@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/tenant/effects.js

@@ -1,15 +1,14 @@
-import { embeddedAgent, flowDelegateManifest, hashManifest, isWorkflowManifestV2, } from "@nylorun/core/define";
-import { countActiveFlowWork, deriveAgentEffectSessionId, isFlowToolEffect, isWorkflowManifest, linkedMessageKey, linkedTurnEnd, } from "../core/flow-host.js";
+import { embeddedAgent, flowDelegateManifest, hashManifest, } from "@nylorun/core/define";
+import { countActiveFlowWork, deriveAgentEffectSessionId, isFlowToolEffect, isWorkflowManifest, linkedMessageInput, linkedMessageKey, linkedTurnEnd, settleAgentEffect, } from "../core/flow-host.js";
 import { mayDispatchMore } from "../core/limits.js";
-import { scrub } from "../redact.js";
 import { isRemoteMcpCall } from "../harness/calls.js";
+import { isHttpToolCall } from "../gates/http-tool.js";
 import { owningSandboxSessionId, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
 import { withSandboxCapability } from "../sandbox/session-sandbox.js";
 import { loadSession, ownedSession, sandboxLookup, sessionOf, } from "./context.js";
 import { fail } from "./http.js";
-import { linkedAgentOutput, turnManifestOf } from "./session.js";
+import { turnManifestOf } from "./session.js";
 import { command } from "./commands.js";
-import { offerAction } from "./delivery.js";
 /**
  * The outcome of a flow `agent` effect once the linked turn it started ended, or undefined
  * while it has not. The linked session may still show an earlier iteration's turn.
@@ -19,7 +18,7 @@ export async function linkedOutcome(t, effect, agent) {
     if (!end || !agent)
         return undefined;
     if (end.status === "completed")
-        return { value: linkedAgentOutput(agent, end.output) };
+        return { value: end.output };
     return {
         value: {
             kind: "failed",
@@ -32,16 +31,17 @@ export async function linkedOutcome(t, effect, agent) {
     };
 }
 /**
- * True when this Tenant's remote MCP calls outlive the process that sent them (the gates
- * service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent and joins
- * the running call or gets its answer, instead of becoming `uncertain`.
+ * True when this Tenant's remote MCP and HTTP tool calls outlive the process that sent them
+ * (the gates service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent
+ * and joins the running call or gets its answer, instead of becoming `uncertain`.
  */
-export function recoversMcpCalls(ctx) {
+export function recoversToolCalls(ctx) {
     return ctx.toolGate.recovers === true;
 }
-/** True when `request` calls a tool of a remote (`streamable-http` or `sse`) MCP server. */
-export function isRemoteMcpEffect(s, request) {
-    return isRemoteMcpCall({ rootManifest: s.manifest, mcpSnapshot: s.mcpSnapshot }, request);
+/** True when `request` calls a tool of a declared MCP server (every one is remote) or an HTTP tool. */
+export function isGateToolEffect(s, request) {
+    return (isRemoteMcpCall({ rootManifest: s.manifest, mcpSnapshot: s.mcpSnapshot }, request) ||
+        isHttpToolCall(s.manifest, request));
 }
 /**
  * True when this Tenant's vault-backed model calls outlive the process that sent them (the
@@ -51,7 +51,7 @@ export function isRemoteMcpEffect(s, request) {
 export function recoversModelCalls(ctx) {
     return ctx.useVaultModel && ctx.modelGate.recovers === true;
 }
-/** Journal and dispatch a new flow effect (agent / tool node / fn / verify). */
+/** Journal and dispatch a new flow effect (agent or tool node). */
 export async function resolveNewFlowEffect(ctx, request, signal, lease) {
     const { store } = ctx;
     signal.throwIfAborted();
@@ -76,9 +76,7 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
                 const outcome = await linkedOutcome(t, existing, agent);
                 if (!outcome)
                     return resolved({ status: "pending" });
-                existing.status = "completed";
-                existing.outcome = outcome;
-                await t.put("effects", request.effectId, existing);
+                await settleAgentEffect({ t, effect: existing, outcome });
                 return resolved({ status: "completed", outcome });
             }
             else {
@@ -94,64 +92,25 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
                 });
             return resolved({ status: "pending" });
         }
-        if (request.kind === "fn" ||
-            request.kind === "verify" ||
-            isFlowToolEffect(request)) {
-            await t.put("effects", request.effectId, {
-                request,
-                status: "pending",
+        if (isFlowToolEffect(request)) {
+            // A tool stage without `http` would run the developer's code: refused at save, so this
+            // is a backstop (HTTP stages are executed by the harness, `harness-api/record.ts`). The
+            // stage fails; nothing runs.
