@nylorun/agents 0.14.0-beta → 0.16.0-beta

package/dist/skills/load.js

@@ -1,7 +1,15 @@
+import { createHash } from "node:crypto";
 import { existsSync, readdirSync, readFileSync, realpathSync, statSync, } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { DEFINITION_FILE_MAX_BYTES, SKILL_ENTRY, SKILL_FILES_MAX, skillFilePathIssue, } from "@nylorun/core/define";
 import matter from "gray-matter";
 const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** Version control and operating system files, never part of a skill. */
+const SKIPPED_DIRECTORIES = new Set([".git", ".hg", ".svn", "node_modules"]);
+const SKIPPED_FILES = new Set([".DS_Store", "Thumbs.db", "desktop.ini"]);
+/** Environment files hold secrets: never uploaded (`.env`, `.env.local`, …). */
+const isEnvFile = (name) => name === ".env" || name.startsWith(".env.");
 export class SkillsError extends Error {
     code;
     diagnostics;
@@ -24,7 +32,9 @@ export function resolveSkillsRoot(directory) {
 }
 /**
  * Load Agent Skills (agentskills.io) from a catalog directory.
- * Each immediate subdirectory with a valid SKILL.md becomes one skill.
+ * Each immediate subdirectory with a valid SKILL.md becomes one skill, with every file of its
+ * folder (text or binary) hashed. Throws `SkillsError` for a skill the Runtime cannot hold: a
+ * file over 10 MiB, more than 500 files, or a path a manifest cannot name.
  */
 export function loadSkillsFromDirectory(directory, diagnostics, options = {}) {
     const root = resolveSkillsRoot(directory);
@@ -34,7 +44,7 @@ export function loadSkillsFromDirectory(directory, diagnostics, options = {}) {
     for (const entry of readdirSync(root, { withFileTypes: true })) {
         if (!entry.isDirectory() || entry.name.startsWith("."))
             continue;
-        if (entry.name === "node_modules" || entry.name === ".git")
+        if (SKIPPED_DIRECTORIES.has(entry.name))
             continue;
         const skillDir = join(root, entry.name);
         const directoryReal = realInside(boundary, skillDir);
@@ -47,7 +57,7 @@ export function loadSkillsFromDirectory(directory, diagnostics, options = {}) {
             });
             continue;
         }
-        const skillFile = join(directoryReal, "SKILL.md");
+        const skillFile = join(directoryReal, SKILL_ENTRY);
         if (!existsSync(skillFile))
             continue;
         const skillReal = realInside(boundary, skillFile);
@@ -79,12 +89,10 @@ export function loadSkillsFromDirectory(directory, diagnostics, options = {}) {
             });
             continue;
         }
-        const resources = readResources(boundary, directoryReal, diagnostics, prefix);
         skills[parsed.name] = {
             name: parsed.name,
             description: parsed.description,
-            instructions: parsed.instructions,
-            ...(Object.keys(resources).length === 0 ? {} : { resources }),
+            ...readFiles(parsed.name, boundary, directoryReal, diagnostics, prefix),
         };
     }
     return skills;
@@ -112,47 +120,57 @@ export function parseSkill(text, directoryName) {
 function asTrimmedString(value) {
     return typeof value === "string" ? value.trim() : "";
 }
-function readResources(boundary, directory, diagnostics, prefix) {
-    const resources = {};
-    const walk = (current, depth) => {
-        if (depth > 6)
+/** Every file of the skill's folder, hashed, and where to read each one's bytes. */
+function readFiles(name, boundary, directory, diagnostics, prefix) {
+    const files = {};
+    const sources = {};
+    const visited = new Set();
+    // `at` is the folder's path in the skill: symbolic links inside the package are followed.
+    const walk = (current, at) => {
+        if (visited.has(current))
             return;
+        visited.add(current);
         for (const entry of readdirSync(current, { withFileTypes: true })) {
-            if (entry.name.startsWith(".") || entry.name === "node_modules")
-                continue;
             const full = join(current, entry.name);
-            if (entry.isDirectory()) {
-                const real = realInside(boundary, full);
-                if (!real)
-                    continue;
-                walk(real, depth + 1);
-                continue;
-            }
-            if (!entry.isFile() && !entry.isSymbolicLink())
-                continue;
-            if (depth === 0 && entry.name === "SKILL.md")
-                continue;
             const real = realInside(boundary, full);
-            if (!real || !statSync(real).isFile()) {
+            if (!real) {
                 diagnostics.push({
                     severity: "warning",
                     code: `${prefix}.resource-denied`,
-                    message: `Denied resource outside the package: ${entry.name}`,
+                    message: `Denied a file of skill '${name}' outside the package: ${entry.name}`,
                     path: full,
                 });
                 continue;
             }
-            const bytes = readFileSync(real);
-            if (bytes.includes(0))
+            const stats = statSync(real);
+            const path = at === "" ? entry.name : `${at}/${entry.name}`;
+            if (stats.isDirectory()) {
+                if (!SKIPPED_DIRECTORIES.has(entry.name))
+                    walk(real, path);
                 continue;
-            const rel = relative(directory, real).split(sep).join("/");
-            if (!rel || rel.startsWith(".."))
+            }
+            if (!stats.isFile() || SKIPPED_FILES.has(entry.name) || isEnvFile(entry.name))
                 continue;
-            resources[rel] = bytes.toString("utf8");
+            const issue = skillFilePathIssue(path);
+            if (issue)
+                throw new SkillsError(`${prefix}.invalid-path`, `Skill '${name}' has a file whose path ${issue}: ${path}`);
+            if (stats.size > DEFINITION_FILE_MAX_BYTES)
+                throw new SkillsError(`${prefix}.file-too-large`, `Skill '${name}' file ${path} is ${stats.size} bytes; a skill file may be at most ${DEFINITION_FILE_MAX_BYTES} (10 MiB)`);
+            const hash = `sha256:${createHash("sha256").update(readFileSync(real)).digest("hex")}`;
+            files[path] = hash;
+            sources[hash] = {
+                size: stats.size,
+                read: async () => new Uint8Array(await readFile(real)),
+            };
+            if (Object.keys(files).length > SKILL_FILES_MAX)
+                throw new SkillsError(`${prefix}.too-many-files`, `Skill '${name}' has more than ${SKILL_FILES_MAX} files; a skill may have at most ${SKILL_FILES_MAX}`);
         }
     };
-    walk(directory, 0);
-    return resources;
+    walk(directory, "");
+    return { files: sorted(files), sources };
+}
+function sorted(files) {
+    return Object.fromEntries(Object.entries(files).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
 }
 function realInside(root, candidate) {
     if (!existsSync(candidate))

package/dist/skills/skills.d.ts

@@ -1,5 +1,5 @@
 import type { CapabilityDeclaration } from "@nylorun/core/define";
-import { type SkillDiagnostic } from "./load.js";
+import { type LoadedSkill, type SkillDiagnostic } from "./load.js";
 export interface SkillsOptions {
     /** Capability id. Defaults to the catalog directory basename. */
     readonly id?: string;
@@ -21,8 +21,10 @@ export interface SkillsCapability extends CapabilityDeclaration {
  *     references/policy.md
  * ```
  *
- * Sets both `skills` (manifest names/descriptions) and `skillRecords` (bodies +
- * resources) so callers do not duplicate content. The harness injects
- * `load_skill` / `read_skill_resource` from the records.
+ * Sets `skills`: each skill's name, description and files (every file of its folder, binary
+ * included, by content hash). The client uploads the files the Runtime lacks when it registers
+ * the agent, and the Runtime serves `load_skill` / `read_skill_resource` from them.
  */
 export declare function skills(directory: string, options?: SkillsOptions): SkillsCapability;
+/** The manifest's skills and the bytes behind their files, for a capability declaration. */
+export declare function skillsDeclaration(listed: readonly LoadedSkill[]): Required<Pick<CapabilityDeclaration, "skills" | "skillFiles">>;

package/dist/skills/skills.js

@@ -13,23 +13,20 @@ import { loadSkillsFromDirectory, resolveSkillsRoot, } from "./load.js";
  *     references/policy.md
  * ```
  *
- * Sets both `skills` (manifest names/descriptions) and `skillRecords` (bodies +
- * resources) so callers do not duplicate content. The harness injects
- * `load_skill` / `read_skill_resource` from the records.
+ * Sets `skills`: each skill's name, description and files (every file of its folder, binary
+ * included, by content hash). The client uploads the files the Runtime lacks when it registers
+ * the agent, and the Runtime serves `load_skill` / `read_skill_resource` from them.
  */
 export function skills(directory, options = {}) {
     const root = resolveSkillsRoot(directory);
     const diagnostics = [];
-    const records = loadSkillsFromDirectory(root, diagnostics);
-    const listed = Object.values(records);
+    const loaded = loadSkillsFromDirectory(root, diagnostics);
+    const listed = Object.values(loaded);
     const id = options.id ?? basename(root);
     if (listed.length === 0) {
         return { id, root, diagnostics };
     }
-    const skillManifest = Object.fromEntries(listed.map((skill) => [
-        skill.name,
-        { name: skill.name, description: skill.description },
-    ]));
+    const { skills: skillManifest, skillFiles } = skillsDeclaration(listed);
     return {
         id,
         root,
@@ -41,7 +38,17 @@ export function skills(directory, options = {}) {
             }))),
         ],
         skills: skillManifest,
-        skillRecords: records,
+        skillFiles,
         diagnostics,
     };
 }
+/** The manifest's skills and the bytes behind their files, for a capability declaration. */
+export function skillsDeclaration(listed) {
+    return {
+        skills: Object.fromEntries(listed.map((skill) => [
+            skill.name,
+            { name: skill.name, description: skill.description, files: skill.files },
+        ])),
+        skillFiles: Object.assign({}, ...listed.map((skill) => skill.sources)),
+    };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nylorun/agents",
-  "version": "0.14.0-beta",
-  "description": "Nylorun agent definitions, session client and Action endpoint",
+  "version": "0.16.0-beta",
+  "description": "Nylorun agent definitions and session client",
   "type": "module",
   "license": "Apache-2.0",
   "files": [
@@ -43,7 +43,7 @@
     "test": "vitest run --passWithNoTests"
   },
   "dependencies": {
-    "@nylorun/core": "0.13.0-beta",
+    "@nylorun/core": "0.15.0-beta",
     "gray-matter": "^4.0.3"
   },
   "peerDependencies": {

package/dist/action-handler.d.ts

@@ -1,63 +0,0 @@
-import { type EndpointPingResponse } from "@nylorun/core/contracts";
-import type { BuiltWorkflow } from "@nylorun/core/define";
-import { toNodeListener } from "./ag-ui/node.js";
-import { type AgentSource, type AgentsClient } from "./client.js";
-export interface ActionHandlerOptions {
-    /** The agents and workflows this endpoint serves. Agents they embed are served too. */
-    agents: readonly (AgentSource | BuiltWorkflow)[];
-    /**
-     * Application client, used by `register` (and, when `runtime` is not set, to read the
-     * Tenant's public keys). Default: `createClient()`, from the environment or the Project link.
-     */
-    client?: AgentsClient | Promise<AgentsClient>;
-    /**
-     * Where to read the Tenant's public keys without a key. Set it for a process that only
-     * serves Actions and holds no application key.
-     */
-    runtime?: {
-        url: string;
-        fetch?: typeof fetch;
-    };
-    /** The Tenant's public keys, instead of reading them from the Runtime. */
-    jwks?: {
-        keys: readonly JsonWebKey[];
-    };
-    /**
-     * The URL the Runtime calls, as registered. Every delivery token must name it. Default: the
-     * URL passed to `register` in this process; until then, any URL of the Tenant.
-     */
-    url?: string;
-    /** Registered with each endpoint. Default: `NYLORUN_IMPLEMENTATION_VERSION`, else `dev`. */
-    implementationVersion?: string;
-    /** Receives errors that are answered with a status instead of thrown. */
-    onError?: (error: unknown) => void;
-    /**
-     * Keeps the process alive for a background tool's work after its `202` answer, on platforms
-     * that end a request's work with its response (for example a serverless platform's
-     * `waitUntil`). A Node server needs nothing.
-     */
-    waitUntil?: (work: Promise<unknown>) => void;
-}
-export interface RegisterOptions {
-    /** The URL the Runtime calls, e.g. `http://localhost:3000/nylorun/actions`. */
-    url: string;
-    /** Save the definitions first. Default true. */
-    saveDefinitions?: boolean;
-    /** How long one inline delivery may take, in milliseconds. */
-    timeoutMs?: number;
-    /** In-flight deliveries per agent. */
-    maxConcurrent?: number;
-    signal?: AbortSignal;
-}
-export interface ActionHandler {
-    /** A web-standard handler: Hono, Next.js route handlers, Workers, Bun, Deno. */
-    fetch(request: Request): Promise<Response>;
-    /** The same handler for `node:http` and Express. */
-    readonly node: ReturnType<typeof toNodeListener>;
-    /**
-     * Saves the definitions, points the Runtime at `url` for every served agent and pings each
-     * one through the Runtime, so a wrong URL or a tunnel that is down fails here.
-     */
-    register(options: RegisterOptions): Promise<EndpointPingResponse[]>;
-}
-export declare function createActionHandler(options: ActionHandlerOptions): ActionHandler;

package/dist/action-handler.js

@@ -1,279 +0,0 @@
-/**
- * An Action endpoint (design: Action endpoints): the application mounts this handler at a URL
- * and registers the URL; the Runtime POSTs each Action for the served agents to it and records
- * the answer as the Action's outcome. No stream, no claim, no key needed to serve.
- *
- * Each request is checked before any code runs: the delivery token must be signed by the
- * Tenant's signing key, be for this Tenant, this URL (once known), this Action and this
- * generation, and cover the exact body. The Action then runs through `executeAction`, with the
- * request's signal as `ctx.signal`.
- */
-import { OUTCOME_HEADER, SIGNATURE_HEADER, } from "@nylorun/core/compatibility";
-import { ActionDeliverySchema, DeliveryHeartbeatResponseSchema, EndpointPingResponseSchema, PutEndpointsRequestSchema, } from "@nylorun/core/contracts";
-import { toNodeListener } from "./ag-ui/node.js";
-import { createClient } from "./client.js";
-import { DeliveryVerificationError, JwksCache, verifyDeliveryToken, } from "./delivery-token.js";
-import { executeAction, runsInBackground, } from "./execute-action.js";
-import { RuntimeError, Transport, delay, segment } from "./http.js";
-import { createActionSandbox } from "./sandbox/client.js";
-import { buildAgents, embeddedIn, flowManifestHash, implementationVersionOf, } from "./served-definitions.js";
-/** The Host feature `register` needs. */
-const REQUIRED_FEATURE = "action-endpoints";
-export function createActionHandler(options) {
-    const agents = buildAgents(options.agents, "createActionHandler");
-    const version = implementationVersionOf(options);
-    let client;
-    const clientOf = () => (client ??= Promise.resolve(options.client ?? createClient()));
-    let audience = options.url;
-    let verification;
-    const verificationOf = () => (verification ??= resolveVerification(options, clientOf)).catch((error) => {
-        verification = undefined;
-        throw error;
-    });
-    let callbacks;
-    const report = (error) => {
-        try {
-            options.onError?.(error);
-        }
-        catch { }
-    };
-    const handle = async (request) => {
-        if (request.method !== "POST")
-            return answer(405, "method_not_allowed", "An Action endpoint accepts POST only");
-        const body = new Uint8Array(await request.arrayBuffer());
-        const { url, fetch, keys } = await verificationOf();
-        const token = request.headers.get(SIGNATURE_HEADER);
-        let claims;
-        try {
-            claims = await verifyDeliveryToken(token, {
-                keys: keys.lookup,
-                body,
-                ...(audience === undefined ? {} : { audience }),
-            });
-        }
-        catch (error) {
-            if (!(error instanceof DeliveryVerificationError))
-                throw error;
-            // A key this endpoint has not seen yet (a rotation within the refetch interval) is not
-            // a refusal: the Runtime retries a 503, while a 401 would fail the Action.
-            return answer(error.code === "key_unknown" ? 503 : 401, error.code, error.message);
-        }
-        let delivery;
-        try {
-            delivery = ActionDeliverySchema.parse(JSON.parse(new TextDecoder().decode(body)));
-        }
-        catch {
-            return answer(400, "invalid_delivery", "The body is not an Action delivery");
-        }
-        if (delivery.type === "ping") {
-            if (claims.sub !== "ping" || claims.agt !== delivery.agentId)
-                return answer(401, "signature_invalid", "The token is for another delivery");
-            const agent = agents.get(delivery.agentId);
-            if (!agent)
-                return notServed(delivery.agentId);
-            const manifestHash = flowManifestHash(agent);
-            return Response.json({
-                agentId: agent.id,
-                implementationVersion: version,
-                ...(manifestHash === undefined ? {} : { manifestHash }),
-            });
-        }
-        const { action } = delivery;
-        if (claims.sub !== action.actionId ||
-            claims.gen !== action.generation ||
-            claims.agt !== action.agentId)
-            return answer(401, "signature_invalid", "The token is for another delivery");
-        const agent = agents.get(action.agentId);
-        if (!agent)
-            return notServed(action.agentId);
-        const served = flowManifestHash(agent);
-        if (served !== undefined && "key" in action && action.manifestHash !== served)
-            return answer(409, "version_mismatch", `Action ${action.actionId} belongs to manifest ${action.manifestHash} of '${action.agentId}'; this endpoint serves ${served}`);
-        if (runsInBackground(action, agent)) {
-            const work = runInBackground({
-                action,
-                agent,
-                token: token,
-                sandbox: delivery.sandbox,
-                runtime: { url, ...(fetch ? { fetch } : {}) },
-                report,
-            });
-            options.waitUntil?.(work);
-            return new Response(null, { status: 202 });
-        }
-        const sandbox = delivery.sandbox
-            ? createActionSandbox({
-                transport: (callbacks = callbacks
-                    ? callbacks.withKey(token)
-                    : new Transport({ url, key: token, ...(fetch ? { fetch } : {}) })),
-                actionId: action.actionId,
-                signal: request.signal,
-            })
-            : undefined;
-        try {
-            const outcome = await executeAction(action, agent, request.signal, {
-                ...(sandbox ? { sandbox } : {}),
-            });
-            return Response.json(outcome, { headers: { [OUTCOME_HEADER]: "1" } });
-        }
-        catch (error) {
-            if (request.signal.aborted)
-                return answer(503, "aborted", "The Runtime closed the delivery");
-            // Tool errors are outcomes; a throw means this endpoint cannot run the Action at all.
-            report(error);
-            return answer(404, "action_not_served", error instanceof Error ? error.message : String(error));
-        }
-    };
-    const fetchHandler = async (request) => {
-        try {
-            return await handle(request);
-        }
-        catch (error) {
-            report(error);
-            // Not run: the Runtime retries a 503 whatever the Action's kind.
-            return answer(503, "endpoint_unavailable", error instanceof Error ? error.message : String(error));
-        }
-    };
-    return {
-        fetch: fetchHandler,
-        node: toNodeListener({ fetch: fetchHandler }),
-        async register(register) {
-            const application = await clientOf();
-            const { transport } = application;
-            await transport.requireFeature(REQUIRED_FEATURE, register.signal);
-            if (register.saveDefinitions ?? true) {
-                const embedded = embeddedIn(agents);
-                for (const agent of agents.values())
-                    if (!embedded.has(agent.id))
-                        await application.saveAgent(agent, { implementationVersion: version });
-            }
-            const endpoints = [...agents.values()].map((agent) => {
-                const manifestHash = flowManifestHash(agent);
-                return {
-                    agentId: agent.id,
-                    url: register.url,
-                    implementationVersion: version,
-                    ...(manifestHash === undefined ? {} : { manifestHash }),
-                    ...(register.timeoutMs === undefined ? {} : { timeoutMs: register.timeoutMs }),
-                    ...(register.maxConcurrent === undefined
-                        ? {}
-                        : { maxConcurrent: register.maxConcurrent }),
-                };
-            });
-            await transport.json("/v1/endpoints", "PUT", PutEndpointsRequestSchema.parse({ endpoints }), register.signal);
-            audience = register.url;
-            const answers = [];
-            for (const agent of agents.values())
-                answers.push(EndpointPingResponseSchema.parse(await transport.json(`/v1/endpoints/${segment(agent.id)}/ping`, "POST", {}, register.signal)));
-            return answers;
-        },
-    };
-}
-/** How long a background tool waits before its first heartbeat, and after a failed one. */
-const HEARTBEAT_RETRY_MS = 1_000;
-/**
- * A background tool (`ToolDefinition.background`): runs after the `202` answer, heartbeats on
- * the deadline the Runtime returns, stops when a heartbeat answers `409` (cancelled, lost or
- * sent again), and posts its outcome. Every callback uses the newest delivery token.
- */
-async function runInBackground(input) {
-    const { action, report } = input;
-    let current = new Transport({ ...input.runtime, key: input.token });
-    const live = {
-        json: (...args) => current.json(...args),
-    };
-    const path = `/v1/actions/${segment(action.actionId)}`;
-    const stop = new AbortController();
-    const done = new AbortController();
-    const heartbeats = (async () => {
-        let wait = HEARTBEAT_RETRY_MS;
-        while (!done.signal.aborted && !stop.signal.aborted) {
-            try {
-                await delay(wait, done.signal);
-            }
-            catch {
-                return;
-            }
-            try {
-                const renewed = DeliveryHeartbeatResponseSchema.parse(await current.json(`${path}/heartbeat`, "POST", undefined, done.signal));
-                current = current.withKey(renewed.token);
-                wait = Math.max(HEARTBEAT_RETRY_MS, Math.floor((Date.parse(renewed.deadlineAt) - Date.now()) / 3));
-            }
-            catch (error) {
-                if (done.signal.aborted)
-                    return;
-                if (error instanceof RuntimeError && error.status === 409) {
-                    stop.abort(error);
-                    return;
-                }
-                report(error);
-                wait = HEARTBEAT_RETRY_MS;
-            }
-        }
-    })();
-    let outcome;
-    try {
-        outcome = await executeAction(action, input.agent, stop.signal, {
-            ...(input.sandbox
-                ? { sandbox: createActionSandbox({ transport: live, actionId: action.actionId, signal: stop.signal }) }
-                : {}),
-        });
-    }
-    catch (error) {
-        // Not served here: say so rather than leave the Runtime waiting for the deadline.
-        report(error);
-        outcome = {
-            value: {
-                kind: "failed",
-                code: "action_not_served",
-                message: error instanceof Error ? error.message : String(error),
-            },
-        };
-    }
-    finally {
-        done.abort();
-    }
-    await heartbeats;
-    if (stop.signal.aborted)
-        return;
-    for (let attempt = 0;; attempt++) {
-        try {
-            await current.json(`${path}/result`, "POST", outcome);
-            return;
-        }
-        catch (error) {
-            if (attempt >= 4 ||
-                (error instanceof RuntimeError && error.status < 500 && error.status !== 429)) {
-                report(error);
-                return;
-            }
-            await delay(Math.min(4_000, 250 * 2 ** attempt), new AbortController().signal);
-        }
-    }
-}
-async function resolveVerification(options, clientOf) {
-    if (options.runtime) {
-        const { url, fetch } = options.runtime;
-        return {
-            url,
-            ...(fetch ? { fetch } : {}),
-            keys: new JwksCache(options.jwks ?? { url, ...(fetch ? { fetch } : {}) }),
-        };
-    }
-    const { transport } = await clientOf();
-    return {
-        url: transport.url,
-        fetch: transport.fetcher,
-        keys: new JwksCache(options.jwks ?? {
-            url: transport.url,
-            key: transport.key,
-            fetch: transport.fetcher,
-        }),
-    };
-}
-function notServed(agentId) {
-    return answer(404, "agent_not_served", `This endpoint does not serve '${agentId}'`);
-}
-function answer(status, code, message) {
-    return Response.json({ code, message }, { status });
-}

package/dist/delivery-token.d.ts

@@ -1,62 +0,0 @@
-/** The claims of a verified delivery token. */
-export interface DeliveryClaims {
-    readonly iss: string;
-    readonly aud: string;
-    /** The Action id, or `ping`. */
-    readonly sub: string;
-    /** The agent or workflow the Action belongs to. */
-    readonly agt: string;
-    /** The delivery's generation; `0` for a ping. */
-    readonly gen: number;
-    /** base64url SHA-256 of the request body. */
-    readonly bdy: string;
-    readonly iat: number;
-    readonly exp: number;
-    readonly jti: string;
-}
-/** Why a delivery was refused; `code` is sent back to the Runtime. */
-export declare class DeliveryVerificationError extends Error {
-    readonly code: "signature_missing" | "signature_invalid" | "key_unknown" | "token_expired";
-    readonly name = "DeliveryVerificationError";
-    constructor(code: "signature_missing" | "signature_invalid" | "key_unknown" | "token_expired", message: string);
-}
-/** Finds the public key for a `kid`, or `undefined` when the Tenant has none. */
-export type KeyLookup = (kid: string) => Promise<CryptoKey | undefined>;
-/**
- * Verifies `token` against `body`. The keys are the installation's, so a valid signature already
- * binds the issuer to its one Tenant: any `urn:nylorun:tenant:<id>` issuer is accepted (and
- * returned in `iss`) unless `tenantId` names the one expected.
- */
-export declare function verifyDeliveryToken(token: string | null, options: {
-    keys: KeyLookup;
-    /** When set, `iss` must name this Tenant. */
-    tenantId?: string;
-    body: Uint8Array;
-    /** When set, `aud` must equal it: the URL this endpoint was registered with. */
-    audience?: string;
-    now?: number;
-}): Promise<DeliveryClaims>;
-/** base64url SHA-256 of `body`: the token's `bdy` claim. */
-export declare function bodyHash(body: Uint8Array): Promise<string>;
-/**
- * The Tenant's public keys, fetched from `GET /v1/access/jwks` and cached by `kid`. An
- * unknown `kid` refetches once, at most every `refetchMs`, so forged tokens cannot make the
- * endpoint call the Runtime on every request. Concurrent lookups share one in-flight fetch.
- */
-export declare class JwksCache {
-    private readonly source;
-    private readonly refetchMs;
-    private readonly keys;
-    private lastFetch;
-    private pending;
-    constructor(source: {
-        url: string;
-        key?: string;
-        fetch?: typeof fetch;
-    } | {
-        keys: readonly JsonWebKey[];
-    }, refetchMs?: number);
-    readonly lookup: KeyLookup;
-    private load;
-    private fetchKeys;
-}