@officialunofficial/kit-wasm 0.0.0-stage → 0.7.1

package/kit_wasm.d.ts

@@ -0,0 +1,815 @@
+/* tslint:disable */
+/* eslint-disable */
+
+export class AttestKeyPairJs {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly algo: string;
+    readonly keyid: string;
+    readonly pubkey_hex: string;
+    readonly seed_hex: string;
+}
+
+export class AttestationJs {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly attestation_id_hex: string;
+    readonly envelope_json: string;
+    readonly keyid: string;
+}
+
+export class BaoEncoded {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly hash_hex: string;
+    readonly outboard: Uint8Array;
+}
+
+export class BaoVerify {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly bytes: Uint8Array | undefined;
+    readonly error: string | undefined;
+    readonly ok: boolean;
+}
+
+/**
+ * One `FastCDC` chunk boundary plus its BLAKE3.
+ */
+export class ChunkInfo {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly hash_hex: string;
+    readonly len: number;
+    readonly offset: number;
+}
+
+export class ChunkedBlobJs {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    chunk(i: number): ChunkInfo | undefined;
+    readonly bytes_len: number;
+    readonly chunk_count: number;
+    readonly root_hash_hex: string;
+}
+
+export class ChunkerResult {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    chunk(i: number): ChunkInfo | undefined;
+    readonly avg: number;
+    /**
+     * Number of chunks. The `chunk(i)` getter returns each one by index,
+     * which is cheaper than materialising a JS array of opaque handles
+     * when the web caller only wants a few.
+     */
+    readonly chunk_count: number;
+    readonly max: number;
+    readonly min: number;
+}
+
+/**
+ * Decoded display fields of a commit object — what [`commit_decode`]
+ * returns for the multiplayer log to walk + render the room's `main`
+ * chain. `parents` are 64-hex object ids (parent 0 first); `signer_hex`
+ * is the 64-hex Ed25519 signer/author pubkey; `timestamp` is unix
+ * seconds; `tree_hex` is the 64-hex tree object id; `signature_hex` is
+ * the 128-hex Ed25519 signature.
+ */
+export class CommitInfoJs {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    parent(i: number): string | undefined;
+    readonly message: string;
+    /**
+     * Number of parents; pair with [`CommitInfoJs::parent`] to read each
+     * 64-hex id by index, matching the `*_count` + indexed-getter shape
+     * used by the streaming result structs.
+     */
+    readonly parent_count: number;
+    /**
+     * 128-hex Ed25519 signature over the commit's signing bytes.
+     */
+    readonly signature_hex: string;
+    readonly signer_hex: string;
+    readonly timestamp: bigint;
+    /**
+     * 64-hex id of the tree this commit snapshots.
+     */
+    readonly tree_hex: string;
+}
+
+/**
+ * One entry in the delta summary. `offset` is populated only for `copy` ops.
+ */
+export class DeltaOp {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly kind: string;
+    readonly len: number;
+    readonly offset: number | undefined;
+}
+
+export class DeltaSummary {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    op(i: number): DeltaOp | undefined;
+    readonly bytes_on_wire: number;
+    readonly full_size: number;
+    readonly op_count: number;
+}
+
+export class EncodedCommit {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly bytes: Uint8Array;
+    readonly hash_hex: string;
+    readonly signature_hex: string;
+}
+
+export class EncodedObject {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly bytes: Uint8Array;
+    readonly hash_hex: string;
+}
+
+export class KeyPairJs {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly pubkey_hex: string;
+    readonly seed_hex: string;
+}
+
+/**
+ * Decoded display fields of a remix object — the remix counterpart of
+ * [`CommitInfoJs`]. Carries the same commit-shaped fields plus the
+ * remix-only `sources` (read via `source_count` + the `source(i)`
+ * indexed getter), each a [`RemixSourceJs`] naming an upstream commit
+ * the fork derives from. `parents` are 64-hex object ids (parent 0
+ * first); `signer_hex` is the 64-hex Ed25519 signer pubkey; `timestamp`
+ * is unix seconds; `tree_hex` is the 64-hex tree id; `signature_hex` is
+ * the 128-hex Ed25519 signature.
+ */
+export class RemixInfoJs {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    parent(i: number): string | undefined;
+    source(i: number): RemixSourceJs | undefined;
+    readonly message: string;
+    /**
+     * Number of parents; pair with [`RemixInfoJs::parent`] to read each
+     * 64-hex id by index.
+     */
+    readonly parent_count: number;
+    /**
+     * 128-hex Ed25519 signature over the remix's signing bytes.
+     */
+    readonly signature_hex: string;
+    readonly signer_hex: string;
+    /**
+     * Number of sources (upstream commits this fork derives from); pair
+     * with [`RemixInfoJs::source`] to read each `{ upstream_id_hex,
+     * commit_hash_hex }` by index.
+     */
+    readonly source_count: number;
+    readonly timestamp: bigint;
+    /**
+     * 64-hex id of the tree this remix snapshots.
+     */
+    readonly tree_hex: string;
+}
+
+/**
+ * One remix source: a `{ upstream_id_hex, commit_hash_hex }` pair naming
+ * an upstream commit this fork derives from. `upstream_id` is the opaque
+ * caller-chosen 32-byte provenance tag (e.g. the room id); `commit_hash`
+ * is the 64-hex id of the upstream commit being remixed.
+ */
+export class RemixSourceJs {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    readonly commit_hash_hex: string;
+    readonly upstream_id_hex: string;
+}
+
+/**
+ * A verified KDSP span, including its authenticated metadata and plaintext.
+ *
+ * Both getters use the result of one verification. The JSON deliberately
+ * excludes the bytes; callers obtain them through [`VerifiedSpan::bytes`].
+ */
+export class VerifiedSpan {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * The authenticated content bytes of the requested range.
+     */
+    readonly bytes: Uint8Array;
+    /**
+     * Authenticated span metadata as JSON.
+     */
+    readonly json: string;
+}
+
+/**
+ * Build a DSSE-wrapped in-toto v1 attestation over a subject, signed with the chosen algorithm.
+ *
+ * * `subject_bytes` is the subject's serialised bytes — its `blake3` and
+ *   paired `sha256` digest (SPEC-ATTESTATIONS §4.2) are both derived from
+ *   these bytes, so the two can never disagree. For a real commit this is
+ *   the commit's serialised bytes; callers binding a non-commit subject
+ *   (e.g. a derived-key identity binding) pass whatever bytes that
+ *   subject's identifier is itself the hash of.
+ * * `predicate_type` is a URI like `https://example.com/Review/v1`.
+ * * `predicate_jcs` is the predicate body as already-canonical JCS bytes (must start with `{` and end with `}`).
+ * * `seed_hex` is a 32-byte seed. How it's interpreted depends on `algo`:
+ *   * `ed25519`   — raw Ed25519 seed
+ *   * `secp256k1` — raw 32-byte scalar
+ *   * `p256`      — raw 32-byte scalar
+ *
+ * Returns `{ envelope_json, keyid, attestation_id_hex }`. The keyid's prefix reveals which algorithm was used.
+ */
+export function attest_build(subject_bytes: Uint8Array, predicate_type: string, predicate_jcs: Uint8Array, seed_hex: string, algo: string): AttestationJs;
+
+/**
+ * Derive the pubkey + canonical keyid for the given attestation algorithm from a 32-byte seed. `algo` is one of
+ * `"ed25519" | "secp256k1" | "p256"`. Deterministic: same seed + same algorithm always produces the same pubkey.
+ *
+ * Pubkey encoding depends on the algorithm:
+ *   * `ed25519`   — 32-byte raw pubkey
+ *   * `secp256k1` — 33-byte compressed SEC1 (`0x02`/`0x03` prefix + x)
+ *   * `p256`      — 33-byte compressed SEC1 (same shape)
+ *
+ * `keyid` follows the canonical `<prefix>:<hex-pubkey>` form described in SPEC-ATTESTATIONS §6.3 for ES256K / ES256,
+ * and the legacy `blake3:<hex-of-blake3(pubkey)>` form for Ed25519 (what `RepoKeySigner` emits; verifier accepts).
+ */
+export function attest_keypair(seed_hex: string, algo: string): AttestKeyPairJs;
+
+/**
+ * Compute the DSSE PAE for an (unsigned) in-toto attestation over a
+ * subject. This is the exact byte string a browser passkey MUST
+ * place in its `WebAuthn` `challenge` so the resulting assertion
+ * verifies under [`verify_webauthn_wrapping`].
+ *
+ * Same `(subject_bytes, predicate_type, predicate_jcs)` inputs as
+ * [`attest_build`], minus the key — the PAE is signer-independent, so a
+ * passkey and a software key over the same statement bind to identical
+ * bytes. Returns the raw PAE; the JS side passes it straight to
+ * `navigator.credentials.get` as a `BufferSource` challenge.
+ *
+ * NOTE: the `WebAuthn` `challenge` here is the *whole* PAE, and platform
+ * authenticators cap challenge size in practice — keep demo predicates
+ * small (see the research note's "challenge sizing" fork).
+ *
+ * # Errors
+ * The statement fails to encode.
+ */
+export function attest_pae(subject_bytes: Uint8Array, predicate_type: string, predicate_jcs: Uint8Array): Uint8Array;
+
+/**
+ * Verify a DSSE envelope against a single trust root of the given algorithm.
+ *
+ * * `envelope_json` is the canonical DSSE envelope JSON emitted by [`attest_build`].
+ * * `pubkey_hex` is the public key, hex-encoded:
+ *   * `ed25519`   — 32-byte raw pubkey (64 hex chars)
+ *   * `secp256k1` — 33-byte compressed SEC1 (66 hex chars) or 65-byte uncompressed (130 hex chars)
+ *   * `p256`      — same shape as `secp256k1`
+ * * `algo` selects which trust-root variant the registry dispatches on.
+ *
+ * Returns `true` iff at least one signature in the envelope verifies.
+ */
+export function attest_verify(envelope_json: string, pubkey_hex: string, algo: string): boolean;
+
+/**
+ * Encode `bytes` in Bao outboard mode and return `{ hash_hex, outboard }`.
+ * Outboard keeps the encoded tree proof separate from the payload so
+ * the demo can stream the original bytes on one track and the proof on
+ * another.
+ */
+export function bao_encode(bytes: Uint8Array): BaoEncoded;
+
+/**
+ * Extract a proof-carrying slice from a Bao outboard encoding. The
+ * returned bytes are in the format `bao::decode::SliceDecoder`
+ * consumes — the original payload plus just enough tree proof to
+ * verify it against the root hash.
+ */
+export function bao_slice(outboard: Uint8Array, bytes: Uint8Array, offset: number, len: number): Uint8Array;
+
+/**
+ * Verify a Bao slice against a root hash. On success returns
+ * `{ ok: true, bytes }` with the verified payload. On tamper returns
+ * `{ ok: false, error }` with the error message — a convenience over
+ * throwing, since the demo wants to render both outcomes side-by-side.
+ */
+export function bao_verify_slice(hash_hex: string, slice_bytes: Uint8Array, offset: number, len: number): BaoVerify;
+
+/**
+ * BLAKE3 of arbitrary bytes, as 64-char lowercase hex. This is the
+ * object id kit uses for every stored object.
+ */
+export function blake3_hex(data: Uint8Array): string;
+
+/**
+ * Bao outboard over the **canonical blob bytes** of `content`.
+ *
+ * `hash_hex` equals the blob object id (`object_id(blob_encode(content).bytes)`).
+ * Distinct from [`crate::bao_encode`], which hashes raw file bytes.
+ *
+ * # Errors
+ *
+ * Content larger than 16 MiB, or a serialize failure.
+ */
+export function blob_bao_encode(content: Uint8Array): BaoEncoded;
+
+/**
+ * Extract a Bao slice over canonical blob bytes at a **content** offset.
+ *
+ * The +10 shift onto the canonical blob (6-byte prologue + 4-byte
+ * length) happens inside. Distinct from [`crate::bao_slice`].
+ *
+ * # Errors
+ *
+ * Oversize content, serialize failure, or a slice-extract error.
+ */
+export function blob_bao_slice(outboard: Uint8Array, content: Uint8Array, content_offset: number, len: number): Uint8Array;
+
+/**
+ * Verify a Bao slice against a blob id at a **content** offset.
+ *
+ * Delegates to [`kit_core::verify::verify_blob_slice`]. Tamper returns
+ * `{ ok: false, error }` rather than throwing, matching [`crate::bao_verify_slice`].
+ *
+ * # Errors
+ *
+ * Malformed `blob_id_hex`.
+ */
+export function blob_bao_verify_slice(blob_id_hex: string, slice: Uint8Array, content_offset: number, len: number): BaoVerify;
+
+/**
+ * Decode a canonical blob into its uninterpreted file bytes.
+ *
+ * # Errors
+ * Invalid encoding, a non-blob object, or input larger than 16 MiB.
+ */
+export function blob_decode(bytes: Uint8Array): Uint8Array;
+
+/**
+ * Serialize a blob object and return `{ bytes, hash_hex }`.
+ *
+ * The returned `bytes` are the canonical on-disk v1 object bytes
+ * (see `docs/specs/SPEC-OBJECTS.md`); `hash_hex` is the object's content id
+ * (via `id_from_object`) — for a non-merkelized `Blob`, BLAKE3 of those bytes.
+ */
+export function blob_encode(data: Uint8Array): EncodedObject;
+
+/**
+ * Run the frozen v1 `FastCDC` chunker over `bytes` and return
+ * `{ chunks: [{ offset, len, hash_hex }], avg, min, max }`.
+ *
+ * Each `hash_hex` is BLAKE3 of the chunk payload — handy for colouring
+ * chips in the web demo when an edit shifts boundaries.
+ */
+export function chunk_boundaries(bytes: Uint8Array): ChunkerResult;
+
+/**
+ * Decode a canonical `ChunkedBlob` object into JSON
+ * `{ total_size, chunk_size, chunks: [hex] }`.
+ *
+ * Input is capped at 16 MiB, matching [`crate::chunked_blob_encode`]'s
+ * workspace admission limit.
+ *
+ * # Errors
+ *
+ * Oversize input, invalid encoding, or a non-`ChunkedBlob` object.
+ */
+export function chunked_blob_decode(bytes: Uint8Array): string;
+
+/**
+ * Build a `ChunkedBlob` manifest from raw bytes: chunk with `FastCDC` v1 and
+ * return `{ root_hash_hex, chunks: [{ offset, len, hash_hex }], bytes_len }`.
+ *
+ * `root_hash_hex` is the object's content id — the BMT root of the manifest,
+ * whose leaves are the per-chunk **Blob object ids** (built via the shared
+ * `worktree::chunked_blob_from_bytes`), so it equals the id the native store
+ * keys the `ChunkedBlob` under. Each chunk's `hash_hex` is the **raw**
+ * BLAKE3 of the chunk payload — for UI colouring/dedup, distinct from the
+ * manifest leaf. `chunk_size` is `0` (the CDC marker, SPEC-OBJECTS §13.7).
+ */
+export function chunked_blob_encode(bytes: Uint8Array): ChunkedBlobJs;
+
+/**
+ * Decode a commit object's display fields from its raw on-disk bytes.
+ *
+ * Deserializes via the same path [`commit_verify`] uses
+ * (`kit_core::deserialize` → [`Object::Commit`]) and exposes the
+ * fields the multiplayer log needs to walk + render the room's `main`
+ * chain: the [`CommitInfoJs::message`], the parents via
+ * [`CommitInfoJs::parent_count`] / [`CommitInfoJs::parent`]
+ * (64-hex object ids, parent 0 first), the
+ * [`CommitInfoJs::signer_hex`] (the 64-hex Ed25519 signer/author
+ * pubkey), the [`CommitInfoJs::timestamp`] (unix seconds), the
+ * [`CommitInfoJs::tree_hex`] (64-hex tree object id), and the
+ * [`CommitInfoJs::signature_hex`] (128-hex Ed25519 signature) — the
+ * last two power the navigable commit-detail view.
+ *
+ * This function does not verify the signature. The signer, tree and
+ * signature fields are unverified claims. Call [`commit_verify`] to check
+ * them. Input over 16 MiB is rejected.
+ *
+ * # Errors
+ * `commit_bytes` is not a valid serialized object, or it deserializes
+ * to a non-`Commit` object.
+ */
+export function commit_decode(bytes: Uint8Array): CommitInfoJs;
+
+/**
+ * Build and sign a commit, returning `{ bytes, hash_hex, signature_hex }`.
+ *
+ * `parent_hex` is a comma-separated list of parent commit hashes (empty
+ * string = root commit). `seed_hex` is the 32-byte Ed25519 seed.
+ */
+export function commit_encode_and_sign(tree_hash_hex: string, parent_hex: string, message: string, timestamp: bigint, seed_hex: string): EncodedCommit;
+
+/**
+ * Verify a commit signature, given the raw on-disk commit bytes.
+ * Returns `true` on pass, `false` on structural or crypto failure.
