@muhkoo/connect 0.10.10-alpha.0 → 0.10.11-alpha.0

package/dist/connect.d.ts

@@ -1905,6 +1905,10 @@ interface VaultFactor {
     createdAt?: number;
     /** Display hint for gated factors ("m•••@gmail.com") — list responses only. */
     masked?: string;
+    /** Passkey's origin (RP id) — list responses only. A passkey only unlocks
+     *  from this host or a subdomain of it, so apps on several hosts enroll one
+     *  per origin. */
+    rpId?: string;
 }
 interface AuthClientOptions {
     /** Absolute URL of the accelerator worker (no trailing slash required). */
@@ -2001,7 +2005,11 @@ declare class AuthClient {
      * Read a factor record for `username` (returns an indistinguishable decoy if
      * absent). Gated types (email) require the recover `verifyToken`.
      */
-    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string): Promise<{
+    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string, 
+    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
+     *  passkey instead of whichever was enrolled first (which WebAuthn would
+     *  refuse). Ignored for other factor types. */
+    rpId?: string): Promise<{
         factor: VaultFactor | null;
     }>;
     /**
@@ -2669,7 +2677,18 @@ declare class ZkAuth {
         label?: string;
         createdAt?: number;
         masked?: string;
+        rpId?: string;
     }>>;
+    /**
+     * Is a passkey enrolled that can unlock from THIS origin?
+     *
+     * Passkeys are origin-bound, so an app served on both a custom domain and the
+     * platform host needs one per host. Use this to decide whether to offer
+     * "Unlock with passkey" or go straight to sign-in — prompting with another
+     * origin's passkey fails with a raw WebAuthn error. Requires a session
+     * (metadata read); returns false when signed out or unsupported.
+     */
+    hasPasskeyForThisOrigin(): Promise<boolean>;
     /** Remove a login method by id (can't remove your only one). Session-authed. */
     removeFactor(id: string): Promise<void>;
     /** Sign out: clears the session, identity, and persisted token. */
@@ -2767,6 +2786,14 @@ interface HttpClientOptions {
      * shared-space (messaging) websockets.
      */
     apiKey?: string;
+    /**
+     * A scoped, expiring **access token** (`mk_<env>_at_…`) — the non-ZK
+     * machine-to-machine credential. It resolves through the SAME accelerator
+     * path as an app key and rides the same `X-Muhkoo-Key` header; when present
+     * it takes precedence over {@link apiKey}. Use it for server-side / CI
+     * callers that shouldn't carry the app's publishable key.
+     */
+    accessToken?: string;
     /** Returns the current user session token, or `null` when logged out. */
     getSessionToken?: () => string | null;
     /** Custom fetch — defaults to `globalThis.fetch`. */
@@ -2795,6 +2822,8 @@ declare class HttpClient {
     /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
     private readonly baseOrigin;
     private readonly apiKey;
+    /** Scoped machine access token — takes precedence over {@link apiKey} on `X-Muhkoo-Key`. */
+    private readonly accessToken;
     private readonly getSessionToken;
     private readonly onUnauthorized;
     private readonly fetchFn;
@@ -4804,6 +4833,78 @@ declare class FunctionsNamespace {
     private path;
 }
 
+/**
+ * `client.accessTokens` — manage an app's **access tokens**: scoped, expiring,
+ * non-ZK machine-to-machine credentials (`mk_<env>_at_…`).
+ *
+ *   const { plaintext } = await client.accessTokens.create(appId, {
+ *     scopes: ["db:read", "db:write"], env: "live", expiresInDays: 30,
+ *     label: "ci-runner",
+ *   });
+ *   // hand `plaintext` to the machine caller as its ClientOptions.accessToken
+ *
+ * These are MANAGEMENT calls — creating/listing/revoking tokens is authorized by
+ * the developer session (same as the `agents`/`functions` namespaces). The token
+ * itself resolves through the SAME accelerator path as an app key (the
+ * `X-Muhkoo-Key` header), but is scoped to a fixed vocabulary of permissions and
+ * expires. The plaintext is returned ONCE, on create — store it then; it can't
+ * be read back.
+ */
+
+/** The fixed vocabulary of permissions an access token can be granted. */
+type Scope = "db:read" | "db:write" | "kv:read" | "kv:write" | "storage:read" | "storage:write" | "messages:read" | "messages:write" | "functions:invoke" | "ai:infer";
+/** All valid {@link Scope}s, in canonical order. */
+declare const ACCESS_TOKEN_SCOPES: Scope[];
+/** A token as returned by {@link AccessTokensNamespace.list} (never the plaintext). */
+interface AccessTokenInfo {
+    keyId: string;
+    env: "live" | "test";
+    scopes: string[];
+    /** Epoch ms, or absent if the token never expires. */
+    expiresAt?: number;
+    label?: string;
+    createdAt: number;
+    revoked: boolean;
+    /** True once past {@link expiresAt}. */
+    expired: boolean;
+}
+/** The editor-settable fields when minting an access token. */
+interface CreateAccessTokenInput {
+    scopes: string[];
+    /** Defaults to `live` on the accelerator. */
+    env?: "live" | "test";
+    /** Omit for a non-expiring token. */
+    expiresInDays?: number;
+    label?: string;
+}
+/** Create response — includes the one-time {@link plaintext} secret. */
+interface CreatedAccessToken {
+    keyId: string;
+    env: "live" | "test";
+    /** The `mk_<env>_at_…` secret. Returned ONCE — store it now. */
+    plaintext: string;
+    scopes: string[];
+    expiresAt: number;
+    label?: string;
+    createdAt: number;
+}
+interface AccessTokensNamespaceDeps {
+    http: HttpClient;
+}
+declare class AccessTokensNamespace {
+    private readonly deps;
+    constructor(deps: AccessTokensNamespaceDeps);
+    /** List the app's access tokens (metadata only — never the plaintext). */
+    list(appId: string): Promise<AccessTokenInfo[]>;
+    /** Mint an access token (owner/editor only). The plaintext is returned once. */
+    create(appId: string, input: CreateAccessTokenInput): Promise<CreatedAccessToken>;
+    /** Revoke an access token by its `keyId`. */
+    revoke(appId: string, keyId: string): Promise<{
+        revoked: boolean;
+    }>;
+    private path;
+}
+
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
 declare const DEFAULT_BASE_URL = "https://api.muhkoo.dev";
 /** The hosted auth SPA — the default {@link ClientOptions.authBaseUrl}. */
@@ -4819,6 +4920,15 @@ interface ClientOptions {
      * New integrations should always pass one.
      */
     apiKey?: string;
+    /**
+     * A scoped, expiring **access token** (`mk_<env>_at_…`) — the non-ZK
+     * machine-to-machine credential. It resolves through the SAME accelerator
+     * path as {@link apiKey} (both ride the `X-Muhkoo-Key` header) and, when
+     * set, takes precedence over it. Use it for server-side / CI callers that
+     * shouldn't carry the app's publishable key. Mint one with
+     * `client.accessTokens.create(...)`.
+     */
+    accessToken?: string;
     /**
      * Absolute URL of the accelerator (trailing slash optional). Defaults to
      * the hosted Muhkoo Accelerator ({@link DEFAULT_BASE_URL}); override to
@@ -4900,6 +5010,8 @@ declare class Client {
     readonly agents: AgentsNamespace;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
     readonly functions: FunctionsNamespace;
+    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
+    readonly accessTokens: AccessTokensNamespace;
     /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
     readonly offline: OfflineManager;
     private readonly session;
@@ -4934,6 +5046,75 @@ declare class Client {
     recoverSession(): Promise<boolean>;
 }
 
+/**
+ * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
+ *
+ * A passkey becomes a device-bound, platform-synced source of a stable secret:
+ * for a fixed salt, the authenticator's PRF returns the same 32 bytes, which we
+ * HKDF into an AES key that wraps the master seed. The server never sees the
+ * passkey — it's purely a local key source; the ZK proof remains the server auth.
+ *
+ * BROWSER ONLY (`navigator.credentials`). The PRF extension fields aren't in the
+ * standard DOM types yet, so they're reached through narrow casts.
+ */
+/** Whether this environment can do WebAuthn at all. (PRF support is checked at enroll.) */
+declare function passkeySupported(): boolean;
+/**
+ * Whether this browser's authenticator can do the **PRF extension** our passkey
+ * factor needs. A browser can save passkeys (e.g. for password autofill) yet not
+ * expose PRF — PRF is what derives the stable secret we wrap the seed under, so a
+ * passkey without it is useless to us.
+ *
+ * Uses `PublicKeyCredential.getClientCapabilities()` (the `extension:prf` cap)
+ * where available. Returns:
+ *   - `true`  — PRF is supported,
+ *   - `false` — definitively NOT supported (hide the option),
+ *   - `null`  — couldn't determine (older browser without the capabilities API);
+ *              the caller may optimistically allow and let enroll surface a real
+ *              error if it turns out PRF isn't there.
+ */
+declare function passkeyPrfCapable(): Promise<boolean | null>;
+/** Best-effort registrable RP id — the host. Apps spanning subdomains should pass
+ *  the parent domain (e.g. "muhkoo.dev") explicitly. */
+declare function defaultRpId(): string;
+/**
+ * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
+ *
+ * WebAuthn only accepts an RP id that is the origin's own host or a registrable
+ * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
+ * `app.example.net`, and one enrolled on a full host is unusable from a sibling
+ * host. An app served on BOTH a custom domain and the platform host therefore
+ * needs one passkey per origin.
+ *
+ * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
+ * a raw "The requested RPID did not match the origin or related origins", which
+ * is a dead end for the user. Checking first lets the caller fall back to normal
+ * sign-in (and offer to enroll a passkey for this origin) instead.
+ */
+declare function rpIdUsableForOrigin(rpId: string | undefined | null, host?: string): boolean;
+/** Thrown when the account's passkey belongs to a different origin. Callers
+ *  should treat this as "no passkey here" and fall back to another factor. */
+declare class PasskeyOriginError extends Error {
+    readonly code = "passkey_wrong_origin";
+    constructor(message?: string);
+}
+interface PasskeyEnrollment {
+    credentialId: Uint8Array;
+    prfSalt: Uint8Array;
+    prfOutput: Uint8Array;
+}
+/**
+ * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
+ * the PRF output for that salt. Throws if the authenticator can't do PRF.
+ */
+declare function createPasskeyWithPrf(opts: {
+    rpId: string;
+    rpName: string;
+    username: string;
+}): Promise<PasskeyEnrollment>;
+/** Evaluate a passkey's PRF for `salt` → 32 bytes. Used at recover/login. */
+declare function evaluatePasskeyPrf(rpId: string, credentialId: Uint8Array, salt: Uint8Array): Promise<Uint8Array>;
+
 /**
  * Muhkoo app decorators — declare your app's agent-facing surface in code, then
  * "eject" a system prompt you hand to a Programmable Agent.
@@ -4996,6 +5177,11 @@ interface MuhkooDBMeta {
     table?: string;
     /** Read-only by default. */
     access?: MuhkooDBAccess;
+    /**
+     * Backend-only table — omitted from {@link ejectAgentPrompt}. Use for tables
+     * an agent should never be told about (server-managed / internal state).
+     */
+    backend?: boolean;
     description: string;
 }
 /** A serverless function the agent can invoke via `call_function`. */
@@ -5012,6 +5198,7 @@ interface TableEntry {
     table: string;
     access: MuhkooDBAccess;
     description: string;
+    backend: boolean;
 }
 interface FunctionEntry {
     name: string;
@@ -5832,5 +6019,5 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, compareHlc, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, ConnectivityOptions, ConnectivityState, DbQueryPage, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, HlcParts, HlcState, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LoginOptions, LwwMap, LwwRegister, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, Participant, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StorageChangeEvent, StoreName, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, compareHlc, compilePrograms, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, passkeyPrfCapable, passkeySupported, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, rpIdUsableForOrigin, sealSeed, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbQueryPage, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, HlcParts, HlcState, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LoginOptions, LwwMap, LwwRegister, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StorageChangeEvent, StoreName, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };

package/dist/server/index.js

@@ -2445,8 +2445,12 @@ class AuthClient {
      * Read a factor record for `username` (returns an indistinguishable decoy if
      * absent). Gated types (email) require the recover `verifyToken`.
      */
-    async vaultRead(username, factorType, verifyToken) {
-        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault`, this.json("POST", { username, factorType, verifyToken }));
+    async vaultRead(username, factorType, verifyToken, 
+    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
+     *  passkey instead of whichever was enrolled first (which WebAuthn would
+     *  refuse). Ignored for other factor types. */
+    rpId) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault`, this.json("POST", { username, factorType, verifyToken, rpId }));
         return await this.parse("vaultRead", res);
     }
     /**
@@ -2976,7 +2980,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.10.10-alpha.0";
+const VERSION = "0.10.11-alpha.0";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -3037,6 +3041,8 @@ class HttpClient {
     /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
     baseOrigin;
     apiKey;
+    /** Scoped machine access token — takes precedence over {@link apiKey} on `X-Muhkoo-Key`. */
+    accessToken;
     getSessionToken;
     onUnauthorized;
     fetchFn;
@@ -3051,6 +3057,7 @@ class HttpClient {
             this.baseOrigin = "";
         }
         this.apiKey = opts.apiKey ?? null;
+        this.accessToken = opts.accessToken ?? null;
         this.getSessionToken = opts.getSessionToken ?? (() => null);
         this.onUnauthorized = opts.onUnauthorized ?? null;
         const f = opts.fetch ?? globalThis.fetch;
@@ -3071,8 +3078,11 @@ class HttpClient {
         // server-reflected path that escapes `baseUrl`) must NOT receive the app
         // key or session token, or it becomes a token-exfiltration vector.
         if (this.isSameOrigin(input)) {
-            if (this.apiKey)
-                headers.set("X-Muhkoo-Key", this.apiKey);
+            // Access token and app key resolve through the same accelerator path
+            // and ride the same header; the access token takes precedence.
+            const key = this.accessToken ?? this.apiKey;
+            if (key)
+                headers.set("X-Muhkoo-Key", key);
             const token = this.getSessionToken();
             if (token)
                 headers.set("X-Muhkoo-Session", token);
@@ -3486,6 +3496,35 @@ async function passkeyPrfCapable() {
 function defaultRpId() {
     return typeof location !== "undefined" ? location.hostname : "";
 }
+/**
+ * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
+ *
+ * WebAuthn only accepts an RP id that is the origin's own host or a registrable
+ * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
+ * `app.example.net`, and one enrolled on a full host is unusable from a sibling
+ * host. An app served on BOTH a custom domain and the platform host therefore
+ * needs one passkey per origin.
+ *
+ * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
+ * a raw "The requested RPID did not match the origin or related origins", which
+ * is a dead end for the user. Checking first lets the caller fall back to normal
+ * sign-in (and offer to enroll a passkey for this origin) instead.
+ */
+function rpIdUsableForOrigin(rpId, host) {
+    const h = host ?? (typeof location !== "undefined" ? location.hostname : "");
+    if (!rpId || !h)
+        return false;
+    return h === rpId || h.endsWith(`.${rpId}`);
+}
+/** Thrown when the account's passkey belongs to a different origin. Callers
+ *  should treat this as "no passkey here" and fall back to another factor. */
+class PasskeyOriginError extends Error {
+    code = "passkey_wrong_origin";
+    constructor(message = "No passkey is enrolled for this site. Sign in another way, then add one for this device.") {
+        super(message);
+        this.name = "PasskeyOriginError";
+    }
+}
 /**
  * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
  * the PRF output for that salt. Throws if the authenticator can't do PRF.
@@ -4179,12 +4218,22 @@ class ZkAuth {
      * its PRF, unwraps the master seed → identity → session.
      */
     async loginWithPasskey(username, opts = {}) {
-        const { factor } = await this.deps.auth.vaultRead(username, "passkey");
+        // Ask for THIS origin's passkey — they're enrolled per-origin, so the
+        // account's first passkey may belong to a different host entirely.
+        const host = defaultRpId();
+        const { factor } = await this.deps.auth.vaultRead(username, "passkey", undefined, host);
         const params = factor?.params;
         if (!factor?.wrap || !factor?.iv || !params?.credentialId || !params?.prfSalt) {
             throw new Error("No passkey is set up for this account.");
         }
-        const prfOutput = await evaluatePasskeyPrf(params.rpId ?? defaultRpId(), fromBase64(params.credentialId), fromBase64(params.prfSalt));
+        const rpId = params.rpId ?? host;
+        // Refuse a foreign rpId up front: WebAuthn would throw a raw "requested
+        // RPID did not match the origin", which reads as a hard failure to the
+        // user. A typed error lets the app fall back to another factor and offer
+        // to enroll a passkey for this origin.
+        if (!rpIdUsableForOrigin(rpId, host))
+            throw new PasskeyOriginError();
+        const prfOutput = await evaluatePasskeyPrf(rpId, fromBase64(params.credentialId), fromBase64(params.prfSalt));
         const key = await wrapKeyFromBytes(prfOutput, "muhkoo-passkey-wrap");
         const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
         const identity = await deriveIdentityFromSeed(seed);
@@ -4204,6 +4253,27 @@ class ZkAuth {
         const { factors } = await this.deps.auth.vaultFactors(token);
         return factors;
     }
+    /**
+     * Is a passkey enrolled that can unlock from THIS origin?
+     *
+     * Passkeys are origin-bound, so an app served on both a custom domain and the
+     * platform host needs one per host. Use this to decide whether to offer
+     * "Unlock with passkey" or go straight to sign-in — prompting with another
+     * origin's passkey fails with a raw WebAuthn error. Requires a session
+     * (metadata read); returns false when signed out or unsupported.
+     */
+    async hasPasskeyForThisOrigin() {
+        if (!passkeySupported())
+            return false;
+        try {
+            const host = defaultRpId();
+            const factors = await this.listFactors();
+            return factors.some((f) => f.type === "passkey" && rpIdUsableForOrigin(f.rpId, host));
+        }
+        catch {
+            return false;
+        }
+    }
     /** Remove a login method by id (can't remove your only one). Session-authed. */
     async removeFactor(id) {
         const token = this.deps.session.token;
@@ -9840,6 +9910,59 @@ class FunctionsNamespace {
     }
 }
 
+/**
+ * `client.accessTokens` — manage an app's **access tokens**: scoped, expiring,
+ * non-ZK machine-to-machine credentials (`mk_<env>_at_…`).
+ *
+ *   const { plaintext } = await client.accessTokens.create(appId, {
+ *     scopes: ["db:read", "db:write"], env: "live", expiresInDays: 30,
+ *     label: "ci-runner",
+ *   });
+ *   // hand `plaintext` to the machine caller as its ClientOptions.accessToken
+ *
+ * These are MANAGEMENT calls — creating/listing/revoking tokens is authorized by
+ * the developer session (same as the `agents`/`functions` namespaces). The token
+ * itself resolves through the SAME accelerator path as an app key (the
+ * `X-Muhkoo-Key` header), but is scoped to a fixed vocabulary of permissions and
+ * expires. The plaintext is returned ONCE, on create — store it then; it can't
+ * be read back.
+ */
+/** All valid {@link Scope}s, in canonical order. */
+const ACCESS_TOKEN_SCOPES = [
+    "db:read",
+    "db:write",
+    "kv:read",
+    "kv:write",
+    "storage:read",
+    "storage:write",
+    "messages:read",
+    "messages:write",
+    "functions:invoke",
+    "ai:infer",
+];
+class AccessTokensNamespace {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** List the app's access tokens (metadata only — never the plaintext). */
+    async list(appId) {
+        const res = await this.deps.http.get(this.path(appId, ""));
+        return res.tokens ?? [];
+    }
+    /** Mint an access token (owner/editor only). The plaintext is returned once. */
+    async create(appId, input) {
+        return this.deps.http.post(this.path(appId, ""), input);
+    }
+    /** Revoke an access token by its `keyId`. */
+    async revoke(appId, keyId) {
+        return this.deps.http.del(this.path(appId, `/${encodeURIComponent(keyId)}`));
+    }
+    path(appId, suffix) {
+        return `/api/apps/${encodeURIComponent(appId)}/access-tokens${suffix}`;
+    }
+}
+
 /**
  * `ChatKeyVault` — SDK-owned lifecycle for a member's long-lived ratchet/space
  * keypair (the connect `KeyStore` entry keyed by the member id / username).
@@ -11087,6 +11210,8 @@ class Client {
     agents;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
     functions;
+    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
+    accessTokens;
     /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
     offline;
     session;
@@ -11140,6 +11265,7 @@ class Client {
         this.http = new HttpClient({
             baseUrl: this.baseUrl,
             apiKey: options.apiKey,
+            accessToken: options.accessToken,
             getSessionToken: () => this.session.token,
             fetch: reportingFetch,
             // Self-heal stale sessions: on a 401, try a silent re-auth (only
@@ -11216,6 +11342,7 @@ class Client {
         });
         this.agents = new AgentsNamespace({ http: this.http });
         this.functions = new FunctionsNamespace({ http: this.http, fnHostSuffix: options.functionsHostSuffix });
+        this.accessTokens = new AccessTokensNamespace({ http: this.http });
         // Replay deferred shard uploads on reconnect. The bytes live in the
         // Cache API keyed by hash; re-PUT them through a (defer-free) shard
         // client so a failure surfaces as transient and the entry stays queued.
@@ -11475,6 +11602,7 @@ function MuhkooDB(meta) {
             table: meta.table ?? String(propertyKey),
             access: meta.access ?? "read",
             description: meta.description,
+            backend: meta.backend ?? false,
         });
     });
 }
@@ -11514,9 +11642,12 @@ function ejectAgentPrompt(appClass) {
         for (const s of d.spaces)
             lines.push(`- ${s.name}: ${s.description}`);
     }
-    if (d.tables.length) {
+    // Backend-only tables are deliberately withheld — the agent should never be
+    // told about server-managed / internal state it can't (and shouldn't) touch.
+    const promptTables = d.tables.filter((t) => !t.backend);
+    if (promptTables.length) {
         lines.push("", "App database tables:");
-        for (const t of d.tables) {
+        for (const t of promptTables) {
             const verbs = t.access === "write"
                 ? "read & write — db_query/db_get/db_insert/db_update/db_delete"
                 : "read-only — db_query/db_get";
@@ -11534,7 +11665,7 @@ function ejectAgentPrompt(appClass) {
     // How to respond — the load-bearing behavioral contract. Without this, models
     // (especially gpt-oss) tend to run tool calls and then end their turn with no
     // user-facing message, so the user sees the work happen but gets no reply.
-    const hasTools = d.tables.length > 0 || d.functions.length > 0;
+    const hasTools = promptTables.length > 0 || d.functions.length > 0;
     lines.push("", "How to respond:");
     if (hasTools) {
         lines.push("- When you need information or need to make a change, call your tools immediately — don't ask the user to do it, and don't describe or name the tools to them.", "- After your tool calls return, you MUST send one final reply to the channel, in plain language, that answers the request using the results.");
@@ -12104,5 +12235,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
     default: loadRsWasm
 });
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DbNamespace, DbTable, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, Ready, ReedSolomonCodec, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, compareHlc, compilePrograms, concatBytes, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, fromBase64$1 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, log, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, sealSeed, serialize, shardHash, signMessage, stableStringify, toBase64$1 as toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DbNamespace, DbTable, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, Ready, ReedSolomonCodec, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, compareHlc, compilePrograms, concatBytes, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, fromBase64$1 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, log, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, rpIdUsableForOrigin, sealSeed, serialize, shardHash, signMessage, stableStringify, toBase64$1 as toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
 //# sourceMappingURL=index.js.map