diff --git a/veilid-core/src/crypto/types/crypto_typed.rs b/veilid-core/src/crypto/types/crypto_typed.rs
index 39f4bd59..740f888c 100644
--- a/veilid-core/src/crypto/types/crypto_typed.rs
+++ b/veilid-core/src/crypto/types/crypto_typed.rs
@@ -1,7 +1,6 @@
 use super::*;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-#[cfg_attr(target_arch = "wasm32", derive(Tsify), tsify(into_wasm_abi))]
 pub struct CryptoTyped<K>
 where
     K: Clone
diff --git a/veilid-core/src/crypto/types/crypto_typed_group.rs b/veilid-core/src/crypto/types/crypto_typed_group.rs
index 77d0974c..80f717bc 100644
--- a/veilid-core/src/crypto/types/crypto_typed_group.rs
+++ b/veilid-core/src/crypto/types/crypto_typed_group.rs
@@ -1,9 +1,7 @@
 use super::*;
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialOrd, Ord, PartialEq, Eq, Hash, Default)]
-#[cfg_attr(target_arch = "wasm32", derive(Tsify))]
 #[serde(from = "Vec<CryptoTyped<K>>", into = "Vec<CryptoTyped<K>>")]
-// TODO: figure out hot to TS type this as `string`, since it's converted to string via the JSON API.
 pub struct CryptoTypedGroup<K = PublicKey>
 where
     K: Clone
diff --git a/veilid-core/src/crypto/types/keypair.rs b/veilid-core/src/crypto/types/keypair.rs
index 333a5d0b..6530eefb 100644
--- a/veilid-core/src/crypto/types/keypair.rs
+++ b/veilid-core/src/crypto/types/keypair.rs
@@ -7,9 +7,7 @@ use super::*;
     tsify(from_wasm_abi, into_wasm_abi)
 )]
 pub struct KeyPair {
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     pub key: PublicKey,
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     pub secret: SecretKey,
 }
 from_impl_to_jsvalue!(KeyPair);
diff --git a/veilid-core/src/veilid_api/types/dht/dht_record_descriptor.rs b/veilid-core/src/veilid_api/types/dht/dht_record_descriptor.rs
index 32c93ffd..9d619652 100644
--- a/veilid-core/src/veilid_api/types/dht/dht_record_descriptor.rs
+++ b/veilid-core/src/veilid_api/types/dht/dht_record_descriptor.rs
@@ -10,16 +10,14 @@ use super::*;
 pub struct DHTRecordDescriptor {
     /// DHT Key = Hash(ownerKeyKind) of: [ ownerKeyValue, schema ]
     #[schemars(with = "String")]
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     key: TypedKey,
     /// The public key of the owner
     #[schemars(with = "String")]
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     owner: PublicKey,
     /// If this key is being created: Some(the secret key of the owner)
     /// If this key is just being opened: None
     #[schemars(with = "Option<String>")]
-    #[cfg_attr(target_arch = "wasm32", tsify(optional, type = "string"))]
+    #[cfg_attr(target_arch = "wasm32", tsify(optional))]
     owner_secret: Option<SecretKey>,
     /// The schema in use associated with the key
     schema: DHTSchema,
diff --git a/veilid-core/src/veilid_api/types/dht/schema/smpl.rs b/veilid-core/src/veilid_api/types/dht/schema/smpl.rs
index d6da5ea6..b14ed67c 100644
--- a/veilid-core/src/veilid_api/types/dht/schema/smpl.rs
+++ b/veilid-core/src/veilid_api/types/dht/schema/smpl.rs
@@ -6,7 +6,6 @@ use super::*;
 pub struct DHTSchemaSMPLMember {
     /// Member key
     #[schemars(with = "String")]
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     pub m_key: PublicKey,
     /// Member subkey count
     pub m_cnt: u16,
diff --git a/veilid-core/src/veilid_api/types/dht/value_data.rs b/veilid-core/src/veilid_api/types/dht/value_data.rs
index 98f73910..e43b9b2b 100644
--- a/veilid-core/src/veilid_api/types/dht/value_data.rs
+++ b/veilid-core/src/veilid_api/types/dht/value_data.rs
@@ -15,7 +15,6 @@ pub struct ValueData {
 
     /// The public identity key of the writer of the data
     #[schemars(with = "String")]
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     writer: PublicKey,
 }
 from_impl_to_jsvalue!(ValueData);
diff --git a/veilid-core/src/veilid_api/types/fourcc.rs b/veilid-core/src/veilid_api/types/fourcc.rs
index 21f8db50..5995c1b5 100644
--- a/veilid-core/src/veilid_api/types/fourcc.rs
+++ b/veilid-core/src/veilid_api/types/fourcc.rs
@@ -4,7 +4,6 @@ use super::*;
 #[derive(
     Copy, Default, Clone, Hash, PartialOrd, Ord, PartialEq, Eq, Serialize, Deserialize, JsonSchema,
 )]
-#[cfg_attr(target_arch = "wasm32", derive(Tsify))]
 #[serde(try_from = "String")]
 #[serde(into = "String")]
 pub struct FourCC(pub [u8; 4]);
diff --git a/veilid-core/src/veilid_api/types/veilid_state.rs b/veilid-core/src/veilid_api/types/veilid_state.rs
index 6c3b4e60..49b180c9 100644
--- a/veilid-core/src/veilid_api/types/veilid_state.rs
+++ b/veilid-core/src/veilid_api/types/veilid_state.rs
@@ -83,10 +83,8 @@ pub struct VeilidStateNetwork {
 #[cfg_attr(target_arch = "wasm32", derive(Tsify))]
 pub struct VeilidRouteChange {
     #[schemars(with = "Vec<String>")]
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     pub dead_routes: Vec<RouteId>,
     #[schemars(with = "Vec<String>")]
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     pub dead_remote_routes: Vec<RouteId>,
 }
 
@@ -100,7 +98,6 @@ pub struct VeilidStateConfig {
 #[cfg_attr(target_arch = "wasm32", derive(Tsify))]
 pub struct VeilidValueChange {
     #[schemars(with = "String")]
-    #[cfg_attr(target_arch = "wasm32", tsify(type = "string"))]
     pub key: TypedKey,
     pub subkeys: Vec<ValueSubkey>,
     pub count: u32,
diff --git a/veilid-wasm/src/lib.rs b/veilid-wasm/src/lib.rs
index 77767ea5..fa87391c 100644
--- a/veilid-wasm/src/lib.rs
+++ b/veilid-wasm/src/lib.rs
@@ -66,10 +66,15 @@ fn take_veilid_api() -> Result<veilid_core::VeilidAPI, veilid_core::VeilidAPIErr
 }
 
 // Marshalling helpers
-pub fn unmarshall(b64: String) -> Vec<u8> {
+pub fn unmarshall(b64: String) -> APIResult<Vec<u8>> {
     data_encoding::BASE64URL_NOPAD
         .decode(b64.as_bytes())
-        .unwrap()
+        .map_err(|e| {
+            VeilidAPIError::generic(format!(
+                "error decoding base64url string '{}' into bytes: {}",
+                b64, e
+            ))
+        })
 }
 
 pub fn marshall(data: &Vec<u8>) -> String {
@@ -246,11 +251,6 @@ pub fn change_log_level(layer: String, log_level: String) {
     }
 }
 
-#[wasm_bindgen(typescript_custom_section)]
-const IUPDATE_VEILID_FUNCTION: &'static str = r#"
-type UpdateVeilidFunction = (event: VeilidUpdate) => void;
-"#;
-
 #[wasm_bindgen()]
 pub fn startup_veilid_core(update_callback_js: Function, json_config: String) -> Promise {
     let update_callback_js = SendWrapper::new(update_callback_js);
diff --git a/veilid-wasm/src/veilid_client_js.rs b/veilid-wasm/src/veilid_client_js.rs
index 0629adb9..e89103cb 100644
--- a/veilid-wasm/src/veilid_client_js.rs
+++ b/veilid-wasm/src/veilid_client_js.rs
@@ -3,7 +3,16 @@ use super::*;
 
 #[wasm_bindgen(typescript_custom_section)]
 const IUPDATE_VEILID_FUNCTION: &'static str = r#"
-type UpdateVeilidFunction = (event: VeilidUpdate) => void;
+export type UpdateVeilidFunction = (event: VeilidUpdate) => void;
+
+// Type overrides for structs that always get serialized by serde.
+export type CryptoKey = string;
+export type Nonce = string;
+export type Signature = string;
+export type KeyPair = `${PublicKey}:${SecretKey}`;
+export type FourCC = "NONE" | "VLD0" | string;
+export type CryptoTyped<TCryptoKey extends string> = `${FourCC}:${TCryptoKey}`;
+export type CryptoTypedGroup<TCryptoKey extends string> = Array<CryptoTyped<TCryptoKey>>;
 "#;
 
 #[wasm_bindgen]
diff --git a/veilid-wasm/src/veilid_crypto_js.rs b/veilid-wasm/src/veilid_crypto_js.rs
index 350bac32..e12a1978 100644
--- a/veilid-wasm/src/veilid_crypto_js.rs
+++ b/veilid-wasm/src/veilid_crypto_js.rs
@@ -1,12 +1,6 @@
 #![allow(non_snake_case)]
 use super::*;
 
-#[wasm_bindgen]
-extern "C" {
-    #[wasm_bindgen(typescript_type = "string[]")]
-    pub type ValidCryptoKinds;
-}
-
 #[wasm_bindgen(js_name = veilidCrypto)]
 pub struct VeilidCrypto {}
 
@@ -99,12 +93,8 @@ impl VeilidCrypto {
 
     pub fn hashPassword(kind: String, password: String, salt: String) -> APIResult<String> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
-        let password: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(password.as_bytes())
-            .unwrap();
-        let salt: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(salt.as_bytes())
-            .unwrap();
+        let password = unmarshall(password)?;
+        let salt = unmarshall(salt)?;
 
         let veilid_api = get_veilid_api()?;
         let crypto = veilid_api.crypto()?;
@@ -125,9 +115,7 @@ impl VeilidCrypto {
         password_hash: String,
     ) -> APIResult<bool> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
-        let password: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(password.as_bytes())
-            .unwrap();
+        let password = unmarshall(password)?;
 
         let veilid_api = get_veilid_api()?;
         let crypto = veilid_api.crypto()?;
@@ -144,12 +132,8 @@ impl VeilidCrypto {
 
     pub fn deriveSharedSecret(kind: String, password: String, salt: String) -> APIResult<String> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
-        let password: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(password.as_bytes())
-            .unwrap();
-        let salt: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(salt.as_bytes())
-            .unwrap();
+        let password = unmarshall(password)?;
+        let salt = unmarshall(salt)?;
 
         let veilid_api = get_veilid_api()?;
         let crypto = veilid_api.crypto()?;
@@ -196,7 +180,79 @@ impl VeilidCrypto {
         APIResult::Ok(out.to_string())
     }
 
-    pub fn generateKeyPair(kind: String) -> APIResult<KeyPair> {
+    pub fn verifySignatures(
+        node_ids: StringArray,
+        data: String,
+        signatures: StringArray,
+    ) -> VeilidAPIResult<StringArray> {
+        let node_ids = into_unchecked_string_vec(node_ids);
+        let node_ids: Vec<TypedKey> = node_ids
+            .iter()
+            .map(|k| {
+                veilid_core::TypedKey::from_str(k).map_err(|e| {
+                    VeilidAPIError::invalid_argument(
+                        "verifySignatures()",
+                        format!("error decoding nodeid in node_ids[]: {}", e),
+                        k,
+                    )
+                })
+            })
+            .collect::<APIResult<Vec<TypedKey>>>()?;
+
+        let data: Vec<u8> = unmarshall(data)?;
+
+        let typed_signatures = into_unchecked_string_vec(signatures);
+        let typed_signatures: Vec<TypedSignature> = typed_signatures
+            .iter()
+            .map(|k| {
+                TypedSignature::from_str(k).map_err(|e| {
+                    VeilidAPIError::invalid_argument(
+                        "verifySignatures()",
+                        format!("error decoding keypair in key_pairs[]: {}", e),
+                        k,
+                    )
+                })
+            })
+            .collect::<APIResult<Vec<TypedSignature>>>()?;
+
+        let veilid_api = get_veilid_api()?;
+        let crypto = veilid_api.crypto()?;
+        let out = crypto.verify_signatures(&node_ids, &data, &typed_signatures)?;
+        let out = out
+            .iter()
+            .map(|item| item.to_string())
+            .collect::<Vec<String>>();
+        let out = into_unchecked_string_array(out);
+        APIResult::Ok(out)
+    }
+
+    pub fn generateSignatures(data: String, key_pairs: StringArray) -> APIResult<StringArray> {
+        let data = unmarshall(data)?;
+
+        let key_pairs = into_unchecked_string_vec(key_pairs);
+        let key_pairs: Vec<TypedKeyPair> = key_pairs
+            .iter()
+            .map(|k| {
+                veilid_core::TypedKeyPair::from_str(k).map_err(|e| {
+                    VeilidAPIError::invalid_argument(
+                        "generateSignatures()",
+                        format!("error decoding keypair in key_pairs[]: {}", e),
+                        k,
+                    )
+                })
+            })
+            .collect::<APIResult<Vec<veilid_core::TypedKeyPair>>>()?;
+
+        let veilid_api = get_veilid_api()?;
+        let crypto = veilid_api.crypto()?;
+        let out = crypto.generate_signatures(&data, &key_pairs, |k, s| {
+            veilid_core::TypedSignature::new(k.kind, s).to_string()
+        })?;
+        let out = into_unchecked_string_array(out);
+        APIResult::Ok(out)
+    }
+
+    pub fn generateKeyPair(kind: String) -> APIResult<String> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
 
         let veilid_api = get_veilid_api()?;
@@ -209,15 +265,14 @@ impl VeilidCrypto {
             )
         })?;
         let out = crypto_system.generate_keypair();
+        let out = out.encode();
         APIResult::Ok(out)
     }
 
     pub fn generateHash(kind: String, data: String) -> APIResult<String> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
 
-        let data: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(data.as_bytes())
-            .unwrap();
+        let data = unmarshall(data)?;
 
         let veilid_api = get_veilid_api()?;
         let crypto = veilid_api.crypto()?;
@@ -254,9 +309,7 @@ impl VeilidCrypto {
     pub fn validateHash(kind: String, data: String, hash: String) -> APIResult<bool> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
 
-        let data: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(data.as_bytes())
-            .unwrap();
+        let data = unmarshall(data)?;
 
         let hash: veilid_core::HashDigest = veilid_core::HashDigest::from_str(&hash)?;
 
@@ -298,9 +351,7 @@ impl VeilidCrypto {
         let key: veilid_core::PublicKey = veilid_core::PublicKey::from_str(&key)?;
         let secret: veilid_core::SecretKey = veilid_core::SecretKey::from_str(&secret)?;
 
-        let data: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(data.as_bytes())
-            .unwrap();
+        let data = unmarshall(data)?;
 
         let veilid_api = get_veilid_api()?;
         let crypto = veilid_api.crypto()?;
@@ -315,9 +366,7 @@ impl VeilidCrypto {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
 
         let key: veilid_core::PublicKey = veilid_core::PublicKey::from_str(&key)?;
-        let data: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(data.as_bytes())
-            .unwrap();
+        let data = unmarshall(data)?;
         let signature: veilid_core::Signature = veilid_core::Signature::from_str(&signature)?;
 
         let veilid_api = get_veilid_api()?;
@@ -354,20 +403,16 @@ impl VeilidCrypto {
     ) -> APIResult<String> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
 
-        let body: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(body.as_bytes())
-            .unwrap();
+        let body = unmarshall(body)?;
 
         let nonce: veilid_core::Nonce = veilid_core::Nonce::from_str(&nonce)?;
 
         let shared_secret: veilid_core::SharedSecret =
             veilid_core::SharedSecret::from_str(&shared_secret)?;
 
-        let associated_data: Option<Vec<u8>> = associated_data.map(|ad| {
-            data_encoding::BASE64URL_NOPAD
-                .decode(ad.as_bytes())
-                .unwrap()
-        });
+        let associated_data = associated_data
+            .map(|ad| unmarshall(ad))
+            .map_or(APIResult::Ok(None), |r| r.map(Some))?;
 
         let veilid_api = get_veilid_api()?;
         let crypto = veilid_api.crypto()?;
@@ -400,20 +445,16 @@ impl VeilidCrypto {
     ) -> APIResult<String> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
 
-        let body: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(body.as_bytes())
-            .unwrap();
+        let body = unmarshall(body)?;
 
-        let nonce: veilid_core::Nonce = veilid_core::Nonce::from_str(&nonce).unwrap();
+        let nonce: veilid_core::Nonce = veilid_core::Nonce::from_str(&nonce)?;
 
         let shared_secret: veilid_core::SharedSecret =
-            veilid_core::SharedSecret::from_str(&shared_secret).unwrap();
+            veilid_core::SharedSecret::from_str(&shared_secret)?;
 
-        let associated_data: Option<Vec<u8>> = associated_data.map(|ad| {
-            data_encoding::BASE64URL_NOPAD
-                .decode(ad.as_bytes())
-                .unwrap()
-        });
+        let associated_data: Option<Vec<u8>> = associated_data
+            .map(|ad| unmarshall(ad))
+            .map_or(APIResult::Ok(None), |r| r.map(Some))?;
 
         let veilid_api = get_veilid_api()?;
         let crypto = veilid_api.crypto()?;
@@ -445,14 +486,12 @@ impl VeilidCrypto {
     ) -> APIResult<String> {
         let kind: veilid_core::CryptoKind = veilid_core::FourCC::from_str(&kind)?;
 
-        let mut body: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(body.as_bytes())
-            .unwrap();
+        let mut body = unmarshall(body)?;
 
-        let nonce: veilid_core::Nonce = veilid_core::Nonce::from_str(&nonce).unwrap();
+        let nonce: veilid_core::Nonce = veilid_core::Nonce::from_str(&nonce)?;
 
         let shared_secret: veilid_core::SharedSecret =
-            veilid_core::SharedSecret::from_str(&shared_secret).unwrap();
+            veilid_core::SharedSecret::from_str(&shared_secret)?;
 
         let veilid_api = get_veilid_api()?;
         let crypto = veilid_api.crypto()?;
diff --git a/veilid-wasm/src/veilid_routing_context_js.rs b/veilid-wasm/src/veilid_routing_context_js.rs
index 50db6fe7..9707c0be 100644
--- a/veilid-wasm/src/veilid_routing_context_js.rs
+++ b/veilid-wasm/src/veilid_routing_context_js.rs
@@ -3,70 +3,23 @@ use super::*;
 
 #[wasm_bindgen()]
 pub struct VeilidRoutingContext {
-    inner_routing_context: Option<RoutingContext>,
+    inner_routing_context: RoutingContext,
 }
 
 #[wasm_bindgen()]
 impl VeilidRoutingContext {
-    /// Don't use this constructor directly.
-    /// Use one of the `VeilidRoutingContext.create___()` factory methods instead.
-    /// @deprecated
+    /// Create a new VeilidRoutingContext, without any privacy or sequencing settings.
     #[wasm_bindgen(constructor)]
-    pub fn new() -> Self {
-        Self {
-            inner_routing_context: None,
-        }
-    }
-
-    // --------------------------------
-    // Constructor factories
-    // --------------------------------
-
-    /// Get a new RoutingContext object to use to send messages over the Veilid network.
-    pub fn createWithoutPrivacy() -> APIResult<VeilidRoutingContext> {
+    pub fn new() -> APIResult<VeilidRoutingContext> {
         let veilid_api = get_veilid_api()?;
-        let routing_context = veilid_api.routing_context();
-        Ok(VeilidRoutingContext {
-            inner_routing_context: Some(routing_context),
+        APIResult::Ok(VeilidRoutingContext {
+            inner_routing_context: veilid_api.routing_context(),
         })
     }
 
-    /// Turn on sender privacy, enabling the use of safety routes.
-    ///
-    /// Default values for hop count, stability and sequencing preferences are used.
-    ///
-    /// Hop count default is dependent on config, but is set to 1 extra hop.
-    /// Stability default is to choose 'low latency' routes, preferring them over long-term reliability.
-    /// Sequencing default is to have no preference for ordered vs unordered message delivery
-    /// To modify these defaults, use `VeilidRoutingContext.createWithCustomPrivacy()`.
-    pub fn createWithPrivacy() -> APIResult<VeilidRoutingContext> {
-        let veilid_api = get_veilid_api()?;
-        let routing_context = veilid_api.routing_context().with_privacy()?;
-        Ok(VeilidRoutingContext {
-            inner_routing_context: Some(routing_context),
-        })
-    }
-
-    /// Turn on privacy using a custom `SafetySelection`
-    pub fn createWithCustomPrivacy(
-        safety_selection: SafetySelection,
-    ) -> APIResult<VeilidRoutingContext> {
-        let veilid_api = get_veilid_api()?;
-        let routing_context = veilid_api
-            .routing_context()
-            .with_custom_privacy(safety_selection)?;
-        Ok(VeilidRoutingContext {
-            inner_routing_context: Some(routing_context),
-        })
-    }
-
-    /// Use a specified `Sequencing` preference, with or without privacy.
-    pub fn createWithSequencing(sequencing: Sequencing) -> APIResult<VeilidRoutingContext> {
-        let veilid_api = get_veilid_api()?;
-        let routing_context = veilid_api.routing_context().with_sequencing(sequencing);
-        Ok(VeilidRoutingContext {
-            inner_routing_context: Some(routing_context),
-        })
+    /// Same as `new VeilidRoutingContext()` except easier to chain.
+    pub fn create() -> APIResult<VeilidRoutingContext> {
+        VeilidRoutingContext::new()
     }
 
     // --------------------------------
@@ -87,6 +40,16 @@ impl VeilidRoutingContext {
         APIResult::Ok(route_blob)
     }
 
+    /// Import a private route blob as a remote private route.
+    ///
+    /// Returns a route id that can be used to send private messages to the node creating this route.
+    pub fn importRemotePrivateRoute(&self, blob: String) -> APIResult<RouteId> {
+        let blob = unmarshall(blob)?;
+        let veilid_api = get_veilid_api()?;
+        let route_id = veilid_api.import_remote_private_route(blob)?;
+        APIResult::Ok(route_id)
+    }
+
     /// Allocate a new private route and specify a specific cryptosystem, stability and sequencing preference.
     /// Returns a route id and a publishable 'blob' with the route encrypted with each crypto kind.
     /// Those nodes importing the blob will have their choice of which crypto kind to use.
@@ -110,7 +73,7 @@ impl VeilidRoutingContext {
     ///
     /// This will deactivate the route and free its resources and it can no longer be sent to or received from.
     pub fn releasePrivateRoute(route_id: String) -> APIResult<()> {
-        let route_id: veilid_core::RouteId = veilid_core::deserialize_json(&route_id).unwrap();
+        let route_id: veilid_core::RouteId = RouteId::from_str(&route_id)?;
         let veilid_api = get_veilid_api()?;
         veilid_api.release_private_route(route_id)?;
         APIRESULT_UNDEFINED
@@ -121,7 +84,7 @@ impl VeilidRoutingContext {
     /// * `call_id` - specifies which call to reply to, and it comes from a VeilidUpdate::AppCall, specifically the VeilidAppCall::id() value.
     /// * `message` - is an answer blob to be returned by the remote node's RoutingContext::app_call() function, and may be up to 32768 bytes
     pub async fn appCallReply(call_id: String, message: String) -> APIResult<()> {
-        let message = unmarshall(message);
+        let message = unmarshall(message)?;
         let call_id = match call_id.parse() {
             Ok(v) => v,
             Err(e) => {
@@ -139,10 +102,43 @@ impl VeilidRoutingContext {
     // Instance methods
     // --------------------------------
     fn getRoutingContext(&self) -> APIResult<RoutingContext> {
-        let Some(routing_context) = &self.inner_routing_context else {
-            return APIResult::Err(veilid_core::VeilidAPIError::generic("Unable to getRoutingContext instance. inner_routing_context is None."));
-        };
-        APIResult::Ok(routing_context.clone())
+        APIResult::Ok(self.inner_routing_context.clone())
+    }
+
+    /// Turn on sender privacy, enabling the use of safety routes.
+    /// Returns a new instance of VeilidRoutingContext - does not mutate.
+    ///
+    /// Default values for hop count, stability and sequencing preferences are used.
+    ///
+    /// Hop count default is dependent on config, but is set to 1 extra hop.
+    /// Stability default is to choose 'low latency' routes, preferring them over long-term reliability.
+    /// Sequencing default is to have no preference for ordered vs unordered message delivery
+    pub fn withPrivacy(&self) -> APIResult<VeilidRoutingContext> {
+        let routing_context = self.getRoutingContext()?;
+        APIResult::Ok(VeilidRoutingContext {
+            inner_routing_context: routing_context.with_privacy()?,
+        })
+    }
+
+    /// Turn on privacy using a custom `SafetySelection`.
+    /// Returns a new instance of VeilidRoutingContext - does not mutate.
+    pub fn withCustomPrivacy(
+        &self,
+        safety_selection: SafetySelection,
+    ) -> APIResult<VeilidRoutingContext> {
+        let routing_context = self.getRoutingContext()?;
+        APIResult::Ok(VeilidRoutingContext {
+            inner_routing_context: routing_context.with_custom_privacy(safety_selection)?,
+        })
+    }
+
+    /// Use a specified `Sequencing` preference.
+    /// Returns a new instance of VeilidRoutingContext - does not mutate.
+    pub fn withSequencing(&self, sequencing: Sequencing) -> APIResult<VeilidRoutingContext> {
+        let routing_context = self.getRoutingContext()?;
+        APIResult::Ok(VeilidRoutingContext {
+            inner_routing_context: routing_context.with_sequencing(sequencing),
+        })
     }
 
     /// App-level unidirectional message that does not expect any value to be returned.
@@ -154,7 +150,7 @@ impl VeilidRoutingContext {
     #[wasm_bindgen(skip_jsdoc)]
     pub async fn appMessage(&self, target_string: String, message: String) -> APIResult<()> {
         let routing_context = self.getRoutingContext()?;
-        let message = unmarshall(message);
+        let message = unmarshall(message)?;
 
         let veilid_api = get_veilid_api()?;
         let target = veilid_api.parse_as_target(target_string).await?;
@@ -171,7 +167,7 @@ impl VeilidRoutingContext {
     /// @returns an answer blob of up to `32768` bytes, base64Url encoded.
     #[wasm_bindgen(skip_jsdoc)]
     pub async fn appCall(&self, target_string: String, request: String) -> APIResult<String> {
-        let request: Vec<u8> = unmarshall(request);
+        let request: Vec<u8> = unmarshall(request)?;
         let routing_context = self.getRoutingContext()?;
 
         let veilid_api = get_veilid_api()?;
@@ -217,11 +213,10 @@ impl VeilidRoutingContext {
         key: String,
         writer: Option<String>,
     ) -> APIResult<DHTRecordDescriptor> {
-        let key = TypedKey::from_str(&key).unwrap();
-        let writer = match writer {
-            Some(writer) => Some(KeyPair::from_str(&writer).unwrap()),
-            _ => None,
-        };
+        let key = TypedKey::from_str(&key)?;
+        let writer = writer
+            .map(|writer| KeyPair::from_str(&writer))
+            .map_or(APIResult::Ok(None), |r| r.map(Some))?;
 
         let routing_context = self.getRoutingContext()?;
         let dht_record_descriptor = routing_context.open_dht_record(key, writer).await?;
@@ -232,7 +227,7 @@ impl VeilidRoutingContext {
     ///
     /// Closing a record allows you to re-open it with a different routing context
     pub async fn closeDhtRecord(&self, key: String) -> APIResult<()> {
-        let key = TypedKey::from_str(&key).unwrap();
+        let key = TypedKey::from_str(&key)?;
         let routing_context = self.getRoutingContext()?;
         routing_context.close_dht_record(key).await?;
         APIRESULT_UNDEFINED
@@ -244,7 +239,7 @@ impl VeilidRoutingContext {
     /// Deleting a record does not delete it from the network, but will remove the storage of the record locally,
     /// and will prevent its value from being refreshed on the network by this node.
     pub async fn deleteDhtRecord(&self, key: String) -> APIResult<()> {
-        let key = TypedKey::from_str(&key).unwrap();
+        let key = TypedKey::from_str(&key)?;
         let routing_context = self.getRoutingContext()?;
         routing_context.delete_dht_record(key).await?;
         APIRESULT_UNDEFINED
@@ -262,7 +257,7 @@ impl VeilidRoutingContext {
         subKey: u32,
         forceRefresh: bool,
     ) -> APIResult<Option<ValueData>> {
-        let key = TypedKey::from_str(&key).unwrap();
+        let key = TypedKey::from_str(&key)?;
         let routing_context = self.getRoutingContext()?;
         let res = routing_context
             .get_dht_value(key, subKey, forceRefresh)
@@ -280,10 +275,8 @@ impl VeilidRoutingContext {
         subKey: u32,
         data: String,
     ) -> APIResult<Option<ValueData>> {
-        let key = TypedKey::from_str(&key).unwrap();
-        let data: Vec<u8> = data_encoding::BASE64URL_NOPAD
-            .decode(&data.as_bytes())
-            .unwrap();
+        let key = TypedKey::from_str(&key)?;
+        let data = unmarshall(data)?;
 
         let routing_context = self.getRoutingContext()?;
         let res = routing_context.set_dht_value(key, subKey, data).await?;
diff --git a/veilid-wasm/src/veilid_table_db_js.rs b/veilid-wasm/src/veilid_table_db_js.rs
index 2a8c235a..f1fb86c3 100644
--- a/veilid-wasm/src/veilid_table_db_js.rs
+++ b/veilid-wasm/src/veilid_table_db_js.rs
@@ -63,11 +63,11 @@ impl VeilidTableDB {
     /// Read a key from a column in the TableDB immediately.
     pub async fn load(&mut self, columnId: u32, key: String) -> APIResult<Option<String>> {
         self.ensureOpen().await;
-        let key = unmarshall(key);
+        let key = unmarshall(key)?;
         let table_db = self.getTableDB()?;
 
-        let out = table_db.load(columnId, &key).await?.unwrap();
-        let out = Some(marshall(&out));
+        let out = table_db.load(columnId, &key).await?;
+        let out = out.map(|out| marshall(&out));
         APIResult::Ok(out)
     }
 
@@ -75,8 +75,8 @@ impl VeilidTableDB {
     /// Performs a single transaction immediately.
     pub async fn store(&mut self, columnId: u32, key: String, value: String) -> APIResult<()> {
         self.ensureOpen().await;
-        let key = unmarshall(key);
-        let value = unmarshall(value);
+        let key = unmarshall(key)?;
+        let value = unmarshall(value)?;
         let table_db = self.getTableDB()?;
 
         table_db.store(columnId, &key, &value).await?;
@@ -86,11 +86,11 @@ impl VeilidTableDB {
     /// Delete key with from a column in the TableDB.
     pub async fn delete(&mut self, columnId: u32, key: String) -> APIResult<Option<String>> {
         self.ensureOpen().await;
-        let key = unmarshall(key);
+        let key = unmarshall(key)?;
         let table_db = self.getTableDB()?;
 
-        let out = table_db.delete(columnId, &key).await?.unwrap();
-        let out = Some(marshall(&out));
+        let out = table_db.delete(columnId, &key).await?;
+        let out = out.map(|out| marshall(&out));
         APIResult::Ok(out)
     }
 
@@ -161,15 +161,15 @@ impl VeilidTableDBTransaction {
     /// Store a key with a value in a column in the TableDB.
     /// Does not modify TableDB until `.commit()` is called.
     pub fn store(&self, col: u32, key: String, value: String) -> APIResult<()> {
-        let key = unmarshall(key);
-        let value = unmarshall(value);
+        let key = unmarshall(key)?;
+        let value = unmarshall(value)?;
         let transaction = self.getTransaction()?;
         transaction.store(col, &key, &value)
     }
 
     /// Delete key with from a column in the TableDB
     pub fn deleteKey(&self, col: u32, key: String) -> APIResult<()> {
-        let key = unmarshall(key);
+        let key = unmarshall(key)?;
         let transaction = self.getTransaction()?;
         transaction.delete(col, &key)
     }
diff --git a/veilid-wasm/src/wasm_helpers.rs b/veilid-wasm/src/wasm_helpers.rs
index f8e93468..84a52069 100644
--- a/veilid-wasm/src/wasm_helpers.rs
+++ b/veilid-wasm/src/wasm_helpers.rs
@@ -36,3 +36,13 @@ pub(crate) fn into_unchecked_string_array(items: Vec<String>) -> StringArray {
         .collect::<js_sys::Array>()
         .unchecked_into::<StringArray>() // TODO: can I do this a better way?
 }
+
+/// Convert a StringArray (`js_sys::Array` with the type of `string[]`) into `Vec<String>`
+pub(crate) fn into_unchecked_string_vec(items: StringArray) -> Vec<String> {
+    items
+        .unchecked_into::<js_sys::Array>()
+        .to_vec()
+        .into_iter()
+        .map(|i| serde_wasm_bindgen::from_value(i).unwrap())
+        .collect::<Vec<String>>()
+}