@muhkoo/connect 0.10.9-alpha.0 → 0.10.11-alpha.0

package/dist/server/index.js

@@ -2445,8 +2445,12 @@ class AuthClient {
      * Read a factor record for `username` (returns an indistinguishable decoy if
      * absent). Gated types (email) require the recover `verifyToken`.
      */
-    async vaultRead(username, factorType, verifyToken) {
-        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault`, this.json("POST", { username, factorType, verifyToken }));
+    async vaultRead(username, factorType, verifyToken, 
+    /** Passkeys are per-origin: naming the caller's host returns THAT origin's
+     *  passkey instead of whichever was enrolled first (which WebAuthn would
+     *  refuse). Ignored for other factor types. */
+    rpId) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/vault`, this.json("POST", { username, factorType, verifyToken, rpId }));
         return await this.parse("vaultRead", res);
     }
     /**
@@ -2976,7 +2980,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.10.9-alpha.0";
+const VERSION = "0.10.11-alpha.0";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -3037,6 +3041,8 @@ class HttpClient {
     /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
     baseOrigin;
     apiKey;
+    /** Scoped machine access token — takes precedence over {@link apiKey} on `X-Muhkoo-Key`. */
+    accessToken;
     getSessionToken;
     onUnauthorized;
     fetchFn;
@@ -3051,6 +3057,7 @@ class HttpClient {
             this.baseOrigin = "";
         }
         this.apiKey = opts.apiKey ?? null;
+        this.accessToken = opts.accessToken ?? null;
         this.getSessionToken = opts.getSessionToken ?? (() => null);
         this.onUnauthorized = opts.onUnauthorized ?? null;
         const f = opts.fetch ?? globalThis.fetch;
@@ -3071,8 +3078,11 @@ class HttpClient {
         // server-reflected path that escapes `baseUrl`) must NOT receive the app
         // key or session token, or it becomes a token-exfiltration vector.
         if (this.isSameOrigin(input)) {
-            if (this.apiKey)
-                headers.set("X-Muhkoo-Key", this.apiKey);
+            // Access token and app key resolve through the same accelerator path
+            // and ride the same header; the access token takes precedence.
+            const key = this.accessToken ?? this.apiKey;
+            if (key)
+                headers.set("X-Muhkoo-Key", key);
             const token = this.getSessionToken();
             if (token)
                 headers.set("X-Muhkoo-Session", token);
@@ -3486,6 +3496,35 @@ async function passkeyPrfCapable() {
 function defaultRpId() {
     return typeof location !== "undefined" ? location.hostname : "";
 }
+/**
+ * Can a passkey enrolled under `rpId` be used from the CURRENT origin?
+ *
+ * WebAuthn only accepts an RP id that is the origin's own host or a registrable
+ * *parent* of it — so a passkey enrolled on `app.example.com` is unusable on
+ * `app.example.net`, and one enrolled on a full host is unusable from a sibling
+ * host. An app served on BOTH a custom domain and the platform host therefore
+ * needs one passkey per origin.
+ *
+ * Call this BEFORE `navigator.credentials.get()`: passing a foreign rpId throws
+ * a raw "The requested RPID did not match the origin or related origins", which
+ * is a dead end for the user. Checking first lets the caller fall back to normal
+ * sign-in (and offer to enroll a passkey for this origin) instead.
+ */
+function rpIdUsableForOrigin(rpId, host) {
+    const h = host ?? (typeof location !== "undefined" ? location.hostname : "");
+    if (!rpId || !h)
+        return false;
+    return h === rpId || h.endsWith(`.${rpId}`);
+}
+/** Thrown when the account's passkey belongs to a different origin. Callers
+ *  should treat this as "no passkey here" and fall back to another factor. */
+class PasskeyOriginError extends Error {
+    code = "passkey_wrong_origin";
+    constructor(message = "No passkey is enrolled for this site. Sign in another way, then add one for this device.") {
+        super(message);
+        this.name = "PasskeyOriginError";
+    }
+}
 /**
  * Create a passkey with PRF and return its credential id, a fresh PRF salt, and
  * the PRF output for that salt. Throws if the authenticator can't do PRF.
@@ -4179,12 +4218,22 @@ class ZkAuth {
      * its PRF, unwraps the master seed → identity → session.
      */
     async loginWithPasskey(username, opts = {}) {
-        const { factor } = await this.deps.auth.vaultRead(username, "passkey");
+        // Ask for THIS origin's passkey — they're enrolled per-origin, so the
+        // account's first passkey may belong to a different host entirely.
+        const host = defaultRpId();
+        const { factor } = await this.deps.auth.vaultRead(username, "passkey", undefined, host);
         const params = factor?.params;
         if (!factor?.wrap || !factor?.iv || !params?.credentialId || !params?.prfSalt) {
             throw new Error("No passkey is set up for this account.");
         }
-        const prfOutput = await evaluatePasskeyPrf(params.rpId ?? defaultRpId(), fromBase64(params.credentialId), fromBase64(params.prfSalt));
+        const rpId = params.rpId ?? host;
+        // Refuse a foreign rpId up front: WebAuthn would throw a raw "requested
+        // RPID did not match the origin", which reads as a hard failure to the
+        // user. A typed error lets the app fall back to another factor and offer
+        // to enroll a passkey for this origin.
+        if (!rpIdUsableForOrigin(rpId, host))
+            throw new PasskeyOriginError();
+        const prfOutput = await evaluatePasskeyPrf(rpId, fromBase64(params.credentialId), fromBase64(params.prfSalt));
         const key = await wrapKeyFromBytes(prfOutput, "muhkoo-passkey-wrap");
         const seed = await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
         const identity = await deriveIdentityFromSeed(seed);
@@ -4204,6 +4253,27 @@ class ZkAuth {
         const { factors } = await this.deps.auth.vaultFactors(token);
         return factors;
     }
+    /**
+     * Is a passkey enrolled that can unlock from THIS origin?
+     *
+     * Passkeys are origin-bound, so an app served on both a custom domain and the
+     * platform host needs one per host. Use this to decide whether to offer
+     * "Unlock with passkey" or go straight to sign-in — prompting with another
+     * origin's passkey fails with a raw WebAuthn error. Requires a session
+     * (metadata read); returns false when signed out or unsupported.
+     */
+    async hasPasskeyForThisOrigin() {
+        if (!passkeySupported())
+            return false;
+        try {
+            const host = defaultRpId();
+            const factors = await this.listFactors();
+            return factors.some((f) => f.type === "passkey" && rpIdUsableForOrigin(f.rpId, host));
+        }
+        catch {
+            return false;
+        }
+    }
     /** Remove a login method by id (can't remove your only one). Session-authed. */
     async removeFactor(id) {
         const token = this.deps.session.token;
@@ -5832,31 +5902,37 @@ class FileStorage {
      */
     async writeFileToShards(input) {
         await this.codec.ready(this.rsWasmModule);
-        const data = await toUint8Array(input.data);
         const fileId = input.fileId ?? generateId();
         const createdAt = Date.now();
         const chunks = [];
-        const totalChunks = Math.max(1, Math.ceil(data.length / this.chunkSize));
+        // Read the source per-chunk so the peak memory footprint stays at
+        // ~chunkSize even for multi-GB files. A Blob/File is sliced lazily (only
+        // the current chunk's bytes are materialized) — reading the whole thing
+        // up front would blow past the browser's ~2GB ArrayBuffer cap and throw
+        // "the file could not be read". A caller that already has the bytes in a
+        // Uint8Array just gets zero-copy subarray views.
+        const asBytes = input.data instanceof Uint8Array ? input.data : null;
+        const size = asBytes ? asBytes.length : input.data.size;
+        const readChunk = async (start, end) => asBytes ? asBytes.subarray(start, end)
+            : new Uint8Array(await input.data.slice(start, end).arrayBuffer());
+        const totalChunks = Math.max(1, Math.ceil(size / this.chunkSize));
         input.onProgress?.(0, totalChunks);
-        // Slicing + encrypting + encoding + uploading is done per-chunk so
-        // the peak memory footprint stays at ~chunkSize even for huge files.
-        // Within a chunk, the shard uploads are parallelized up to
-        // `this.concurrency`.
-        for (let chunkIndex = 0; chunkIndex * this.chunkSize < Math.max(1, data.length); chunkIndex++) {
+        // Within a chunk, the shard uploads are parallelized up to `this.concurrency`.
+        for (let chunkIndex = 0; chunkIndex * this.chunkSize < Math.max(1, size); chunkIndex++) {
             const start = chunkIndex * this.chunkSize;
-            const end = Math.min(start + this.chunkSize, data.length);
-            const plaintext = data.subarray(start, end);
+            const end = Math.min(start + this.chunkSize, size);
+            const plaintext = await readChunk(start, end);
             chunks.push(await this.writeChunk(plaintext, chunkIndex));
             input.onProgress?.(chunks.length, totalChunks);
             // Stop after one iteration if the file is empty — we still emit a
             // single zero-length chunk so the manifest has a stable shape.
-            if (data.length === 0)
+            if (size === 0)
                 break;
         }
         const manifest = {
             id: fileId,
             name: input.metadata.name,
-            size: data.length,
+            size,
             type: input.metadata.type,
             path: input.metadata.path,
             lastModified: input.metadata.lastModified ?? createdAt,
@@ -5892,6 +5968,19 @@ class FileStorage {
         }
         return { data: out, stat: manifestToStat(manifest) };
     }
+    /**
+     * Streaming inverse of {@link writeFileToShards}: yields each chunk's
+     * decrypted plaintext in order WITHOUT concatenating. Peak memory stays at
+     * ~one chunk, so multi-GB files (which overflow a single `Uint8Array`) can be
+     * piped straight to a file/socket. Same shard sourcing (cache → peers →
+     * origin) and per-chunk auth as {@link readFileFromShards}.
+     */
+    async *readChunksFromShards(manifest) {
+        await this.codec.ready(this.rsWasmModule);
+        for (const chunkManifest of [...manifest.chunks].sort((a, b) => a.chunkIndex - b.chunkIndex)) {
+            yield await this.readChunk(chunkManifest);
+        }
+    }
     // -------------------------------------------------------------------------
     // Space-backed convenience wrappers — encrypt + upload + write manifest.
     // Require a `SharedSpaceClient` to have been provided at construction.
@@ -6025,14 +6114,6 @@ class FileStorage {
         await Promise.all(workers);
     }
 }
-/** Normalize `data` to a flat `Uint8Array`. */
-async function toUint8Array(data) {
-    if (data instanceof Uint8Array)
-        return data;
-    // Blob covers File too (File extends Blob in every runtime we target).
-    const ab = await data.arrayBuffer();
-    return new Uint8Array(ab);
-}
 
 /**
  * HTTP client for the gated file-manifest store on a SharedSpace
@@ -7348,6 +7429,13 @@ class Space {
     async getFile(manifest) {
         return this.fileStorage().readFileFromShards(manifest);
     }
+    /** Streaming read: async-iterate a stored file's decrypted chunks in order,
+     *  never holding the whole file in memory. Use for multi-GB files (a single
+     *  `Uint8Array` can't hold them) — e.g. a transcoder piping the raw to a temp
+     *  file. Same peer/origin shard sourcing as {@link getFile}. */
+    getFileStream(manifest) {
+        return this.fileStorage().readChunksFromShards(manifest);
+    }
     /** Declare a file's shards (ref++ + meter) for a manifest already stored —
      *  used to back-fill accounting for files written before commit existed, or to
      *  register a manifest received via sharing. `putFile` already commits new
@@ -9822,6 +9910,59 @@ class FunctionsNamespace {
     }
 }
 
+/**
+ * `client.accessTokens` — manage an app's **access tokens**: scoped, expiring,
+ * non-ZK machine-to-machine credentials (`mk_<env>_at_…`).
+ *
+ *   const { plaintext } = await client.accessTokens.create(appId, {
+ *     scopes: ["db:read", "db:write"], env: "live", expiresInDays: 30,
+ *     label: "ci-runner",
+ *   });
+ *   // hand `plaintext` to the machine caller as its ClientOptions.accessToken
+ *
+ * These are MANAGEMENT calls — creating/listing/revoking tokens is authorized by
+ * the developer session (same as the `agents`/`functions` namespaces). The token
+ * itself resolves through the SAME accelerator path as an app key (the
+ * `X-Muhkoo-Key` header), but is scoped to a fixed vocabulary of permissions and
+ * expires. The plaintext is returned ONCE, on create — store it then; it can't
+ * be read back.
+ */
+/** All valid {@link Scope}s, in canonical order. */
+const ACCESS_TOKEN_SCOPES = [
+    "db:read",
+    "db:write",
+    "kv:read",
+    "kv:write",
+    "storage:read",
+    "storage:write",
+    "messages:read",
+    "messages:write",
+    "functions:invoke",
+    "ai:infer",
+];
+class AccessTokensNamespace {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** List the app's access tokens (metadata only — never the plaintext). */
+    async list(appId) {
+        const res = await this.deps.http.get(this.path(appId, ""));
+        return res.tokens ?? [];
+    }
+    /** Mint an access token (owner/editor only). The plaintext is returned once. */
+    async create(appId, input) {
+        return this.deps.http.post(this.path(appId, ""), input);
+    }
+    /** Revoke an access token by its `keyId`. */
+    async revoke(appId, keyId) {
+        return this.deps.http.del(this.path(appId, `/${encodeURIComponent(keyId)}`));
+    }
+    path(appId, suffix) {
+        return `/api/apps/${encodeURIComponent(appId)}/access-tokens${suffix}`;
+    }
+}
+
 /**
  * `ChatKeyVault` — SDK-owned lifecycle for a member's long-lived ratchet/space
  * keypair (the connect `KeyStore` entry keyed by the member id / username).
@@ -11069,6 +11210,8 @@ class Client {
     agents;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
     functions;
+    /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
+    accessTokens;
     /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
     offline;
     session;
@@ -11122,6 +11265,7 @@ class Client {
         this.http = new HttpClient({
             baseUrl: this.baseUrl,
             apiKey: options.apiKey,
+            accessToken: options.accessToken,
             getSessionToken: () => this.session.token,
             fetch: reportingFetch,
             // Self-heal stale sessions: on a 401, try a silent re-auth (only
@@ -11198,6 +11342,7 @@ class Client {
         });
         this.agents = new AgentsNamespace({ http: this.http });
         this.functions = new FunctionsNamespace({ http: this.http, fnHostSuffix: options.functionsHostSuffix });
+        this.accessTokens = new AccessTokensNamespace({ http: this.http });
         // Replay deferred shard uploads on reconnect. The bytes live in the
         // Cache API keyed by hash; re-PUT them through a (defer-free) shard
         // client so a failure surfaces as transient and the entry stays queued.
@@ -11457,6 +11602,7 @@ function MuhkooDB(meta) {
             table: meta.table ?? String(propertyKey),
             access: meta.access ?? "read",
             description: meta.description,
+            backend: meta.backend ?? false,
         });
     });
 }
@@ -11496,9 +11642,12 @@ function ejectAgentPrompt(appClass) {
         for (const s of d.spaces)
             lines.push(`- ${s.name}: ${s.description}`);
     }
-    if (d.tables.length) {
+    // Backend-only tables are deliberately withheld — the agent should never be
+    // told about server-managed / internal state it can't (and shouldn't) touch.
+    const promptTables = d.tables.filter((t) => !t.backend);
+    if (promptTables.length) {
         lines.push("", "App database tables:");
-        for (const t of d.tables) {
+        for (const t of promptTables) {
             const verbs = t.access === "write"
                 ? "read & write — db_query/db_get/db_insert/db_update/db_delete"
                 : "read-only — db_query/db_get";
@@ -11516,7 +11665,7 @@ function ejectAgentPrompt(appClass) {
     // How to respond — the load-bearing behavioral contract. Without this, models
     // (especially gpt-oss) tend to run tool calls and then end their turn with no
     // user-facing message, so the user sees the work happen but gets no reply.
-    const hasTools = d.tables.length > 0 || d.functions.length > 0;
+    const hasTools = promptTables.length > 0 || d.functions.length > 0;
     lines.push("", "How to respond:");
     if (hasTools) {
         lines.push("- When you need information or need to make a change, call your tools immediately — don't ask the user to do it, and don't describe or name the tools to them.", "- After your tool calls return, you MUST send one final reply to the channel, in plain language, that answers the request using the results.");
@@ -12086,5 +12235,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
     default: loadRsWasm
 });
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DbNamespace, DbTable, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, Ready, ReedSolomonCodec, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, compareHlc, compilePrograms, concatBytes, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, fromBase64$1 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, log, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, sealSeed, serialize, shardHash, signMessage, stableStringify, toBase64$1 as toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, ConnectivityManager, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DbCache, DbNamespace, DbTable, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, Ready, ReedSolomonCodec, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VaultUnavailableError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, compareHlc, compilePrograms, concatBytes, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, fromBase64$1 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, log, manifestToStat, materializeRow, mergeMap, mergeMessage, mergeRegister, messageKey, pack, padHandle, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, rpIdUsableForOrigin, sealSeed, serialize, shardHash, signMessage, stableStringify, toBase64$1 as toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
 //# sourceMappingURL=index.js.map