@muhkoo/connect 0.10.10-alpha.0 → 0.10.11-alpha.0

package/dist/browser/index.js

@@ -4537,8 +4537,12 @@ class AuthClient {
      * Read a factor record for `username` (returns an indistinguishable decoy if
      * absent). Gated types (email) require the recover `verifyToken`.
      */
-    async vaultRead(username, factorType, verifyToken) {
-        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault`, this.json("POST", { username, factorType, verifyToken }));
+    async vaultRead(username, factorType, verifyToken, 
+    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
+     *  passkey instead of whichever was enrolled first (which WebAuthn would
+     *  refuse). Ignored for other factor types. */
+    rpId) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault`, this.json("POST", { username, factorType, verifyToken, rpId }));
         return await this.parse("vaultRead", res);
     }
     /**
@@ -5068,7 +5072,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.10.10-alpha.0";
+const VERSION = "0.10.11-alpha.0";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -5129,6 +5133,8 @@ class HttpClient {
     /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
     baseOrigin;
     apiKey;
+    /** Scoped machine access token — takes precedence over {@link apiKey} on `X-Muhkoo-Key`. */
+    accessToken;
     getSessionToken;
     onUnauthorized;
     fetchFn;
@@ -5143,6 +5149,7 @@ class HttpClient {
             this.baseOrigin = "";
         }
         this.apiKey = opts.apiKey ?? null;
+        this.accessToken = opts.accessToken ?? null;
         this.getSessionToken = opts.getSessionToken ?? (() => null);
         this.onUnauthorized = opts.onUnauthorized ?? null;
         const f = opts.fetch ?? globalThis.fetch;
@@ -5163,8 +5170,11 @@ class HttpClient {
         // server-reflected path that escapes `baseUrl`) must NOT receive the app
         // key or session token, or it becomes a token-exfiltration vector.
         if (this.isSameOrigin(input)) {
-            if (this.apiKey)
-                headers.set("X-Muhkoo-Key", this.apiKey);
+            // Access token and app key resolve through the same accelerator path
+            // and ride the same header; the access token takes precedence.
+            const key = this.accessToken ?? this.apiKey;
+            if (key)
+                headers.set("X-Muhkoo-Key", key);
             const token = this.getSessionToken();
             if (token)
                 headers.set("X-Muhkoo-Session", token);
@@ -5578,6 +5588,35 @@ async function passkeyPrfCapable() {
 function defaultRpId() {
     return typeof location !== "undefined" ? location.hostname : "";
 }
+/**
+ * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
+ *
+ * WebAuthn only accepts an RP id that is the origin's own host or a registrable
+ * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
+ * `app.example.net`, and one enrolled on a full host is unusable from a sibling
+ * host. An app served on BOTH a custom domain and the platform host therefore
+ * needs one passkey per origin.
+ *
+ * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
+ * a raw "The requested RPID did not match the origin or related origins", which
+ * is a dead end for the user. Checking first lets the caller fall back to normal
+ * sign-in (and offer to enroll a passkey for this origin) instead.
+ */
+function rpIdUsableForOrigin(rpId, host) {
+    const h = host ?? (typeof location !== "undefined" ? location.hostname : "");
+    if (!rpId || !h)
+        return false;
+    return h === rpId || h.endsWith(`.${rpId}`);
+}
+/** Thrown when the account's passkey belongs to a different origin. Callers
+ *  should treat this as "no passkey here" and fall back to another factor. */
+class PasskeyOriginError extends Error {
+    code = "passkey_wrong_origin";
+    constructor(message = "No passkey is enrolled for this site. Sign in another way, then add one for this device.") {
+        super(message);
+        this.name = "PasskeyOriginError";
+    }
+}
 /**
  * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
  * the PRF output for that salt. Throws if the authenticator can't do PRF.
@@ -6271,12 +6310,22 @@ class ZkAuth {
      * its PRF, unwraps the master seed → identity → session.
      */
     async loginWithPasskey(username, opts = {}) {
-        const { factor } = await this.deps.auth.vaultRead(username, "passkey");
+        // Ask for THIS origin's passkey — they're enrolled per-origin, so the
+        // account's first passkey may belong to a different host entirely.
+        const host = defaultRpId();
+        const { factor } = await this.deps.auth.vaultRead(username, "passkey", undefined, host);
         const params = factor?.params;
         if (!factor?.wrap || !factor?.iv || !params?.credentialId || !params?.prfSalt) {
             throw new Error("No passkey is set up for this account.");
         }
-        const prfOutput = await evaluatePasskeyPrf(params.rpId ?? defaultRpId(), fromBase64(params.credentialId), fromBase64(params.prfSalt));
+        const rpId = params.rpId ?? host;
+        // Refuse a foreign rpId up front: WebAuthn would throw a raw "requested
+        // RPID did not match the origin", which reads as a hard failure to the
+        // user. A typed error lets the app fall back to another factor and offer
+        // to enroll a passkey for this origin.
+        if (!rpIdUsableForOrigin(rpId, host))
+            throw new PasskeyOriginError();
+        const prfOutput = await evaluatePasskeyPrf(rpId, fromBase64(params.credentialId), fromBase64(params.prfSalt));
         const key = await wrapKeyFromBytes(prfOutput, "muhkoo-passkey-wrap");
         const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
         const identity = await deriveIdentityFromSeed(seed);
@@ -6296,6 +6345,27 @@ class ZkAuth {
         const { factors } = await this.deps.auth.vaultFactors(token);
         return factors;
     }
+    /**
+     * Is a passkey enrolled that can unlock from THIS origin?
+     *
+     * Passkeys are origin-bound, so an app served on both a custom domain and the
+     * platform host needs one per host. Use this to decide whether to offer
+     * "Unlock with passkey" or go straight to sign-in — prompting with another
+     * origin's passkey fails with a raw WebAuthn error. Requires a session
+     * (metadata read); returns false when signed out or unsupported.
+     */
+    async hasPasskeyForThisOrigin() {
+        if (!passkeySupported())
+            return false;
+        try {
+            const host = defaultRpId();
+            const factors = await this.listFactors();
+            return factors.some((f) => f.type === "passkey" && rpIdUsableForOrigin(f.rpId, host));
+        }
+        catch {
+            return false;
+        }
+    }
     /** Remove a login method by id (can't remove your only one). Session-authed. */
     async removeFactor(id) {
         const token = this.deps.session.token;
@@ -10109,6 +10179,59 @@ class FunctionsNamespace {
     }
 }
 
+/**
+ * `client.accessTokens` — manage an app's **access tokens**: scoped, expiring,
+ * non-ZK machine-to-machine credentials (`mk_<env>_at_…`).
+ *
+ *   const { plaintext } = await client.accessTokens.create(appId, {
+ *     scopes: ["db:read", "db:write"], env: "live", expiresInDays: 30,
+ *     label: "ci-runner",
+ *   });
+ *   // hand `plaintext` to the machine caller as its ClientOptions.accessToken
+ *
+ * These are MANAGEMENT calls — creating/listing/revoking tokens is authorized by
+ * the developer session (same as the `agents`/`functions` namespaces). The token
+ * itself resolves through the SAME accelerator path as an app key (the
+ * `X-Muhkoo-Key` header), but is scoped to a fixed vocabulary of permissions and
+ * expires. The plaintext is returned ONCE, on create — store it then; it can't
+ * be read back.
+ */
+/** All valid {@link Scope}s, in canonical order. */
+const ACCESS_TOKEN_SCOPES = [
+    "db:read",
+    "db:write",
+    "kv:read",
+    "kv:write",
+    "storage:read",
+    "storage:write",
+    "messages:read",
+    "messages:write",
+    "functions:invoke",
+    "ai:infer",
+];
+class AccessTokensNamespace {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** List the app's access tokens (metadata only — never the plaintext). */
+    async list(appId) {
+        const res = await this.deps.http.get(this.path(appId, ""));
+        return res.tokens ?? [];
+    }
+    /** Mint an access token (owner/editor only). The plaintext is returned once. */
+    async create(appId, input) {
+        return this.deps.http.post(this.path(appId, ""), input);
+    }
+    /** Revoke an access token by its `keyId`. */
+    async revoke(appId, keyId) {
+        return this.deps.http.del(this.path(appId, `/${encodeURIComponent(keyId)}`));
+    }
+    path(appId, suffix) {
+        return `/api/apps/${encodeURIComponent(appId)}/access-tokens${suffix}`;
+    }
+}
+
 /**
  * `ChatKeyVault` — SDK-owned lifecycle for a member's long-lived ratchet/space
  * keypair (the connect `KeyStore` entry keyed by the member id / username).
@@ -11356,6 +11479,8 @@ class Client {
     agents;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
     functions;
+    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
+    accessTokens;
     /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
     offline;
     session;
@@ -11409,6 +11534,7 @@ class Client {
         this.http = new HttpClient({
             baseUrl: this.baseUrl,
             apiKey: options.apiKey,
+            accessToken: options.accessToken,
             getSessionToken: () => this.session.token,
             fetch: reportingFetch,
             // Self-heal stale sessions: on a 401, try a silent re-auth (only
@@ -11485,6 +11611,7 @@ class Client {
         });
         this.agents = new AgentsNamespace({ http: this.http });
         this.functions = new FunctionsNamespace({ http: this.http, fnHostSuffix: options.functionsHostSuffix });
+        this.accessTokens = new AccessTokensNamespace({ http: this.http });
         // Replay deferred shard uploads on reconnect. The bytes live in the
         // Cache API keyed by hash; re-PUT them through a (defer-free) shard
         // client so a failure surfaces as transient and the entry stays queued.
@@ -11634,6 +11761,7 @@ function MuhkooDB(meta) {
             table: meta.table ?? String(propertyKey),
             access: meta.access ?? "read",
             description: meta.description,
+            backend: meta.backend ?? false,
         });
     });
 }
@@ -11673,9 +11801,12 @@ function ejectAgentPrompt(appClass) {
         for (const s of d.spaces)
             lines.push(`- ${s.name}: ${s.description}`);
     }
-    if (d.tables.length) {
+    // Backend-only tables are deliberately withheld — the agent should never be
+    // told about server-managed / internal state it can't (and shouldn't) touch.
+    const promptTables = d.tables.filter((t) => !t.backend);
+    if (promptTables.length) {
         lines.push("", "App database tables:");
-        for (const t of d.tables) {
+        for (const t of promptTables) {
             const verbs = t.access === "write"
                 ? "read & write — db_query/db_get/db_insert/db_update/db_delete"
                 : "read-only — db_query/db_get";
@@ -11693,7 +11824,7 @@ function ejectAgentPrompt(appClass) {
     // How to respond — the load-bearing behavioral contract. Without this, models
     // (especially gpt-oss) tend to run tool calls and then end their turn with no
     // user-facing message, so the user sees the work happen but gets no reply.
-    const hasTools = d.tables.length > 0 || d.functions.length > 0;
+    const hasTools = promptTables.length > 0 || d.functions.length > 0;
     lines.push("", "How to respond:");
     if (hasTools) {
         lines.push("- When you need information or need to make a change, call your tools immediately — don't ask the user to do it, and don't describe or name the tools to them.", "- After your tool calls return, you MUST send one final reply to the channel, in plain language, that answers the request using the results.");
@@ -11903,5 +12034,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
   default: loadRsWasm
 });
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, compareHlc, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, compareHlc, compilePrograms, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, passkeyPrfCapable, passkeySupported, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, rpIdUsableForOrigin, sealSeed, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
 //# sourceMappingURL=index.js.map