@hanzo/build 0.2.10 → 0.2.11

package/lib/api/connectors.js

@@ -0,0 +1,109 @@
+/**
+ * Connectors: the MCP servers an org adds, and the shelf it picks them from.
+ *
+ *   GET    /v1/tool/mcp/servers        {servers: [server]}
+ *   POST   /v1/tool/mcp/servers        {name, url} or {listing, name?}, with {authHeader, secret} → 201 server
+ *   DELETE /v1/tool/mcp/servers/{id}   204
+ *   GET    /v1/tool/catalog?q=&limit=&offset=   {catalog: [listing], total, limit, offset}
+ *   GET    /v1/tool/catalog/{id}       one listing in full
+ *
+ * A server's secret is sealed in KMS by the platform and never answered again;
+ * a record says only whether it has one. Its tools are GET /v1/tool?source=mcp
+ * (tools.ts), named `<server id>_<tool>`, and each is called only once it is on.
+ * A listing can be added here only when it serves streamable HTTP; one that
+ * ships only a package needs somewhere to run first. The fleet's own servers,
+ * on for every run, are mcp.ts.
+ */
+import { call, query, seg } from './call.js';
+const str = (v) => (typeof v === 'string' ? v : '');
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+const obj = (v) => (v && typeof v === 'object' ? v : {});
+const rows = (v) => (Array.isArray(v) ? v : []);
+export function server(raw) {
+    const o = obj(raw);
+    return {
+        id: str(o.id),
+        name: str(o.name),
+        url: str(o.url),
+        header: str(o.authHeader),
+        secret: o.hasSecret === true,
+        listing: str(o.listing),
+        created: num(o.createdAt),
+    };
+}
+export function listing(raw) {
+    const o = obj(raw);
+    return {
+        id: str(o.id),
+        name: str(o.name),
+        title: str(o.title),
+        description: str(o.description),
+        vendor: str(o.vendor),
+        version: str(o.version),
+        logo: str(o.logo),
+        featured: o.featured === true,
+        official: o.official === true,
+        transports: rows(o.transports).map(str).filter(Boolean),
+        remotes: rows(o.remotes)
+            .map((r) => ({ transport: str(obj(r).transport), url: str(obj(r).url) }))
+            .filter((r) => r.url),
+        packages: rows(o.packages)
+            .map((p) => {
+            const x = obj(p);
+            return { registry: str(x.registry), identifier: str(x.identifier), runtime: str(x.runtime), version: str(x.version) };
+        })
+            .filter((p) => p.identifier),
+        repo: str(o.repo),
+        site: str(o.site),
+    };
+}
+/** What a listing is called on screen. */
+export const titleOf = (l) => l.title || l.name;
+/** Whether a listing can be added here and now: the platform dials its streamable-HTTP remote. */
+export const ready = (l) => l.remotes.some((r) => r.transport === 'streamable-http');
+/** A server's tools among the plane's, by the prefix its id gives them. */
+export const owns = (s, toolName) => toolName.startsWith(`${s.id}_`);
+export async function servers(t) {
+    return rows(obj(await call(t, 'GET', '/v1/tool/mcp/servers')).servers).map(server).filter((s) => s.id);
+}
+/** Why a server cannot be added as it stands, or '' when it can. */
+export function refuse(a) {
+    if (!a.listing) {
+        if (!a.name?.trim())
+            return 'A connector needs a name';
+        if (!/^https?:\/\/[^\s/]+/.test(a.url?.trim() ?? ''))
+            return 'The URL is an http(s) address';
+    }
+    if (a.secret && !a.header?.trim())
+        return 'Name the header the secret is sent in';
+    return '';
+}
+export async function add(t, a) {
+    const why = refuse(a);
+    if (why)
+        throw new Error(why);
+    const body = {};
+    if (a.listing)
+        body.listing = a.listing;
+    else
+        body.url = a.url.trim();
+    if (a.name?.trim())
+        body.name = a.name.trim();
+    // The header names where the secret goes, so it rides with one or not at all.
+    if (a.secret) {
+        body.authHeader = a.header.trim();
+        body.secret = a.secret;
+    }
+    return server(await call(t, 'POST', '/v1/tool/mcp/servers', body));
+}
+export async function remove(t, id) {
+    await call(t, 'DELETE', `/v1/tool/mcp/servers/${seg(id)}`);
+}
+/** A page of the shelf, featured first, then by name. */
+export async function shelf(t, q = {}) {
+    const r = obj(await call(t, 'GET', `/v1/tool/catalog${query({ q: q.text?.trim(), limit: q.limit, offset: q.offset || undefined })}`));
+    return { listings: rows(r.catalog).map(listing).filter((l) => l.id), total: num(r.total), offset: num(r.offset) };
+}
+export async function one(t, id) {
+    return listing(await call(t, 'GET', `/v1/tool/catalog/${seg(id)}`));
+}

package/lib/api/consent.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The signed-in person's answers to Hanzo's data-sharing questions, as IAM
+ * records them for every Hanzo surface.
+ *
+ *   GET /v1/iam/consent → {status, data: {insights, training}}
+ *   PUT /v1/iam/consent   {insights?, training?}   only the answers sent change
+ *
+ * `training` has three states: unanswered (''), granted, refused. Only granted
+ * lets Hanzo train on this person's data; unanswered is read as no. `insights`
+ * is anonymous product usage, with no prompt or answer text, and is on until
+ * turned off. Every change is audited by IAM with the answer before and after.
+ */
+import { type Target } from './call.ts';
+export type Answer = '' | 'granted' | 'refused';
+export interface Consent {
+    insights: boolean;
+    training: Answer;
+}
+/** IAM's defaults for anything it did not say: insights on, training unanswered. */
+export declare function consentOf(raw: unknown): Consent;
+export declare function consent(t: Target): Promise<Consent>;
+export declare function setConsent(t: Target, change: Partial<Consent>): Promise<Consent>;

package/lib/api/consent.js

@@ -0,0 +1,28 @@
+/**
+ * The signed-in person's answers to Hanzo's data-sharing questions, as IAM
+ * records them for every Hanzo surface.
+ *
+ *   GET /v1/iam/consent → {status, data: {insights, training}}
+ *   PUT /v1/iam/consent   {insights?, training?}   only the answers sent change
+ *
+ * `training` has three states: unanswered (''), granted, refused. Only granted
+ * lets Hanzo train on this person's data; unanswered is read as no. `insights`
+ * is anonymous product usage, with no prompt or answer text, and is on until
+ * turned off. Every change is audited by IAM with the answer before and after.
+ */
+import { call, unwrap } from './call.js';
+const ANSWERS = ['', 'granted', 'refused'];
+/** IAM's defaults for anything it did not say: insights on, training unanswered. */
+export function consentOf(raw) {
+    const o = (raw && typeof raw === 'object' ? raw : {});
+    return {
+        insights: typeof o.insights === 'boolean' ? o.insights : true,
+        training: ANSWERS.includes(o.training) ? o.training : '',
+    };
+}
+export async function consent(t) {
+    return consentOf(unwrap(await call(t, 'GET', '/v1/iam/consent')));
+}
+export async function setConsent(t, change) {
+    return consentOf(unwrap(await call(t, 'PUT', '/v1/iam/consent', change)));
+}

package/lib/api/github.d.ts

@@ -6,6 +6,7 @@
  *   GET  /v1/provider/github/user              the person's own connection
  *   POST /v1/provider/github/user/connect      → {authorizeUrl}
  *   POST /v1/provider/github/user/disconnect
+ *   GET  /v1/provider/github/installations     the accounts this org has bound the App on
  *
  * Paged by an opaque `after` cursor; `next` is the cursor for the page after
  * this one, or empty on the last. Rows are read defensively: a field the
@@ -76,6 +77,18 @@ export declare function connection(t: Target): Promise<Connection>;
 /** Where to send the person to authorize the platform's GitHub App — github.com only. */
 export declare function connect(t: Target): Promise<string>;
 export declare function disconnect(t: Target): Promise<void>;
+/** A GitHub account the platform's App is installed on, as this org sees it. */
+export interface Installation {
+    login: string;
+    /** `Organization` or `User`. */
+    type: string;
+    /** `all` or `selected` repositories. */
+    grant: string;
+    /** This org has bound it, and GitHub still has the App installed there. */
+    connected: boolean;
+}
+/** The accounts this org has bound the App on. An org admin adds one through `/v1/provider/github/connect`. */
+export declare function installations(t: Target): Promise<Installation[]>;
 /** One repository the GitHub connection grants this organization. */
 export interface Grant {
     owner: string;

package/lib/api/github.js

@@ -6,6 +6,7 @@
  *   GET  /v1/provider/github/user              the person's own connection
  *   POST /v1/provider/github/user/connect      → {authorizeUrl}
  *   POST /v1/provider/github/user/disconnect
+ *   GET  /v1/provider/github/installations     the accounts this org has bound the App on
  *
  * Paged by an opaque `after` cursor; `next` is the cursor for the page after
  * this one, or empty on the last. Rows are read defensively: a field the
@@ -71,6 +72,14 @@ export async function connect(t) {
 export async function disconnect(t) {
     await call(t, 'POST', '/v1/provider/github/user/disconnect');
 }
+/** The accounts this org has bound the App on. An org admin adds one through `/v1/provider/github/connect`. */
+export async function installations(t) {
+    const raw = obj(await call(t, 'GET', '/v1/provider/github/installations'));
+    return (Array.isArray(raw.installations) ? raw.installations : [])
+        .map(obj)
+        .map((i) => ({ login: str(i.login), type: str(i.type), grant: str(i.grant), connected: i.connected === true }))
+        .filter((i) => i.login);
+}
 export function grant(raw) {
     const r = obj(raw);
     const name = str(r.name);

package/lib/api/harness.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The agent's own output, read as cards.
+ *
+ * A sandbox run's agent is `dev exec`, and everything it prints reaches the
+ * run's session as `log` chunks (apps/sandbox work.go). It prints each item of
+ * its turn under a header line (hanzo dev, exec/src/event_processor_with_human_output.rs):
+ *
+ *   exec / <command> in <dir>            a command started
+ *    succeeded in 12ms: / <output>       …how it ended, then what it printed
+ *   codex / <text>                        the agent said something
+ *   apply patch / patch: completed / <paths>, then the turn's diff
+ *   mcp: server/tool (completed)          a tool call
+ *   web search: <query>
+ *     ✓ step / → step / • step            its plan
+ *   tokens used / <n>                     the end; the final message follows once more, bare
+ *
+ * The chunks are cut by a clock, not by line, so a line is read only once it
+ * is whole. Lines no header owns — reasoning, or the tail of output from before
+ * the recorded events begin — are prose. Everything here becomes TEXT on the
+ * screen; nothing is markup.
+ */
+import type { Card } from './turn.ts';
+/**
+ * A shell command's words, as `sh` splits them: quotes grouped, `'"'"'`
+ * joined, a backslash escaping the next character outside single quotes.
+ */
+export declare function words(line: string): string[];
+/** The command a harness ran, out of the `bash -lc '…'` it wraps each one in. */
+export declare function unwrap(command: string): string;
+/**
+ * The file a command only reads, or ''. `cat f`, `nl -ba f`, `sed -n '1,80p' f`,
+ * `head -n 40 f`, `tail f` — one file, and nothing piped, chained or redirected.
+ */
+export declare function reads(command: string): string;
+/** A path to show: a relative one as it is, an absolute one by its name — never the sandbox's layout. */
+export declare const shown: (path: string) => string;
+/** A unified diff's sections, by the path each changes, from its first hunk on. */
+export declare function sections(diff: string): Map<string, string>;
+/** A reader that appends the cards it finds to `out`, keyed by `mint`. */
+export declare function harness(out: Card[], mint: () => string): {
+    feed(chunk: string): void;
+    /** The last line even without its newline, and what only the whole output can decide. */
+    end(): void;
+};

package/lib/api/harness.js

@@ -0,0 +1,348 @@
+/** Colour codes a terminal would have drawn; a sandbox is not a terminal, but a harness may still print them. */
+const ANSI = /\u001b\[[0-9;?]*[A-Za-z]/g;
+/**
+ * A shell command's words, as `sh` splits them: quotes grouped, `'"'"'`
+ * joined, a backslash escaping the next character outside single quotes.
+ */
+export function words(line) {
+    const out = [];
+    let cur = '';
+    let open = false;
+    let q = '';
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (q === "'") {
+            if (c === "'")
+                q = '';
+            else
+                cur += c;
+            continue;
+        }
+        if (q === '"') {
+            if (c === '"')
+                q = '';
+            else if (c === '\\' && i + 1 < line.length)
+                cur += line[++i];
+            else
+                cur += c;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            q = c;
+            open = true;
+        }
+        else if (c === '\\' && i + 1 < line.length) {
+            cur += line[++i];
+            open = true;
+        }
+        else if (/\s/.test(c)) {
+            if (open)
+                out.push(cur);
+            cur = '';
+            open = false;
+        }
+        else {
+            cur += c;
+            open = true;
+        }
+    }
+    if (open)
+        out.push(cur);
+    return out;
+}
+/** The command a harness ran, out of the `bash -lc '…'` it wraps each one in. */
+export function unwrap(command) {
+    const w = words(command);
+    if (w.length === 3 && /(^|\/)(ba|z)?sh$/.test(w[0]) && (w[1] === '-lc' || w[1] === '-c'))
+        return w[2];
+    return command;
+}
+/**
+ * The file a command only reads, or ''. `cat f`, `nl -ba f`, `sed -n '1,80p' f`,
+ * `head -n 40 f`, `tail f` — one file, and nothing piped, chained or redirected.
+ */
+export function reads(command) {
+    const inner = unwrap(command);
+    if (/[|;&<>`$]/.test(inner))
+        return '';
+    const [cmd, ...args] = words(inner);
+    const one = (xs) => {
+        const files = xs.filter((a) => !a.startsWith('-'));
+        return files.length === 1 ? files[0] : '';
+    };
+    switch (cmd) {
+        case 'cat':
+        case 'nl':
+            return one(args);
+        case 'sed':
+            return args.length === 3 && args[0] === '-n' && /^\d+(,\d+)?p$/.test(args[1]) ? args[2] : '';
+        case 'head':
+        case 'tail':
+            return one(args[0] === '-n' ? args.slice(2) : args);
+    }
+    return '';
+}
+/** A path to show: a relative one as it is, an absolute one by its name — never the sandbox's layout. */
+export const shown = (path) => {
+    if (!path.startsWith('/'))
+        return path;
+    const cut = path.replace(/\/+$/, '');
+    return cut.slice(cut.lastIndexOf('/') + 1);
+};
+/** A unified diff's sections, by the path each changes, from its first hunk on. */
+export function sections(diff) {
+    const out = new Map();
+    let at = '';
+    let lines = [];
+    const close = () => {
+        if (at)
+            out.set(at, lines.join('\n'));
+    };
+    for (const line of diff.split('\n')) {
+        const m = /^diff --git a\/(.+) b\/(.+)$/.exec(line);
+        if (m) {
+            close();
+            at = m[2];
+            lines = [];
+        }
+        else if (at && (lines.length || line.startsWith('@@')))
+            lines.push(line);
+    }
+    close();
+    return out;
+}
+const HEAD = /^(exec|codex|thinking|user|apply patch|tokens used|turn interrupted|context compacted)$/;
+const LEAD = /^(patch|mcp|web search|warning|ERROR|deprecated|model rerouted|hook): /;
+const RESULT = /^\s*(succeeded|exited (-?\d+)|declined|in progress)( in [\d.]+m?s)?:$/;
+/** A reader that appends the cards it finds to `out`, keyed by `mint`. */
+export function harness(out, mint) {
+    let rest = '';
+    let mode = 'prose';
+    // The banner is a rule, the settings, and a rule.
+    let rules = 0;
+    let card = null;
+    let final = [];
+    const open = [];
+    const edits = [];
+    let edit = null;
+    let diff = null;
+    const said = (text) => {
+        const c = { kind: 'said', key: mint(), who: 'agent', text };
+        out.push(c);
+        return c;
+    };
+    const patch = () => {
+        const c = { kind: 'edit', key: mint(), files: [], patch: '', ran: 'running' };
+        out.push(c);
+        edit = { card: c, paths: [] };
+        edits.push(edit);
+        return edit;
+    };
+    // The diff printed after a patch is the turn's so far; the edit keeps the latest.
+    const settle = () => {
+        if (diff && edit)
+            edit.card.patch = diff.join('\n');
+        diff = null;
+    };
+    const step = (name, detail, ran) => {
+        const c = { kind: 'step', key: mint(), name, detail, output: '', ran };
+        out.push(c);
+        return c;
+    };
+    const line = (raw) => {
+        const l = raw.replace(ANSI, '').replace(/\r$/, '');
+        if (mode === 'config') {
+            if (l === '--------' && ++rules === 2)
+                mode = 'prose';
+            return;
+        }
+        if (mode === 'command') {
+            const cut = l.lastIndexOf(' in ');
+            const command = cut > 0 ? l.slice(0, cut) : l;
+            const file = reads(command);
+            const c = file
+                ? { kind: 'read', key: mint(), file: shown(file), ran: 'running' }
+                : { kind: 'shell', key: mint(), command: unwrap(command), output: '', ran: 'running' };
+            out.push(c);
+            open.push(c);
+            card = null;
+            mode = 'prose';
+            return;
+        }
+        if (mode === 'tokens') {
+            mode = 'final';
+            return;
+        }
+        if (mode === 'diff' && !HEAD.test(l) && !LEAD.test(l)) {
+            diff.push(l);
+            return;
+        }
+        const result = RESULT.exec(l);
+        if (result && open.length) {
+            settle();
+            const c = open.pop();
+            c.ran = result[1] === 'succeeded' ? 'done' : result[1] === 'declined' ? 'cancelled' : result[1] === 'in progress' ? 'running' : 'error';
+            card = c;
+            mode = 'output';
+            return;
+        }
+        if (HEAD.test(l)) {
+            settle();
+            card = null;
+            switch (l) {
+                case 'exec':
+                    mode = 'command';
+                    return;
+                case 'codex':
+                case 'thinking':
+                    card = said('');
+                    mode = 'agent';
+                    return;
+                case 'user':
+                    mode = 'user';
+                    return;
+                case 'apply patch':
+                    patch();
+                    mode = 'prose';
+                    return;
+                case 'tokens used':
+                    mode = 'tokens';
+                    return;
+                default:
+                    out.push({ kind: 'note', key: mint(), text: l === 'turn interrupted' ? 'The agent was interrupted' : 'The agent compacted its context' });
+                    mode = 'prose';
+                    return;
+            }
+        }
+        if (/^Hanzo Dev v\S+$/.test(l)) {
+            settle();
+            mode = 'config';
+            rules = 0;
+            return;
+        }
+        const patched = /^patch: (completed|failed|declined|in_progress)$/.exec(l);
+        if (patched) {
+            settle();
+            const e = edit && edit.card.ran === 'running' ? edit : patch();
+            e.card.ran = patched[1] === 'completed' ? 'done' : patched[1] === 'in_progress' ? 'running' : 'error';
+            card = null;
+            mode = 'patch';
+            return;
+        }
+        if (mode === 'patch' && l.startsWith('diff --git ')) {
+            diff = [l];
+            mode = 'diff';
+            return;
+        }
+        const mcp = /^mcp: (\S+) (started|\((completed|failed|in_progress)\))$/.exec(l);
+        if (mcp) {
+            settle();
+            const ran = mcp[3] === 'completed' ? 'done' : mcp[3] === 'failed' ? 'error' : 'running';
+            const started = [...out].reverse().find((c) => c.kind === 'step' && c.name === mcp[1] && c.ran === 'running');
+            if (started && started.kind === 'step' && mcp[2] !== 'started')
+                started.ran = ran;
+            else
+                step(mcp[1], 'tool', ran);
+            card = null;
+            mode = 'prose';
+            return;
+        }
+        const web = /^web search: (.*)$/.exec(l);
+        if (web) {
+            settle();
+            const prior = out[out.length - 1];
+            // Printed when the search starts and again when it lands: one card.
+            if (!(prior && prior.kind === 'step' && prior.name === 'Web search' && prior.detail === web[1]))
+                step('Web search', web[1], 'done');
+            card = null;
+            mode = 'prose';
+            return;
+        }
+        const warn = /^(warning|ERROR|deprecated|model rerouted): ?(.*)$/.exec(l);
+        if (warn) {
+            settle();
+            out.push({ kind: 'note', key: mint(), text: warn[1] === 'ERROR' ? warn[2] : `${warn[1]}: ${warn[2]}` });
+            card = null;
+            mode = 'prose';
+            return;
+        }
+        if (l.startsWith('hook: '))
+            return;
+        const todo = /^ {2}(✓|→|•) (.*)$/.exec(l);
+        if (todo && mode !== 'output' && mode !== 'agent') {
+            const row = `${todo[1] === '✓' ? '✓' : todo[1] === '→' ? '●' : '○'} ${todo[2]}`;
+            if (card && card.kind === 'step' && card.name === 'Plan')
+                card.output += `\n${row}`;
+            else {
+                card = step('Plan', '', 'done');
+                if (card.kind === 'step')
+                    card.output = row;
+            }
+            mode = 'prose';
+            return;
+        }
+        switch (mode) {
+            case 'user':
+                return;
+            case 'patch':
+                if (l.trim() && edit)
+                    edit.paths.push(l.trim());
+                return;
+            case 'final':
+                final.push(l);
+                return;
+            case 'output':
+                if (card && card.kind === 'shell')
+                    card.output += card.output ? `\n${l}` : l;
+                return;
+        }
+        // Prose: what the agent said under its header, or lines no header owns.
+        if (card && card.kind === 'said') {
+            card.text += card.text ? `\n${l}` : l;
+            return;
+        }
+        if (!l.trim())
+            return;
+        card = said(l);
+        mode = 'agent';
+    };
+    return {
+        feed(chunk) {
+            const text = rest + chunk;
+            const lines = text.split('\n');
+            rest = lines.pop() ?? '';
+            for (const l of lines)
+                line(l);
+        },
+        /** The last line even without its newline, and what only the whole output can decide. */
+        end() {
+            if (rest)
+                line(rest);
+            rest = '';
+            settle();
+            // The final message is printed twice: under its header, and bare at the end.
+            const tail = final.join('\n').trim();
+            const spoken = out.filter((c) => c.kind === 'said' && c.who === 'agent').map((c) => c.text.trim());
+            if (tail && !spoken.includes(tail))
+                said(tail);
+            final = [];
+            // A patch names the sandbox's paths; the diff names them as the repository
+            // does, and is the whole turn's, so an edit keeps the sections of its own files.
+            for (const e of edits) {
+                const parts = sections(e.card.patch);
+                const known = [...parts.keys()];
+                e.card.files = e.paths.map((p) => known.find((k) => p === k || p.endsWith(`/${k}`)) ?? shown(p));
+                if (!e.card.files.length)
+                    e.card.files = known;
+                const mine = e.card.files.filter((f) => parts.has(f));
+                e.card.patch = mine.length === 1 ? parts.get(mine[0]) : mine.map((f) => `${f}\n${parts.get(f)}`).join('\n');
+            }
+            edits.length = 0;
+            for (let i = out.length - 1; i >= 0; i--) {
+                const c = out[i];
+                if (c.kind === 'said' && !c.text.trim())
+                    out.splice(i, 1);
+            }
+        },
+    };
+}

package/lib/api/keys.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A person's own API keys: one secret key (sk-, it belongs on a server) and one
+ * publishable key (pk-, safe in a page's source), at most one of each.
+ *
+ *   GET    /v1/account/keys             {keys: [{type, prefix, key?, limit?, createdAt}]}
+ *   POST   /v1/account/keys             {type, limit?} → {key, type, limit}, answered once
+ *   DELETE /v1/account/keys?type=…      revoke that one
+ *
+ * Creating is rotating: a new key of a type ends the one before it. A secret key
+ * is answered once and by its prefix after; a publishable key is public by
+ * construction and always comes back whole. A limit only narrows what a key may
+ * reach — `model:zen5`, `project:acme`, `product:commerce`, `model:*`.
+ */
+import { type Target } from './call.ts';
+export declare const KINDS: readonly ['secret', 'publishable'];
+export type Kind = (typeof KINDS)[number];
+export interface Key {
+    type: Kind;
+    /** The recognizable head, never enough to use the key. */
+    prefix: string;
+    /** The whole key: a publishable key's only. */
+    key: string;
+    /** `kind:name` entries; none reaches whatever its holder does. */
+    limit: string[];
+    /** When it last changed, as IAM records it. */
+    created: string;
+}
+export interface Minted {
+    type: Kind;
+    /** The key itself. A secret one is never readable again. */
+    key: string;
+    limit: string[];
+}
+export declare function keys(t: Target): Promise<Key[]>;
+/** A `kind:name` limit: a lowercase kind, a colon, and a name or `*`. */
+export declare const LIMIT: RegExp;
+/** The limits a person typed, split on commas and spaces; throws on the first that is not one. */
+export declare function limits(raw: string): string[];
+/** Create a key of this type, ending the one before it. The answer is the only time a secret key is shown. */
+export declare function mint(t: Target, type: Kind, limit?: string[]): Promise<Minted>;
+export declare function revoke(t: Target, type: Kind): Promise<void>;