address is
      * OTP-verified). Sends the code, then returns a `confirm` continuation:
      *
      *   const { confirm } = await client.auth.zk.enrollEmailFactor("me@x.com");
      *   await confirm(codeFromInbox);
      *
      * Requires being signed in with the seed held (like the other enrolls).
-     * Custody note: gated factors trade some custody for recoverability — the
-     * trade-off should be disclosed in the enroll UI.
+     * Custody note: Muhkoo holds the keys behind gated factors, so it can
+     * recover the seed of any account with an email or Google factor. The
+     * hosted sign-in UI discloses this; a custom enroll UI must too.
      */
     enrollEmailFactor(email: string): Promise<{
         email: string;
@@ -3445,7 +3596,7 @@ declare class ZkAuth {
     /**
      * Recover an account via its enrolled **email** factor. Sends a code to the
      * enrolled address (the response never reveals whether one exists), then
-     * `confirm(code)` completes: gated read + split-key eval → unwrap seed →
+     * `confirm(code)` completes: gated read + gated OPRF eval → unwrap seed →
      * normal ZK login. After this, call {@link changePassword} to set a new
      * password.
      *
@@ -3458,11 +3609,14 @@ declare class ZkAuth {
     /**
      * Link a Google account as a recovery + login factor. Requires being signed
      * in with the seed held. `idToken` is a fresh Google ID token (GIS).
+     * Custody note: as with {@link enrollEmailFactor}, Muhkoo holds the keys
+     * behind this factor and can recover the seed of an account that has it.
+     * The hosted sign-in UI discloses this; a custom enroll UI must too.
      */
     enrollGoogleFactor(idToken: string): Promise<void>;
     /**
      * Sign in with Google — verify the ID token, unlock the seed via the gated
-     * split-key eval, and establish a session. Same machinery serves "Sign in
+     * OPRF eval, and establish a session. Same machinery serves "Sign in
      * with Google" and "recover with Google"; the account must have linked the
      * factor first.
      */
@@ -3471,7 +3625,8 @@ declare class ZkAuth {
      * Register a brand-new, **passwordless** account whose only factor is Google.
      * A random master seed is generated and wrapped under the Google-gated key;
      * the user can add a password / passkey / phrase later. The ZK registration
-     * is identical to a password signup.
+     * is identical to a password signup. Custody note: see
+     * {@link enrollGoogleFactor} — Muhkoo can recover this account's seed.
      */
     registerWithGoogle(username: string, idToken: string): Promise<AuthUser>;
     /**
@@ -3726,9 +3881,10 @@ interface HttpClientOptions {
      * token) or `false` if it couldn't (the `401` propagates as an
      * {@link HttpError}). Wired by {@link Client} to `auth.zk.recover()`.
      *
-     * Only consulted by the JSON helpers (`get`/`post`/`del`); the raw
-     * {@link fetch} passes 401s straight through so the auth wire calls that
-     * power recovery itself can't recurse.
+     * Only consulted by the JSON helpers (`get`/`post`/`del`) and
+     * {@link HttpClient.fetchWithRecovery}; the raw {@link fetch} passes 401s
+     * straight through so the auth wire calls that power recovery itself
+     * can't recurse.
      */
     onUnauthorized?: () => Promise<boolean>;
 }
@@ -3755,6 +3911,15 @@ declare class HttpClient {
      * up credentials without knowing about them.
      */
     readonly fetch: typeof fetch;
+    /**
+     * {@link fetch} with the JSON helpers' stale-session recovery: a 401 on a
+     * request made while a session token is held runs `onUnauthorized` once
+     * and, if that recovered, replays the request once with the fresh token.
+     * The final response is returned whatever its status, never thrown. The
+     * replay re-sends `init` as given, so its body must be re-sendable (a
+     * string or bytes, not a stream).
+     */
+    readonly fetchWithRecovery: typeof fetch;
     /** True when `input` resolves to {@link baseOrigin} (relative URLs always do). */
     private isSameOrigin;
     get<T = unknown>(path: string): Promise<T>;
@@ -3919,8 +4084,9 @@ interface OfflineStore {
  * mutation by re-invoking the real namespace method (with an `isReplay` flag so
  * it doesn't re-enqueue). `drain()` replays entries in HLC order:
  *   - success → remove the entry;
- *   - permanent failure (4xx) → drop it and surface a `SYNC_ERROR` (a write the
- *     server will never accept must not wedge the queue forever);
+ *   - permanent failure (4xx, or a Space whose member list refuses this user)
+ *     → drop it and surface a `SYNC_ERROR` (a write the server will never
+ *     accept must not wedge the queue forever);
  *   - transient/network failure → stop draining and leave the rest for the next
  *     reconnect.
  *
@@ -4500,6 +4666,140 @@ declare class StorageNamespace {
     private space;
 }
 
+/**
+ * Wire types of the e2e-channels trust layer (spec 2026-09-27 §3.2, §3.5,
+ * §4.2.4, §5.3.1). These shapes are signed and stored: never rename a field.
+ *
+ * Every string field holds the exact string that was transmitted; the
+ * canonical encoders in `canonical.ts` sign those strings as they are.
+ *
+ * Ported from the accelerator's `src/trust/types.ts` (the server-only app
+ * roster types are left out); the shared shapes must stay identical.
+ */
+type Visibility = "private" | "public";
+type HistoryPolicy$1 = "static" | "rotate";
+type MemberRole = "viewer" | "editor";
+type SvcMode = "addressed" | "all";
+type MlogOp = "genesis" | "add" | "role" | "remove" | "leave" | "join" | "link" | "unlink" | "redeem" | "svc" | "retire";
+/** `legacyCommits` is `{}` for a new Space; values are b64url of 32 bytes, keys canonical decimal epochs. */
+interface GenesisBody {
+    visibility: Visibility;
+    policy: HistoryPolicy$1;
+    appId: string;
+    baseEpoch: number;
+    legacyCommits: Record<string, string>;
+}
+interface AddBody {
+    member: string;
+    memberIk: string;
+    role: MemberRole;
+}
+interface RoleBody {
+    member: string;
+    role: MemberRole;
+}
+interface RemoveBody {
+    member: string;
+}
+type LeaveBody = Record<string, never>;
+/** `via` is a linkId, or "" for no link. */
+interface JoinBody {
+    via: string;
+}
+interface LinkBody {
+    linkId: string;
+    role: MemberRole;
+    standing: boolean;
+    expiresAt: number;
+    maxUses: number;
+    linkEcdhPub: string;
+    linkSignPub: string;
+    keyCommits: Record<string, string>;
+}
+interface UnlinkBody {
+    linkId: string;
+}
+interface RedeemBody {
+    linkId: string;
+}
+interface SvcBody {
+    member: string;
+    action: "add" | "remove";
+    ecdhPub: string;
+    ecdsaPub: string;
+    mode: SvcMode;
+    rosterSeq: number;
+}
+interface RetireBody {
+    member: string;
+    reason: string;
+}
+interface MlogBodies {
+    genesis: GenesisBody;
+    add: AddBody;
+    role: RoleBody;
+    remove: RemoveBody;
+    leave: LeaveBody;
+    join: JoinBody;
+    link: LinkBody;
+    unlink: UnlinkBody;
+    redeem: RedeemBody;
+    svc: SvcBody;
+    retire: RetireBody;
+}
+interface EntryBase {
+    v: 1;
+    spaceId: string;
+    /** 0 = genesis; −1 only in an enable intent (§5.3.3), never stored. */
+    seq: number;
+    /** hash of entry seq−1; "" at genesis and in an intent. */
+    prev: string;
+    /** Signer member id; "" in a server-written `retire`. */
+    by: string;
+    /** Signer IK (b64 or hex raw P-256), exactly as sent; "" in a `retire`. */
+    ik: string;
+    /** Signer clock, informational. */
+    at: number;
+    /** b64 P1363 ECDSA-P256-SHA256 by `ik` over entryBytes; "" only in a `retire`. */
+    sig: string;
+    /** Link-sign signature over entryBytes (`link`, `redeem`, `join` with `via`). */
+    lsig?: string;
+}
+type MembershipEntry<O extends MlogOp = MlogOp> = {
+    [K in O]: EntryBase & {
+        op: K;
+        body: MlogBodies[K];
+    };
+}[O];
+type UnsignedEntry<O extends MlogOp = MlogOp> = {
+    [K in O]: Omit<MembershipEntry<K>, "sig" | "lsig">;
+}[O];
+interface ChatKeyCert {
+    v: 1;
+    ik: string;
+    ecdh: string;
+    ecdsa: string;
+    sig: string;
+}
+interface EpochCommit {
+    v: 1;
+    spaceId: string;
+    epoch: number;
+    prevKeyed: number;
+    keyCommit: string;
+    headSeq: number;
+    headHash: string;
+    sole: boolean;
+    by: string;
+    ik: string;
+    at: number;
+    sig: string;
+}
+interface MlogHead {
+    seq: number;
+    hash: string;
+}
+
 /**
  * Shared types for the Space fan-out group-encryption layer.
  *
@@ -4509,6 +4809,7 @@ declare class StorageNamespace {
  * which is what lets the server persist + replay messages as history while
  * staying blind to their contents.
  */
+
 /**
  * How a space treats history across membership changes.
  *  - `static`: one group key for all time (epoch 0). New members can read the
@@ -4556,6 +4857,8 @@ interface JoinRequest {
     /** Epoch the newcomer wants a key for (defaults to current). */
     desiredEpoch?: number;
     ts?: number;
+    /** The account IK's certificate over the two identity strings above (design §3.2). Optional: a join never requires one. */
+    keyCert?: ChatKeyCert;
 }
 /** A space member's published identity keys (the keyring directory). */
 interface RosterMember {
@@ -4710,6 +5013,18 @@ interface KeyringTransport {
     /** Add `username` to a private channel's membership allowlist. */
     invite(username: string): Promise<void>;
     fetchMetadata(): Promise<SpaceMetadata | null>;
+    /** GET /keyring/log (design §3.6): entries with seq > since, ascending, ≤ limit; head null = no log. */
+    fetchLog?(since?: number, limit?: number): Promise<{
+        entries: MembershipEntry[];
+        head: MlogHead | null;
+    }>;
+    /** POST /keyring/log {entry, ec?}. */
+    postLogEntry?(entry: MembershipEntry, ec?: EpochCommit): Promise<{
+        ok: true;
+        head: MlogHead;
+    }>;
+    /** Status of GET /keyring/state, or "network" when the request fails. */
+    probeState?(): Promise<number | "network">;
 }
 /** PersonalSpace-backed cache of this member's group keys (epoch → base64 key). */
 interface SpaceKeyCache {
@@ -4729,6 +5044,10 @@ interface SpaceKeyringDeps {
     transport: KeyringTransport;
     cache?: SpaceKeyCache;
     historyPolicy?: HistoryPolicy;
+    /** Mints the IK certificate for this member's chat keys (design §3.2). Absent, or resolving undefined, means none. */
+    keyCert?: () => Promise<ChatKeyCert | undefined>;
+    /** Whether a key may be wrapped to `memberId`; absent means anyone. On a signed Space: log members and the keeper only. */
+    canWrapTo?: (memberId: string) => boolean;
 }
 declare class SpaceKeyring implements EpochKeyProvider {
     private readonly deps;
@@ -4745,7 +5064,11 @@ declare class SpaceKeyring implements EpochKeyProvider {
      *  this window won't re-fetch (the roster hasn't changed that fast); genuine
      *  membership changes use `{ force: true }` (join requests / history loads). */
     private static readonly DIR_COOLDOWN_MS;
+    private readonly keyListeners;
     constructor(deps: SpaceKeyringDeps);
+    /** Notified whenever this keyring gains a key (bootstrap, cache hit, pull). Returns an unsubscribe. */
+    onKeysChanged(h: () => void): () => void;
+    private notifyKeys;
     /** The cached ECDSA verify key for a member, if known. */
     ecdsaKeyFor(memberId: string): CryptoKey | undefined;
     /**
@@ -4763,6 +5086,10 @@ declare class SpaceKeyring implements EpochKeyProvider {
     currentEpoch(): number;
     keyForEpoch(epoch: number): Uint8Array | undefined;
     hasAnyKey(): boolean;
+    /** The raw 32-byte group key for `epoch`, for its key commitment (design §4.2.4). */
+    rawKey(epoch: number): Uint8Array | undefined;
+    /** Whether a key may be wrapped to `memberId` (design §4.5.1: on a signed Space, log members and the keeper only). */
+    canWrapTo(memberId: string): boolean;
     /** Hydrate keys from the PersonalSpace cache, if available. Best-effort —
      * a cache miss/failure (e.g. not unlocked) must not block joining. */
     loadFromCache(): Promise<boolean>;
@@ -4772,7 +5099,8 @@ declare class SpaceKeyring implements EpochKeyProvider {
     /**
      * Post a join request so an online key-holder can wrap a key for us. Also
      * publishes our identity keys in the member directory (so others can verify
-     * our message signatures, and the keeper can wrap to us).
+     * our message signatures, and the keeper can wrap to us). With a `keyCert`
+     * dep it also carries the IK certificate over exactly those two strings.
      */
     requestKey(desiredEpoch?: number): Promise<void>;
     /**
@@ -4810,6 +5138,124 @@ declare class SpaceKeyring implements EpochKeyProvider {
     invite(username: string): Promise<void>;
 }
 
+type Role = "owner" | "editor" | "viewer";
+interface LogMember {
+    id: string;
+    ik: string;
+    role: Role;
+    since: number;
+}
+
+/** What LogSync needs from core (kept structural so spaces/ never imports core/). */
+interface LogSyncDeps {
+    spaceId: string;
+    me: () => string;
+    appId: () => Promise<string>;
+    commitment: () => string | null;
+    transport: {
+        fetchLog(since?: number, limit?: number): Promise<{
+            entries: MembershipEntry[];
+            head: MlogHead | null;
+        }>;
+        postLogEntry(entry: MembershipEntry, ec?: EpochCommit): Promise<{
+            head: MlogHead;
+        }>;
+    };
+    signer: {
+        sign(b: Uint8Array): Promise<string>;
+        identityKeyRaw(): Promise<string>;
+    };
+    directory: {
+        lookup(username: string): Promise<string>;
+    };
+    pins: {
+        get(doc: "identity" | "spaces", key: string): Promise<string | undefined>;
+        pin(doc: "identity" | "spaces", entries: Record<string, string>): Promise<{
+            conflicts: string[];
+        }>;
+    };
+    store: () => Promise<{
+        get<T>(k: string): Promise<T | undefined>;
+        put(k: string, v: unknown): Promise<void>;
+    }>;
+}
+interface MemberView {
+    id: string;
+    role: Role;
+    ik: string;
+    fingerprint: string;
+    identityChanged: boolean;
+}
+type IntegrityState = {
+    broken: false;
+} | {
+    broken: true;
+    reason: string;
+};
+/**
+ * One Space's membership log, as this client has verified it (design §3.6–§3.7).
+ * Syncs the whole log from −1 on each call (slice logs are tiny, so no entry
+ * cache), checks the head against the high-water mark kept in `muhkoo.trust`,
+ * checks the genesis against the pins (TOFU against the directory the first
+ * time), and pins every IK a verified `add` names (design §3.4).
