@muhkoo/connect 0.6.0-alpha.1 → 0.7.0-alpha.3

package/dist/server/index.js

@@ -1,6 +1,10 @@
 import { prove, verify as verify$1 } from '@zk-kit/groth16';
 import { p256 } from '@noble/curves/nist.js';
 import { buildPoseidon } from 'circomlibjs';
+import { scrypt } from '@noble/hashes/scrypt.js';
+import { entropyToMnemonic, validateMnemonic, mnemonicToEntropy } from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english.js';
+import { ristretto255_oprf } from '@noble/curves/ed25519.js';
 
 /**
  * WebCrypto subtle-interface resolver.
@@ -439,7 +443,7 @@ function fromHex(hex) {
     return out;
 }
 /** Encode a byte array as a standard base64 string. */
-function toBase64(bytes) {
+function toBase64$1(bytes) {
     let binary = "";
     for (let i = 0; i < bytes.length; i++) {
         binary += String.fromCharCode(bytes[i]);
@@ -447,7 +451,7 @@ function toBase64(bytes) {
     return btoa(binary);
 }
 /** Decode a standard base64 string to bytes. */
-function fromBase64(b64) {
+function fromBase64$1(b64) {
     const binary = atob(b64);
     const ab = new ArrayBuffer(binary.length);
     const out = new Uint8Array(ab);
@@ -457,13 +461,13 @@ function fromBase64(b64) {
 }
 /** Encode a byte array as a base64url string (no padding). */
 function toBase64Url(bytes) {
-    return toBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return toBase64$1(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 /** Decode a base64url string (with or without padding) to bytes. */
 function fromBase64Url(b64url) {
     const padded = b64url.replace(/-/g, "+").replace(/_/g, "/") +
         "=".repeat((4 - (b64url.length % 4)) % 4);
-    return fromBase64(padded);
+    return fromBase64$1(padded);
 }
 /** Concatenate any number of byte arrays into a single Uint8Array. */
 function concatBytes(...arrays) {
@@ -1041,10 +1045,10 @@ class KeyStore {
     async packDehydratedKeys(id) {
         const dehydrated = await this.dehydrateKeyPair(id);
         const combined = JSON.stringify(dehydrated);
-        return toBase64(new TextEncoder().encode(combined));
+        return toBase64$1(new TextEncoder().encode(combined));
     }
     async hydrateFromPacked(id, masterKey) {
-        const decoded = utf8Decode(fromBase64(masterKey));
+        const decoded = utf8Decode(fromBase64$1(masterKey));
         const dehydrated = JSON.parse(decoded);
         await this.hydrateKeyPair(id, dehydrated);
     }
@@ -1875,8 +1879,8 @@ class ChunkCipher {
      */
     generateKeyMaterial() {
         return {
-            key: toBase64(randomBytes(AES_GCM_KEY_BYTES)),
-            iv: toBase64(randomBytes(AES_GCM_IV_BYTES)),
+            key: toBase64$1(randomBytes(AES_GCM_KEY_BYTES)),
+            iv: toBase64$1(randomBytes(AES_GCM_IV_BYTES)),
         };
     }
     /**
@@ -1885,7 +1889,7 @@ class ChunkCipher {
      * GCM behavior).
      */
     async encryptChunk(plaintext, material) {
-        return encryptAesGcm(fromBase64(material.key), fromBase64(material.iv), plaintext);
+        return encryptAesGcm(fromBase64$1(material.key), fromBase64$1(material.iv), plaintext);
     }
     /**
      * Inverse of {@link encryptChunk}. Throws if the auth tag fails — that
@@ -1894,7 +1898,7 @@ class ChunkCipher {
      */
     async decryptChunk(ciphertext, material) {
         try {
-            return await decryptAesGcm(fromBase64(material.key), fromBase64(material.iv), ciphertext);
+            return await decryptAesGcm(fromBase64$1(material.key), fromBase64$1(material.iv), ciphertext);
         }
         catch {
             // WebCrypto throws a vague OperationError on GCM tag mismatch.
@@ -2370,6 +2374,100 @@ class AuthClient {
         const res = await this.fetchFn(`${this.baseUrl}/api/auth/verify`, this.json("POST", { token }));
         return await this.parse("verify", res);
     }
+    // ---- Identity vault (M1.0) ----------------------------------------------
+    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
+    async oprfEvaluate(username, blinded) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/oprf`, this.json("POST", { username, blinded }));
+        return await this.parse("oprfEvaluate", res);
+    }
+    /**
+     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
+     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
+     * domains' evaluations. The recover token is consumed by this call.
+     */
+    async oprfEvaluateGated(username, blinded, factorType, purpose, verifyToken) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/oprf`, this.json("POST", { username, blinded, factorType, purpose, verifyToken }));
+        return await this.parse("oprfEvaluateGated", res);
+    }
+    /**
+     * Request an email OTP. With a session `token` this is the ENROLL flow
+     * (code sent to `email`); without one it's RECOVER (code sent to the
+     * account's enrolled address — the response is uniform either way).
+     */
+    async emailOtpStart(opts) {
+        const init = this.json("POST", { email: opts.email, username: opts.username });
+        if (opts.token)
+            init.headers["X-Muhkoo-Session"] = opts.token;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/email/start`, init);
+        await this.parse("emailOtpStart", res);
+    }
+    /** Trade an emailed code for a single-use verifyToken (+ the proven address). */
+    async emailOtpVerify(opts) {
+        const init = this.json("POST", { code: opts.code, username: opts.username });
+        if (opts.token)
+            init.headers["X-Muhkoo-Session"] = opts.token;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/email/verify`, init);
+        return await this.parse("emailOtpVerify", res);
+    }
+    /**
+     * Verify a Google ID token (M2.3). With a session `token` it's the ENROLL
+     * gate; without, it's RECOVER/LOGIN (the Google account must already be
+     * linked). Returns a single-use verifyToken bound to the account's `sub`.
+     */
+    async googleVerify(opts) {
+        const init = this.json("POST", { idToken: opts.idToken, username: opts.username });
+        if (opts.token)
+            init.headers["X-Muhkoo-Session"] = opts.token;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/google/verify`, init);
+        return await this.parse("googleVerify", res);
+    }
+    // ---- Hosted-auth authorization-code flow (H0) ---------------------------
+    /** Mint a single-use authorization code for an app (called by the hosted page; session-authed). */
+    async grant(token, body) {
+        const init = this.json("POST", body);
+        init.headers["X-Muhkoo-Session"] = token;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/grant`, init);
+        return await this.parse("grant", res);
+    }
+    /** Exchange an authorization code + PKCE verifier for the session + sealed key material. */
+    async token(body) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/token`, this.json("POST", body));
+        return await this.parse("token", res);
+    }
+    /**
+     * Read a factor record for `username` (returns an indistinguishable decoy if
+     * absent). Gated types (email) require the recover `verifyToken`.
+     */
+    async vaultRead(username, factorType, verifyToken) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault`, this.json("POST", { username, factorType, verifyToken }));
+        return await this.parse("vaultRead", res);
+    }
+    /**
+     * Add/replace a factor (session-authed; the seed is already wrapped
+     * client-side). Email factors additionally require (and consume) the
+     * enroll `verifyToken`; the stored address must be the verified one.
+     */
+    async vaultPutFactor(token, factor, verifyToken) {
+        const init = this.json("PUT", { factor, verifyToken });
+        init.headers["Authorization"] = `Bearer ${token}`;
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault/factor`, init);
+        return await this.parse("vaultPutFactor", res);
+    }
+    /** List the user's factor metadata (no ciphertext). Session-authed. */
+    async vaultFactors(token) {
+        const init = { method: "GET", headers: { Authorization: `Bearer ${token}` } };
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault/factors`, init);
+        return await this.parse("vaultFactors", res);
+    }
+    /** Remove a factor by id (can't remove the last one). Session-authed. */
+    async vaultDeleteFactor(token, id) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault/factor`, {
+            method: "DELETE",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+            body: JSON.stringify({ id }),
+        });
+        return await this.parse("vaultDeleteFactor", res);
+    }
     // -------------------------------------------------------------------------
     // Internals
     // -------------------------------------------------------------------------
@@ -2487,7 +2585,31 @@ async function deriveIdentity(username, password) {
     if (typeof password !== "string" || password.length === 0) {
         throw new Error("deriveIdentity: `password` is required");
     }
-    const seed = await pbkdf2Bytes(password, "muhkoo-zk-v1:" + username, SCALAR_BYTES);
+    const seed = await deriveMasterSeedFromPassword(username, password);
+    return deriveIdentityFromSeed(seed);
+}
+/**
+ * Legacy master-seed derivation: `PBKDF2(password, "muhkoo-zk-v1:"||username)`.