+ * Input over 16 MiB returns `false`.
+ */
+export function commit_verify(commit_bytes: Uint8Array): boolean;
+
+/**
+ * Build a SPEC-DELTA v1 stream of `base -> target` and return a
+ * structural summary: `{ ops, bytes_on_wire, full_size }`.
+ *
+ * `ops` contains one entry per opcode — `{ kind: "copy", offset, len }`
+ * or `{ kind: "insert", len }` — without the insert payloads, so the
+ * whole thing stays cheap to pass across the JS boundary. `bytes_on_wire`
+ * is the total delta stream length; `full_size` is `target.len()` for
+ * easy delta-savings calculation.
+ */
+export function delta_encode(base: Uint8Array, target: Uint8Array): DeltaSummary;
+
+/**
+ * Return the verified payload bytes of a disclosure bundle.
+ *
+ * Re-verifies the bundle. Object payload: canonical object bytes. Chunk
+ * payload: the chunk's canonical blob bytes. Range payload: the
+ * disclosed range bytes.
+ *
+ * # Errors
+ *
+ * The same failures as [`verify_disclosure`].
+ */
+export function disclosure_payload_bytes(commit_id_hex: string, bundle: Uint8Array): Uint8Array;
+
+/**
+ * Derive the 32-byte Ed25519 public key from a 32-byte seed.
+ *
+ * Pure function: same seed → same pubkey. Errors only if `seed` is not
+ * exactly 32 bytes. Internally goes through `kit-core`'s
+ * `KeyPair::from_seed`, which is the same derivation step the commit
+ * signer uses, so a key minted here interoperates 1:1 with on-disk
+ * `.kit/keys/default.key` material.
+ */
+export function ed25519_pubkey_from_seed(seed: Uint8Array): Uint8Array;
+
+/**
+ * Sign `msg` with the Ed25519 secret derived from a 32-byte `seed`.
+ *
+ * Returns the 64-byte signature (`R || s`). Errors only if `seed` is
+ * not exactly 32 bytes — Ed25519 signing itself is infallible once the
+ * key material is the right shape (RFC 8032 is deterministic; no RNG).
+ *
+ * The output is byte-equal to
+ * `ed25519_dalek::SigningKey::from_bytes(seed).sign(msg)`, which is the
+ * same signing path `kit-core::sign::KeyPair` drives for commit
+ * signatures (modulo the BLAKE3-domain wrapper that commits add on
+ * top — those callers should keep using `commit_encode_and_sign`).
+ */
+export function ed25519_sign(msg: Uint8Array, seed: Uint8Array): Uint8Array;
+
+/**
+ * Verify a raw Ed25519 signature, with strict canonical-encoding checks.
+ *
+ * Returns `true` only if the signature passes the SPEC-SIGNING §1
+ * predicate over `msg`: canonical, non-small-order `A` and `R`, canonical
+ * `s`, and the cofactored equation. This is the same check every other
+ * Ed25519 verifier in kit runs.
+ *
+ * Wrong-length `sig` or `pubkey` return `false` (the JS API matches the
+ * noble shape — boolean out, no exceptions on shape errors).
+ */
+export function ed25519_verify(sig: Uint8Array, msg: Uint8Array, pubkey: Uint8Array): boolean;
+
+/**
+ * Derive `{ seed_hex, pubkey_hex }` from a 32-byte seed. Deterministic:
+ * the same seed always yields the same public key.
+ */
+export function keypair_from_seed(seed_hex: string): KeyPairJs;
+
+/**
+ * Generate a fresh Ed25519 keypair from the browser CSPRNG.
+ */
+export function keypair_generate(): KeyPairJs;
+
+/**
+ * Return a canonical object's 64-hex content id, including Merkle ids.
+ *
+ * This checks the encoding, not signatures or referenced child objects.
+ * Callers must compare the result with the independently requested id.
+ *
+ * # Errors
+ * Invalid object encoding or input larger than 16 MiB.
+ */
+export function object_id(bytes: Uint8Array): string;
+
+/**
+ * Read the object-type tag from a serialized object's prologue and
+ * return its spec short name: `"commit" | "remix" | "tree" | "blob" |
+ * "chunked_blob" | "delta" | "tag"`.
+ *
+ * Lets the browser route a fetched object to the right decoder
+ * (`commit_decode` vs `remix_decode`) without guessing or trial-decoding.
+ * Goes through `kit_core::deserialize` so the answer reflects a fully
+ * well-formed object, then reports `ObjectType::name`.
+ *
+ * # Errors
+ * `bytes` is not a valid serialized object (bad prologue / truncated /
+ * unknown type tag), or longer than 16 MiB.
+ */
+export function object_kind(bytes: Uint8Array): string;
+
+/**
+ * Decode a remix object's display fields from its raw on-disk bytes.
+ *
+ * The remix counterpart of [`commit_decode`]: deserializes via
+ * `kit_core::deserialize` → [`Object::Remix`] and exposes the same
+ * commit-shaped fields (`message`, `signer_hex`, `timestamp`,
+ * `tree_hex`, `signature_hex`, `parents`) plus the remix-only
+ * `sources` — each a `{ upstream_id_hex, commit_hash_hex }`
+ * read by `source_count` + the `source(i)` indexed getter. The web
+ * browser uses the sources to render the "fork of …" badge whose
+ * `commit_hash` links to the upstream commit's detail.
+ *
+ * This function does not verify the signature. The signer, tree and
+ * signature fields are unverified claims. Input over 16 MiB is rejected.
+ *
+ * # Errors
+ * `bytes` is not a valid serialized object, or it deserializes to a
+ * non-`Remix` object.
+ */
+export function remix_decode(bytes: Uint8Array): RemixInfoJs;
+
+/**
+ * Build and sign a remix (fork/derivation), returning
+ * `{ bytes, hash_hex, signature_hex }` like [`commit_encode_and_sign`].
+ *
+ * A `Remix` is the first-class fork object: it snapshots a `tree_hash`,
+ * names zero or more `parents` (prior remixes/commits in the fork's own
+ * history), and — crucially — records one or more `sources`, each a
+ * `RemixSource { upstream_id, commit_hash }` pointing at the upstream
+ * commit(s) this fork derives from.
+ *
+ * Inputs mirror the commit variant, plus `sources_json`:
+ * * `tree_hash_hex` — 64-hex tree object id this remix snapshots.
+ * * `parent_hex` — comma-separated parent ids (empty = root remix).
+ * * `sources_json` — JSON array of `{ "upstream_id_hex", "commit_hash_hex" }`
+ *   objects, each 64-hex. The upstream commits being forked/remixed.
+ * * `message` / `timestamp` — same as a commit.
+ * * `seed_hex` — the 32-byte Ed25519 seed.
+ *
+ * `sources` are sorted here by `(upstream_id, commit_hash)` and checked
+ * for duplicates, satisfying the strict-ascending order kit-core's
+ * `read_remix` enforces at decode time (see `Remix::sources_sorted`).
+ * At least one source is required — a remix with no source is not a fork.
+ *
+ * # Errors
+ * Any hex field is malformed, `sources_json` does not parse, `sources`
+ * is empty or contains a duplicate `(upstream_id, commit_hash)` pair, or
+ * signing-bytes construction fails.
+ */
+export function remix_encode_and_sign(tree_hash_hex: string, parent_hex: string, sources_json: string, message: string, timestamp: bigint, seed_hex: string): EncodedCommit;
+
+/**
+ * Verify a canonical remix's signature. Returns false for invalid encoding,
+ * wrong object kind, signature failure, or input larger than 16 MiB.
+ */
+export function remix_verify(bytes: Uint8Array): boolean;
+
+/**
+ * Sign arbitrary bytes under kit's commit signing domain. Exposed for
+ * the signing demo — real kit commits go through `commit_encode_and_sign`.
+ */
+export function sign_bytes_commit_domain(seed_hex: string, bytes: Uint8Array): string;
+
+/**
+ * Decode a canonical tree into JSON `[name, mode, hash_hex]` triples.
+ * Modes match [`tree_encode`]: `blob`, `tree`, `symlink`, and `exec`.
+ *
+ * # Errors
+ * Invalid encoding, a non-tree object, input larger than 16 MiB, or a
+ * non-UTF-8 entry name (which cannot round-trip through the JSON API).
+ */
+export function tree_decode(bytes: Uint8Array): string;
+
+/**
+ * Build a tree object from a JSON array of `[name, mode, hash_hex]`
+ * triples and return its serialized bytes + hash. `mode` is one of
+ * `"blob" | "tree" | "symlink" | "exec"`.