+ */
+declare class LogSync {
+    private readonly deps;
+    private log;
+    private enabled;
+    private integrityState;
+    private changed;
+    private fps;
+    private listeners;
+    private timer;
+    private running;
+    private followUp;
+    constructor(deps: LogSyncDeps);
+    get logEnabled(): boolean;
+    get integrity(): IntegrityState;
+    get signer(): LogSyncDeps["signer"];
+    get directory(): LogSyncDeps["directory"];
+    member(id: string): LogMember | undefined;
+    isMember(id: string): boolean;
+    members(): MemberView[];
+    onChange(h: () => void): () => void;
+    /**
+     * An `mlog` frame marks the log stale; sync once a burst of frames settles.
+     * A failure is logged with its code and reported through `onChange`, never
+     * thrown; integrity is left as it was, and the next frame or open retries.
+     */
+    scheduleSync(): void;
+    private hwKey;
+    /** Whether this client holds a high-water mark for this Space, i.e. has verified its log before (design §3.7 item 3). */
+    hasHighWater(): Promise<boolean>;
+    /**
+     * Fetch and verify the whole log. Single-flight: a call made while a sync
+     * runs does not start a second one alongside it. It waits for exactly one
+     * follow-up run, which starts once the running one ends, so it sees whatever
+     * prompted the call; every call made in the meantime shares that follow-up.
+     */
+    sync(): Promise<void>;
+    private startSync;
+    private runSync;
+    /** Genesis trust (design §3.7 item 2): the pinned genesis hash, else TOFU with the owner's IK checked against the directory. */
+    private checkGenesis;
+    /** "s:" + b64url(SHA-256(utf8(spaceId))), the spaces-v1 key; computed exactly as PinStore.spacePinKey, which this layer may not import. */
+    private spacePinKey;
+    /** Pin every IK a verified add names (design §3.4 row 2); a different pinned IK flags the member (identity-changed). */
+    private pinMembers;
+    /**
+     * Sign and append one entry. On `409 Log moved`: re-sync, re-sign against the
+     * new head and retry, at most 3 times with jitter (design §9.2 I9). Nothing is
+     * signed while integrity is broken, including after a re-sync that breaks it.
+     * Any other refusal → SpaceTrustError("log-refused") carrying the server's code and reason.
+     * Once the server has stored the entry, its `{seq}` is returned even if the sync confirming it fails.
+     */
+    append(op: MembershipEntry["op"], body: Record<string, unknown>, ec?: (hash: string, entry: UnsignedEntry) => Promise<EpochCommit>): Promise<{
+        seq: number;
+    }>;
+    private emit;
+}
+
 /**
  * `Space` — a client handle for one shared space.
  *
@@ -4927,6 +5373,11 @@ interface EphemeralEvent {
 interface MessageDeletedEvent {
     handle: number;
 }
+type AdmissionState = "locked" | "requesting" | "keyed" | "not-member" | "identity-mismatch" | "integrity";
+/** WebSocket close code for a refused private-Space socket (design §3.6; accelerator NOT_MEMBER_CLOSE_CODE). */
+declare const NOT_MEMBER_CLOSE_CODE = 4403;
+/** At most one resume after a 4403 per Space per this interval (design §6.7). */
+declare const NOT_MEMBER_RECHECK_MS = 60000;
 interface SpaceDeps {
     /** Transport room id. For fan-out spaces this is the encoded space pubkey. */
     name: string;
@@ -4961,6 +5412,21 @@ interface SpaceDeps {
     deferShardUpload?: (hash: string) => Promise<void>;
     /** Offline message cache + send queue. Undefined ⇒ no offline behavior. */
     offline?: SpaceOfflineAdapter;
+    /** Locked session (design §3.3): no keyring, never connects; the app re-opens after sign-in. */
+    locked?: boolean;
+    /** The Space's membership log (a signed private Space), when this client has trust wired. */
+    logSync?: LogSync;
+    /** Visibility the Space was created with; only a private Space gets a genesis (design §3.8). */
+    visibility?: "private" | "public";
+    /** This app's id, which a genesis names (design §3.5). */
+    appId?: () => Promise<string>;
+    /**
+     * Status of GET /keyring/state after the client's silent 401 recovery, or "network": asked after a
+     * 4403 close before believing it (design §6.9).
+     */
+    probeState?: () => Promise<number | "network">;
+    /** True while the session holds a token, so a reconnect must never go ticketless. */
+    hasSession?: () => boolean;
 }
 /** The subset of {@link BroadcastChannel} a {@link Space} drives. */
 interface SpaceChannelLike {
@@ -4973,13 +5439,22 @@ interface SpaceChannelLike {
     sendRaw(frame: unknown): void;
     peers?(): string[];
     isConnected?(): boolean;
+    /** Reconnect after a terminal close, on a fresh URL. */
+    resume?(): void;
 }
 declare class Space {
     private readonly deps;
     readonly name: string;
     readonly historyPolicy: HistoryPolicy;
     private channel;
-    private readonly pending;
+    /**
+     * The log turned this user away and closed `channel` (design §3.7). Its
+     * single-use ticket is spent, so it is never dialled again: the next
+     * `connect()` checks the log and opens a new channel on a fresh ticket.
+     */
+    private channelSpent;
+    /** Every raw channel listener (`on`), attached to each channel this Space opens. */
+    private readonly listeners;
     private readonly cipher;
     /** Per-instance event bus for fan-out events (isolated across spaces). */
     private readonly events;
@@ -4987,12 +5462,52 @@ declare class Space {
     private catchUpUnsub;
     /** Optional P2P swarm for this Space (block exchange among members). */
     private peerNet;
+    private _admission;
+    /** Whether admission follows the log's changes yet (subscribed once, on the first open the log admits). */
+    private admissionWired;
+    /** When the last resume after a 4403 ran (design §6.7: at most one per {@link NOT_MEMBER_RECHECK_MS}). */
+    private lastResumeAt;
+    private resumeTimer;
+    /** Bumped by `disconnect()`: a /keyring/state answer that arrives after it is dropped. */
+    private teardowns;
     constructor(deps: SpaceDeps);
     /** The encoded space id (same as the transport name for fan-out spaces). */
     get id(): string;
     /** The keyring backing this space's group keys, if any. */
     get keyring(): SpaceKeyring | undefined;
-    /** Open the space websocket (resolves the ticket + identity lazily). */
+    /** Where this member stands in this Space (design §4.5.12, as the slice ships it). */
+    get admission(): AdmissionState;
+    /** Subscribe to admission changes. Returns an unsubscribe. */
+    onAdmission(h: (s: AdmissionState) => void): () => void;
+    protected setAdmission(s: AdmissionState): void;
+    /** The log turned this user away; nothing reconnects until it admits them again. */
+    private denied;
+    /**
+     * Sync the membership log and derive admission from it, before any ticket
+     * (design §3.4, §3.7, §4.5.12). A 403 from the log route is not-member and a
+     * 401 is locked. Any other failure is fatal only where this client has
+     * verified the log before (it holds a high-water mark). Otherwise the Space
+     * opens as unlogged this time, and the next open or `mlog` frame syncs again.
+     */
+    private admitByLog;
+    /** Re-derive admission from the verified log (design §3.4 rows, §3.7, §4.5.12). */
+    private evaluateAdmission;
+    /**
+     * A 4403 alone never shows not-member: ask /keyring/state first (design §6.9, AV12).
+     * 403 is not-member and 401, which `probeState` returns only once a silent re-auth has failed, is
+     * locked; either closes the channel for good, like a log refusal. Any
+     * other answer (404 while step I has no state route, 2xx, 5xx, a network error) resumes, at most
+     * once per {@link NOT_MEMBER_RECHECK_MS}.
+     */
+    private onNotMemberClose;
+    /** Close the socket of a user the log turned away, and never dial that channel again (design §3.7). */
+    private dropChannel;
+    /**
+     * Open the space websocket (resolves the ticket + identity lazily). On a
+     * Space with a membership log, the log is checked first: a user it does not
+     * list, or lists under another identity key, is refused with
+     * {@link AdmissionDeniedError} before any ticket is fetched (design §4.5.12).
+     */
     connect(): Promise<void>;
     disconnect(): void;
     /** Attach a P2P swarm so this Space's file reads/writes can use peers. */
@@ -5008,7 +5523,7 @@ declare class Space {
     gossipToPeers(data: Uint8Array): void;
     /** Subscribe to peer gossip ({@link gossipToPeers}). Returns an unsubscribe fn. */
     onPeerGossip(handler: (from: string, data: Uint8Array) => void): () => void;
-    /** Subscribe to a raw channel event. Buffered until `connect()` if early. */
+    /** Subscribe to a raw channel event. Buffered until `connect()` if early, and kept across a new channel. */
     on(event: string, handler: Listener): void;
     off(event: string, handler: Listener): void;
     /** Advertise our keyExchange to the room (idempotent per connection). */
@@ -5092,7 +5607,7 @@ declare class Space {
         timeoutMs?: number;
         pollMs?: number;
     }): Promise<boolean>;
-    /** Creator path: mint the initial group key, then connect. */
+    /** Creator path: mint epoch 0; for a private Space, sign the genesis + ec(0) BEFORE connecting (design §4.5.10). */
     create(): Promise<void>;
     /** Wrap the group key for a newcomer and post it (key-holder action). */
     admit(memberId: string, identityEcdhPub: string): Promise<void>;
@@ -5103,6 +5618,29 @@ declare class Space {
         memberId: string;
         identityEcdhPub: string;
     }>): Promise<number>;
+    /** Whether this Space has a verified membership log. */
+    get logEnabled(): boolean;
+    /** The verified member list, or null when this Space has no log. */
+    membership(): MemberView[] | null;
+    /** Called with the member list (null when unlogged) each time the log is re-synced. Returns an unsubscribe. */
+    onMembership(h: (m: MemberView[] | null) => void): () => void;
+    private requireLog;
+    /** Add by exact username (design §3.8; the owner, or an editor for viewers). Looks the IK up in the directory. */
+    add(username: string, opts?: {
+        role?: "viewer" | "editor";
+    }): Promise<{
+        seq: number;
+    }>;
+    /** Remove a member. In this build it cuts them off at the relay; it does not rotate the key. */
+    remove(memberId: string): Promise<{
+        seq: number;
+    }>;
+    setRole(memberId: string, role: "viewer" | "editor"): Promise<{
+        seq: number;
+    }>;
+    leave(): Promise<{
+        seq: number;
+    }>;
     putFile(file: File | Blob | Uint8Array, metadata: SpaceFileMetadata, opts?: {
         onProgress?: (completed: number, total: number) => void;
         /**
@@ -5295,19 +5833,27 @@ declare class ChatKeyVault {
     private readonly store;
     constructor(store: ChatKeyStore);
     /**
-     * Register-time: ensure a keypair exists for `memberId`, seed-wrap the
-     * dehydrated form, and persist it to the personal space. Idempotent — reuses
-     * an existing in-tab keypair rather than minting a second one.
+     * Register-time: ensure a vault-backed keypair exists for `memberId`,
+     * seed-wrap it and persist it. Idempotent for a pair that is already
+     * vault-backed. Otherwise a fresh pair is generated, persisted, and only
+     * then swapped in, replacing whatever the tab held: a throwaway key is never
+     * persisted as the stable one, and a failed persist leaves the tab's keys
+     * as they were, with nothing marked.
      */
     provision(memberId: string, seedSecret: string): Promise<void>;
     /**
-     * Sign-in / unlock time: fetch the wrapped blob, unwrap with the seed, and
-     * hydrate the `KeyStore` — restoring the SAME keypair the member had before.
-     * Returns `true` when a keypair is now in hand (already present or hydrated),
-     * `false` when there's no blob yet (a brand-new member → caller provisions).
-     * Throws only on a genuine unwrap failure (wrong secret / tampered blob).
+     * Sign-in / unlock time: fetch the wrapped blob, unwrap it with the seed, and
+     * hydrate the `KeyStore`, restoring the SAME keypair the member had before.
+     * Returns `true` when a vault-backed keypair is now in hand, and `false` when
+     * there is no blob yet (a brand-new member; the caller provisions). A store
+     * failure propagates as thrown; a blob that does not unwrap, parse or import
+     * throws `ChatKeysUnreadableError`. Nothing in the `KeyStore` changes until
+     * the saved pair is imported; it then replaces whatever pair the tab held,
+     * in one step, so a pair minted meanwhile is never kept in its place.
      */
     rehydrate(memberId: string, seedSecret: string): Promise<boolean>;
+    /** Unwrap, parse and import a saved pair, outside the `KeyStore`. */
+    private unwrapPair;
     /**
      * Ensure a stable keypair is in hand: rehydrate from the vault if a blob
      * exists, otherwise mint one and persist it (so it's stable next session).
@@ -5316,6 +5862,101 @@ declare class ChatKeyVault {
     ensure(memberId: string, seedSecret: string): Promise<void>;
 }
 
+/**
+ * POST /api/auth/identity (SpecA §4.1 as amended by CS-7). An unknown name
+ * answers a deterministic decoy, so a lookup never says whether an account
+ * exists. Responses are cached for the life of the Client. Any failure,
+ * including a 429, fails closed (SpecA §4.3).
+ */
+declare class IdentityDirectory {
+    private readonly http;
+    private readonly cache;
+    constructor(http: Pick<HttpClient, "post">);
+    lookup(username: string): Promise<string>;
+    lookupMany(usernames: string[]): Promise<Record<string, string>>;
+}
+
+/** Signs with the account identity key (IK). Never exposes the seed (SpecA §6.1). */
+interface IdentitySigner {
+    /** b64 IEEE-P1363 ECDSA-P256-SHA256 over `bytes`. */
+    sign(bytes: Uint8Array): Promise<string>;
+    /** The IK as standard padded base64 of the raw 65-byte point. */
+    identityKeyRaw(): Promise<string>;
+}
+
+/**
+ * IndexedDB `muhkoo.trust` (design §6.6): pin high-water marks and per-Space log
+ * heads. When IndexedDB is absent, throws on open, or has not opened within 2 s,
+ * it is an in-memory store for the life of the Client, and `persistent` is
+ * false (KI1).
+ */
+interface TrustStore {
+    readonly persistent: boolean;
+    get<T>(key: string): Promise<T | undefined>;
+    put(key: string, value: unknown): Promise<void>;
+    del(key: string): Promise<void>;
+}
+
+type PinDocName = "identity" | "spaces";
+interface PinDoc {
+    v: 1;
+    ownerCommitment: string;
+    counter: number;
+    entries: Record<string, string>;
+    sig: string;
+}
+interface PinStoreDeps {
+    http: Pick<HttpClient, "post">;
+    commitment: () => string | null;
+    signer: IdentitySigner;
+    store: () => Promise<TrustStore>;
+}
+declare class PinStore {
+    private readonly deps;
+    constructor(deps: PinStoreDeps);
+    private commitment;
+    private markKey;
+    private kvPath;
+    private fetchDoc;
+    private verify;
+    /** The current verified document; an empty bootstrap at counter 0 when none exists and no mark does either. */
+    read(doc: PinDocName): Promise<PinDoc>;
+    get(doc: PinDocName, key: string): Promise<string | undefined>;
+    /** Pin new keys. A key already pinned to a different value is reported, never overwritten (design §3.4). */
+    pin(doc: PinDocName, entries: Record<string, string>): Promise<{
+        conflicts: string[];
+    }>;
+    unpin(doc: PinDocName, keys: string[]): Promise<void>;
+    /** User-confirmed recovery (design §9.1 "Your saved trust records are missing."): forget the high-water mark. */
+    resetMark(doc: PinDocName): Promise<void>;
+    private mutate;
+}
+
+/** One per Client: shared by every Space (and, in sub-project 4, DMs). */
+declare class TrustContext {
+    private readonly deps;
+    readonly directory: IdentityDirectory;
+    readonly signer: IdentitySigner;
+    readonly pins: PinStore;
+    private storeP;
+    private opened;
+    private appIdP;
+    constructor(deps: {
+        http: HttpClient;
+        session: SessionState;
+        openStore?: () => Promise<TrustStore>;
+    });
+    /** Whether muhkoo.trust survives a restart (KI1): false until the open settles, and false for an in-memory store. */
+    get persistent(): boolean;
+    store(): Promise<TrustStore>;
+    /** This app's id, from GET /api/app/trust (a genesis must name it, D4). Cached; a failure is retried next call. */
+    appId(): Promise<string>;
+    /** User-confirmed "Reset trust for this space" (design §9.1): drop its genesis pin and log high-water. */
+    resetSpacePins(spaceId: string): Promise<void>;
+    /** `client.trust.unpin(username)`: forget a member's pinned identity after comparing safety numbers (design §3.4). */
+    unpinUser(username: string): Promise<void>;
+}
+
 /**
  * `client.space` — the fan-out group-encryption surface.
  *
@@ -5354,6 +5995,9 @@ interface SpaceNamespaceDeps {
     /** SDK-owned ratchet-keypair vault — gives a STABLE member keypair across
      *  reloads (rehydrate-or-provision) instead of a fresh one each session. */
     chatKeys?: ChatKeyVault;
+    /** The Client's trust context. Present, every join request carries the IK
+     *  certificate over this member's chat keys (design §3.2). */
+    trust?: TrustContext;
     /** P2P swarm config — enables peer block exchange among Space members. */
     p2p?: {
         enabled?: boolean;
@@ -5369,6 +6013,10 @@ declare class SpaceNamespace {
     private spaceCache?;
     /** Spaces built this session, by id — used to route offline send replays. */
     private readonly openSpaces;
+    /** In-flight identity loads, by member id; each entry is deleted once it settles. */
+    private readonly identityInFlight;
+    /** Chat-key certificates, by member and the exact key strings; a failed mint is dropped so the next join retries. */
+    private readonly certs;
     /** Unique id for THIS device/session — the P2P peer identity. A user's own
      *  devices share a member id, so the mesh MUST distinguish them by this or a
      *  device treats its siblings' signals as its own echo and never connects. */
@@ -5397,8 +6045,14 @@ declare class SpaceNamespace {
     joinSpace(spaceId: string, opts?: {
         timeoutMs?: number;
     }): Promise<Space>;
-    /** A handle to a space without auto-connecting (uses cached keys on demand). */
-    get(spaceId: string, historyPolicy?: HistoryPolicy): Promise<Space>;
+    /**
+     * A handle to a space without auto-connecting (uses cached keys on demand).
+     * `messaging: false` opens a files-only space, as {@link createSpace} makes:
+     * no keyring and no identity, so it opens whether or not the session is locked.
+     */
+    get(spaceId: string, historyPolicy?: HistoryPolicy, opts?: {
+        messaging?: boolean;
+    }): Promise<Space>;
     /** List this app's channels (name → space-id) for the key's environment. */
     listChannels(): Promise<Array<{
         name: string;
@@ -5457,8 +6111,22 @@ declare class SpaceNamespace {
     }>>;
     private keyringFor;
     private build;
-    /** Ensure the member has an identity keypair; return its public ECDH + ECDSA keys. */
+    /**
+     * The member's stable chat identity (design §3.3). A locked session (no
+     * seed) throws `IdentityLockedError`. A vault failure throws
+     * `IdentityUnavailableError`: `retryable` when the vault could not be
+     * reached (§9.2 I8), and not when the saved keys do not unwrap under this
+     * seed. A throwaway pair is never minted: doing so is what hid a reloaded
+     * member's earlier messages from everyone else.
+     *
+     * Concurrent calls for one member share a single load, so two first opens
+     * can never interleave their forget/generate steps and persist a second or
+     * mixed pair.
+     */
     private ensureIdentity;
+    private loadIdentity;
+    /** One certificate per (member, chat keys) for the life of the Client (design §3.2: global, not per Space). */
+    private certFor;
     private fetchPolicy;
     private fetchTicket;
     private myId;
@@ -5920,6 +6588,8 @@ interface FileEntry {
      * would defeat the point of keeping history out of the directory record.
      */
     versions?: number;
+    /** See `DirEntry.moving`. */
+    moving?: true;
 }
 interface DirEntry {
     kind: "dir";
@@ -5928,6 +6598,25 @@ interface DirEntry {
     /** Base64 AES-256 key for that record. See the capability note above. */
     key: string;
     mtime: number;
+    /**
+     * Set on both copies while a move between two directories is under way.
+     *
+     * A move writes two records, attaching before it detaches, and one that
+     * is interrupted leaves the same entry - the same directory record, or
+     * the same file id, content and history - named in both. This is how a
+     * delete of either copy knows to look for the other before letting go of
+     * anything. Cleared by the move's last write, and from the one copy left
+     * when a delete removes the other. Left in place, it costs a delete of
+     * that entry one read of the tree, and a file keeps every version that
+     * falls off its history.
+     *
+     * Not cleared when that last write is the one that fails: the move has
+     * otherwise finished, only one copy is named anywhere, and nothing comes
+     * back to unmark it. A retried move of the same entry carries the mark
+     * over. That copy then keeps what falls off its history for good - a
+     * storage cost, never a loss.
+     */
+    moving?: true;
 }
 type Entry = FileEntry | DirEntry;
 /** One directory record, as stored (before encryption). */
@@ -5983,6 +6672,57 @@ declare class VfsNotFoundError extends Error {
 declare class VfsConflictError extends Error {
     constructor(message: string);
 }
+/**
+ * Raised when a directory record cannot be read: it does not decrypt or parse
+ * with the key its parent holds, or it does but is not a shape this SDK can
+ * read - not an object, a version other than 1, `entries` missing or not a map.
+ *
+ * Thrown, never read as an empty directory. The next write into an "empty"
+ * directory would seal an empty record over the real one, and a record this
+ * version cannot read may simply be one a NEWER version wrote. Nor is the
+ * directory skipped: a sync that cannot see a subtree reads its absence as a
+ * deletion. The record is left exactly as stored; a recursive delete
+ * (`delete(path, { recursive: true })`) detaches it when the user wants it
+ * gone.
+ */
+declare class VfsCorruptRecordError extends Error {
+    /** The record's id - `dirKey(id)` is where it is stored. */
+    readonly id: string;
+    /** The path it was reached through, when known. A moved subtree can have two. */
+    readonly path?: string;
+    constructor(id: string, path: string | undefined, reason: string);
+}
+/**
+ * Raised when a walk or a copy would go past a size or depth ceiling, or a
+ * write would put a directory deeper than a walk reads.
+ *
+ * Thrown rather than returning what was gathered so far, because every caller
+ * of a walk treats a path that is missing from the result as a path that does
+ * not exist - and a sync then plans a deletion for it. A tree this large or
+ * deep is almost always one built to be expensive to read: directory records
+ * can point at the same directory many times over, so a handful of tiny
+ * records can describe more paths than there are atoms.
+ */
+declare class VfsLimitError extends Error {
+    /**
+     * Which ceiling was hit: total entries, total characters of path text,
+     * nesting depth, or - for a copy - how many places one directory may
+     * appear. Entries alone do not bound memory - a name may be 255 bytes, so
+     * one path can be ~16KB - which is why path text has its own.
+     */
+    readonly limit: "entries" | "pathChars" | "depth" | "shared";
+    /** The ceiling itself. */
+    readonly max: number;
+    /** Where the operation started, or for a write what it was asked to write. */
+    readonly path: string;
+    /**
+     * Where the ceiling was reached: the directory being listed, or for depth
+     * the entry one level too deep. Walking the tree to find the culprit would
+     * hit the same ceiling, so this is the only pointer the caller gets.
+     */
+    readonly at: string;
+    constructor(limit: VfsLimitError["limit"], max: number, path: string, at: string, doing?: string);
+}
 
 /**
  * `client.vfs` — a real filesystem over Muhkoo primitives.
@@ -6053,6 +6793,18 @@ interface VfsNamespaceDeps {
     seed: () => Uint8Array | null;
     /** Versions retained per file. */
     historyLimit?: number;
+    /**
+     * Ceilings for the operations that visit a whole subtree - `walk` (and so
+     * `glob`) and `copy`. `entries` is the most entries one call may visit;
+     * `pathChars` the most characters of path text, summed over every path it
+     * visits. The defaults are far past any real project; tests lower them so
+     * a hostile tree hits them in milliseconds. `Client` does not pass these,
+     * so `client.vfs` always has the defaults.
+     */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 declare class VfsNamespace {
     private readonly deps;
@@ -6066,6 +6818,8 @@ declare class VfsNamespace {
      */
     private cache;
     private readonly historyLimit;
+    private readonly maxEntries;
+    private readonly maxPathChars;
     constructor(deps: VfsNamespaceDeps);
     /**
      * The working directory relative paths resolve against.
@@ -6117,14 +6871,46 @@ declare class VfsNamespace {
     stat(path: string): Promise<VfsStat>;
     /** Immediate children of a directory. One record fetch. */
     list(path?: string): Promise<VfsStat[]>;
+    /**
+     * A directory's entries in listing order: directories first, then by name.
+     * Shared by `list` and `walk`, so a walk's output order is exactly the order
+     * of the listings it is made of.
+     */
+    private children;
     private warn;
     /**
      * Every file path under a prefix, depth-first.
      *
      * Deliberately separate from `list`: this walks the whole subtree, which is
      * one fetch per directory. Fine for a project, wrong as a default.
+     *
+     * Throws VfsLimitError past the entry budget or the depth ceiling, and
+     * VfsCorruptRecordError for a directory it cannot read, rather than
+     * returning part of the tree. Skips (with a warning) a directory that is
+     * one of its own ancestors.
      */
     walk(path?: string): Promise<string[]>;
+    /**
+     * Every entry under a prefix - directories as well as files - depth-first,
+     * each directory just before its contents. `walk` is this with the
+     * directories filtered out, so the two can never disagree about what is in
+     * a tree; version control uses this one because a commit records empty
+     * directories too.
+     */
+    walkEntries(path?: string): Promise<VfsStat[]>;
+    /**
+     * `walkEntries` without the list: `visit` is called with each entry in
+     * the same order, and for a file with its manifest - the handle
+     * `statManifest` gives, without resolving the path all over again, which
+     * on a deep tree cost far more than the walk itself. Null for a directory.
+     *
+     * For a caller that does not need every entry at once. Version control
+     * compares the working tree with a commit as it goes, where holding the
+     * whole walk beside the whole commit, and a map of one beside a map of
+     * the other, ran a 512MB heap out of memory inside the default budgets.
+     * The same guards and budgets as `walk`, which is built on this.
+     */
+    eachEntry(path: string, visit: (stat: VfsStat, manifest: FileManifest | null) => void): Promise<void>;
     readFile(path: string): Promise<Uint8Array>;
     readText(path: string): Promise<string>;
     /**
@@ -6170,6 +6956,16 @@ declare class VfsNamespace {
     mkdir(path: string, opts?: {
         recursive?: boolean;
     }): Promise<void>;
+    /**
+     * Refuse now what creating these directories with `mkdir -p` would refuse
+     * part way: one deeper than MAX_DEPTH, or a name on the way held by an
+     * entry this version cannot read. Writes nothing.
+     *
+     * For an operation that removes things before it writes - a checkout -
+     * so that a refusal comes before anything is gone. A FILE in the way is
+     * not refused: such an operation removes those first.
+     */
+    assertCreatable(dirs: Iterable<string>): Promise<void>;
     /**
      * Write a file, creating parent directories as needed.
      *
@@ -6183,10 +6979,10 @@ declare class VfsNamespace {
     /**
      * Delete a file, or a directory when `recursive`.
      *
-     * `keepContent` removes the entry WITHOUT releasing its shards. A checkout
-     * needs that: the file is leaving the working tree, but commits still
-     * reference the same manifest, and releasing would free content history
-     * depends on.
+     * `keepContent` removes the entry WITHOUT releasing its shards - or, for
+     * a directory, the shards of anything in it. A checkout needs that: the
+     * file is leaving the working tree, but commits still reference the same
+     * manifest, and releasing would free content history depends on.
      */
     delete(path: string, opts?: {
         recursive?: boolean;
@@ -6198,9 +6994,21 @@ declare class VfsNamespace {
      *
      * A directory move is O(1) regardless of how much is inside it — the
      * subtree records are not touched at all, because nothing in them records
-     * its own path.
+     * its own path. Except a move to a DEEPER place, which reads the subtree
+     * first: what is below must still be inside MAX_DEPTH once it is moved.
      */
     rename(from: string, to: string): Promise<void>;
+    /**
+     * Refuse to move the directory at `src` to `dst` when something in it
+     * would then be deeper than MAX_DEPTH from the root. Writes nothing.
+     *
+     * Measured only moving deeper, because it reads the whole subtree: one
+     * move of a 40-deep tree under a 30-deep directory was accepted when only
+     * the moved directory was measured, and every walk of the root threw from
+     * then on. A part that cannot be read cannot be measured, and does not
+     * stop the move - that record stops every walk above it already.
+     */
+    private assertFitsAt;
     /**
      * Copy a file or a directory tree.
      *
@@ -6262,25 +7070,158 @@ declare class VfsNamespace {
     /** Open a directory by path, creating nothing. Throws if it is missing. */
     private openDir;
     private openDirOrNull;
+    /** Open a directory by path, along with the id of every directory on the way to it. */
+    private openChain;
+    /**
+     * `path` is only for error messages. The cache is keyed by id, so when two
+     * paths reach one record - a move interrupted between attach and detach -
+     * the error names whichever asked first.
+     */
     private openDirById;
+    /**
+     * Turn a decrypted record into an OpenDir, or throw.
+     *
+     * The record is THROWN on, never read as empty, when its shape is wrong -
+     * see VfsCorruptRecordError. An individual entry of the wrong shape is set
+     * aside in `hidden` instead: out of every read, but kept for the write.
+     */
+    private readRecord;
     /** Apply an edit to a directory record and persist it. */
     private mutate;
     private createDir;
-    /** Recursively remove a subtree's records. Best-effort: unreachable ≠ fatal. */
+    /**
+     * Every directory record in a subtree, each once, opened - and nothing
+     * changed. The first half of a recursive delete; see `delete`.
+     *
+     * Once per id, so a record that references another inside the subtree
+     * cannot recurse forever, and a subtree reachable twice is not released
+     * twice. And never a directory in `above` - the root and everything else
+     * on the way down to the target - nor the root by any route. Deduplicating
+     * alone let an entry naming the root pull the whole filesystem into the
+     * delete, the root record included; a walk shows the same pointer as a
+     * cycle and skips it, so this skips it too.
+     *
+     * `moving` says whether anything in it is marked as half of an
+     * interrupted move, which is what makes a delete look for the other half.
+     */
+    private subtree;
+    /**
+     * Delete these records and let go of every file in them. The second half
+     * of a recursive delete, run only once the subtree is detached. Cannot
+     * throw: every step is best-effort, because unreachable is not fatal.
+     *
+     * With `elsewhere` - what the rest of the tree still names, read because
+     * something here is half of an interrupted move - a record still named
+     * elsewhere is kept, and so is a file.
+     */
     private purge;
+    /**
+     * Unmark what is left of an interrupted move once a delete has removed
+     * the other copy. Marked, a file keeps every version that falls off its
+     * history, because the other copy might hold it - for good, once there
+     * is no other copy - and every delete of the entry, or of a directory
+     * above it, reads the whole tree. Only when exactly one marked copy is
+     * left: more, and they are still shared. Best-effort, like everything
+     * after a detach; failing, it stays marked, which costs only that.
+     */
+    private settle;
+    /**
+     * Let go of files that are leaving the tree: each one's content, every
+     * version its history holds, and the history record. Best-effort, like
+     * everything after a detach.
+     *
+     * A file id still named elsewhere is one file with two names, left by an
+     * interrupted move: its content and history belong to the name that is
+     * staying, and all that changes hands is the key its history opens with.
+     * `keepContent` keeps every file's content and drops only its history
+     * record, as a checkout needs.
+     */
+    private letGo;
+    /**
+     * What the tree still names with one entry left out: every directory
+     * record, and every file id with a directory that holds it. Null when
+     * part of the tree cannot be read or followed, so the answer is unknown.
+     */
+    private namedElsewhere;
+    /**
+     * Everything reachable from the root: every directory record's id and
+     * key, and every file id with a directory that names it - following the
+     * entries hidden only for their name, which still reference what they
+     * point at. `skip` leaves one entry out: one about to be detached.
+     *
+     * Fetches up to WALK_CONCURRENCY records at once, each record once
+     * however often it is named. Throws VfsCorruptRecordError for a record a
+     * path reaches that cannot be read, unless `lenient`. `unknown` counts
+     * what could not be followed at all: an entry this version cannot read,
+     * and a record behind an unusable name that does not open - which no path
+     * can reach, and so no recursive delete can remove - or, `lenient`, any
+     * record that does not open.
+     */
+    private references;
     /**
      * Deep-copy an entry. Files reuse their manifest (no bytes move); each
      * directory gets a fresh id and key, so the copy is independent of the
      * original — writing into one must never appear in the other.
+     *
+     * `at` is the entry's SOURCE path, and `depth` how many directories deep
+     * from the root the copy of it will be. With `run.write` false this is the
+     * dry run: every check, no reference taken and no record stored.
      */
     private cloneEntry;
     /**
-     * Let go of a file's bytes: the current manifest and every retained
-     * version, then the history record itself.
+     * Let go of one file's bytes: its content, every version its history
+     * retains, and the history record itself.
+     *
+     * Each distinct manifest once. `copies` is every entry naming the file -
+     * two after an interrupted move, which may by now hold different
+     * versions - and `restore` puts a version back without taking a second
+     * reference, so its manifest is in the entry and in the history both.
+     * Releasing per mention released one reference twice, and so freed bytes
+     * a copy elsewhere, holding its own reference, still needed.
      */
     private releaseFile;
+    /**
+     * A file's history record, opened with the first of `keys` that opens
+     * it, and that key. Null when there is none, or none of them does.
+     */
+    private openHistory;
+    /**
+     * Seal a file's history with the key of the directory that holds it now.
+     *
+     * A history record is sealed with its directory's key, so a file moved
+     * to another directory carried a history its new directory could not
+     * open: every read of it, and every write to the file, failed from then
+     * on. Nothing to do when there is no history, when it opens with `to`
+     * already, or when none of the keys opens it.
+     */
+    private rekeyHistory;
+    /**
+     * The history of the file `entry` names as `name` in `parent`, and the
+     * key to seal it with from now on.
+     *
+     * A history is sealed with its directory's key - usually. The two halves
+     * of an interrupted move share one history, sealed with ONE of their
+     * directories' keys, and a file moved between directories by a version
+     * before `rename` re-sealed it still has its old directory's. So when the
+     * directory's own key does not open it, every key in the tree is tried,
+     * the other half's first: a read of the whole tree, and only then. It
+     * need not be read in full, or understood - an entry this version cannot
+     * follow may hide a key, but a key that opens the record is proof
+     * enough. Found, it is re-sealed with this directory's key, so the search
+     * is made once - except for half of a move, which keeps the key that
+     * opened it and so keeps working for both halves.
+     *
+     * No record, or a value that is not a sealed record at all, is an empty
+     * history, as it always was. One that no key opens is thrown on, with a
+     * message rather than a bare decryption error: writing an empty history
+     * over it would lose every version it holds.
+     */
     private readHistory;
-    /** Push `entry` onto its history record. Returns the new version count. */
+    /**
+     * Push `entry` onto its history record. Returns the new version count.
+     * `next` is the manifest the entry will hold once the caller has written
+     * it.
+     */
     private pushHistory;
 }
 
@@ -6386,21 +7327,88 @@ interface VcsNamespaceDeps {
     key: () => Promise<Uint8Array>;
     /** Who to record as the author. */
     author: () => string;
+    /**
+     * `entries` is the most tree entries one read of history may visit - one
+     * `status`, `diff` or `checkout` - and `pathChars` the most characters of
+     * path those entries may add up to. The defaults are far past any real
+     * project; tests lower them so a hostile tree hits them in milliseconds.
+     * `Client` does not pass these, so `client.vcs` always has the defaults.
+     */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 declare class Repo {
     private readonly slug;
     private readonly deps;
+    private readonly maxEntries;
+    private readonly maxPathChars;
+    /**
+     * How many directories deep below the project a tree may nest. The
+     * working tree may be written MAX_DEPTH directories below the root, and
+     * the project itself is some of those: a deeper tree would check out into
+     * something no walk will read, and `status` - and every checkout after,
+     * which walks the tree first - would throw from then on.
+     */
+    private readonly maxTreeDepth;
     constructor(slug: string, deps: VcsNamespaceDeps);
     private get root();
     /** Store an object, returning its hash and whether it was new. */
     private put;
+    /** Does this stored record open to an object with this hash? */
+    private holds;
+    /**
+     * Fetch an object, and prove it is the one that was asked for.
+     *
+     * Content addressing is only a guarantee if the address is checked. Without
+     * this a stored object could claim any hash - including its own, so a tree
+     * could contain itself and `status` would follow it for ever. Every object
+     * this repository has ever written verifies: `put` hashes exactly the value
+     * it seals, `canonical` is independent of key order and drops `undefined`
+     * exactly as JSON does, and hashing has never been versioned.
+     */
     private get;
+    /** A commit, checked to be one. See `commitProblem`. */
+    private readCommit;
+    /**
+     * Start a traversal of history: a budget shared by every branch of it, and
+     * a cache of the tree objects it has fetched.
+     *
+     * The cache matters for the same reason the budget does. Identical
+     * subtrees are one object, so a tree of honest-but-hostile shape is a
+     * handful of fetches and a vast number of paths; caching keeps it to the
+     * handful, and the budget stops the paths. It caches OBJECTS, never output
+     * - each name a shared subtree appears at is still listed.
+     */
+    private treeWalk;
+    /**
+     * A tree object's entries, checked and ready to walk.
+     *
+     * Returned in a null-prototype map, so a name like `constructor` is looked
+     * up as an entry and not found as an inherited property.
+     */
+    private readTree;
+    /**
+     * A record that is not an object - HEAD, a branch ref, the branch list,
+     * MERGE - opened. Null when there is none; `problem` when there is one
+     * that does not open. What is inside is the caller's to check.
+     */
+    private openRecord;
     private head;
     private setHead;
     private readRef;
+    /** A branch's commit, null when there is no such branch, or "unreadable". */
+    private refState;
     private writeRef;
     /** Every branch name in this repository. */
     branches(): Promise<string[]>;
+    /**
+     * The branch list, less any name a branch could not have been created
+     * with - left out with a warning, like an unreadable entry in a tree, so
+     * one planted name does not hide every real one.
+     */
+    private readIndex;
     /** The commit HEAD resolves to, or null in an empty repository. */
     current(): Promise<string | null>;
     /**
@@ -6418,7 +7426,27 @@ declare class Repo {
         theirs: string;
         name: string;
     } | null>;
-    /** Write a directory and everything under it, returning the tree's hash. */
+    /**
+     * Give up on a merge that stopped for conflicts: the next commit is an
+     * ordinary one, with one parent. The working tree is left as it is,
+     * conflict markers and all. To put it back, switch to the current branch
+     * with `discardChanges` — not `checkout`, which always leaves HEAD
+     * detached, so later commits would stop moving the branch.
+     *
+     * Also the way out when the record of the merge cannot be read, which
+     * would otherwise stop every commit.
+     */
+    abortMerge(): Promise<void>;
+    /**
+     * Write a directory and everything under it, returning the tree's hash.
+     *
+     * Reads the working tree through ONE `walkEntries`, rather than listing
+     * each directory by path and recursing. The recursion had no guard at all:
+     * a directory record that names itself - which anything holding the seed
+     * can plant - sent `commit` down /loop/loop/loop/... for ever. The walk has
+     * the cycle guard, the budget and the depth ceiling, so a commit records
+     * exactly the tree `status` compares it against.
+     */
     private writeTree;
     /** Commits reachable from HEAD, newest first. */
     log(limit?: number): Promise<LogEntry[]>;
@@ -6446,8 +7474,6 @@ declare class Repo {
      * trees for states nobody chose to keep.
      */
     status(): Promise<Change[]>;
-    /** The working tree as a path → entry map, mirroring `filesOf`. */
-    private workingFiles;
     /**
      * Turn what a person typed into a commit hash.
      *
@@ -6539,6 +7565,11 @@ interface VcsNamespaceOptions {
     /** The in-memory master seed, or null when locked. Read per call. */
     seed: () => Uint8Array | null;
     author: () => string;
+    /** See `VcsNamespaceDeps.limits`. */
+    limits?: {
+        entries?: number;
+        pathChars?: number;
+    };
 }
 
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
@@ -6646,6 +7677,12 @@ declare class Client {
     readonly message: MessageNamespace;
     /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
     readonly space: SpaceNamespace;
+    /** Trust records shared by every Space: pins and per-Space log heads (design §3.4, §6.9). */
+    readonly trust: {
+        readonly persistent: boolean;
+        unpin(username: string): Promise<void>;
+        resetSpacePins(spaceId: string): Promise<void>;
+    };
     /** Programmable Agents — `client.agents.create(appId, …)`, etc. */
     readonly agents: AgentsNamespace;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
@@ -7582,14 +8619,29 @@ declare namespace protocol {
  *   GET  /api/spaces/:id/keyring/pending        -> JoinRequest[]
  *   GET  /api/spaces/:id/keyring/roster         -> { memberId, identityEcdhPub }[]
  *   POST /api/spaces/:id/keyring/rotate         { nextEpoch } -> { epoch }
+ *   GET  /api/spaces/:id/keyring/log            ?since&limit -> { entries, head }
+ *   POST /api/spaces/:id/keyring/log            { entry, ec? } -> { ok, head }
+ *   GET  /api/spaces/:id/keyring/state          (status only)
  *   GET  /api/spaces/:id/metadata               -> SpaceMetadata
  */
 
+/** A keyring route answered non-2xx; status and JSON body preserved (the existing methods keep their plain Errors). */
+declare class KeyringHttpError extends Error {
+    readonly status: number;
+    readonly body: Record<string, unknown> | null;
+    constructor(status: number, body: Record<string, unknown> | null, route: string);
+}
 interface KeyringClientDeps {
     spaceId: string;
     httpBaseUrl: string;
     /** Header-injecting fetch from the client's HttpClient. */
     fetch: typeof fetch;
+    /**
+     * The same fetch with the HttpClient's silent 401 recovery (`HttpClient.fetchWithRecovery`).
+     * `probeState` and the log routes use it, so a 401 reads as locked only once a re-auth has failed (design §6.9).
+     * Defaults to {@link fetch}.
+     */
+    fetchWithRecovery?: typeof fetch;
 }
 declare class KeyringClient implements KeyringTransport {
     private readonly deps;
@@ -7597,6 +8649,27 @@ declare class KeyringClient implements KeyringTransport {
     private url;
     private post;
     private get;
+    /**
+     * The log routes. Sent through `fetchWithRecovery` when given, as `probeState` is, so a stale session is
+     * re-established before a 401 reads as locked (design §6.9): a GET replays safely, and a POST body is a string.
+     */
+    private request;
+    /** GET /keyring/log (design §3.6): entries with seq > since, ascending, ≤ limit; head null = no log. */
+    fetchLog(since?: number, limit?: number): Promise<{
+        entries: MembershipEntry[];
+        head: MlogHead | null;
+    }>;
+    /** POST /keyring/log {entry, ec?} → {ok, head}; `409 {error:"Log moved", head}` (no code) on a compare-and-set miss. */
+    postLogEntry(entry: MembershipEntry, ec?: EpochCommit): Promise<{
+        ok: true;
+        head: MlogHead;
+    }>;
+    /**
+     * Status of GET /keyring/state, or "network" when the request fails: 403 is not-member, 401 is locked,
+     * anything else resumes (design §6.9). Sent through `fetchWithRecovery` when given, so a stale session
+     * is re-established before a 401 is believed.
+     */
+    probeState(): Promise<number | "network">;
     postJoinRequest(req: JoinRequest): Promise<void>;
     fetchBlobs(memberId: string): Promise<WrappedKey[]>;
     postWrappedKey(targetMemberId: string, wrapped: WrappedKey, fromMemberId: string): Promise<void>;
@@ -7631,6 +8704,43 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
+/**
+ * Trust-layer errors shared by Spaces and, later, DMs (design §3.3, §6.9;
+ * SpecA §6.6). Class names are public API and are frozen at their first
+ * release (design Q16).
+ */
+/** The session holds no seed, so it has no stable identity and may not take part (design §3.3, T7). */
+declare class IdentityLockedError extends Error {
+    readonly code: "identity-locked";
+    constructor(message?: string);
+}
+/**
+ * The stable chat keys could not be loaded (design §3.3). `retryable` says
+ * whether the same call can succeed later. It is true when the vault could not
+ * be reached or written (a 5xx or a network error on `chat-keys`), which the
+ * next open retries (§9.2 I8). It is false when the saved keys were read but do
+ * not unwrap under this session's seed, because they are damaged or were saved
+ * under another seed, and when the client has no vault: retrying fails the same way.
+ */
+declare class IdentityUnavailableError extends Error {
+    readonly reason?: unknown | undefined;
+    readonly retryable: boolean;
+    readonly code: "identity-unavailable";
+    constructor(message?: string, reason?: unknown | undefined, retryable?: boolean);
+}
+type SpaceTrustCode = "integrity" | "log-conflict" | "log-refused" | "lookup-failed" | "pins-missing" | "pins-rollback" | "pins-stale" | "pins-invalid" | "pins-write-failed";
+/** A membership-log or pin failure. `detail` carries server fields (`reason`, `head`, ...). */
+declare class SpaceTrustError extends Error {
+    readonly code: SpaceTrustCode;
+    readonly detail?: Record<string, unknown> | undefined;
+    constructor(code: SpaceTrustCode, message?: string, detail?: Record<string, unknown> | undefined);
+}
+/** This user may not open this Space (design §4.5.12, V25). */
+declare class AdmissionDeniedError extends Error {
+    readonly code: "not-member" | "identity-mismatch";
+    constructor(code: "not-member" | "identity-mismatch", message?: string);
+}
+
 declare class Logger {
     private prefix;
     private logLevel;
@@ -7865,7 +8975,7 @@ declare function getId(row: {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-declare const VERSION = "0.14.0-alpha.8";
+declare const VERSION = "0.15.0-alpha.0";
 
 /**
  * The SDK's process-global logger.
@@ -7897,5 +9007,5 @@ declare global {
 }
 declare const appLogger: InstanceType<typeof Logger>;
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AdmissionState, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChatKeyCert, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, MemberView, MembershipEntry, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role$1 as Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, SpaceTrustCode, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };