@wireapp/core-crypto 10.2.0 → 10.4.0

package/dist/browser/corecrypto.d.ts

@@ -41,268 +41,6 @@ export declare function setMaxLogLevel(level: CoreCryptoLogLevel): void;
  * The version of `core-crypto`.
  */
 export declare function version(): string;
-type UuidLike = Uuid;
-/**
- * A Uuid.
- */
-export declare class Uuid extends UniffiAbstractObject {
-	readonly [uniffiTypeNameSymbol] = "Uuid";
-	readonly [destructorGuardSymbol]: UniffiGcObject;
-	readonly [pointerLiteralSymbol]: UniffiHandle;
-	/**
-	 * Parse a `Uuid` from a string.
-	 */
-	constructor(uuid: string);
-	toString(): string;
-	equals(other: Uuid): boolean;
-	hashCode(): bigint;
-	uniffiDestroy(): void;
-	static instanceOf(obj_: any): obj_ is Uuid;
-}
-type DeviceIdLike = DeviceId;
-/**
- * A Device ID.
- */
-export declare class DeviceId extends UniffiAbstractObject {
-	readonly [uniffiTypeNameSymbol] = "DeviceId";
-	readonly [destructorGuardSymbol]: UniffiGcObject;
-	readonly [pointerLiteralSymbol]: UniffiHandle;
-	/**
-	 * New device id from an unsigned 64-bit integer.
-	 */
-	constructor(id: bigint);
-	/**
-	 * Construct a `DeviceId` from 8 bytes encoded as a hex string.
-	 */
-	static fromHexString(hexString: string): DeviceIdLike;
-	/**
-	 * Encode the `DeviceId` as a 16-character lowercase hex string, with leading 0s.
-	 */
-	toHexString(): string;
-	/**
-	 * Get the number corresponding to this `DeviceId`.
-	 */
-	toU64(): bigint;
-	equals(other: DeviceId): boolean;
-	hashCode(): bigint;
-	uniffiDestroy(): void;
-	static instanceOf(obj_: any): obj_ is DeviceId;
-}
-/**
- * This directly represents a `ClientId` of the `<userid>:<device-id>@<domain>` format.
- * Instantiate via [ClientId::deserialize].
- */
-export type DeserializedClientId = {
-	/**
-	 * The client id this was deserialized from
-	 */
-	clientId: ClientIdLike;
-	/**
-	 * The user id component
-	 */
-	userId: UuidLike;
-	/**
-	 * The device id component
-	 */
-	deviceId: DeviceIdLike;
-	/**
-	 * The domain
-	 */
-	domain: string;
-};
-/**
- * Generated factory for {@link DeserializedClientId} record objects.
- */
-export declare const DeserializedClientId: Readonly<{
-	create: (partial: Partial<DeserializedClientId> & Required<Omit<DeserializedClientId, never>>) => DeserializedClientId;
-	new: (partial: Partial<DeserializedClientId> & Required<Omit<DeserializedClientId, never>>) => DeserializedClientId;
-	defaults: () => Partial<DeserializedClientId>;
-	toString(self_: DeserializedClientId): string;
-}>;
-type ClientIdLike = ClientId;
-/**
- * A unique identifier for an MLS client.
- *
- * Each app instance a user is running, such as desktop or mobile, is a separate client
- * with its own client id. A single user may therefore have multiple clients.
- * More information: <https://messaginglayersecurity.rocks/mls-architecture/draft-ietf-mls-architecture.html#name-group-members-and-clients>
- */
-export declare class ClientId extends UniffiAbstractObject {
-	readonly [uniffiTypeNameSymbol] = "ClientId";
-	readonly [destructorGuardSymbol]: UniffiGcObject;
-	readonly [pointerLiteralSymbol]: UniffiHandle;
-	/**
-	 * Create a new client id.
-	 */
-	constructor(userId: UuidLike, deviceId: DeviceIdLike, domain: string);
-	/**
-	 * Copy the wrapped data into a new byte array.
-	 */
-	copyBytes(): Uint8Array;
-	/**
-	 * Copy the wrapped data into a direct representation of the `<user-id>:<device-id>@<domain>` format.
-	 */
-	deserialize(): DeserializedClientId;
-	equals(other: ClientId): boolean;
-	hashCode(): bigint;
-	uniffiDestroy(): void;
-	static instanceOf(obj_: any): obj_ is ClientId;
-}
-/**
- * The standalone status of a device credential in an MLS group at a given moment.