+ */
+export function tree_encode(entries_json: string): EncodedObject;
+
+/**
+ * Verify a signature made by [`sign_bytes_commit_domain`].
+ */
+export function verify_bytes_commit_domain(pubkey_hex: string, bytes: Uint8Array, sig_hex: string): boolean;
+
+/**
+ * Verify a single chunk inclusion proof against a `ChunkedBlob` id.
+ *
+ * `position` is the BMT position (chunk index + 1). Position 0 is the
+ * metadata leaf and is never a valid chunk proof. Returns `Ok(false)`
+ * on [`MerkleError::VerificationFailed`]; `Err` on malformed input.
+ *
+ * # Errors
+ *
+ * Malformed hex or proof bytes, or any merkle error other than
+ * [`MerkleError::VerificationFailed`].
+ */
+export function verify_chunk(chunked_id_hex: string, chunk_id_hex: string, position: number, proof: Uint8Array): boolean;
+
+/**
+ * Verify a closure manifest plus concatenated packs against a trusted root.
+ *
+ * The manifest is a locator, never a trust anchor: `expected_root_hex`
+ * must match the manifest root. Pack framing matches
+ * [`verify_closure_packs`].
+ *
+ * # Errors
+ *
+ * Malformed hex, oversize input, or any [`verify::VerifyError`].
+ */
+export function verify_closure_manifest(expected_root_hex: string, manifest: Uint8Array, packs: Uint8Array, pack_lengths_json: string): string;
+
+/**
+ * Verify concatenated raw-only closure packs against a trusted root.
+ *
+ * `mode` is `"snapshot"` or `"history"`. `packs` is the concatenation of
+ * each pack's bytes; `pack_lengths_json` is a JSON array of those
+ * lengths in the same order, e.g. `"[1024,2048]"`. Each pack and the
+ * concatenated buffer are capped at 1 GiB.
+ *
+ * Returns JSON `{ root, mode, verified, complete, unreferenced_checked,
+ * missing, corrupt, unreferenced }`.
+ *
+ * # Errors
+ *
+ * Malformed hex or mode, oversize or mis-sliced packs, or any
+ * [`verify::VerifyError`].
+ */
+export function verify_closure_packs(root_hex: string, mode: string, packs: Uint8Array, pack_lengths_json: string): string;
+
+/**
+ * Verify a disclosure bundle against a trusted commit id.
+ *
+ * Returns JSON `{ commit_id, tree_hash, path, leaf_id, signer,
+ * signature_valid, payload, step_inner_roots, chunk_inner_root }`
+ * **without** payload bytes. Call
+ * [`disclosure_payload_bytes`] for the verified bytes. Both functions
+ * re-verify; a caller that wants both should call this first and treat a
+ * failure of either as a failure.
+ *
+ * `path` entries are `{ name }` (UTF-8 or `null`), `{ name_hex }`, and
+ * `{ mode }` (`blob` / `tree` / `symlink` / `exec`). Payload `kind` is
+ * `object`, `chunk`, or `range`. Bundles larger than 64 MiB
+ * ([`MAX_BUNDLE_BYTES`]) are rejected before decode.
+ *
+ * # Errors
+ *
+ * Malformed hex, an oversize bundle, or any [`verify::VerifyError`].
+ */
+export function verify_disclosure(commit_id_hex: string, bundle: Uint8Array): string;
+
+/**
+ * Verify a KDSP v1 span container against a trusted commit id.
+ *
+ * The JSON contains `commit_id`, `tree_hash`, `path`, `leaf_id`, `signer`,
+ * `signature_valid`, `offset`, `bytes_len`, `bytes_blake3`, `first`, `last`,
+ * `span_start`, and `chunk_inner_root`. A `path` entry has `name` (UTF-8 or
+ * `null`), `name_hex`, and `mode`. The bytes are returned by the getter of
+ * the same [`VerifiedSpan`] and are never reverified. Input is capped at
+ * 64 MiB. Every error starts with a SPEC-DISCLOSURE §8.2 reason label,
+ * except a malformed `commit_id_hex`, which is not a §8.2 condition and
+ * starts with `invalid_input:`.
+ *
+ * # Errors
+ *
+ * Invalid commit hex, an oversized container, malformed framing, or a
+ * failed cryptographic or span check.
+ */
+export function verify_disclosure_span(commit_id_hex: string, bundle: Uint8Array): VerifiedSpan;
+
+/**
+ * Verify a single tree-entry inclusion proof against a tree object id.
+ *
+ * `entry_json` is `{ "name" | "name_hex", "mode", "object_hash" }`.
+ * `mode` matches [`crate::tree_encode`]: `blob` / `tree` / `symlink` /
+ * `exec`. `object_hash` is 64-char lowercase hex. Returns `Ok(false)`
+ * when the proof does not fold to `tree_id_hex`
+ * ([`MerkleError::VerificationFailed`]); `Err` on malformed input.
+ *
+ * # Errors
+ *
+ * Malformed hex, JSON, or proof bytes, or any merkle error other than
+ * [`MerkleError::VerificationFailed`].
+ */
+export function verify_tree_entry(tree_id_hex: string, entry_json: string, position: number, proof: Uint8Array): boolean;
+
+/**
+ * Verify a browser passkey (`WebAuthn` / P-256) assertion against a DSSE
+ * PAE — cryptographic checks only, no ceremony policy.
+ *
+ * Thin wrapper over `kit_attest::verify_webauthn_wrapping`. Checks the
+ * `type == "webauthn.get"`, `challenge == base64url-nopad(pae)`, the
+ * `authenticatorData` shape, and the P-256 signature over
+ * `authenticatorData || SHA-256(clientDataJSON)`. It does NOT bind the
+ * RP ID or origin — use [`verify_webauthn_wrapping_with_policy`] for
+ * that (which is what a real demo should do, pinning the RP ID to the
+ * site so the green check proves origin binding, not just a signature).
+ *
+ * * `pae` — the bytes from [`attest_pae`].
+ * * `authenticator_data` / `client_data_json` — raw bytes from the
+ *   browser assertion (`response.authenticatorData` /
+ *   `response.clientDataJSON`), passed as a `Uint8Array`.
+ * * `pubkey_hex` — SEC1 P-256 public key, 33-byte compressed (66 hex)
+ *   or 65-byte uncompressed (130 hex).
+ * * `signature` — 64-byte compact `r || s` (DER must be converted and
+ *   low-S-normalised JS-side first).
+ *
+ * Returns `Ok(())` when the assertion verifies. On failure the `Err`
+ * carries the typed reason (challenge mismatch, signature failed, …) so
+ * the demo can show *why* — more instructive than a bare boolean.
+ *
+ * # Errors
+ * `pubkey_hex` is not valid hex, or any `WebAuthn` verification failure.
+ */
+export function verify_webauthn_wrapping(pae: Uint8Array, authenticator_data: Uint8Array, client_data_json: Uint8Array, pubkey_hex: string, signature: Uint8Array): void;
+
+/**
+ * Policy-aware counterpart of [`verify_webauthn_wrapping`].
+ *
+ * Same cryptographic checks, plus the ceremony policy parsed from
+ * `policy_json` — an empty string (or `"{}"`) is fully permissive.
+ * Recognised keys (all optional):
+ *
+ * ```json
+ * {
+ *   "expected_rp_id": "kit.storage",
+ *   "allowed_origins": ["https://kit.storage"],
+ *   "require_user_presence": true,
+ *   "require_user_verification": false,
+ *   "allow_cross_origin": false,
+ *   "previous_sign_count": 0
+ * }
+ * ```
+ *
+ * Defaults match `WebAuthnPolicy::permissive` (no RP-ID/origin binding,
+ * UP/UV off, cross-origin allowed, counter unenforced) — only keys
+ * present in `policy_json` tighten the check.
+ *
+ * # Errors
+ * Malformed `policy_json`, `pubkey_hex` is not valid hex, or any
+ * `WebAuthn` verification failure.
+ */
+export function verify_webauthn_wrapping_with_policy(pae: Uint8Array, authenticator_data: Uint8Array, client_data_json: Uint8Array, pubkey_hex: string, signature: Uint8Array, policy_json: string): void;
+
+/**
+ * Wrap a BMT inner root with the kit type domain, producing the object id.
+ *
+ * `kind` is `"tree"` or `"chunked_blob"`. For a commonware BMT verifier
+ * that checked the inner root, this is the remaining step before
+ * comparing to an kit id.
+ *
+ * # Errors
+ *
+ * Unknown `kind` or malformed hex.
+ */
+export function wrap_object_id(kind: string, inner_root_hex: string): string;