@muhkoo/connect 0.15.0-alpha.4 → 0.15.0-alpha.6

package/dist/connect.d.ts

@@ -1099,6 +1099,59 @@ declare class BroadcastChannel {
     private handleInboundFrame;
 }
 
+/**
+ * `HttpError` — thrown for any non-2xx accelerator response.
+ *
+ * In a module of its own so that `PaymentRequiredError` can extend it while
+ * `HttpClient`, which throws both, imports `PaymentRequiredError`: with the
+ * class in `HttpClient.ts`, the two modules would import each other, and
+ * whichever loaded second would extend a class not yet defined. `HttpClient`
+ * re-exports it, so `import { HttpError } from "./HttpClient"` still works.
+ */
+/** Thrown for any non-2xx accelerator response. Carries the HTTP status. */
+declare class HttpError extends Error {
+    readonly status: number;
+    readonly body?: unknown | undefined;
+    constructor(message: string, status: number, body?: unknown | undefined);
+}
+
+/**
+ * `PaymentRequiredError` — a write the accelerator refused for payment
+ * (accelerator spec 2026-10-06-paid-accounts-and-past-due, "Interfaces and
+ * contracts").
+ *
+ * The accelerator answers such a write with a 402 whose body carries one of
+ * three codes:
+ *   - `user_plan_required`: the app takes paid Muhkoo plans only, and the
+ *     signed-in user is on Free;
+ *   - `user_payment_past_due`: the user's own Muhkoo payment is past due. Only
+ *     first-party apps are told this; every other app is told
+ *     `user_plan_required` instead;
+ *   - `owner_payment_past_due`: the app owner's payment is past due, so the
+ *     app stores nothing new for anyone.
+ * Reads, sign-in and deletes still work in all three cases.
+ *
+ * Every other 402 — the Free-tier refusals that carry `quotaExceeded`,
+ * `requiresPaidTier` or `freeTierFull` — has no `code`, and stays a plain
+ * `HttpError`, as before.
+ */
+
+/** Why a write was refused for payment. A wire contract: these strings never change. */
+type PaymentRequiredCode = "user_plan_required" | "user_payment_past_due" | "owner_payment_past_due";
+/** Thrown for a 402 whose body carries one of the three {@link PaymentRequiredCode}s. */
+declare class PaymentRequiredError extends HttpError {
+    /** Why the write was refused. */
+    readonly code: PaymentRequiredCode;
+    /**
+     * Where to send the user: the portal's upgrade page or its billing page,
+     * as an absolute URL. Set only when the server sent an absolute http(s)
+     * URL. The relative `upgradeUrl` of the Free-tier refusals is never here:
+     * those are not this error.
+     */
+    readonly upgradeUrl?: string;
+    constructor(message: string, code: PaymentRequiredCode, body?: unknown, upgradeUrl?: string);
+}
+
 /**
  * Cloudflare-Workers-compatible Groth16 ZK proof verifier.
  *
@@ -2416,6 +2469,15 @@ interface ShardClientOptions {
      * Provided so callers can inject retries / auth / instrumentation.
      */
     fetch?: typeof fetch;
+    /**
+     * The same fetch with the client's silent re-authentication
+     * (`HttpClient.fetchWithRecovery`), used for uploads only. A paid-only
+     * app refuses a PUT made with a dead session with `401 session_required`;
+     * through this, the session is re-established once and the PUT sent
+     * again, which is safe because its bytes can be sent twice. Reads keep
+     * {@link fetch}. Defaults to {@link fetch}.
+     */
+    fetchWithRecovery?: typeof fetch;
     /**
      * Optional offline byte cache. When present, GETs are served cache-first and
      * populated on success, and PUTs write the cache before the network so a
@@ -2462,6 +2524,8 @@ declare class ShardClient {
     private readonly baseUrl;
     private readonly pathPrefix;
     private readonly fetchFn;
+    /** What a PUT goes through: {@link ShardClientOptions.fetchWithRecovery} when given, else {@link fetchFn}. */
+    private readonly putFn;
     private readonly cache?;
     /** Hashes waiting for the next batch, each with everyone awaiting it and its size if a caller gave it. */
     private pendingShards;
@@ -2725,6 +2789,25 @@ declare class FileStorage {
      * origin) and per-chunk auth as {@link readFileFromShards}.
      */
     readChunksFromShards(manifest: FileManifest): AsyncGenerator<Uint8Array>;
+    /**
+     * Each chunk's plaintext, in order, with the next {@link READ_AHEAD_CHUNKS}
+     * already being fetched.
+     *
+     * One chunk at a time, a large file cost a full round trip per 4 MB chunk
+     * with nothing overlapping it: a 33 MB file was eight serial requests,
+     * each mostly waiting. Within a chunk the shard reads were already
+     * parallel; this overlaps the chunks too.
+     *
+     * Bounded on purpose: while the caller holds a yielded chunk, at most
+     * `1 + READ_AHEAD_CHUNKS` more are in flight, and nothing new starts until
+     * it asks for the next — a slow consumer of the stream is not run away
+     * from. A failure surfaces at its own chunk, in order; reads already
+     * started past it are let finish, their failures swallowed rather than
+     * left unhandled. If the caller stops early (`break` or `return()`), no
+     * further read starts and the ones in flight settle on their own; they are
+     * not awaited, so `return()` is not delayed by a slow shard.
+     */
+    private chunksInOrder;
     /** As {@link writeFileToShards}, plus POSTs the manifest to `input.spaceId`. */
     writeFile(input: WriteFileInput): Promise<FileStat>;
     /** As {@link readFileFromShards}, but fetches the manifest from a space first. */
@@ -3895,12 +3978,7 @@ interface HttpClientOptions {
      */
     onUnauthorized?: () => Promise<boolean>;
 }
-/** Thrown for any non-2xx accelerator response. Carries the HTTP status. */
-declare class HttpError extends Error {
-    readonly status: number;
-    readonly body?: unknown | undefined;
-    constructor(message: string, status: number, body?: unknown | undefined);
-}
+
 declare class HttpClient {
     readonly baseUrl: string;
     /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
@@ -4052,6 +4130,14 @@ interface QueueEntry {
     method: string;
     /** Serializable arguments captured at enqueue time. */
     args: unknown;
+    /**
+     * Whose write it is: the commitment of the user signed in when it was
+     * queued, stamped by `OutboundQueue.enqueue`. A drain sends only the
+     * signed-in user's entries, because every replayer builds its request
+     * from the session signed in when it runs. Absent on entries an older
+     * SDK queued, which any drain sends, as before.
+     */
+    commitment?: string;
 }
 interface OfflineEntry<T> {
     key: string;
@@ -4091,9 +4177,14 @@ interface OfflineStore {
  * mutation by re-invoking the real namespace method (with an `isReplay` flag so
  * it doesn't re-enqueue). `drain()` replays entries in HLC order:
  *   - success → remove the entry;
- *   - permanent failure (4xx, or a Space whose member list refuses this user)
- *     → drop it and surface a `SYNC_ERROR` (a write the server will never
- *     accept must not wedge the queue forever);
+ *   - refused for payment (`PaymentRequiredError`: the app takes paid plans
+ *     only, or someone's payment is past due) → keep it and everything after
+ *     it, stop, and surface a `SYNC_ERROR` with `dropped: false`. The server
+ *     accepts it once the user or the app owner pays, so it waits for the next
+ *     reconnect, or for `client.app.access()` to report the app allowed;
+ *   - permanent failure (any other 4xx, or a Space whose member list refuses
+ *     this user) → drop it and surface a `SYNC_ERROR` (a write the server will
+ *     never accept must not wedge the queue forever);
  *   - transient/network failure → stop draining and leave the rest for the next
  *     reconnect.
  *
@@ -4121,7 +4212,11 @@ interface OutboundQueueOptions {
      * tests), every drain runs, as before.
      */
     tryLock?: TryLock;
-    /** Whose drain lock to take: the signed-in user's. With no one signed in, the drain runs unlocked. */
+    /**
+     * The signed-in user: stamps each enqueued write, picks which writes a
+     * drain sends, and names the drain lock. With no one signed in, writes are
+     * unstamped and the drain runs unlocked.
+     */
     commitment?: () => string | null;
 }
 declare class OutboundQueue {
@@ -4132,10 +4227,25 @@ declare class OutboundQueue {
     constructor(store: OfflineStore, opts?: OutboundQueueOptions);
     /** A domain registers how to replay its mutations. */
     register(domain: QueueEntry["domain"], replayer: Replayer): void;
-    /** Record a mutation for later replay; resolves with its assigned seq. */
+    /**
+     * Record a mutation for later replay; resolves with its assigned seq.
+     * Stamped with the signed-in user's commitment, so that it is only ever
+     * sent under their session (see {@link waiting}).
+     */
     enqueue(entry: Omit<QueueEntry, "seq">): Promise<number>;
-    /** Number of writes still awaiting sync. */
+    /** Number of writes still awaiting sync, every user's. */
     pending(): Promise<number>;
+    /**
+     * The writes a drain would send now, in order: the signed-in user's, and
+     * any an older SDK queued without saying whose they are. Every tab of an
+     * origin shares this queue, and every replayer builds its request from
+     * the session signed in when it runs, so another user's write sent now
+     * would land in this user's space, or overwrite their data. It stays
+     * queued, as it is, until its own user signs in on this device again.
+     */
+    waiting(): Promise<QueueEntry[]>;
+    /** True for an entry this drain may send: the signed-in user's, or one with no user. */
+    private sendable;
     /**
      * Replay queued mutations in HLC order. Coalesces concurrent calls into a
      * single in-flight drain. Stops on the first transient failure, leaving the
@@ -4149,6 +4259,10 @@ declare class OutboundQueue {
      * a drain after it finds only what it left.
      */
     private drainOnce;
+    /**
+     * One pass over the queue. False when a write refused for payment stopped
+     * it, which leaves that write and everything after it queued.
+     */
     private runDrain;
 }
 
@@ -4307,6 +4421,16 @@ declare class OfflineManager {
      * replayer re-PUTs from the cache on reconnect.
      */
     deferShardUpload(hash: string): Promise<void>;
+    /**
+     * Replay the queue now, as a reconnect does, if anything is waiting in it.
+     * `client.app.access()` calls this each time it reports the app allowed,
+     * so writes kept after a refusal for payment go out once the user or the
+     * app owner has paid, without waiting for the next reconnect. One drain per
+     * call, never on a timer. With nothing of the signed-in user's queued it
+     * does not drain at all, so the app sees no "syncing". A drain also runs the
+     * catch-up tasks (Space history paging), as a reconnect does.
+     */
+    resume(): Promise<void>;
     /** Resolve once the clock + node id are loaded. */
     ready(): Promise<void>;
     /** Current connectivity state (`online` | `offline` | `syncing`). */
@@ -5447,6 +5571,12 @@ interface SpaceDeps {
     httpBaseUrl: string;
     /** Header-injecting fetch from the client's HttpClient. */
     fetch: typeof fetch;
+    /**
+     * The same fetch with the client's silent 401 recovery (`HttpClient.fetchWithRecovery`). File uploads
+     * use it, so a PUT made with a dead session re-establishes the session once instead of failing.
+     * Defaults to {@link fetch}.
+     */
+    fetchWithRecovery?: typeof fetch;
     /** Resolves the user id used for the ratchet / member id (signed-in username). */
     myId: () => string;
     /** Resolves a short-lived WS upgrade ticket (or null when keyless). */
@@ -6583,6 +6713,68 @@ declare class AccessTokensNamespace {
     private path;
 }
 
+/**
+ * `client.app` — what the signed-in user may do in this app (accelerator spec
+ * 2026-10-06-paid-accounts-and-past-due, B6 and B8).
+ *
+ * An app's owner can turn on "Paid Muhkoo accounts only" in the portal. The
+ * accelerator then refuses a Free user's writes that add data, with a 402 the
+ * SDK throws as `PaymentRequiredError`. Reads, sign-in and deletes still work.
+ * The same refusal reaches every user of an app whose owner's payment is past
+ * due, whether or not the setting is on.
+ *
+ * `access()` asks up front, so an app can show the right screen before the
+ * first refusal.
+ */
+
+/** The answer of `GET /api/app/access`. */
+interface AppAccess {
+    /** The owner has turned on "Paid Muhkoo accounts only" for this app. */
+    paidAccountsOnly: boolean;
+    /** The signed-in user may add data in this app now. */
+    allowed: boolean;
+    /**
+     * Why not: the code a refused write carries. Read only when `allowed` is
+     * false, and only when it is one of the three codes.
+     */
+    reason?: PaymentRequiredCode;
+    /**
+     * Where to send the user, as an absolute URL: the portal's upgrade page
+     * for `user_plan_required`, with a way back to this app when the request
+     * came from one of its registered redirect URIs, or its billing page for
+     * `user_payment_past_due`. The accelerator sends it only for those two
+     * reasons: the user can do nothing about the owner's payment. Read only
+     * when `allowed` is false, and only when it is an absolute http(s) URL.
+     */
+    upgradeUrl?: string;
+}
+interface AppNamespaceDeps {
+    http: HttpClient;
+    /**
+     * Called each time `access()` answers `allowed: true`. The Client sends
+     * the writes its offline queue kept after a refusal for payment
+     * (`OfflineManager.resume`). A throw or a rejection is logged and ignored.
+     */
+    onAllowed?: () => Promise<void>;
+}
+declare class AppNamespace {
+    private readonly deps;
+    constructor(deps: AppNamespaceDeps);
+    /**
+     * Whether the signed-in user may add data in this app and, if not, why
+     * and where to send them. Needs the app key and a session; a stale session
+     * is re-established once, as for every request. The route is never
+     * refused for payment. Throws `HttpError` for anything else, among them a
+     * 401 without a session and a 404 from an accelerator older than the
+     * route.
+     *
+     * Each `allowed: true` also sends any writes the offline queue kept after
+     * a refusal for payment, without waiting for them. Call it after sign-in,
+     * and again when the user comes back from the portal.
+     */
+    access(): Promise<AppAccess>;
+}
+
 /**
  * Wire types for the VFS metadata layer.
  *
@@ -8207,6 +8399,8 @@ declare class Client {
     readonly functions: FunctionsNamespace;
     /** Access tokens — `client.accessTokens.create(appId, …)`, etc. */
     readonly accessTokens: AccessTokensNamespace;
+    /** This app — `client.app.access()`: may the signed-in user add data here? */
+    readonly app: AppNamespace;
     /** Offline cache + sync — `client.offline.status`, `client.offline.snapshot`, etc. */
     readonly offline: OfflineManager;
     private readonly session;
@@ -9493,7 +9687,7 @@ declare function getId(row: {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-declare const VERSION = "0.15.0-alpha.4";
+declare const VERSION = "0.15.0-alpha.6";
 
 /**
  * The SDK's process-global logger.
@@ -9525,5 +9719,5 @@ declare global {
 }
 declare const appLogger: InstanceType<typeof Logger>;
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
-export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AdmissionState, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChatKeyCert, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, MemberView, MembershipEntry, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role$1 as Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, SpaceTrustCode, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AppNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PaymentRequiredError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export type { ACL, ACLEntry, AccessTokenInfo, AccessTokensNamespaceDeps, AdmissionState, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AppAccess, AppNamespaceDeps, AttachedPeerNetwork, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, BlockStore, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, CachedSpaceMessage, Change, ChannelLike, ChatKeyCert, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitIntegrity, CircuitUrls, ClientOptions, Commit, Conflict, ConnectivityOptions, ConnectivityState, CreateAccessTokenInput, CreatedAccessToken, DbFilterOp, DbNamespaceDeps, DbQuery, DbQueryPage, DbQueryResult, DbWhereCondition, DehydratedKeypair, DehydratedKeys, DeviceBlobStore, DeviceKeyVault, DevicePairingErrorReason, DevicePairingKeypair, DevicePairingPoll, DevicePairingRequest, DevicePairingSession, DirEntry, DirNode, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EngineHandle, EngineHost, Entry, EphemeralEvent, EpochKeyProvider, FileEntry, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, Hasher, Head, HistoryRecord, HlcParts, HlcState, HostedAuthDeps, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvEntry, KvNamespaceDeps, LogEntry, LoginOptions, LwwMap, LwwRegister, MemberView, MembershipEntry, Merge3Result, MergeRegionConflict, MergeResult, MessageBody, MessageDeletedEvent, MessageEntry, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOp, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooKeystoreBridge, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, OfflineEntry, OfflineManagerDeps, OfflineStore, OutSink, PacketCipher, PacketHeaders, PacketOptions, PairedDevice, Participant, PasskeyEnrollment, PaymentRequiredCode, PeerBlockSource, PeerExchangeOptions, PeerId, PeerNetworkOptions, PeerTransport, Permission, PermissionCheckRequest, PermissionCheckResult, PersistedDeviceIdentity, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, QueueEntry, RatchetState, ReceiveResult, RegisterParams, Replayer, Role$1 as Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, Scope, SealedHandoff, SealedHeaders, SealedRecord, Session, SessionOptions, SessionStore, SetOptions, ShardByteCache, ShardClientOptions, SharedSpaceClientOptions, SignalEnvelope, SignalKind, SignalingSpace, SnapshotNamespaceDeps, SnarkProof, SpaceChannelLike, SpaceCursor, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, SpaceOfflineAdapter, SpaceTrustCode, StartDevicePairingOptions, StorageChangeEvent, StoreName, StoredSession, Subscription, Tree, TreeDir, TreeEntry, TreeFile, UserIdentity, VaultFactor, VcsNamespaceDeps, VcsNamespaceOptions, VerificationKey, VfsContentStore, VfsNamespaceDeps, VfsStat, VfsStore, WSMessage, WSMessageType, WSTransportOptions, WaitForDevicePairingOptions, WebRtcTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };

package/dist/connect.workers.d.ts

@@ -1179,6 +1179,59 @@ declare class BroadcastChannel {
     private handleInboundFrame;
 }
 
+/**
+ * `HttpError` — thrown for any non-2xx accelerator response.
+ *
+ * In a module of its own so that `PaymentRequiredError` can extend it while
+ * `HttpClient`, which throws both, imports `PaymentRequiredError`: with the
+ * class in `HttpClient.ts`, the two modules would import each other, and
+ * whichever loaded second would extend a class not yet defined. `HttpClient`
+ * re-exports it, so `import { HttpError } from "./HttpClient"` still works.
+ */
+/** Thrown for any non-2xx accelerator response. Carries the HTTP status. */
+declare class HttpError extends Error {
+    readonly status: number;
+    readonly body?: unknown | undefined;
+    constructor(message: string, status: number, body?: unknown | undefined);
+}
+
+/**
+ * `PaymentRequiredError` — a write the accelerator refused for payment
+ * (accelerator spec 2026-10-06-paid-accounts-and-past-due, "Interfaces and
+ * contracts").
+ *
+ * The accelerator answers such a write with a 402 whose body carries one of
+ * three codes:
+ *   - `user_plan_required`: the app takes paid Muhkoo plans only, and the
+ *     signed-in user is on Free;
+ *   - `user_payment_past_due`: the user's own Muhkoo payment is past due. Only
+ *     first-party apps are told this; every other app is told
+ *     `user_plan_required` instead;
+ *   - `owner_payment_past_due`: the app owner's payment is past due, so the
+ *     app stores nothing new for anyone.
+ * Reads, sign-in and deletes still work in all three cases.
+ *
+ * Every other 402 — the Free-tier refusals that carry `quotaExceeded`,
+ * `requiresPaidTier` or `freeTierFull` — has no `code`, and stays a plain
+ * `HttpError`, as before.
+ */
+
+/** Why a write was refused for payment. A wire contract: these strings never change. */
+type PaymentRequiredCode = "user_plan_required" | "user_payment_past_due" | "owner_payment_past_due";
+/** Thrown for a 402 whose body carries one of the three {@link PaymentRequiredCode}s. */
+declare class PaymentRequiredError extends HttpError {
+    /** Why the write was refused. */
+    readonly code: PaymentRequiredCode;
+    /**
+     * Where to send the user: the portal's upgrade page or its billing page,
+     * as an absolute URL. Set only when the server sent an absolute http(s)
+     * URL. The relative `upgradeUrl` of the Free-tier refusals is never here:
+     * those are not this error.
+     */
+    readonly upgradeUrl?: string;
+    constructor(message: string, code: PaymentRequiredCode, body?: unknown, upgradeUrl?: string);
+}
+
 /**
  * Cloudflare-Workers-compatible Groth16 ZK proof verifier.
  *
@@ -1221,5 +1274,5 @@ declare function initBn128Wasm(wasmModule?: WebAssembly.Module): Promise<Bn128Wa
  */
 declare function verifyGroth16(wasmInstance: WebAssembly.Instance, memory: WebAssembly.Memory, initialPFree: number, verificationKey: VerificationKey, proof: Groth16Proof, publicSignals: string[]): Promise<boolean>;
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, BroadcastChannel, BroadcastChannelEvents, ChunkCipher, DoubleRatchet, EncryptedSession, EventCore, EventCoreEvents, KeyStore, Message, Message as MessageDefault, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, SerializeMessage, WSTransport, decorators, decryptAesGcm, deriveAesKeyFromPassphrase, deriveBitsHkdf, encryptAesGcm, getSubtle, initBn128Wasm, randomBytes, unwrapWithPassphrase, verifyGroth16, wrapWithPassphrase };
-export type { ACL, ACLEntry, AuthKeyPair, AuthType, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, ChunkKeyMaterial, CipherFrame, CipherMessage, CipherMessageHeader, DehydratedKeypair, DehydratedKeys, ECDHCurve, Groth16Proof, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, MessageBody, MessageEvent, MessageHeaders, MessageOptions, OAuthProvider, PacketOptions, Participant, Permission, PermissionCheckRequest, PermissionCheckResult, PublicKeyJWK, RatchetState, ReceiveResult, Role, Session, SessionOptions, Subscription, UserIdentity, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload };
+export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, BroadcastChannel, BroadcastChannelEvents, ChunkCipher, DoubleRatchet, EncryptedSession, EventCore, EventCoreEvents, KeyStore, Message, Message as MessageDefault, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PaymentRequiredError, SerializeMessage, WSTransport, decorators, decryptAesGcm, deriveAesKeyFromPassphrase, deriveBitsHkdf, encryptAesGcm, getSubtle, initBn128Wasm, randomBytes, unwrapWithPassphrase, verifyGroth16, wrapWithPassphrase };
+export type { ACL, ACLEntry, AuthKeyPair, AuthType, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, ChunkKeyMaterial, CipherFrame, CipherMessage, CipherMessageHeader, DehydratedKeypair, DehydratedKeys, ECDHCurve, Groth16Proof, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, MessageBody, MessageEvent, MessageHeaders, MessageOptions, OAuthProvider, PacketOptions, Participant, PaymentRequiredCode, Permission, PermissionCheckRequest, PermissionCheckResult, PublicKeyJWK, RatchetState, ReceiveResult, Role, Session, SessionOptions, Subscription, UserIdentity, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload };