@muhkoo/connect 0.14.0-alpha.9 → 0.15.0-alpha.1

package/dist/connect.d.ts

@@ -160,14 +160,14 @@ type Permission = 'read' | 'write' | 'delete' | 'admin' | 'share' | 'invite';
 /**
  * Role types
  */
-type Role = 'owner' | 'admin' | 'editor' | 'viewer' | 'member';
+type Role$1 = 'owner' | 'admin' | 'editor' | 'viewer' | 'member';
 /**
  * ACL Entry - grants permissions to a user (identified by public key)
  */
 interface ACLEntry {
     subject: string;
     permissions: Permission[];
-    role?: Role;
+    role?: Role$1;
     expiresAt?: number;
     conditions?: {
         ipAllowlist?: string[];
@@ -194,7 +194,7 @@ interface ACL {
  */
 interface Participant {
     publicKey: string;
-    role: Role;
+    role: Role$1;
     addedAt: number;
     addedBy: string;
     customPermissions?: Permission[];
@@ -434,20 +434,51 @@ interface DehydratedKeys {
     ecdsaPub: string;
     ecdsaPriv: string;
 }
+/** A member's own ECDH and ECDSA pairs, held outside the store until {@link KeyStore.replaceOwnKeyPair}. */
+interface OwnKeyPair {
+    ecdh: KeyPair;
+    ecdsa: AuthKeyPair;
+}
 declare class KeyStore {
     private static instance;
     private _keys;
     private _authKeys;
+    /** The exact pairs marked vault-backed, so a pair written over them later is never taken for them. */
+    private _vaultBacked;
     private constructor();
     static getInstance(): KeyStore;
     get keys(): Map<string, KeyPair>;
     get authKeys(): Map<string, AuthKeyPair>;
     generateOwnKeyPair(id: string): Promise<KeyPair>;
     storeRemotePublicKeys(id: string, ecdhPublicKey: CryptoKey, ecdsaPublicKey: CryptoKey): Promise<void>;
+    /** Generate an own pair without touching the store; {@link replaceOwnKeyPair} puts it in place. */
+    generateKeyPair(): Promise<OwnKeyPair>;
     hydrateKeyPair(id: string, dehydrated: DehydratedKeys): Promise<void>;
+    /** Import a dehydrated pair without touching the store; {@link replaceOwnKeyPair} puts it in place. */
+    importKeyPair(dehydrated: DehydratedKeys): Promise<OwnKeyPair>;
     getKeyPair(id: string): KeyPair | null;
     getAuthKeyPair(id: string): AuthKeyPair | null;
+    /** Record that the pair `id` holds now came from the seed-wrapped vault (ChatKeyVault). */
+    markVaultBacked(id: string): void;
+    /**
+     * Put `pair` in place as `id`'s own pair and mark it vault-backed, in one
+     * synchronous step: whatever `id` held before is dropped, so a pair minted
+     * while the vault pair was being fetched or generated is never kept and
+     * marked in its place (design §3.3).
+     */
+    replaceOwnKeyPair(id: string, pair: OwnKeyPair): void;
+    /**
+     * Whether `id`'s own pair was loaded from, or persisted to, the vault in this
+     * tab, and is still the very pair that was marked. A Space identity must be
+     * vault-backed (design §3.3): any other pair, such as one minted by a locked
+     * DM subscription, never takes part, even one that lands over the marked pair.
+     */
+    isVaultBacked(id: string): boolean;
+    /** Drop every key held for `id` (SpecA §6.4 `KeyStore.forget`). */
+    forget(id: string): void;
     dehydrateKeyPair(id: string): Promise<DehydratedKeys>;
+    /** Dehydrate a pair that is not (yet) in the store, in the same format as {@link dehydrateKeyPair}. */
+    exportKeyPair(pair: OwnKeyPair): Promise<DehydratedKeys>;
     getRawEcdsaPublicKey(id: string): Promise<Uint8Array | null>;
     packDehydratedKeys(id: string): Promise<string>;
     hydrateFromPacked(id: string, masterKey: string): Promise<void>;
@@ -522,7 +553,6 @@ declare class DoubleRatchet {
     private sessionType;
     private maxSkip;
     private overlapPeriod;
-    private windowSize;
     constructor(senderId: string, recipientId: string, sessionType: 'global' | 'specific', isClient?: boolean);
     private hkdf;
     initializeSession(isClient?: boolean): Promise<void>;
@@ -885,6 +915,8 @@ interface WSTransportOptions {
      * auto-response. Default `"pong"`.
      */
     pongFrame?: string;
+    /** A close with one of these codes is terminal: no reconnect, `DISCONNECTED` carries `{code, reason}`; `resume()` restarts. */
+    terminalCloseCodes?: number[];
 }
 declare class WSTransport extends EventCore {
     /**
@@ -917,11 +949,14 @@ declare class WSTransport extends EventCore {
     private pongFrame;
     private heartbeatTimer;
     private pongTimer;
+    private readonly terminalCloseCodes;
     constructor(opts: WSTransportOptions);
     /** Open the socket. Resolves when CONNECTED fires. Rejects on first error. */
     connect(): Promise<void>;
     /** Close the socket and stop reconnecting. */
     disconnect(): void;
+    /** Restart reconnecting after a terminal close or `disconnect()`; the next URL comes from `urlProvider`. */
+    resume(): void;
     /**
      * Send a raw frame. If currently disconnected, the frame is queued and sent
      * after the next successful reconnect (up to `maxQueueSize`).
@@ -1035,6 +1070,8 @@ declare class BroadcastChannel {
     connect(): Promise<void>;
     /** Close the WebSocket and stop reconnecting. */
     disconnect(): void;
+    /** Reconnect after a terminal close (see `terminalCloseCodes`) or `disconnect()`, on a fresh `urlProvider` URL. */
+    resume(): void;
     /**
      * Send our `keyExchange` frame to the room. Idempotent — only sends on the
      * first call. Call this once your higher-level handshake (e.g. sending a
@@ -1214,6 +1251,68 @@ declare class DoubleRatchetManager {
     private loadState;
 }
 
+/**
+ * OPRF (Oblivious PRF) — RFC 9497, ristretto255-SHA512, mode 0x00.
+ *
+ * Used to gate the password/recovery factors of the identity vault
+ * ({@link ./vault}). The wrap key for a password factor is
+ * `HKDF(OPRF(serverKey, scrypt(password)))`, so:
+ *   - the client cannot derive the wrap key offline (it needs the server's
+ *     secret-keyed evaluation), and
+ *   - the server learns nothing — it only ever sees a *blinded* group element,
+ *     never the password or the resulting key.
+ *
+ * Net effect: a stolen vault blob is NOT offline-crackable; every guess costs a
+ * round-trip to a rate-limited server endpoint. The same OPRF backs the M2
+ * Google/email factors.
+ *
+ * Thin wrapper over `@noble/curves`' vetted `ristretto255_oprf` so the protocol
+ * (blind / blindEvaluate / finalize) lives in one named place. CLIENT uses
+ * {@link oprfBlind} + {@link oprfFinalize}.
+ *
+ * The `oprfDeriveKey` / `oprfBlindEvaluate` helpers here are the SERVER half,
+ * but note they are used only by this repo's tests. The accelerator does NOT
+ * import them: it has an independent implementation in its own
+ * `src/services/oprf.ts`, also built directly on `@noble/curves`. (An earlier
+ * version of this comment claimed the accelerator's VaultDO imported them; it
+ * does not — it imports `@muhkoo/connect` in exactly two files, both for
+ * Groth16 verification.) Any protocol change therefore has to land in BOTH
+ * repos in lockstep.
+ *
+ * KNOWN WEAKNESS — mode 0x00, tracked as audit finding C4 and NOT fixed here.
+ * This uses RFC 9497 base mode: the server returns a bare evaluation with no
+ * DLEQ proof, and {@link oprfFinalize} verifies nothing. A hostile server can
+ * answer `{evaluated: blinded}` (i.e. k=1); the unblinded point is then just
+ * `H(input)` and the wrap key collapses to a pure function of public strings,
+ * destroying the offline-uncrackability guarantee stated above.
+ *
+ * The fix is `ristretto255_oprf.voprf` (mode 0x01) with the server's public key
+ * pinned as a build-time constant and the proof verified on every finalize.
+ * noble's `voprf` variant is already present and unused. It cannot be done
+ * client-side alone: the wire response (`{evaluated}` / `{evaluated, evaluated2}`)
+ * carries no proof field, and the pinned public keys must correspond to the
+ * accelerator's actual K1/K2 secrets. Changing only this file would break login
+ * against the live server.
+ */
+/**
+ * The RFC 9497 mode this client speaks, declared on every evaluation request.
+ *
+ * Declaring it is what lets the server refuse loudly instead of answering in a
+ * mode we did not ask for — the silent substitution that IS audit finding C4.
+ * A server too old to know the field drops it and answers in base mode, which is
+ * what we asked for anyway, so sending it is safe in both directions and imposes
+ * no deploy ordering.
+ *
+ * NOT to be confused with the vault's KEY VERSION, a different axis that also
+ * uses small integers: there, `2` means "per-account key". Here `2` means POPRF.
+ * The server half of these constants is `accelerator/src/services/oprf.ts` and
+ * MUST hold the same numbers.
+ */
+declare const OPRF_PROTOCOL_BASE = 0;
+/** RFC 9497 mode 0x02 — the fix for C4. Reserved; no deployment serves it yet. */
+declare const OPRF_PROTOCOL_POPRF = 2;
+type OprfProtocol = typeof OPRF_PROTOCOL_BASE | typeof OPRF_PROTOCOL_POPRF;
+
 /**
  * HTTP client for the accelerator's `/api/auth/*` endpoints.
  *
@@ -1227,6 +1326,21 @@ declare class DoubleRatchetManager {
  * (with the worker's message inlined where available).
  */
 
+/**
+ * A non-2xx response from `/api/auth/*`, carrying the HTTP status and the
+ * worker's machine-readable `code` alongside its human `error` string.
+ *
+ * Exists because the status used to be discarded: every failure arrived as a
+ * bare `Error` whose only distinguishing feature was its message, so classifying
+ * one meant regex-matching a sentence the server is free to reword. See
+ * `VaultUnavailableError`, which still does exactly that for rate limits.
+ */
+declare class AuthHttpError extends Error {
+    readonly label: string;
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(label: string, status: number, code: string | undefined, detail: string);
+}
 interface ZkRegisterRequest {
     username: string;
     /** Decimal-string Poseidon commitment. */
@@ -1306,16 +1420,24 @@ declare class AuthClient {
     verify(token: string): Promise<{
         username: string;
     }>;
-    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
-    oprfEvaluate(username: string, blinded: string): Promise<{
+    /**
+     * Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key.
+     *
+     * `oprfProtocol` declares the RFC 9497 mode this client speaks so the server
+     * can refuse rather than answer in a different one. A server too old to know
+     * the field drops it and answers in base mode, so this is safe against any
+     * deployment.
+     */
+    oprfEvaluate(username: string, blinded: string, oprfProtocol?: OprfProtocol): Promise<{
         evaluated: string;
     }>;
     /**
-     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
-     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
-     * domains' evaluations. The recover token is consumed by this call.
+     * Gated OPRF evaluation (M2 — email/google factors). Requires a live
+     * `verifyToken` from {@link emailOtpVerify}; returns BOTH keys'
+     * evaluations (K1 and K2, both operated by Muhkoo). The recover token is
+     * consumed by this call.
      */
-    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string): Promise<{
+    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string, oprfProtocol?: OprfProtocol): Promise<{
         evaluated: string;
         evaluated2: string;
     }>;
@@ -2896,6 +3018,11 @@ interface HostedAuthDeps {
     /** Sleep used by the poll loop. Injectable so tests don't burn wall-clock. */
     sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
 }
+/**
+ * A same-origin path the app may be sent back to after sign-in. It starts with
+ * "/", not "//", and has no backslash or control characters (design §4.4.9).
+ */
+declare function isSameOriginPath(p: unknown): p is string;
 /** One in-flight pairing attempt. Hold it; pass it back into poll/wait/cancel. */
 interface DevicePairingSession {
     /** Opaque; carry it back into poll/wait/cancel. Never render it. */
@@ -3048,13 +3175,15 @@ declare class HostedAuth {
      * (App side) Begin hosted login: stash a PKCE verifier + state, then send
      * the browser to the hosted authorize page. Returns the URL it redirects to
      * (also useful for popup mode / tests). `redirectUri` must be registered for
-     * the app in the portal.
+     * the app in the portal. `returnTo`, a same-origin path, rides the stash and
+     * comes back from {@link handleCallback}; anything else is refused here.
      */
     login(opts: {
         appId: string;
         redirectUri: string;
         redirect?: boolean;
         prompt?: "login";
+        returnTo?: string;
     }): Promise<string>;
     /**
      * (App side) Send the user to centralized account & security management on
@@ -3071,9 +3200,12 @@ declare class HostedAuth {
     /**
      * (App side) Complete login on the callback URL: verify state, exchange the
      * code (+ PKCE verifier) for the session, unseal the seed from the fragment,
-     * establish the session, and scrub the URL. Returns the signed-in user.
+     * establish the session, and scrub the URL. Returns the signed-in user, with
+     * the `returnTo` passed to {@link login} when it is still a same-origin path.
      */
-    handleCallback(): Promise<AuthUser>;
+    handleCallback(): Promise<AuthUser & {
+        returnTo?: string;
+    }>;
     /**
      * (Hosted-page side) Finish an /authorize request after the user has
      * authenticated here: seal the in-memory seed, mint the grant, and return
@@ -3299,6 +3431,24 @@ declare function formatUserCode(canonical: string): string;
 declare class VaultUnavailableError extends Error {
     constructor(cause?: unknown);
 }
+/**
+ * The vault refused the OPRF protocol this client speaks.
+ *
+ * Distinct from {@link VaultUnavailableError} because the remedy is different and
+ * the two used to be conflated: "unavailable" means retry, and a version mismatch
+ * never resolves by retrying — it resolves by updating the app (or the server).
+ *
+ * Critically, this must NOT be caught into the
+ * `vaultSeed ?? deriveMasterSeedFromPassword(...)` fallback in `login`/`unlock`.
+ * That fallback is correct for an account with no password factor, and wrong for
+ * a refusal: it derives a different seed, and on a legacy-migrated account —
+ * where the fallback seed happens to be the right one — it would let
+ * `migrateLegacyPasswordFactor` rewrite the factor as a side effect of a failure
+ * the user was never shown.
+ */
+declare class VaultProtocolMismatchError extends Error {
+    constructor(cause?: unknown);
+}
 /**
  * A stored device pairing that the account has since revoked.
  *
@@ -3428,15 +3578,16 @@ declare class ZkAuth {
     recoverWithPhrase(username: string, mnemonic: string, opts?: LoginOptions): Promise<AuthUser>;
     /**
      * Add an **email** as a recovery + login factor (M2 verification-gated:
-     * the server only releases the split-key OPRF eval after the address is
+     * the server only releases the gated OPRF eval after the address is
      * OTP-verified). Sends the code, then returns a `confirm` continuation:
      *
      *   const { confirm } = await client.auth.zk.enrollEmailFactor("me@x.com");
      *   await confirm(codeFromInbox);
      *
      * Requires being signed in with the seed held (like the other enrolls).
-     * Custody note: gated factors trade some custody for recoverability — the
-     * trade-off should be disclosed in the enroll UI.
+     * Custody note: Muhkoo holds the keys behind gated factors, so it can
+     * recover the seed of any account with an email or Google factor. The
+     * hosted sign-in UI discloses this; a custom enroll UI must too.
      */
     enrollEmailFactor(email: string): Promise<{
         email: string;
@@ -3445,7 +3596,7 @@ declare class ZkAuth {
     /**
      * Recover an account via its enrolled **email** factor. Sends a code to the
      * enrolled address (the response never reveals whether one exists), then
-     * `confirm(code)` completes: gated read + split-key eval → unwrap seed →
+     * `confirm(code)` completes: gated read + gated OPRF eval → unwrap seed →
      * normal ZK login. After this, call {@link changePassword} to set a new
      * password.
      *
@@ -3458,11 +3609,14 @@ declare class ZkAuth {
     /**
      * Link a Google account as a recovery + login factor. Requires being signed
      * in with the seed held. `idToken` is a fresh Google ID token (GIS).
+     * Custody note: as with {@link enrollEmailFactor}, Muhkoo holds the keys
+     * behind this factor and can recover the seed of an account that has it.
+     * The hosted sign-in UI discloses this; a custom enroll UI must too.
      */
     enrollGoogleFactor(idToken: string): Promise<void>;
     /**
      * Sign in with Google — verify the ID token, unlock the seed via the gated
-     * split-key eval, and establish a session. Same machinery serves "Sign in
+     * OPRF eval, and establish a session. Same machinery serves "Sign in
      * with Google" and "recover with Google"; the account must have linked the
      * factor first.
      */
@@ -3471,7 +3625,8 @@ declare class ZkAuth {
      * Register a brand-new, **passwordless** account whose only factor is Google.
      * A random master seed is generated and wrapped under the Google-gated key;
      * the user can add a password / passkey / phrase later. The ZK registration
-     * is identical to a password signup.
+     * is identical to a password signup. Custody note: see
+     * {@link enrollGoogleFactor} — Muhkoo can recover this account's seed.
      */
     registerWithGoogle(username: string, idToken: string): Promise<AuthUser>;
     /**
@@ -3726,9 +3881,10 @@ interface HttpClientOptions {
      * token) or `false` if it couldn't (the `401` propagates as an
      * {@link HttpError}). Wired by {@link Client} to `auth.zk.recover()`.
      *
-     * Only consulted by the JSON helpers (`get`/`post`/`del`); the raw
-     * {@link fetch} passes 401s straight through so the auth wire calls that
-     * power recovery itself can't recurse.
+     * Only consulted by the JSON helpers (`get`/`post`/`del`) and
+     * {@link HttpClient.fetchWithRecovery}; the raw {@link fetch} passes 401s
+     * straight through so the auth wire calls that power recovery itself
+     * can't recurse.
      */
     onUnauthorized?: () => Promise<boolean>;
 }
@@ -3755,6 +3911,15 @@ declare class HttpClient {
      * up credentials without knowing about them.
      */
     readonly fetch: typeof fetch;
+    /**
+     * {@link fetch} with the JSON helpers' stale-session recovery: a 401 on a
+     * request made while a session token is held runs `onUnauthorized` once
+     * and, if that recovered, replays the request once with the fresh token.
+     * The final response is returned whatever its status, never thrown. The
+     * replay re-sends `init` as given, so its body must be re-sendable (a
+     * string or bytes, not a stream).
+     */
+    readonly fetchWithRecovery: typeof fetch;
     /** True when `input` resolves to {@link baseOrigin} (relative URLs always do). */
     private isSameOrigin;
     get<T = unknown>(path: string): Promise<T>;
@@ -3919,8 +4084,9 @@ interface OfflineStore {
  * mutation by re-invoking the real namespace method (with an `isReplay` flag so
  * it doesn't re-enqueue). `drain()` replays entries in HLC order:
  *   - success → remove the entry;
- *   - permanent failure (4xx) → drop it and surface a `SYNC_ERROR` (a write the
- *     server will never accept must not wedge the queue forever);
+ *   - permanent failure (4xx, or a Space whose member list refuses this user)
+ *     → drop it and surface a `SYNC_ERROR` (a write the server will never
+ *     accept must not wedge the queue forever);
  *   - transient/network failure → stop draining and leave the rest for the next
  *     reconnect.
  *
@@ -4500,6 +4666,140 @@ declare class StorageNamespace {
     private space;
 }
 
+/**
+ * Wire types of the e2e-channels trust layer (spec 2026-09-27 §3.2, §3.5,
+ * §4.2.4, §5.3.1). These shapes are signed and stored: never rename a field.
+ *
+ * Every string field holds the exact string that was transmitted; the
+ * canonical encoders in `canonical.ts` sign those strings as they are.
+ *
+ * Ported from the accelerator's `src/trust/types.ts` (the server-only app
+ * roster types are left out); the shared shapes must stay identical.
+ */
+type Visibility = "private" | "public";
+type HistoryPolicy$1 = "static" | "rotate";
+type MemberRole = "viewer" | "editor";
+type SvcMode = "addressed" | "all";
+type MlogOp = "genesis" | "add" | "role" | "remove" | "leave" | "join" | "link" | "unlink" | "redeem" | "svc" | "retire";
+/** `legacyCommits` is `{}` for a new Space; values are b64url of 32 bytes, keys canonical decimal epochs. */
+interface GenesisBody {
+    visibility: Visibility;
+    policy: HistoryPolicy$1;
+    appId: string;
+    baseEpoch: number;
+    legacyCommits: Record<string, string>;
+}
+interface AddBody {
+    member: string;
+    memberIk: string;
+    role: MemberRole;
+}
+interface RoleBody {
+    member: string;
+    role: MemberRole;
+}
+interface RemoveBody {
+    member: string;
+}
+type LeaveBody = Record<string, never>;
+/** `via` is a linkId, or "" for no link. */
+interface JoinBody {
+    via: string;
+}
+interface LinkBody {
+    linkId: string;
+    role: MemberRole;
+    standing: boolean;
+    expiresAt: number;
+    maxUses: number;
+    linkEcdhPub: string;
+    linkSignPub: string;
+    keyCommits: Record<string, string>;
+}
+interface UnlinkBody {
+    linkId: string;
+}
+interface RedeemBody {
+    linkId: string;
+}
+interface SvcBody {
+    member: string;
+    action: "add" | "remove";
+    ecdhPub: string;
+    ecdsaPub: string;
+    mode: SvcMode;
+    rosterSeq: number;
+}
+interface RetireBody {
+    member: string;
+    reason: string;
+}
+interface MlogBodies {
+    genesis: GenesisBody;
+    add: AddBody;
+    role: RoleBody;
+    remove: RemoveBody;
+    leave: LeaveBody;
+    join: JoinBody;
+    link: LinkBody;
+    unlink: UnlinkBody;
+    redeem: RedeemBody;
+    svc: SvcBody;
+    retire: RetireBody;
+}
+interface EntryBase {
+    v: 1;
+    spaceId: string;
+    /** 0 = genesis; −1 only in an enable intent (§5.3.3), never stored. */
+    seq: number;
+    /** hash of entry seq−1; "" at genesis and in an intent. */
+    prev: string;
+    /** Signer member id; "" in a server-written `retire`. */
+    by: string;
+    /** Signer IK (b64 or hex raw P-256), exactly as sent; "" in a `retire`. */
+    ik: string;
+    /** Signer clock, informational. */
+    at: number;
+    /** b64 P1363 ECDSA-P256-SHA256 by `ik` over entryBytes; "" only in a `retire`. */
+    sig: string;
+    /** Link-sign signature over entryBytes (`link`, `redeem`, `join` with `via`). */
+    lsig?: string;
+}
+type MembershipEntry<O extends MlogOp = MlogOp> = {
+    [K in O]: EntryBase & {
+        op: K;
+        body: MlogBodies[K];
+    };
+}[O];
+type UnsignedEntry<O extends MlogOp = MlogOp> = {
+    [K in O]: Omit<MembershipEntry<K>, "sig" | "lsig">;
+}[O];
+interface ChatKeyCert {
+    v: 1;
+    ik: string;
+    ecdh: string;
+    ecdsa: string;
+    sig: string;
+}
+interface EpochCommit {
+    v: 1;
+    spaceId: string;
+    epoch: number;
+    prevKeyed: number;
+    keyCommit: string;
+    headSeq: number;
+    headHash: string;
+    sole: boolean;
+    by: string;
+    ik: string;
+    at: number;
+    sig: string;
+}
+interface MlogHead {
+    seq: number;
+    hash: string;
+}
+
 /**
  * Shared types for the Space fan-out group-encryption layer.
  *
@@ -4509,6 +4809,7 @@ declare class StorageNamespace {
  * which is what lets the server persist + replay messages as history while
  * staying blind to their contents.
  */
+
 /**
  * How a space treats history across membership changes.
  *  - `static`: one group key for all time (epoch 0). New members can read the
@@ -4556,6 +4857,8 @@ interface JoinRequest {
     /** Epoch the newcomer wants a key for (defaults to current). */
     desiredEpoch?: number;
     ts?: number;
+    /** The account IK's certificate over the two identity strings above (design §3.2). Optional: a join never requires one. */
+    keyCert?: ChatKeyCert;
 }
 /** A space member's published identity keys (the keyring directory). */
 interface RosterMember {
@@ -4710,6 +5013,18 @@ interface KeyringTransport {
     /** Add `username` to a private channel's membership allowlist. */
     invite(username: string): Promise<void>;
     fetchMetadata(): Promise<SpaceMetadata | null>;
+    /** GET /keyring/log (design §3.6): entries with seq > since, ascending, ≤ limit; head null = no log. */
+    fetchLog?(since?: number, limit?: number): Promise<{
+        entries: MembershipEntry[];
+        head: MlogHead | null;
+    }>;
+    /** POST /keyring/log {entry, ec?}. */
+    postLogEntry?(entry: MembershipEntry, ec?: EpochCommit): Promise<{
+        ok: true;
+        head: MlogHead;
+    }>;
+    /** Status of GET /keyring/state, or "network" when the request fails. */
+    probeState?(): Promise<number | "network">;
 }
 /** PersonalSpace-backed cache of this member's group keys (epoch → base64 key). */
 interface SpaceKeyCache {
@@ -4729,6 +5044,10 @@ interface SpaceKeyringDeps {
     transport: KeyringTransport;
     cache?: SpaceKeyCache;
     historyPolicy?: HistoryPolicy;
+    /** Mints the IK certificate for this member's chat keys (design §3.2). Absent, or resolving undefined, means none. */
+    keyCert?: () => Promise<ChatKeyCert | undefined>;
+    /** Whether a key may be wrapped to `memberId`; absent means anyone. On a signed Space: log members and the keeper only. */
+    canWrapTo?: (memberId: string) => boolean;
 }
 declare class SpaceKeyring implements EpochKeyProvider {
     private readonly deps;
@@ -4745,7 +5064,11 @@ declare class SpaceKeyring implements EpochKeyProvider {
      *  this window won't re-fetch (the roster hasn't changed that fast); genuine
      *  membership changes use `{ force: true }` (join requests / history loads). */
     private static readonly DIR_COOLDOWN_MS;
+    private readonly keyListeners;
     constructor(deps: SpaceKeyringDeps);
+    /** Notified whenever this keyring gains a key (bootstrap, cache hit, pull). Returns an unsubscribe. */
+    onKeysChanged(h: () => void): () => void;
+    private notifyKeys;
     /** The cached ECDSA verify key for a member, if known. */
     ecdsaKeyFor(memberId: string): CryptoKey | undefined;
     /**
@@ -4763,6 +5086,10 @@ declare class SpaceKeyring implements EpochKeyProvider {
     currentEpoch(): number;
     keyForEpoch(epoch: number): Uint8Array | undefined;
     hasAnyKey(): boolean;
+    /** The raw 32-byte group key for `epoch`, for its key commitment (design §4.2.4). */
+    rawKey(epoch: number): Uint8Array | undefined;
+    /** Whether a key may be wrapped to `memberId` (design §4.5.1: on a signed Space, log members and the keeper only). */
+    canWrapTo(memberId: string): boolean;
     /** Hydrate keys from the PersonalSpace cache, if available. Best-effort —
      * a cache miss/failure (e.g. not unlocked) must not block joining. */
     loadFromCache(): Promise<boolean>;
@@ -4772,7 +5099,8 @@ declare class SpaceKeyring implements EpochKeyProvider {
     /**
      * Post a join request so an online key-holder can wrap a key for us. Also
      * publishes our identity keys in the member directory (so others can verify
-     * our message signatures, and the keeper can wrap to us).
+     * our message signatures, and the keeper can wrap to us). With a `keyCert`
+     * dep it also carries the IK certificate over exactly those two strings.
      */
     requestKey(desiredEpoch?: number): Promise<void>;
     /**
@@ -4810,6 +5138,124 @@ declare class SpaceKeyring implements EpochKeyProvider {
     invite(username: string): Promise<void>;
 }
 
+type Role = "owner" | "editor" | "viewer";
+interface LogMember {
+    id: string;
+    ik: string;
+    role: Role;
+    since: number;
+}
+
+/** What LogSync needs from core (kept structural so spaces/ never imports core/). */
+interface LogSyncDeps {
+    spaceId: string;
+    me: () => string;
+    appId: () => Promise<string>;
+    commitment: () => string | null;
+    transport: {
+        fetchLog(since?: number, limit?: number): Promise<{
+            entries: MembershipEntry[];
+            head: MlogHead | null;
+        }>;
+        postLogEntry(entry: MembershipEntry, ec?: EpochCommit): Promise<{
+            head: MlogHead;
+        }>;
+    };
+    signer: {
+        sign(b: Uint8Array): Promise<string>;
+        identityKeyRaw(): Promise<string>;
+    };
+    directory: {
+        lookup(username: string): Promise<string>;
+    };
+    pins: {
+        get(doc: "identity" | "spaces", key: string): Promise<string | undefined>;
+        pin(doc: "identity" | "spaces", entries: Record<string, string>): Promise<{
+            conflicts: string[];
+        }>;
+    };
+    store: () => Promise<{
+        get<T>(k: string): Promise<T | undefined>;
+        put(k: string, v: unknown): Promise<void>;
+    }>;
+}
+interface MemberView {
+    id: string;
+    role: Role;
+    ik: string;
+    fingerprint: string;
+    identityChanged: boolean;
+}
+type IntegrityState = {
+    broken: false;
+} | {
+    broken: true;
+    reason: string;
+};
+/**
+ * One Space's membership log, as this client has verified it (design §3.6–§3.7).
+ * Syncs the whole log from −1 on each call (slice logs are tiny, so no entry
+ * cache), checks the head against the high-water mark kept in `muhkoo.trust`,
+ * checks the genesis against the pins (TOFU against the directory the first
+ * time), and pins every IK a verified `add` names (design §3.4).
+ */
+declare class LogSync {
+    private readonly deps;
+    private log;
+    private enabled;
+    private integrityState;
+    private changed;
+    private fps;
+    private listeners;
+    private timer;
+    private running;
+    private followUp;
+    constructor(deps: LogSyncDeps);
+    get logEnabled(): boolean;
+    get integrity(): IntegrityState;
+    get signer(): LogSyncDeps["signer"];
+    get directory(): LogSyncDeps["directory"];
+    member(id: string): LogMember | undefined;
+    isMember(id: string): boolean;
+    members(): MemberView[];
+    onChange(h: () => void): () => void;
+    /**
+     * An `mlog` frame marks the log stale; sync once a burst of frames settles.
+     * A failure is logged with its code and reported through `onChange`, never
+     * thrown; integrity is left as it was, and the next frame or open retries.
+     */
+    scheduleSync(): void;
+    private hwKey;
+    /** Whether this client holds a high-water mark for this Space, i.e. has verified its log before (design §3.7 item 3). */
+    hasHighWater(): Promise<boolean>;
+    /**
+     * Fetch and verify the whole log. Single-flight: a call made while a sync
+     * runs does not start a second one alongside it. It waits for exactly one
+     * follow-up run, which starts once the running one ends, so it sees whatever
+     * prompted the call; every call made in the meantime shares that follow-up.
+     */
+    sync(): Promise<void>;
+    private startSync;
+    private runSync;
+    /** Genesis trust (design §3.7 item 2): the pinned genesis hash, else TOFU with the owner's IK checked against the directory. */
+    private checkGenesis;
+    /** "s:" + b64url(SHA-256(utf8(spaceId))), the spaces-v1 key; computed exactly as PinStore.spacePinKey, which this layer may not import. */
+    private spacePinKey;
+    /** Pin every IK a verified add names (design §3.4 row 2); a different pinned IK flags the member (identity-changed). */
+    private pinMembers;
+    /**
+     * Sign and append one entry. On `409 Log moved`: re-sync, re-sign against the
+     * new head and retry, at most 3 times with jitter (design §9.2 I9). Nothing is
+     * signed while integrity is broken, including after a re-sync that breaks it.
+     * Any other refusal → SpaceTrustError("log-refused") carrying the server's code and reason.
+     * Once the server has stored the entry, its `{seq}` is returned even if the sync confirming it fails.
+     */
+    append(op: MembershipEntry["op"], body: Record<string, unknown>, ec?: (hash: string, entry: UnsignedEntry) => Promise<EpochCommit>): Promise<{
+        seq: number;
+    }>;
+    private emit;
+}
+
 /**
  * `Space` — a client handle for one shared space.
  *
@@ -4927,6 +5373,11 @@ interface EphemeralEvent {
 interface MessageDeletedEvent {
     handle: number;
 }
+type AdmissionState = "locked" | "requesting" | "keyed" | "not-member" | "identity-mismatch" | "integrity";
+/** WebSocket close code for a refused private-Space socket (design §3.6; accelerator NOT_MEMBER_CLOSE_CODE). */
+declare const NOT_MEMBER_CLOSE_CODE = 4403;
+/** At most one resume after a 4403 per Space per this interval (design §6.7). */
+declare const NOT_MEMBER_RECHECK_MS = 60000;
 interface SpaceDeps {
     /** Transport room id. For fan-out spaces this is the encoded space pubkey. */
     name: string;
@@ -4961,6 +5412,21 @@ interface SpaceDeps {
     deferShardUpload?: (hash: string) => Promise<void>;
     /** Offline message cache + send queue. Undefined ⇒ no offline behavior. */
     offline?: SpaceOfflineAdapter;
+    /** Locked session (design §3.3): no keyring, never connects; the app re-opens after sign-in. */
+    locked?: boolean;
+    /** The Space's membership log (a signed private Space), when this client has trust wired. */
+    logSync?: LogSync;
+    /** Visibility the Space was created with; only a private Space gets a genesis (design §3.8). */
+    visibility?: "private" | "public";
+    /** This app's id, which a genesis names (design §3.5). */
+    appId?: () => Promise<string>;
+    /**
+     * Status of GET /keyring/state after the client's silent 401 recovery, or "network": asked after a
+     * 4403 close before believing it (design §6.9).
+     */
+    probeState?: () => Promise<number | "network">;
+    /** True while the session holds a token, so a reconnect must never go ticketless. */
+    hasSession?: () => boolean;
 }
 /** The subset of {@link BroadcastChannel} a {@link Space} drives. */
 interface SpaceChannelLike {
@@ -4973,13 +5439,22 @@ interface SpaceChannelLike {
     sendRaw(frame: unknown): void;
     peers?(): string[];
     isConnected?(): boolean;
+    /** Reconnect after a terminal close, on a fresh URL. */
+    resume?(): void;
 }
 declare class Space {
     private readonly deps;
     readonly name: string;
     readonly historyPolicy: HistoryPolicy;
     private channel;
-    private readonly pending;
+    /**
+     * The log turned this user away and closed `channel` (design §3.7). Its
+     * single-use ticket is spent, so it is never dialled again: the next
+     * `connect()` checks the log and opens a new channel on a fresh ticket.
+     */
+    private channelSpent;
+    /** Every raw channel listener (`on`), attached to each channel this Space opens. */
+    private readonly listeners;
     private readonly cipher;
     /** Per-instance event bus for fan-out events (isolated across spaces). */
     private readonly events;
@@ -4987,12 +5462,52 @@ declare class Space {
     private catchUpUnsub;
     /** Optional P2P swarm for this Space (block exchange among members). */
     private peerNet;
+    private _admission;
+    /** Whether admission follows the log's changes yet (subscribed once, on the first open the log admits). */
+    private admissionWired;
+    /** When the last resume after a 4403 ran (design §6.7: at most one per {@link NOT_MEMBER_RECHECK_MS}). */
+    private lastResumeAt;
+    private resumeTimer;
+    /** Bumped by `disconnect()`: a /keyring/state answer that arrives after it is dropped. */
+    private teardowns;
     constructor(deps: SpaceDeps);
     /** The encoded space id (same as the transport name for fan-out spaces). */
     get id(): string;
     /** The keyring backing this space's group keys, if any. */
     get keyring(): SpaceKeyring | undefined;
-    /** Open the space websocket (resolves the ticket + identity lazily). */
+    /** Where this member stands in this Space (design §4.5.12, as the slice ships it). */
+    get admission(): AdmissionState;
+    /** Subscribe to admission changes. Returns an unsubscribe. */
+    onAdmission(h: (s: AdmissionState) => void): () => void;
+    protected setAdmission(s: AdmissionState): void;
+    /** The log turned this user away; nothing reconnects until it admits them again. */
+    private denied;
+    /**
+     * Sync the membership log and derive admission from it, before any ticket
+     * (design §3.4, §3.7, §4.5.12). A 403 from the log route is not-member and a
+     * 401 is locked. Any other failure is fatal only where this client has
+     * verified the log before (it holds a high-water mark). Otherwise the Space
+     * opens as unlogged this time, and the next open or `mlog` frame syncs again.
+     */
+    private admitByLog;
+    /** Re-derive admission from the verified log (design §3.4 rows, §3.7, §4.5.12). */
+    private evaluateAdmission;
+    /**
+     * A 4403 alone never shows not-member: ask /keyring/state first (design §6.9, AV12).
+     * 403 is not-member and 401, which `probeState` returns only once a silent re-auth has failed, is
+     * locked; either closes the channel for good, like a log refusal. Any
+     * other answer (404 while step I has no state route, 2xx, 5xx, a network error) resumes, at most
+     * once per {@link NOT_MEMBER_RECHECK_MS}.
+     */
+    private onNotMemberClose;
+    /** Close the socket of a user the log turned away, and never dial that channel again (design §3.7). */
+    private dropChannel;
+    /**
+     * Open the space websocket (resolves the ticket + identity lazily). On a
+     * Space with a membership log, the log is checked first: a user it does not
+     * list, or lists under another identity key, is refused with
+     * {@link AdmissionDeniedError} before any ticket is fetched (design §4.5.12).
+     */
     connect(): Promise<void>;
     disconnect(): void;
     /** Attach a P2P swarm so this Space's file reads/writes can use peers. */
@@ -5008,7 +5523,7 @@ declare class Space {
     gossipToPeers(data: Uint8Array): void;
     /** Subscribe to peer gossip ({@link gossipToPeers}). Returns an unsubscribe fn. */
     onPeerGossip(handler: (from: string, data: Uint8Array) => void): () => void;
-    /** Subscribe to a raw channel event. Buffered until `connect()` if early. */
+    /** Subscribe to a raw channel event. Buffered until `connect()` if early, and kept across a new channel. */
     on(event: string, handler: Listener): void;
     off(event: string, handler: Listener): void;
     /** Advertise our keyExchange to the room (idempotent per connection). */
@@ -5092,7 +5607,7 @@ declare class Space {
         timeoutMs?: number;
         pollMs?: number;
     }): Promise<boolean>;
-    /** Creator path: mint the initial group key, then connect. */
+    /** Creator path: mint epoch 0; for a private Space, sign the genesis + ec(0) BEFORE connecting (design §4.5.10). */
     create(): Promise<void>;
     /** Wrap the group key for a newcomer and post it (key-holder action). */
     admit(memberId: string, identityEcdhPub: string): Promise<void>;
@@ -5103,6 +5618,29 @@ declare class Space {
         memberId: string;
         identityEcdhPub: string;
     }>): Promise<number>;
+    /** Whether this Space has a verified membership log. */
+    get logEnabled(): boolean;
+    /** The verified member list, or null when this Space has no log. */
+    membership(): MemberView[] | null;
+    /** Called with the member list (null when unlogged) each time the log is re-synced. Returns an unsubscribe. */
+    onMembership(h: (m: MemberView[] | null) => void): () => void;
+    private requireLog;
+    /** Add by exact username (design §3.8; the owner, or an editor for viewers). Looks the IK up in the directory. */
+    add(username: string, opts?: {
+        role?: "viewer" | "editor";
+    }): Promise<{
+        seq: number;
+    }>;
+    /** Remove a member. In this build it cuts them off at the relay; it does not rotate the key. */
+    remove(memberId: string): Promise<{
+        seq: number;
+    }>;
+    setRole(memberId: string, role: "viewer" | "editor"): Promise<{
+        seq: number;
+    }>;
+    leave(): Promise<{
+        seq: number;
+    }>;
     putFile(file: File | Blob | Uint8Array, metadata: SpaceFileMetadata, opts?: {
         onProgress?: (completed: number, total: number) => void;
         /**
@@ -5295,19 +5833,27 @@ declare class ChatKeyVault {
     private readonly store;
     constructor(store: ChatKeyStore);
     /**
-     * Register-time: ensure a keypair exists for `memberId`, seed-wrap the
-     * dehydrated form, and persist it to the personal space. Idempotent — reuses
-     * an existing in-tab keypair rather than minting a second one.
+     * Register-time: ensure a vault-backed keypair exists for `memberId`,
+     * seed-wrap it and persist it. Idempotent for a pair that is already
+     * vault-backed. Otherwise a fresh pair is generated, persisted, and only
+     * then swapped in, replacing whatever the tab held: a throwaway key is never
+     * persisted as the stable one, and a failed persist leaves the tab's keys
+     * as they were, with nothing marked.
      */
     provision(memberId: string, seedSecret: string): Promise<void>;
     /**
-     * Sign-in / unlock time: fetch the wrapped blob, unwrap with the seed, and
-     * hydrate the `KeyStore` — restoring the SAME keypair the member had before.
-     * Returns `true` when a keypair is now in hand (already present or hydrated),
-     * `false` when there's no blob yet (a brand-new member → caller provisions).
-     * Throws only on a genuine unwrap failure (wrong secret / tampered blob).
+     * Sign-in / unlock time: fetch the wrapped blob, unwrap it with the seed, and
+     * hydrate the `KeyStore`, restoring the SAME keypair the member had before.
+     * Returns `true` when a vault-backed keypair is now in hand, and `false` when
+     * there is no blob yet (a brand-new member; the caller provisions). A store
+     * failure propagates as thrown; a blob that does not unwrap, parse or import
+     * throws `ChatKeysUnreadableError`. Nothing in the `KeyStore` changes until
+     * the saved pair is imported; it then replaces whatever pair the tab held,
+     * in one step, so a pair minted meanwhile is never kept in its place.
      */
     rehydrate(memberId: string, seedSecret: string): Promise<boolean>;
+    /** Unwrap, parse and import a saved pair, outside the `KeyStore`. */
+    private unwrapPair;
     /**
      * Ensure a stable keypair is in hand: rehydrate from the vault if a blob
      * exists, otherwise mint one and persist it (so it's stable next session).
@@ -5316,6 +5862,101 @@ declare class ChatKeyVault {
     ensure(memberId: string, seedSecret: string): Promise<void>;
 }
 
+/**
+ * POST /api/auth/identity (SpecA §4.1 as amended by CS-7). An unknown name
+ * answers a deterministic decoy, so a lookup never says whether an account
+ * exists. Responses are cached for the life of the Client. Any failure,
+ * including a 429, fails closed (SpecA §4.3).
+ */
+declare class IdentityDirectory {
+    private readonly http;
+    private readonly cache;
+    constructor(http: Pick<HttpClient, "post">);
+    lookup(username: string): Promise<string>;
+    lookupMany(usernames: string[]): Promise<Record<string, string>>;
+}
+
+/** Signs with the account identity key (IK). Never exposes the seed (SpecA §6.1). */
+interface IdentitySigner {
+    /** b64 IEEE-P1363 ECDSA-P256-SHA256 over `bytes`. */
+    sign(bytes: Uint8Array): Promise<string>;
+    /** The IK as standard padded base64 of the raw 65-byte point. */
+    identityKeyRaw(): Promise<string>;
+}
+
+/**
+ * IndexedDB `muhkoo.trust` (design §6.6): pin high-water marks and per-Space log
+ * heads. When IndexedDB is absent, throws on open, or has not opened within 2 s,
+ * it is an in-memory store for the life of the Client, and `persistent` is
+ * false (KI1).
+ */
+interface TrustStore {
+    readonly persistent: boolean;
+    get<T>(key: string): Promise<T | undefined>;
+    put(key: string, value: unknown): Promise<void>;
+    del(key: string): Promise<void>;
+}
+
+type PinDocName = "identity" | "spaces";
+interface PinDoc {
+    v: 1;
+    ownerCommitment: string;
+    counter: number;
+    entries: Record<string, string>;
+    sig: string;
+}
+interface PinStoreDeps {
+    http: Pick<HttpClient, "post">;
+    commitment: () => string | null;
+    signer: IdentitySigner;
+    store: () => Promise<TrustStore>;
+}
+declare class PinStore {
+    private readonly deps;
+    constructor(deps: PinStoreDeps);
+    private commitment;
+    private markKey;
+    private kvPath;
+    private fetchDoc;
+    private verify;
+    /** The current verified document; an empty bootstrap at counter 0 when none exists and no mark does either. */
+    read(doc: PinDocName): Promise<PinDoc>;
+    get(doc: PinDocName, key: string): Promise<string | undefined>;
+    /** Pin new keys. A key already pinned to a different value is reported, never overwritten (design §3.4). */
+    pin(doc: PinDocName, entries: Record<string, string>): Promise<{
+        conflicts: string[];
+    }>;
+    unpin(doc: PinDocName, keys: string[]): Promise<void>;
+    /** User-confirmed recovery (design §9.1 "Your saved trust records are missing."): forget the high-water mark. */
+    resetMark(doc: PinDocName): Promise<void>;
+    private mutate;
+}
+
+/** One per Client: shared by every Space (and, in sub-project 4, DMs). */
+declare class TrustContext {
+    private readonly deps;
+    readonly directory: IdentityDirectory;
+    readonly signer: IdentitySigner;
+    readonly pins: PinStore;
+    private storeP;
+    private opened;
+    private appIdP;
+    constructor(deps: {
+        http: HttpClient;
+        session: SessionState;
+        openStore?: () => Promise<TrustStore>;
+    });
+    /** Whether muhkoo.trust survives a restart (KI1): false until the open settles, and false for an in-memory store. */
+    get persistent(): boolean;
+    store(): Promise<TrustStore>;
+    /** This app's id, from GET /api/app/trust (a genesis must name it, D4). Cached; a failure is retried next call. */
+    appId(): Promise<string>;
+    /** User-confirmed "Reset trust for this space" (design §9.1): drop its genesis pin and log high-water. */
+    resetSpacePins(spaceId: string): Promise<void>;
+    /** `client.trust.unpin(username)`: forget a member's pinned identity after comparing safety numbers (design §3.4). */
+    unpinUser(username: string): Promise<void>;
+}
+
 /**
  * `client.space` — the fan-out group-encryption surface.
  *
@@ -5354,6 +5995,9 @@ interface SpaceNamespaceDeps {
     /** SDK-owned ratchet-keypair vault — gives a STABLE member keypair across
      *  reloads (rehydrate-or-provision) instead of a fresh one each session. */
     chatKeys?: ChatKeyVault;
+    /** The Client's trust context. Present, every join request carries the IK
+     *  certificate over this member's chat keys (design §3.2). */
+    trust?: TrustContext;
     /** P2P swarm config — enables peer block exchange among Space members. */
     p2p?: {
         enabled?: boolean;
@@ -5369,6 +6013,10 @@ declare class SpaceNamespace {
     private spaceCache?;
     /** Spaces built this session, by id — used to route offline send replays. */
     private readonly openSpaces;
+    /** In-flight identity loads, by member id; each entry is deleted once it settles. */
+    private readonly identityInFlight;
+    /** Chat-key certificates, by member and the exact key strings; a failed mint is dropped so the next join retries. */
+    private readonly certs;
     /** Unique id for THIS device/session — the P2P peer identity. A user's own
      *  devices share a member id, so the mesh MUST distinguish them by this or a
      *  device treats its siblings' signals as its own echo and never connects. */
@@ -5397,8 +6045,14 @@ declare class SpaceNamespace {
     joinSpace(spaceId: string, opts?: {
         timeoutMs?: number;
     }): Promise<Space>;
-    /** A handle to a space without auto-connecting (uses cached keys on demand). */
-    get(spaceId: string, historyPolicy?: HistoryPolicy): Promise<Space>;
+    /**
+     * A handle to a space without auto-connecting (uses cached keys on demand).
+     * `messaging: false` opens a files-only space, as {@link createSpace} makes:
+     * no keyring and no identity, so it opens whether or not the session is locked.
+     */
+    get(spaceId: string, historyPolicy?: HistoryPolicy, opts?: {
+        messaging?: boolean;
+    }): Promise<Space>;
     /** List this app's channels (name → space-id) for the key's environment. */
     listChannels(): Promise<Array<{
         name: string;
@@ -5457,8 +6111,22 @@ declare class SpaceNamespace {
     }>>;
     private keyringFor;
     private build;
-    /** Ensure the member has an identity keypair; return its public ECDH + ECDSA keys. */
+    /**
+     * The member's stable chat identity (design §3.3). A locked session (no
+     * seed) throws `IdentityLockedError`. A vault failure throws
+     * `IdentityUnavailableError`: `retryable` when the vault could not be
+     * reached (§9.2 I8), and not when the saved keys do not unwrap under this
+     * seed. A throwaway pair is never minted: doing so is what hid a reloaded
+     * member's earlier messages from everyone else.
+     *
+     * Concurrent calls for one member share a single load, so two first opens
+     * can never interleave their forget/generate steps and persist a second or
+     * mixed pair.
+     */
     private ensureIdentity;
+    private loadIdentity;
+    /** One certificate per (member, chat keys) for the life of the Client (design §3.2: global, not per Space). */
+    private certFor;
     private fetchPolicy;
     private fetchTicket;
     private myId;
@@ -6089,6 +6757,8 @@ interface VfsContentStore {
     write(data: Uint8Array | Blob, meta: {
         name: string;
         type: string;
+    }, opts?: {
+        onProgress?: (done: number, total: number) => void;
     }): Promise<{
         manifest: FileManifest;
         size: number;
@@ -6149,6 +6819,18 @@ declare class VfsNamespace {
      * than by TTL — a stale directory listing shows files that are not there.
      */
     private cache;
+    /**
+     * The write of each directory record still in flight, by id.
+     *
+     * Two writes of one record must land in the order they were made. The
+     * personal space has no compare-and-swap: of two writes of one key that
+     * are in flight together it keeps whichever request finishes last, and
+     * that is often the one sent first. Then the earlier write, sealed before
+     * the later edit was made, undoes it. That is how a file deleted forever
+     * from the Trash, while the move that put it there was still being
+     * written, came back. So each write waits for the one before it.
+     */
+    private readonly writing;
     private readonly historyLimit;
     private readonly maxEntries;
     private readonly maxPathChars;
@@ -6307,6 +6989,7 @@ declare class VfsNamespace {
      */
     writeFile(path: string, data: Uint8Array | string | Blob, opts?: {
         type?: string;
+        onProgress?: (done: number, total: number) => void;
     }): Promise<VfsStat>;
     /**
      * Delete a file, or a directory when `recursive`.
@@ -6420,6 +7103,14 @@ declare class VfsNamespace {
     private readRecord;
     /** Apply an edit to a directory record and persist it. */
     private mutate;
+    /**
+     * Seal a directory record as it stands NOW and put it in the store.
+     *
+     * Read at the moment of sending, not when the edit was made, so a write
+     * that waited behind another carries every edit made to the record by
+     * then, its own included.
+     */
+    private writeRecord;
     private createDir;
     /**
      * Every directory record in a subtree, each once, opened - and nothing
@@ -7009,6 +7700,12 @@ declare class Client {
     readonly message: MessageNamespace;
     /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
     readonly space: SpaceNamespace;
+    /** Trust records shared by every Space: pins and per-Space log heads (design §3.4, §6.9). */
+    readonly trust: {
+        readonly persistent: boolean;
+        unpin(username: string): Promise<void>;
+        resetSpacePins(spaceId: string): Promise<void>;
+    };
     /** Programmable Agents — `client.agents.create(appId, …)`, etc. */
     readonly agents: AgentsNamespace;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
@@ -7945,14 +8642,29 @@ declare namespace protocol {
  *   GET  /api/spaces/:id/keyring/pending        -> JoinRequest[]
  *   GET  /api/spaces/:id/keyring/roster         -> { memberId, identityEcdhPub }[]
  *   POST /api/spaces/:id/keyring/rotate         { nextEpoch } -> { epoch }
+ *   GET  /api/spaces/:id/keyring/log            ?since&limit -> { entries, head }
+ *   POST /api/spaces/:id/keyring/log            { entry, ec? } -> { ok, head }
+ *   GET  /api/spaces/:id/keyring/state          (status only)
  *   GET  /api/spaces/:id/metadata               -> SpaceMetadata
  */
 
+/** A keyring route answered non-2xx; status and JSON body preserved (the existing methods keep their plain Errors). */
+declare class KeyringHttpError extends Error {
+    readonly status: number;
+    readonly body: Record<string, unknown> | null;
+    constructor(status: number, body: Record<string, unknown> | null, route: string);
+}
 interface KeyringClientDeps {
     spaceId: string;
     httpBaseUrl: string;
     /** Header-injecting fetch from the client's HttpClient. */
     fetch: typeof fetch;
+    /**
+     * The same fetch with the HttpClient's silent 401 recovery (`HttpClient.fetchWithRecovery`).
+     * `probeState` and the log routes use it, so a 401 reads as locked only once a re-auth has failed (design §6.9).
+     * Defaults to {@link fetch}.
+     */
+    fetchWithRecovery?: typeof fetch;
 }
 declare class KeyringClient implements KeyringTransport {
     private readonly deps;
@@ -7960,6 +8672,27 @@ declare class KeyringClient implements KeyringTransport {
     private url;
     private post;
     private get;
+    /**
+     * The log routes. Sent through `fetchWithRecovery` when given, as `probeState` is, so a stale session is
+     * re-established before a 401 reads as locked (design §6.9): a GET replays safely, and a POST body is a string.
+     */
+    private request;
+    /** GET /keyring/log (design §3.6): entries with seq > since, ascending, ≤ limit; head null = no log. */
+    fetchLog(since?: number, limit?: number): Promise<{
+        entries: MembershipEntry[];
+        head: MlogHead | null;
+    }>;
+    /** POST /keyring/log {entry, ec?} → {ok, head}; `409 {error:"Log moved", head}` (no code) on a compare-and-set miss. */
+    postLogEntry(entry: MembershipEntry, ec?: EpochCommit): Promise<{
+        ok: true;
+        head: MlogHead;
+    }>;
+    /**
+     * Status of GET /keyring/state, or "network" when the request fails: 403 is not-member, 401 is locked,
+     * anything else resumes (design §6.9). Sent through `fetchWithRecovery` when given, so a stale session
+     * is re-established before a 401 is believed.
+     */
+    probeState(): Promise<number | "network">;
     postJoinRequest(req: JoinRequest): Promise<void>;
     fetchBlobs(memberId: string): Promise<WrappedKey[]>;
     postWrappedKey(targetMemberId: string, wrapped: WrappedKey, fromMemberId: string): Promise<void>;
@@ -7994,6 +8727,43 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
+/**
+ * Trust-layer errors shared by Spaces and, later, DMs (design §3.3, §6.9;
+ * SpecA §6.6). Class names are public API and are frozen at their first
+ * release (design Q16).
+ */
+/** The session holds no seed, so it has no stable identity and may not take part (design §3.3, T7). */
+declare class IdentityLockedError extends Error {
+    readonly code: "identity-locked";
+    constructor(message?: string);
+}
+/**
+ * The stable chat keys could not be loaded (design §3.3). `retryable` says
+ * whether the same call can succeed later. It is true when the vault could not
+ * be reached or written (a 5xx or a network error on `chat-keys`), which the
+ * next open retries (§9.2 I8). It is false when the saved keys were read but do
+ * not unwrap under this session's seed, because they are damaged or were saved
+ * under another seed, and when the client has no vault: retrying fails the same way.
+ */
+declare class IdentityUnavailableError extends Error {
+    readonly reason?: unknown | undefined;
+    readonly retryable: boolean;
+    readonly code: "identity-unavailable";
+    constructor(message?: string, reason?: unknown | undefined, retryable?: boolean);
+}
+type SpaceTrustCode = "integrity" | "log-conflict" | "log-refused" | "lookup-failed" | "pins-missing" | "pins-rollback" | "pins-stale" | "pins-invalid" | "pins-write-failed";
+/** A membership-log or pin failure. `detail` carries server fields (`reason`, `head`, ...). */
+declare class SpaceTrustError extends Error {
+    readonly code: SpaceTrustCode;
+    readonly detail?: Record<string, unknown> | undefined;
+    constructor(code: SpaceTrustCode, message?: string, detail?: Record<string, unknown> | undefined);
+}
+/** This user may not open this Space (design §4.5.12, V25). */
+declare class AdmissionDeniedError extends Error {
+    readonly code: "not-member" | "identity-mismatch";
+    constructor(code: "not-member" | "identity-mismatch", message?: string);
+}
+
 declare class Logger {
     private prefix;
     private logLevel;
@@ -8228,7 +8998,7 @@ declare function getId(row: {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-declare const VERSION = "0.14.0-alpha.9";
+declare const VERSION = "0.15.0-alpha.1";
 
 /**
  * The SDK's process-global logger.
@@ -8260,5 +9030,5 @@ declare global {
 }
 declare const appLogger: InstanceType<typeof Logger>;
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AdmissionState, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChatKeyCert, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, MemberView, MembershipEntry, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role$1 as Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, SpaceTrustCode, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };