@fungi.computer/truffle 0.0.0-stage → 0.1.1

package/dist/private-fungi-account.d.ts

@@ -0,0 +1,235 @@
+import { type AuthProvider, type FetchLike, type OAuthClientProvider, type StoredOAuthClientInformation } from "@modelcontextprotocol/client";
+import { z } from "zod";
+import type { Credential, CredentialStore, OAuthAuth } from "@earendil-works/pi-ai";
+/**
+ * One folder attached to a Team Computer. The absolute folder path and the
+ * device's private key never leave this file; the Hub holds only the public
+ * key and the two labels.
+ */
+declare const localBackendRecordSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    teamId: z.ZodString;
+    computerId: z.ZodString;
+    computerName: z.ZodString;
+    rootPath: z.ZodString;
+    hostLabel: z.ZodString;
+    folderLabel: z.ZodString;
+    publicKey: z.ZodBase64;
+    privateKey: z.ZodBase64;
+    backendId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type LocalBackendRecord = z.output<typeof localBackendRecordSchema>;
+declare const teamChoiceSchema: z.ZodObject<{
+    teamId: z.ZodString;
+    handle: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type FungiAccountTeam = z.output<typeof teamChoiceSchema>;
+export type PrivateFungiAccountOAuthProviderOptions = {
+    interactive?: boolean;
+    credentialPath?: string;
+    issuer?: string;
+    /** The Team MCP endpoint named in re-login guidance. */
+    endpoint?: URL;
+    /** The listening loopback callback for an interactive login. */
+    redirectUrl?: string;
+    openBrowser?: (url: URL) => void;
+};
+/** Hand a Fungi sign-in page to the platform browser; callers show the URL. */
+export declare function launchPlatformBrowser(url: URL): void;
+/** Persisted OAuth state uses Local's existing owner-only Pi credential file. */
+export declare function privateFungiAccountOAuthProvider(options?: PrivateFungiAccountOAuthProviderOptions): OAuthClientProvider & {
+    saveClientInformation(information: StoredOAuthClientInformation): Promise<void>;
+    expectedState(): string | undefined;
+    authorizationUrl(): URL | undefined;
+};
+export type PrivateFungiAccountLoginOptions = {
+    credentialPath?: string;
+    /**
+     * Asked before a login for another origin replaces the saved login. Without
+     * it, a login for another origin fails with the logout command to run.
+     */
+    confirmReplace?: (savedIssuer: string, nextIssuer: string) => Promise<boolean>;
+    /** Choose a current membership when the account has several Teams. */
+    chooseTeam?: (teams: readonly FungiAccountTeam[]) => Promise<string>;
+    signal?: AbortSignal;
+    /** The maintained OAuth fetch seam. */
+    fetch?: FetchLike;
+    /** Opens the Hub pages; the default launches the platform browser. */
+    openBrowser?: (url: URL) => void;
+};
+export type PrivateFungiAccountLogoutResult = Readonly<{
+    kind: "not-logged-in" | "removed" | "revoked";
+    message: string;
+    unconfirmedComputers: readonly Readonly<{
+        name: string;
+        url: string;
+    }>[];
+}>;
+export type FungiAccountStatus = {
+    issuer: string;
+    accessExpiresAt: Date;
+    team?: FungiAccountTeam;
+    teamCount?: number;
+};
+/** Non-secret status of the shared Fungi account. */
+export declare function readFungiAccountStatus(options?: {
+    credentialPath?: string;
+}): Promise<FungiAccountStatus | undefined>;
+/**
+ * Remove the saved Fungi MCP login for the endpoint's origin and ask that
+ * issuer to revoke its refresh grant. A login for another origin is kept.
+ */
+export declare function signOutFungiAccount(rawEndpoint?: string | URL, options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+}): Promise<PrivateFungiAccountLogoutResult>;
+/**
+ * Run one Mycelium control call against the Team MCP endpoint with the saved
+ * login, and return the tool's text result. An error result or a transport
+ * failure is `undefined`: the caller retries with its persisted request id.
+ */
+export declare function callFungiMcpTeamControl(teamEndpoint: URL, code: string, options?: Readonly<{
+    credentialPath?: string;
+    fetch?: FetchLike;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}>): Promise<string | undefined>;
+/** The Team MCP endpoint and Team a control call addresses, validated. */
+export declare function fungiMcpTeamEndpoint(rawEndpoint: string | URL): {
+    endpoint: URL;
+    teamId: string;
+};
+/** The machine's attached folders, as Local keeps them. */
+export declare function readFungiMcpLocalBackends(options?: Readonly<{
+    credentialPath?: string;
+}>): Promise<Readonly<{
+    issuer: string | undefined;
+    backends: LocalBackendRecord[];
+}>>;
+/** Replace the attached folder records in the owner-only credential file. */
+export declare function writeFungiMcpLocalBackends(update: (current: readonly LocalBackendRecord[]) => LocalBackendRecord[], options?: Readonly<{
+    credentialPath?: string;
+}>): Promise<void>;
+/** Complete first-party registration and OAuth authorization in a foreground TUI. */
+export declare function signInFungiAccount(rawEndpoint: string | URL, options?: PrivateFungiAccountLoginOptions): Promise<void>;
+/** Switch only to a fresh membership; failure preserves the prior selected Team. */
+export declare function switchFungiAccountTeam(teamId: string, options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+}): Promise<void>;
+export type FungiAccountTeams = Readonly<{
+    teams: readonly FungiAccountTeam[];
+    selectedTeamId?: string;
+}>;
+/** Fresh memberships for the saved account, with the Team that pays for models. */
+export declare function readFungiAccountTeams(options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+}): Promise<FungiAccountTeams>;
+declare const teamBalanceSchema: z.ZodObject<{
+    teamId: z.ZodString;
+    balance: z.ZodObject<{
+        amount: z.ZodString;
+        currency: z.ZodObject<{
+            code: z.ZodLiteral<"USD">;
+            base: z.ZodLiteral<10>;
+            exponent: z.ZodLiteral<2>;
+        }, z.core.$strip>;
+        scale: z.ZodLiteral<5>;
+    }, z.core.$strip>;
+    included: z.ZodNullable<z.ZodObject<{
+        granted: z.ZodObject<{
+            amount: z.ZodString;
+            currency: z.ZodObject<{
+                code: z.ZodLiteral<"USD">;
+                base: z.ZodLiteral<10>;
+                exponent: z.ZodLiteral<2>;
+            }, z.core.$strip>;
+            scale: z.ZodLiteral<5>;
+        }, z.core.$strip>;
+        remaining: z.ZodObject<{
+            amount: z.ZodString;
+            currency: z.ZodObject<{
+                code: z.ZodLiteral<"USD">;
+                base: z.ZodLiteral<10>;
+                exponent: z.ZodLiteral<2>;
+            }, z.core.$strip>;
+            scale: z.ZodLiteral<5>;
+        }, z.core.$strip>;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strict>>;
+    reserved: z.ZodObject<{
+        amount: z.ZodString;
+        currency: z.ZodObject<{
+            code: z.ZodLiteral<"USD">;
+            base: z.ZodLiteral<10>;
+            exponent: z.ZodLiteral<2>;
+        }, z.core.$strip>;
+        scale: z.ZodLiteral<5>;
+    }, z.core.$strip>;
+    available: z.ZodObject<{
+        amount: z.ZodString;
+        currency: z.ZodObject<{
+            code: z.ZodLiteral<"USD">;
+            base: z.ZodLiteral<10>;
+            exponent: z.ZodLiteral<2>;
+        }, z.core.$strip>;
+        scale: z.ZodLiteral<5>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type FungiTeamCredit = z.output<typeof teamBalanceSchema>;
+/**
+ * The selected Team's credit as the Hub billing read reports it. Refusals are
+ * typed absences: 404 the person is no longer a member, 403 this sign-in
+ * lacks the billing:read grant (signed in before it existed; sign in again),
+ * 401 the Hub does not admit this sign-in for billing.
+ */
+export type FungiTeamBalance = Readonly<{
+    kind: "balance";
+    credit: FungiTeamCredit;
+}> | Readonly<{
+    kind: "not-available";
+    reason: "no-team" | "not-a-member" | "sign-in-again" | "sign-in-not-admitted";
+}>;
+export declare function readFungiTeamBalance(options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+}): Promise<FungiTeamBalance>;
+/**
+ * One cross-process credential lock serves MCP and model access, but only
+ * when the saved access token actually needs it: a plain read never takes
+ * the lock or rewrites the file, so a still-valid credential stays untouched.
+ */
+export declare function freshFungiAccess(rawHub: string | URL, options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+    signal?: AbortSignal;
+    /** Compare inside the lock: another request may already have rotated it. */
+    rejectedAccess?: string;
+}): Promise<string>;
+/** Retry an explicitly refused request once; the cloned body is replayable. */
+export declare function fungiAccountFetch(rawHub: string | URL, options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+    signal?: AbortSignal;
+}): typeof globalThis.fetch;
+/** The SDK owns exactly one retry; this hook rotates only the refused credential. */
+export declare function fungiMcpAccountAuth(endpoint: URL, options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+    signal?: AbortSignal;
+}): AuthProvider;
+/** Selected payer metadata belongs to the shared account, never a model request body. */
+export declare function fungiAccountTeam(credential: Credential): FungiAccountTeam;
+/** Pi uses its own locked modify; this owner supplies the same refresh as MCP. */
+export declare function createFungiAccountOAuth(options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+}): OAuthAuth;
+/** Pi deletion clears Local custody and reports unconfirmed remote revocation. */
+export declare function createFungiAccountCredentialStore(options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+}): CredentialStore;
+export {};