- *
- * This does not represent states where a device is not using MLS or end-to-end identity.
- */
-export declare enum DeviceStatus {
-	/**
-	 * The device credential is valid.
-	 */
-	Valid = 1,
-	/**
-	 * The device credential's certificate has expired.
-	 */
-	Expired = 2,
-	/**
-	 * The device credential's certificate has been revoked.
-	 *
-	 * Note: revocation is not yet implemented.
-	 */
-	Revoked = 3
-}
-/**
- * The type of credential used to authenticate an MLS client's identity.
- */
-export declare enum CredentialType {
-	/**
-	 * A basic credential backed by a raw key pair, without any certificate infrastructure.
-	 */
-	Basic = 1,
-	/**
-	 * An X509 certificate credential, typically obtained through the end-to-end identity enrollment process.
-	 */
-	X509 = 2
-}
-/**
- * Typealias from the type name used in the UDL file to the builtin type.  This
- * is needed because the UDL type name is used in function/method signatures.
- */
-export type Timestamp = Date;
-/**
- * Fields from a `WireIdentity` that are specific to X509 credentials.
- */
-export type X509Identity = {
-	/**
-	 * User handle e.g. `john_wire`
-	 */
-	handle: string;
-	/**
-	 * Name as displayed in the messaging application e.g. `John Fitzgerald Kennedy`
-	 */
-	displayName: string;
-	/**
-	 * DNS domain for which this identity proof was generated e.g. `whitehouse.gov`
-	 */
-	domain: string;
-	/**
-	 * PEM-encoded X509 certificate identifying this client in the MLS group.
-	 */
-	certificate: string;
-	/**
-	 * X509 certificate serial number
-	 */
-	serialNumber: string;
-	/**
-	 * Certificate validity start time (the X509 notBefore field).
-	 */
-	notBefore: Timestamp;
-	/**
-	 * Certificate validity end time (the X509 notAfter field).
-	 */
-	notAfter: Timestamp;
-};
-/**
- * Generated factory for {@link X509Identity} record objects.
- */
-export declare const X509Identity: Readonly<{
-	create: (partial: Partial<X509Identity> & Required<Omit<X509Identity, never>>) => X509Identity;
-	new: (partial: Partial<X509Identity> & Required<Omit<X509Identity, never>>) => X509Identity;
-	defaults: () => Partial<X509Identity>;
-}>;
-/**
- * The identity claims identifying a client.
- *
- * Those claims are verifiable by any member in the group.
- */
-export type WireIdentity = {
-	/**
-	 * Unique client identifier e.g. `T4Coy4vdRzianwfOgXpn6A:6add501bacd1d90e@whitehouse.gov`
-	 */
-	clientId?: ClientIdLike;
-	/**
-	 * Status of the credential at the moment this object is created.
-	 */
-	status: DeviceStatus;
-	/**
-	 * MLS thumbprint
-	 */
-	thumbprint: string;
-	/**
-	 * Indicates whether the credential is Basic or X509.
-	 */
-	credentialType: CredentialType;
-	/**
-	 * The X509 certificate details; populated only when `credential_type` is X509.
-	 */
-	x509Identity?: X509Identity;
-};
-/**
- * Generated factory for {@link WireIdentity} record objects.
- */
-export declare const WireIdentity: Readonly<{
-	create: (partial: Partial<WireIdentity> & Required<Omit<WireIdentity, "clientId" | "x509Identity">>) => WireIdentity;
-	new: (partial: Partial<WireIdentity> & Required<Omit<WireIdentity, "clientId" | "x509Identity">>) => WireIdentity;
-	defaults: () => Partial<WireIdentity>;
-}>;
-/**
- * A decrypted message that was buffered due to out-of-order delivery by the distribution service.
- *
- * These are returned in the `buffered_messages` field of a `DecryptedMessage` when a commit is
- * processed. They represent messages for the new epoch that arrived before the commit that created it.
- */
-export type BufferedDecryptedMessage = {
-	/**
-	 * Decrypted plaintext
-	 */
-	message?: Uint8Array;
-	/**
-	 * False if processing this message caused the client to be removed from the group, i.e. due to a Remove commit.
-	 */
-	isActive: boolean;
-	/**
-	 * Commit delay in seconds.
-	 *
-	 * When set, clients must delay this long before processing a commit.
-	 * This reduces load on the backend, which otherwise would receive epoch change notifications from all clients
-	 * simultaneously.
-	 */
-	commitDelay?: bigint;
-	/**
-	 * `ClientId` of the sender of the message being decrypted. Only present for application messages.
-	 */
-	senderClientId?: ClientIdLike;
-	/**
-	 * Identity claims present in the sender credential.
-	 */
-	identity: WireIdentity;
-};
-/**
- * Generated factory for {@link BufferedDecryptedMessage} record objects.
- */
-export declare const BufferedDecryptedMessage: Readonly<{
-	create: (partial: Partial<BufferedDecryptedMessage> & Required<Omit<BufferedDecryptedMessage, "message" | "commitDelay" | "senderClientId">>) => BufferedDecryptedMessage;
-	new: (partial: Partial<BufferedDecryptedMessage> & Required<Omit<BufferedDecryptedMessage, "message" | "commitDelay" | "senderClientId">>) => BufferedDecryptedMessage;
-	defaults: () => Partial<BufferedDecryptedMessage>;
-}>;
 /**
  * Metadata describing the conditions of the build of this software.
  */
@@ -1190,7 +928,7 @@ export declare const MlsError: Readonly<{
 /**
  * Errors produced by the MLS layer.
  */
-export type MlsError = InstanceType<(typeof MlsError)["ConversationAlreadyExists" | "DuplicateMessage" | "BufferedFutureMessage" | "WrongEpoch" | "BufferedCommit" | "MessageEpochTooOld" | "SelfCommitIgnored" | "UnmergedPendingGroup" | "StaleProposal" | "StaleCommit" | "OrphanWelcome" | "MessageRejected" | "Other"]>;
+export type MlsError = InstanceType<typeof MlsError["ConversationAlreadyExists" | "DuplicateMessage" | "BufferedFutureMessage" | "WrongEpoch" | "BufferedCommit" | "MessageEpochTooOld" | "SelfCommitIgnored" | "UnmergedPendingGroup" | "StaleProposal" | "StaleCommit" | "OrphanWelcome" | "MessageRejected" | "Other"]>;
 export declare enum ProteusError_Tags {
 	SessionNotFound = "SessionNotFound",
 	DuplicateMessage = "DuplicateMessage",
@@ -1459,7 +1197,7 @@ export declare const ProteusError: Readonly<{
 /**
  * Errors produced by the Proteus layer.
  */
-export type ProteusError = InstanceType<(typeof ProteusError)["SessionNotFound" | "DuplicateMessage" | "RemoteIdentityChanged" | "Other"]>;
+export type ProteusError = InstanceType<typeof ProteusError["SessionNotFound" | "DuplicateMessage" | "RemoteIdentityChanged" | "Other"]>;
 export declare enum CoreCryptoError_Tags {
 	Mls = "Mls",
 	Proteus = "Proteus",
@@ -1916,7 +1654,7 @@ export declare const CoreCryptoError: Readonly<{
 /**
  * The primary error type returned across the CoreCrypto FFI boundary.
  */
-export type CoreCryptoError = InstanceType<(typeof CoreCryptoError)["Mls" | "Proteus" | "E2ei" | "TransactionFailed" | "Other"]>;
+export type CoreCryptoError = InstanceType<typeof CoreCryptoError["Mls" | "Proteus" | "E2ei" | "TransactionFailed" | "Other"]>;
 type WelcomeLike = Welcome;
 /**
  * A TLS-serialized Welcome message.
@@ -2026,49 +1764,112 @@ export declare const CommitBundle: Readonly<{
 	new: (partial: Partial<CommitBundle> & Required<Omit<CommitBundle, "welcome" | "encryptedMessage">>) => CommitBundle;
 	defaults: () => Partial<CommitBundle>;
 }>;
+type ClientIdLike = ClientId;
 /**
- * A decrypted message and various associated metadata.
+ * A unique identifier for an MLS client.
+ *
+ * Each app instance a user is running, such as desktop or mobile, is a separate client
+ * with its own client id. A single user may therefore have multiple clients.
+ * More information: <https://messaginglayersecurity.rocks/mls-architecture/draft-ietf-mls-architecture.html#name-group-members-and-clients>
  */
-export type DecryptedMessage = {
+export declare class ClientId extends UniffiAbstractObject {
+	readonly [uniffiTypeNameSymbol] = "ClientId";
+	readonly [destructorGuardSymbol]: UniffiGcObject;
+	readonly [pointerLiteralSymbol]: UniffiHandle;
 	/**
-	 * Decrypted plaintext
+	 * Create a new client id.
 	 */
-	message?: Uint8Array;
+	constructor(userId: UuidLike, deviceId: DeviceIdLike, domain: string);
 	/**
-	 * False if processing this message caused the client to be removed from the group, i.e. due to a Remove commit.
+	 * Copy the wrapped data into a new byte array.
 	 */
-	isActive: boolean;
+	copyBytes(): Uint8Array;
 	/**
-	 * Commit delay in seconds.
-	 *
-	 * When set, clients must delay this long before processing a commit.
-	 * This reduces load on the backend, which otherwise would receive epoch change notifications from all clients
-	 * simultaneously.
+	 * Copy the wrapped data into a direct representation of the `<user-id>:<device-id>@<domain>` format.
 	 */
-	commitDelay?: bigint;
+	deserialize(): DeserializedClientId;
+	equals(other: ClientId): boolean;
+	hashCode(): bigint;
+	uniffiDestroy(): void;
+	static instanceOf(obj_: any): obj_ is ClientId;
+}
+type UuidLike = Uuid;
+/**
+ * A Uuid.
+ */
+export declare class Uuid extends UniffiAbstractObject {
+	readonly [uniffiTypeNameSymbol] = "Uuid";
+	readonly [destructorGuardSymbol]: UniffiGcObject;
+	readonly [pointerLiteralSymbol]: UniffiHandle;
 	/**
-	 * `ClientId` of the sender of the message being decrypted. Only present for application messages.
+	 * Parse a `Uuid` from a string.
 	 */
-	senderClientId?: ClientIdLike;
+	constructor(uuid: string);
+	toString(): string;
+	equals(other: Uuid): boolean;
+	hashCode(): bigint;
+	uniffiDestroy(): void;
+	static instanceOf(obj_: any): obj_ is Uuid;
+}
+type DeviceIdLike = DeviceId;
+/**
+ * A Device ID.
+ */
+export declare class DeviceId extends UniffiAbstractObject {
+	readonly [uniffiTypeNameSymbol] = "DeviceId";
+	readonly [destructorGuardSymbol]: UniffiGcObject;
+	readonly [pointerLiteralSymbol]: UniffiHandle;
 	/**
-	 * Identity claims present in the sender credential.
+	 * New device id from an unsigned 64-bit integer.
 	 */
-	identity: WireIdentity;
+	constructor(id: bigint);
 	/**
-	 * Only set when the decrypted message is a commit.
-	 *
-	 * Contains buffered messages for next epoch which were received before the commit creating the epoch
-	 * because the DS did not fan them out in order.
+	 * Construct a `DeviceId` from 8 bytes encoded as a hex string.
+	 */
+	static fromHexString(hexString: string): DeviceIdLike;
+	/**
+	 * Encode the `DeviceId` as a 16-character lowercase hex string, with leading 0s.
+	 */
+	toHexString(): string;
+	/**
+	 * Get the number corresponding to this `DeviceId`.
 	 */
-	bufferedMessages?: Array<BufferedDecryptedMessage>;
+	toU64(): bigint;
+	equals(other: DeviceId): boolean;
+	hashCode(): bigint;
+	uniffiDestroy(): void;
+	static instanceOf(obj_: any): obj_ is DeviceId;
+}
+/**
+ * This directly represents a `ClientId` of the `<userid>:<device-id>@<domain>` format.
+ * Instantiate via [ClientId::deserialize].
+ */
+export type DeserializedClientId = {
+	/**
+	 * The client id this was deserialized from
+	 */
+	clientId: ClientIdLike;
+	/**
+	 * The user id component
+	 */
+	userId: UuidLike;
+	/**
+	 * The device id component
+	 */
+	deviceId: DeviceIdLike;
+	/**
+	 * The domain
+	 */
+	domain: string;
 };
 /**
- * Generated factory for {@link DecryptedMessage} record objects.
+ * Generated factory for {@link DeserializedClientId} record objects.
  */
-export declare const DecryptedMessage: Readonly<{
-	create: (partial: Partial<DecryptedMessage> & Required<Omit<DecryptedMessage, "message" | "commitDelay" | "senderClientId" | "bufferedMessages">>) => DecryptedMessage;
-	new: (partial: Partial<DecryptedMessage> & Required<Omit<DecryptedMessage, "message" | "commitDelay" | "senderClientId" | "bufferedMessages">>) => DecryptedMessage;
-	defaults: () => Partial<DecryptedMessage>;
+export declare const DeserializedClientId: Readonly<{
+	create: (partial: Partial<DeserializedClientId> & Required<Omit<DeserializedClientId, never>>) => DeserializedClientId;
+	new: (partial: Partial<DeserializedClientId> & Required<Omit<DeserializedClientId, never>>) => DeserializedClientId;
+	defaults: () => Partial<DeserializedClientId>;
+	toString(self_: DeserializedClientId): string;
 }>;
 /**
  * A `HistorySecret` encodes sufficient client state that it can be used to instantiate an
@@ -2159,6 +1960,121 @@ export declare const ProteusAutoPrekeyBundle: Readonly<{
 	new: (partial: Partial<ProteusAutoPrekeyBundle> & Required<Omit<ProteusAutoPrekeyBundle, never>>) => ProteusAutoPrekeyBundle;
 	defaults: () => Partial<ProteusAutoPrekeyBundle>;
 }>;
+/**
+ * The standalone status of a device credential in an MLS group at a given moment.
+ *
+ * This does not represent states where a device is not using MLS or end-to-end identity.
+ */
+export declare enum DeviceStatus {
+	/**
+	 * The device credential is valid.
+	 */
+	Valid = 1,
+	/**
+	 * The device credential's certificate has expired.
+	 */
+	Expired = 2,
+	/**
+	 * The device credential's certificate has been revoked.
+	 *
+	 * Note: revocation is not yet implemented.
+	 */
+	Revoked = 3
+}
+/**
+ * The type of credential used to authenticate an MLS client's identity.
+ */
+export declare enum CredentialType {
+	/**
+	 * A basic credential backed by a raw key pair, without any certificate infrastructure.
+	 */
+	Basic = 1,
+	/**
+	 * An X509 certificate credential, typically obtained through the end-to-end identity enrollment process.
+	 */
+	X509 = 2
+}
+/**
+ * Typealias from the type name used in the UDL file to the builtin type.  This
+ * is needed because the UDL type name is used in function/method signatures.
+ */
+export type Timestamp = Date;
+/**
+ * Fields from a `WireIdentity` that are specific to X509 credentials.
+ */
+export type X509Identity = {
+	/**
+	 * User handle e.g. `john_wire`
+	 */
+	handle: string;
+	/**
+	 * Name as displayed in the messaging application e.g. `John Fitzgerald Kennedy`
+	 */
+	displayName: string;
+	/**
+	 * DNS domain for which this identity proof was generated e.g. `whitehouse.gov`
+	 */
+	domain: string;
+	/**
+	 * PEM-encoded X509 certificate identifying this client in the MLS group.
+	 */
+	certificate: string;
+	/**
+	 * X509 certificate serial number
+	 */
+	serialNumber: string;
+	/**
+	 * Certificate validity start time (the X509 notBefore field).
+	 */
+	notBefore: Timestamp;
+	/**
+	 * Certificate validity end time (the X509 notAfter field).
+	 */
+	notAfter: Timestamp;
+};
+/**
+ * Generated factory for {@link X509Identity} record objects.
+ */
+export declare const X509Identity: Readonly<{
+	create: (partial: Partial<X509Identity> & Required<Omit<X509Identity, never>>) => X509Identity;
+	new: (partial: Partial<X509Identity> & Required<Omit<X509Identity, never>>) => X509Identity;
+	defaults: () => Partial<X509Identity>;
+}>;
+/**
+ * The identity claims identifying a client.
+ *
+ * Those claims are verifiable by any member in the group.
+ */
+export type WireIdentity = {
+	/**
+	 * Unique client identifier e.g. `T4Coy4vdRzianwfOgXpn6A:6add501bacd1d90e@whitehouse.gov`
+	 */
+	clientId?: ClientIdLike;
+	/**
+	 * Status of the credential at the moment this object is created.
+	 */
+	status: DeviceStatus;
+	/**
+	 * MLS thumbprint
+	 */
+	thumbprint: string;
+	/**
+	 * Indicates whether the credential is Basic or X509.
+	 */
+	credentialType: CredentialType;
+	/**
+	 * The X509 certificate details; populated only when `credential_type` is X509.
+	 */
+	x509Identity?: X509Identity;
+};
+/**
+ * Generated factory for {@link WireIdentity} record objects.
+ */
+export declare const WireIdentity: Readonly<{
+	create: (partial: Partial<WireIdentity> & Required<Omit<WireIdentity, "clientId" | "x509Identity">>) => WireIdentity;
+	new: (partial: Partial<WireIdentity> & Required<Omit<WireIdentity, "clientId" | "x509Identity">>) => WireIdentity;
+	defaults: () => Partial<WireIdentity>;
+}>;
 /**
  * MLS cipher suites
  */
@@ -2237,6 +2153,160 @@ export declare const X509CredentialAcquisitionConfiguration: Readonly<{
 	new: (partial: Partial<X509CredentialAcquisitionConfiguration> & Required<Omit<X509CredentialAcquisitionConfiguration, "team">>) => X509CredentialAcquisitionConfiguration;
 	defaults: () => Partial<X509CredentialAcquisitionConfiguration>;
 }>;
+declare enum BufferedDecryptedMessage_Tags {
+	Text = "Text",
+	Commit = "Commit",
+	Proposal = "Proposal"
+}
+/**
+ * A decrypted message that was buffered due to out-of-order delivery by the delivery service.
+ * It represents messages for the new epoch that arrived before the commit that created it.
+ */
+export declare const BufferedDecryptedMessage: Readonly<{
+	instanceOf: (obj: any) => obj is BufferedDecryptedMessage;
+	Text: {
+		new (inner: {
+			plaintext: Uint8Array;
+			senderClientId: ClientIdLike;
+			identity: WireIdentity;
+		}): {
+			readonly tag: BufferedDecryptedMessage_Tags.Text;
+			readonly inner: Readonly<{
+				plaintext: Uint8Array;
+				senderClientId: ClientIdLike;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+		"new"(inner: {
+			plaintext: Uint8Array;
+			senderClientId: ClientIdLike;
+			identity: WireIdentity;
+		}): {
+			readonly tag: BufferedDecryptedMessage_Tags.Text;
+			readonly inner: Readonly<{
+				plaintext: Uint8Array;
+				senderClientId: ClientIdLike;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+		instanceOf(obj: any): obj is {
+			readonly tag: BufferedDecryptedMessage_Tags.Text;
+			readonly inner: Readonly<{
+				plaintext: Uint8Array;
+				senderClientId: ClientIdLike;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+	};
+	Commit: {
+		new (inner: {
+			isActive: boolean;
+			identity: WireIdentity;
+		}): {
+			readonly tag: BufferedDecryptedMessage_Tags.Commit;
+			readonly inner: Readonly<{
+				isActive: boolean;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+		"new"(inner: {
+			isActive: boolean;
+			identity: WireIdentity;
+		}): {
+			readonly tag: BufferedDecryptedMessage_Tags.Commit;
+			readonly inner: Readonly<{
+				isActive: boolean;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+		instanceOf(obj: any): obj is {
+			readonly tag: BufferedDecryptedMessage_Tags.Commit;
+			readonly inner: Readonly<{
+				isActive: boolean;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+	};
+	Proposal: {
+		new (inner: {
+			delay?: bigint;
+			identity: WireIdentity;
+		}): {
+			readonly tag: BufferedDecryptedMessage_Tags.Proposal;
+			readonly inner: Readonly<{
+				delay?: bigint;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+		"new"(inner: {
+			delay?: bigint;
+			identity: WireIdentity;
+		}): {
+			readonly tag: BufferedDecryptedMessage_Tags.Proposal;
+			readonly inner: Readonly<{
+				delay?: bigint;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+		instanceOf(obj: any): obj is {
+			readonly tag: BufferedDecryptedMessage_Tags.Proposal;
+			readonly inner: Readonly<{
+				delay?: bigint;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "BufferedDecryptedMessage";
+		};
+	};
+}>;
+/**
+ * A decrypted message that was buffered due to out-of-order delivery by the delivery service.
+ * It represents messages for the new epoch that arrived before the commit that created it.
+ */
+export type BufferedDecryptedMessage = InstanceType<typeof BufferedDecryptedMessage["Text" | "Commit" | "Proposal"]>;
 /**
  * Defines the log level for CoreCrypto.
  */
@@ -2248,6 +2318,163 @@ export declare enum CoreCryptoLogLevel {
 	Warn = 5,
 	Error = 6
 }
+declare enum DecryptedMessage_Tags {
+	Text = "Text",
+	Commit = "Commit",
+	Proposal = "Proposal"
+}
+/**
+ * Represents the items a consumer might require after decrypting a message.
+ */
+export declare const DecryptedMessage: Readonly<{
+	instanceOf: (obj: any) => obj is DecryptedMessage;
+	Text: {
+		new (inner: {
+			plaintext: Uint8Array;
+			senderClientId: ClientIdLike;
+			identity: WireIdentity;
+		}): {
+			readonly tag: DecryptedMessage_Tags.Text;
+			readonly inner: Readonly<{
+				plaintext: Uint8Array;
+				senderClientId: ClientIdLike;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+		"new"(inner: {
+			plaintext: Uint8Array;
+			senderClientId: ClientIdLike;
+			identity: WireIdentity;
+		}): {
+			readonly tag: DecryptedMessage_Tags.Text;
+			readonly inner: Readonly<{
+				plaintext: Uint8Array;
+				senderClientId: ClientIdLike;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+		instanceOf(obj: any): obj is {
+			readonly tag: DecryptedMessage_Tags.Text;
+			readonly inner: Readonly<{
+				plaintext: Uint8Array;
+				senderClientId: ClientIdLike;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+	};
+	Commit: {
+		new (inner: {
+			isActive: boolean;
+			bufferedMessages?: Array<BufferedDecryptedMessage>;
+			identity: WireIdentity;
+		}): {
+			readonly tag: DecryptedMessage_Tags.Commit;
+			readonly inner: Readonly<{
+				isActive: boolean;
+				bufferedMessages?: Array<BufferedDecryptedMessage>;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+		"new"(inner: {
+			isActive: boolean;
+			bufferedMessages?: Array<BufferedDecryptedMessage>;
+			identity: WireIdentity;
+		}): {
+			readonly tag: DecryptedMessage_Tags.Commit;
+			readonly inner: Readonly<{
+				isActive: boolean;
+				bufferedMessages?: Array<BufferedDecryptedMessage>;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+		instanceOf(obj: any): obj is {
+			readonly tag: DecryptedMessage_Tags.Commit;
+			readonly inner: Readonly<{
+				isActive: boolean;
+				bufferedMessages?: Array<BufferedDecryptedMessage>;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+	};
+	Proposal: {
+		new (inner: {
+			delay?: bigint;
+			identity: WireIdentity;
+		}): {
+			readonly tag: DecryptedMessage_Tags.Proposal;
+			readonly inner: Readonly<{
+				delay?: bigint;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+		"new"(inner: {
+			delay?: bigint;
+			identity: WireIdentity;
+		}): {
+			readonly tag: DecryptedMessage_Tags.Proposal;
+			readonly inner: Readonly<{
+				delay?: bigint;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+		instanceOf(obj: any): obj is {
+			readonly tag: DecryptedMessage_Tags.Proposal;
+			readonly inner: Readonly<{
+				delay?: bigint;
+				identity: WireIdentity;
+			}>;
+			/**
+			 * @private
+			 * This field is private and should not be used, use `tag` instead.
+			 */
+			readonly [uniffiTypeNameSymbol]: "DecryptedMessage";
+		};
+	};
+}>;
+/**
+ * Represents the items a consumer might require after decrypting a message.
+ */
+export type DecryptedMessage = InstanceType<typeof DecryptedMessage["Text" | "Commit" | "Proposal"]>;
 /**
  * The end-to-end identity verification state of a conversation.
  *
@@ -2323,7 +2550,7 @@ export declare const EpochChangedReportingError: {
 /**
  * An error returned by an `EpochObserver` callback implementation.
  */
-export type EpochChangedReportingError = InstanceType<(typeof EpochChangedReportingError)["Ffi"]>;
+export type EpochChangedReportingError = InstanceType<typeof EpochChangedReportingError["Ffi"]>;
 /**
  * HttpMethod used for PKI hooks.
  */
@@ -2406,7 +2633,7 @@ export declare const LoggingError: {
 /**
  * An error returned by a `CoreCryptoLogger` callback implementation.
  */
-export type LoggingError = InstanceType<(typeof LoggingError)["Ffi"]>;
+export type LoggingError = InstanceType<typeof LoggingError["Ffi"]>;
 declare enum MlsTransportError_Tags {
 	MessageRejected = "MessageRejected"
 }
@@ -2507,7 +2734,7 @@ export declare const MlsTransportError: Readonly<{
 /**
  * Errors returned by MLS transport callbacks exposed through FFI.
  */
-export type MlsTransportError = InstanceType<(typeof MlsTransportError)["MessageRejected"]>;
+export type MlsTransportError = InstanceType<typeof MlsTransportError["MessageRejected"]>;
 declare enum NewHistoryClientReportingError_Tags {
 	Ffi = "Ffi"
 }
@@ -2561,7 +2788,7 @@ export declare const NewHistoryClientReportingError: {
 /**
  * An error returned by a `HistoryObserver` callback implementation.
  */
-export type NewHistoryClientReportingError = InstanceType<(typeof NewHistoryClientReportingError)["Ffi"]>;
+export type NewHistoryClientReportingError = InstanceType<typeof NewHistoryClientReportingError["Ffi"]>;
 declare enum PkiEnvironmentHooksError_Tags {
 	Error = "Error"
 }
@@ -2662,7 +2889,7 @@ export declare const PkiEnvironmentHooksError: Readonly<{
 /**
  * An error returned by a `PkiEnvironmentHooks` callback implementation.
  */
-export type PkiEnvironmentHooksError = InstanceType<(typeof PkiEnvironmentHooksError)["Error"]>;
+export type PkiEnvironmentHooksError = InstanceType<typeof PkiEnvironmentHooksError["Error"]>;
 /**
  * Signature schemes supported by MLS, as defined in RFC 9420.
  */
@@ -2688,6 +2915,16 @@ export declare enum SignatureScheme {
 	 */
 	Ed448 = 2056
 }
+declare enum TargetedMessagePolicy {
+	/**
+	 * Won't be persisted and will only be visible to currently online members who immediately process it.
+	 */
+	Transient = 0,
+	/**
+	 * May be persisted and buffered, will also be delivered and processed by currently offline members.
+	 */
+	Persisted = 1
+}
 /**
  * Typealias from the type name used in the UDL file to the builtin type.  This
  * is needed because the UDL type name is used in function/method signatures.
@@ -3085,6 +3322,15 @@ declare class CoreCryptoContext extends UniffiAbstractObject {
 	encryptMessage(conversationId: ConversationIdLike, message: Uint8Array, asyncOpts_?: {
 		signal: AbortSignal;
 	}): Promise<Uint8Array>;
+	/**
+	 * Encrypts a plaintext message for one member of the given conversation.
+	 *
+	 * Any feature using a targeted, transient or transient targeted message MUST specify why the lower security
+	 * guarantees (compared to MLS application messages) are acceptable and/or how they are mitigated.
+	 */
+	encryptTargetedMessage(conversationId: ConversationIdLike, recipient: ClientIdLike, policy: TargetedMessagePolicy, message: Uint8Array, asyncOpts_?: {
+		signal: AbortSignal;
+	}): Promise<Uint8Array>;
 	/**
 	 * Derives and exports a secret of `key_length` bytes for the given conversation.
 	 *
@@ -3374,13 +3620,23 @@ export declare class PkiEnvironment extends UniffiAbstractObject {
 	}): Promise<void>;
 	/**
 	 * Add a PEM-encoded certificate as a trust anchor.
-	 *
-	 * NOTE: currently we only support storing a single trust anchor, calling this method multiple
-	 * times will overwrite any previously added trust anchor.
 	 */
 	addTrustAnchor(certPem: string, asyncOpts_?: {
 		signal: AbortSignal;
 	}): Promise<void>;
+	/**
+	 * Get all trust anchors as PEM-encoded certificates.
+	 */
+	getTrustAnchors(asyncOpts_?: {
+		signal: AbortSignal;
+	}): Promise<Array<string>>;
+	/**
+	 * Remove a trust anchor by providing the certificates Subject Public Key Info (SPKI) fingerprint as bytes.
+	 * Trying to remove trust anchor that doesn't exist in the database will just succeed.
+	 */
+	removeTrustAnchor(fingerprint: Uint8Array, asyncOpts_?: {
+		signal: AbortSignal;
+	}): Promise<void>;
 	uniffiDestroy(): void;
 	static instanceOf(obj_: any): obj_ is PkiEnvironment;
 }