@muhkoo/connect 0.10.9-alpha.0 → 0.10.11-alpha.0

package/dist/connect.d.ts

@@ -1706,6 +1706,14 @@ declare class FileStorage {
         data: Uint8Array;
         stat: FileStat;
     }>;
+    /**
+     * Streaming inverse of {@link writeFileToShards}: yields each chunk's
+     * decrypted plaintext in order WITHOUT concatenating. Peak memory stays at
+     * ~one chunk, so multi-GB files (which overflow a single `Uint8Array`) can be
+     * piped straight to a file/socket. Same shard sourcing (cache → peers →
+     * origin) and per-chunk auth as {@link readFileFromShards}.
+     */
+    readChunksFromShards(manifest: FileManifest): AsyncGenerator<Uint8Array>;
     /** As {@link writeFileToShards}, plus POSTs the manifest to `input.spaceId`. */
     writeFile(input: WriteFileInput): Promise<FileStat>;
     /** As {@link readFileFromShards}, but fetches the manifest from a space first. */
@@ -1897,6 +1905,10 @@ interface VaultFactor {
     createdAt?: number;
     /** Display hint for gated factors ("m•••@gmail.com") — list responses only. */
     masked?: string;
+    /** Passkey's origin (RP id) — list responses only. A passkey only unlocks
+     *  from this host or a subdomain of it, so apps on several hosts enroll one
+     *  per origin. */
+    rpId?: string;
 }
 interface AuthClientOptions {
     /** Absolute URL of the accelerator worker (no trailing slash required). */
@@ -1993,7 +2005,11 @@ declare class AuthClient {
      * Read a factor record for `username` (returns an indistinguishable decoy if
      * absent). Gated types (email) require the recover `verifyToken`.
      */
-    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string): Promise<{
+    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string, 
+    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
+     *  passkey instead of whichever was enrolled first (which WebAuthn would
+     *  refuse). Ignored for other factor types. */
+    rpId?: string): Promise<{
         factor: VaultFactor | null;
     }>;
     /**
@@ -2661,7 +2677,18 @@ declare class ZkAuth {
         label?: string;
         createdAt?: number;
         masked?: string;
+        rpId?: string;
     }>>;
+    /**
+     * Is a passkey enrolled that can unlock from THIS origin?
+     *
+     * Passkeys are origin-bound, so an app served on both a custom domain and the
+     * platform host needs one per host. Use this to decide whether to offer
+     * "Unlock with passkey" or go straight to sign-in — prompting with another
+     * origin's passkey fails with a raw WebAuthn error. Requires a session
+     * (metadata read); returns false when signed out or unsupported.
+     */
+    hasPasskeyForThisOrigin(): Promise<boolean>;
     /** Remove a login method by id (can't remove your only one). Session-authed. */
     removeFactor(id: string): Promise<void>;
     /** Sign out: clears the session, identity, and persisted token. */
@@ -2759,6 +2786,14 @@ interface HttpClientOptions {
      * shared-space (messaging) websockets.
      */
     apiKey?: string;
+    /**
+     * A scoped, expiring **access token** (`mk_<env>_at_…`) — the non-ZK
+     * machine-to-machine credential. It resolves through the SAME accelerator
+     * path as an app key and rides the same `X-Muhkoo-Key` header; when present
+     * it takes precedence over {@link apiKey}. Use it for server-side / CI
+     * callers that shouldn't carry the app's publishable key.
+     */
+    accessToken?: string;
     /** Returns the current user session token, or `null` when logged out. */
     getSessionToken?: () => string | null;
     /** Custom fetch — defaults to `globalThis.fetch`. */
@@ -2787,6 +2822,8 @@ declare class HttpClient {
     /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
     private readonly baseOrigin;
     private readonly apiKey;
+    /** Scoped machine access token — takes precedence over {@link apiKey} on `X-Muhkoo-Key`. */
+    private readonly accessToken;
     private readonly getSessionToken;
     private readonly onUnauthorized;
     private readonly fetchFn;
@@ -4146,6 +4183,11 @@ declare class Space {
         data: Uint8Array;
         stat: FileStat;
     }>;
+    /** Streaming read: async-iterate a stored file's decrypted chunks in order,
+     *  never holding the whole file in memory. Use for multi-GB files (a single
+     *  `Uint8Array` can't hold them) — e.g. a transcoder piping the raw to a temp
+     *  file. Same peer/origin shard sourcing as {@link getFile}. */
+    getFileStream(manifest: FileManifest): AsyncGenerator<Uint8Array>;
     /** Declare a file's shards (ref++ + meter) for a manifest already stored —
      *  used to back-fill accounting for files written before commit existed, or to
      *  register a manifest received via sharing. `putFile` already commits new
@@ -4791,6 +4833,78 @@ declare class FunctionsNamespace {
     private path;
 }
 
+/**
+ * `client.accessTokens` — manage an app's **access tokens**: scoped, expiring,
+ * non-ZK machine-to-machine credentials (`mk_<env>_at_…`).
+ *
+ *   const { plaintext } = await client.accessTokens.create(appId, {
+ *     scopes: ["db:read", "db:write"], env: "live", expiresInDays: 30,
+ *     label: "ci-runner",
+ *   });
+ *   // hand `plaintext` to the machine caller as its ClientOptions.accessToken
+ *
+ * These are MANAGEMENT calls — creating/listing/revoking tokens is authorized by
+ * the developer session (same as the `agents`/`functions` namespaces). The token
+ * itself resolves through the SAME accelerator path as an app key (the
+ * `X-Muhkoo-Key` header), but is scoped to a fixed vocabulary of permissions and
+ * expires. The plaintext is returned ONCE, on create — store it then; it can't
+ * be read back.
+ */
+
+/** The fixed vocabulary of permissions an access token can be granted. */
+type Scope = "db:read" | "db:write" | "kv:read" | "kv:write" | "storage:read" | "storage:write" | "messages:read" | "messages:write" | "functions:invoke" | "ai:infer";
+/** All valid {@link Scope}s, in canonical order. */
+declare const ACCESS_TOKEN_SCOPES: Scope[];
+/** A token as returned by {@link AccessTokensNamespace.list} (never the plaintext). */
+interface AccessTokenInfo {
+    keyId: string;
+    env: "live" | "test";
+    scopes: string[];
+    /** Epoch ms, or absent if the token never expires. */
+    expiresAt?: number;
+    label?: string;
+    createdAt: number;
+    revoked: boolean;
+    /** True once past {@link expiresAt}. */
+    expired: boolean;
+}
+/** The editor-settable fields when minting an access token. */
+interface CreateAccessTokenInput {
+    scopes: string[];
+    /** Defaults to `live` on the accelerator. */
+    env?: "live" | "test";
+    /** Omit for a non-expiring token. */
+    expiresInDays?: number;
+    label?: string;
+}
+/** Create response — includes the one-time {@link plaintext} secret. */
+interface CreatedAccessToken {
+    keyId: string;
+    env: "live" | "test";
+    /** The `mk_<env>_at_…` secret. Returned ONCE — store it now. */
+    plaintext: string;
+    scopes: string[];
+    expiresAt: number;
+    label?: string;
+    createdAt: number;
+}
+interface AccessTokensNamespaceDeps {
+    http: HttpClient;
+}
+declare class AccessTokensNamespace {
+    private readonly deps;
+    constructor(deps: AccessTokensNamespaceDeps);
+    /** List the app's access tokens (metadata only — never the plaintext). */
+    list(appId: string): Promise<AccessTokenInfo[]>;
+    /** Mint an access token (owner/editor only). The plaintext is returned once. */
+    create(appId: string, input: CreateAccessTokenInput): Promise<CreatedAccessToken>;
+    /** Revoke an access token by its `keyId`. */
+    revoke(appId: string, keyId: string): Promise<{
+        revoked: boolean;
+    }>;
+    private path;
+}
+
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
 declare const DEFAULT_BASE_URL = "https://api.muhkoo.dev";
 /** The hosted auth SPA — the default {@link ClientOptions.authBaseUrl}. */
@@ -4806,6 +4920,15 @@ interface ClientOptions {
      * New integrations should always pass one.
      */
     apiKey?: string;
+    /**
+     * A scoped, expiring **access token** (`mk_<env>_at_…`) — the non-ZK
+     * machine-to-machine credential. It resolves through the SAME accelerator
+     * path as {@link apiKey} (both ride the `X-Muhkoo-Key` header) and, when
+     * set, takes precedence over it. Use it for server-side / CI callers that
+     * shouldn't carry the app's publishable key. Mint one with
+     * `client.accessTokens.create(...)`.
+     */
+    accessToken?: string;
     /**
      * Absolute URL of the accelerator (trailing slash optional). Defaults to
      * the hosted Muhkoo Accelerator ({@link DEFAULT_BASE_URL}); override to
@@ -4887,6 +5010,8 @@ declare class Client {
     readonly agents: AgentsNamespace;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
     readonly functions: FunctionsNamespace;
+    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
+    readonly accessTokens: AccessTokensNamespace;
     /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
     readonly offline: OfflineManager;
     private readonly session;
@@ -4921,6 +5046,75 @@ declare class Client {
     recoverSession(): Promise<boolean>;
 }
 
+/**
+ * Passkey factor (M1.1) — WebAuthn with the **PRF extension**.
+ *
+ * A passkey becomes a device-bound, platform-synced source of a stable secret:
+ * for a fixed salt, the authenticator's PRF returns the same 32 bytes, which we
+ * HKDF into an AES key that wraps the master seed. The server never sees the
+ * passkey — it's purely a local key source; the ZK proof remains the server auth.
+ *
+ * BROWSER ONLY (`navigator.credentials`). The PRF extension fields aren't in the
+ * standard DOM types yet, so they're reached through narrow casts.
+ */
+/** Whether this environment can do WebAuthn at all. (PRF support is checked at enroll.) */
+declare function passkeySupported(): boolean;
+/**
+ * Whether this browser's authenticator can do the **PRF extension** our passkey
+ * factor needs. A browser can save passkeys (e.g. for password autofill) yet not
+ * expose PRF — PRF is what derives the stable secret we wrap the seed under, so a
+ * passkey without it is useless to us.
+ *
+ * Uses `PublicKeyCredential.getClientCapabilities()` (the `extension:prf` cap)
+ * where available. Returns:
+ *   - `true`  — PRF is supported,
+ *   - `false` — definitively NOT supported (hide the option),
+ *   - `null`  — couldn't determine (older browser without the capabilities API);
+ *              the caller may optimistically allow and let enroll surface a real
+ *              error if it turns out PRF isn't there.
+ */
+declare function passkeyPrfCapable(): Promise<boolean | null>;
+/** Best-effort registrable RP id — the host. Apps spanning subdomains should pass
+ *  the parent domain (e.g. "muhkoo.dev") explicitly. */
+declare function defaultRpId(): string;
+/**
+ * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
+ *
+ * WebAuthn only accepts an RP id that is the origin's own host or a registrable
+ * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
+ * `app.example.net`, and one enrolled on a full host is unusable from a sibling
+ * host. An app served on BOTH a custom domain and the platform host therefore
+ * needs one passkey per origin.
+ *
+ * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
+ * a raw "The requested RPID did not match the origin or related origins", which
+ * is a dead end for the user. Checking first lets the caller fall back to normal
+ * sign-in (and offer to enroll a passkey for this origin) instead.
+ */
+declare function rpIdUsableForOrigin(rpId: string | undefined | null, host?: string): boolean;
+/** Thrown when the account's passkey belongs to a different origin. Callers
+ *  should treat this as "no passkey here" and fall back to another factor. */
+declare class PasskeyOriginError extends Error {
+    readonly code = "passkey_wrong_origin";
+    constructor(message?: string);
+}
+interface PasskeyEnrollment {
+    credentialId: Uint8Array;
+    prfSalt: Uint8Array;
+    prfOutput: Uint8Array;
+}
+/**
+ * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
+ * the PRF output for that salt. Throws if the authenticator can't do PRF.
+ */
+declare function createPasskeyWithPrf(opts: {
+    rpId: string;
+    rpName: string;
+    username: string;
+}): Promise<PasskeyEnrollment>;
+/** Evaluate a passkey's PRF for `salt` → 32 bytes. Used at recover/login. */
+declare function evaluatePasskeyPrf(rpId: string, credentialId: Uint8Array, salt: Uint8Array): Promise<Uint8Array>;
+
 /**
  * Muhkoo app decorators — declare your app's agent-facing surface in code, then
  * "eject" a system prompt you hand to a Programmable Agent.
@@ -4983,6 +5177,11 @@ interface MuhkooDBMeta {
     table?: string;
     /** Read-only by default. */
     access?: MuhkooDBAccess;
+    /**
+     * Backend-only table — omitted from {@link ejectAgentPrompt}. Use for tables
+     * an agent should never be told about (server-managed / internal state).
+     */
+    backend?: boolean;
     description: string;
 }
 /** A serverless function the agent can invoke via `call_function`. */
@@ -4999,6 +5198,7 @@ interface TableEntry {
     table: string;
     access: MuhkooDBAccess;
     description: string;
+    backend: boolean;
 }
 interface FunctionEntry {
     name: string;
@@ -5819,5 +6019,5 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, compareHlc, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, ConnectivityOptions, ConnectivityState, DbQueryPage, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, HlcParts, HlcState, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LoginOptions, LwwMap, LwwRegister, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, Participant, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StorageChangeEvent, StoreName, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, buildCommitment, compareHlc, compilePrograms, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isOfflineCapable, isP2pCapable, isProvisional, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, passkeyPrfCapable, passkeySupported, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, rpIdUsableForOrigin, sealSeed, shardHash, signMessage, stableStringify, toField, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbQueryPage, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, HlcParts, HlcState, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LoginOptions, LwwMap, LwwRegister, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, StorageChangeEvent, StoreName, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };