@muhkoo/connect 0.3.0-alpha.0 → 0.4.0-alpha.1

package/README.md

@@ -1,12 +1,16 @@
 # @muhkoo/connect
 
 Client SDK for the Muhkoo Accelerator. The headline surface is a single
-**`Client`** that hangs everything off four namespaces —
-`client.auth` / `client.storage` / `client.message` / `client.space` — backed by
-end-to-end-encrypted messaging (fan-out group channels with history, plus
-Double Ratchet + ECDH P-384 for direct messages), ZK identity + personal/shared
-spaces, and a Cloudflare-Workers-compatible Groth16 verifier — all bundled from
-a single TypeScript source tree.
+**`Client`** that hangs everything off its namespaces —
+`client.auth` / `client.kv` / `client.storage` / `client.message` /
+`client.space` / `client.agents` / `client.functions` — backed by
+end-to-end-encrypted messaging (fan-out group channels with history, plus Double
+Ratchet + ECDH P-384 for direct messages), ZK identity + personal/shared spaces,
+server-side Programmable Agents, developer-authored serverless functions, and a
+Cloudflare-Workers-compatible Groth16 verifier — all bundled from a single
+TypeScript source tree.
+
+See [`CHANGELOG.md`](./CHANGELOG.md) for what's new.
 
 > Status: alpha. The library is consumed in tree by `../accelerator` and the
 > `../web` SPA.
@@ -163,6 +167,69 @@ blind (it only ever sees opaque, ECIES-wrapped key blobs). The space handle was
 once `Room`; that name is still exported as an alias, and `client.message.room()`
 returns the same handle.
 
+**Shareable invite links + member roles.** A private Space (`createChannel(name,
+{ private: true })`) admits only allowlisted members. Instead of inviting
+people one username at a time, mint a **capability link** anyone can redeem —
+the keeper admits them on redemption. Members carry a **role** (`viewer` /
+`editor`) the owner controls; apps use roles to gate delegated management (e.g.
+who can edit an app's config).
+
+```typescript
+// Owner: mint a shareable invite (optionally time-/use-bounded, with a role).
+const { token } = await client.space.createInviteLink(space.id, { role: "viewer", maxUses: 10 });
+const url = `https://yourapp.com/join?space=${space.id}&token=${token}`;
+await client.space.listInviteLinks(space.id);     // owner: active links
+await client.space.revokeInviteLink(space.id, token);
+
+// Recipient: redeem the link → admitted by the keeper, group key wrapped for them.
+const joined = await client.space.joinByInvite(space.id, token);
+
+// Owner: see members + roles, and promote/demote.
+await client.space.members(space.id);             // [{ memberId, role }]
+await client.space.setMemberRole(space.id, "alice", "editor");
+await client.space.roster(space.id);              // member identity pubkeys
+```
+
+**Programmable Agents (`client.agents`).** Server-side "virtual users" backed by
+Cloudflare Workers AI: an app editor gives an agent a persona (system prompt), a
+model, and **triggers** (e.g. reply on @-mention), then enables it per-Space;
+members chat with it inside that Space. Management is session-authed (owner or
+Space editor) and **paid-tier-only**. Enabling an agent on a Space makes that
+Space readable by the app's keeper (per-Space opt-in); every other Space stays
+blind.
+
+```typescript
+const { config } = await client.agents.create(appId, {
+  handle: "@assistant",
+  displayName: "Assistant",
+  model: "@cf/meta/llama-3.1-8b-instruct",
+  systemPrompt: "You are a concise, friendly teammate in this Space.",
+  triggers: [{ type: "mention" }],
+});
+await client.agents.enable(appId, config.agentId, space.id);  // per-Space opt-in
+// list / update / delete / disable also available.
+```
+
+**Serverless Functions (`client.functions`).** Deploy your own code that runs on
+the accelerator. A function is an untrusted single-module ES worker
+(`export default { fetch }`) with two triggers: **HTTP** (reachable at its own
+`<name>--<slug>.fns.<zone>` subdomain) and **Space-bound** (invoked on Space
+messages, like an agent). Source is encrypted at rest and uploaded just-in-time
+on invocation. Management is session-authed (owner / Space editor) and
+**paid-tier-only**.
+
+```typescript
+const { config } = await client.functions.deploy(appId, {
+  name: "hello",
+  displayName: "Hello",
+  code: `export default { fetch: () => new Response("hi from Muhkoo!") }`,
+  triggers: { http: { enabled: true } },
+});
+// → reachable at https://hello--<app-slug>.fns.<zone>/
+await client.functions.enable(appId, config.functionId, space.id); // Space-bound
+// list / get / code / update / delete / disable also available.
+```
+
 Auth lifecycle:
 
 ```typescript

package/dist/browser/index.js

@@ -2407,6 +2407,7 @@ class WSTransport extends EventCore {
         return `${this.id}:${event}`;
     }
     url;
+    urlProvider;
     socket = null;
     _isConnected = false;
     _isConnecting = false;
@@ -2432,6 +2433,7 @@ class WSTransport extends EventCore {
             throw new Error("WSTransport: `url` is required");
         }
         this.url = opts.url;
+        this.urlProvider = opts.urlProvider;
         this.id = opts.id ?? `ws${++__wsInstanceSeq}`;
         this.autoReconnect = opts.autoReconnect ?? true;
         this.reconnectDelay = opts.reconnectDelay ?? 3000;
@@ -2448,6 +2450,18 @@ class WSTransport extends EventCore {
             throw new Error("WSTransport: already connected or connecting");
         }
         this._isConnecting = true;
+        // On a RECONNECT, refresh the URL (the baked-in single-use ticket is spent).
+        // The first connect uses `url` as-is. If the provider throws (e.g. can't
+        // mint a ticket), surface it and let scheduleReconnect retry.
+        if (this.urlProvider && this.reconnectAttempts > 0) {
+            try {
+                this.url = await this.urlProvider();
+            }
+            catch (err) {
+                this._isConnecting = false;
+                throw err;
+            }
+        }
         return new Promise((resolve, reject) => {
             try {
                 const socket = new WebSocket(this.url);
@@ -2620,7 +2634,12 @@ class WSTransport extends EventCore {
                 await this.connect();
             }
             catch {
-                // scheduleReconnect will fire again from onclose
+                // A failed reconnect never opened the socket, so its `onclose` won't
+                // re-schedule (that path is guarded by `wasConnected`). Re-schedule here
+                // so we keep retrying (with a fresh ticket each time) until we succeed
+                // or hit the attempt cap.
+                if (this.autoReconnect)
+                    this.scheduleReconnect();
             }
         }, this.reconnectDelay);
     }
@@ -3936,6 +3955,8 @@ class FileStorage {
         const fileId = input.fileId ?? generateId();
         const createdAt = Date.now();
         const chunks = [];
+        const totalChunks = Math.max(1, Math.ceil(data.length / this.chunkSize));
+        input.onProgress?.(0, totalChunks);
         // Slicing + encrypting + encoding + uploading is done per-chunk so
         // the peak memory footprint stays at ~chunkSize even for huge files.
         // Within a chunk, the shard uploads are parallelized up to
@@ -3945,6 +3966,7 @@ class FileStorage {
             const end = Math.min(start + this.chunkSize, data.length);
             const plaintext = data.subarray(start, end);
             chunks.push(await this.writeChunk(plaintext, chunkIndex));
+            input.onProgress?.(chunks.length, totalChunks);
             // Stop after one iteration if the file is empty — we still emit a
             // single zero-length chunk so the manifest has a stable shape.
             if (data.length === 0)
@@ -4691,6 +4713,9 @@ class HttpClient {
     post(path, body) {
         return this.request("POST", path, body);
     }
+    patch(path, body) {
+        return this.request("PATCH", path, body);
+    }
     del(path, body) {
         return this.request("DELETE", path, body);
     }
@@ -5659,12 +5684,27 @@ class Space {
     /** Open the space websocket (resolves the ticket + identity lazily). */
     async connect() {
         if (!this.channel) {
-            const ticket = await this.deps.fetchTicket();
-            const url = `${this.deps.wsBaseUrl}/api/spaces/${encodeURIComponent(this.name)}/websocket` +
-                (ticket ? `?ticket=${encodeURIComponent(ticket)}` : "");
+            // The WS upgrade ticket is single-use + short-TTL, so a reconnect
+            // must mint a FRESH one — otherwise the socket drops (idle timeout,
+            // network blip) and never comes back. `buildUrl` is handed to the
+            // transport as a `urlProvider` it calls before each reconnect.
+            const buildUrl = async () => {
+                const ticket = await this.deps.fetchTicket();
+                return (`${this.deps.wsBaseUrl}/api/spaces/${encodeURIComponent(this.name)}/websocket` +
+                    (ticket ? `?ticket=${encodeURIComponent(ticket)}` : ""));
+            };
+            const url = await buildUrl();
             this.channel = this.deps.createChannel
                 ? this.deps.createChannel(url, this.deps.myId())
-                : new BroadcastChannel({ url, myId: this.deps.myId(), autoAnnounce: false });
+                : new BroadcastChannel({
+                    url,
+                    myId: this.deps.myId(),
+                    autoAnnounce: false,
+                    urlProvider: buildUrl,
+                    // Keep recovering across network flaps (each attempt mints a
+                    // fresh ticket); teardown calls disconnect() which stops it.
+                    maxReconnectAttempts: 0,
+                });
             for (const [event, handler] of this.pending)
                 this.channel.on(event, handler);
             this.pending.length = 0;
@@ -5868,8 +5908,8 @@ class Space {
         return this.requireKeyring().rotate(roster);
     }
     // -- room-scoped files (no websocket needed) -------------------------------
-    async putFile(file, metadata) {
-        return this.fileStorage().writeFileToShards({ data: file, metadata });
+    async putFile(file, metadata, opts = {}) {
+        return this.fileStorage().writeFileToShards({ data: file, metadata, onProgress: opts.onProgress });
     }
     async getFile(manifest) {
         return this.fileStorage().readFileFromShards(manifest);
@@ -6026,6 +6066,12 @@ class Space {
      * nothing to verify against → reject.
      */
     async verifySender(packet) {
+        // Trust our OWN messages — we sent them, so there's nothing to prove
+        // against the roster. This also keeps a returning member (who loaded a
+        // cached key and never re-published a join-request) from dropping the
+        // echo of their own messages when their `ecdsaPub` isn't in the roster.
+        if (packet.source === this.deps.myId())
+            return true;
         const keyring = this.deps.keyring;
         const sig = packet.headers?.sig;
         if (!keyring || typeof sig !== "string")
@@ -6522,6 +6568,34 @@ class KeyringClient {
     async invite(username) {
         await this.post("/keyring/invite", { username });
     }
+    // -- Shareable invite links ----------------------------------------------
+    // A capability token tied to this space. Redeeming it allowlists the holder
+    // so the keeper admits them — the link IS the invitation. Mint/list/revoke
+    // require the caller to be the creator or an existing member.
+    async createInviteLink(opts = {}) {
+        return this.post("/keyring/link", opts);
+    }
+    async listInviteLinks() {
+        const body = await this.get("/keyring/links");
+        return body.links ?? [];
+    }
+    /** Set a member's role ("viewer" | "editor"). Owner-only on the server. */
+    async setMemberRole(username, role) {
+        await this.post("/keyring/role", { username, role });
+    }
+    /** Roster with roles (owner/members only). */
+    async members() {
+        const body = await this.get("/keyring/members");
+        return body.members ?? [];
+    }
+    async revokeInviteLink(token) {
+        await this.post("/keyring/link-revoke", { token });
+    }
+    /** Redeem a link: the server allowlists this member and asks the keeper to
+     *  wrap the group key for their identity. Caller must be authenticated. */
+    async redeemInvite(req) {
+        await this.post("/keyring/redeem", req);
+    }
     async fetchMetadata() {
         try {
             return await this.get("/metadata");
@@ -6659,6 +6733,56 @@ class SpaceNamespace {
         return this.joinSpace(spaceId, opts);
     }
     // -------------------------------------------------------------------------
+    // Invite links — shareable, keeper-gated invitations to a space. The token
+    // is a capability: anyone signed in who redeems it is admitted by the
+    // keeper. Mint/list/revoke require the caller to be the space's creator or
+    // an existing member.
+    // -------------------------------------------------------------------------
+    /** Mint a shareable invite link for a space. `opts.expiresInSec` / `maxUses`
+     *  bound it (0/undefined = unlimited); `opts.role` ("viewer"|"editor") is the
+     *  access granted to redeemers (default viewer). Returns the link. */
+    async createInviteLink(spaceId, opts = {}) {
+        return this.keyringFor(spaceId).createInviteLink(opts);
+    }
+    /** Set a member's role on a space ("viewer" | "editor"). Owner-only. */
+    async setMemberRole(spaceId, username, role) {
+        await this.keyringFor(spaceId).setMemberRole(username, role);
+    }
+    /** Roster with roles (owner/members only). */
+    async members(spaceId) {
+        return this.keyringFor(spaceId).members();
+    }
+    /** List a space's active invite links (creator/members only). */
+    async listInviteLinks(spaceId) {
+        return this.keyringFor(spaceId).listInviteLinks();
+    }
+    /** Revoke an invite link by token. */
+    async revokeInviteLink(spaceId, token) {
+        await this.keyringFor(spaceId).revokeInviteLink(token);
+    }
+    /**
+     * Join a space using an invite link: redeem the token (the keeper admits
+     * this member), then connect and resolve once the group key arrives.
+     * Returns the open {@link Space}.
+     */
+    async joinByInvite(spaceId, token, opts = {}) {
+        const memberId = this.myId();
+        const { ecdhPub, ecdsaPub } = await this.ensureIdentity(memberId);
+        await this.keyringFor(spaceId).redeemInvite({ token, identityEcdhPub: ecdhPub, identityEcdsaPub: ecdsaPub });
+        return this.joinSpace(spaceId, opts);
+    }
+    /** The current member roster of a space (member id → identity public keys). */
+    async roster(spaceId) {
+        return this.keyringFor(spaceId).fetchRoster();
+    }
+    keyringFor(spaceId) {
+        return new KeyringClient({
+            spaceId,
+            httpBaseUrl: this.deps.http.baseUrl,
+            fetch: this.deps.http.fetch,
+        });
+    }
+    // -------------------------------------------------------------------------
     // Internals
     // -------------------------------------------------------------------------
     async build(spaceId, historyPolicy) {
@@ -6725,6 +6849,133 @@ class SpaceNamespace {
     }
 }
 
+/**
+ * `client.agents` — manage an app's **Programmable Agents** (server-side
+ * "virtual users" backed by Workers AI).
+ *
+ *   const { config } = await client.agents.create(appId, {
+ *     handle: '@assistant', displayName: 'Assistant',
+ *     systemPrompt: 'You are a helpful teammate in this Space.',
+ *     triggers: [{ type: 'mention' }],
+ *   });
+ *   await client.agents.enable(appId, config.agentId, spaceId);  // per-Space opt-in
+ *
+ * These are MANAGEMENT calls — the agent itself runs on the accelerator. Only an
+ * app's owner or an editor of its shared Space may create/update/enable an agent
+ * (viewers can read). Authorization rides the user session token; non-owner
+ * editors pass their management Space via `opts.space`.
+ *
+ * v1 is "prompts + persona": a system prompt, a model, named prompt `skills`,
+ * and `triggers` that decide when the agent speaks. No tools, no code.
+ */
+class AgentsNamespace {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** List the app's agents. */
+    async list(appId, opts = {}) {
+        const res = await this.deps.http.get(this.path(appId, "", opts));
+        return res.agents ?? [];
+    }
+    /** Read one agent (config + identity keys). */
+    async get(appId, agentId, opts = {}) {
+        return this.deps.http.get(this.path(appId, `/${encodeURIComponent(agentId)}`, opts));
+    }
+    /** Create an agent (owner/editor only). */
+    async create(appId, input, opts = {}) {
+        return this.deps.http.post(this.path(appId, "", {}), { ...input, space: opts.space });
+    }
+    /** Update an agent's editor-settable fields (owner/editor only). */
+    async update(appId, agentId, patch, opts = {}) {
+        return this.deps.http.patch(this.path(appId, `/${encodeURIComponent(agentId)}`, {}), { ...patch, space: opts.space });
+    }
+    /** Delete an agent (owner/editor only). */
+    async delete(appId, agentId, opts = {}) {
+        return this.deps.http.del(this.path(appId, `/${encodeURIComponent(agentId)}`, {}), { space: opts.space });
+    }
+    /** Enable the agent on a Space (per-Space opt-in). */
+    async enable(appId, agentId, spaceId, opts = {}) {
+        return this.deps.http.post(this.path(appId, `/${encodeURIComponent(agentId)}/enable`, {}), { targetSpaceId: spaceId, space: opts.space });
+    }
+    /** Disable the agent on a Space. */
+    async disable(appId, agentId, spaceId, opts = {}) {
+        return this.deps.http.post(this.path(appId, `/${encodeURIComponent(agentId)}/disable`, {}), { targetSpaceId: spaceId, space: opts.space });
+    }
+    path(appId, suffix, opts) {
+        const q = opts.space ? `?space=${encodeURIComponent(opts.space)}` : "";
+        return `/api/apps/${encodeURIComponent(appId)}/agents${suffix}${q}`;
+    }
+}
+
+/**
+ * `client.functions` — manage an app's **serverless functions** (developer-
+ * authored code that runs on the accelerator).
+ *
+ *   const { config } = await client.functions.deploy(appId, {
+ *     name: 'hello', displayName: 'Hello',
+ *     code: `export default { fetch: () => new Response('hi') }`,
+ *     triggers: { http: { enabled: true } },
+ *   });
+ *   // HTTP-reachable at  hello--<slug>.fns.muhkoo.dev
+ *   await client.functions.enable(appId, config.functionId, spaceId); // Space-bound
+ *
+ * These are MANAGEMENT calls — the function itself runs on the accelerator
+ * (uploaded just-in-time, decrypted only at invocation). Only an app's owner or
+ * an editor of its shared Space may deploy/update/enable (viewers read).
+ * Authorization rides the user session token; non-owner editors pass their
+ * management Space via `opts.space`.
+ *
+ * v1 is "compute-only": a function is an untrusted single-module ES worker
+ * (`export default { fetch }`) with NO platform bindings — it reaches the
+ * platform as an external client (the end-user session is passed through). Two
+ * triggers: `http` (its own subdomain) and `space` (invoked on Space messages,
+ * like a Programmable Agent).
+ */
+class FunctionsNamespace {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** List the app's functions. */
+    async list(appId, opts = {}) {
+        const res = await this.deps.http.get(this.path(appId, "", opts));
+        return res.functions ?? [];
+    }
+    /** Read one function's config. */
+    async get(appId, functionId, opts = {}) {
+        return this.deps.http.get(this.path(appId, `/${encodeURIComponent(functionId)}`, opts));
+    }
+    /** Read a function's decrypted source (owner/editor; for the editor UI). */
+    async code(appId, functionId, opts = {}) {
+        return this.deps.http.get(this.path(appId, `/${encodeURIComponent(functionId)}/code`, opts));
+    }
+    /** Deploy (create) a function (owner/editor only). */
+    async deploy(appId, input, opts = {}) {
+        return this.deps.http.post(this.path(appId, "", {}), { ...input, space: opts.space });
+    }
+    /** Update a function's editor-settable fields and/or redeploy its `code`. */
+    async update(appId, functionId, patch, opts = {}) {
+        return this.deps.http.patch(this.path(appId, `/${encodeURIComponent(functionId)}`, {}), { ...patch, space: opts.space });
+    }
+    /** Delete a function (owner/editor only). */
+    async delete(appId, functionId, opts = {}) {
+        return this.deps.http.del(this.path(appId, `/${encodeURIComponent(functionId)}`, {}), { space: opts.space });
+    }
+    /** Enable the function on a Space (per-Space opt-in for the `space` trigger). */
+    async enable(appId, functionId, spaceId, opts = {}) {
+        return this.deps.http.post(this.path(appId, `/${encodeURIComponent(functionId)}/enable`, {}), { targetSpaceId: spaceId, space: opts.space });
+    }
+    /** Disable the function on a Space. */
+    async disable(appId, functionId, spaceId, opts = {}) {
+        return this.deps.http.post(this.path(appId, `/${encodeURIComponent(functionId)}/disable`, {}), { targetSpaceId: spaceId, space: opts.space });
+    }
+    path(appId, suffix, opts) {
+        const q = opts.space ? `?space=${encodeURIComponent(opts.space)}` : "";
+        return `/api/apps/${encodeURIComponent(appId)}/functions${suffix}${q}`;
+    }
+}
+
 /**
  * `Client` — the single entry point to the Muhkoo SDK.
  *
@@ -6769,6 +7020,10 @@ class Client {
     message;
     /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
     space;
+    /** Programmable Agents — `client.agents.create(appId, …)`, etc. */
+    agents;
+    /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
+    functions;
     session;
     http;
     /** Subscribers notified when a session expires and can't be recovered. */
@@ -6811,6 +7066,8 @@ class Client {
             wsBaseUrl,
             cache: spaceKeyCache,
         });
+        this.agents = new AgentsNamespace({ http: this.http });
+        this.functions = new FunctionsNamespace({ http: this.http });
     }
     /** The currently signed-in user, or `null`. */
     get user() {
@@ -6930,5 +7187,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
   default: loadRsWasm
 });
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_BASE_URL, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, shardHash, signMessage, toField, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
+export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_BASE_URL, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, shardHash, signMessage, toField, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
 //# sourceMappingURL=index.js.map