+ *
+ * This was the *only* path pre-vault, where the identity descended directly from
+ * the password. It's kept so existing accounts still re-derive their seed (and
+ * the vault can adopt that exact seed on migration, preserving the commitment).
+ * New accounts use a random seed (`vault.randomSeed`) instead, so their identity
+ * is no longer a function of the password.
+ */
+async function deriveMasterSeedFromPassword(username, password) {
+    return pbkdf2Bytes(password, "muhkoo-zk-v1:" + username, SCALAR_BYTES);
+}
+/**
+ * Derive the (unchanged) ZK identity from a 32-byte **master seed**. The seed is
+ * HKDF-expanded into secret/salt + the P-256 ECDSA & ECDH keypairs exactly as
+ * before — so the resulting commitment is byte-identical for a given seed. The
+ * vault wraps THIS seed under each recovery factor.
+ */
+async function deriveIdentityFromSeed(seed) {
+    if (!(seed instanceof Uint8Array) || seed.length !== SCALAR_BYTES) {
+        throw new Error(`deriveIdentityFromSeed: expected a ${SCALAR_BYTES}-byte seed`);
+    }
     const secretBytes = await hkdfExpand(seed, "zk-secret", SCALAR_BYTES);
     const saltBytes = await hkdfExpand(seed, "zk-salt", SCALAR_BYTES);
     const ecdsaPriv = await hkdfExpand(seed, "ecdsa-priv", SCALAR_BYTES);
@@ -2716,6 +2838,139 @@ async function signMessage(message, privateKey) {
     return bytesToBase64(new Uint8Array(sig));
 }
 
+/**
+ * Identity vault primitives (M1.0).
+ *
+ * The vault decouples the identity from the password: a random 32-byte **master
+ * seed** yields the (unchanged) ZK identity via {@link deriveIdentityFromSeed},
+ * and that seed is AES-256-GCM-wrapped under one key *per factor* (password,
+ * passkey, recovery phrase). Server stores only ciphertext.
+ *
+ * This module holds the PURE primitives (seed gen, the memory-hard password
+ * pre-hash, AES-GCM wrap/unwrap, the OPRF -> wrap-key HKDF). The networked
+ * orchestration (calling the server's OPRF endpoint, fetching/storing factor
+ * records) lives in the AuthNamespace, which has transport access.
+ *
+ * Memory-hard KDF: we use **scrypt** (vetted, in `@noble/hashes`, runs in
+ * browser + Workers + Node - no wasm dependency) instead of argon2id; it is the
+ * pre-hash fed into the OPRF, so even if the OPRF key ever leaked, guesses still
+ * pay the scrypt cost.
+ */
+const TE$1 = new TextEncoder();
+// Interactive-login scrypt params (~100ms on a laptop). N must be a power of 2.
+const SCRYPT = { N: 1 << 15, r: 8, p: 1, dkLen: 32 };
+/** 32 random bytes - the master seed for a brand-new identity. */
+function randomSeed() {
+    return crypto.getRandomValues(new Uint8Array(32));
+}
+/** Memory-hard pre-hash of the password - the OPRF input. Salted by username. */
+function passwordPreHash(username, password) {
+    return scrypt(TE$1.encode(password), TE$1.encode("muhkoo-vault-v1:" + username.toLowerCase()), SCRYPT);
+}
+/** HKDF the 64-byte OPRF output into a non-extractable AES-256-GCM wrap key. */
+async function wrapKeyFromOprf(oprfOutput) {
+    const prk = await crypto.subtle.importKey("raw", oprfOutput, { name: "HKDF" }, false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array(), info: TE$1.encode("muhkoo-vault-wrap") }, prk, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+/** HKDF arbitrary 32-byte key material (e.g. a passkey PRF output) into an AES-GCM wrap key. */
+async function wrapKeyFromBytes(keyMaterial, info) {
+    const prk = await crypto.subtle.importKey("raw", keyMaterial, { name: "HKDF" }, false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array(), info: TE$1.encode(info) }, prk, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function wrapSeed(seed, key) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, seed);
+    return { iv: toBase64(iv), ct: toBase64(new Uint8Array(ct)) };
+}
+/** Decrypt a wrapped seed. Throws (AES-GCM tag failure) on a wrong key. */
+async function unwrapSeed(wrapped, key) {
+    const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv: fromBase64(wrapped.iv) }, key, fromBase64(wrapped.ct));
+    return new Uint8Array(pt);
+}
+function toBase64(bytes) {
+    let s = "";
+    for (let i = 0; i < bytes.length; i++)
+        s += String.fromCharCode(bytes[i]);
+    return btoa(s);
+}
+function fromBase64(b64) {
+    const s = atob(b64);
+    const out = new Uint8Array(s.length);
+    for (let i = 0; i < s.length; i++)
+        out[i] = s.charCodeAt(i);
+    return out;
+}
+
+/**
+ * Hosted-auth handoff crypto (auth.muhkoo.dev — AUTH_HOSTED_PLAN.md §3).
+ *
+ * The hosted page authenticates the user and ends up holding the master seed.
+ * To pass it to the developer's app without it ever sitting server-readable or
+ * landing in browser history:
+ *
+ *   1. {@link sealSeed} generates a one-time key K_t, AES-256-GCM-seals the seed
+ *      under it, and returns the ciphertext envelope (`sealedKeys`, stored in
+ *      the grant the server relays but can't read) plus K_t (`fragmentKey`,
+ *      placed ONLY in the redirect URL fragment — fragments never hit a server).
+ *   2. The app exchanges the code for `sealedKeys`, reads K_t from the fragment,
+ *      and {@link unsealSeed} recovers the seed, then strips the fragment.
+ *
+ * Trust-equivalent to today's embedded SDK (the app still ends up with the
+ * seed) while moving credential entry onto the Muhkoo origin. The envelope is
+ * versioned so a future per-app-key handoff (v2) can swap in without a protocol
+ * change.
+ */
+const TE = new TextEncoder();
+const TD = new TextDecoder();
+/** Seal the master seed under a fresh one-time key for the redirect handoff. */
+async function sealSeed(seed) {
+    const ktRaw = crypto.getRandomValues(new Uint8Array(32));
+    const key = await crypto.subtle.importKey("raw", ktRaw, { name: "AES-GCM" }, false, ["encrypt"]);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, key, seed));
+    const envelope = { v: 1, iv: toBase64(iv), ct: toBase64(ct) };
+    return {
+        sealedKeys: toBase64(TE.encode(JSON.stringify(envelope))),
+        fragmentKey: base64UrlEncode(ktRaw),
+    };
+}
+/** Recover the master seed from the sealed envelope + the fragment key. */
+async function unsealSeed(sealedKeys, fragmentKey) {
+    const envelope = JSON.parse(TD.decode(fromBase64(sealedKeys)));
+    if (envelope.v !== 1)
+        throw new Error(`Unsupported handoff envelope version ${envelope.v}`);
+    const ktRaw = base64UrlDecode(fragmentKey);
+    const key = await crypto.subtle.importKey("raw", ktRaw, { name: "AES-GCM" }, false, ["decrypt"]);
+    const seed = await crypto.subtle.decrypt({ name: "AES-GCM", iv: fromBase64(envelope.iv) }, key, fromBase64(envelope.ct));
+    return new Uint8Array(seed);
+}
+/** Generate a PKCE verifier + S256 challenge for the authorize→token exchange. */
+async function generatePkce() {
+    const codeVerifier = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", TE.encode(codeVerifier)));
+    return { codeVerifier, codeChallenge: base64UrlEncode(digest) };
+}
+/** A random URL-safe value for the OAuth `state` (CSRF binding on the callback). */
+function randomState() {
+    return base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
+}
+function base64UrlEncode(bytes) {
+    return toBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(s) {
+    return fromBase64(s.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(s.length / 4) * 4, "="));
+}
+
+/**
+ * SDK build version — stamped to the console when a {@link Client} is created.
+ *
+ * During active development, bump the `-alpha.N` suffix whenever we ship a build
+ * so we can confirm in the browser console that the page is running the build we
+ * expect (and isn't serving a stale cached bundle). Keep this in sync with
+ * `package.json` `version`.
+ */
+const VERSION = "0.7.0-alpha.3";
+
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
  * accelerator over HTTP.
@@ -2933,6 +3188,10 @@ function defaultSessionStore(keyPrefix) {
 class SessionState {
     session = null;
     _identity = null;
+    /** The 32-byte master seed, in-memory only (never persisted). Held after
+     *  login/register so additional recovery factors (passkey, phrase) can be
+     *  enrolled, and a password can be changed, without re-deriving. */
+    _seed = null;
     store;
     constructor(store) {
         this.store = store ?? new MemorySessionStore();
@@ -2974,6 +3233,14 @@ class SessionState {
     setIdentity(identity) {
         this._identity = identity;
     }
+    /** The in-memory master seed (or null when locked / not held). */
+    get seed() {
+        return this._seed;
+    }
+    /** Hold the master seed in memory (set on login/register when available). */
+    setSeed(seed) {
+        this._seed = seed;
+    }
     /** Load a persisted session (used by `restore()`); identity stays null. */
     async loadPersisted() {
         const loaded = await this.store.load();
@@ -2985,10 +3252,378 @@ class SessionState {
     async clear() {
         this.session = null;
         this._identity = null;
+        if (this._seed)
+            this._seed.fill(0); // wipe the master seed
+        this._seed = null;
         await this.store.clear();
     }
 }
 
+/**
+ * Recovery phrase (M1.2) — a 24-word BIP39 mnemonic that ENCODES the 32-byte
+ * master seed directly. Nothing is stored server-side (the phrase *is* the seed),
+ * so it's a fully offline, self-sovereign recovery factor: enter the phrase →
+ * decode → master seed → identity. A `phrase-marker` factor is kept in the vault
+ * only so the UI can show "recovery phrase: enabled".
+ */
+/** Encode a 32-byte master seed as a 24-word BIP39 recovery phrase. */
+function seedToMnemonic(seed) {
+    if (!(seed instanceof Uint8Array) || seed.length !== 32) {
+        throw new Error("seedToMnemonic: expected a 32-byte seed");
+    }
+    return entropyToMnemonic(seed, wordlist);
+}
+function normalize(mnemonic) {
+    return mnemonic.trim().toLowerCase().replace(/\s+/g, " ");
+}
+/** Decode a recovery phrase back to the 32-byte master seed. Throws if invalid. */
+function mnemonicToSeed(mnemonic) {
+    const m = normalize(mnemonic);
+    if (!validateMnemonic(m, wordlist))
+        throw new Error("Invalid recovery phrase.");
+    return mnemonicToEntropy(m, wordlist);
+}
+
+/**
+ * OPRF (Oblivious PRF) — RFC 9497, ristretto255-SHA512, mode 0x00.
+ *
+ * Used to gate the password/recovery factors of the identity vault
+ * ({@link ./vault}). The wrap key for a password factor is
+ * `HKDF(OPRF(serverKey, scrypt(password)))`, so:
+ *   - the client cannot derive the wrap key offline (it needs the server's
+ *     secret-keyed evaluation), and
+ *   - the server learns nothing — it only ever sees a *blinded* group element,
+ *     never the password or the resulting key.
+ *
+ * Net effect: a stolen vault blob is NOT offline-crackable; every guess costs a
+ * round-trip to a rate-limited server endpoint. The same OPRF backs the M2
+ * Google/email factors.
+ *
+ * Thin wrapper over `@noble/curves`' vetted `ristretto255_oprf` so the protocol
+ * (blind / blindEvaluate / finalize) lives in one named place. CLIENT uses
+ * {@link oprfBlind} + {@link oprfFinalize}; SERVER uses {@link oprfDeriveKey} +
+ * {@link oprfBlindEvaluate} (imported by the accelerator's VaultDO).
+ */
+const OPRF = ristretto255_oprf.oprf;
+// Domain separation for the server key derivation (RFC 9497 `info`).
+new TextEncoder().encode("muhkoo-oprf-v1");
+/** CLIENT: blind `input` (e.g. `scrypt(password)`) before the server eval. */
+function oprfBlind(input) {
+    const { blind, blinded } = OPRF.blind(input);
+    return { blind, blinded };
+}
+/** CLIENT: fold the server's blinded evaluation into the final 64-byte OPRF output. */
+function oprfFinalize(input, blind, evaluated) {
+    return OPRF.finalize(input, blind, evaluated);
+}
+
+/**
+ * Verification-gated vault factors (M2 — email, later Google).
+ *
+ * These factors have NO client-side secret: the user proves *channel control*
+ * (an email OTP) and the server releases a split-key OPRF evaluation —
+ * `wrapKey = HKDF( OPRF(K1, input) ‖ OPRF(K2, input) )` where K1 lives on the
+ * accelerator and K2 in a separate trust domain, so no single server-side
+ * compromise can derive the wrap key offline. See accelerator
+ * `AUTH_M2_PLAN.md` §1; the canonical reference implementation is
+ * accelerator `tests/gated-oprf.test.ts` — keep these derivations in
+ * byte-exact lockstep with it.
+ */
+/**
+ * Deterministic OPRF input for an email factor. Public-ish by design (the
+ * verification gate, not the input, is what protects the eval) — but it must
+ * be stable forever: username + address are lowercased, the tag is versioned.
+ */
+async function emailFactorInput(username, email) {
+    const tag = `muhkoo/factor:email:v1:${username.toLowerCase()}:${email.toLowerCase()}`;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(tag));
+    return new Uint8Array(digest);
+}
+/**
+ * Deterministic OPRF input for a google factor — keyed on the stable Google
+ * account id (`sub`), not the email (which can change). Same versioning rules
+ * as {@link emailFactorInput}.
+ */
+async function googleFactorInput(username, sub) {
+    const tag = `muhkoo/factor:google:v1:${username.toLowerCase()}:${sub}`;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(tag));
+    return new Uint8Array(digest);
+}
+/** Blind a gated input for the split eval (same blind serves both domains). */
+function gatedBlind(input) {
+    return oprfBlind(input);
+}
+/**
+ * Fold the two domains' evaluations into the AES-256-GCM wrap key:
+ * unblind each, concatenate, HKDF with the gated-factor domain separation.
+ */
+async function gatedWrapKey(input, blind, evaluatedB64, evaluated2B64) {
+    const out1 = oprfFinalize(input, blind, fromBase64(evaluatedB64));
+    const out2 = oprfFinalize(input, blind, fromBase64(evaluated2B64));
+    const ikm = new Uint8Array(out1.length + out2.length);
+    ikm.set(out1);
+    ikm.set(out2, out1.length);
+    return wrapKeyFromBytes(ikm, "muhkoo-gated-wrap-v1");
+}
+
+/**
+ * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
+ *
+ * A passkey becomes a device-bound, platform-synced source of a stable secret:
+ * for a fixed salt, the authenticator's PRF returns the same 32 bytes, which we
+ * HKDF into an AES key that wraps the master seed. The server never sees the
+ * passkey — it's purely a local key source; the ZK proof remains the server auth.
+ *
+ * BROWSER ONLY (`navigator.credentials`). The PRF extension fields aren't in the
+ * standard DOM types yet, so they're reached through narrow casts.
+ */
+function rand(n) {
+    return crypto.getRandomValues(new Uint8Array(n));
+}
+/** Whether this environment can do WebAuthn at all. (PRF support is checked at enroll.) */
+function passkeySupported() {
+    return (typeof navigator !== "undefined" &&
+        !!navigator.credentials &&
+        typeof PublicKeyCredential !== "undefined");
+}
+/**
+ * Whether this browser's authenticator can do the **PRF extension** our passkey
+ * factor needs. A browser can save passkeys (e.g. for password autofill) yet not
+ * expose PRF — PRF is what derives the stable secret we wrap the seed under, so a
+ * passkey without it is useless to us.
+ *
+ * Uses `PublicKeyCredential.getClientCapabilities()` (the `extension:prf` cap)
+ * where available. Returns:
+ *   - `true`  — PRF is supported,
+ *   - `false` — definitively NOT supported (hide the option),
+ *   - `null`  — couldn't determine (older browser without the capabilities API);
+ *              the caller may optimistically allow and let enroll surface a real
+ *              error if it turns out PRF isn't there.
+ */
+async function passkeyPrfCapable() {
+    if (!passkeySupported())
+        return false;
+    const PC = PublicKeyCredential;
+    if (typeof PC.getClientCapabilities !== "function")
+        return null;
+    try {
+        const caps = await PC.getClientCapabilities();
+        // The spec keys extension caps as `extension:<name>`; tolerate variants.
+        const prf = caps["extension:prf"] ?? caps["extensions:prf"] ?? caps["prf"];
+        return typeof prf === "boolean" ? prf : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Best-effort registrable RP id — the host. Apps spanning subdomains should pass
+ *  the parent domain (e.g. "muhkoo.dev") explicitly. */
+function defaultRpId() {
+    return typeof location !== "undefined" ? location.hostname : "";
+}
+/**
+ * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
+ * the PRF output for that salt. Throws if the authenticator can't do PRF.
+ */
+async function createPasskeyWithPrf(opts) {
+    if (!passkeySupported())
+        throw new Error("Passkeys aren't supported in this browser.");
+    const created = (await navigator.credentials.create({
+        publicKey: {
+            rp: { id: opts.rpId, name: opts.rpName },
+            user: { id: rand(16), name: opts.username, displayName: opts.username },
+            challenge: rand(32),
+            pubKeyCredParams: [{ type: "public-key", alg: -7 }, { type: "public-key", alg: -257 }],
+            authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" },
+            extensions: { prf: {} },
+        },
+    }));
+    if (!created)
+        throw new Error("Passkey creation was cancelled.");
+    const credentialId = new Uint8Array(created.rawId);
+    // Don't trust `prf.enabled` from create() alone — several browsers only report
+    // PRF support on the first get() eval, so a precheck false-negatives. Try the
+    // actual PRF eval; if it yields a result, PRF works.
+    const prfSalt = rand(32);
+    let prfOutput;
+    try {
+        prfOutput = await evaluatePasskeyPrf(opts.rpId, credentialId, prfSalt);
+    }
+    catch {
+        // Empty PRF result almost always means a third-party credential manager
+        // (e.g. a browser password-manager extension) handled the request instead of
+        // the platform authenticator, and that manager doesn't implement PRF. The
+        // device's built-in passkey (Touch ID / Windows Hello / iCloud Keychain)
+        // normally does — so steer the user there rather than blaming the device.
+        throw new Error("That passkey can't be used for recovery — it didn't return a PRF result. " +
+            "A browser password-manager extension may have handled it; try again and " +
+            "pick your device's built-in passkey (Touch ID / Windows Hello), or use a " +
+            "recovery phrase instead.");
+    }
+    return { credentialId, prfSalt, prfOutput };
+}
+/** Evaluate a passkey's PRF for `salt` → 32 bytes. Used at recover/login. */
+async function evaluatePasskeyPrf(rpId, credentialId, salt) {
+    if (!passkeySupported())
+        throw new Error("Passkeys aren't supported in this browser.");
+    const assertion = (await navigator.credentials.get({
+        publicKey: {
+            rpId,
+            challenge: rand(32),
+            allowCredentials: [{ type: "public-key", id: credentialId }],
+            userVerification: "preferred",
+            extensions: { prf: { eval: { first: salt } } },
+        },
+    }));
+    if (!assertion)
+        throw new Error("Passkey authentication was cancelled.");
+    const results = assertion.getClientExtensionResults()?.prf?.results;
+    if (!results?.first)
+        throw new Error("Your passkey didn't return a PRF result.");
+    return new Uint8Array(results.first);
+}
+
+/**
+ * `client.auth.hosted` — centralized hosted auth (auth.muhkoo.dev).
+ * AUTH_HOSTED_PLAN.md.
+ *
+ * Two sides share this class:
+ *   - **Developer apps** call {@link login} (redirect to the hosted page) and
+ *     {@link handleCallback} (exchange the returned code → session + seed). The
+ *     app carries no snarkjs and never sees the user's credentials.
+ *   - **The hosted page** (the muhkoo/auth SPA), once it has authenticated the
+ *     user via the normal `client.auth.zk.*` flow, calls
+ *     {@link completeAuthorize} to seal the seed, mint the grant, and build the
+ *     redirect-back URL.
+ *
+ * Flow (authorization-code + PKCE + sealed-seed handoff):
+ *   app  →  GET  auth.muhkoo.dev/authorize?app_id&redirect_uri&state&code_challenge
+ *   page →  (user authenticates) → POST /api/auth/grant → redirect_uri?code&state#k=<K_t>
+ *   app  →  POST /api/auth/token {code, code_verifier} → {sessionToken, sealedKeys}
+ *        →  unseal sealedKeys with K_t → master seed → session ready
+ */
+const PKCE_STORE_KEY = "muhkoo.hosted.pkce";
+class HostedAuth {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * (App side) Begin hosted login: stash a PKCE verifier + state, then send
+     * the browser to the hosted authorize page. Returns the URL it redirects to
+     * (also useful for popup mode / tests). `redirectUri` must be registered for
+     * the app in the portal.
+     */
+    async login(opts) {
+        const { codeVerifier, codeChallenge } = await generatePkce();
+        const state = randomState();
+        this.store({ codeVerifier, state, appId: opts.appId, redirectUri: opts.redirectUri });
+        const url = `${this.deps.authBaseUrl}/authorize?` + new URLSearchParams({
+            app_id: opts.appId,
+            redirect_uri: opts.redirectUri,
+            state,
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+        }).toString();
+        if (opts.redirect !== false)
+            this.location().assign(url);
+        return url;
+    }
+    /** Whether the current URL looks like a hosted-auth callback (has code + state). */
+    isCallback() {
+        try {
+            const q = new URLSearchParams(this.location().search);
+            return q.has("code") && q.has("state");
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * (App side) Complete login on the callback URL: verify state, exchange the
+     * code (+ PKCE verifier) for the session, unseal the seed from the fragment,
+     * establish the session, and scrub the URL. Returns the signed-in user.
+     */
+    async handleCallback() {
+        const loc = this.location();
+        const query = new URLSearchParams(loc.search);
+        const code = query.get("code");
+        const state = query.get("state");
+        const fragmentKey = new URLSearchParams(loc.hash.replace(/^#/, "")).get("k");
+        if (!code || !state)
+            throw new Error("Not a hosted-auth callback.");
+        if (!fragmentKey)
+            throw new Error("Missing handoff key — the login link was altered.");
+        const stash = this.take();
+        if (!stash || stash.state !== state)
+            throw new Error("State mismatch — possible CSRF; start login again.");
+        const res = await this.deps.auth.token({ code, codeVerifier: stash.codeVerifier, appId: stash.appId });
+        const seed = await unsealSeed(res.sealedKeys, fragmentKey);
+        const identity = await deriveIdentityFromSeed(seed);
+        await this.deps.session.setSession({ token: res.sessionToken, username: res.username, commitment: res.commitment });
+        this.deps.session.setIdentity(identity);
+        this.deps.session.setSeed(seed);
+        this.scrubUrl();
+        return { username: res.username, commitment: res.commitment };
+    }
+    /**
+     * (Hosted-page side) Finish an /authorize request after the user has
+     * authenticated here: seal the in-memory seed, mint the grant, and return
+     * the URL to redirect the browser back to. The seed must be held (the user
+     * just signed in via `client.auth.zk.*`).
+     */
+    async completeAuthorize(opts) {
+        const token = this.deps.session.token;
+        const seed = this.deps.session.seed;
+        if (!token || !seed)
+            throw new Error("Authenticate the user before completing authorization.");
+        const { sealedKeys, fragmentKey } = await sealSeed(seed);
+        const { code } = await this.deps.auth.grant(token, {
+            appId: opts.appId, redirectUri: opts.redirectUri, codeChallenge: opts.codeChallenge, sealedKeys,
+        });
+        const url = new URL(opts.redirectUri);
+        url.searchParams.set("code", code);
+        url.searchParams.set("state", opts.state);
+        url.hash = `k=${fragmentKey}`;
+        return url.toString();
+    }
+    // ---- internals ----------------------------------------------------------
+    location() {
+        const loc = globalThis.location;
+        if (!loc)
+            throw new Error("Hosted auth requires a browser environment.");
+        return loc;
+    }
+    store(v) {
+        const ss = globalThis.sessionStorage;
+        if (!ss)
+            throw new Error("Hosted auth requires sessionStorage.");
+        ss.setItem(PKCE_STORE_KEY, JSON.stringify(v));
+    }
+    take() {
+        const ss = globalThis.sessionStorage;
+        if (!ss)
+            return null;
+        const raw = ss.getItem(PKCE_STORE_KEY);
+        if (!raw)
+            return null;
+        ss.removeItem(PKCE_STORE_KEY);
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Drop `code`, `state`, and the `#k` fragment from the address bar. */
+    scrubUrl() {
+        const h = globalThis.history;
+        const loc = this.location();
+        if (h?.replaceState)
+            h.replaceState(null, "", loc.pathname);
+    }
+}
+
 /**
  * `client.auth` — user authentication, exposed today through the `zk`
  * sub-namespace (`client.auth.zk.login(...)`). Leaving room under `auth` for
@@ -3005,6 +3640,24 @@ class SessionState {
  * {@link SessionState} so the storage + message namespaces can reuse it for
  * at-rest encryption and the messaging ratchet without re-deriving.
  */
+/**
+ * Thrown when the identity vault can't be reached to unlock the seed — a network
+ * failure, a 5xx, or the per-user rate limit (429). This is distinct from a wrong
+ * password, and is surfaced so `login`/`unlock` do NOT silently fall back to the
+ * legacy password derivation (which, for a vault account, yields a misleading
+ * "commitment mismatch"). Callers should ask the user to retry, not re-enter a
+ * password.
+ */
+class VaultUnavailableError extends Error {
+    constructor(cause) {
+        const detail = cause instanceof Error ? cause.message : String(cause ?? "");
+        super(/too many|rate.?limit|\b429\b/i.test(detail)
+            ? "Too many attempts — please wait a moment and try again."
+            : "Couldn't reach the secure vault. Check your connection and try again.");
+        this.name = "VaultUnavailableError";
+        this.cause = cause;
+    }
+}
 /**
  * ZK identity auth. One instance per {@link Client}; reads/writes the shared
  * {@link SessionState}.
@@ -3015,13 +3668,18 @@ class ZkAuth {
         this.deps = deps;
     }
     /**
-     * Register a new user, then (by default) sign them in. The identity is
-     * derived deterministically from `(username, password)` — the same inputs
-     * reproduce it on any device, so there's no key material to ship around.
+     * Register a new user, then (by default) sign them in.
+     *
+     * M1.0: the identity now descends from a **random master seed** (not the
+     * password), so it's recoverable + the password can be changed. We register
+     * the commitment, sign in with the in-memory identity to get a token, then
+     * enroll the OPRF-gated **password factor** (the seed wrapped under a key the
+     * server can't derive offline). Future logins unlock the seed via that factor.
      */
     async register(params) {
         const { username, password, email = null, login = true } = params;
-        const identity = await deriveIdentity(username, password);
+        const seed = randomSeed();
+        const identity = await deriveIdentityFromSeed(seed);
         const commitment = await this.commitmentFor(identity);
         await this.deps.auth.register({
             username,
@@ -3030,19 +3688,52 @@ class ZkAuth {
             ecdsaPublicKey: await exportPublicKeyBase64(identity.ecdsaKeyPair.publicKey),
             email,
         });
-        if (login) {
-            return this.login(username, password);
-        }
-        return { username, commitment };
+        // Sign in with the in-memory (random-seed) identity to obtain a session
+        // token, then enroll the password factor so the next login can recover
+        // the seed. (A token is required to write the factor.)
+        const user = await this.proveAndStore(username, identity, {});
+        await this.enrollPasswordFactor(username, password, seed, this.deps.session.token);
+        this.deps.session.setSeed(seed); // held so a passkey/phrase can be enrolled next
+        if (!login)
+            await this.logout();
+        return user;
     }
     /**
-     * Sign in: re-derive the identity, prove knowledge of it against a fresh
-     * server challenge, and trade the proof for a session token. On success
-     * both the session and the identity are stored on the client.
+     * Sign in. M1.0 is **vault-first**: read the password factor and OPRF-unwrap
+     * the master seed → identity. If that fails (a pre-vault account, whose factor
+     * is absent so the server returns a decoy, or a wrong password), fall back to
+     * the legacy password-derived identity. Either way we then prove knowledge of
+     * the identity and trade it for a session token.
      */
     async login(username, password, opts = {}) {
-        const identity = await deriveIdentity(username, password);
-        return this.proveAndStore(username, identity, opts);
+        // Vault-first; fall back to the legacy password-derived seed (pre-vault
+        // accounts). Either way we end up with the master seed, which we hold so
+        // recovery factors can be enrolled.
+        const vaultSeed = await this.tryUnlockSeed(username, password);
+        const seed = vaultSeed ?? await deriveMasterSeedFromPassword(username, password);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        // Migrate a legacy account into the vault on first vault-aware login: it has
+        // no password factor (`vaultSeed` is null), so enroll one now — wrapping the
+        // exact legacy-derived seed the proof just validated, so the commitment is
+        // preserved. Best-effort; the legacy path still works if this fails.
+        if (!vaultSeed)
+            await this.migrateLegacyPasswordFactor(username, password, seed);
+        return user;
+    }
+    /** Enroll the password factor for a legacy (pre-vault) account. Idempotent +
+     *  best-effort; failure just means we retry on the next login. */
+    async migrateLegacyPasswordFactor(username, password, seed) {
+        const token = this.deps.session.token;
+        if (!token)
+            return;
+        try {
+            await this.enrollPasswordFactor(username, password, seed, token);
+        }
+        catch {
+            /* migrate next time */
+        }
     }
     /**
      * Silently re-authenticate the current user without prompting for a
@@ -3140,12 +3831,273 @@ class ZkAuth {
         if (!username || !expected) {
             throw new Error("ZkAuth.unlock: no active session to unlock — sign in first.");
         }
-        const identity = await deriveIdentity(username, password);
+        const vaultSeed = await this.tryUnlockSeed(username, password);
+        const seed = vaultSeed ?? await deriveMasterSeedFromPassword(username, password);
+        const identity = await deriveIdentityFromSeed(seed);
         const commitment = await this.commitmentFor(identity);
         if (commitment !== expected) {
             throw new Error("ZkAuth.unlock: incorrect password (commitment mismatch).");
         }
         this.deps.session.setIdentity(identity);
+        this.deps.session.setSeed(seed);
+        // Migrate a legacy account into the vault if it has no password factor.
+        if (!vaultSeed)
+            await this.migrateLegacyPasswordFactor(username, password, seed);
+    }
+    /**
+     * Generate a 24-word **recovery phrase** that encodes the master seed, and
+     * record a marker in the vault so the UI knows one exists. Show the returned
+     * phrase to the user ONCE — it's never stored server-side (the phrase *is* the
+     * seed). Requires being signed in (the seed must be held in memory).
+     */
+    async enrollRecoveryPhrase() {
+        const seed = this.deps.session.seed;
+        const token = this.deps.session.token;
+        if (!seed || !token) {
+            throw new Error("Sign in first to set up a recovery phrase.");
+        }
+        const mnemonic = seedToMnemonic(seed);
+        await this.deps.auth.vaultPutFactor(token, { id: "phrase", type: "phrase-marker", createdAt: Date.now() });
+        return mnemonic;
+    }
+    /**
+     * Recover an account with its recovery phrase (the "forgot password" path).
+     * Decodes the phrase to the master seed → identity → session. After this,
+     * call {@link changePassword} to set a new password. No server lookup needed.
+     */
+    async recoverWithPhrase(username, mnemonic, opts = {}) {
+        const seed = mnemonicToSeed(mnemonic);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        return user;
+    }
+    /**
+     * Add an **email** as a recovery + login factor (M2 verification-gated:
+     * the server only releases the split-key OPRF eval after the address is
+     * OTP-verified). Sends the code, then returns a `confirm` continuation:
+     *
+     *   const { confirm } = await client.auth.zk.enrollEmailFactor("me@x.com");
+     *   await confirm(codeFromInbox);
+     *
+     * Requires being signed in with the seed held (like the other enrolls).
+     * Custody note: gated factors trade some custody for recoverability — the
+     * trade-off should be disclosed in the enroll UI.
+     */
+    async enrollEmailFactor(email) {
+        const seed = this.deps.session.seed;
+        const token = this.deps.session.token;
+        const username = this.deps.session.username;
+        if (!seed || !token || !username) {
+            throw new Error("Sign in first to add a recovery email.");
+        }
+        await this.deps.auth.emailOtpStart({ token, email });
+        return {
+            email,
+            confirm: async (code) => {
+                const { verifyToken, email: verified } = await this.deps.auth.emailOtpVerify({ token, code });
+                const input = await emailFactorInput(username, verified);
+                const { blind, blinded } = gatedBlind(input);
+                const evals = await this.deps.auth.oprfEvaluateGated(username, toBase64(blinded), "email", "enroll", verifyToken);
+                const key = await gatedWrapKey(input, blind, evals.evaluated, evals.evaluated2);
+                const wrapped = await wrapSeed(seed, key);
+                await this.deps.auth.vaultPutFactor(token, { id: "email", type: "email", wrap: wrapped.ct, iv: wrapped.iv, params: { email: verified }, createdAt: Date.now() }, verifyToken);
+            },
+        };
+    }
+    /**
+     * Recover an account via its enrolled **email** factor. Sends a code to the
+     * enrolled address (the response never reveals whether one exists), then
+     * `confirm(code)` completes: gated read + split-key eval → unwrap seed →
+     * normal ZK login. After this, call {@link changePassword} to set a new
+     * password.
+     *
+     *   const { confirm } = await client.auth.zk.recoverWithEmail("alice");
+     *   const user = await confirm(codeFromInbox);
+     */
+    async recoverWithEmail(username, opts = {}) {
+        await this.deps.auth.emailOtpStart({ username });
+        return {
+            confirm: async (code) => {
+                const { verifyToken, email } = await this.deps.auth.emailOtpVerify({ username, code });
+                const { factor } = await this.deps.auth.vaultRead(username, "email", verifyToken);
+                if (!factor?.wrap || !factor?.iv) {
+                    throw new Error("This account has no email recovery set up.");
+                }
+                const input = await emailFactorInput(username, email);
+                const { blind, blinded } = gatedBlind(input);
+                const evals = await this.deps.auth.oprfEvaluateGated(username, toBase64(blinded), "email", "recover", verifyToken);
+                const key = await gatedWrapKey(input, blind, evals.evaluated, evals.evaluated2);
+                const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
+                const identity = await deriveIdentityFromSeed(seed);
+                const user = await this.proveAndStore(username, identity, opts);
+                this.deps.session.setSeed(seed);
+                return user;
+            },
+        };
+    }
+    // --- Google factor (M2.3) ------------------------------------------------
+    // Google is pure authentication UX: its verified ID token gates the
+    // split-key OPRF eval that releases the master seed. The ZK identity layer
+    // is unchanged. The app obtains `idToken` via Google Identity Services and
+    // passes it in; the SDK never renders Google UI.
+    /**
+     * Link a Google account as a recovery + login factor. Requires being signed
+     * in with the seed held. `idToken` is a fresh Google ID token (GIS).
+     */
+    async enrollGoogleFactor(idToken) {
+        const seed = this.deps.session.seed;
+        const token = this.deps.session.token;
+        const username = this.deps.session.username;
+        if (!seed || !token || !username)
+            throw new Error("Sign in first to link a Google account.");
+        const { verifyToken, sub, emailHint } = await this.deps.auth.googleVerify({ idToken, token });
+        const input = await googleFactorInput(username, sub);
+        const { blind, blinded } = gatedBlind(input);
+        const evals = await this.deps.auth.oprfEvaluateGated(username, toBase64(blinded), "google", "enroll", verifyToken);
+        const key = await gatedWrapKey(input, blind, evals.evaluated, evals.evaluated2);
+        const wrapped = await wrapSeed(seed, key);
+        await this.deps.auth.vaultPutFactor(token, { id: "google", type: "google", wrap: wrapped.ct, iv: wrapped.iv, params: { sub, emailHint: emailHint ?? undefined }, createdAt: Date.now() }, verifyToken);
+    }
+    /**
+     * Sign in with Google — verify the ID token, unlock the seed via the gated
+     * split-key eval, and establish a session. Same machinery serves "Sign in
+     * with Google" and "recover with Google"; the account must have linked the
+     * factor first.
+     */
+    async loginWithGoogle(username, idToken, opts = {}) {
+        const { verifyToken, sub } = await this.deps.auth.googleVerify({ idToken, username });
+        const { factor } = await this.deps.auth.vaultRead(username, "google", verifyToken);
+        if (!factor?.wrap || !factor?.iv)
+            throw new Error("No Google account is linked to this username.");
+        const input = await googleFactorInput(username, sub);
+        const { blind, blinded } = gatedBlind(input);
+        const evals = await this.deps.auth.oprfEvaluateGated(username, toBase64(blinded), "google", "recover", verifyToken);
+        const key = await gatedWrapKey(input, blind, evals.evaluated, evals.evaluated2);
+        const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        return user;
+    }
+    /**
+     * Register a brand-new, **passwordless** account whose only factor is Google.
+     * A random master seed is generated and wrapped under the Google-gated key;
+     * the user can add a password / passkey / phrase later. The ZK registration
+     * is identical to a password signup.
+     */
+    async registerWithGoogle(username, idToken) {
+        const seed = randomSeed();
+        const identity = await deriveIdentityFromSeed(seed);
+        const commitment = await this.commitmentFor(identity);
+        await this.deps.auth.register({
+            username,
+            commitment,
+            ecdhPublicKey: await exportPublicKeyBase64(identity.ecdhKeyPair.publicKey),
+            ecdsaPublicKey: await exportPublicKeyBase64(identity.ecdsaKeyPair.publicKey),
+            email: null,
+        });
+        const user = await this.proveAndStore(username, identity, {});
+        this.deps.session.setSeed(seed);
+        // Enroll Google as the sole factor (session + seed are now in hand).
+        await this.enrollGoogleFactor(idToken);
+        return user;
+    }
+    /**
+     * Change the password — re-wraps the (unchanged) master seed under the new
+     * password's OPRF-gated key. The identity/commitment never moves. Requires
+     * being signed in (or freshly recovered) so the seed is held.
+     */
+    async changePassword(newPassword) {
+        const seed = this.deps.session.seed;
+        const username = this.deps.session.username;
+        const token = this.deps.session.token;
+        if (!seed || !username || !token) {
+            throw new Error("Sign in first to change your password.");
+        }
+        await this.enrollPasswordFactor(username, newPassword, seed, token);
+    }
+    /** Whether this browser can use passkeys (WebAuthn) at all. */
+    passkeyAvailable() {
+        return passkeySupported();
+    }
+    /**
+     * Whether this browser's authenticator can do the **PRF extension** our
+     * passkey factor requires. A browser may support passkeys generally but not
+     * PRF — in which case enrolling one would fail. Resolves `true`/`false`, or
+     * `null` when it can't be determined (no capabilities API). Use this to gate
+     * the passkey UI so users don't hit a dead-end error.
+     */
+    async passkeyPrfAvailable() {
+        return passkeyPrfCapable();
+    }
+    /**
+     * Add a **passkey** recovery factor. Creates a WebAuthn passkey with PRF,
+     * wraps the master seed under its PRF output, and stores the factor. The
+     * passkey (synced via the platform's keychain) then unlocks the account on
+     * any device — no password. Requires being signed in (seed held in memory).
+     */
+    async enrollPasskey(opts) {
+        const seed = this.deps.session.seed;
+        const token = this.deps.session.token;
+        const username = this.deps.session.username;
+        if (!seed || !token || !username) {
+            throw new Error("Sign in first to add a passkey.");
+        }
+        const rpId = opts?.rpId ?? defaultRpId();
+        const { credentialId, prfSalt, prfOutput } = await createPasskeyWithPrf({
+            rpId,
+            rpName: opts?.rpName ?? "Muhkoo",
+            username,
+        });
+        const key = await wrapKeyFromBytes(prfOutput, "muhkoo-passkey-wrap");
+        const wrapped = await wrapSeed(seed, key);
+        await this.deps.auth.vaultPutFactor(token, {
+            id: `passkey:${toBase64(credentialId).slice(0, 16)}`,
+            type: "passkey",
+            wrap: wrapped.ct,
+            iv: wrapped.iv,
+            params: { credentialId: toBase64(credentialId), prfSalt: toBase64(prfSalt), rpId },
+            label: opts?.label ?? "Passkey",
+            createdAt: Date.now(),
+        });
+    }
+    /**
+     * Sign in with a passkey (no password). Reads the passkey factor, evaluates
+     * its PRF, unwraps the master seed → identity → session.
+     */
+    async loginWithPasskey(username, opts = {}) {
+        const { factor } = await this.deps.auth.vaultRead(username, "passkey");
+        const params = factor?.params;
+        if (!factor?.wrap || !factor?.iv || !params?.credentialId || !params?.prfSalt) {
+            throw new Error("No passkey is set up for this account.");
+        }
+        const prfOutput = await evaluatePasskeyPrf(params.rpId ?? defaultRpId(), fromBase64(params.credentialId), fromBase64(params.prfSalt));
+        const key = await wrapKeyFromBytes(prfOutput, "muhkoo-passkey-wrap");
+        const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
+        const identity = await deriveIdentityFromSeed(seed);
+        const user = await this.proveAndStore(username, identity, opts);
+        this.deps.session.setSeed(seed);
+        return user;
+    }
+    /**
+     * List the user's enrolled login methods (metadata only). Session-authed.
+     * Gated factors (email/google) carry a `masked` display hint
+     * ("m•••@gmail.com"); the full value is never returned.
+     */
+    async listFactors() {
+        const token = this.deps.session.token;
+        if (!token)
+            throw new Error("Sign in first to view your login methods.");
+        const { factors } = await this.deps.auth.vaultFactors(token);
+        return factors;
+    }
+    /** Remove a login method by id (can't remove your only one). Session-authed. */
+    async removeFactor(id) {
+        const token = this.deps.session.token;
+        if (!token)
+            throw new Error("Sign in first to manage your login methods.");
+        await this.deps.auth.vaultDeleteFactor(token, id);
     }
     /** Sign out: clears the session, identity, and persisted token. */
     async logout() {
@@ -3170,6 +4122,16 @@ class ZkAuth {
     get token() {
         return this.deps.session.token;
     }
+    /**
+     * The master seed as base64, or `null` when locked. The host app uses this to
+     * wrap app-level data (e.g. chat ratchet keys) to the **seed** instead of the
+     * password — so that data survives password changes and can be unlocked by a
+     * passwordless (passkey) login, both of which recover the same seed.
+     */
+    get seedBase64() {
+        const seed = this.deps.session.seed;
+        return seed ? toBase64(seed) : null;
+    }
     // -------------------------------------------------------------------------
     /** Poseidon commitment for an identity — the value the server stores. */
     async commitmentFor(identity) {
@@ -3178,12 +4140,82 @@ class ZkAuth {
         const ecdsaPubHex = await exportPublicKeyHex(identity.ecdsaKeyPair.publicKey);
         return buildCommitment(identity.secretHex, identity.saltHex, ecdsaPubHex);
     }
+    // ---- Identity vault (M1.0) ----------------------------------------------
+    /**
+     * Derive the OPRF-gated wrap key for the password factor: `scrypt(password)`
+     * is blinded, evaluated by the server's secret OPRF key (so it can't be
+     * derived offline), unblinded, then HKDF'd into an AES-GCM key.
+     */
+    async passwordWrapKey(username, password) {
+        const pre = passwordPreHash(username, password);
+        const { blind, blinded } = oprfBlind(pre);
+        const { evaluated } = await this.deps.auth.oprfEvaluate(username, toBase64(blinded));
+        return wrapKeyFromOprf(oprfFinalize(pre, blind, fromBase64(evaluated)));
+    }
+    /**
+     * Try to recover the master seed from the password factor.
+     *
+     * Returns `null` only when the vault read SUCCEEDS but the seed can't be
+     * unwrapped — i.e. there's no real factor (a pre-vault/legacy account, whose
+     * read returns a decoy that won't unwrap) or the password is wrong. The caller
+     * then legitimately falls back to the legacy password-derived identity.
+     *
+     * Throws {@link VaultUnavailableError} when the vault itself can't be reached
+     * (network / 5xx / rate-limit) — so a *transient* failure is NOT silently
+     * turned into a legacy fallback (which would surface as "commitment mismatch").
+     */
+    async tryUnlockSeed(username, password) {
+        const read = await this.deps.auth
+            .vaultRead(username, "password")
+            .catch((e) => { throw new VaultUnavailableError(e); });
+        const factor = read.factor;
+        if (!factor?.wrap || !factor?.iv)
+            return null; // genuinely no factor → legacy account
+        const key = await this
+            .passwordWrapKey(username, password)
+            .catch((e) => { throw new VaultUnavailableError(e); }); // OPRF eval unreachable / rate-limited
+        try {
+            return await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
+        }
+        catch {
+            return null; // factor present but won't unwrap → wrong password, or a decoy
+        }
+    }
+    /**
+     * Enroll/replace the password factor for `username` — wraps `seed` under the
+     * OPRF-gated key and stores it (needs a session `token`).
+     *
+     * Retries: this is the step that persists the (otherwise in-memory-only)
+     * master seed. If it fails after a fresh registration the account would be
+     * unrecoverable, so we retry a few times before surfacing the error.
+     */
+    async enrollPasswordFactor(username, password, seed, token) {
+        const key = await this.passwordWrapKey(username, password);
+        const wrapped = await wrapSeed(seed, key);
+        const factor = { id: "password", type: "password", wrap: wrapped.ct, iv: wrapped.iv, createdAt: Date.now() };
+        let lastErr;
+        for (let attempt = 0; attempt < 3; attempt++) {
+            try {
+                await this.deps.auth.vaultPutFactor(token, factor);
+                return;
+            }
+            catch (err) {
+                lastErr = err;
+                await new Promise((r) => setTimeout(r, 200 * (attempt + 1)));
+            }
+        }
+        throw new Error("Registration could not finish securing your account (vault enrollment failed). " +
+            "Please try again. " + (lastErr instanceof Error ? lastErr.message : ""));
+    }
 }
 /** `client.auth` — the auth namespace. Strategies hang off here. */
 class AuthNamespace {
     zk;
+    /** Centralized hosted auth (auth.muhkoo.dev) — `client.auth.hosted.login(...)`. */
+    hosted;
     constructor(deps) {
         this.zk = new ZkAuth(deps);
+        this.hosted = new HostedAuth({ auth: deps.auth, session: deps.session, authBaseUrl: deps.authBaseUrl });
     }
     /** Convenience pass-through: the currently signed-in user, or `null`. */
     get user() {
@@ -3216,13 +4248,13 @@ class StorageCipher {
         const iv = randomBytes(AES_GCM_IV_BYTES);
         const plaintext = utf8Encode(JSON.stringify(value));
         const ciphertext = await encryptAesGcm(key, iv, plaintext);
-        return { _enc: "a256gcm", iv: toBase64(iv), ct: toBase64(ciphertext) };
+        return { _enc: "a256gcm", iv: toBase64$1(iv), ct: toBase64$1(ciphertext) };
     }
     /** Open an {@link EncryptedEnvelope} back into the original value. */
     async decrypt(envelope) {
         const key = await this.keyPromise;
-        const iv = fromBase64(envelope.iv);
-        const ciphertext = fromBase64(envelope.ct);
+        const iv = fromBase64$1(envelope.iv);
+        const ciphertext = fromBase64$1(envelope.ct);
         const plaintext = await decryptAesGcm(key, iv, ciphertext);
         return JSON.parse(utf8Decode(plaintext));
     }
@@ -5334,12 +6366,12 @@ function canonicalMessage(fields) {
 /** Sign the canonical bytes with the sender's ECDSA identity private key. */
 async function signSpaceMessage(canonical, ecdsaPriv) {
     const sig = await getSubtle().sign(ECDSA_SIGN, ecdsaPriv, utf8Encode(canonical));
-    return toBase64(new Uint8Array(sig));
+    return toBase64$1(new Uint8Array(sig));
 }
 /** Verify a signature over the canonical bytes against the sender's ECDSA key. */
 async function verifySpaceMessage(canonical, sigB64, ecdsaPub) {
     try {
-        return await getSubtle().verify(ECDSA_SIGN, ecdsaPub, fromBase64(sigB64), utf8Encode(canonical));
+        return await getSubtle().verify(ECDSA_SIGN, ecdsaPub, fromBase64$1(sigB64), utf8Encode(canonical));
     }
     catch {
         return false;
@@ -5375,8 +6407,8 @@ async function wrapSpaceKey(kSpace, epoch, recipientEcdhPub) {
     return {
         epoch,
         ephemeralPub: await exportEcdhPublicKey(eph.publicKey),
-        iv: toBase64(iv),
-        ciphertext: toBase64(ciphertext),
+        iv: toBase64$1(iv),
+        ciphertext: toBase64$1(ciphertext),
         alg: WRAP_ALG,
     };
 }
@@ -5388,7 +6420,7 @@ async function unwrapSpaceKey(wrapped, ownEcdhPriv) {
     const ephPub = await importEcdhPublicKey(wrapped.ephemeralPub);
     const shared = new Uint8Array(await getSubtle().deriveBits({ name: "ECDH", public: ephPub }, ownEcdhPriv, P384_BITS));
     const wrapKey = await deriveBitsHkdf(shared, WRAP_INFO, AES_GCM_KEY_BYTES, utf8Encode(`epoch:${wrapped.epoch}`));
-    return decryptAesGcm(wrapKey, fromBase64(wrapped.iv), fromBase64(wrapped.ciphertext));
+    return decryptAesGcm(wrapKey, fromBase64$1(wrapped.iv), fromBase64$1(wrapped.ciphertext));
 }
 // ---------------------------------------------------------------------------
 // Message sealing
@@ -5397,14 +6429,14 @@ async function unwrapSpaceKey(wrapped, ownEcdhPriv) {
 async function sealSerialized(kSpace, serialized) {
     const iv = randomBytes(AES_GCM_IV_BYTES);
     const ciphertext = await encryptAesGcm(kSpace, iv, utf8Encode(serialized));
-    return { iv: toBase64(iv), ciphertext: toBase64(ciphertext) };
+    return { iv: toBase64$1(iv), ciphertext: toBase64$1(ciphertext) };
 }
 /**
  * Open a sealed payload back into its serialized message string. Throws (GCM
  * tag failure) on the wrong group key or a tampered ciphertext.
