@muhkoo/connect 0.4.0-alpha.1 → 0.6.0-alpha.11

package/dist/connect.d.ts

@@ -1812,6 +1812,16 @@ interface AuthSuccess {
     token: string;
     username: string;
 }
+/** A vault factor record (M1.0). Wrap/iv are base64 AES-GCM; absent for phrase. */
+interface VaultFactor {
+    id: string;
+    type: "password" | "passkey" | "phrase-marker";
+    wrap?: string;
+    iv?: string;
+    params?: Record<string, unknown>;
+    label?: string;
+    createdAt?: number;
+}
 interface AuthClientOptions {
     /** Absolute URL of the accelerator worker (no trailing slash required). */
     baseUrl: string;
@@ -1836,6 +1846,28 @@ declare class AuthClient {
     verify(token: string): Promise<{
         username: string;
     }>;
+    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
+    oprfEvaluate(username: string, blinded: string): Promise<{
+        evaluated: string;
+    }>;
+    /** Read a factor record for `username` (returns an indistinguishable decoy if absent). */
+    vaultRead(username: string, factorType: VaultFactor["type"]): Promise<{
+        factor: VaultFactor | null;
+    }>;
+    /** Add/replace a factor (session-authed; the seed is already wrapped client-side). */
+    vaultPutFactor(token: string, factor: VaultFactor): Promise<{
+        ok: boolean;
+        id: string;
+    }>;
+    /** List the user's factor metadata (no ciphertext). Session-authed. */
+    vaultFactors(token: string): Promise<{
+        factors: VaultFactor[];
+        migrated: boolean;
+    }>;
+    /** Remove a factor by id (can't remove the last one). Session-authed. */
+    vaultDeleteFactor(token: string, id: string): Promise<{
+        deleted: boolean;
+    }>;
     private json;
     private parse;
 }
@@ -1882,6 +1914,23 @@ interface ZkIdentity {
  * devices.
  */
 declare function deriveIdentity(username: string, password: string): Promise<ZkIdentity>;
+/**
+ * Legacy master-seed derivation: `PBKDF2(password, "muhkoo-zk-v1:"||username)`.
+ *
+ * This was the *only* path pre-vault, where the identity descended directly from
+ * the password. It's kept so existing accounts still re-derive their seed (and
+ * the vault can adopt that exact seed on migration, preserving the commitment).
+ * New accounts use a random seed (`vault.randomSeed`) instead, so their identity
+ * is no longer a function of the password.
+ */
+declare function deriveMasterSeedFromPassword(username: string, password: string): Promise<Uint8Array>;
+/**
+ * Derive the (unchanged) ZK identity from a 32-byte **master seed**. The seed is
+ * HKDF-expanded into secret/salt + the P-256 ECDSA & ECDH keypairs exactly as
+ * before — so the resulting commitment is byte-identical for a given seed. The
+ * vault wraps THIS seed under each recovery factor.
+ */
+declare function deriveIdentityFromSeed(seed: Uint8Array): Promise<ZkIdentity>;
 
 /**
  * Poseidon hash wrapper used by the ZK auth flow.
@@ -2083,6 +2132,10 @@ declare function defaultSessionStore(keyPrefix?: string): SessionStore;
 declare class SessionState {
     private session;
     private _identity;
+    /** The 32-byte master seed, in-memory only (never persisted). Held after
+     *  login/register so additional recovery factors (passkey, phrase) can be
+     *  enrolled, and a password can be changed, without re-deriving. */
+    private _seed;
     private readonly store;
     constructor(store?: SessionStore);
     /** True once a token-bearing session exists (regardless of identity). */
@@ -2099,6 +2152,10 @@ declare class SessionState {
     setSession(session: StoredSession): Promise<void>;
     /** Attach derived identity material to the current session. */
     setIdentity(identity: ZkIdentity): void;
+    /** The in-memory master seed (or null when locked / not held). */
+    get seed(): Uint8Array | null;
+    /** Hold the master seed in memory (set on login/register when available). */
+    setSeed(seed: Uint8Array | null): void;
     /** Load a persisted session (used by `restore()`); identity stays null. */
     loadPersisted(): Promise<StoredSession | null>;
     /** Drop all session + identity state and clear persistence. */
@@ -2122,6 +2179,17 @@ declare class SessionState {
  * at-rest encryption and the messaging ratchet without re-deriving.
  */
 
+/**
+ * Thrown when the identity vault can't be reached to unlock the seed — a network
+ * failure, a 5xx, or the per-user rate limit (429). This is distinct from a wrong
+ * password, and is surfaced so `login`/`unlock` do NOT silently fall back to the
+ * legacy password derivation (which, for a vault account, yields a misleading
+ * "commitment mismatch"). Callers should ask the user to retry, not re-enter a
+ * password.
+ */
+declare class VaultUnavailableError extends Error {
+    constructor(cause?: unknown);
+}
 /** What the auth methods resolve to — the stable, non-secret user facts. */
 interface AuthUser {
     username: string;
@@ -2152,17 +2220,26 @@ declare class ZkAuth {
     private readonly deps;
     constructor(deps: ZkAuthDeps);
     /**
-     * Register a new user, then (by default) sign them in. The identity is
-     * derived deterministically from `(username, password)` — the same inputs
-     * reproduce it on any device, so there's no key material to ship around.
+     * Register a new user, then (by default) sign them in.
+     *
+     * M1.0: the identity now descends from a **random master seed** (not the
+     * password), so it's recoverable + the password can be changed. We register
+     * the commitment, sign in with the in-memory identity to get a token, then
+     * enroll the OPRF-gated **password factor** (the seed wrapped under a key the
+     * server can't derive offline). Future logins unlock the seed via that factor.
      */
     register(params: RegisterParams): Promise<AuthUser>;
     /**
-     * Sign in: re-derive the identity, prove knowledge of it against a fresh
-     * server challenge, and trade the proof for a session token. On success
-     * both the session and the identity are stored on the client.
+     * Sign in. M1.0 is **vault-first**: read the password factor and OPRF-unwrap
+     * the master seed → identity. If that fails (a pre-vault account, whose factor
+     * is absent so the server returns a decoy, or a wrong password), fall back to
+     * the legacy password-derived identity. Either way we then prove knowledge of
+     * the identity and trade it for a session token.
      */
     login(username: string, password: string, opts?: LoginOptions): Promise<AuthUser>;
+    /** Enroll the password factor for a legacy (pre-vault) account. Idempotent +
+     *  best-effort; failure just means we retry on the next login. */
+    private migrateLegacyPasswordFactor;
     /**
      * Silently re-authenticate the current user without prompting for a
      * password. Only possible while the client is **unlocked** — i.e. the
@@ -2200,6 +2277,60 @@ declare class ZkAuth {
      * the password by checking the derived commitment matches the session's.
      */
     unlock(password: string): Promise<void>;
+    /**
+     * Generate a 24-word **recovery phrase** that encodes the master seed, and
+     * record a marker in the vault so the UI knows one exists. Show the returned
+     * phrase to the user ONCE — it's never stored server-side (the phrase *is* the
+     * seed). Requires being signed in (the seed must be held in memory).
+     */
+    enrollRecoveryPhrase(): Promise<string>;
+    /**
+     * Recover an account with its recovery phrase (the "forgot password" path).
+     * Decodes the phrase to the master seed → identity → session. After this,
+     * call {@link changePassword} to set a new password. No server lookup needed.
+     */
+    recoverWithPhrase(username: string, mnemonic: string, opts?: LoginOptions): Promise<AuthUser>;
+    /**
+     * Change the password — re-wraps the (unchanged) master seed under the new
+     * password's OPRF-gated key. The identity/commitment never moves. Requires
+     * being signed in (or freshly recovered) so the seed is held.
+     */
+    changePassword(newPassword: string): Promise<void>;
+    /** Whether this browser can use passkeys (WebAuthn) at all. */
+    passkeyAvailable(): boolean;
+    /**
+     * Whether this browser's authenticator can do the **PRF extension** our
+     * passkey factor requires. A browser may support passkeys generally but not
+     * PRF — in which case enrolling one would fail. Resolves `true`/`false`, or
+     * `null` when it can't be determined (no capabilities API). Use this to gate
+     * the passkey UI so users don't hit a dead-end error.
+     */
+    passkeyPrfAvailable(): Promise<boolean | null>;
+    /**
+     * Add a **passkey** recovery factor. Creates a WebAuthn passkey with PRF,
+     * wraps the master seed under its PRF output, and stores the factor. The
+     * passkey (synced via the platform's keychain) then unlocks the account on
+     * any device — no password. Requires being signed in (seed held in memory).
+     */
+    enrollPasskey(opts?: {
+        rpId?: string;
+        rpName?: string;
+        label?: string;
+    }): Promise<void>;
+    /**
+     * Sign in with a passkey (no password). Reads the passkey factor, evaluates
+     * its PRF, unwraps the master seed → identity → session.
+     */
+    loginWithPasskey(username: string, opts?: LoginOptions): Promise<AuthUser>;
+    /** List the user's enrolled login methods (metadata only). Session-authed. */
+    listFactors(): Promise<Array<{
+        id: string;
+        type: string;
+        label?: string;
+        createdAt?: number;
+    }>>;
+    /** Remove a login method by id (can't remove your only one). Session-authed. */
+    removeFactor(id: string): Promise<void>;
     /** Sign out: clears the session, identity, and persisted token. */
     logout(): Promise<void>;
     /** The signed-in user, or `null`. Synchronous read of current state. */
@@ -2213,8 +2344,43 @@ declare class ZkAuth {
     get identity(): ZkIdentity | null;
     /** The current session token, or `null` when signed out. */
     get token(): string | null;
+    /**
+     * The master seed as base64, or `null` when locked. The host app uses this to
+     * wrap app-level data (e.g. chat ratchet keys) to the **seed** instead of the
+     * password — so that data survives password changes and can be unlocked by a
+     * passwordless (passkey) login, both of which recover the same seed.
+     */
+    get seedBase64(): string | null;
     /** Poseidon commitment for an identity — the value the server stores. */
     private commitmentFor;
+    /**
+     * Derive the OPRF-gated wrap key for the password factor: `scrypt(password)`
+     * is blinded, evaluated by the server's secret OPRF key (so it can't be
+     * derived offline), unblinded, then HKDF'd into an AES-GCM key.
+     */
+    private passwordWrapKey;
+    /**
+     * Try to recover the master seed from the password factor.
+     *
+     * Returns `null` only when the vault read SUCCEEDS but the seed can't be
+     * unwrapped — i.e. there's no real factor (a pre-vault/legacy account, whose
+     * read returns a decoy that won't unwrap) or the password is wrong. The caller
+     * then legitimately falls back to the legacy password-derived identity.
+     *
+     * Throws {@link VaultUnavailableError} when the vault itself can't be reached
+     * (network / 5xx / rate-limit) — so a *transient* failure is NOT silently
+     * turned into a legacy fallback (which would surface as "commitment mismatch").
+     */
+    private tryUnlockSeed;
+    /**
+     * Enroll/replace the password factor for `username` — wraps `seed` under the
+     * OPRF-gated key and stores it (needs a session `token`).
+     *
+     * Retries: this is the step that persists the (otherwise in-memory-only)
+     * master seed. If it fails after a fresh registration the account would be
+     * unrecoverable, so we retry a few times before surfacing the error.
+     */
+    private enrollPasswordFactor;
 }
 /** `client.auth` — the auth namespace. Strategies hang off here. */
 declare class AuthNamespace {
@@ -2373,6 +2539,101 @@ declare class KvNamespace {
     private getCipher;
 }
 
+/**
+ * `client.db` — the app's scalable database. A developer defines tables in the
+ * Muhkoo portal (columns + indexes); each table is backed by its own Durable
+ * Object SQLite instance and reachable through a sanitized REST gateway. This
+ * namespace wraps that gateway:
+ *
+ *   const todos = client.db.table('todos');
+ *   const { id } = await todos.insert({ title: 'Buy milk', done: false });
+ *   const one    = await todos.get(id);
+ *   const { rows, nextCursor } = await todos.query({
+ *     where: [{ column: 'done', op: 'eq', value: false }],
+ *     orderBy: { column: 'rank', dir: 'asc' },
+ *     limit: 50,
+ *   });
+ *   await todos.update(id, { done: true });
+ *   await todos.delete(id);
+ *
+ * Authorization is the **app key** ({@link HttpClient} stamps it on every
+ * request); the appId + environment are resolved server-side from the key, so a
+ * key can only ever reach its own app's tables. The front end never touches the
+ * database directly — this REST surface is the only gateway, and all input is
+ * validated against the table's schema (parameterized statements, column +
+ * operator allowlists). There is no raw-SQL passthrough.
+ *
+ * Schema is authored in the portal, not here (the SDK reads + writes rows, it
+ * doesn't create tables). Pagination is keyset-based: pass the `nextCursor` from
+ * a previous `query()` back as `cursor` to fetch the next page.
+ */
+
+interface DbNamespaceDeps {
+    http: HttpClient;
+}
+/** Comparison operators allowed in a {@link DbQuery} `where` clause. */
+type DbFilterOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "like" | "likeStartsWith" | "likeContains";
+interface DbWhereCondition {
+    column: string;
+    op: DbFilterOp;
+    /** Scalar for most ops; an array for `in`; a string for the `like` family. */
+    value: unknown;
+}
+interface DbQuery {
+    /** Columns to return; omit for all columns. */
+    select?: string[];
+    /** Conditions AND-combined. */
+    where?: DbWhereCondition[];
+    /** Sort by a column (defaults to the primary key, ascending). */
+    orderBy?: {
+        column: string;
+        dir?: "asc" | "desc";
+    };
+    /** Page size, clamped server-side to 100. */
+    limit?: number;
+    /** Opaque keyset cursor from a previous query's `nextCursor`. */
+    cursor?: string;
+}
+interface DbQueryResult<T = Record<string, unknown>> {
+    rows: T[];
+    /** Cursor for the next page, or `null` when the last page was returned. */
+    nextCursor: string | null;
+}
+/** A handle to one table — the ergonomic surface for row operations. */
+declare class DbTable<T extends Record<string, unknown> = Record<string, unknown>> {
+    private readonly http;
+    private readonly name;
+    constructor(http: HttpClient, name: string);
+    private base;
+    /** Insert a row. Returns the created row and its primary-key value. */
+    insert(values: Partial<T>): Promise<{
+        row: T;
+        id: unknown;
+    }>;
+    /** Fetch a row by primary key, or `null` if it doesn't exist. */
+    get(id: string | number): Promise<T | null>;
+    /** Query rows with filters, ordering, and keyset pagination. */
+    query(query?: DbQuery): Promise<DbQueryResult<T>>;
+    /** Update a row by primary key. Returns the updated row. */
+    update(id: string | number, values: Partial<T>): Promise<{
+        row: T;
+    }>;
+    /** Delete a row by primary key. Returns the number of rows removed (0 or 1). */
+    delete(id: string | number): Promise<number>;
+}
+declare class DbNamespace {
+    private readonly deps;
+    constructor(deps: DbNamespaceDeps);
+    /**
+     * A handle to a table defined in the portal. The optional type parameter
+     * gives row operations a typed shape:
+     *
+     *   interface Todo { _id: number; title: string; done: boolean }
+     *   const todos = client.db.table<Todo>('todos');
+     */
+    table<T extends Record<string, unknown> = Record<string, unknown>>(name: string): DbTable<T>;
+}
+
 /**
  * `client.storage` — file storage. Hides the `FileStorage` / `ShardClient` /
  * `SharedSpaceClient` primitives behind the unified client.
@@ -3228,11 +3489,41 @@ declare class SpaceNamespace {
  * (viewers can read). Authorization rides the user session token; non-owner
  * editors pass their management Space via `opts.space`.
  *
- * v1 is "prompts + persona": a system prompt, a model, named prompt `skills`,
- * and `triggers` that decide when the agent speaks. No tools, no code.
+ * An agent is "prompts + persona": a system prompt, a model, named prompt
+ * `skills`, and `triggers` that decide when it speaks — plus optional `tools`
+ * that let it act on the app (query/write its database, call its functions,
+ * resolve its channels) via a server-side function-calling loop. See
+ * {@link AgentToolsConfig}. Pair with the `@MuhkooAgent`/`@MuhkooSpace`/
+ * `@MuhkooDB`/`@MuhkooFunction` decorators + `ejectAgentPrompt`/`ejectAgentTools`
+ * to generate `systemPrompt` and `tools` straight from your app's surface.
  */
 
 type AgentTriggerType = "mention" | "keyword" | "regex" | "always";
+/** How much database access the agent's tool-use has. */
+type AgentDbToolMode = "off" | "read" | "write";
+/**
+ * Tool-use config — lets the agent act on the app through a function-calling
+ * loop. Opt-in and conservatively gated server-side: a fresh agent has tools
+ * off, the DB is read-only and per-table allowlisted, functions are per-name
+ * allowlisted, and channels are off. **Enabling tools requires a
+ * function-calling `model` in the same create/update payload** (the server
+ * rejects `enabled: true` otherwise). `ejectAgentTools` produces this shape.
+ */
+interface AgentToolsConfig {
+    enabled: boolean;
+    db: {
+        /** `off` = no DB tools; `read` = query/get; `write` = + insert/update/delete. */
+        mode: AgentDbToolMode;
+        /** Allowlisted table names the agent may touch. */
+        tables: string[];
+    };
+    /** Allowlisted serverless-function names the agent may call. */
+    functions: string[];
+    /** Whether the agent may resolve the app's PUBLIC channels. */
+    channels: boolean;
+    /** Max tool-call rounds per reply (1..6). */
+    maxIterations: number;
+}
 interface AgentTrigger {
     type: AgentTriggerType;
     /** Required for `keyword` (case-insensitive substring) and `regex`. */
@@ -3258,6 +3549,8 @@ interface AgentConfig {
     caps: {
         dailyTokenBudget: number;
     };
+    /** Tool-use config (absent / `enabled: false` = prompt-only). */
+    tools?: AgentToolsConfig;
     createdAt: number;
     updatedAt: number;
 }
@@ -3272,6 +3565,8 @@ interface AgentCreateInput {
     caps?: {
         dailyTokenBudget: number;
     };
+    /** Grant tool-use. Requires `model` to be a function-calling model. */
+    tools?: AgentToolsConfig;
 }
 type AgentUpdateInput = Partial<AgentCreateInput>;
 /** Create/get response — the config plus the agent's published identity keys. */
@@ -3481,6 +3776,8 @@ declare class Client {
     readonly auth: AuthNamespace;
     /** Per-user key/value storage — `client.kv.set(...)`, etc. */
     readonly kv: KvNamespace;
+    /** App scalable database — `client.db.table('todos').query(...)`, etc. */
+    readonly db: DbNamespace;
     /** File storage — `client.storage.writeFile(...)`, etc. */
     readonly storage: StorageNamespace;
     /** Realtime messaging — `client.message.subscribe(...)`, etc. */
@@ -3523,6 +3820,134 @@ declare class Client {
     recoverSession(): Promise<boolean>;
 }
 
+/**
+ * Muhkoo app decorators — declare your app's agent-facing surface in code, then
+ * "eject" a system prompt you hand to a Programmable Agent.
+ *
+ * You annotate a plain class with `@MuhkooAgent` (the app's identity + how the
+ * agent should behave) plus per-surface decorators — `@MuhkooSpace`,
+ * `@MuhkooDB`, `@MuhkooFunction` — that describe what each channel, table, and
+ * function is *for*. {@link ejectAgentPrompt} reads those annotations and
+ * produces a `systemPrompt` string:
+ *
+ * ```ts
+ * @MuhkooAgent({
+ *   name: "Chat Assistant",
+ *   purpose: "A helpful assistant inside a real-time team chat.",
+ *   guidance: ["Keep replies short.", "Only chime in when relevant."],
+ * })
+ * class ChatAssistant {
+ *   @MuhkooSpace({ description: "Main team discussion." })            general!: string;
+ *   @MuhkooDB({ access: "read", description: "Chat message history." }) messages!: unknown;
+ *   @MuhkooFunction({ description: "Open a support ticket." })         openTicket!: () => void;
+ * }
+ *
+ * const systemPrompt = ejectAgentPrompt(ChatAssistant);
+ * await client.agents.create({ handle: "assistant", displayName: "Assistant", systemPrompt });
+ * ```
+ *
+ * The ejected prompt owns the **semantic** layer — what the app is, how to act,
+ * and what each surface means. The Muhkoo runtime separately appends the
+ * **authoritative** roster (exact columns, function parameters, and the closed
+ * list of callable tools), so the prompt here never needs to restate schema and
+ * can't drift from it. Decorators only describe; they never change runtime
+ * behavior, so they're safe to apply to a throwaway descriptor class.
+ *
+ * Requires `experimentalDecorators` (already enabled in this package). Metadata
+ * is captured in a per-class registry — no `reflect-metadata` dependency.
+ */
+
+/** Whether the agent may only read a table, or read and write it. */
+type MuhkooDBAccess = "read" | "write";
+/** App-level identity + behavioral guidance — the heart of the ejected prompt. */
+interface MuhkooAgentMeta {
+    /** The agent persona's name (e.g. "Chat Assistant"). */
+    name: string;
+    /** What the app is and the agent's role in it. One or two sentences. */
+    purpose: string;
+    /** Short behavioral rules, rendered as a bulleted list. */
+    guidance?: string[];
+    /** Optional free-form instructions appended verbatim after the surface. */
+    instructions?: string;
+}
+/** A channel/Space the agent can resolve and post into. */
+interface MuhkooSpaceMeta {
+    /** Channel name. Defaults to the decorated member's name. */
+    name?: string;
+    description: string;
+}
+/** An app database table the agent can query (and optionally mutate). */
+interface MuhkooDBMeta {
+    /** Table name. Defaults to the decorated member's name. */
+    table?: string;
+    /** Read-only by default. */
+    access?: MuhkooDBAccess;
+    description: string;
+}
+/** A serverless function the agent can invoke via `call_function`. */
+interface MuhkooFunctionMeta {
+    /** Function name. Defaults to the decorated member's name. */
+    name?: string;
+    description: string;
+}
+interface SpaceEntry {
+    name: string;
+    description: string;
+}
+interface TableEntry {
+    table: string;
+    access: MuhkooDBAccess;
+    description: string;
+}
+interface FunctionEntry {
+    name: string;
+    description: string;
+}
+/** The full annotated surface gathered from one decorated class. */
+interface MuhkooAppDescriptor {
+    agent?: MuhkooAgentMeta;
+    spaces: SpaceEntry[];
+    tables: TableEntry[];
+    functions: FunctionEntry[];
+}
+/**
+ * Class decorator. Declares the app's agent identity, purpose, and behavioral
+ * guidance. Apply it to the class whose members carry the surface decorators.
+ */
+declare function MuhkooAgent(meta: MuhkooAgentMeta): ClassDecorator;
+/** Member decorator. Marks a channel/Space the agent can resolve and post to. */
+declare function MuhkooSpace(meta: MuhkooSpaceMeta): PropertyDecorator & MethodDecorator;
+/** Member decorator. Marks an app database table the agent can query/mutate. */
+declare function MuhkooDB(meta: MuhkooDBMeta): PropertyDecorator & MethodDecorator;
+/** Member decorator. Marks a serverless function the agent can call. */
+declare function MuhkooFunction(meta: MuhkooFunctionMeta): PropertyDecorator & MethodDecorator;
+/** Read back the raw descriptor a class accumulated (for tooling/tests). */
+declare function getMuhkooAppDescriptor(appClass: Function): MuhkooAppDescriptor | undefined;
+/**
+ * Compose the agent system prompt from a `@MuhkooAgent`-decorated class. Throws
+ * if the class isn't decorated. The result is the semantic layer only — the
+ * runtime appends exact schema + the closed tool list at invocation time.
+ */
+declare function ejectAgentPrompt(appClass: Function): string;
+/**
+ * The tools-config shape the Muhkoo platform uses to gate an agent. Alias of
+ * `client.agents`' {@link AgentToolsConfig} so {@link ejectAgentTools} output
+ * drops straight into `client.agents.create({ tools })`.
+ */
+type MuhkooAgentToolsConfig = AgentToolsConfig;
+/**
+ * Derive a suggested tools allowlist from a decorated class — the db tables
+ * (and whether any are writable), the callable functions, and whether channels
+ * are in play. Pair with {@link ejectAgentPrompt} when configuring the agent.
+ *
+ * If any tables/functions are present the result has `enabled: true`; to
+ * actually grant tools you must also pass a function-calling `model` in the same
+ * `client.agents.create`/`update` call (the server enforces this).
+ */
+declare function ejectAgentTools(appClass: Function, opts?: {
+    maxIterations?: number;
+}): AgentToolsConfig;
+
 /**
  * KeyringClient — HTTP implementation of {@link KeyringTransport} against the
  * accelerator's per-space keyring endpoints. All blobs are opaque to the
@@ -3583,5 +4008,5 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_BASE_URL, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, shardHash, signMessage, toField, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
-export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvNamespaceDeps, LoginOptions, MessageBody, MessageDeletedEvent, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOptions, MessageSubscription, MuhkooMessageEvent, OAuthProvider, PacketCipher, PacketHeaders, PacketOptions, Participant, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, PublicKeyJWK, RatchetState, ReceiveResult, RegisterParams, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardClientOptions, SharedSpaceClientOptions, SnarkProof, SpaceChannelLike, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, StorageChangeEvent, StoredSession, Subscription, UserIdentity, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_BASE_URL, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, VaultUnavailableError, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, shardHash, signMessage, toField, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
+export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvNamespaceDeps, LoginOptions, MessageBody, MessageDeletedEvent, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, PacketCipher, PacketHeaders, PacketOptions, Participant, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, PublicKeyJWK, RatchetState, ReceiveResult, RegisterParams, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardClientOptions, SharedSpaceClientOptions, SnarkProof, SpaceChannelLike, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, StorageChangeEvent, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };