@fungi.computer/truffle 0.0.0-stage → 0.2.0

package/dist/local-skill-source.js

@@ -0,0 +1,433 @@
+import { open, opendir, realpath, stat } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+const maximumSkillCount = 64;
+const maximumCatalogBytes = 16_000;
+const maximumFileBytes = 128 * 1_024;
+const maximumDirectoryEntries = 512;
+const maximumSupportingDepth = 16;
+const maximumDiscoveryDepth = 16;
+const utf8 = new TextEncoder();
+const nameSchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u);
+const frontmatterSchema = z.object({
+    name: z.string().optional(),
+    description: z.string().optional(),
+    "disable-model-invocation": z
+        .unknown()
+        .default(false)
+        .transform((value) => value === true),
+});
+const fileSchema = z
+    .string()
+    .min(1)
+    .max(4_096)
+    .refine((file) => !isAbsolute(file) &&
+    !file.includes("\\") &&
+    !file.includes("\0") &&
+    file
+        .split("/")
+        .every((part) => part !== "" && part !== "." && part !== ".."), "Skill file must remain a relative path inside its skill directory");
+function absent(cause) {
+    return cause instanceof Error && "code" in cause && cause.code === "ENOENT";
+}
+function contained(root, path) {
+    const within = relative(root, path);
+    if (isAbsolute(within) ||
+        within === ".." ||
+        within.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`))
+        throw new Error("Skill path escapes its directory");
+    return path;
+}
+function inside(root, path) {
+    const within = relative(root, path);
+    return within === "" ||
+        isAbsolute(within) ||
+        within === ".." ||
+        within.startsWith(`..${sep}`)
+        ? undefined
+        : within;
+}
+/** The model's view of a skill file: invocation-relative, `~/…`, else absolute. */
+function displayLocation(location, roots) {
+    const project = inside(roots.cwd, location);
+    if (project !== undefined)
+        return project;
+    const personal = inside(roots.home, location);
+    return personal === undefined ? location : join("~", personal);
+}
+async function readBounded(path, signal) {
+    signal.throwIfAborted();
+    const handle = await open(path, "r");
+    try {
+        if (!(await handle.stat()).isFile())
+            throw new Error("Skill path is not a regular file");
+        const bytes = Buffer.alloc(maximumFileBytes + 1);
+        let size = 0;
+        while (size < bytes.length) {
+            signal.throwIfAborted();
+            const page = await handle.read(bytes, size, bytes.length - size, size);
+            if (page.bytesRead === 0)
+                break;
+            size += page.bytesRead;
+        }
+        if (size > maximumFileBytes)
+            throw new Error("Skill file exceeds the 128 KiB bound");
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, size));
+    }
+    finally {
+        await handle.close();
+    }
+}
+class SkillSourceError extends Error {
+}
+function diagnostic(path, reason, message, cause = new Error(message)) {
+    return { path, reason, message, cause };
+}
+function explanation(cause, fallback) {
+    return cause instanceof SkillSourceError ? cause.message : fallback;
+}
+function parseSkill(content, directory) {
+    const normalized = content.replace(/\r\n?/gu, "\n");
+    const match = /^---\n([\s\S]*?)\n---(?:\n|$)/u.exec(normalized);
+    if (!match)
+        throw new SkillSourceError("SKILL.md requires YAML frontmatter");
+    let frontmatter;
+    try {
+        frontmatter = parseYaml(match[1] ?? "");
+    }
+    catch (cause) {
+        throw new SkillSourceError("Skill frontmatter is not valid YAML", {
+            cause,
+        });
+    }
+    const result = frontmatterSchema.safeParse(frontmatter);
+    if (!result.success)
+        throw new SkillSourceError("Skill frontmatter has invalid field types", {
+            cause: result.error,
+        });
+    const metadata = result.data;
+    if (metadata.description === undefined || metadata.description.trim() === "")
+        throw new SkillSourceError("description is required");
+    const name = metadata.name === ""
+        ? basename(directory)
+        : (metadata.name ?? basename(directory));
+    return {
+        metadata: { ...metadata, name, description: metadata.description },
+        body: normalized.slice(match[0].length),
+    };
+}
+async function discoveryRoots(cwd) {
+    const project = [join(cwd, ".fungi/skills")];
+    let ancestor = cwd;
+    for (;;) {
+        project.push(join(ancestor, ".agents/skills"));
+        try {
+            await stat(join(ancestor, ".git"));
+            break;
+        }
+        catch (cause) {
+            if (!absent(cause))
+                throw cause;
+        }
+        const parent = dirname(ancestor);
+        if (parent === ancestor)
+            break;
+        ancestor = parent;
+    }
+    return project;
+}
+async function configuredRoots(path, base, home, signal, diagnostics) {
+    const settingsSchema = z.object({
+        skills: z.array(z.string().trim().min(1)).max(64).default([]),
+    });
+    try {
+        const settings = settingsSchema.parse(JSON.parse(await readBounded(path, signal)));
+        return settings.skills.map((folder) => folder === "~"
+            ? home
+            : folder.startsWith("~/")
+                ? resolve(home, folder.slice(2))
+                : resolve(base, folder));
+    }
+    catch (cause) {
+        signal.throwIfAborted();
+        if (!absent(cause))
+            diagnostics.push(diagnostic(path, "invalid", "Local settings must be valid JSON with a skills list of extra folders", cause));
+        return [];
+    }
+}
+function describeOrigin(origin) {
+    return origin.kind === "extension"
+        ? `extension ${origin.extensionId}`
+        : origin.kind;
+}
+/** Walk labeled roots in order; the first skill with a name wins. */
+async function scanRoots(roots, displayRoots, signal, diagnostics) {
+    const skills = [];
+    const owners = new Map();
+    const paths = new Set();
+    const visitedRoots = new Set();
+    for (const { path, origin, named } of roots) {
+        signal.throwIfAborted();
+        let root;
+        try {
+            root = await realpath(path);
+        }
+        catch (cause) {
+            signal.throwIfAborted();
+            if (!absent(cause) || named)
+                diagnostics.push({
+                    path,
+                    reason: "unavailable",
+                    message: "Skill root is unavailable",
+                    cause,
+                });
+            continue;
+        }
+        if (visitedRoots.has(root))
+            continue;
+        visitedRoots.add(root);
+        const visited = new Set();
+        let entries = 0;
+        let found = 0;
+        const before = diagnostics.length;
+        const walk = async (directory, depth) => {
+            signal.throwIfAborted();
+            if (depth > maximumDiscoveryDepth) {
+                diagnostics.push(diagnostic(directory, "bound", "Skill discovery exceeds its 16-level depth bound"));
+                return;
+            }
+            if (visited.has(directory))
+                return;
+            visited.add(directory);
+            const skillPath = join(directory, "SKILL.md");
+            let location;
+            try {
+                location = contained(directory, await realpath(skillPath));
+            }
+            catch (cause) {
+                signal.throwIfAborted();
+                if (!absent(cause)) {
+                    diagnostics.push({
+                        path: skillPath,
+                        reason: "invalid",
+                        message: "Skill file escapes its directory or cannot be read",
+                        cause,
+                    });
+                    return;
+                }
+            }
+            if (location !== undefined) {
+                found++;
+                try {
+                    if (paths.has(location))
+                        return;
+                    paths.add(location);
+                    const { metadata } = parseSkill(await readBounded(location, signal), directory);
+                    if (!nameSchema.safeParse(metadata.name).success ||
+                        metadata.name !== basename(directory))
+                        diagnostics.push(diagnostic(skillPath, "warning", "Skill name should match its directory, use lowercase letters, digits and single hyphens, and be at most 64 characters"));
+                    if (metadata.description.length > 1_024)
+                        diagnostics.push(diagnostic(skillPath, "warning", "Skill description exceeds the recommended 1024 characters"));
+                    const winner = owners.get(metadata.name);
+                    if (winner !== undefined) {
+                        diagnostics.push(diagnostic(skillPath, "collision", `${describeOrigin(winner)} skill ${metadata.name} wins over ${describeOrigin(origin)}`));
+                        return;
+                    }
+                    owners.set(metadata.name, origin);
+                    if (metadata["disable-model-invocation"]) {
+                        diagnostics.push(diagnostic(skillPath, "skipped", "Skill disables model invocation"));
+                        return;
+                    }
+                    const skill = {
+                        name: metadata.name,
+                        description: metadata.description,
+                        location,
+                        displayLocation: displayLocation(location, displayRoots),
+                        origin,
+                    };
+                    if (skills.length >= maximumSkillCount ||
+                        utf8.encode(JSON.stringify([...skills, skill])).byteLength >
+                            maximumCatalogBytes) {
+                        diagnostics.push(diagnostic(skillPath, "bound", "Skill catalog exceeds its 64-skill or 16 KB bound"));
+                        return;
+                    }
+                    skills.push(skill);
+                }
+                catch (cause) {
+                    signal.throwIfAborted();
+                    diagnostics.push({
+                        path: skillPath,
+                        reason: "invalid",
+                        message: explanation(cause, "Skill metadata or file is invalid"),
+                        cause,
+                    });
+                }
+                return;
+            }
+            const children = [];
+            for await (const entry of await opendir(directory)) {
+                signal.throwIfAborted();
+                if (++entries > maximumDirectoryEntries)
+                    throw new SkillSourceError("Skill discovery exceeds its 512-entry bound");
+                if (entry.name.startsWith(".") || entry.name === "node_modules") {
+                    if (entry.isDirectory() || entry.isSymbolicLink())
+                        diagnostics.push(diagnostic(join(directory, entry.name), "skipped", "Dot directories and node_modules are not searched"));
+                    continue;
+                }
+                children.push(entry.name);
+            }
+            for (const child of children.sort()) {
+                const candidate = join(directory, child);
+                try {
+                    const canonical = contained(root, await realpath(candidate));
+                    if ((await stat(canonical)).isDirectory())
+                        await walk(canonical, depth + 1);
+                }
+                catch (cause) {
+                    signal.throwIfAborted();
+                    if (cause instanceof SkillSourceError)
+                        throw cause;
+                    diagnostics.push(diagnostic(join(candidate, "SKILL.md"), "invalid", "Skill entry escapes its root or is unavailable", cause));
+                }
+            }
+        };
+        try {
+            await walk(root, 0);
+            if (found === 0 && diagnostics.length === before)
+                diagnostics.push(diagnostic(path, "empty", entries === 0
+                    ? "Skill root is empty"
+                    : "Skill root contains no SKILL.md files"));
+        }
+        catch (cause) {
+            signal.throwIfAborted();
+            diagnostics.push({
+                path,
+                reason: cause instanceof SkillSourceError ? "bound" : "unavailable",
+                message: explanation(cause, "Skill root cannot be searched"),
+                cause,
+            });
+        }
+    }
+    return { skills, diagnostics };
+}
+/** What an extension's skills folder offers, for the install prompt. */
+export function describeExtensionSkills(folder, signal) {
+    // The install prompt lists names only, so display paths are never shown.
+    return scanRoots([
+        {
+            path: folder.directory,
+            origin: { kind: "extension", extensionId: folder.extensionId },
+            named: true,
+        },
+    ], { cwd: folder.directory, home: folder.directory }, signal, []);
+}
+/**
+ * Discover skills without widening the invocation Files jail. Folders are
+ * searched project first, then personal, then installed extensions' (lowest);
+ * the first skill with a name wins, so your own skill beats an extension's.
+ * `extensions` is already filtered by the extension owner's activation: a
+ * folder that is not passed here contributes nothing. Local installed
+ * extensions only; Hub-hosted extensions are not covered.
+ */
+export function createLocalSkillSource(options) {
+    const cwd = resolve(options.cwd);
+    const home = resolve(options.home);
+    // Skill files are canonical paths, so compare them with canonical roots.
+    // A root that does not exist has no symlinks to resolve; any other failure
+    // (permissions, loops) propagates to the caller.
+    const canonical = async (path) => {
+        try {
+            return await realpath(path);
+        }
+        catch (cause) {
+            if (absent(cause))
+                return path;
+            throw cause;
+        }
+    };
+    const catalog = async (signal) => {
+        const displayRoots = {
+            cwd: await canonical(cwd),
+            home: await canonical(home),
+        };
+        const diagnostics = [];
+        const projectExtras = await configuredRoots(join(cwd, ".fungi/settings.json"), cwd, home, signal, diagnostics);
+        const personalExtras = await configuredRoots(join(home, ".fungi/settings.json"), join(home, ".fungi"), home, signal, diagnostics);
+        const project = { kind: "project" };
+        const personal = { kind: "personal" };
+        const roots = [
+            ...(await discoveryRoots(cwd)).map((path) => ({
+                path,
+                origin: project,
+                named: false,
+            })),
+            ...projectExtras.map((path) => ({ path, origin: project, named: true })),
+            ...[join(home, ".fungi/skills"), join(home, ".agents/skills")].map((path) => ({ path, origin: personal, named: false })),
+            ...personalExtras.map((path) => ({
+                path,
+                origin: personal,
+                named: true,
+            })),
+            ...(options.extensions ?? []).map(({ extensionId, directory }) => ({
+                path: directory,
+                origin: { kind: "extension", extensionId },
+                named: true,
+            })),
+        ];
+        return scanRoots(roots, displayRoots, signal, diagnostics);
+    };
+    return {
+        catalog,
+        read: async (name, file, signal) => {
+            z.string().min(1).parse(name);
+            const found = (await catalog(signal)).skills.find((skill) => skill.name === name);
+            if (!found)
+                throw new Error(`Unknown or hidden skill: ${name}`);
+            const baseDirectory = dirname(found.location);
+            const selected = file === undefined ? "SKILL.md" : fileSchema.parse(file);
+            const path = contained(baseDirectory, await realpath(join(baseDirectory, selected)));
+            const content = await readBounded(path, signal);
+            if (selected !== "SKILL.md")
+                return {
+                    name,
+                    file: selected,
+                    content,
+                    baseDirectory,
+                    supportingFiles: [],
+                };
+            const parsed = parseSkill(content, baseDirectory);
+            if (parsed.metadata["disable-model-invocation"])
+                throw new Error(`Hidden skill: ${name}`);
+            const supportingFiles = [];
+            let entries = 0;
+            const walk = async (directory, depth) => {
+                if (depth > maximumSupportingDepth)
+                    throw new Error("Skill supporting files exceed depth bound");
+                for await (const entry of await opendir(directory)) {
+                    signal.throwIfAborted();
+                    if (++entries > maximumDirectoryEntries)
+                        throw new Error("Skill supporting files exceed entry bound");
+                    const path = contained(baseDirectory, await realpath(join(directory, entry.name)));
+                    // Directory symlinks are not traversed; direct reads still enforce realpath containment.
+                    if (entry.isDirectory())
+                        await walk(path, depth + 1);
+                    else if ((await stat(path)).isFile() && path !== found.location)
+                        supportingFiles.push(relative(baseDirectory, path));
+                }
+            };
+            await walk(baseDirectory, 0);
+            return {
+                name,
+                file: selected,
+                content: parsed.body,
+                baseDirectory,
+                supportingFiles: supportingFiles.sort(),
+            };
+        },
+    };
+}

package/dist/log-event.d.ts

@@ -0,0 +1,9 @@
+export type LocalFailureMetadata = Readonly<{
+    source: "local-runtime";
+    operation: string;
+    failureKind: "Error" | "NonErrorThrown";
+}>;
+/** The only persistable projection of a caught Local failure. */
+export declare function localFailureMetadata(operation: string, cause: unknown): LocalFailureMetadata;
+/** Retain the original Local failure without printing exception or input text. */
+export declare function logEvent(operation: string, cause: unknown): void;

package/dist/log-event.js

@@ -0,0 +1,13 @@
+import * as Redacted from "effect/Redacted";
+/** The only persistable projection of a caught Local failure. */
+export function localFailureMetadata(operation, cause) {
+    return {
+        source: "local-runtime",
+        operation,
+        failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+    };
+}
+/** Retain the original Local failure without printing exception or input text. */
+export function logEvent(operation, cause) {
+    globalThis.console.error(JSON.stringify(localFailureMetadata(operation, cause)), Redacted.make(cause));
+}

package/dist/private-bounded-response.d.ts

@@ -0,0 +1,2 @@
+/** Local HTTP response budget, checked before text/JSON/schema decoding. */
+export declare function readBoundedResponse(response: Response, maximumBytes: number, description: string): Promise<string>;

package/dist/private-bounded-response.js

@@ -0,0 +1,41 @@
+/** Local HTTP response budget, checked before text/JSON/schema decoding. */
+export async function readBoundedResponse(response, maximumBytes, description) {
+    const declared = response.headers.get("content-length");
+    if (declared !== null) {
+        const declaredBytes = Number(declared);
+        if (!Number.isSafeInteger(declaredBytes) ||
+            declaredBytes < 0 ||
+            declaredBytes > maximumBytes)
+            throw new Error(`${description} response is too large`);
+    }
+    if (response.body === null)
+        throw new Error(`${description} returned no body`);
+    const stream = response.body.pipeThrough(new TransformStream());
+    const reader = stream.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            const bytes = next.value;
+            size += bytes.byteLength;
+            if (size > maximumBytes) {
+                await reader.cancel();
+                throw new Error(`${description} response is too large`);
+            }
+            chunks.push(bytes);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const joined = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(joined);
+}

package/dist/private-bun-shiitake-host.d.ts

@@ -0,0 +1,11 @@
+import { type RpcTarget } from "@fungi.computer/capnweb";
+import type { PrivateLocalShiitakeServer } from "./private-local-shiitake-host.js";
+import { type PrivateLocalShiitakeWorkerBatch, type PrivateLocalShiitakeWorkerInput } from "./private-local-shiitake-host.js";
+/** Retained native Bun listener, now owned beside the persistent Local service. */
+export declare function openPrivateLocalBunServer(fetch: (request: Request) => Response | Promise<Response>, listenAddress?: string, auth?: Readonly<{
+    path: string;
+    admit: (request: Request) => boolean;
+    createTarget: () => RpcTarget;
+}>): PrivateLocalShiitakeServer;
+/** Retained static worker server; persistent service callers use the manager. */
+export declare function openPrivateLocalBunShiitakeWorkerBatch(inputs: readonly PrivateLocalShiitakeWorkerInput[], listenAddress: string): Promise<PrivateLocalShiitakeWorkerBatch>;

package/dist/private-bun-shiitake-host.js

@@ -0,0 +1,66 @@
+/// <reference types="bun-types" />
+import { serve } from "bun";
+import { dispatchPrivateLocalRequest } from "./private-local-http-dispatch.js";
+import { newBunWebSocketRpcHandler, } from "@fungi.computer/capnweb";
+import { openPrivateLocalShiitakeWorkerBatch, } from "./private-local-shiitake-host.js";
+function parsePrivateLoopbackListener(value) {
+    const url = new URL(value);
+    const loopback = url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    const port = Number(url.port);
+    if (url.protocol !== "http:" ||
+        !loopback ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "" ||
+        !Number.isInteger(port) ||
+        port < 1 ||
+        port > 65_535)
+        throw new Error("Private local Shiitake listener requires loopback HTTP with an explicit port");
+    return {
+        hostname: url.hostname === "127.0.0.1" ? "127.0.0.1" : "::1",
+        port,
+    };
+}
+/** Retained native Bun listener, now owned beside the persistent Local service. */
+export function openPrivateLocalBunServer(fetch, listenAddress, auth) {
+    const listener = listenAddress === undefined
+        ? { hostname: "127.0.0.1", port: 0 }
+        : parsePrivateLoopbackListener(listenAddress);
+    // A model retry can leave SSE quiet, and command admission/cancellation can
+    // await owner cleanup. Bun's socket-idle clock must not sever either while
+    // the handler is pending. Restore its ordinary idle limit for finite replies.
+    const dispatch = async (request, server) => {
+        return dispatchPrivateLocalRequest(request, server, fetch);
+    };
+    const server = auth === undefined
+        ? serve({ ...listener, fetch: dispatch })
+        : serve({
+            ...listener,
+            websocket: newBunWebSocketRpcHandler(auth.createTarget),
+            fetch(request, server) {
+                if (new URL(request.url).pathname === auth.path) {
+                    if (!auth.admit(request))
+                        return new Response(null, { status: 403 });
+                    if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+                        return new Response(null, { status: 426 });
+                    if (server.upgrade(request, { data: undefined }))
+                        return;
+                    return new Response(null, { status: 400 });
+                }
+                return dispatch(request, server);
+            },
+        });
+    return Object.freeze({
+        baseUrl: server.url.origin,
+        close: () => server.stop(true),
+    });
+}
+/** Retained static worker server; persistent service callers use the manager. */
+export async function openPrivateLocalBunShiitakeWorkerBatch(inputs, listenAddress) {
+    // Validate the native listener before any Local owner opens its store.
+    parsePrivateLoopbackListener(listenAddress);
+    return openPrivateLocalShiitakeWorkerBatch(inputs, (fetch) => openPrivateLocalBunServer(fetch, listenAddress));
+}
+/// <reference types="bun-types" />

package/dist/private-file-credential-store.d.ts

@@ -0,0 +1,58 @@
+import { type MachineEnrollmentRecord, type LocalMachineEnrollment } from "./private-local-mesh-record.js";
+import type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
+import { z } from "zod";
+export declare const maximumCredentialStringLength: number;
+export declare const oauthCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    refresh: z.ZodString;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+}, z.core.$catchall<z.ZodJSONSchema>>;
+export type AtomicWrite = (path: string, content: string, options: Readonly<{
+    encoding: BufferEncoding;
+    fsync: boolean;
+    mode: number;
+}>) => Promise<void>;
+/** The signed-in credential that must still own an enrollment origin. */
+export type MachineEnrollmentOwner = Readonly<{
+    providerId: string;
+    /** Throws unless this credential owns the origin being edited. */
+    admit: (current: Credential | undefined) => void;
+}>;
+/** A host-private Pi credential store selected by one absolute filesystem path. */
+export type PrivateCredentialStore = CredentialStore & {
+    readMachineEnrollments(): Promise<MachineEnrollmentRecord[]>;
+    /**
+     * Edit one origin's enrollments under the file lock. An empty result removes
+     * the record. When the origin belongs to a signed-in credential, `owner`
+     * admits that credential under the same lock before anything is written.
+     */
+    modifyMachineEnrollments(origin: string, edit: (current: readonly LocalMachineEnrollment[]) => LocalMachineEnrollment[], owner?: MachineEnrollmentOwner): Promise<void>;
+    removeMachineEnrollments(origin: string): Promise<boolean>;
+    /** Stable host identity supplied to Pi's ChatGPT sign-in, never a credential. */
+    getDeviceId(): Promise<string>;
+    /** Revoke or validate current custody under the same lock, then delete it atomically. */
+    remove<T>(providerId: string, beforeRemove: (credential: Credential) => Promise<T>, options?: AuthOperationOptions): Promise<T | undefined>;
+};
+/** Resolve the host-owned default path without consulting project or Agent Home state. */
+export declare function resolveDefaultCredentialPath(home: string): string;
+/**
+ * Internal constructor permits one focused write-failure test while the public
+ * package surface remains the Pi CredentialStore factory below.
+ */
+export declare class FileCredentialStore implements PrivateCredentialStore {
+    #private;
+    constructor(path: string, writeAtomic?: AtomicWrite);
+    /** Keep the installation UUID beside credentials, across logout and restart. */
+    getDeviceId(): Promise<string>;
+    read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
+    modify(providerId: string, callback: (current: Credential | undefined) => Promise<Credential | undefined>, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    delete(providerId: string, options?: AuthOperationOptions): Promise<void>;
+    readMachineEnrollments(): Promise<MachineEnrollmentRecord[]>;
+    modifyMachineEnrollments(origin: string, edit: (current: readonly LocalMachineEnrollment[]) => LocalMachineEnrollment[], owner?: MachineEnrollmentOwner): Promise<void>;
+    removeMachineEnrollments(origin: string): Promise<boolean>;
+    remove<T>(providerId: string, beforeRemove: (credential: Credential) => Promise<T>, options?: AuthOperationOptions): Promise<T | undefined>;
+}
+/** Create the one private Pi CredentialStore selected by the local host. */
+export declare function createPrivateCredentialStore(path: string): PrivateCredentialStore;