@muhkoo/connect 0.6.0-alpha.1 → 0.7.0-alpha.3

package/dist/browser/index.js

@@ -1,6 +1,10 @@
 import { prove, verify as verify$1 } from '@zk-kit/groth16';
 import { p256 } from '@noble/curves/nist.js';
 import { buildPoseidon } from 'circomlibjs';
+import { scrypt } from '@noble/hashes/scrypt.js';
+import { entropyToMnemonic, validateMnemonic, mnemonicToEntropy } from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english.js';
+import { ristretto255_oprf } from '@noble/curves/ed25519.js';
 
 const _isTty = (() => {
     try {
@@ -259,7 +263,7 @@ function fromHex(hex) {
     return out;
 }
 /** Encode a byte array as a standard base64 string. */
-function toBase64(bytes) {
+function toBase64$1(bytes) {
     let binary = "";
     for (let i = 0; i < bytes.length; i++) {
         binary += String.fromCharCode(bytes[i]);
@@ -267,7 +271,7 @@ function toBase64(bytes) {
     return btoa(binary);
 }
 /** Decode a standard base64 string to bytes. */
-function fromBase64(b64) {
+function fromBase64$1(b64) {
     const binary = atob(b64);
     const ab = new ArrayBuffer(binary.length);
     const out = new Uint8Array(ab);
@@ -277,13 +281,13 @@ function fromBase64(b64) {
 }
 /** Encode a byte array as a base64url string (no padding). */
 function toBase64Url(bytes) {
-    return toBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return toBase64$1(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 /** Decode a base64url string (with or without padding) to bytes. */
 function fromBase64Url(b64url) {
     const padded = b64url.replace(/-/g, "+").replace(/_/g, "/") +
         "=".repeat((4 - (b64url.length % 4)) % 4);
-    return fromBase64(padded);
+    return fromBase64$1(padded);
 }
 /** Concatenate any number of byte arrays into a single Uint8Array. */
 function concatBytes(...arrays) {
@@ -1114,10 +1118,10 @@ class KeyStore {
     async packDehydratedKeys(id) {
         const dehydrated = await this.dehydrateKeyPair(id);
         const combined = JSON.stringify(dehydrated);
-        return toBase64(new TextEncoder().encode(combined));
+        return toBase64$1(new TextEncoder().encode(combined));
     }
     async hydrateFromPacked(id, masterKey) {
-        const decoded = utf8Decode(fromBase64(masterKey));
+        const decoded = utf8Decode(fromBase64$1(masterKey));
         const dehydrated = JSON.parse(decoded);
         await this.hydrateKeyPair(id, dehydrated);
     }
@@ -1948,8 +1952,8 @@ class ChunkCipher {
      */
     generateKeyMaterial() {
         return {
-            key: toBase64(randomBytes(AES_GCM_KEY_BYTES)),
-            iv: toBase64(randomBytes(AES_GCM_IV_BYTES)),
+            key: toBase64$1(randomBytes(AES_GCM_KEY_BYTES)),
+            iv: toBase64$1(randomBytes(AES_GCM_IV_BYTES)),
         };
     }
     /**
@@ -1958,7 +1962,7 @@ class ChunkCipher {
      * GCM behavior).
      */
     async encryptChunk(plaintext, material) {
-        return encryptAesGcm(fromBase64(material.key), fromBase64(material.iv), plaintext);
+        return encryptAesGcm(fromBase64$1(material.key), fromBase64$1(material.iv), plaintext);
     }
     /**
      * Inverse of {@link encryptChunk}. Throws if the auth tag fails — that
@@ -1967,7 +1971,7 @@ class ChunkCipher {
      */
     async decryptChunk(ciphertext, material) {
         try {
-            return await decryptAesGcm(fromBase64(material.key), fromBase64(material.iv), ciphertext);
+            return await decryptAesGcm(fromBase64$1(material.key), fromBase64$1(material.iv), ciphertext);
         }
         catch {
             // WebCrypto throws a vague OperationError on GCM tag mismatch.
@@ -4293,6 +4297,100 @@ class AuthClient {
         const res = await this.fetchFn(`${this.baseUrl}/api/auth/verify`, this.json("POST", { token }));
         return await this.parse("verify", res);
     }
+    // ---- Identity vault (M1.0) ----------------------------------------------
+    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
+    async oprfEvaluate(username, blinded) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/oprf`, this.json("POST", { username, blinded }));
+        return await this.parse("oprfEvaluate", res);
+    }
+    /**
+     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
+     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
+     * domains' evaluations. The recover token is consumed by this call.
+     */
+    async oprfEvaluateGated(username, blinded, factorType, purpose, verifyToken) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/oprf`, this.json("POST", { username, blinded, factorType, purpose, verifyToken }));
+        return await this.parse("oprfEvaluateGated", res);
+    }
+    /**
+     * Request an email OTP. With a session `token` this is the ENROLL flow
+     * (code sent to `email`); without one it's RECOVER (code sent to the
+     * account's enrolled address — the response is uniform either way).
+     */
+    async emailOtpStart(opts) {
+        const init = this.json("POST", { email: opts.email, username: opts.username });
+        if (opts.token)
+            init.headers["X-Muhkoo-Session"] = opts.token;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/email/start`, init);
+        await this.parse("emailOtpStart", res);
+    }
+    /** Trade an emailed code for a single-use verifyToken (+ the proven address). */
+    async emailOtpVerify(opts) {
+        const init = this.json("POST", { code: opts.code, username: opts.username });
+        if (opts.token)
+            init.headers["X-Muhkoo-Session"] = opts.token;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/email/verify`, init);
+        return await this.parse("emailOtpVerify", res);
+    }
+    /**
+     * Verify a Google ID token (M2.3). With a session `token` it's the ENROLL
+     * gate; without, it's RECOVER/LOGIN (the Google account must already be
+     * linked). Returns a single-use verifyToken bound to the account's `sub`.
+     */
+    async googleVerify(opts) {
+        const init = this.json("POST", { idToken: opts.idToken, username: opts.username });
+        if (opts.token)
+            init.headers["X-Muhkoo-Session"] = opts.token;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/google/verify`, init);
+        return await this.parse("googleVerify", res);
+    }
+    // ---- Hosted-auth authorization-code flow (H0) ---------------------------
+    /** Mint a single-use authorization code for an app (called by the hosted page; session-authed). */
+    async grant(token, body) {
+        const init = this.json("POST", body);
+        init.headers["X-Muhkoo-Session"] = token;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/grant`, init);
+        return await this.parse("grant", res);
+    }
+    /** Exchange an authorization code + PKCE verifier for the session + sealed key material. */
+    async token(body) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/token`, this.json("POST", body));
+        return await this.parse("token", res);
+    }
+    /**
+     * Read a factor record for `username` (returns an indistinguishable decoy if
+     * absent). Gated types (email) require the recover `verifyToken`.
+     */
+    async vaultRead(username, factorType, verifyToken) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault`, this.json("POST", { username, factorType, verifyToken }));
+        return await this.parse("vaultRead", res);
+    }
+    /**
+     * Add/replace a factor (session-authed; the seed is already wrapped
+     * client-side). Email factors additionally require (and consume) the
+     * enroll `verifyToken`; the stored address must be the verified one.
+     */
+    async vaultPutFactor(token, factor, verifyToken) {
+        const init = this.json("PUT", { factor, verifyToken });
+        init.headers["Authorization"] = `Bearer ${token}`;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault/factor`, init);
+        return await this.parse("vaultPutFactor", res);
+    }
+    /** List the user's factor metadata (no ciphertext). Session-authed. */
+    async vaultFactors(token) {
+        const init = { method: "GET", headers: { Authorization: `Bearer ${token}` } };
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault/factors`, init);
+        return await this.parse("vaultFactors", res);
+    }
+    /** Remove a factor by id (can't remove the last one). Session-authed. */
+    async vaultDeleteFactor(token, id) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault/factor`, {
+            method: "DELETE",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+            body: JSON.stringify({ id }),
+        });
+        return await this.parse("vaultDeleteFactor", res);
+    }
     // -------------------------------------------------------------------------
     // Internals
     // -------------------------------------------------------------------------
@@ -4410,7 +4508,31 @@ async function deriveIdentity(username, password) {
     if (typeof password !== "string" || password.length === 0) {
         throw new Error("deriveIdentity: `password` is required");
     }
-    const seed = await pbkdf2Bytes(password, "muhkoo-zk-v1:" + username, SCALAR_BYTES);
+    const seed = await deriveMasterSeedFromPassword(username, password);
+    return deriveIdentityFromSeed(seed);
+}
+/**
+ * Legacy master-seed derivation: `PBKDF2(password, "muhkoo-zk-v1:"||username)`.
+ *
+ * This was the *only* path pre-vault, where the identity descended directly from
+ * the password. It's kept so existing accounts still re-derive their seed (and
+ * the vault can adopt that exact seed on migration, preserving the commitment).
+ * New accounts use a random seed (`vault.randomSeed`) instead, so their identity
+ * is no longer a function of the password.
+ */
+async function deriveMasterSeedFromPassword(username, password) {
+    return pbkdf2Bytes(password, "muhkoo-zk-v1:" + username, SCALAR_BYTES);
+}
+/**
+ * Derive the (unchanged) ZK identity from a 32-byte **master seed**. The seed is
+ * HKDF-expanded into secret/salt + the P-256 ECDSA & ECDH keypairs exactly as
+ * before — so the resulting commitment is byte-identical for a given seed. The
+ * vault wraps THIS seed under each recovery factor.
+ */
+async function deriveIdentityFromSeed(seed) {
+    if (!(seed instanceof Uint8Array) || seed.length !== SCALAR_BYTES) {
+        throw new Error(`deriveIdentityFromSeed: expected a ${SCALAR_BYTES}-byte seed`);
+    }
     const secretBytes = await hkdfExpand(seed, "zk-secret", SCALAR_BYTES);
     const saltBytes = await hkdfExpand(seed, "zk-salt", SCALAR_BYTES);
     const ecdsaPriv = await hkdfExpand(seed, "ecdsa-priv", SCALAR_BYTES);
@@ -4639,6 +4761,139 @@ async function signMessage(message, privateKey) {
     return bytesToBase64(new Uint8Array(sig));
 }
 
+/**
+ * Identity vault primitives (M1.0).
+ *
+ * The vault decouples the identity from the password: a random 32-byte **master
+ * seed** yields the (unchanged) ZK identity via {@link deriveIdentityFromSeed},
+ * and that seed is AES-256-GCM-wrapped under one key *per factor* (password,
+ * passkey, recovery phrase). Server stores only ciphertext.
+ *
+ * This module holds the PURE primitives (seed gen, the memory-hard password
+ * pre-hash, AES-GCM wrap/unwrap, the OPRF -> wrap-key HKDF). The networked
+ * orchestration (calling the server's OPRF endpoint, fetching/storing factor
+ * records) lives in the AuthNamespace, which has transport access.
+ *
+ * Memory-hard KDF: we use **scrypt** (vetted, in `@noble/hashes`, runs in
+ * browser + Workers + Node - no wasm dependency) instead of argon2id; it is the
+ * pre-hash fed into the OPRF, so even if the OPRF key ever leaked, guesses still
+ * pay the scrypt cost.
+ */
+const TE$1 = new TextEncoder();
+// Interactive-login scrypt params (~100ms on a laptop). N must be a power of 2.
+const SCRYPT = { N: 1 << 15, r: 8, p: 1, dkLen: 32 };
+/** 32 random bytes - the master seed for a brand-new identity. */
+function randomSeed() {
+    return crypto.getRandomValues(new Uint8Array(32));
+}
+/** Memory-hard pre-hash of the password - the OPRF input. Salted by username. */
+function passwordPreHash(username, password) {
+    return scrypt(TE$1.encode(password), TE$1.encode("muhkoo-vault-v1:" + username.toLowerCase()), SCRYPT);
+}
+/** HKDF the 64-byte OPRF output into a non-extractable AES-256-GCM wrap key. */
+async function wrapKeyFromOprf(oprfOutput) {
+    const prk = await crypto.subtle.importKey("raw", oprfOutput, { name: "HKDF" }, false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array(), info: TE$1.encode("muhkoo-vault-wrap") }, prk, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+/** HKDF arbitrary 32-byte key material (e.g. a passkey PRF output) into an AES-GCM wrap key. */
+async function wrapKeyFromBytes(keyMaterial, info) {
+    const prk = await crypto.subtle.importKey("raw", keyMaterial, { name: "HKDF" }, false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array(), info: TE$1.encode(info) }, prk, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function wrapSeed(seed, key) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, seed);
+    return { iv: toBase64(iv), ct: toBase64(new Uint8Array(ct)) };
+}
+/** Decrypt a wrapped seed. Throws (AES-GCM tag failure) on a wrong key. */
+async function unwrapSeed(wrapped, key) {
+    const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv: fromBase64(wrapped.iv) }, key, fromBase64(wrapped.ct));
+    return new Uint8Array(pt);
+}
+function toBase64(bytes) {
+    let s = "";
+    for (let i = 0; i < bytes.length; i++)
+        s += String.fromCharCode(bytes[i]);
+    return btoa(s);
+}
+function fromBase64(b64) {
+    const s = atob(b64);
+    const out = new Uint8Array(s.length);
+    for (let i = 0; i < s.length; i++)
+        out[i] = s.charCodeAt(i);
+    return out;
+}
+
+/**
+ * Hosted-auth handoff crypto (auth.muhkoo.dev — AUTH_HOSTED_PLAN.md §3).
+ *
+ * The hosted page authenticates the user and ends up holding the master seed.
+ * To pass it to the developer's app without it ever sitting server-readable or
+ * landing in browser history:
+ *
+ *   1. {@link sealSeed} generates a one-time key K_t, AES-256-GCM-seals the seed
+ *      under it, and returns the ciphertext envelope (`sealedKeys`, stored in
+ *      the grant the server relays but can't read) plus K_t (`fragmentKey`,
+ *      placed ONLY in the redirect URL fragment — fragments never hit a server).
+ *   2. The app exchanges the code for `sealedKeys`, reads K_t from the fragment,
+ *      and {@link unsealSeed} recovers the seed, then strips the fragment.
+ *
+ * Trust-equivalent to today's embedded SDK (the app still ends up with the
+ * seed) while moving credential entry onto the Muhkoo origin. The envelope is
+ * versioned so a future per-app-key handoff (v2) can swap in without a protocol
+ * change.
+ */
+const TE = new TextEncoder();
+const TD = new TextDecoder();
+/** Seal the master seed under a fresh one-time key for the redirect handoff. */
+async function sealSeed(seed) {
+    const ktRaw = crypto.getRandomValues(new Uint8Array(32));
+    const key = await crypto.subtle.importKey("raw", ktRaw, { name: "AES-GCM" }, false, ["encrypt"]);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, key, seed));
+    const envelope = { v: 1, iv: toBase64(iv), ct: toBase64(ct) };
+    return {
+        sealedKeys: toBase64(TE.encode(JSON.stringify(envelope))),
+        fragmentKey: base64UrlEncode(ktRaw),
+    };
+}
+/** Recover the master seed from the sealed envelope + the fragment key. */
+async function unsealSeed(sealedKeys, fragmentKey) {
+    const envelope = JSON.parse(TD.decode(fromBase64(sealedKeys)));
+    if (envelope.v !== 1)
+        throw new Error(`Unsupported handoff envelope version ${envelope.v}`);
+    const ktRaw = base64UrlDecode(fragmentKey);
+    const key = await crypto.subtle.importKey("raw", ktRaw, { name: "AES-GCM" }, false, ["decrypt"]);
+    const seed = await crypto.subtle.decrypt({ name: "AES-GCM", iv: fromBase64(envelope.iv) }, key, fromBase64(envelope.ct));
+    return new Uint8Array(seed);
+}
+/** Generate a PKCE verifier + S256 challenge for the authorize→token exchange. */
+async function generatePkce() {
+    const codeVerifier = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", TE.encode(codeVerifier)));
+    return { codeVerifier, codeChallenge: base64UrlEncode(digest) };
+}
+/** A random URL-safe value for the OAuth `state` (CSRF binding on the callback). */
+function randomState() {
+    return base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
+}
+function base64UrlEncode(bytes) {
+    return toBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(s) {
+    return fromBase64(s.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(s.length / 4) * 4, "="));
+}
+
+/**
+ * SDK build version — stamped to the console when a {@link Client} is created.
+ *
+ * During active development, bump the `-alpha.N` suffix whenever we ship a build
+ * so we can confirm in the browser console that the page is running the build we
+ * expect (and isn't serving a stale cached bundle). Keep this in sync with
+ * `package.json` `version`.
+ */
+const VERSION = "0.7.0-alpha.3";
+
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
  * accelerator over HTTP.
@@ -4856,6 +5111,10 @@ function defaultSessionStore(keyPrefix) {
 class SessionState {
     session = null;
     _identity = null;
+    /** The 32-byte master seed, in-memory only (never persisted). Held after
+     *  login/register so additional recovery factors (passkey, phrase) can be
+     *  enrolled, and a password can be changed, without re-deriving. */
+    _seed = null;
     store;
     constructor(store) {
         this.store = store ?? new MemorySessionStore();
@@ -4897,6 +5156,14 @@ class SessionState {
     setIdentity(identity) {
         this._identity = identity;
     }
+    /** The in-memory master seed (or null when locked / not held). */
+    get seed() {
+        return this._seed;
+    }
+    /** Hold the master seed in memory (set on login/register when available). */
+    setSeed(seed) {
+        this._seed = seed;
+    }
     /** Load a persisted session (used by `restore()`); identity stays null. */
     async loadPersisted() {
         const loaded = await this.store.load();
@@ -4908,10 +5175,378 @@ class SessionState {
     async clear() {
         this.session = null;
         this._identity = null;
+        if (this._seed)
+            this._seed.fill(0); // wipe the master seed
+        this._seed = null;
         await this.store.clear();
     }
 }
 
+/**
+ * Recovery phrase (M1.2) — a 24-word BIP39 mnemonic that ENCODES the 32-byte
+ * master seed directly. Nothing is stored server-side (the phrase *is* the seed),
+ * so it's a fully offline, self-sovereign recovery factor: enter the phrase →
+ * decode → master seed → identity. A `phrase-marker` factor is kept in the vault
+ * only so the UI can show "recovery phrase: enabled".
+ */
+/** Encode a 32-byte master seed as a 24-word BIP39 recovery phrase. */
+function seedToMnemonic(seed) {
+    if (!(seed instanceof Uint8Array) || seed.length !== 32) {
+        throw new Error("seedToMnemonic: expected a 32-byte seed");
+    }
+    return entropyToMnemonic(seed, wordlist);
+}
+function normalize(mnemonic) {
+    return mnemonic.trim().toLowerCase().replace(/\s+/g, " ");
+}
+/** Decode a recovery phrase back to the 32-byte master seed. Throws if invalid. */
+function mnemonicToSeed(mnemonic) {
+    const m = normalize(mnemonic);
+    if (!validateMnemonic(m, wordlist))
+        throw new Error("Invalid recovery phrase.");
+    return mnemonicToEntropy(m, wordlist);
+}
+
+/**
+ * OPRF (Oblivious PRF) — RFC 9497, ristretto255-SHA512, mode 0x00.
+ *
+ * Used to gate the password/recovery factors of the identity vault
+ * ({@link ./vault}). The wrap key for a password factor is
+ * `HKDF(OPRF(serverKey, scrypt(password)))`, so:
+ *   - the client cannot derive the wrap key offline (it needs the server's
+ *     secret-keyed evaluation), and
+ *   - the server learns nothing — it only ever sees a *blinded* group element,
+ *     never the password or the resulting key.
+ *
+ * Net effect: a stolen vault blob is NOT offline-crackable; every guess costs a
+ * round-trip to a rate-limited server endpoint. The same OPRF backs the M2
+ * Google/email factors.
+ *
+ * Thin wrapper over `@noble/curves`' vetted `ristretto255_oprf` so the protocol
+ * (blind / blindEvaluate / finalize) lives in one named place. CLIENT uses
+ * {@link oprfBlind} + {@link oprfFinalize}; SERVER uses {@link oprfDeriveKey} +
+ * {@link oprfBlindEvaluate} (imported by the accelerator's VaultDO).
+ */
+const OPRF = ristretto255_oprf.oprf;
+// Domain separation for the server key derivation (RFC 9497 `info`).
+new TextEncoder().encode("muhkoo-oprf-v1");
+/** CLIENT: blind `input` (e.g. `scrypt(password)`) before the server eval. */
+function oprfBlind(input) {
+    const { blind, blinded } = OPRF.blind(input);
+    return { blind, blinded };
+}
+/** CLIENT: fold the server's blinded evaluation into the final 64-byte OPRF output. */
+function oprfFinalize(input, blind, evaluated) {
+    return OPRF.finalize(input, blind, evaluated);
+}
+
+/**
+ * Verification-gated vault factors (M2 — email, later Google).
+ *
+ * These factors have NO client-side secret: the user proves *channel control*
+ * (an email OTP) and the server releases a split-key OPRF evaluation —
+ * `wrapKey = HKDF( OPRF(K1, input) ‖ OPRF(K2, input) )` where K1 lives on the
+ * accelerator and K2 in a separate trust domain, so no single server-side
+ * compromise can derive the wrap key offline. See accelerator
+ * `AUTH_M2_PLAN.md` §1; the canonical reference implementation is
+ * accelerator `tests/gated-oprf.test.ts` — keep these derivations in
+ * byte-exact lockstep with it.
+ */
+/**
+ * Deterministic OPRF input for an email factor. Public-ish by design (the
+ * verification gate, not the input, is what protects the eval) — but it must
+ * be stable forever: username + address are lowercased, the tag is versioned.
+ */
+async function emailFactorInput(username, email) {
+    const tag = `muhkoo/factor:email:v1:${username.toLowerCase()}:${email.toLowerCase()}`;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(tag));
+    return new Uint8Array(digest);
+}
+/**
+ * Deterministic OPRF input for a google factor — keyed on the stable Google
+ * account id (`sub`), not the email (which can change). Same versioning rules
+ * as {@link emailFactorInput}.
+ */
+async function googleFactorInput(username, sub) {
+    const tag = `muhkoo/factor:google:v1:${username.toLowerCase()}:${sub}`;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(tag));
+    return new Uint8Array(digest);
+}
+/** Blind a gated input for the split eval (same blind serves both domains). */
+function gatedBlind(input) {
+    return oprfBlind(input);
+}
+/**
+ * Fold the two domains' evaluations into the AES-256-GCM wrap key:
+ * unblind each, concatenate, HKDF with the gated-factor domain separation.
+ */
+async function gatedWrapKey(input, blind, evaluatedB64, evaluated2B64) {
+    const out1 = oprfFinalize(input, blind, fromBase64(evaluatedB64));
+    const out2 = oprfFinalize(input, blind, fromBase64(evaluated2B64));
+    const ikm = new Uint8Array(out1.length + out2.length);
+    ikm.set(out1);
+    ikm.set(out2, out1.length);
+    return wrapKeyFromBytes(ikm, "muhkoo-gated-wrap-v1");
+}
+
+/**
+ * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
+ *
+ * A passkey becomes a device-bound, platform-synced source of a stable secret:
+ * for a fixed salt, the authenticator's PRF returns the same 32 bytes, which we
+ * HKDF into an AES key that wraps the master seed. The server never sees the
+ * passkey — it's purely a local key source; the ZK proof remains the server auth.
+ *
+ * BROWSER ONLY (`navigator.credentials`). The PRF extension fields aren't in the
+ * standard DOM types yet, so they're reached through narrow casts.
+ */
+function rand(n) {
+    return crypto.getRandomValues(new Uint8Array(n));
+}
+/** Whether this environment can do WebAuthn at all. (PRF support is checked at enroll.) */
+function passkeySupported() {
+    return (typeof navigator !== "undefined" &&
+        !!navigator.credentials &&
+        typeof PublicKeyCredential !== "undefined");
+}
+/**
+ * Whether this browser's authenticator can do the **PRF extension** our passkey
+ * factor needs. A browser can save passkeys (e.g. for password autofill) yet not
+ * expose PRF — PRF is what derives the stable secret we wrap the seed under, so a
+ * passkey without it is useless to us.
+ *
+ * Uses `PublicKeyCredential.getClientCapabilities()` (the `extension:prf` cap)
+ * where available. Returns:
+ *   - `true`  — PRF is supported,
+ *   - `false` — definitively NOT supported (hide the option),
+ *   - `null`  — couldn't determine (older browser without the capabilities API);
+ *              the caller may optimistically allow and let enroll surface a real
+ *              error if it turns out PRF isn't there.
+ */
+async function passkeyPrfCapable() {
+    if (!passkeySupported())
+        return false;
+    const PC = PublicKeyCredential;
+    if (typeof PC.getClientCapabilities !== "function")
+        return null;
+    try {
+        const caps = await PC.getClientCapabilities();
+        // The spec keys extension caps as `extension:<name>`; tolerate variants.
+        const prf = caps["extension:prf"] ?? caps["extensions:prf"] ?? caps["prf"];
+        return typeof prf === "boolean" ? prf : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Best-effort registrable RP id — the host. Apps spanning subdomains should pass
+ *  the parent domain (e.g. "muhkoo.dev") explicitly. */
+function defaultRpId() {
+    return typeof location !== "undefined" ? location.hostname : "";
+}
+/**
+ * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
+ * the PRF output for that salt. Throws if the authenticator can't do PRF.
+ */
+async function createPasskeyWithPrf(opts) {
+    if (!passkeySupported())
+        throw new Error("Passkeys aren't supported in this browser.");
+    const created = (await navigator.credentials.create({
+        publicKey: {
+            rp: { id: opts.rpId, name: opts.rpName },
+            user: { id: rand(16), name: opts.username, displayName: opts.username },
+            challenge: rand(32),
+            pubKeyCredParams: [{ type: "public-key", alg: -7 }, { type: "public-key", alg: -257 }],
+            authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" },
+            extensions: { prf: {} },
+        },
+    }));
+    if (!created)
+        throw new Error("Passkey creation was cancelled.");
+    const credentialId = new Uint8Array(created.rawId);
+    // Don't trust `prf.enabled` from create() alone — several browsers only report
+    // PRF support on the first get() eval, so a precheck false-negatives. Try the
+    // actual PRF eval; if it yields a result, PRF works.
+    const prfSalt = rand(32);
+    let prfOutput;
+    try {
+        prfOutput = await evaluatePasskeyPrf(opts.rpId, credentialId, prfSalt);
+    }
+    catch {
+        // Empty PRF result almost always means a third-party credential manager
+        // (e.g. a browser password-manager extension) handled the request instead of
+        // the platform authenticator, and that manager doesn't implement PRF. The
+        // device's built-in passkey (Touch ID / Windows Hello / iCloud Keychain)
+        // normally does — so steer the user there rather than blaming the device.
+        throw new Error("That passkey can't be used for recovery — it didn't return a PRF result. " +
+            "A browser password-manager extension may have handled it; try again and " +
+            "pick your device's built-in passkey (Touch ID / Windows Hello), or use a " +
+            "recovery phrase instead.");
+    }
+    return { credentialId, prfSalt, prfOutput };
+}
+/** Evaluate a passkey's PRF for `salt` → 32 bytes. Used at recover/login. */
+async function evaluatePasskeyPrf(rpId, credentialId, salt) {
+    if (!passkeySupported())
+        throw new Error("Passkeys aren't supported in this browser.");
+    const assertion = (await navigator.credentials.get({
+        publicKey: {
+            rpId,
+            challenge: rand(32),
+            allowCredentials: [{ type: "public-key", id: credentialId }],
+            userVerification: "preferred",
+            extensions: { prf: { eval: { first: salt } } },
+        },
+    }));
+    if (!assertion)
+        throw new Error("Passkey authentication was cancelled.");
+    const results = assertion.getClientExtensionResults()?.prf?.results;
+    if (!results?.first)
+        throw new Error("Your passkey didn't return a PRF result.");
+    return new Uint8Array(results.first);
+}
+
+/**
+ * `client.auth.hosted` — centralized hosted auth (auth.muhkoo.dev).
+ * AUTH_HOSTED_PLAN.md.
+ *
+ * Two sides share this class:
+ *   - **Developer apps** call {@link login} (redirect to the hosted page) and
+ *     {@link handleCallback} (exchange the returned code → session + seed). The
+ *     app carries no snarkjs and never sees the user's credentials.
+ *   - **The hosted page** (the muhkoo/auth SPA), once it has authenticated the
+ *     user via the normal `client.auth.zk.*` flow, calls
+ *     {@link completeAuthorize} to seal the seed, mint the grant, and build the
+ *     redirect-back URL.
+ *
+ * Flow (authorization-code + PKCE + sealed-seed handoff):
+ *   app  →  GET  auth.muhkoo.dev/authorize?app_id&redirect_uri&state&code_challenge
+ *   page →  (user authenticates) → POST /api/auth/grant → redirect_uri?code&state#k=<K_t>
+ *   app  →  POST /api/auth/token {code, code_verifier} → {sessionToken, sealedKeys}
+ *        →  unseal sealedKeys with K_t → master seed → session ready
+ */
+const PKCE_STORE_KEY = "muhkoo.hosted.pkce";
+class HostedAuth {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * (App side) Begin hosted login: stash a PKCE verifier + state, then send
+     * the browser to the hosted authorize page. Returns the URL it redirects to
+     * (also useful for popup mode / tests). `redirectUri` must be registered for
+     * the app in the portal.
+     */
+    async login(opts) {
+        const { codeVerifier, codeChallenge } = await generatePkce();
+        const state = randomState();
+        this.store({ codeVerifier, state, appId: opts.appId, redirectUri: opts.redirectUri });
+        const url = `${this.deps.authBaseUrl}/authorize?` + new URLSearchParams({
+            app_id: opts.appId,
+            redirect_uri: opts.redirectUri,
+            state,
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+        }).toString();
+        if (opts.redirect !== false)
+            this.location().assign(url);
+        return url;
+    }
+    /** Whether the current URL looks like a hosted-auth callback (has code + state). */
+    isCallback() {
+        try {
+            const q = new URLSearchParams(this.location().search);
+            return q.has("code") && q.has("state");
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * (App side) Complete login on the callback URL: verify state, exchange the
+     * code (+ PKCE verifier) for the session, unseal the seed from the fragment,
+     * establish the session, and scrub the URL. Returns the signed-in user.
+     */
+    async handleCallback() {
+        const loc = this.location();
+        const query = new URLSearchParams(loc.search);
+        const code = query.get("code");
+        const state = query.get("state");
+        const fragmentKey = new URLSearchParams(loc.hash.replace(/^#/, "")).get("k");
+        if (!code || !state)
+            throw new Error("Not a hosted-auth callback.");
+        if (!fragmentKey)
+            throw new Error("Missing handoff key — the login link was altered.");
+        const stash = this.take();
+        if (!stash || stash.state !== state)
+            throw new Error("State mismatch — possible CSRF; start login again.");
+        const res = await this.deps.auth.token({ code, codeVerifier: stash.codeVerifier, appId: stash.appId });
+        const seed = await unsealSeed(res.sealedKeys, fragmentKey);
+        const identity = await deriveIdentityFromSeed(seed);
+        await this.deps.session.setSession({ token: res.sessionToken, username: res.username, commitment: res.commitment });
+        this.deps.session.setIdentity(identity);
+        this.deps.session.setSeed(seed);
+        this.scrubUrl();
+        return { username: res.username, commitment: res.commitment };
+    }
+    /**
+     * (Hosted-page side) Finish an /authorize request after the user has
+     * authenticated here: seal the in-memory seed, mint the grant, and return
+     * the URL to redirect the browser back to. The seed must be held (the user
+     * just signed in via `client.auth.zk.*`).
+     */
+    async completeAuthorize(opts) {
+        const token = this.deps.session.token;
+        const seed = this.deps.session.seed;
+        if (!token || !seed)
+            throw new Error("Authenticate the user before completing authorization.");
+        const { sealedKeys, fragmentKey } = await sealSeed(seed);
+        const { code } = await this.deps.auth.grant(token, {
+            appId: opts.appId, redirectUri: opts.redirectUri, codeChallenge: opts.codeChallenge, sealedKeys,
+        });
+        const url = new URL(opts.redirectUri);
+        url.searchParams.set("code", code);
+        url.searchParams.set("state", opts.state);
+        url.hash = `k=${fragmentKey}`;
+        return url.toString();
+    }
+    // ---- internals ----------------------------------------------------------
+    location() {
+        const loc = globalThis.location;
+        if (!loc)
+            throw new Error("Hosted auth requires a browser environment.");
+        return loc;
+    }
+    store(v) {
+        const ss = globalThis.sessionStorage;
+        if (!ss)
+            throw new Error("Hosted auth requires sessionStorage.");
+        ss.setItem(PKCE_STORE_KEY, JSON.stringify(v));
+    }
+    take() {
+        const ss = globalThis.sessionStorage;
+        if (!ss)
+            return null;
+        const raw = ss.getItem(PKCE_STORE_KEY);
+        if (!raw)
+            return null;
+        ss.removeItem(PKCE_STORE_KEY);
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Drop `code`, `state`, and the `#k` fragment from the address bar. */
+    scrubUrl() {
+        const h = globalThis.history;
+        const loc = this.location();
+        if (h?.replaceState)
+            h.replaceState(null, "", loc.pathname);
+    }
+}
+
 /**
  * `client.auth` — user authentication, exposed today through the `zk`
  * sub-namespace (`client.auth.zk.login(...)`). Leaving room under `auth` for
@@ -4928,6 +5563,24 @@ class SessionState {
  * {@link SessionState} so the storage + message namespaces can reuse it for
  * at-rest encryption and the messaging ratchet without re-deriving.
  */
+/**
+ * Thrown when the identity vault can't be reached to unlock the seed — a network
+ * failure, a 5xx, or the per-user rate limit (429). This is distinct from a wrong
+ * password, and is surfaced so `login`/`unlock` do NOT silently fall back to the
+ * legacy password derivation (which, for a vault account, yields a misleading
+ * "commitment mismatch"). Callers should ask the user to retry, not re-enter a
+ * password.
+ */
+class VaultUnavailableError extends Error {
+    constructor(cause) {
+        const detail = cause instanceof Error ? cause.message : String(cause ?? "");
+        super(/too many|rate.?limit|\b429\b/i.test(detail)
+            ? "Too many attempts — please wait a moment and try again."
+            : "Couldn't reach the secure vault. Check your connection and try again.");
+        this.name = "VaultUnavailableError";
+        this.cause = cause;
+    }
+}
 /**
  * ZK identity auth. One instance per {@link Client}; reads/writes the shared
  * {@link SessionState}.
@@ -4938,13 +5591,18 @@ class ZkAuth {
         this.deps = deps;
     }
     /**
-     * Register a new user, then (by default) sign them in. The identity is
-     * derived deterministically from `(username, password)` — the same inputs
-     * reproduce it on any device, so there's no key material to ship around.
+     * Register a new user, then (by default) sign them in.
+     *
+     * M1.0: the identity now descends from a **random master seed** (not the
+     * password), so it's recoverable + the password can be changed. We register
+     * the commitment, sign in with the in-memory identity to get a token, then
+     * enroll the OPRF-gated **password factor** (the seed wrapped under a key the
+     * server can't derive offline). Future logins unlock the seed via that factor.
      */
     async register(params) {
         const { username, password, email = null, login = true } = params;
-        const identity = await deriveIdentity(username, password);
+        const seed = randomSeed();
+        const identity = await deriveIdentityFromSeed(seed);
         const commitment = await this.commitmentFor(identity);
         await this.deps.auth.register({
             username,
@@ -4953,19 +5611,52 @@ class ZkAuth {
             ecdsaPublicKey: await exportPublicKeyBase64(identity.ecdsaKeyPair.publicKey),
             email,
         });
-        if (login) {
-            return this.login(username, password);
-        }
-        return { username, commitment };
+        // Sign in with the in-memory (random-seed) identity to obtain a session
+        // token, then enroll the password factor so the next login can recover
+        // the seed. (A token is required to write the factor.)
+        const user = await this.proveAndStore(username, identity, {});
+        await this.enrollPasswordFactor(username, password, seed, this.deps.session.token);
+        this.deps.session.setSeed(seed); // held so a passkey/phrase can be enrolled next
+        if (!login)
+            await this.logout();
+        return user;
     }
     /**
-     * Sign in: re-derive the identity, prove knowledge of it against a fresh
-     * server challenge, and trade the proof for a session token. On success
-     * both the session and the identity are stored on the client.
+     * Sign in. M1.0 is **vault-first**: read the password factor and OPRF-unwrap
+     * the master seed → identity. If that fails (a pre-vault account, whose factor
+     * is absent so the server returns a decoy, or a wrong password), fall back to
+     * the legacy password-derived identity. Either way we then prove knowledge of
+     * the identity and trade it for a session token.
      */
     async login(username, password, opts = {}) {
-        const identity = await deriveIdentity(username, password);
-        return this.proveAndStore(username, identity, opts);
+        // Vault-first; fall back to the legacy password-derived seed (pre-vault
+        // accounts). Either way we end up with the master seed, which we hold so
+        // recovery factors can be enrolled.
+        const vaultSeed = await this.tryUnlockSeed(username, password);
+        const seed = vaultSeed ?? await deriveMasterSeedFromPassword(username, password);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        // Migrate a legacy account into the vault on first vault-aware login: it has
+        // no password factor (`vaultSeed` is null), so enroll one now — wrapping the
+        // exact legacy-derived seed the proof just validated, so the commitment is
+        // preserved. Best-effort; the legacy path still works if this fails.
+        if (!vaultSeed)
+            await this.migrateLegacyPasswordFactor(username, password, seed);
+        return user;
+    }
+    /** Enroll the password factor for a legacy (pre-vault) account. Idempotent +
+     *  best-effort; failure just means we retry on the next login. */
+    async migrateLegacyPasswordFactor(username, password, seed) {
+        const token = this.deps.session.token;
+        if (!token)
+            return;
+        try {
+            await this.enrollPasswordFactor(username, password, seed, token);
+        }
+        catch {
+            /* migrate next time */
+        }
     }
     /**
      * Silently re-authenticate the current user without prompting for a
@@ -5063,12 +5754,273 @@ class ZkAuth {
         if (!username || !expected) {
             throw new Error("ZkAuth.unlock: no active session to unlock — sign in first.");
         }
-        const identity = await deriveIdentity(username, password);
+        const vaultSeed = await this.tryUnlockSeed(username, password);
+        const seed = vaultSeed ?? await deriveMasterSeedFromPassword(username, password);
+        const identity = await deriveIdentityFromSeed(seed);
         const commitment = await this.commitmentFor(identity);
         if (commitment !== expected) {
             throw new Error("ZkAuth.unlock: incorrect password (commitment mismatch).");
         }
         this.deps.session.setIdentity(identity);
+        this.deps.session.setSeed(seed);
+        // Migrate a legacy account into the vault if it has no password factor.
+        if (!vaultSeed)
+            await this.migrateLegacyPasswordFactor(username, password, seed);
+    }
+    /**
+     * Generate a 24-word **recovery phrase** that encodes the master seed, and
+     * record a marker in the vault so the UI knows one exists. Show the returned
+     * phrase to the user ONCE — it's never stored server-side (the phrase *is* the
+     * seed). Requires being signed in (the seed must be held in memory).
+     */
+    async enrollRecoveryPhrase() {
+        const seed = this.deps.session.seed;
+        const token = this.deps.session.token;
+        if (!seed || !token) {
+            throw new Error("Sign in first to set up a recovery phrase.");
+        }
+        const mnemonic = seedToMnemonic(seed);
+        await this.deps.auth.vaultPutFactor(token, { id: "phrase", type: "phrase-marker", createdAt: Date.now() });
+        return mnemonic;
+    }
+    /**
+     * Recover an account with its recovery phrase (the "forgot password" path).
+     * Decodes the phrase to the master seed → identity → session. After this,
+     * call {@link changePassword} to set a new password. No server lookup needed.
+     */
+    async recoverWithPhrase(username, mnemonic, opts = {}) {
+        const seed = mnemonicToSeed(mnemonic);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        return user;
+    }
+    /**
+     * Add an **email** as a recovery + login factor (M2 verification-gated:
+     * the server only releases the split-key OPRF eval after the address is
+     * OTP-verified). Sends the code, then returns a `confirm` continuation:
+     *
+     *   const { confirm } = await client.auth.zk.enrollEmailFactor("me@x.com");
+     *   await confirm(codeFromInbox);
+     *
+     * Requires being signed in with the seed held (like the other enrolls).
+     * Custody note: gated factors trade some custody for recoverability — the
+     * trade-off should be disclosed in the enroll UI.
+     */
+    async enrollEmailFactor(email) {
+        const seed = this.deps.session.seed;
+        const token = this.deps.session.token;
+        const username = this.deps.session.username;
+        if (!seed || !token || !username) {
+            throw new Error("Sign in first to add a recovery email.");
+        }
+        await this.deps.auth.emailOtpStart({ token, email });
+        return {
+            email,
+            confirm: async (code) => {
+                const { verifyToken, email: verified } = await this.deps.auth.emailOtpVerify({ token, code });
+                const input = await emailFactorInput(username, verified);
+                const { blind, blinded } = gatedBlind(input);
+                const evals = await this.deps.auth.oprfEvaluateGated(username, toBase64(blinded), "email", "enroll", verifyToken);
+                const key = await gatedWrapKey(input, blind, evals.evaluated, evals.evaluated2);
+                const wrapped = await wrapSeed(seed, key);
+                await this.deps.auth.vaultPutFactor(token, { id: "email", type: "email", wrap: wrapped.ct, iv: wrapped.iv, params: { email: verified }, createdAt: Date.now() }, verifyToken);
+            },
+        };
+    }
+    /**
+     * Recover an account via its enrolled **email** factor. Sends a code to the
+     * enrolled address (the response never reveals whether one exists), then
+     * `confirm(code)` completes: gated read + split-key eval → unwrap seed →
+     * normal ZK login. After this, call {@link changePassword} to set a new
+     * password.
+     *
+     *   const { confirm } = await client.auth.zk.recoverWithEmail("alice");
+     *   const user = await confirm(codeFromInbox);
+     */
+    async recoverWithEmail(username, opts = {}) {
+        await this.deps.auth.emailOtpStart({ username });
+        return {
+            confirm: async (code) => {
+                const { verifyToken, email } = await this.deps.auth.emailOtpVerify({ username, code });
+                const { factor } = await this.deps.auth.vaultRead(username, "email", verifyToken);
+                if (!factor?.wrap || !factor?.iv) {
+                    throw new Error("This account has no email recovery set up.");
+                }
+                const input = await emailFactorInput(username, email);
+                const { blind, blinded } = gatedBlind(input);
+                const evals = await this.deps.auth.oprfEvaluateGated(username, toBase64(blinded), "email", "recover", verifyToken);
+                const key = await gatedWrapKey(input, blind, evals.evaluated, evals.evaluated2);
+                const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
+                const identity = await deriveIdentityFromSeed(seed);
+                const user = await this.proveAndStore(username, identity, opts);
+                this.deps.session.setSeed(seed);
+                return user;
+            },
+        };
+    }
+    // --- Google factor (M2.3) ------------------------------------------------
+    // Google is pure authentication UX: its verified ID token gates the
+    // split-key OPRF eval that releases the master seed. The ZK identity layer
+    // is unchanged. The app obtains `idToken` via Google Identity Services and
+    // passes it in; the SDK never renders Google UI.
+    /**
+     * Link a Google account as a recovery + login factor. Requires being signed
+     * in with the seed held. `idToken` is a fresh Google ID token (GIS).
+     */
+    async enrollGoogleFactor(idToken) {
+        const seed = this.deps.session.seed;
+        const token = this.deps.session.token;
+        const username = this.deps.session.username;
+        if (!seed || !token || !username)
+            throw new Error("Sign in first to link a Google account.");
+        const { verifyToken, sub, emailHint } = await this.deps.auth.googleVerify({ idToken, token });
+        const input = await googleFactorInput(username, sub);
+        const { blind, blinded } = gatedBlind(input);
+        const evals = await this.deps.auth.oprfEvaluateGated(username, toBase64(blinded), "google", "enroll", verifyToken);
+        const key = await gatedWrapKey(input, blind, evals.evaluated, evals.evaluated2);
+        const wrapped = await wrapSeed(seed, key);
+        await this.deps.auth.vaultPutFactor(token, { id: "google", type: "google", wrap: wrapped.ct, iv: wrapped.iv, params: { sub, emailHint: emailHint ?? undefined }, createdAt: Date.now() }, verifyToken);
+    }
+    /**
+     * Sign in with Google — verify the ID token, unlock the seed via the gated
+     * split-key eval, and establish a session. Same machinery serves "Sign in
+     * with Google" and "recover with Google"; the account must have linked the
+     * factor first.
+     */
+    async loginWithGoogle(username, idToken, opts = {}) {
+        const { verifyToken, sub } = await this.deps.auth.googleVerify({ idToken, username });
+        const { factor } = await this.deps.auth.vaultRead(username, "google", verifyToken);
+        if (!factor?.wrap || !factor?.iv)
+            throw new Error("No Google account is linked to this username.");
+        const input = await googleFactorInput(username, sub);
+        const { blind, blinded } = gatedBlind(input);
+        const evals = await this.deps.auth.oprfEvaluateGated(username, toBase64(blinded), "google", "recover", verifyToken);
+        const key = await gatedWrapKey(input, blind, evals.evaluated, evals.evaluated2);
+        const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        return user;
+    }
+    /**
+     * Register a brand-new, **passwordless** account whose only factor is Google.
+     * A random master seed is generated and wrapped under the Google-gated key;
+     * the user can add a password / passkey / phrase later. The ZK registration
+     * is identical to a password signup.
+     */
+    async registerWithGoogle(username, idToken) {
+        const seed = randomSeed();
+        const identity = await deriveIdentityFromSeed(seed);
+        const commitment = await this.commitmentFor(identity);
+        await this.deps.auth.register({
+            username,
+            commitment,
+            ecdhPublicKey: await exportPublicKeyBase64(identity.ecdhKeyPair.publicKey),
+            ecdsaPublicKey: await exportPublicKeyBase64(identity.ecdsaKeyPair.publicKey),
+            email: null,
+        });
+        const user = await this.proveAndStore(username, identity, {});
+        this.deps.session.setSeed(seed);
+        // Enroll Google as the sole factor (session + seed are now in hand).
+        await this.enrollGoogleFactor(idToken);
+        return user;
+    }
+    /**
+     * Change the password — re-wraps the (unchanged) master seed under the new
+     * password's OPRF-gated key. The identity/commitment never moves. Requires
+     * being signed in (or freshly recovered) so the seed is held.
+     */
+    async changePassword(newPassword) {
+        const seed = this.deps.session.seed;
+        const username = this.deps.session.username;
+        const token = this.deps.session.token;
+        if (!seed || !username || !token) {
+            throw new Error("Sign in first to change your password.");
+        }
+        await this.enrollPasswordFactor(username, newPassword, seed, token);
+    }
+    /** Whether this browser can use passkeys (WebAuthn) at all. */
+    passkeyAvailable() {
+        return passkeySupported();
+    }
+    /**
+     * Whether this browser's authenticator can do the **PRF extension** our
+     * passkey factor requires. A browser may support passkeys generally but not
+     * PRF — in which case enrolling one would fail. Resolves `true`/`false`, or
+     * `null` when it can't be determined (no capabilities API). Use this to gate
+     * the passkey UI so users don't hit a dead-end error.
+     */
+    async passkeyPrfAvailable() {
+        return passkeyPrfCapable();
+    }
+    /**
+     * Add a **passkey** recovery factor. Creates a WebAuthn passkey with PRF,
+     * wraps the master seed under its PRF output, and stores the factor. The
+     * passkey (synced via the platform's keychain) then unlocks the account on
+     * any device — no password. Requires being signed in (seed held in memory).
+     */
+    async enrollPasskey(opts) {
+        const seed = this.deps.session.seed;
+        const token = this.deps.session.token;
+        const username = this.deps.session.username;
+        if (!seed || !token || !username) {
+            throw new Error("Sign in first to add a passkey.");
+        }
+        const rpId = opts?.rpId ?? defaultRpId();
+        const { credentialId, prfSalt, prfOutput } = await createPasskeyWithPrf({
+            rpId,
+            rpName: opts?.rpName ?? "Muhkoo",
+            username,
+        });
+        const key = await wrapKeyFromBytes(prfOutput, "muhkoo-passkey-wrap");
+        const wrapped = await wrapSeed(seed, key);
+        await this.deps.auth.vaultPutFactor(token, {
+            id: `passkey:${toBase64(credentialId).slice(0, 16)}`,
+            type: "passkey",
+            wrap: wrapped.ct,
+            iv: wrapped.iv,
+            params: { credentialId: toBase64(credentialId), prfSalt: toBase64(prfSalt), rpId },
+            label: opts?.label ?? "Passkey",
+            createdAt: Date.now(),
+        });
+    }
+    /**
+     * Sign in with a passkey (no password). Reads the passkey factor, evaluates
+     * its PRF, unwraps the master seed → identity → session.
+     */
+    async loginWithPasskey(username, opts = {}) {
+        const { factor } = await this.deps.auth.vaultRead(username, "passkey");
+        const params = factor?.params;
+        if (!factor?.wrap || !factor?.iv || !params?.credentialId || !params?.prfSalt) {
+            throw new Error("No passkey is set up for this account.");
+        }
+        const prfOutput = await evaluatePasskeyPrf(params.rpId ?? defaultRpId(), fromBase64(params.credentialId), fromBase64(params.prfSalt));
+        const key = await wrapKeyFromBytes(prfOutput, "muhkoo-passkey-wrap");
+        const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        return user;
+    }
+    /**
+     * List the user's enrolled login methods (metadata only). Session-authed.
+     * Gated factors (email/google) carry a `masked` display hint
+     * ("m•••@gmail.com"); the full value is never returned.
+     */
+    async listFactors() {
+        const token = this.deps.session.token;
+        if (!token)
+            throw new Error("Sign in first to view your login methods.");
+        const { factors } = await this.deps.auth.vaultFactors(token);
+        return factors;
+    }
+    /** Remove a login method by id (can't remove your only one). Session-authed. */
+    async removeFactor(id) {
+        const token = this.deps.session.token;
+        if (!token)
+            throw new Error("Sign in first to manage your login methods.");
+        await this.deps.auth.vaultDeleteFactor(token, id);
     }
     /** Sign out: clears the session, identity, and persisted token. */
     async logout() {
@@ -5093,6 +6045,16 @@ class ZkAuth {
     get token() {
         return this.deps.session.token;
     }
+    /**
+     * The master seed as base64, or `null` when locked. The host app uses this to
+     * wrap app-level data (e.g. chat ratchet keys) to the **seed** instead of the
+     * password — so that data survives password changes and can be unlocked by a
+     * passwordless (passkey) login, both of which recover the same seed.
+     */
+    get seedBase64() {
+        const seed = this.deps.session.seed;
+        return seed ? toBase64(seed) : null;
+    }
     // -------------------------------------------------------------------------
     /** Poseidon commitment for an identity — the value the server stores. */
     async commitmentFor(identity) {
@@ -5101,12 +6063,82 @@ class ZkAuth {
         const ecdsaPubHex = await exportPublicKeyHex(identity.ecdsaKeyPair.publicKey);
         return buildCommitment(identity.secretHex, identity.saltHex, ecdsaPubHex);
     }
+    // ---- Identity vault (M1.0) ----------------------------------------------
+    /**
+     * Derive the OPRF-gated wrap key for the password factor: `scrypt(password)`
+     * is blinded, evaluated by the server's secret OPRF key (so it can't be
+     * derived offline), unblinded, then HKDF'd into an AES-GCM key.
+     */
+    async passwordWrapKey(username, password) {
+        const pre = passwordPreHash(username, password);
+        const { blind, blinded } = oprfBlind(pre);
+        const { evaluated } = await this.deps.auth.oprfEvaluate(username, toBase64(blinded));
+        return wrapKeyFromOprf(oprfFinalize(pre, blind, fromBase64(evaluated)));
+    }
+    /**
+     * Try to recover the master seed from the password factor.
+     *
+     * Returns `null` only when the vault read SUCCEEDS but the seed can't be
+     * unwrapped — i.e. there's no real factor (a pre-vault/legacy account, whose
+     * read returns a decoy that won't unwrap) or the password is wrong. The caller
+     * then legitimately falls back to the legacy password-derived identity.
+     *
+     * Throws {@link VaultUnavailableError} when the vault itself can't be reached
+     * (network / 5xx / rate-limit) — so a *transient* failure is NOT silently
+     * turned into a legacy fallback (which would surface as "commitment mismatch").
+     */
+    async tryUnlockSeed(username, password) {
+        const read = await this.deps.auth
+            .vaultRead(username, "password")
+            .catch((e) => { throw new VaultUnavailableError(e); });
+        const factor = read.factor;
+        if (!factor?.wrap || !factor?.iv)
+            return null; // genuinely no factor → legacy account
+        const key = await this
+            .passwordWrapKey(username, password)
+            .catch((e) => { throw new VaultUnavailableError(e); }); // OPRF eval unreachable / rate-limited
+        try {
+            return await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
+        }
+        catch {
+            return null; // factor present but won't unwrap → wrong password, or a decoy
+        }
+    }
+    /**
+     * Enroll/replace the password factor for `username` — wraps `seed` under the
+     * OPRF-gated key and stores it (needs a session `token`).
+     *
+     * Retries: this is the step that persists the (otherwise in-memory-only)
+     * master seed. If it fails after a fresh registration the account would be
+     * unrecoverable, so we retry a few times before surfacing the error.
+     */
+    async enrollPasswordFactor(username, password, seed, token) {
+        const key = await this.passwordWrapKey(username, password);
+        const wrapped = await wrapSeed(seed, key);
+        const factor = { id: "password", type: "password", wrap: wrapped.ct, iv: wrapped.iv, createdAt: Date.now() };
+        let lastErr;
+        for (let attempt = 0; attempt < 3; attempt++) {
+            try {
+                await this.deps.auth.vaultPutFactor(token, factor);
+                return;
+            }
+            catch (err) {
+                lastErr = err;
+                await new Promise((r) => setTimeout(r, 200 * (attempt + 1)));
+            }
+        }
+        throw new Error("Registration could not finish securing your account (vault enrollment failed). " +
+            "Please try again. " + (lastErr instanceof Error ? lastErr.message : ""));
+    }
 }
 /** `client.auth` — the auth namespace. Strategies hang off here. */
 class AuthNamespace {
     zk;
+    /** Centralized hosted auth (auth.muhkoo.dev) — `client.auth.hosted.login(...)`. */
+    hosted;
     constructor(deps) {
         this.zk = new ZkAuth(deps);
+        this.hosted = new HostedAuth({ auth: deps.auth, session: deps.session, authBaseUrl: deps.authBaseUrl });
     }
     /** Convenience pass-through: the currently signed-in user, or `null`. */
     get user() {
@@ -5139,13 +6171,13 @@ class StorageCipher {
         const iv = randomBytes(AES_GCM_IV_BYTES);
         const plaintext = utf8Encode(JSON.stringify(value));
         const ciphertext = await encryptAesGcm(key, iv, plaintext);
-        return { _enc: "a256gcm", iv: toBase64(iv), ct: toBase64(ciphertext) };
+        return { _enc: "a256gcm", iv: toBase64$1(iv), ct: toBase64$1(ciphertext) };
     }
     /** Open an {@link EncryptedEnvelope} back into the original value. */
     async decrypt(envelope) {
         const key = await this.keyPromise;
-        const iv = fromBase64(envelope.iv);
-        const ciphertext = fromBase64(envelope.ct);
+        const iv = fromBase64$1(envelope.iv);
+        const ciphertext = fromBase64$1(envelope.ct);
         const plaintext = await decryptAesGcm(key, iv, ciphertext);
         return JSON.parse(utf8Decode(plaintext));
     }
@@ -5603,12 +6635,12 @@ function canonicalMessage(fields) {
 /** Sign the canonical bytes with the sender's ECDSA identity private key. */
 async function signSpaceMessage(canonical, ecdsaPriv) {
     const sig = await getSubtle().sign(ECDSA_SIGN, ecdsaPriv, utf8Encode(canonical));
-    return toBase64(new Uint8Array(sig));
+    return toBase64$1(new Uint8Array(sig));
 }
 /** Verify a signature over the canonical bytes against the sender's ECDSA key. */
 async function verifySpaceMessage(canonical, sigB64, ecdsaPub) {
     try {
-        return await getSubtle().verify(ECDSA_SIGN, ecdsaPub, fromBase64(sigB64), utf8Encode(canonical));
+        return await getSubtle().verify(ECDSA_SIGN, ecdsaPub, fromBase64$1(sigB64), utf8Encode(canonical));
     }
     catch {
         return false;
@@ -5644,8 +6676,8 @@ async function wrapSpaceKey(kSpace, epoch, recipientEcdhPub) {
     return {
         epoch,
         ephemeralPub: await exportEcdhPublicKey(eph.publicKey),
-        iv: toBase64(iv),
-        ciphertext: toBase64(ciphertext),
+        iv: toBase64$1(iv),
+        ciphertext: toBase64$1(ciphertext),
         alg: WRAP_ALG,
     };
 }
@@ -5657,7 +6689,7 @@ async function unwrapSpaceKey(wrapped, ownEcdhPriv) {
     const ephPub = await importEcdhPublicKey(wrapped.ephemeralPub);
     const shared = new Uint8Array(await getSubtle().deriveBits({ name: "ECDH", public: ephPub }, ownEcdhPriv, P384_BITS));
     const wrapKey = await deriveBitsHkdf(shared, WRAP_INFO, AES_GCM_KEY_BYTES, utf8Encode(`epoch:${wrapped.epoch}`));
-    return decryptAesGcm(wrapKey, fromBase64(wrapped.iv), fromBase64(wrapped.ciphertext));
+    return decryptAesGcm(wrapKey, fromBase64$1(wrapped.iv), fromBase64$1(wrapped.ciphertext));
 }
 // ---------------------------------------------------------------------------
 // Message sealing
@@ -5666,14 +6698,14 @@ async function unwrapSpaceKey(wrapped, ownEcdhPriv) {
 async function sealSerialized(kSpace, serialized) {
     const iv = randomBytes(AES_GCM_IV_BYTES);
     const ciphertext = await encryptAesGcm(kSpace, iv, utf8Encode(serialized));
-    return { iv: toBase64(iv), ciphertext: toBase64(ciphertext) };
+    return { iv: toBase64$1(iv), ciphertext: toBase64$1(ciphertext) };
 }
 /**
  * Open a sealed payload back into its serialized message string. Throws (GCM
  * tag failure) on the wrong group key or a tampered ciphertext.
  */
 async function openSerialized(kSpace, iv, ciphertext) {
-    const plaintext = await decryptAesGcm(kSpace, fromBase64(iv), fromBase64(ciphertext));
+    const plaintext = await decryptAesGcm(kSpace, fromBase64$1(iv), fromBase64$1(ciphertext));
     return utf8Decode(plaintext);
 }
 
@@ -6465,7 +7497,7 @@ class SpaceKeyring {
         if (!cached)
             return false;
         for (const [epochStr, b64] of Object.entries(cached)) {
-            this.keys.set(Number(epochStr), fromBase64(b64));
+            this.keys.set(Number(epochStr), fromBase64$1(b64));
         }
         this.epoch = Math.max(0, ...Array.from(this.keys.keys()));
         return this.keys.size > 0;
@@ -6475,7 +7507,7 @@ class SpaceKeyring {
             return;
         const out = {};
         for (const [epoch, key] of this.keys)
-            out[String(epoch)] = toBase64(key);
+            out[String(epoch)] = toBase64$1(key);
         // Best-effort: caching is an optimization; a write failure (e.g. locked
         // storage) must not break key acquisition.
         try {
@@ -7010,6 +8042,7 @@ class AgentsNamespace {
  *   });
  *   // HTTP-reachable at  hello--<slug>.fns.muhkoo.dev
  *   await client.functions.enable(appId, config.functionId, spaceId); // Space-bound
+ *   const out = await client.functions.invoke({ name: 'hello', slug }, { body: { q: 1 } });
  *
  * These are MANAGEMENT calls — the function itself runs on the accelerator
  * (uploaded just-in-time, decrypted only at invocation). Only an app's owner or
@@ -7023,6 +8056,18 @@ class AgentsNamespace {
  * triggers: `http` (its own subdomain) and `space` (invoked on Space messages,
  * like a Programmable Agent).
  */
+/** The hosted platform's HTTP-function zone. */
+const DEFAULT_FN_HOST_SUFFIX = "fns.muhkoo.dev";
+/** Bodies `fetch` accepts natively — everything else is JSON-encoded. */
+function isRawBody(body) {
+    return (typeof body === "string" ||
+        body instanceof FormData ||
+        body instanceof Blob ||
+        body instanceof ArrayBuffer ||
+        ArrayBuffer.isView(body) ||
+        body instanceof URLSearchParams ||
+        (typeof ReadableStream !== "undefined" && body instanceof ReadableStream));
+}
 class FunctionsNamespace {
     deps;
     constructor(deps) {
@@ -7061,6 +8106,71 @@ class FunctionsNamespace {
     async disable(appId, functionId, spaceId, opts = {}) {
         return this.deps.http.post(this.path(appId, `/${encodeURIComponent(functionId)}/disable`, {}), { targetSpaceId: spaceId, space: opts.space });
     }
+    /**
+     * Invoke an HTTP-triggered function and parse its JSON response.
+     *
+     *   const out = await client.functions.invoke({ name: 'hello', slug: 'myapp' });
+     *   const out = await client.functions.invoke('hello--myapp', { body: { q: 1 } });
+     *   const out = await client.functions.invoke('https://hello--myapp.fns.muhkoo.dev/x');
+     *
+     * The request carries the SDK's credentials (`X-Muhkoo-Key` and, when a
+     * user is signed in, `X-Muhkoo-Session`) — the platform passes the session
+     * token through to the function, which can verify it server-side via
+     * `POST /api/auth/verify` to establish the caller's identity.
+     *
+     * Non-2xx responses throw {@link HttpError}. For functions that return
+     * something other than JSON, use {@link invokeRaw}.
+     */
+    async invoke(target, opts = {}) {
+        const res = await this.invokeRaw(target, opts);
+        let parsed = null;
+        try {
+            parsed = await res.json();
+        }
+        catch {
+            // Non-JSON body — fall through to the status-only error below.
+        }
+        if (!res.ok) {
+            const msg = parsed && typeof parsed === "object" && "error" in parsed
+                ? String(parsed.error)
+                : `${res.status} ${res.statusText}`;
+            throw new HttpError(msg, res.status, parsed);
+        }
+        return parsed;
+    }
+    /** Invoke an HTTP-triggered function and return the raw `Response`. */
+    async invokeRaw(target, opts = {}) {
+        const init = {
+            method: opts.method ?? (opts.body !== undefined ? "POST" : "GET"),
+        };
+        const headers = new Headers(opts.headers);
+        if (opts.body !== undefined) {
+            if (isRawBody(opts.body)) {
+                init.body = opts.body;
+            }
+            else {
+                init.body = JSON.stringify(opts.body);
+                if (!headers.has("Content-Type"))
+                    headers.set("Content-Type", "application/json");
+            }
+        }
+        init.headers = headers;
+        return this.deps.http.fetch(this.invokeUrl(target, opts.path), init);
+    }
+    /** Resolve an invoke target to the function's absolute URL. */
+    invokeUrl(target, path = "") {
+        const suffix = this.deps.fnHostSuffix ?? DEFAULT_FN_HOST_SUFFIX;
+        let base;
+        if (typeof target === "string") {
+            base = /^https?:\/\//.test(target) ? target : `https://${target}.${suffix}`;
+        }
+        else {
+            base = `https://${target.name}--${target.slug}.${suffix}`;
+        }
+        if (!path)
+            return base;
+        return `${base.replace(/\/+$/, "")}${path.startsWith("/") ? "" : "/"}${path}`;
+    }
     path(appId, suffix, opts) {
         const q = opts.space ? `?space=${encodeURIComponent(opts.space)}` : "";
         return `/api/apps/${encodeURIComponent(appId)}/functions${suffix}${q}`;
@@ -7092,6 +8202,8 @@ class FunctionsNamespace {
  */
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
 const DEFAULT_BASE_URL = "https://api.muhkoo.dev";
+/** The hosted auth SPA — the default {@link ClientOptions.authBaseUrl}. */
+const DEFAULT_AUTH_BASE_URL = "https://auth.muhkoo.dev";
 /**
  * Turn the HTTP base URL into a websocket base (`http(s)://` → `ws(s)://`).
  * The accelerator serves spaces over both on the same origin.
@@ -7124,6 +8236,13 @@ class Client {
     /** Shared in-flight recovery so a burst of 401s triggers one re-auth. */
     recoverInFlight = null;
     constructor(options = {}) {
+        // Build stamp — always logged (independent of logLevel) so the running
+        // build is identifiable in the console. Catches stale cached bundles
+        // during development; bump `VERSION` (and package.json) each build.
+        try {
+            console.info(`[@muhkoo/connect] initialized — v${VERSION}`);
+        }
+        catch { /* console may be unavailable in some runtimes */ }
         if (options.logLevel && typeof globalThis.appLogger?.setLevel === "function") {
             globalThis.appLogger.setLevel(options.logLevel);
         }
@@ -7142,7 +8261,8 @@ class Client {
         const circuits = options.circuits ?? defaultCircuitUrls(this.baseUrl);
         const authClient = new AuthClient({ baseUrl: this.baseUrl, fetch: this.http.fetch });
         const wsBaseUrl = toWsBase(this.baseUrl);
-        this.auth = new AuthNamespace({ auth: authClient, circuits, session: this.session });
+        const authBaseUrl = (options.authBaseUrl ?? DEFAULT_AUTH_BASE_URL).replace(/\/+$/, "");
+        this.auth = new AuthNamespace({ auth: authClient, circuits, session: this.session, authBaseUrl });
         this.kv = new KvNamespace({ http: this.http, session: this.session, wsBaseUrl });
         this.db = new DbNamespace({ http: this.http });
         this.storage = new StorageNamespace({ http: this.http, baseUrl: this.baseUrl, kv: this.kv });
@@ -7161,7 +8281,7 @@ class Client {
             cache: spaceKeyCache,
         });
         this.agents = new AgentsNamespace({ http: this.http });
-        this.functions = new FunctionsNamespace({ http: this.http });
+        this.functions = new FunctionsNamespace({ http: this.http, fnHostSuffix: options.functionsHostSuffix });
     }
     /** The currently signed-in user, or `null`. */
     get user() {
@@ -7452,5 +8572,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
   default: loadRsWasm
 });
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_BASE_URL, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, shardHash, signMessage, toField, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
+export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, VaultUnavailableError, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, toField, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
 //# sourceMappingURL=index.js.map