@muhkoo/connect 0.6.0-alpha.11 → 0.7.0-alpha.3

package/dist/connect.d.ts

@@ -1812,15 +1812,17 @@ interface AuthSuccess {
     token: string;
     username: string;
 }
-/** A vault factor record (M1.0). Wrap/iv are base64 AES-GCM; absent for phrase. */
+/** A vault factor record (M1.0 + M2 gated types). Wrap/iv are base64 AES-GCM; absent for phrase. */
 interface VaultFactor {
     id: string;
-    type: "password" | "passkey" | "phrase-marker";
+    type: "password" | "passkey" | "phrase-marker" | "email" | "google";
     wrap?: string;
     iv?: string;
     params?: Record<string, unknown>;
     label?: string;
     createdAt?: number;
+    /** Display hint for gated factors ("m•••@gmail.com") — list responses only. */
+    masked?: string;
 }
 interface AuthClientOptions {
     /** Absolute URL of the accelerator worker (no trailing slash required). */
@@ -1850,12 +1852,82 @@ declare class AuthClient {
     oprfEvaluate(username: string, blinded: string): Promise<{
         evaluated: string;
     }>;
-    /** Read a factor record for `username` (returns an indistinguishable decoy if absent). */
-    vaultRead(username: string, factorType: VaultFactor["type"]): Promise<{
+    /**
+     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
+     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
+     * domains' evaluations. The recover token is consumed by this call.
+     */
+    oprfEvaluateGated(username: string, blinded: string, factorType: "email" | "google", purpose: "enroll" | "recover", verifyToken: string): Promise<{
+        evaluated: string;
+        evaluated2: string;
+    }>;
+    /**
+     * Request an email OTP. With a session `token` this is the ENROLL flow
+     * (code sent to `email`); without one it's RECOVER (code sent to the
+     * account's enrolled address — the response is uniform either way).
+     */
+    emailOtpStart(opts: {
+        token?: string;
+        email?: string;
+        username?: string;
+    }): Promise<void>;
+    /** Trade an emailed code for a single-use verifyToken (+ the proven address). */
+    emailOtpVerify(opts: {
+        code: string;
+        token?: string;
+        username?: string;
+    }): Promise<{
+        verifyToken: string;
+        email: string;
+    }>;
+    /**
+     * Verify a Google ID token (M2.3). With a session `token` it's the ENROLL
+     * gate; without, it's RECOVER/LOGIN (the Google account must already be
+     * linked). Returns a single-use verifyToken bound to the account's `sub`.
+     */
+    googleVerify(opts: {
+        idToken: string;
+        token?: string;
+        username?: string;
+    }): Promise<{
+        verifyToken: string;
+        sub: string;
+        emailHint: string | null;
+    }>;
+    /** Mint a single-use authorization code for an app (called by the hosted page; session-authed). */
+    grant(token: string, body: {
+        appId: string;
+        redirectUri: string;
+        codeChallenge: string;
+        sealedKeys: string;
+    }): Promise<{
+        code: string;
+    }>;
+    /** Exchange an authorization code + PKCE verifier for the session + sealed key material. */
+    token(body: {
+        code: string;
+        codeVerifier: string;
+        appId?: string;
+    }): Promise<{
+        sessionToken: string;
+        username: string;
+        commitment: string;
+        sealedKeys: string;
+        appId: string;
+    }>;
+    /**
+     * Read a factor record for `username` (returns an indistinguishable decoy if
+     * absent). Gated types (email) require the recover `verifyToken`.
+     */
+    vaultRead(username: string, factorType: VaultFactor["type"], verifyToken?: string): Promise<{
         factor: VaultFactor | null;
     }>;
-    /** Add/replace a factor (session-authed; the seed is already wrapped client-side). */
-    vaultPutFactor(token: string, factor: VaultFactor): Promise<{
+    /**
+     * Add/replace a factor (session-authed; the seed is already wrapped
+     * client-side). Email factors additionally require (and consume) the
+     * enroll `verifyToken`; the stored address must be the verified one.
+     */
+    vaultPutFactor(token: string, factor: VaultFactor, verifyToken?: string): Promise<{
         ok: boolean;
         id: string;
     }>;
@@ -2052,6 +2124,44 @@ declare function exportPublicKeyBase64(publicKey: CryptoKey): Promise<string>;
 /** Sign a UTF-8 `message` with an ECDSA private key. Returns base64. */
 declare function signMessage(message: string, privateKey: CryptoKey): Promise<string>;
 
+/**
+ * Hosted-auth handoff crypto (auth.muhkoo.dev — AUTH_HOSTED_PLAN.md §3).
+ *
+ * The hosted page authenticates the user and ends up holding the master seed.
+ * To pass it to the developer's app without it ever sitting server-readable or
+ * landing in browser history:
+ *
+ *   1. {@link sealSeed} generates a one-time key K_t, AES-256-GCM-seals the seed
+ *      under it, and returns the ciphertext envelope (`sealedKeys`, stored in
+ *      the grant the server relays but can't read) plus K_t (`fragmentKey`,
+ *      placed ONLY in the redirect URL fragment — fragments never hit a server).
+ *   2. The app exchanges the code for `sealedKeys`, reads K_t from the fragment,
+ *      and {@link unsealSeed} recovers the seed, then strips the fragment.
+ *
+ * Trust-equivalent to today's embedded SDK (the app still ends up with the
+ * seed) while moving credential entry onto the Muhkoo origin. The envelope is
+ * versioned so a future per-app-key handoff (v2) can swap in without a protocol
+ * change.
+ */
+interface SealedHandoff {
+    /** base64 JSON envelope — relayed by the server in the grant; server-opaque. */
+    sealedKeys: string;
+    /** base64url one-time key — rides ONLY in the redirect URL fragment. */
+    fragmentKey: string;
+}
+/** Seal the master seed under a fresh one-time key for the redirect handoff. */
+declare function sealSeed(seed: Uint8Array): Promise<SealedHandoff>;
+/** Recover the master seed from the sealed envelope + the fragment key. */
+declare function unsealSeed(sealedKeys: string, fragmentKey: string): Promise<Uint8Array>;
+interface Pkce {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/** Generate a PKCE verifier + S256 challenge for the authorize→token exchange. */
+declare function generatePkce(): Promise<Pkce>;
+/** A random URL-safe value for the OAuth `state` (CSRF binding on the callback). */
+declare function randomState(): string;
+
 /**
  * `SessionState` — the in-memory source of truth for "who is signed in" on a
  * {@link Client}.
@@ -2162,6 +2272,77 @@ declare class SessionState {
     clear(): Promise<void>;
 }
 
+/**
+ * `client.auth.hosted` — centralized hosted auth (auth.muhkoo.dev).
+ * AUTH_HOSTED_PLAN.md.
+ *
+ * Two sides share this class:
+ *   - **Developer apps** call {@link login} (redirect to the hosted page) and
+ *     {@link handleCallback} (exchange the returned code → session + seed). The
+ *     app carries no snarkjs and never sees the user's credentials.
+ *   - **The hosted page** (the muhkoo/auth SPA), once it has authenticated the
+ *     user via the normal `client.auth.zk.*` flow, calls
+ *     {@link completeAuthorize} to seal the seed, mint the grant, and build the
+ *     redirect-back URL.
+ *
+ * Flow (authorization-code + PKCE + sealed-seed handoff):
+ *   app  →  GET  auth.muhkoo.dev/authorize?app_id&redirect_uri&state&code_challenge
+ *   page →  (user authenticates) → POST /api/auth/grant → redirect_uri?code&state#k=<K_t>
+ *   app  →  POST /api/auth/token {code, code_verifier} → {sessionToken, sealedKeys}
+ *        →  unseal sealedKeys with K_t → master seed → session ready
+ */
+
+interface HostedAuthDeps {
+    auth: AuthClient;
+    session: SessionState;
+    /** Base URL of the hosted auth SPA (e.g. https://auth.muhkoo.dev). */
+    authBaseUrl: string;
+}
+interface AuthUser$1 {
+    username: string;
+    commitment: string;
+}
+declare class HostedAuth {
+    private readonly deps;
+    constructor(deps: HostedAuthDeps);
+    /**
+     * (App side) Begin hosted login: stash a PKCE verifier + state, then send
+     * the browser to the hosted authorize page. Returns the URL it redirects to
+     * (also useful for popup mode / tests). `redirectUri` must be registered for
+     * the app in the portal.
+     */
+    login(opts: {
+        appId: string;
+        redirectUri: string;
+        redirect?: boolean;
+    }): Promise<string>;
+    /** Whether the current URL looks like a hosted-auth callback (has code + state). */
+    isCallback(): boolean;
+    /**
+     * (App side) Complete login on the callback URL: verify state, exchange the
+     * code (+ PKCE verifier) for the session, unseal the seed from the fragment,
+     * establish the session, and scrub the URL. Returns the signed-in user.
+     */
+    handleCallback(): Promise<AuthUser$1>;
+    /**
+     * (Hosted-page side) Finish an /authorize request after the user has
+     * authenticated here: seal the in-memory seed, mint the grant, and return
+     * the URL to redirect the browser back to. The seed must be held (the user
+     * just signed in via `client.auth.zk.*`).
+     */
+    completeAuthorize(opts: {
+        appId: string;
+        redirectUri: string;
+        codeChallenge: string;
+        state: string;
+    }): Promise<string>;
+    private location;
+    private store;
+    private take;
+    /** Drop `code`, `state`, and the `#k` fragment from the address bar. */
+    private scrubUrl;
+}
+
 /**
  * `client.auth` — user authentication, exposed today through the `zk`
  * sub-namespace (`client.auth.zk.login(...)`). Leaving room under `auth` for
@@ -2290,6 +2471,54 @@ declare class ZkAuth {
      * call {@link changePassword} to set a new password. No server lookup needed.
      */
     recoverWithPhrase(username: string, mnemonic: string, opts?: LoginOptions): Promise<AuthUser>;
+    /**
+     * Add an **email** as a recovery + login factor (M2 verification-gated:
+     * the server only releases the split-key OPRF eval after the address is
+     * OTP-verified). Sends the code, then returns a `confirm` continuation:
+     *
+     *   const { confirm } = await client.auth.zk.enrollEmailFactor("me@x.com");
+     *   await confirm(codeFromInbox);
+     *
+     * Requires being signed in with the seed held (like the other enrolls).
+     * Custody note: gated factors trade some custody for recoverability — the
+     * trade-off should be disclosed in the enroll UI.
+     */
+    enrollEmailFactor(email: string): Promise<{
+        email: string;
+        confirm: (code: string) => Promise<void>;
+    }>;
+    /**
+     * Recover an account via its enrolled **email** factor. Sends a code to the
+     * enrolled address (the response never reveals whether one exists), then
+     * `confirm(code)` completes: gated read + split-key eval → unwrap seed →
+     * normal ZK login. After this, call {@link changePassword} to set a new
+     * password.
+     *
+     *   const { confirm } = await client.auth.zk.recoverWithEmail("alice");
+     *   const user = await confirm(codeFromInbox);
+     */
+    recoverWithEmail(username: string, opts?: LoginOptions): Promise<{
+        confirm: (code: string) => Promise<AuthUser>;
+    }>;
+    /**
+     * Link a Google account as a recovery + login factor. Requires being signed
+     * in with the seed held. `idToken` is a fresh Google ID token (GIS).
+     */
+    enrollGoogleFactor(idToken: string): Promise<void>;
+    /**
+     * Sign in with Google — verify the ID token, unlock the seed via the gated
+     * split-key eval, and establish a session. Same machinery serves "Sign in
+     * with Google" and "recover with Google"; the account must have linked the
+     * factor first.
+     */
+    loginWithGoogle(username: string, idToken: string, opts?: LoginOptions): Promise<AuthUser>;
+    /**
+     * Register a brand-new, **passwordless** account whose only factor is Google.
+     * A random master seed is generated and wrapped under the Google-gated key;
+     * the user can add a password / passkey / phrase later. The ZK registration
+     * is identical to a password signup.
+     */
+    registerWithGoogle(username: string, idToken: string): Promise<AuthUser>;
     /**
      * Change the password — re-wraps the (unchanged) master seed under the new
      * password's OPRF-gated key. The identity/commitment never moves. Requires
@@ -2322,12 +2551,17 @@ declare class ZkAuth {
      * its PRF, unwraps the master seed → identity → session.
      */
     loginWithPasskey(username: string, opts?: LoginOptions): Promise<AuthUser>;
-    /** List the user's enrolled login methods (metadata only). Session-authed. */
+    /**
+     * List the user's enrolled login methods (metadata only). Session-authed.
+     * Gated factors (email/google) carry a `masked` display hint
+     * ("m•••@gmail.com"); the full value is never returned.
+     */
     listFactors(): Promise<Array<{
         id: string;
         type: string;
         label?: string;
         createdAt?: number;
+        masked?: string;
     }>>;
     /** Remove a login method by id (can't remove your only one). Session-authed. */
     removeFactor(id: string): Promise<void>;
@@ -2385,7 +2619,11 @@ declare class ZkAuth {
 /** `client.auth` — the auth namespace. Strategies hang off here. */
 declare class AuthNamespace {
     readonly zk: ZkAuth;
-    constructor(deps: ZkAuthDeps);
+    /** Centralized hosted auth (auth.muhkoo.dev) — `client.auth.hosted.login(...)`. */
+    readonly hosted: HostedAuth;
+    constructor(deps: ZkAuthDeps & {
+        authBaseUrl: string;
+    });
     /** Convenience pass-through: the currently signed-in user, or `null`. */
     get user(): AuthUser | null;
 }
@@ -3625,6 +3863,7 @@ declare class AgentsNamespace {
  *   });
  *   // HTTP-reachable at  hello--<slug>.fns.muhkoo.dev
  *   await client.functions.enable(appId, config.functionId, spaceId); // Space-bound
+ *   const out = await client.functions.invoke({ name: 'hello', slug }, { body: { q: 1 } });
  *
  * These are MANAGEMENT calls — the function itself runs on the accelerator
  * (uploaded just-in-time, decrypted only at invocation). Only an app's owner or
@@ -3694,6 +3933,29 @@ interface FunctionDeployInput {
 type FunctionUpdateInput = Partial<FunctionDeployInput>;
 interface FunctionsNamespaceDeps {
     http: HttpClient;
+    /**
+     * Wildcard zone HTTP functions are served from
+     * (`<name>--<slug>.<suffix>`). Defaults to the hosted platform's
+     * {@link DEFAULT_FN_HOST_SUFFIX}; override for staging / self-hosted.
+     */
+    fnHostSuffix?: string;
+}
+/** The hosted platform's HTTP-function zone. */
+declare const DEFAULT_FN_HOST_SUFFIX = "fns.muhkoo.dev";
+/** Options for {@link FunctionsNamespace.invoke}. */
+interface FunctionInvokeOptions {
+    /** HTTP method. Defaults to `POST` when `body` is present, else `GET`. */
+    method?: string;
+    /**
+     * Request body. Plain objects/arrays are JSON-encoded (with
+     * `Content-Type: application/json`); strings, `FormData`, `Blob`,
+     * `ArrayBuffer`/views and `URLSearchParams` are sent as-is.
+     */
+    body?: unknown;
+    /** Extra headers, merged over the SDK's credential headers. */
+    headers?: HeadersInit;
+    /** Sub-path (and query) on the function's host, e.g. `/reports?from=...`. */
+    path?: string;
 }
 /** Common option: a management Space for delegated (non-owner) access. */
 interface FunctionScopeOpts {
@@ -3734,11 +3996,42 @@ declare class FunctionsNamespace {
     disable(appId: string, functionId: string, spaceId: string, opts?: FunctionScopeOpts): Promise<{
         config: FunctionConfig;
     }>;
+    /**
+     * Invoke an HTTP-triggered function and parse its JSON response.
+     *
+     *   const out = await client.functions.invoke({ name: 'hello', slug: 'myapp' });
+     *   const out = await client.functions.invoke('hello--myapp', { body: { q: 1 } });
+     *   const out = await client.functions.invoke('https://hello--myapp.fns.muhkoo.dev/x');
+     *
+     * The request carries the SDK's credentials (`X-Muhkoo-Key` and, when a
+     * user is signed in, `X-Muhkoo-Session`) — the platform passes the session
+     * token through to the function, which can verify it server-side via
+     * `POST /api/auth/verify` to establish the caller's identity.
+     *
+     * Non-2xx responses throw {@link HttpError}. For functions that return
+     * something other than JSON, use {@link invokeRaw}.
+     */
+    invoke<T = unknown>(target: string | {
+        name: string;
+        slug: string;
+    }, opts?: FunctionInvokeOptions): Promise<T>;
+    /** Invoke an HTTP-triggered function and return the raw `Response`. */
+    invokeRaw(target: string | {
+        name: string;
+        slug: string;
+    }, opts?: FunctionInvokeOptions): Promise<Response>;
+    /** Resolve an invoke target to the function's absolute URL. */
+    invokeUrl(target: string | {
+        name: string;
+        slug: string;
+    }, path?: string): string;
     private path;
 }
 
 /** The hosted Muhkoo Accelerator — the default {@link ClientOptions.baseUrl}. */
 declare const DEFAULT_BASE_URL = "https://api.muhkoo.dev";
+/** The hosted auth SPA — the default {@link ClientOptions.authBaseUrl}. */
+declare const DEFAULT_AUTH_BASE_URL = "https://auth.muhkoo.dev";
 interface ClientOptions {
     /**
      * App / publishable key issued by the accelerator (e.g. `mk_test_pk_…`).
@@ -3769,6 +4062,19 @@ interface ClientOptions {
     fetch?: typeof fetch;
     /** Optional log level for the SDK logger. */
     logLevel?: string;
+    /**
+     * Wildcard zone HTTP serverless functions are served from
+     * (`<name>--<slug>.<suffix>`), used by `client.functions.invoke(...)`.
+     * Defaults to the hosted platform's zone (`fns.muhkoo.dev`); override for
+     * staging or a self-hosted deployment.
+     */
+    functionsHostSuffix?: string;
+    /**
+     * Base URL of the centralized hosted auth SPA (`client.auth.hosted`).
+     * Defaults to {@link DEFAULT_AUTH_BASE_URL} (`auth.muhkoo.dev`); override for
+     * staging (`auth.staging.muhkoo.dev`) or a self-hosted deployment.
+     */
+    authBaseUrl?: string;
 }
 declare class Client {
     readonly baseUrl: string;
@@ -4008,5 +4314,5 @@ declare class KeyringClient implements KeyringTransport {
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 
-export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_BASE_URL, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, VaultUnavailableError, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, shardHash, signMessage, toField, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
-export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvNamespaceDeps, LoginOptions, MessageBody, MessageDeletedEvent, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, PacketCipher, PacketHeaders, PacketOptions, Participant, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, PublicKeyJWK, RatchetState, ReceiveResult, RegisterParams, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardClientOptions, SharedSpaceClientOptions, SnarkProof, SpaceChannelLike, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, StorageChangeEvent, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };
+export { AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, Client, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_FN_HOST_SUFFIX, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HashKnowledge, HttpClient, HttpError, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvNamespace, LocalStorageSessionStore, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, PBKDF2_DEFAULT_ITERATIONS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PersonalSpaceClient, Poseidon, PreimagePoK, ReedSolomonCodec, Space as Room, SerializeMessage, SessionState, ShardClient, SharedSpaceClient, Space, SpaceKeyring, SpaceNamespace, SpacePacketCipher, StorageNamespace, VaultUnavailableError, WSTransport, ZkAuth, buildCommitment, compilePrograms, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultSessionStore, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, ejectAgentPrompt, ejectAgentTools, encodeToHex, encryptAesGcm, exportPublicKeyBase64, exportPublicKeyHex, generateAuthProof, generatePkce, getMuhkooAppDescriptor, getSubtle, initBn128Wasm, initRsWasm, initializeCircuits, manifestToStat, poseidonHash, quickVerify, randomBytes, randomState, sealSeed, shardHash, signMessage, toField, unsealSeed, unwrapWithPassphrase, verify, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase };
+export type { ACL, ACLEntry, AgentConfig, AgentCreateInput, AgentDbToolMode, AgentProvisioned, AgentScopeOpts, AgentSkill, AgentToolsConfig, AgentTrigger, AgentTriggerType, AgentUpdateInput, AgentsNamespaceDeps, AuthClientOptions, AuthKeyPair, AuthSuccess, AuthToken, AuthType, AuthUser, Bn128WasmInstance, BroadcastChannelEvent, BroadcastChannelOptions, ChannelLike, ChunkKeyMaterial, ChunkManifest, CipherFrame, CipherMessage, CipherMessageHeader, CircuitBufferConfig, CircuitUrls, ClientOptions, DehydratedKeypair, DehydratedKeys, DoubleRatchetCipherDeps, ECDHCurve, EncodeResult, EphemeralEvent, EpochKeyProvider, FileManifest, FileNamespaceDeps, FileStat, FileStorageOptions, FunctionCaps, FunctionConfig, FunctionDeployInput, FunctionInvokeOptions, FunctionScopeOpts, FunctionTrigger, FunctionTriggerType, FunctionTriggers, FunctionUpdateInput, FunctionsNamespaceDeps, Groth16Proof, HttpClientOptions, IncomingFrame, KeyExchangeFrame, KeyPair, Keypair, KeyringClientDeps, KeyringTransport, KvNamespaceDeps, LoginOptions, MessageBody, MessageDeletedEvent, MessageEvent, MessageHeaders, MessageNamespaceDeps, MessageOptions, MessageSubscription, MuhkooAgentMeta, MuhkooAgentToolsConfig, MuhkooAppDescriptor, MuhkooDBAccess, MuhkooDBMeta, MuhkooFunctionMeta, MuhkooMessageEvent, MuhkooSpaceMeta, OAuthProvider, PacketCipher, PacketHeaders, PacketOptions, Participant, Permission, PermissionCheckRequest, PermissionCheckResult, PersonalSpaceClientOptions, Pkce, PublicKeyJWK, RatchetState, ReceiveResult, RegisterParams, Role, SpaceDeps as RoomDeps, SpaceFileMetadata as RoomFileMetadata, SealedHandoff, SealedHeaders, Session, SessionOptions, SessionStore, SetOptions, ShardClientOptions, SharedSpaceClientOptions, SnarkProof, SpaceChannelLike, SpaceDeps, SpaceFileMetadata, SpaceKeyCache, SpaceKeyringDeps, SpaceMessageEvent, SpaceNamespaceDeps, StorageChangeEvent, StoredSession, Subscription, UserIdentity, VaultFactor, VerificationKey, WSMessage, WSMessageType, WSTransportOptions, WrappedPayload, WriteFileInput, WriteFileOptions, WriteToShardsInput, ZkAuthDeps, ZkAuthenticateRequest, ZkChallengeResponse, ZkCompiled, ZkIdentity, ZkRegisterRequest, ZkRegisterResponse };