@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/adapters/media.d.ts

@@ -1,24 +0,0 @@
-import { type MediaAsset, type MediaReference } from "../media.js";
-export * from "../media.js";
-/** Explicit local asset store; agents receive only opaque references. */
-export declare class MediaStore {
-    private readonly root;
-    constructor(root: string);
-    saveInput(agentId: string, sessionId: string, mediaType: string, base64: string): Promise<MediaAsset>;
-    saveGenerated(agentId: string, sessionId: string, mediaType: string, bytes: Uint8Array): Promise<MediaAsset>;
-    dataUrl(reference: MediaReference, sessionId: string): Promise<{
-        readonly asset: MediaAsset;
-        readonly url: string;
-    } | undefined>;
-    latestInput(agentId: string, sessionId: string): Promise<MediaAsset | undefined>;
-    read(agentId: string, sessionId: string, assetId: string): Promise<{
-        asset: MediaAsset;
-        bytes: Uint8Array;
-    } | undefined>;
-    private save;
-    private readMetadata;
-    private directory;
-}
-export declare function localMedia(options: {
-    root: string;
-}): MediaStore;

package/dist/adapters/media.js

@@ -1,111 +0,0 @@
-import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { randomUUID } from "node:crypto";
-import { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "../media.js";
-export * from "../media.js";
-/** Explicit local asset store; agents receive only opaque references. */
-export class MediaStore {
-    root;
-    constructor(root) {
-        this.root = root;
-    }
-    async saveInput(agentId, sessionId, mediaType, base64) {
-        const bytes = decodeImageBase64(mediaType, base64);
-        return this.save(agentId, sessionId, "input", mediaType, bytes);
-    }
-    async saveGenerated(agentId, sessionId, mediaType, bytes) {
-        validateImageBytes(mediaType, bytes);
-        return this.save(agentId, sessionId, "generated", mediaType, bytes);
-    }
-    async dataUrl(reference, sessionId) {
-        const stored = await this.read(reference.agentId, sessionId, reference.assetId);
-        if (!stored)
-            return undefined;
-        return Object.freeze({
-            asset: stored.asset,
-            url: `data:${stored.asset.mediaType};base64,${Buffer.from(stored.bytes).toString("base64")}`,
-        });
-    }
-    async latestInput(agentId, sessionId) {
-        const directory = this.directory(agentId, sessionId);
-        try {
-            const metadata = await Promise.all((await readdir(directory))
-                .filter((name) => name.endsWith(".json"))
-                .map(async (name) => this.readMetadata(directory, name)));
-            return metadata
-                .filter((entry) => entry?.kind === "input")
-                .sort((left, right) => right.createdAt - left.createdAt)[0];
-        }
-        catch {
-            return undefined;
-        }
-    }
-    async read(agentId, sessionId, assetId) {
-        if (!safe(agentId) || !safe(sessionId) || !safe(assetId))
-            return undefined;
-        const directory = this.directory(agentId, sessionId);
-        const metadata = await this.readMetadata(directory, `${assetId}.json`);
-        if (!metadata)
-            return undefined;
-        try {
-            return {
-                asset: metadata,
-                bytes: await readFile(join(directory, `${assetId}.bin`)),
-            };
-        }
-        catch {
-            return undefined;
-        }
-    }
-    async save(agentId, sessionId, kind, mediaType, bytes) {
-        if (!safe(agentId) || !safe(sessionId))
-            throw new Error("Invalid media asset scope.");
-        const directory = this.directory(agentId, sessionId);
-        const asset = {
-            id: randomUUID(),
-            mediaType,
-            bytes: bytes.byteLength,
-            kind,
-            createdAt: Date.now(),
-        };
-        await mkdir(directory, { recursive: true });
-        await writeFile(join(directory, `${asset.id}.bin`), bytes);
-        await writeFile(join(directory, `${asset.id}.json`), JSON.stringify(asset));
-        return omitCreatedAt(asset);
-    }
-    async readMetadata(directory, name) {
-        try {
-            const value = JSON.parse(await readFile(join(directory, name), "utf8"));
-            return validAsset(value) ? value : undefined;
-        }
-        catch {
-            return undefined;
-        }
-    }
-    directory(agentId, sessionId) {
-        return join(this.root, agentId, sessionId);
-    }
-}
-/** Decode one canonical base64 image before it is persisted or sent to a provider. */
-function validAsset(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const asset = value;
-    return (typeof asset.id === "string" &&
-        safe(asset.id) &&
-        typeof asset.mediaType === "string" &&
-        IMAGE_MEDIA_TYPES.includes(asset.mediaType) &&
-        typeof asset.bytes === "number" &&
-        (asset.kind === "input" || asset.kind === "generated") &&
-        typeof asset.createdAt === "number");
-}
-function omitCreatedAt(asset) {
-    const { createdAt: _createdAt, ...result } = asset;
-    return Object.freeze(result);
-}
-function safe(value) {
-    return value !== "." && value !== ".." && /^[a-zA-Z0-9._-]+$/u.test(value);
-}
-export function localMedia(options) {
-    return new MediaStore(options.root);
-}

package/dist/host/cors.d.ts

@@ -1,27 +0,0 @@
-/**
- * Browser access at the Host (Host feature `browser-access`). A preflight carries no
- * credentials and no header values, so it cannot name a Tenant: the Host answers it from the
- * route alone, permissively for browser routes, and the Tenant enforces the publishable key's
- * origin allowlist on the actual request (`tenant/browser.ts`). A cached preflight therefore
- * never widens access, and it grants no credentials.
- */
-import type { IncomingMessage, ServerResponse } from "node:http";
-/** Request headers a browser may send to the Runtime. */
-export declare const BROWSER_REQUEST_HEADERS: readonly ["authorization", "content-type", "nylorun-key", "nylorun-tenant", "nylorun-protocol", "last-event-id"];
-/**
- * Tenant routes a browser may call: agents (list), sessions (not the sandbox tool route),
- * vaults, AG-UI and the JWKS. Tokens, access management, endpoints, actions and Tenant
- * settings never are.
- */
-/** The `Origin` header if it is a serialized origin (not `null`, not a path). */
-export declare function browserOrigin(request: IncomingMessage): string | undefined;
-/**
- * Answers a CORS preflight: `204` with the allowed methods and headers for a browser route,
- * `403` without any CORS header otherwise.
- */
-export declare function answerPreflight(request: IncomingMessage, response: ServerResponse, segments: readonly string[], isBrowserRoute: (method: string, segments: readonly string[]) => boolean): number;
-/**
- * CORS headers for an actual request from an allowed origin; set once with `setHeader`, so
- * every response that follows (JSON, errors, SSE) carries them.
- */
-export declare function setCorsHeaders(response: ServerResponse, origin: string): void;

package/dist/host/cors.js

@@ -1,64 +0,0 @@
-import { isSerializedOrigin } from "@nylorun/core/contracts";
-/** Request headers a browser may send to the Runtime. */
-export const BROWSER_REQUEST_HEADERS = [
-    "authorization",
-    "content-type",
-    "nylorun-key",
-    "nylorun-tenant",
-    "nylorun-protocol",
-    "last-event-id",
-];
-const BROWSER_METHODS = ["GET", "POST", "PUT", "DELETE"];
-const PREFLIGHT_MAX_AGE_SECONDS = 600;
-/**
- * Tenant routes a browser may call: agents (list), sessions (not the sandbox tool route),
- * vaults, AG-UI and the JWKS. Tokens, access management, endpoints, actions and Tenant
- * settings never are.
- */
-/** The `Origin` header if it is a serialized origin (not `null`, not a path). */
-export function browserOrigin(request) {
-    const raw = request.headers.origin;
-    const origin = Array.isArray(raw) ? raw[0] : raw;
-    return origin !== undefined && isSerializedOrigin(origin) ? origin : undefined;
-}
-/**
- * Answers a CORS preflight: `204` with the allowed methods and headers for a browser route,
- * `403` without any CORS header otherwise.
- */
-export function answerPreflight(request, response, segments, isBrowserRoute) {
-    const origin = browserOrigin(request);
-    const method = String(request.headers["access-control-request-method"] ?? "").toUpperCase();
-    const requested = String(request.headers["access-control-request-headers"] ?? "")
-        .split(",")
-        .map((name) => name.trim().toLowerCase())
-        .filter(Boolean);
-    const allowed = origin !== undefined &&
-        BROWSER_METHODS.includes(method) &&
-        isBrowserRoute(method, segments) &&
-        requested.every((name) => BROWSER_REQUEST_HEADERS.includes(name));
-    if (!allowed) {
-        response.writeHead(403, { "content-length": "0" });
-        response.end();
-        return 403;
-    }
-    response.writeHead(204, {
-        "access-control-allow-origin": origin,
-        "access-control-allow-methods": BROWSER_METHODS.join(", "),
-        "access-control-allow-headers": requested.join(", "),
-        "access-control-max-age": String(PREFLIGHT_MAX_AGE_SECONDS),
-        vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
-        "content-length": "0",
-    });
-    response.end();
-    return 204;
-}
-/**
- * CORS headers for an actual request from an allowed origin; set once with `setHeader`, so
- * every response that follows (JSON, errors, SSE) carries them.
- */
-export function setCorsHeaders(response, origin) {
-    response.setHeader("access-control-allow-origin", origin);
-    response.setHeader("vary", "Origin");
-    response.setHeader("access-control-expose-headers", "retry-after, www-authenticate");
-    response.setHeader("cache-control", "no-store");
-}

package/dist/tenant/access-policy.d.ts

@@ -1,30 +0,0 @@
-/**
- * The Tenant's access policy (Host feature `subject-tokens`): the roles subject tokens are
- * minted for, what a publishable key grants alone (`anon`), and how long tokens live. One
- * validated JSON document in the Tenant settings; a Tenant that never set one has no roles,
- * so nothing can be minted.
- *
- * A token's permissions are resolved from the policy on every request, so editing a role
- * changes outstanding tokens at their next request and removing one ends them.
- */
-import { type AccessPolicy, type RoleLimits, type TokenScope } from "@nylorun/core/contracts";
-import type { Tx } from "../store/types.js";
-export declare const ACCESS_POLICY_SETTING = "access.policy";
-export declare function readPolicy(t: Tx): Promise<AccessPolicy>;
-export declare function writePolicy(t: Tx, policy: AccessPolicy): Promise<void>;
-/** What a token may do right now: its role narrowed by what the mint asked for. */
-export interface EffectiveAccess {
-    readonly role: string;
-    readonly scopes: ReadonlySet<TokenScope>;
-    readonly agents: ReadonlySet<string> | "*";
-    readonly limits?: RoleLimits;
-}
-/** Agents both lists allow; `"*"` allows every agent. */
-export declare function intersectAgents(a: readonly string[] | "*", b: readonly string[] | "*" | undefined): ReadonlySet<string> | "*";
-/**
- * The role's permissions narrowed to `scopes` and `agents`, or undefined when the role no
- * longer exists.
- */
-export declare function resolveRole(policy: AccessPolicy, role: string, scopes: readonly TokenScope[], agents?: readonly string[]): EffectiveAccess | undefined;
-/** True when `agentId` is allowed by `agents`. */
-export declare function agentAllowed(agents: ReadonlySet<string> | "*", agentId: string): boolean;

package/dist/tenant/access-policy.js

@@ -1,52 +0,0 @@
-/**
- * The Tenant's access policy (Host feature `subject-tokens`): the roles subject tokens are
- * minted for, what a publishable key grants alone (`anon`), and how long tokens live. One
- * validated JSON document in the Tenant settings; a Tenant that never set one has no roles,
- * so nothing can be minted.
- *
- * A token's permissions are resolved from the policy on every request, so editing a role
- * changes outstanding tokens at their next request and removing one ends them.
- */
-import { AccessPolicySchema, DEFAULT_ACCESS_POLICY, } from "@nylorun/core/contracts";
-export const ACCESS_POLICY_SETTING = "access.policy";
-export async function readPolicy(t) {
-    const stored = await t.getSetting(ACCESS_POLICY_SETTING);
-    if (stored === undefined)
-        return DEFAULT_ACCESS_POLICY;
-    // Only `writePolicy` stores it, after validation.
-    return AccessPolicySchema.parse(JSON.parse(stored));
-}
-export async function writePolicy(t, policy) {
-    await t.putSetting(ACCESS_POLICY_SETTING, JSON.stringify(AccessPolicySchema.parse(policy)));
-}
-/** Agents both lists allow; `"*"` allows every agent. */
-export function intersectAgents(a, b) {
-    if (b === undefined || b === "*")
-        return a === "*" ? "*" : new Set(a);
-    if (a === "*")
-        return new Set(b);
-    const allowed = new Set(a);
-    return new Set(b.filter((agent) => allowed.has(agent)));
-}
-/**
- * The role's permissions narrowed to `scopes` and `agents`, or undefined when the role no
- * longer exists.
- */
-export function resolveRole(policy, role, scopes, agents) {
-    const entry = Object.hasOwn(policy.roles, role)
-        ? policy.roles[role]
-        : undefined;
-    if (!entry)
-        return undefined;
-    const allowed = new Set(entry.scopes);
-    return {
-        role,
-        scopes: new Set(scopes.filter((scope) => allowed.has(scope))),
-        agents: intersectAgents(entry.agents, agents),
-        ...(entry.limits ? { limits: entry.limits } : {}),
-    };
-}
-/** True when `agentId` is allowed by `agents`. */
-export function agentAllowed(agents, agentId) {
-    return agents === "*" || agents.has(agentId);
-}

package/dist/tenant/browser.d.ts

@@ -1,15 +0,0 @@
-/**
- * Which client app a request comes from (Host feature `browser-access`), decided before the
- * bearer is looked at. `Nylorun-Key` names a publishable key of this Tenant; an `Origin` must
- * be on that key's allowlist, and only then does the response carry CORS headers. The
- * allowlist protects browsers from other sites' pages; it is not authentication, since a
- * non-browser can send any `Origin`: tokens authorize.
- */
-import type { IncomingMessage, ServerResponse } from "node:http";
-import type { TenantContext } from "./context.js";
-/** The client app of a request: its publishable key, and the origin when from a browser. */
-export interface BrowserClient {
-    readonly keyId: string;
-    readonly origin?: string;
-}
-export declare function identifyClient(ctx: TenantContext, request: IncomingMessage, response: ServerResponse): Promise<BrowserClient | undefined>;

package/dist/tenant/browser.js

@@ -1,39 +0,0 @@
-import { PUBLISHABLE_KEY_HEADER } from "@nylorun/core/compatibility";
-import { originAllowed } from "@nylorun/core/contracts";
-import { browserOrigin, setCorsHeaders } from "../host/cors.js";
-import { fail, failOpaque } from "./http.js";
-function single(request, name) {
-    const raw = request.headers[name.toLowerCase()];
-    return Array.isArray(raw) ? raw[0] : raw;
-}
-export async function identifyClient(ctx, request, response) {
-    const key = single(request, PUBLISHABLE_KEY_HEADER);
-    const hasOrigin = request.headers.origin !== undefined;
-    if (key === undefined) {
-        if (hasOrigin)
-            fail(403, `Browser requests need ${PUBLISHABLE_KEY_HEADER}`, {
-                code: "origin_rejected",
-            });
-        return undefined;
-    }
-    const row = await ctx.store.tx((t) => t.publishableKeyByKey(key));
-    if (!row || row.revokedAt !== null) {
-        ctx.config.logger.warn("credential rejected", {
-            reason: "publishable_key_rejected",
-        });
-        return failOpaque();
-    }
-    if (!hasOrigin)
-        return { keyId: row.id };
-    const origin = browserOrigin(request);
-    const origins = JSON.parse(row.originsJson);
-    if (origin === undefined || !originAllowed(origins, origin)) {
-        ctx.config.logger.warn("credential rejected", {
-            reason: "origin_not_allowed",
-            keyId: row.id,
-        });
-        return failOpaque();
-    }
-    setCorsHeaders(response, origin);
-    return { keyId: row.id, origin };
-}

package/dist/tenant/subject-limits.d.ts

@@ -1,16 +0,0 @@
-/**
- * Subject limits (Host feature `subject-tokens`): a subject token's role may cap how many turns
- * its subject starts per hour and how many run at once. Every turn spends the Tenant's model
- * budget, so these ship with the first credential that reaches the Runtime without an app
- * server in between.
- *
- * Turns per hour is a token bucket per subject (capacity `turnsPerHour`, refilled
- * continuously): no hourly rows and no burst at a window boundary. Concurrent turns counts the
- * subject's sessions with work in flight; `paused` is not counted, so an unanswered approval
- * never locks a person out. Checked inside the command's transaction, after the session row
- * lock, so one subject's messages serialize on the bucket row.
- */
-import type { RoleLimits } from "@nylorun/core/contracts";
-import type { Tx } from "../store/types.js";
-/** Charges one turn to `subject`, or answers `429 limit_exceeded`. */
-export declare function chargeTurn(t: Tx, subject: string, limits: RoleLimits, now?: number): Promise<void>;

package/dist/tenant/subject-limits.js

@@ -1,45 +0,0 @@
-import { fail } from "./http.js";
-/** Session statuses that hold a turn in flight. */
-const ACTIVE_STATUSES = ["runnable", "running", "waiting"];
-const CONCURRENT_RETRY_SECONDS = 5;
-/** Floating-point slack when a refill lands exactly on a whole turn. */
-const EPSILON = 1e-9;
-/** Charges one turn to `subject`, or answers `429 limit_exceeded`. */
-export async function chargeTurn(t, subject, limits, now = Date.now()) {
-    if (limits.concurrentTurns !== undefined) {
-        const active = await t.countOwnerSessions(subject, ACTIVE_STATUSES);
-        if (active >= limits.concurrentTurns)
-            fail(429, `At most ${limits.concurrentTurns} turns may run at once`, {
-                code: "limit_exceeded",
-                details: {
-                    limit: "concurrentTurns",
-                    retryAfterSeconds: CONCURRENT_RETRY_SECONDS,
-                },
-            }, { "retry-after": String(CONCURRENT_RETRY_SECONDS) });
-    }
-    const capacity = limits.turnsPerHour;
-    if (capacity === undefined)
-        return;
-    const perMs = capacity / 3_600_000;
-    const usage = await t.lockSubjectUsage({
-        subject,
-        turnTokens: capacity,
-        refilledAt: new Date(now).toISOString(),
-    });
-    const elapsed = Math.max(0, now - Date.parse(usage.refilledAt));
-    const tokens = Math.min(capacity, usage.turnTokens + elapsed * perMs);
-    if (tokens < 1 - EPSILON) {
-        // Rounded before the ceiling so floating-point dust never adds a second.
-        const wait = Math.round(((1 - tokens) / perMs / 1000) * 1000) / 1000;
-        const retryAfterSeconds = Math.max(1, Math.ceil(wait));
-        fail(429, `At most ${capacity} turns per hour`, {
-            code: "limit_exceeded",
-            details: { limit: "turnsPerHour", retryAfterSeconds },
-        }, { "retry-after": String(retryAfterSeconds) });
-    }
-    await t.putSubjectUsage({
-        subject,
-        turnTokens: Math.max(0, tokens - 1),
-        refilledAt: new Date(now).toISOString(),
-    });
-}

package/dist/tenant/tokens.d.ts

@@ -1,14 +0,0 @@
-import { type CreateTokenRequest, type CreateTokenResponse } from "@nylorun/core/contracts";
-import type { AuthScope, TenantContext } from "./context.js";
-export { looksLikeToken } from "./jwt.js";
-export declare function mintToken(ctx: TenantContext, body: CreateTokenRequest): Promise<CreateTokenResponse>;
-export type TokenScopeAuth = Extract<AuthScope, {
-    kind: "token";
-}>;
-/**
- * Verifies a subject token. Returns the request's scope, answers `401 token_expired` for
- * the cases a new token fixes, and the opaque 404 for everything else.
- */
-export declare function verifySubjectToken(ctx: TenantContext, raw: string): Promise<TokenScopeAuth>;
-/** True when a token caller may reach `agentId`. Other callers always may. */
-export declare function mayUseAgent(scope: AuthScope, agentId: string): boolean;

package/dist/tenant/tokens.js

@@ -1,180 +0,0 @@
-/**
- * Subject tokens (Host feature `subject-tokens`): ES256 JWTs minted by `POST /v1/tokens` with
- * an application key, for one subject and one role of the access policy.
- *
- * Verification order matters: everything a forger controls is checked before any signature
- * work, and nothing but the signature-verified cases reveals more than the opaque 404.
- * Expired tokens, a stale revocation epoch, a revoked key or a removed role answer
- * `401 token_expired`, so clients always react the same way: get a new token.
- */
-import { randomUUID } from "node:crypto";
-import { errors, jwtVerify } from "jose";
-import { isSubject, SUBJECT_TOKEN_AUDIENCE, SUBJECT_TOKEN_TYPE, subjectTokenIssuer, TOKEN_SCOPES, TOKEN_TTL_MIN_SECONDS, } from "@nylorun/core/contracts";
-import { agentAllowed, readPolicy, resolveRole } from "./access-policy.js";
-import { fail, failOpaque, HttpError } from "./http.js";
-import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
-/** Allowed spread between `iat` and `exp` beyond the policy's longest lifetime. */
-const LIFETIME_SLACK_SECONDS = 60;
-export { looksLikeToken } from "./jwt.js";
-/** The 401 every "get a new token" case answers. The reason is logged, never returned. */
-function expired(ctx, reason, jti) {
-    ctx.config.logger.warn("subject token refused", {
-        reason,
-        ...(jti ? { jti } : {}),
-    });
-    throw new HttpError(401, "The subject token has expired or was revoked", { code: "token_expired" }, { "www-authenticate": 'Bearer error="invalid_token"' });
-}
-function rejected(ctx, reason) {
-    ctx.config.logger.warn("credential rejected", { reason });
-    return failOpaque();
-}
-export async function mintToken(ctx, body) {
-    const tenantId = ctx.config.tenantId;
-    const { access, epoch, ttl } = await ctx.store.tx(async (t) => {
-        const policy = await readPolicy(t);
-        const role = Object.hasOwn(policy.roles, body.role)
-            ? policy.roles[body.role]
-            : undefined;
-        if (!role)
-            return fail(400, `Role ${body.role} is not in the access policy`, {
-                code: "invalid_request",
-            });
-        const scopes = body.scopes ?? role.scopes;
-        const outside = scopes.filter((scope) => !role.scopes.includes(scope));
-        if (outside.length > 0)
-            fail(400, `Role ${body.role} does not allow ${outside.join(", ")}`, {
-                code: "invalid_request",
-            });
-        if (body.agents && role.agents !== "*") {
-            const allowed = new Set(role.agents);
-            const extra = body.agents.filter((agent) => !allowed.has(agent));
-            if (extra.length > 0)
-                fail(400, `Role ${body.role} does not allow agent ${extra.join(", ")}`, {
-                    code: "invalid_request",
-                });
-        }
-        const maxTtl = policy.tokens.maxTtlSeconds;
-        const ttl = Math.min(body.ttlSeconds ?? maxTtl, maxTtl);
-        if (ttl < TOKEN_TTL_MIN_SECONDS)
-            fail(400, `ttlSeconds must be at least ${TOKEN_TTL_MIN_SECONDS}`);
-        return {
-            access: resolveRole(policy, body.role, scopes, body.agents),
-            epoch: await t.subjectEpoch(body.subject),
-            ttl,
-        };
-    });
-    const iat = Math.floor(Date.now() / 1000);
-    const jti = randomUUID();
-    const scopes = [...access.scopes];
-    const claims = {
-        tnt: tenantId,
-        role: body.role,
-        scp: scopes.join(" "),
-        ...(body.agents ? { agt: [...body.agents] } : {}),
-        epc: epoch,
-    };
-    // Signed by the keys service (F4.2): this process never holds the private key.
-    const { token, keyId } = await ctx.keys.sign({
-        typ: SUBJECT_TOKEN_TYPE,
-        claims: {
-            ...claims,
-            iss: subjectTokenIssuer(tenantId),
-            aud: SUBJECT_TOKEN_AUDIENCE,
-            sub: body.subject,
-            iat,
-            exp: iat + ttl,
-            jti,
-        },
-    });
-    const signer = { id: keyId };
-    ctx.config.logger.info("subject token minted", {
-        jti,
-        kid: signer.id,
-        role: body.role,
-    });
-    return {
-        token,
-        expiresAt: new Date((iat + ttl) * 1000).toISOString(),
-        subject: body.subject,
-        role: body.role,
-        scopes,
-        agents: access.agents === "*" ? "*" : [...access.agents],
-        keyId: signer.id,
-    };
-}
-/**
- * Verifies a subject token. Returns the request's scope, answers `401 token_expired` for
- * the cases a new token fixes, and the opaque 404 for everything else.
- */
-export async function verifySubjectToken(ctx, raw) {
-    const checked = tokenKeyId(raw, SUBJECT_TOKEN_TYPE);
-    if ("refused" in checked)
-        return rejected(ctx, checked.refused === "malformed" ? "token_malformed" : "token_header");
-    const { kid } = checked;
-    const { row, policy } = await ctx.store.tx(async (t) => ({
-        row: await t.signingKey(kid),
-        policy: await readPolicy(t),
-    }));
-    if (!row)
-        return rejected(ctx, "token_key_unknown");
-    const tenantId = ctx.config.tenantId;
-    let claims;
-    try {
-        const verified = await jwtVerify(raw, await ctx.signingKeys.publicKey(row), {
-            algorithms: ["ES256"],
-            issuer: subjectTokenIssuer(tenantId),
-            audience: SUBJECT_TOKEN_AUDIENCE,
-            typ: SUBJECT_TOKEN_TYPE,
-            clockTolerance: CLOCK_TOLERANCE_SECONDS,
-            requiredClaims: ["sub", "iat", "exp", "jti"],
-        });
-        claims = verified.payload;
-    }
-    catch (error) {
-        if (error instanceof errors.JWTExpired) {
-            // The signature was valid; only now may the answer differ from a forgery.
-            return expired(ctx, "expired");
-        }
-        return rejected(ctx, "token_invalid");
-    }
-    // The key was revoked after it signed: a new token uses the current key.
-    if (row.state === "revoked")
-        return expired(ctx, "key_revoked", claims.jti);
-    const scopeNames = typeof claims.scp === "string" ? claims.scp.split(" ").filter(Boolean) : [];
-    if (claims.tnt !== tenantId ||
-        !isSubject(claims.sub) ||
-        typeof claims.role !== "string" ||
-        typeof claims.epc !== "number" ||
-        !Number.isInteger(claims.epc) ||
-        claims.exp - claims.iat >
-            policy.tokens.maxTtlSeconds + LIFETIME_SLACK_SECONDS ||
-        scopeNames.some((name) => !TOKEN_SCOPES.includes(name)) ||
-        (claims.agt !== undefined &&
-            (!Array.isArray(claims.agt) ||
-                claims.agt.some((agent) => typeof agent !== "string"))))
-        return rejected(ctx, "token_claims");
-    const epoch = await ctx.store.tx((t) => t.subjectEpoch(claims.sub));
-    if (claims.epc !== epoch)
-        return expired(ctx, "revoked", claims.jti);
-    const access = resolveRole(policy, claims.role, scopeNames, claims.agt);
-    if (!access)
-        return expired(ctx, "role_removed", claims.jti);
-    if (access.scopes.size === 0)
-        return expired(ctx, "role_narrowed", claims.jti);
-    return {
-        kind: "token",
-        subject: claims.sub,
-        scopes: access.scopes,
-        agents: access.agents,
-        role: access.role,
-        ...(access.limits ? { limits: access.limits } : {}),
-        epoch,
-        expiresAt: claims.exp * 1000,
-        tokenId: claims.jti,
-        keyId: kid,
-    };
-}
-/** True when a token caller may reach `agentId`. Other callers always may. */
-export function mayUseAgent(scope, agentId) {
-    return scope.kind !== "token" || agentAllowed(scope.agents, agentId);
-}