  */
 async function openSerialized(kSpace, iv, ciphertext) {
-    const plaintext = await decryptAesGcm(kSpace, fromBase64(iv), fromBase64(ciphertext));
+    const plaintext = await decryptAesGcm(kSpace, fromBase64$1(iv), fromBase64$1(ciphertext));
     return utf8Decode(plaintext);
 }
 
@@ -6196,7 +7228,7 @@ class SpaceKeyring {
         if (!cached)
             return false;
         for (const [epochStr, b64] of Object.entries(cached)) {
-            this.keys.set(Number(epochStr), fromBase64(b64));
+            this.keys.set(Number(epochStr), fromBase64$1(b64));
         }
         this.epoch = Math.max(0, ...Array.from(this.keys.keys()));
         return this.keys.size > 0;
@@ -6206,7 +7238,7 @@ class SpaceKeyring {
             return;
         const out = {};
         for (const [epoch, key] of this.keys)
-            out[String(epoch)] = toBase64(key);
+            out[String(epoch)] = toBase64$1(key);
         // Best-effort: caching is an optimization; a write failure (e.g. locked
         // storage) must not break key acquisition.
         try {
@@ -6741,6 +7773,7 @@ class AgentsNamespace {
  *   });
  *   // HTTP-reachable at  hello--<slug>.fns.muhkoo.dev
  *   await client.functions.enable(appId, config.functionId, spaceId); // Space-bound
+ *   const out = await client.functions.invoke({ name: 'hello', slug }, { body: { q: 1 } });
  *
  * These are MANAGEMENT calls — the function itself runs on the accelerator
  * (uploaded just-in-time, decrypted only at invocation). Only an app's owner or
@@ -6754,6 +7787,18 @@ class AgentsNamespace {
  * triggers: `http` (its own subdomain) and `space` (invoked on Space messages,
  * like a Programmable Agent).
  */
+/** The hosted platform's HTTP-function zone. */
+const DEFAULT_FN_HOST_SUFFIX = "fns.muhkoo.dev";
+/** Bodies `fetch` accepts natively — everything else is JSON-encoded. */
+function isRawBody(body) {
+    return (typeof body === "string" ||
+        body instanceof FormData ||
+        body instanceof Blob ||
+        body instanceof ArrayBuffer ||
+        ArrayBuffer.isView(body) ||
+        body instanceof URLSearchParams ||
+        (typeof ReadableStream !== "undefined" && body instanceof ReadableStream));
+}
 class FunctionsNamespace {
     deps;
     constructor(deps) {
@@ -6792,6 +7837,71 @@ class FunctionsNamespace {
     async disable(appId, functionId, spaceId, opts = {}) {
         return this.deps.http.post(this.path(appId, `/${encodeURIComponent(functionId)}/disable`, {}), { targetSpaceId: spaceId, space: opts.space });
     }
+    /**
+     * Invoke an HTTP-triggered function and parse its JSON response.
+     *
+     *   const out = await client.functions.invoke({ name: 'hello', slug: 'myapp' });
+     *   const out = await client.functions.invoke('hello--myapp', { body: { q: 1 } });
+     *   const out = await client.functions.invoke('https://hello--myapp.fns.muhkoo.dev/x');
+     *
+     * The request carries the SDK's credentials (`X-Muhkoo-Key` and, when a
+     * user is signed in, `X-Muhkoo-Session`) — the platform passes the session
+     * token through to the function, which can verify it server-side via
+     * `POST /api/auth/verify` to establish the caller's identity.
+     *
+     * Non-2xx responses throw {@link HttpError}. For functions that return
+     * something other than JSON, use {@link invokeRaw}.
+     */
+    async invoke(target, opts = {}) {
+        const res = await this.invokeRaw(target, opts);
+        let parsed = null;
+        try {
+            parsed = await res.json();
+        }
+        catch {
+            // Non-JSON body — fall through to the status-only error below.
+        }
+        if (!res.ok) {
+            const msg = parsed && typeof parsed === "object" && "error" in parsed
+                ? String(parsed.error)
+                : `${res.status} ${res.statusText}`;
+            throw new HttpError(msg, res.status, parsed);
+        }
+        return parsed;
+    }
+    /** Invoke an HTTP-triggered function and return the raw `Response`. */
+    async invokeRaw(target, opts = {}) {
+        const init = {
+            method: opts.method ?? (opts.body !== undefined ? "POST" : "GET"),
+        };
+        const headers = new Headers(opts.headers);
+        if (opts.body !== undefined) {
+            if (isRawBody(opts.body)) {
+                init.body = opts.body;
+            }
+            else {
+                init.body = JSON.stringify(opts.body);
+                if (!headers.has("Content-Type"))
+                    headers.set("Content-Type", "application/json");
+            }
+        }
+        init.headers = headers;
+        return this.deps.http.fetch(this.invokeUrl(target, opts.path), init);
+    }
+    /** Resolve an invoke target to the function's absolute URL. */
+    invokeUrl(target, path = "") {
+        const suffix = this.deps.fnHostSuffix ?? DEFAULT_FN_HOST_SUFFIX;
+        let base;
+        if (typeof target === "string") {
+            base = /^https?:\/\//.test(target) ? target : `https://${target}.${suffix}`;
+        }
+        else {
+            base = `https://${target.name}--${target.slug}.${suffix}`;
+        }
+        if (!path)
+            return base;
+        return `${base.replace(/\/+$/, "")}${path.startsWith("/") ? "" : "/"}${path}`;
+    }
     path(appId, suffix, opts) {
         const q = opts.space ? `?space=${encodeURIComponent(opts.space)}` : "";
         return `/api/apps/${encodeURIComponent(appId)}/functions${suffix}${q}`;
@@ -6823,6 +7933,8 @@ class FunctionsNamespace {
  */
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
 const DEFAULT_BASE_URL = "https://api.muhkoo.dev";
+/** The hosted auth SPA — the default {@link ClientOptions.authBaseUrl}. */
+const DEFAULT_AUTH_BASE_URL = "https://auth.muhkoo.dev";
 /**
  * Turn the HTTP base URL into a websocket base (`http(s)://` → `ws(s)://`).
  * The accelerator serves spaces over both on the same origin.
@@ -6855,6 +7967,13 @@ class Client {
     /** Shared in-flight recovery so a burst of 401s triggers one re-auth. */
     recoverInFlight = null;
     constructor(options = {}) {
+        // Build stamp — always logged (independent of logLevel) so the running
+        // build is identifiable in the console. Catches stale cached bundles
+        // during development; bump `VERSION` (and package.json) each build.
+        try {
+            console.info(`[@muhkoo/connect] initialized — v${VERSION}`);
+        }
+        catch { /* console may be unavailable in some runtimes */ }
         if (options.logLevel && typeof globalThis.appLogger?.setLevel === "function") {
             globalThis.appLogger.setLevel(options.logLevel);
         }
@@ -6873,7 +7992,8 @@ class Client {
         const circuits = options.circuits ?? defaultCircuitUrls(this.baseUrl);
         const authClient = new AuthClient({ baseUrl: this.baseUrl, fetch: this.http.fetch });
         const wsBaseUrl = toWsBase(this.baseUrl);
-        this.auth = new AuthNamespace({ auth: authClient, circuits, session: this.session });
+        const authBaseUrl = (options.authBaseUrl ?? DEFAULT_AUTH_BASE_URL).replace(/\/+$/, "");
+        this.auth = new AuthNamespace({ auth: authClient, circuits, session: this.session, authBaseUrl });
         this.kv = new KvNamespace({ http: this.http, session: this.session, wsBaseUrl });
         this.db = new DbNamespace({ http: this.http });
         this.storage = new StorageNamespace({ http: this.http, baseUrl: this.baseUrl, kv: this.kv });
@@ -6892,7 +8012,7 @@ class Client {
             cache: spaceKeyCache,
         });
         this.agents = new AgentsNamespace({ http: this.http });
-        this.functions = new FunctionsNamespace({ http: this.http });
+        this.functions = new FunctionsNamespace({ http: this.http, fnHostSuffix: options.functionsHostSuffix });
     }
     /** The currently signed-in user, or `null`. */
     get user() {
@@ -7653,5 +8773,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
     default: loadRsWasm
 });
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_BASE_URL, DbNamespace, DbTable, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, Ready, ReedSolomonCodec, Retry, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, WSTransport, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, compilePrograms, concatBytes, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deserialize, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateId, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNumber, log, manifestToStat, poseidonHash, quickVerify, randomBytes, serialize, shardHash, signMessage, toBase64, toBase64Url, toField, toHex, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
+export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbNamespace, DbTable, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, Ready, ReedSolomonCodec, Retry, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, VERSION, VaultUnavailableError, WSTransport, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, compilePrograms, concatBytes, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, fromBase64$1 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNumber, log, manifestToStat, poseidonHash, quickVerify, randomBytes, randomState, sealSeed, serialize, shardHash, signMessage, toBase64$1 as toBase64, toBase64Url, toField, toHex, unsealSeed, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
 //# sourceMappingURL=index.js.map