@kici-dev/orchestrator 0.17.0 → 0.18.0

package/dist/storage/blob-routes.d.ts

@@ -1,33 +1,24 @@
 /**
- * HTTP routes for the filesystem cache backend.
+ * Filesystem cache backend routes. `FilesystemCacheStorage` mints signed
+ * `http://<orch>/api/v1/cache/blob/<key>?sig=<token>` URLs for agent GETs and PUTs; these
+ * routes verify the HMAC token, reject path traversal, and stream to / from `basePath`.
  *
- * `FilesystemCacheStorage` mints signed `http://<orch>/api/v1/cache/blob/<key>?sig=<token>`
- * URLs that the agent uses to GET cached bytes or PUT new uploads. These
- * routes verify the HMAC token, reject path traversal, and stream content
- * to / from disk under the configured `basePath`.
- *
- * The S3 backend doesn't go through these routes — it uses real pre-signed
- * URLs against the S3 endpoint. These routes are mounted only when the
- * filesystem backend is active (`deps.fsCache` truthy in app.ts).
+ * Mounted only when the filesystem backend is active (`deps.fsCache` in app.ts); S3 uses real
+ * pre-signed URLs instead.
  */
 import type { Hono } from 'hono';
 /**
- * URL prefix for the filesystem-backend blob transfer route. The app-level
- * webhook body-size cap MUST exempt this prefix: blob PUTs carry internal
- * artifacts (dependency tarballs up to `cacheMaxTarballBytes`, 500MB by
- * default), which the S3 backend uploads direct-to-S3 uncapped. Binding them
- * to the tenant-webhook body limit would 413 legitimate large caches on the
- * filesystem backend. The PUT route below enforces its own `maxUploadBytes`
- * bound instead.
+ * The app-level webhook body-size cap MUST exempt this prefix: blob PUTs carry dependency
+ * tarballs up to `cacheMaxTarballBytes` (500MB default), which S3 uploads uncapped, and the
+ * webhook limit would 413 them. The PUT route enforces its own `maxUploadBytes` instead.
  */
 export declare const CACHE_BLOB_PATH_PREFIX = "/api/v1/cache/blob/";
 export interface FsCacheRouteDeps {
     basePath: string;
     signingSecret: string;
     /**
-     * Upper bound on a single blob PUT, in bytes. Aligned with the dep-cache's
-     * `cacheMaxTarballBytes` (500MB default) so the filesystem backend accepts
-     * the same artifact sizes the S3 backend does.
+     * Bytes per blob PUT; aligned with `cacheMaxTarballBytes` (500MB default) so the filesystem
+     * backend accepts the sizes S3 does.
      */
     maxUploadBytes: number;
 }

package/dist/storage/filesystem.d.ts

@@ -1,17 +1,13 @@
 /**
- * Filesystem-backed cache storage.
+ * Filesystem-backed `CacheStorage`, the counterpart of `S3CacheStorage`, for
+ * single-host deployments and test sandboxes. Production should still use S3.
  *
- * Mirrors the `CacheStorage` interface that `S3CacheStorage` provides, but
- * stores blobs as files under a configured base directory. Pre-signed URLs
- * are replaced by HMAC-signed `http://<orchUrl>/api/v1/cache/blob/...` URLs
- * — see `sign-url.ts` for the token mechanics and `app.ts` for the route.
+ * Pre-signed URLs become HMAC-signed `http://<orchUrl>/api/v1/cache/blob/...`
+ * URLs (token mechanics: `sign-url.ts`; route: `app.ts`).
  *
- * Intended for single-host deployments and test sandboxes where standing up
- * an S3-compatible service is overkill. Production should still use S3.
- *
- * Metadata is co-located as a sibling JSON file (`<key>.meta.json`) so the
- * data file is byte-identical to what the agent receives over HTTP. TTL is
- * enforced lazily on access — same model as the S3 backend.
+ * Metadata sits in a sibling `<key>.meta.json`, so the data file is
+ * byte-identical to what the agent receives over HTTP. TTL is enforced lazily
+ * on access, as in the S3 backend.
  */
 import type { CacheMetadata, CacheStorage } from './types.js';
 export interface FilesystemCacheStorageOptions {
@@ -34,9 +30,9 @@ export declare class FilesystemCacheStorage implements CacheStorage {
     private readonly routePrefix;
     constructor(options: FilesystemCacheStorageOptions);
     /**
-     * Map a cache key to its on-disk path. Keys may contain `/`, which becomes a
-     * directory separator. Reject keys containing `..` segments or NUL bytes to
-     * prevent path traversal — the same defence the route layer enforces too.
+     * Map a cache key to its on-disk path (`/` becomes a directory separator).
+     * Rejects `..` segments and NUL bytes against path traversal, as the route
+     * layer also does.
      */
     private resolvePath;
     /** Public for the HTTP route. The route validates the key before calling. */
@@ -56,29 +52,23 @@ export declare class FilesystemCacheStorage implements CacheStorage {
     getInternalUploadUrl(key: string): Promise<string>;
     initMeta(key: string): Promise<void>;
     /**
-     * List cache keys under a prefix.
-     *
-     * The prefix is a **key prefix**, not necessarily a directory — `UserCache`'s
-     * `restoreKeys` fallback lists on `${prefix}${seg(restoreKey)}`, a partial
-     * object name. Two shapes, and both must work the way the S3 backend does:
+     * List cache keys under a **key prefix**, which need not be a directory:
+     * `UserCache`'s `restoreKeys` fallback lists on `${prefix}${seg(restoreKey)}`,
+     * a partial object name. Both shapes must behave as on S3:
      *
      * - trailing `/` — a directory. Walk it directly; this is the hot path.
-     * - no trailing `/` — a partial name. Walk the parent directory and filter by
-     *   the prefix, since the prefix itself may name a file (or nothing at all).
-     *
-     * Reading the prefix as a directory in the second case is what made the
-     * `restoreKeys` fallback silently never hit here (`ENOENT` → `[]`) or throw
-     * (`ENOTDIR`, when a real object carried that exact name).
+     * - no trailing `/` — a partial name. Walk the parent and filter by the
+     *   prefix, which may name a file or nothing at all. Reading it as a
+     *   directory made `restoreKeys` never hit (`ENOENT`) or throw (`ENOTDIR`).
      */
     list(subPrefix: string): Promise<string[]>;
     getMetadata(key: string): Promise<CacheMetadata | null>;
     getObjectSize(key: string): Promise<number | null>;
     copy(srcKey: string, destKey: string): Promise<void>;
     /**
-     * Recursively collect data files under `dir`, returning each as a cache key
-     * relative to `basePath` paired with its mtime. Metadata sidecars
-     * (`*.meta.json`) and the atomic-write temp files (`*.tmp-*`) are skipped so
-     * `list()` only surfaces real cache objects.
+     * Recursively collect data files under `dir` as `basePath`-relative keys with
+     * their mtime, skipping `*.meta.json` sidecars and `*.tmp-*` atomic-write
+     * temp files so `list()` surfaces only real cache objects.
      */
     private walkDataFiles;
     private signedUrl;

package/dist/storage/index.d.ts

@@ -1,11 +1,6 @@
 /**
- * Cache storage module.
- *
- * Pluggable storage backends:
- *   - S3CacheStorage         — production / multi-host
- *   - FilesystemCacheStorage — single-host / test sandbox
- *
- * Use createCacheStorage() to instantiate from a discriminated config.
+ * Cache storage backends: S3CacheStorage (production / multi-host) and FilesystemCacheStorage
+ * (single-host / test sandbox), built by createCacheStorage() from a discriminated config.
  */
 export type { CacheStorage, CacheStorageConfig, CacheMetadata, S3CacheStorageConfig, FilesystemCacheStorageConfig, } from './types.js';
 export { S3CacheStorage } from './s3.js';
@@ -13,8 +8,5 @@ export { FilesystemCacheStorage } from './filesystem.js';
 export { signToken, verifyToken, generateSigningSecret } from './sign-url.js';
 export type { SignedMethod, SignedToken, VerifyResult } from './sign-url.js';
 import type { CacheStorage, CacheStorageConfig } from './types.js';
-/**
- * Create a cache storage backend from configuration.
- */
 export declare function createCacheStorage(config: CacheStorageConfig): CacheStorage;
 //# sourceMappingURL=index.d.ts.map

package/dist/storage/key-discriminator.d.ts

@@ -1,20 +1,18 @@
 /**
- * Width of the object-key discriminator, in hex characters.
+ * Width of the object-key discriminator, in hex characters (32 = 128 bits).
  *
- * 32 hex chars is 128 bits, and the width is a security property rather than a
- * formatting choice: on a case-insensitive namespace the discriminator is the
- * only thing separating object names chosen by untrusted workflow code. A
- * narrower value would let that code search case variants for a colliding pair
- * and land two different payloads on one object.
+ * A security property: on a case-insensitive namespace the discriminator alone
+ * separates object names chosen by untrusted workflow code, and a narrower one
+ * would let that code search case variants for a collision and land two
+ * payloads on one object.
  */
 export declare const KEY_DISCRIMINATOR_LENGTH = 32;
 /**
  * A collision-resistant discriminator for a user-supplied object-key segment.
  *
- * Hashes the **exact** name, before any sanitization. Sanitizing is many-to-one
- * — `seg()` maps both `/` and `_` to `_`, so `a/b` and `a_b` collapse to one
- * segment — and a case-insensitive backend folds `build` onto `Build`. Hashing
- * the pre-sanitization name is what keeps each of those pairs two objects.
+ * Hashes the **exact** pre-sanitization name: `seg()` maps both `/` and `_` to
+ * `_` (`a/b` and `a_b` collapse), and a case-insensitive backend folds `build`
+ * onto `Build`, so only the hash keeps each pair two objects.
  */
 export declare function keyDiscriminator(exact: string): string;
 //# sourceMappingURL=key-discriminator.d.ts.map

package/dist/storage/loopback-guard.d.ts

@@ -1,45 +1,35 @@
 /**
- * Startup guard: an orchestrator that runs non-co-located agents (any scaler
- * backend) must not hand them a loopback storage URL. Loopback is only
- * reachable by a co-located process, so a scaled agent would fail with an
- * opaque ECONNREFUSED. This module detects the misconfiguration so the
- * orchestrator can refuse to start with a clear, actionable error.
+ * Startup guard: an orchestrator running non-co-located agents must not hand them a loopback
+ * storage URL, which only a co-located process reaches (a scaled agent fails with an opaque
+ * ECONNREFUSED). It refuses to start with an actionable error instead.
  */
 import { ScalerBackendType } from '@kici-dev/engine';
 import type { AppConfig } from '../config.js';
 import type { ScalerConfig } from '../scaler/types.js';
 /**
- * Backends that place the agent outside the orchestrator's loopback (separate
- * netns, microVM, or host) whenever the entry does not say otherwise.
- * `kubernetes` is included defensively even though `ScalerEntry.type` excludes
- * it today.
+ * Backends that place the agent outside the orchestrator's loopback (separate netns, microVM,
+ * or host) unless the entry says otherwise. `kubernetes` is included defensively although
+ * `ScalerEntry.type` excludes it.
  *
- * Backend type alone is an imprecise signal — a `bare-metal` scaler may spawn
- * on this very machine or on a rack of remote hosts — so it is only the
- * fallback. When an entry declares its own `orchestratorUrl`, that URL says
- * where the agent will be, and `scalerIsColocated` reads it instead.
+ * Backend type is only the fallback signal (a `bare-metal` scaler may spawn locally or
+ * remotely): an entry's own `orchestratorUrl` takes precedence in `scalerIsColocated`.
  */
 export declare const NON_COLOCATED_BACKENDS: ReadonlySet<ScalerBackendType>;
 /**
- * Answers "could an agent in another netns/VM/host reach this address?" — the
- * question a DESTINATION URL asks. A wildcard (`0.0.0.0`, `::`) is not a
- * destination at all, so it is reported as loopback here.
- *
- * For a listener's bind address the question is the opposite one; use
- * `isLoopbackBind`.
+ * Whether a DESTINATION URL host is unreachable from another netns/VM/host. A wildcard
+ * (`0.0.0.0`, `::`) is not a destination, so it counts as loopback here. For a listener's
+ * bind address, use `isLoopbackBind`.
  */
 export declare function isLoopbackHost(hostname: string): boolean;
 /**
- * Answers "does a listener on this address stay on this machine?" — the
- * question a BIND address asks. A wildcard (`0.0.0.0`, `::`) accepts every
- * interface, so it is NOT loopback here, which is the one case where this
- * predicate and `isLoopbackHost` disagree.
+ * Whether a listener on this BIND address stays on this machine. A wildcard (`0.0.0.0`, `::`)
+ * accepts every interface, so it is NOT loopback here: the only disagreement with
+ * `isLoopbackHost`.
  */
 export declare function isLoopbackBind(hostname: string): boolean;
 /**
- * Decide whether an agent-facing storage URL is a loopback address that a
- * non-co-located agent could not reach. Returns a remediation message, or null
- * when the configuration is safe.
+ * A remediation message when the agent-facing storage URL is a loopback address a
+ * non-co-located agent cannot reach; null when the configuration is safe.
  */
 export declare function checkLoopbackAgentEndpoint(input: {
     agentFacingUrl: string | null;
@@ -53,9 +43,8 @@ export declare function checkLoopbackAgentEndpoint(input: {
     message: string;
 } | null;
 /**
- * Resolve the URL an AGENT would use to reach storage, plus the env var an
- * operator would set to fix a loopback misconfiguration. Returns null when the
- * storage backend has no agent-facing URL to validate.
+ * The URL an AGENT uses to reach storage, and the env var that fixes a loopback
+ * misconfiguration; null when the backend has no agent-facing URL.
  */
 export declare function resolveAgentFacingStorage(config: AppConfig): {
     url: string | null;
@@ -73,24 +62,17 @@ export declare function assertAgentReachableStorage(config: AppConfig, scalerCon
  * bound to something other than a loopback address.
  *
  * `KICI_AGENT_AUTH=none` answers `auth.success` to any `auth.request`
- * (`ws/agent-handler.ts`), so a listener on a routable address hands anyone who
- * can reach the port a registered agent: it receives dispatched jobs — with the
- * org's resolved secrets in hybrid mode — and streams results back as the
- * operator's own agent. No credential is involved anywhere in that sequence.
+ * (`ws/agent-handler.ts`), so on a routable address anyone who reaches the port becomes a
+ * registered agent with no credential: it receives dispatched jobs (with the org's resolved
+ * secrets in hybrid mode) and reports results as the operator's own agent.
  *
- * `none` is a local-development affordance, and any bind other hosts can reach
- * is never an intended pairing with it. The one-shot startup warning that used
- * to be the only signal was demonstrably not enough — the local dev plane
- * shipped in exactly this state — so this refuses, following the sibling guard
- * above: an orchestrator misconfiguration that produces a confusing failure
- * later must refuse to start with an actionable message.
+ * `none` is a local-development affordance, never intended with a bind other hosts can reach.
+ * A startup warning alone proved insufficient, so this refuses to start, like the storage
+ * guard above.
  *
- * The bind question is `isLoopbackBind`, not `isLoopbackHost`. The default
- * `KICI_HOST` is the wildcard `0.0.0.0`, which `isLoopbackHost` reports as
- * loopback because a wildcard is not a reachable destination — true of a
- * storage URL, and the opposite of what a listener on it does. So the guard
- * covers the default bind, which is the configuration an operator reaches
- * without setting `KICI_HOST` at all.
+ * It uses `isLoopbackBind`, not `isLoopbackHost`: the default `KICI_HOST` is the wildcard
+ * `0.0.0.0`, which `isLoopbackHost` reports as loopback, so only `isLoopbackBind` covers the
+ * default bind an operator gets without setting `KICI_HOST`.
  */
 export declare function assertAgentAuthBindSafe(config: AppConfig): void;
 //# sourceMappingURL=loopback-guard.d.ts.map

package/dist/storage/s3.d.ts

@@ -1,15 +1,11 @@
 /**
- * S3-backed cache storage.
+ * S3-backed cache storage; AWS SDK v3 modules load only when S3 storage is configured.
  *
- * Stores cached items in S3 with custom metadata headers for TTL tracking.
- * Uses AWS SDK v3 modular imports -- only loaded when S3 storage is configured.
- *
- * Metadata storage:
+ * TTL metadata headers:
  *   x-amz-meta-created-at      -- ISO timestamp of creation
  *   x-amz-meta-last-accessed-at -- ISO timestamp of last access
  *
  * TTL is enforced lazily: expired items are deleted on access.
- * Pre-signed URLs are generated for getUrl() with 15-minute expiry.
  */
 import type { CacheMetadata, CacheStorage } from './types.js';
 export interface S3CacheStorageOptions {
@@ -20,85 +16,62 @@ export interface S3CacheStorageOptions {
     /** Custom endpoint URL for S3-compatible services (e.g., SeaweedFS, LocalStack) */
     endpoint?: string;
     /**
-     * Separate endpoint for pre-signed URLs (upload and download).
-     * When set, pre-signed URLs use this endpoint instead of `endpoint`.
-     * Useful when the orchestrator accesses S3 on localhost but agents
-     * need a container-routable address (e.g., container DNS name).
+     * Endpoint for pre-signed URLs (upload and download) instead of `endpoint`, e.g. when the
+     * orchestrator reaches S3 on localhost but agents need a container DNS name.
      */
     externalEndpoint?: string;
     /**
-     * Separate endpoint for the pre-signed URL a developer machine running
-     * `kici run remote` PUTs the overlay to. The developer's machine may reach
-     * the bucket at a different address than the orchestrator or its agents (an
-     * orchestrator in a container uses the compose DNS name while the host CLI
-     * uses localhost). When unset, `getInternalUploadUrl` signs with the
-     * agent-facing `externalEndpoint`, else with `endpoint`.
+     * Endpoint for the pre-signed URL a developer machine running `kici run remote` PUTs the
+     * overlay to, which may differ from the orchestrator's and agents' (compose DNS name vs the
+     * host CLI's localhost). When unset, `getInternalUploadUrl` signs with `externalEndpoint`,
+     * else `endpoint`.
      */
     uploadEndpoint?: string;
-    /** Use path-style access instead of virtual-hosted-style (required for most S3-compatible services) */
+    /** Path-style instead of virtual-hosted-style access (most S3-compatible services need it). */
     forcePathStyle?: boolean;
 }
 export declare class S3CacheStorage implements CacheStorage {
     private readonly client;
-    /** Separate client for pre-signed URL generation (uses externalEndpoint if configured). */
+    /** Pre-signing client: externalEndpoint when configured. */
     private readonly presignClient;
     /** Client for the developer upload URL: uploadEndpoint, else the presign client. */
     private readonly uploadPresignClient;
     private readonly bucket;
     private readonly prefix;
     private readonly ttlMs;
-    /**
-     * False once the backend answered a conditional self-copy with
-     * `501 NotImplemented`. From then on `updateMeta` copies unconditionally.
-     */
+    /** False once the backend answered a conditional self-copy with `501 NotImplemented`. */
     private conditionalCopySupported;
     constructor(options: S3CacheStorageOptions);
-    /** Build the full S3 object key from a cache key. */
     private objectKey;
     /** Check if metadata indicates an expired item, honoring a per-op TTL override. */
     private isExpired;
-    /**
-     * Read metadata from an S3 object's custom headers.
-     * Returns null if the object doesn't exist (NoSuchKey/NotFound).
-     */
+    /** Null when the object does not exist (NoSuchKey/NotFound). */
     private readMeta;
-    /**
-     * Read an object's TTL metadata together with the ETag of the version it
-     * belongs to. Returns null if the object doesn't exist (NoSuchKey/NotFound).
-     */
+    /** TTL metadata plus the ETag of its version; null when the object does not exist. */
     private readHead;
     /**
-     * Update metadata on an S3 object by copying it to itself.
-     * This is the standard S3 pattern for updating metadata without re-uploading data.
-     *
-     * The copy is conditional on `etag`, the version whose metadata the caller
-     * read. A self-copy is a whole-object write: without the condition, one that
-     * races a `put()` of the same key can land after it and write the older body
-     * back. Cache pointers are rewritten in place while builds publish them, so a
-     * touch-on-read racing a publish reverted the pointer to a tarball that no
-     * longer exists. `CopySourceIfMatch` pins the bytes copied to that version and
-     * `IfMatch` refuses the write unless the key still holds it.
+     * Updates metadata by self-copy, conditional on `etag` (the version the caller read). A
+     * self-copy is a whole-object write: unconditioned, one racing a `put()` of the key can write
+     * the older body back, reverting a cache pointer to a deleted tarball. `CopySourceIfMatch`
+     * pins the copied bytes; `IfMatch` refuses the write unless the key still holds that version.
      *
-     * Returns false when the object was replaced since the read (`412`), or is
-     * being replaced right now (`409 ConditionalRequestConflict`): the newer
-     * write stamps metadata of its own, so there is nothing left to refresh.
+     * Returns false when the object was replaced since the read (`412`) or is being replaced
+     * (`409 ConditionalRequestConflict`): the newer write stamps its own metadata.
      *
-     * An S3-compatible backend that does not implement conditional copies
-     * answers `501 NotImplemented`. The copy then runs again without the
-     * condition, and later copies skip it, as on a backend that ignores the
-     * headers.
+     * A backend without conditional copies answers `501 NotImplemented`; the copy reruns
+     * unconditionally, and later copies skip the condition.
      */
     private updateMeta;
     /** Copy an object onto itself with new TTL metadata, conditional on `etag` when given. */
     private copyOntoItself;
-    /** Check if an error is a failed conditional request (PreconditionFailed, 412). */
+    /** A failed conditional request (PreconditionFailed, 412). */
     private isPreconditionFailedError;
-    /** Check if an error is a conditional write that raced another write (ConditionalRequestConflict, 409). */
+    /** A conditional write that raced another write (ConditionalRequestConflict, 409). */
     private isConditionalConflictError;
-    /** Check if an error is a request the backend does not implement (NotImplemented, 501). */
+    /** A request the backend does not implement (NotImplemented, 501). */
     private isNotImplementedError;
     private hasErrorShape;
-    /** Check if an error is a "not found" error (NoSuchKey, NotFound, 404). */
+    /** NoSuchKey, NotFound or 404. */
     private isNotFoundError;
     put(key: string, data: Buffer | string): Promise<void>;
     get(key: string, ttlMsOverride?: number): Promise<Buffer | null>;

package/dist/storage/sign-url.d.ts

@@ -1,25 +1,16 @@
 /**
- * HMAC-signed URL tokens for the filesystem cache backend.
- *
- * Pre-signed S3 URLs are not available for filesystem storage, so the
- * filesystem backend mints HMAC-SHA256 tokens that the orchestrator's HTTP
- * blob route verifies before serving / writing a file. Token shape:
+ * HMAC-SHA256 URL tokens for the filesystem cache backend (which has no pre-signed S3 URLs);
+ * the blob route verifies them before serving / writing a file. Token shape:
  *
  *   `${expiresUnixMs}.${hexSig}`
  *
- * Signature input: `${method}:${key}:${expiresUnixMs}` with HMAC-SHA256 keyed
- * by a per-orchestrator-process secret (random 32-byte hex at boot, persists
- * for the lifetime of the process). Tokens become invalid on orchestrator
- * restart — fine for the filesystem backend's single-host / test-sandbox use
- * case.
+ * Signs `${method}:${key}:${expiresUnixMs}` with a per-process secret (random 32 bytes at
+ * boot), so tokens die on orchestrator restart — fine for single-host / test-sandbox use.
  */
-/** Default URL lifetime: 1 hour (matches S3 backend's PUT-URL lifetime). */
+/** Default URL lifetime: 1 hour. */
 export declare const DEFAULT_SIGN_URL_TTL_MS: number;
 export type SignedMethod = 'GET' | 'PUT';
-/**
- * Generate a fresh per-process signing secret. Caller stores it on the
- * orchestrator config object so the same value is used for sign + verify.
- */
+/** The caller stores it on the orchestrator config, so sign and verify share it. */
 export declare function generateSigningSecret(): string;
 export interface SignedToken {
     /** Encoded token string (`${expiresMs}.${sig}`) ready to drop into a URL. */
@@ -27,9 +18,6 @@ export interface SignedToken {
     /** Expiry timestamp in unix ms — exposed for tests and logging. */
     expiresMs: number;
 }
-/**
- * Mint a signed token for the given (method, key, expiry) triple.
- */
 export declare function signToken(secret: string, method: SignedMethod, key: string, ttlMs?: number): SignedToken;
 export type VerifyResult = {
     ok: true;
@@ -38,9 +26,6 @@ export type VerifyResult = {
     ok: false;
     reason: 'malformed' | 'expired' | 'bad-signature';
 };
-/**
- * Verify a token. Constant-time signature compare on hex digest length;
- * rejects malformed shapes and expired tokens up-front.
- */
+/** Constant-time signature compare; rejects malformed and expired tokens up-front. */
 export declare function verifyToken(secret: string, method: SignedMethod, key: string, token: string): VerifyResult;
 //# sourceMappingURL=sign-url.d.ts.map