@nylorun/runtime 0.13.0-beta → 0.14.0-beta

package/dist/api/components.js

@@ -0,0 +1,83 @@
+/**
+ * Named schemas of the OpenAPI document: each becomes `#/components/schemas/<id>`, referenced
+ * wherever a route uses it. Named with Zod's own `.meta({ id })`, which works on the contracts'
+ * schemas whenever they were created; made once per process, since ids are unique in Zod's
+ * global registry.
+ */
+import { z } from "zod";
+import { JwksSchema, CreateTokenRequestSchema, CreateTokenResponseSchema, AccessPolicyResponseSchema, PutAccessPolicyRequestSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, ListPublishableKeysResponseSchema, PublishableKeySchema, CreatePublishableKeyRequestSchema, UpdatePublishableKeyRequestSchema, RevokeSubjectRequestSchema, RevokeSubjectResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, ActionResultReceiptSchema, DeleteEndpointResponseSchema, DeliveryHeartbeatResponseSchema, ActionOutcomeSchema, EndpointPingResponseSchema, ListEndpointsResponseSchema, PutEndpointsRequestSchema, SandboxToolOutcomeSchema, SessionCommandSchema, AdminStatusSchema, AdminTenantListSchema, AdminTenantStatusSchema, CreateTenantRequestSchema, HostShutdownResponseSchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, TenantEnvelopeSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+function named(id, schema) {
+    return schema.meta({ id });
+}
+export const Rejected = named("Rejected", RejectedResponseSchema);
+export const ProtocolRejected = named("ProtocolRejected", ProtocolRejectedResponseSchema);
+export const TenantEnvelope = named("TenantEnvelope", TenantEnvelopeSchema);
+export const CreateTenantRequest = named("CreateTenantRequest", CreateTenantRequestSchema);
+export const AdminTenantList = named("AdminTenantList", AdminTenantListSchema);
+export const AdminTenantStatus = named("AdminTenantStatus", AdminTenantStatusSchema);
+export const AdminStatus = named("AdminStatus", AdminStatusSchema);
+export const HostShutdownResponse = named("HostShutdownResponse", HostShutdownResponseSchema);
+export const SandboxToolOutcome = named("SandboxToolOutcome", SandboxToolOutcomeSchema);
+export const PutEndpointsRequest = named("PutEndpointsRequest", PutEndpointsRequestSchema);
+export const ListEndpointsResponse = named("ListEndpointsResponse", ListEndpointsResponseSchema);
+export const DeleteEndpointResponse = named("DeleteEndpointResponse", DeleteEndpointResponseSchema);
+export const EndpointPingResponse = named("EndpointPingResponse", EndpointPingResponseSchema);
+export const DeliveryHeartbeatResponse = named("DeliveryHeartbeatResponse", DeliveryHeartbeatResponseSchema);
+export const ActionOutcome = named("ActionOutcome", ActionOutcomeSchema);
+export const SessionCommand = named("SessionCommand", SessionCommandSchema);
+export const AcceptedResponse = named("AcceptedResponse", AcceptedResponseSchema);
+export const ActionResultReceipt = named("ActionResultReceipt", ActionResultReceiptSchema);
+export const ListAgentsResponse = named("ListAgentsResponse", ListAgentsResponseSchema);
+export const ListPublicAgentsResponse = named("ListPublicAgentsResponse", ListPublicAgentsResponseSchema);
+export const PutAgentRequest = named("PutAgentRequest", PutAgentRequestSchema);
+export const PutAgentResponse = named("PutAgentResponse", PutAgentResponseSchema);
+export const ListSessionsResponse = named("ListSessionsResponse", ListSessionsResponseSchema);
+export const PutSessionRequest = named("PutSessionRequest", PutSessionRequestSchema);
+export const SessionView = named("SessionView", SessionViewSchema);
+export const LiveEvent = named("LiveEvent", LiveEventSchema);
+/** `action.delivery_failed` → `ActionDeliveryFailedEvent`. */
+export function eventComponentName(type) {
+    return `${type
+        .split(/[._]/)
+        .map((part) => part[0].toUpperCase() + part.slice(1))
+        .join("")}Event`;
+}
+/** The event catalog as components: one per event type, and `SessionEvent`, their union. */
+export const SessionEvent = named("SessionEvent", z.discriminatedUnion("type", EVENT_TYPES.map((type) => named(eventComponentName(type), EVENT_SCHEMAS[type]))));
+export const SessionItemsResponse = named("SessionItemsResponse", SessionItemsResponseSchema.extend({ items: z.array(SessionEvent) }));
+export const StreamClosedFrame = named("StreamClosedFrame", StreamClosedFrameSchema);
+export const TenantStatus = named("TenantStatus", TenantStatusSchema);
+export const ResetTenantRequest = named("ResetTenantRequest", ResetTenantRequestSchema);
+export const ResetTenantResponse = named("ResetTenantResponse", ResetTenantResponseSchema);
+export const SeedTenantConfigRequest = named("SeedTenantConfigRequest", SeedTenantConfigRequestSchema);
+export const SeedTenantConfigResponse = named("SeedTenantConfigResponse", SeedTenantConfigResponseSchema);
+export const HostModelCatalog = named("HostModelCatalog", HostModelCatalogSchema);
+export const TenantSandboxView = named("TenantSandboxView", TenantSandboxViewSchema);
+export const PutTenantSandboxRequest = named("PutTenantSandboxRequest", PutTenantSandboxRequestSchema);
+export const ListProvidersResponse = named("ListProvidersResponse", ListProvidersResponseSchema);
+export const HostModelView = named("HostModelView", HostModelViewSchema);
+export const PutHostModelRequest = named("PutHostModelRequest", PutHostModelRequestSchema);
+export const SelectHostModelRequest = named("SelectHostModelRequest", SelectHostModelRequestSchema);
+export const CreateVaultRequest = named("CreateVaultRequest", CreateVaultRequestSchema);
+export const VaultInfo = named("VaultInfo", VaultInfoSchema);
+export const ListVaultsResponse = named("ListVaultsResponse", ListVaultsResponseSchema);
+export const CreateCredentialRequest = named("CreateCredentialRequest", CreateCredentialRequestSchema);
+export const CredentialInfo = named("CredentialInfo", CredentialInfoSchema);
+export const ListCredentialsResponse = named("ListCredentialsResponse", ListCredentialsResponseSchema);
+export const RotateCredentialRequest = named("RotateCredentialRequest", RotateCredentialRequestSchema);
+export const DeletedResponse = named("DeletedResponse", DeletedResponseSchema);
+export const Jwks = named("Jwks", JwksSchema);
+export const CreateTokenRequest = named("CreateTokenRequest", CreateTokenRequestSchema);
+export const CreateTokenResponse = named("CreateTokenResponse", CreateTokenResponseSchema);
+export const AccessPolicyResponse = named("AccessPolicyResponse", AccessPolicyResponseSchema);
+export const PutAccessPolicyRequest = named("PutAccessPolicyRequest", PutAccessPolicyRequestSchema);
+export const SigningKeyList = named("SigningKeyList", SigningKeyListSchema);
+export const SigningKeyView = named("SigningKeyView", SigningKeyViewSchema);
+export const RotateSigningKeysRequest = named("RotateSigningKeysRequest", RotateSigningKeysRequestSchema);
+export const RevokeSigningKeyRequest = named("RevokeSigningKeyRequest", RevokeSigningKeyRequestSchema);
+export const ListPublishableKeysResponse = named("ListPublishableKeysResponse", ListPublishableKeysResponseSchema);
+export const PublishableKey = named("PublishableKey", PublishableKeySchema);
+export const CreatePublishableKeyRequest = named("CreatePublishableKeyRequest", CreatePublishableKeyRequestSchema);
+export const UpdatePublishableKeyRequest = named("UpdatePublishableKeyRequest", UpdatePublishableKeyRequestSchema);
+export const RevokeSubjectRequest = named("RevokeSubjectRequest", RevokeSubjectRequestSchema);
+export const RevokeSubjectResponse = named("RevokeSubjectResponse", RevokeSubjectResponseSchema);

package/dist/api/http/app.d.ts

@@ -0,0 +1,18 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { AuthScope, TenantContext } from "../../tenant/context.js";
+import type { NodeBindings } from "../../tenant/types.js";
+import { type RouteAccess } from "./define.js";
+export type TenantBindings = NodeBindings & {
+    readonly tenant: TenantContext;
+};
+export type TenantEnv = {
+    Bindings: TenantBindings;
+    Variables: {
+        /** Who is calling, once authenticated. */
+        scope: AuthScope;
+    };
+};
+/** The Tenant API, built on first use. */
+export declare function tenantApi(): OpenAPIHono<TenantEnv>;
+/** Who may call `method` on a Tenant path (its decoded segments), if it is a route. */
+export declare function findTenantRoute(method: string, segments: readonly string[]): RouteAccess | undefined;

package/dist/api/http/app.js

@@ -0,0 +1,58 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
+import { fail } from "../../tenant/http.js";
+import { a2aRoutes } from "../a2a/endpoint.js";
+import { agUiRoutes } from "../ag-ui/endpoint.js";
+import { authenticateCaller, declaredRoute, pathSegments } from "./define.js";
+import { jsonResponse, rejectionOf } from "./respond.js";
+import { accessRoutes } from "./routes/access.js";
+import { endpointRoutes } from "./routes/endpoints.js";
+import { actionRoutes } from "./routes/actions.js";
+import { sessionRoutes } from "./routes/sessions.js";
+import { tenantRoutes } from "./routes/tenant.js";
+import { vaultRoutes } from "./routes/vaults.js";
+let app;
+/** The Tenant API, built on first use. */
+export function tenantApi() {
+    return (app ??= build());
+}
+/** Who may call `method` on a Tenant path (its decoded segments), if it is a route. */
+export function findTenantRoute(method, segments) {
+    tenantApi();
+    return declaredRoute(method, segments);
+}
+/** No route: authenticated first, so an unknown credential stays the opaque 404. */
+async function notFound(c) {
+    await authenticateCaller(c);
+    return fail(404, "Route not found");
+}
+function build() {
+    const api = new OpenAPIHono();
+    // Hono serves HEAD with the GET route; the Tenant API has no HEAD routes.
+    api.use(async (c, next) => (c.req.method === "HEAD" ? await notFound(c) : await next()));
+    // A malformed path is rejected before anything else reads it.
+    api.use(async (c, next) => {
+        pathSegments(c.env.incoming);
+        await next();
+    });
+    actionRoutes(api);
+    endpointRoutes(api);
+    sessionRoutes(api);
+    tenantRoutes(api);
+    vaultRoutes(api);
+    accessRoutes(api);
+    agUiRoutes(api);
+    a2aRoutes(api);
+    api.notFound(notFound);
+    api.onError((error, c) => {
+        const { outgoing } = c.env;
+        // Once a response has started, the rejection can only end it.
+        if (outgoing.headersSent) {
+            outgoing.end();
+            return RESPONSE_ALREADY_SENT;
+        }
+        const rejection = rejectionOf(error);
+        return jsonResponse(rejection.status, rejection.body, rejection.headers);
+    });
+    return api;
+}

package/dist/api/http/body.d.ts

@@ -0,0 +1,4 @@
+/** The body as text. */
+export declare function readText(request: Request): Promise<string>;
+/** The body as JSON, before any schema. */
+export declare function readJson(request: Request): Promise<unknown>;

package/dist/api/http/body.js

@@ -0,0 +1,37 @@
+/**
+ * Request bodies of Tenant routes, read as the router they replace read them
+ * (`tenant/http.ts`): at most 1 MiB, UTF-8, and a missing or malformed JSON body is
+ * `400 Invalid JSON`.
+ */
+import { fail } from "../../tenant/http.js";
+const MAX_BODY_BYTES = 1024 * 1024;
+/** The body as text. */
+export async function readText(request) {
+    if (request.body === null)
+        return "";
+    const chunks = [];
+    let bytes = 0;
+    const reader = request.body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        bytes += value.byteLength;
+        if (bytes > MAX_BODY_BYTES) {
+            await reader.cancel();
+            fail(413, "Request too large");
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+/** The body as JSON, before any schema. */
+export async function readJson(request) {
+    const text = await readText(request);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return fail(400, "Invalid JSON");
+    }
+}

package/dist/api/http/define.d.ts

@@ -0,0 +1,39 @@
+/**
+ * How a Tenant API route is declared: once, with who may call it, for serving and for the
+ * OpenAPI document.
+ *
+ * `RouteAccess` says which credentials a route takes, which subject scopes reach it and
+ * whether browsers may call it: the one statement of who may call a route. The document shows
+ * it as the operation's `security`, its `Nylorun-*` headers and `x-nylorun-*` fields; the Host
+ * answers browser preflights from it (`findTenantRoute`). Serving runs the Tenant's checks in
+ * order: the browser client, the bearer, the subject's scopes, then the handler, which parses
+ * its body.
+ */
+import type { IncomingMessage } from "node:http";
+import type { OpenAPIHono, RouteConfig } from "@hono/zod-openapi";
+import type { Context, Handler } from "hono";
+import type { SubjectScope } from "@nylorun/core/contracts";
+import type { AuthScope } from "../../tenant/context.js";
+import type { TenantEnv } from "./app.js";
+export type Credential = "application" | "subject" | "token" | "publishable" | "delivery";
+export interface RouteAccess {
+    readonly credentials: readonly Credential[];
+    /** The subject scopes that reach the route: any one of them, none (`never`), or all (`any`). */
+    readonly scopes: readonly SubjectScope[] | "never" | "any";
+    /** A browser page may call it: its preflight is allowed. */
+    readonly browser?: boolean;
+    /**
+     * Public data: a request with no credential at all (no `Authorization`, no `Nylorun-Key`) is
+     * served too. A credential that is sent is still checked, so a wrong one stays the opaque 404.
+     */
+    readonly anonymous?: boolean;
+}
+/** The route's path segments, decoded, as the Tenant's checks read them. */
+export declare function pathSegments(incoming: IncomingMessage): string[];
+/** Who is calling: the browser client and the bearer, as every Tenant request checks them. */
+export declare function authenticateCaller(c: Context<TenantEnv>, 
+/** The route serves public data (`RouteAccess.anonymous`): no credential is needed. */
+anonymous?: boolean): Promise<AuthScope>;
+/** The declared route `method path` is, if any. `{param}` segments match any one segment. */
+export declare function declaredRoute(method: string, segments: readonly string[]): RouteAccess | undefined;
+export declare function tenantRoute(api: OpenAPIHono<TenantEnv>, access: RouteAccess, route: RouteConfig, handler: Handler<TenantEnv>): void;

package/dist/api/http/define.js

@@ -0,0 +1,130 @@
+import { z } from "zod";
+import { PROTOCOL_VERSION } from "@nylorun/core/compatibility";
+import { authenticate, requireScopes } from "../../tenant/auth.js";
+import { identifyClient } from "../../tenant/browser.js";
+import { fail } from "../../tenant/http.js";
+import { ProtocolRejected, Rejected } from "../components.js";
+const SCHEMES = {
+    application: "applicationKey",
+    subject: "applicationKey",
+    token: "subjectToken",
+    publishable: "publishableKey",
+    delivery: "deliveryToken",
+};
+const rejected = (description) => ({
+    description,
+    content: { "application/json": { schema: Rejected } },
+});
+/** The route's path segments, decoded, as the Tenant's checks read them. */
+export function pathSegments(incoming) {
+    return new URL(incoming.url ?? "/", "http://runtime").pathname
+        .split("/")
+        .filter(Boolean)
+        .map((segment) => {
+        try {
+            return decodeURIComponent(segment);
+        }
+        catch {
+            return fail(400, "Malformed path");
+        }
+    });
+}
+/** Who is calling: the browser client and the bearer, as every Tenant request checks them. */
+export async function authenticateCaller(c, 
+/** The route serves public data (`RouteAccess.anonymous`): no credential is needed. */
+anonymous = false) {
+    const { tenant, incoming, outgoing } = c.env;
+    // The client app first: a browser's origin is checked, and CORS headers set, before the
+    // bearer is looked at, so every answer from here on is readable by an allowed page.
+    const client = await identifyClient(tenant, incoming, outgoing);
+    if (anonymous && !client && incoming.headers.authorization === undefined)
+        return { kind: "anonymous" };
+    return await authenticate(tenant, incoming, client);
+}
+const declared = [];
+/** The declared route `method path` is, if any. `{param}` segments match any one segment. */
+export function declaredRoute(method, segments) {
+    return declared.find((route) => route.method === method.toUpperCase() &&
+        route.segments.length === segments.length &&
+        route.segments.every((segment, index) => segment === segments[index] ||
+            (segment.startsWith("{") && segments[index] !== "")))?.access;
+}
+function authenticated(access) {
+    return async (c, next) => {
+        const scope = await authenticateCaller(c, access.anonymous === true);
+        requireScopes(scope, access.scopes);
+        if (scope.kind === "publishable" && !access.credentials.includes("publishable"))
+            fail(403, "A publishable key alone reaches only the agent list", {
+                code: "scope_required",
+            });
+        // Handlers tell callers apart by kind, and a delivery token is none of theirs: only the
+        // routes that list it may see one.
+        if (scope.kind === "delivery" && !access.credentials.includes("delivery"))
+            fail(403, "A delivery token reaches only its Action's callbacks");
+        c.set("scope", scope);
+        await next();
+    };
+}
+export function tenantRoute(api, access, route, handler) {
+    const takes = (credential) => access.credentials.includes(credential);
+    const schemes = [...new Set(access.credentials.map((credential) => SCHEMES[credential]))];
+    const headers = z.object({
+        "Nylorun-Protocol": z.string().meta({ description: `The protocol version, \`${PROTOCOL_VERSION}\`` }),
+        ...(access.browser || takes("publishable")
+            ? {
+                "Nylorun-Tenant": z
+                    .string()
+                    .optional()
+                    .meta({ description: "The Tenant; optional with a publishable key, which names it" }),
+            }
+            : { "Nylorun-Tenant": z.string().meta({ description: "The Tenant" }) }),
+        ...(takes("subject")
+            ? {
+                "Nylorun-Subject": z
+                    .string()
+                    .optional()
+                    .meta({ description: "The person an application key acts for" }),
+                "Nylorun-Scopes": z
+                    .string()
+                    .optional()
+                    .meta({ description: "The subject's space-separated scopes; required with a subject" }),
+            }
+            : {}),
+        ...(takes("publishable")
+            ? {
+                "Nylorun-Key": z
+                    .string()
+                    .optional()
+                    .meta({ description: "A publishable key, from a browser page on an allowed origin" }),
+            }
+            : {}),
+    });
+    api.openAPIRegistry.registerPath({
+        ...route,
+        // `{}`: no credential needed (OpenAPI's optional security).
+        security: [
+            ...schemes.map((scheme) => ({ [scheme]: [] })),
+            ...(access.anonymous ? [{}] : []),
+        ],
+        request: { ...route.request, headers },
+        responses: {
+            400: rejected("Invalid headers, path, body or cursor"),
+            ...(takes("token") ? { 401: rejected("The subject token expired or was revoked (`token_expired`)") } : {}),
+            403: rejected("Not allowed for this credential, subject scope or origin"),
+            404: rejected("Not found, or a credential the Tenant does not know (`not_found`)"),
+            426: { description: "`Nylorun-Protocol` missing or unsupported", content: { "application/json": { schema: ProtocolRejected } } },
+            ...(takes("token") ? { 429: rejected("The subject's turn limits are reached (`limit_exceeded`)") } : {}),
+            503: rejected("The Tenant's storage or streams are unavailable"),
+            ...route.responses,
+        },
+        "x-nylorun-credentials": access.credentials,
+        "x-nylorun-scopes": access.scopes,
+        "x-nylorun-browser": access.browser === true,
+    });
+    declared.push({
+        method: route.method.toUpperCase(),
+        segments: route.path.split("/").filter(Boolean),
+        access,
+    });
+    api.on(route.method.toUpperCase(), route.path.replaceAll(/\/{(.+?)}/g, "/:$1"), authenticated(access), handler);
+}

package/dist/api/http/respond.d.ts

@@ -0,0 +1,9 @@
+/** A JSON answer. CORS headers a browser needs are already on the Node response. */
+export declare function jsonResponse(status: number, body: unknown, headers?: Readonly<Record<string, string>>): Response;
+export interface Rejection {
+    readonly status: number;
+    readonly body: unknown;
+    readonly headers: Readonly<Record<string, string>>;
+}
+/** What a Tenant route that threw `error` answers. */
+export declare function rejectionOf(error: unknown): Rejection;

package/dist/api/http/respond.js

@@ -0,0 +1,44 @@
+/**
+ * How the Tenant API answers: JSON with an explicit length, and the one mapping from what a
+ * route throws to the rejection a client sees. The Hono routes and the router they replace
+ * (`routes.ts`) both answer through here, so a route answers the same wherever it runs.
+ */
+import { SandboxRouteError } from "../../core/sandbox-routes.js";
+import { HttpError, OpaqueAuthError } from "../../tenant/http.js";
+import { VaultError } from "../../vault/error.js";
+/** A JSON answer. CORS headers a browser needs are already on the Node response. */
+export function jsonResponse(status, body, headers = {}) {
+    const payload = JSON.stringify(body);
+    return new Response(payload, {
+        status,
+        headers: {
+            ...headers,
+            "content-type": "application/json",
+            "content-length": String(Buffer.byteLength(payload)),
+        },
+    });
+}
+/** What a Tenant route that threw `error` answers. */
+export function rejectionOf(error) {
+    if (error instanceof OpaqueAuthError)
+        return { status: error.status, body: error.body, headers: {} };
+    const status = error instanceof HttpError ||
+        error instanceof VaultError ||
+        error instanceof SandboxRouteError
+        ? error.status
+        : error?.name === "ZodError" ||
+            error?.message === "Invalid cursor"
+            ? 400
+            : 500;
+    const rejection = error instanceof HttpError ? error.rejection : {};
+    return {
+        status,
+        body: {
+            status: "rejected",
+            code: status === 500 ? "internal_error" : (rejection.code ?? "request_rejected"),
+            message: status === 500 ? "Runtime request failed" : error.message,
+            ...(rejection.details === undefined ? {} : { details: rejection.details }),
+        },
+        headers: error instanceof HttpError ? error.headers : {},
+    };
+}

package/dist/api/http/routes/access.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Access management (Host feature `subject-tokens`), for the application key only: subject
+ * tokens, the access policy, signing keys, publishable keys and subject revocation; and the
+ * public keys, for any caller that reached the Tenant.
+ *
+ * Subjects travel in bodies, not paths, because they may be email addresses and request paths
+ * are logged.
+ */
+import type { OpenAPIHono } from "@hono/zod-openapi";
+import type { PublishableKey as PublishableKeyBody } from "@nylorun/core/contracts";
+import type { PublishableKeyRow } from "../../../store/types.js";
+import type { TenantContext } from "../../../tenant/context.js";
+import type { TenantEnv } from "../app.js";
+export declare function accessRoutes(api: OpenAPIHono<TenantEnv>): void;
+/** A publishable key as the API shows it. */
+export declare function publishableKeyView(row: PublishableKeyRow): PublishableKeyBody;
+/**
+ * Ends every token of `subject` minted so far: bumps its epoch, then ends its open streams
+ * here and, through `tenant/control`, on every other process. Running turns continue.
+ */
+export declare function revokeSubject(ctx: TenantContext, subject: string): Promise<{
+    subject: string;
+    epoch: number;
+}>;