@nylorun/runtime 0.16.0-beta → 0.17.0-beta

package/dist/tenant/auth.js

@@ -2,10 +2,9 @@ import { SCOPES_HEADER, SUBJECT_HEADER, } from "@nylorun/core/compatibility";
 import { DELIVERY_TOKEN_TYPE, parseSubjectHeaders, } from "@nylorun/core/contracts";
 import { hashToken } from "../core/bearer.js";
 import { fail, failOpaque } from "./http.js";
-import { looksLikeToken, verifySubjectToken } from "./tokens.js";
 import { verifyDeliveryToken } from "./delivery-token.js";
-import { tokenType } from "./jwt.js";
-import { readPolicy } from "./access-policy.js";
+import { verifyIssuerToken } from "./issuers.js";
+import { looksLikeToken, tokenType } from "./jwt.js";
 const SUBJECT_INVALID = { code: "subject_invalid" };
 /** One header's value, or `undefined`; a header sent twice is refused. */
 function singleHeader(request, name) {
@@ -18,20 +17,10 @@ function singleHeader(request, name) {
         return fail(400, `${name} must be sent once`, SUBJECT_INVALID);
     return values[0];
 }
-export async function authenticate(ctx, request, client) {
+export async function authenticate(ctx, request) {
     const header = request.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
     if (!token || !header?.startsWith("Bearer ")) {
-        // A publishable key alone: what the policy grants `anon` (nothing by default).
-        if (client && header === undefined) {
-            const { anon } = await ctx.store.tx((t) => readPolicy(t));
-            return {
-                kind: "publishable",
-                keyId: client.keyId,
-                scopes: new Set(anon.scopes),
-                agents: anon.agents === "*" ? "*" : new Set(anon.agents),
-            };
-        }
         ctx.config.logger.warn("credential rejected", {
             reason: "missing_bearer",
         });
@@ -47,24 +36,27 @@ export async function authenticate(ctx, request, client) {
             fail(403, "A delivery token cannot act for a subject");
         return scope;
     }
-    if (looksLikeToken(token)) {
-        const scope = await verifySubjectToken(ctx, token);
-        // Read only after verification, so an unknown token still sees the opaque 404.
+    // A trusted issuer's token (Host feature `trusted-issuers`), from a server or a browser: its
+    // unverified `iss` names an issuer of the identity file, and only that issuer verifies it.
+    const issuer = ctx.config.issuers?.claimed(token);
+    if (issuer) {
+        const scope = await verifyIssuerToken(ctx, issuer, token);
         if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
             singleHeader(request, SCOPES_HEADER) !== undefined)
-            fail(403, "A subject token cannot act for another subject");
+            fail(403, "An issuer token cannot act for another subject");
         return scope;
     }
+    // Any other JWT: no issuer of this Host signed it (subject tokens are gone, protocol 7).
+    if (looksLikeToken(token)) {
+        ctx.config.logger.warn("credential rejected", { reason: "token_unknown_issuer" });
+        return failOpaque();
+    }
     // Application keys never come from a browser or a shipped app: refused before they are even
     // looked up.
     if (request.headers.origin !== undefined)
         fail(403, "Application keys are not accepted from browsers", {
             code: "origin_rejected",
         });
-    if (client)
-        fail(400, "Nylorun-Key is for browser and mobile clients, not with a Tenant key", {
-            code: "invalid_request",
-        });
     const tokenHash = hashToken(token);
     const principal = await ctx.store.tx((t) => t.principalByTokenHash(tokenHash));
     if (!principal) {
@@ -92,13 +84,11 @@ export async function authenticate(ctx, request, client) {
     };
 }
 /**
- * A subject, subject token or publishable key reaches a route only with one of the scopes it
- * declares: `403 scope_required`, decided from the route alone before anything is read.
+ * A subject or a token caller reaches a route only with one of the scopes it declares:
+ * `403 scope_required`, decided from the route alone before anything is read.
  */
 export function requireScopes(scope, access) {
-    if (scope.kind !== "subject" &&
-        scope.kind !== "token" &&
-        scope.kind !== "publishable")
+    if (scope.kind !== "subject" && scope.kind !== "token")
         return;
     if (access === "any")
         return;
@@ -107,7 +97,8 @@ export function requireScopes(scope, access) {
             code: "scope_required",
             details: { scopes: [] },
         });
-    if (!access.some((name) => scope.scopes.has(name)))
+    const held = scope.scopes;
+    if (!access.some((name) => held.has(name)))
         fail(403, `Scope ${access.join(" or ")} required`, {
             code: "scope_required",
             details: { scopes: access },
@@ -124,9 +115,7 @@ export function accessOf(scope) {
                 owner: scope.subject,
                 ...(scope.agents === "*" ? {} : { agents: scope.agents }),
             };
-        // A publishable key alone owns nothing: no session or vault is ever reachable.
-        case "publishable":
-        // Nor does a request with no credential, on a route that serves public data.
+        // A request with no credential, on a route that serves public data, owns nothing.
         case "anonymous":
             return fail(404, "Not found");
         // A delivery token reaches its Action's callbacks, never a session or vault.
@@ -138,7 +127,7 @@ export function accessOf(scope) {
         }
     }
 }
-/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+/** The subject whose sessions the request is limited to, if it acts for one. */
 export function ownerOf(scope) {
     return accessOf(scope)?.owner;
 }
@@ -159,6 +148,10 @@ export function scoped(scope, action) {
         return;
     fail(403, "This delivery token is for another Action");
 }
+/** True when a token caller may reach `agentId` (its issuer's allowlist). Other callers always may. */
+export function mayUseAgent(scope, agentId) {
+    return scope.kind !== "token" || scope.agents === "*" || scope.agents.has(agentId);
+}
 export function requireApplication(scope) {
     if (scope.kind === "application")
         return scope.principalId;

package/dist/tenant/commands.js

@@ -24,7 +24,6 @@ import { canonical } from "../store/canonical.js";
 import { lockedSession, } from "./context.js";
 import { fail } from "./http.js";
 import { accessOf } from "./auth.js";
-import { chargeTurn } from "./subject-limits.js";
 import { checkSandboxTurn } from "./sandboxes.js";
 import { actionTarget, rebaseSessionState, turnManifestOf, variantStore, } from "./session.js";
 import { signalActionOutcome, signalSessionCancel } from "./streams.js";
@@ -97,7 +96,7 @@ export async function command(ctx, id, input, scope) {
         if (scope.kind === "token" &&
             command.type === "message" &&
             command.manifest !== undefined)
-            fail(403, "A subject token cannot send message.manifest", {
+            fail(403, "A token caller cannot send message.manifest", {
                 code: "scope_required",
             });
         const key = commandKey(id, command.idempotencyKey);
@@ -180,12 +179,9 @@ export async function command(ctx, id, input, scope) {
             if (command.type === "message") {
                 if (!["idle", "completed", "failed", "cancelled"].includes(s.status))
                     fail(409, "Session has active or unresolved work");
-                // Every turn start on a sandbox: it exists, the token's `sbx` reaches it, and no other
-                // session's turn holds it. Before the charge, so a refused turn costs nothing.
+                // Every turn start on a sandbox: it exists, the token's grants reach it, and no other
+                // session's turn holds it.
                 await checkSandboxTurn(t, s, scope, ctx);
-                // After the replay check above, so a retried message is never charged twice.
-                if (scope.kind === "token" && scope.limits)
-                    await chargeTurn(t, scope.subject, scope.limits);
                 s.turnStartState = s.state;
                 // A new turn folds from the latest snapshot: a cancel or failure only reverts this turn.
                 if (s.history?.snapshot !== undefined)

package/dist/tenant/context.d.ts

@@ -14,7 +14,7 @@
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
  */
 import type { SessionHistory } from "./history.js";
-import type { RoleLimits, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
+import type { IssuerScope, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
 import type { AgentManifest, JsonValue, SandboxManifest } from "@nylorun/core/define";
 import type { CredentialSelection } from "@nylorun/core/contracts";
@@ -25,6 +25,7 @@ import type { ModelGate } from "../gates/model-gate.js";
 import type { ToolGate } from "../gates/tool-gate.js";
 import type { Keys } from "../keys/keys.js";
 import type { VaultService } from "../vault/service.js";
+import type { CredentialSources } from "../vault/sources.js";
 import type { McpPool } from "../mcp/pool.js";
 import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
 import type { HarnessApiServer } from "../harness-api/server.js";
@@ -95,22 +96,24 @@ export type AuthScope = {
     principalId: string;
 }
 /**
- * A subject token (Host feature `subject-tokens`): one subject, the role's scopes and agents
- * narrowed by the token, until `expiresAt` (ms) or the subject's epoch moves past `epoch`.
+ * A trusted issuer's token (Host feature `trusted-issuers`, F9-D12): one subject, with the
+ * issuer's scopes, agents and sandbox grants, until `expiresAt` (ms). Only its expiry ends it.
  */
  | {
     kind: "token";
+    /** The identity file's issuer that signed it. */
+    issuer: string;
     subject: string;
-    scopes: ReadonlySet<SubjectScope>;
+    /** The issuer's scopes the token holds, which may add `studio`. */
+    scopes: ReadonlySet<IssuerScope>;
     agents: ReadonlySet<string> | "*";
-    role: string;
-    limits?: RoleLimits;
-    /** The token's `sbx` grants: the sandboxes it reaches. Absent reaches none. */
+    /** The sandboxes it reaches: exact ids or `p/*` prefixes. Absent or empty reaches none. */
     sandboxes?: readonly string[];
-    epoch: number;
     expiresAt: number;
+    /** The token's `jti`, or a hash of it. */
     tokenId: string;
-    keyId: string;
+    /** The issuer key's `kid`, when it has one. */
+    keyId?: string;
 }
 /** An application principal acting for `subject` (`Nylorun-Subject`), narrowed to `scopes`. */
  | {
@@ -135,22 +138,17 @@ export type AuthScope = {
     expiresAt: number;
     tokenId: string;
     keyId: string;
-}
-/**
- * A publishable key with no bearer (Host feature `browser-access`): what the policy grants
- * `anon`, at most `agents:read`. It owns no session or vault.
- */
- | {
-    kind: "publishable";
-    keyId: string;
-    scopes: ReadonlySet<SubjectScope>;
-    agents: ReadonlySet<string> | "*";
 };
 export interface TenantContext {
     readonly config: TenantConfig;
     readonly envelope: TenantEnvelope;
     readonly store: SessionStore;
     readonly vault: VaultService;
+    /**
+     * A session's MCP credentials, for the in-process MCP pool: its attached vaults, then the
+     * operator's credential resolver (`TenantConfig.resolver`, F9 C1).
+     */
+    readonly credentials: CredentialSources;
     /**
      * The MCP pool of the Tenant's in-process harness. Absent when harnesses run elsewhere
      * (`NYLORUN_HARNESS=remote`): each keeps its own (F6.2).
@@ -208,7 +206,7 @@ export interface TenantContext {
     readonly work: WorkState;
     /** Live delivery over Durable Streams: one `SessionStream` per observed session, and the streams wiring. */
     readonly sessionStreams: SessionStreams;
-    /** The Tenant's signing keys for subject tokens. */
+    /** The Tenant's signing keys: delivery tokens, capability links, run and host tokens. */
     readonly signingKeys: SigningKeys;
     /** The Worker id this process writes as session `owner` (§10.6). */
     readonly workerId: string;
@@ -248,8 +246,8 @@ export interface TenantContext {
     onSweep(hook: () => Promise<void>): () => void;
 }
 /**
- * What a request acting for a person may reach: that person's sessions and vaults, and, for a
- * subject token, only sessions of the agents its role allows. Undefined means the whole Tenant.
+ * What a request acting for a person may reach: that person's sessions, and, for a token
+ * caller, only sessions of the agents its issuer allows. Undefined means the whole Tenant.
  */
 export interface SessionAccess {
     readonly owner: string;

package/dist/tenant/delivery-token.js

@@ -5,13 +5,13 @@
  * Tenant's public keys, and comes back as the bearer of that Action's callbacks (a background
  * result, heartbeats, sandbox tools).
  *
- * A token lives at most `DELIVERY_TOKEN_MAX_TTL_SECONDS`, the subject-token maximum, and key
+ * A token lives at most `DELIVERY_TOKEN_MAX_TTL_SECONDS` (`TOKEN_TTL_MAX_SECONDS`), and key
  * rotation waits at least that long before it revokes the previous key
  * (`signing-keys.ts`), so a rotation never revokes a live token.
  */
 import { createHash, randomUUID } from "node:crypto";
 import { errors, jwtVerify } from "jose";
-import { DELIVERY_TOKEN_MAX_TTL_SECONDS, DELIVERY_TOKEN_TYPE, subjectTokenIssuer, } from "@nylorun/core/contracts";
+import { DELIVERY_TOKEN_MAX_TTL_SECONDS, DELIVERY_TOKEN_TYPE, tenantTokenIssuer, } from "@nylorun/core/contracts";
 import { failOpaque, HttpError } from "./http.js";
 import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
 /** base64url SHA-256 of a request body: the token's `bdy` claim. */
@@ -34,7 +34,7 @@ export async function mintDeliveryToken(ctx, options) {
             agt: delivery.agentId,
             gen: delivery.kind === "action" ? delivery.generation : 0,
             bdy: bodyHash(options.body),
-            iss: subjectTokenIssuer(ctx.config.tenantId),
+            iss: tenantTokenIssuer(ctx.config.tenantId),
             aud: options.audience,
             sub: delivery.kind === "action" ? delivery.actionId : "ping",
             iat,
@@ -62,7 +62,7 @@ export async function verifyDeliveryToken(ctx, raw) {
     try {
         const verified = await jwtVerify(raw, await ctx.signingKeys.publicKey(row), {
             algorithms: ["ES256"],
-            issuer: subjectTokenIssuer(ctx.config.tenantId),
+            issuer: tenantTokenIssuer(ctx.config.tenantId),
             typ: DELIVERY_TOKEN_TYPE,
             clockTolerance: CLOCK_TOLERANCE_SECONDS,
             requiredClaims: ["sub", "aud", "iat", "exp", "jti"],

package/dist/tenant/effects.d.ts

@@ -38,8 +38,12 @@ export declare function isRemoteMcpEffect(s: Session, request: HostEffect): bool
 export declare function recoversModelCalls(ctx: TenantContext): boolean;
 /** Journal and dispatch a new flow effect (agent / tool node / fn / verify). */
 export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;
-/** Vault authorization for an MCP server request made on behalf of a session. */
+/**
+ * The credential of an MCP server request made on behalf of a session: from its attached vaults,
+ * else the operator's credential resolver (`vault/sources.ts`).
+ */
 export declare function authorize(ctx: TenantContext, sessionId: string, request: {
     url: string;
     serverName?: string;
+    agentId?: string;
 }): Promise<AuthorizeResult>;

package/dist/tenant/effects.js

@@ -1,7 +1,6 @@
 import { embeddedAgent, flowDelegateManifest, hashManifest, isWorkflowManifestV2, } from "@nylorun/core/define";
 import { countActiveFlowWork, deriveAgentEffectSessionId, isFlowToolEffect, isWorkflowManifest, linkedMessageKey, linkedTurnEnd, } from "../core/flow-host.js";
 import { mayDispatchMore } from "../core/limits.js";
-import { scrub } from "../redact.js";
 import { isRemoteMcpCall } from "../harness/calls.js";
 import { owningSandboxSessionId, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
 import { withSandboxCapability } from "../sandbox/session-sandbox.js";
@@ -286,23 +285,13 @@ function inheritedSandbox(owner, definition) {
         throw new Error(sandboxed.message);
     return { spec, manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
 }
-/** Vault authorization for an MCP server request made on behalf of a session. */
+/**
+ * The credential of an MCP server request made on behalf of a session: from its attached vaults,
+ * else the operator's credential resolver (`vault/sources.ts`).
+ */
 export async function authorize(ctx, sessionId, request) {
     const s = await loadSession(ctx, sessionId);
-    const result = await ctx.vault.authorize({
-        sessionId,
-        vaultIds: s.vaultIds ?? [],
-        credentialSelections: s.credentialSelections ?? [],
-        url: request.url,
-        serverName: request.serverName,
-    });
-    if (result.status === "authorized") {
-        const token = result.headers.authorization.slice("Bearer ".length);
-        scrub({ authorization: result.headers.authorization, url: result.url }, [
-            token,
-        ]);
-    }
-    return result;
+    return ctx.credentials.authorize({ ...s, id: sessionId }, request);
 }
 /**
  * The definition a flow leaf's session runs. A v2 workflow embeds its leaves, so they

package/dist/tenant/ephemeral.d.ts

@@ -1,5 +1,8 @@
 import { type PostgresClient } from "../store/postgres/connect.js";
+import type { TrustedIssuerConfig } from "./identity-file.js";
+import { type TrustedIssuers } from "./issuers.js";
 import type { Logger, TenantModelConfig } from "./types.js";
+import type { ResolverConfig } from "../vault/sources.js";
 export interface StartEphemeralRuntimeOptions {
     /**
      * Absolute Host root for `host.json`, the admin key and the Tenant's files (vault key,
@@ -25,10 +28,19 @@ export interface StartEphemeralRuntimeOptions {
     sandboxBackend?: "auto" | "virtual";
     /** When true, close() leaves hostRoot on disk. */
     retainRoot?: boolean;
-    /** Allow browser requests (an `Origin` with a publishable key). Default off. */
-    browserAccess?: boolean;
     /** Serve the Admin API on its own loopback listener (`adminUrl`). Default off. */
     operatorListener?: boolean;
+    /**
+     * Trusted issuers whose JWTs the Tenant API accepts (Host feature `trusted-issuers`): the
+     * issuers of an identity file (`parseIdentityFile`), or ones already built with
+     * `createTrustedIssuers`. Default none.
+     */
+    issuers?: readonly TrustedIssuerConfig[] | TrustedIssuers;
+    /**
+     * The operator's credential resolver (F9 C1): asked for a person's MCP credential when the
+     * session's vaults hold none. Default: none (vaults only).
+     */
+    resolver?: ResolverConfig;
     logger?: Logger;
     /**
      * The Postgres database of the Tenant (one Tenant per database): a pool, which the caller

package/dist/tenant/ephemeral.js

@@ -24,6 +24,7 @@ import { createTenantLogger } from "./logger.js";
 import { hostPaths, tenantPaths } from "./paths.js";
 import { hostPrincipals } from "./principals.js";
 import { openTenantRuntime } from "./runtime.js";
+import { createTrustedIssuers } from "./issuers.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -66,6 +67,11 @@ export async function startEphemeralRuntime(options) {
         };
     const baseline = options.baseline ?? {};
     const model = options.model ?? { kind: "scripted", output: "ok" };
+    const issuers = options.issuers === undefined
+        ? undefined
+        : Array.isArray(options.issuers)
+            ? createTrustedIssuers(options.issuers)
+            : options.issuers;
     const configFor = (tenantId) => {
         const tenant = tenantPaths(hostRoot);
         // A seeded `sandbox.backend` setting overrides this when the Tenant opens.
@@ -76,6 +82,8 @@ export async function startEphemeralRuntime(options) {
             paths: tenant,
             sandbox: { backend: sandboxBackend },
             model,
+            ...(issuers ? { issuers } : {}),
+            ...(options.resolver ? { resolver: options.resolver } : {}),
             childEnv: Object.freeze({
                 ...baseline,
                 HOME: tenant.home,
@@ -142,7 +150,6 @@ export async function startEphemeralRuntime(options) {
             credentials,
             logger,
             coreVersion: coreVersion(),
-            browserAccess: options.browserAccess === true,
             ...(options.operatorListener
                 ? { operator: { host: "127.0.0.1", port: 0 } }
                 : {}),

package/dist/tenant/host-token.js

@@ -17,7 +17,7 @@
  * The host token is accepted only by the Harness API listener (a connection serving that one
  * sandbox, and `host.renew`); the egress token only by egress-gate, as the proxy credential
  * (`Proxy-Authorization`). Neither is a bearer anywhere else: the Tenant API's bearer check
- * accepts subject tokens only, and the gates run tokens only.
+ * accepts trusted issuers' and delivery tokens only, and the gates run tokens only.
  *
  * Verification reads the key row on every call (a revoked key refuses at once) and, with
  * `currentHost`, the sandbox's row (one indexed read): the epoch must be the sandbox's, the
@@ -25,7 +25,7 @@
  */
 import { randomUUID } from "node:crypto";
 import { errors, importJWK, jwtVerify } from "jose";
-import { subjectTokenIssuer } from "@nylorun/core/contracts";
+import { tenantTokenIssuer } from "@nylorun/core/contracts";
 import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
 export const HOST_TOKEN_TYP = "nylorun-host+jwt";
 export const HOST_TOKEN_AUD = "nylorun-harness-api";
@@ -52,7 +52,7 @@ export async function mintEgressToken(signer, request) {
     const { token } = await signer.keys.sign({
         typ: EGRESS_TOKEN_TYP,
         claims: {
-            iss: subjectTokenIssuer(tenantId),
+            iss: tenantTokenIssuer(tenantId),
             aud: EGRESS_TOKEN_AUD,
             sbx: sandboxId,
             epc: epoch,
@@ -73,7 +73,7 @@ export async function mintHostTokens(signer, host) {
         signer.keys.sign({
             typ: HOST_TOKEN_TYP,
             claims: {
-                iss: subjectTokenIssuer(tenantId),
+                iss: tenantTokenIssuer(tenantId),
                 aud: HOST_TOKEN_AUD,
                 sub: host.sandboxId,
                 sbx: host.sandboxId,
@@ -126,7 +126,7 @@ export async function verifyHostToken(store, tenantId, raw, kind, cache = new Ma
     try {
         const verified = await jwtVerify(raw, key, {
             algorithms: ["ES256"],
-            issuer: subjectTokenIssuer(tenantId),
+            issuer: tenantTokenIssuer(tenantId),
             audience: aud,
             typ,
             clockTolerance: CLOCK_TOLERANCE_SECONDS,

package/dist/tenant/identity-file.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The identity file (Host feature `trusted-issuers`, F9 I2): the YAML file
+ * `NYLORUN_IDENTITY_FILE` names, listing the issuers whose JWTs the Tenant API accepts as
+ * bearers. Read once at boot (`host/main.ts`); a change takes a restart. A malformed file stops
+ * the boot with a message naming the issuer and the field.
+ *
+ * ```yaml
+ * issuers:
+ *   - name: keycloak
+ *     issuer: https://sso.acme.dev/realms/eng
+ *     audience: nylorun
+ *     jwks: https://sso.acme.dev/realms/eng/protocol/openid-connect/certs  # or keys: [<PEM>]
+ *     subject: "u:{sub}"                         # scalar claims only
+ *     scopes: { claim: nylorun_scopes }          # or { fixed: [sessions:own, agents:read] }
+ *     allowedScopes: [agents:read, sessions:own, sandboxes:write, studio]
+ *     agents: [support]                          # optional allowlist; absent means all
+ *     sandboxes: ["{org_id}/*"]                  # optional grants; absent reaches none
+ *     maxLifetime: 15m
+ * ```
+ */
+import { type KeyObject } from "node:crypto";
+import { type IssuerScope } from "@nylorun/core/contracts";
+/** The JWT algorithms an issuer may sign with. */
+export declare const ISSUER_ALGORITHMS: readonly ["RS256", "ES256", "EdDSA"];
+export type IssuerAlgorithm = (typeof ISSUER_ALGORITHMS)[number];
+/** A public key an issuer signs with, and the one algorithm it verifies. */
+export interface IssuerKey {
+    readonly key: KeyObject;
+    readonly alg: IssuerAlgorithm;
+    readonly kid?: string;
+}
+/** One trusted issuer, as the identity file declares it. */
+export interface TrustedIssuerConfig {
+    /** Its name: `issuer:<name>` in `GET /v1/me` and the token's role. */
+    readonly name: string;
+    /** The `iss` its tokens carry, exactly. */
+    readonly issuer: string;
+    /** The `aud` its tokens must carry. */
+    readonly audience: string;
+    /** Where its public keys are fetched (a JWKS URL); or `keys`. */
+    readonly jwks?: string;
+    /** Its public keys, given in the file (PEM); or `jwks`. */
+    readonly keys?: readonly IssuerKey[];
+    /** The subject template, such as `u:{sub}`: at least one claim reference. */
+    readonly subject: string;
+    /** Where its tokens' scopes come from: a claim, or a fixed list. */
+    readonly scopes: {
+        readonly claim: string;
+    } | {
+        readonly fixed: readonly IssuerScope[];
+    };
+    /** The scopes its tokens may carry; others are dropped. */
+    readonly allowedScopes: readonly IssuerScope[];
+    /** The agents its tokens reach; absent reaches all. */
+    readonly agents?: readonly string[];
+    /** Sandbox grant templates, such as `{org_id}/*`; absent reaches no sandbox. */
+    readonly sandboxes?: readonly string[];
+    /** The longest `exp - iat` it may sign, in seconds. */
+    readonly maxLifetimeSeconds: number;
+}
+/** A malformed identity file: the message names the issuer and the field. */
+export declare class IdentityFileError extends Error {
+    constructor(message: string);
+}
+/** The claim names a template references. */
+export declare function claimReferences(template: string): string[];
+/** `template` with every reference replaced by `value(claim)`; undefined when one has none. */
+export declare function renderTemplate(template: string, value: (claim: string) => string | undefined): string | undefined;
+/** A PEM public key an issuer may sign with, and its algorithm; throws a message otherwise. */
+export declare function issuerKey(key: KeyObject, kid?: string): IssuerKey;
+/**
+ * The issuers of an identity file's text. Throws `IdentityFileError` naming the file, the issuer
+ * and the field when the file is malformed.
+ */
+export declare function parseIdentityFile(text: string, source?: string): TrustedIssuerConfig[];