+            const outcome = {
+                value: {
+                    kind: "failed",
+                    code: "tool.unavailable",
+                    message: `The tool stage '${request.key ?? request.path ?? ""}' runs your code, and the Runtime runs no code of yours during a session`,
+                },
+            };
+            await t.put("effects", request.effectId, { request, status: "completed", outcome });
+            await t.event(workflow.id, workflow.activeTurnId, "node.started", {
+                path: request.path,
+                kind: "tool",
+                key: request.key,
+                ...(request.iterations !== undefined ? { iterations: request.iterations } : {}),
             });
-            const action = request.kind === "fn" || request.kind === "verify"
-                ? {
-                    actionId: request.effectId,
-                    sessionId: request.sessionId,
-                    turnId: request.turnId,
-                    agentId: request.agentId,
-                    manifestHash: request.manifestHash,
-                    implementationVersion: workflow.implementationVersion,
-                    input: request.input,
-                    context: request.context,
-                    status: "pending",
-                    generation: 0,
-                    kind: request.kind,
-                    path: request.path,
-                    key: request.key,
-                }
-                : {
-                    actionId: request.effectId,
-                    sessionId: request.sessionId,
-                    turnId: request.turnId,
-                    agentId: request.agentId,
-                    manifestHash: request.manifestHash,
-                    implementationVersion: workflow.implementationVersion,
-                    input: request.input,
-                    context: request.context,
-                    status: "pending",
-                    generation: 0,
-                    kind: "tool",
-                    path: request.path,
-                    key: request.key,
-                };
-            await t.put("actions", action.actionId, action);
-            if (isFlowToolEffect(request)) {
-                await t.event(workflow.id, workflow.activeTurnId, "node.started", {
-                    path: request.path,
-                    kind: "tool",
-                    key: request.key,
-                    ...(request.iterations !== undefined
-                        ? { iterations: request.iterations }
-                        : {}),
-                });
-            }
-            await t.event(workflow.id, workflow.activeTurnId, "action.pending", {
-                actionId: action.actionId,
-                kind: action.kind,
-                path: action.path,
-                key: action.key,
-                input: action.input,
-            });
-            await offerAction(t, ctx, action);
-            return resolved({ status: "pending" });
+            return resolved({ status: "completed", outcome });
         }
         return { kind: "agent", workflow };
     });
@@ -184,7 +143,7 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
         await ownedSession(t, lease, workflow.id);
         if (exists)
             return;
-        const definition = await leafDefinition(t, workflow, body, request);
+        const definition = leafDefinition(workflow, body, request);
         const lookup = await sandboxLookup(t, workflow.sandboxOwnerId);
         const sandboxOwnerId = sessionSandboxSpec(workflow) || workflow.sandboxOwnerId
             ? owningSandboxSessionId(workflow, lookup)
@@ -208,7 +167,6 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
             },
             vaultIds: workflow.vaultIds,
             credentialSelections: workflow.credentialSelections,
-            pluginRoots: definition.pluginRoots ?? {},
             ...(sandboxOwnerId ? { sandboxOwnerId } : {}),
             ...(inherited
                 ? { sandbox: inherited.spec, sandboxSource: "shared" }
@@ -218,21 +176,19 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
     });
     // Binds this effect to the one linked turn its message opens (`linkedTurnEnd`).
     const idempotencyKey = linkedMessageKey(request);
-    const messageInput = body.input;
+    const messageInput = linkedMessageInput(body);
     const messageCommand = typeof messageInput === "string"
         ? {
             type: "message",
             content: messageInput,
             requestId: `flow-${request.effectId}`,
             idempotencyKey,
-            ...(body.manifest ? { manifest: body.manifest } : {}),
         }
         : {
             type: "message",
             data: messageInput,
             requestId: `flow-${request.effectId}`,
             idempotencyKey,
-            ...(body.manifest ? { manifest: body.manifest } : {}),
         };
     const accepted = (await command(ctx, agentSessionId, messageCommand, {
         kind: "application",
@@ -242,8 +198,8 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
     return store.tx(async (t) => {
         const s = await ownedSession(t, lease, request.sessionId);
         const agent = await sessionOf(t, agentSessionId);
-        // Only a Loop's own agent turns are iterations; a step elsewhere in the flow is not.
-        if (typeof request.context.loopPath === "string")
+        // Only a Loop body's agent turns are iterations: not its verifier, nor a step elsewhere.
+        if (typeof request.context.loopPath === "string" && request.context.role !== "verify-agent")
             await t.event(s.id, s.activeTurnId, "loop.iteration", {
                 path: request.context.loopPath,
                 n,
@@ -260,11 +216,10 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
         // May already be settled if the agent was fast / replayed.
         const outcome = await linkedOutcome(t, { request, agentSessionId }, agent);
         if (outcome) {
-            await t.put("effects", request.effectId, {
-                request,
-                status: "completed",
+            await settleAgentEffect({
+                t,
+                effect: { request, status: "pending", agentSessionId },
                 outcome,
-                agentSessionId,
             });
             return { status: "completed", outcome };
         }
@@ -286,30 +241,19 @@ function inheritedSandbox(owner, definition) {
         throw new Error(sandboxed.message);
     return { spec, manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
 }
-/** Vault authorization for an MCP server request made on behalf of a session. */
+/**
+ * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
+ * attached vaults, else the operator's credential resolver (`vault/sources.ts`).
+ */
 export async function authorize(ctx, sessionId, request) {
     const s = await loadSession(ctx, sessionId);
-    const result = await ctx.vault.authorize({
-        sessionId,
-        vaultIds: s.vaultIds ?? [],
-        credentialSelections: s.credentialSelections ?? [],
-        url: request.url,
-        serverName: request.serverName,
-    });
-    if (result.status === "authorized") {
-        const token = result.headers.authorization.slice("Bearer ".length);
-        scrub({ authorization: result.headers.authorization, url: result.url }, [
-            token,
-        ]);
-    }
-    return result;
+    return ctx.credentials.authorize({ ...s, id: sessionId }, request);
 }
 /**
- * The definition a flow leaf's session runs. A v2 workflow embeds its leaves, so they
- * come from the workflow's own manifest and can't drift from it; v1 leaves come from the
- * registry by id.
+ * The definition a flow leaf's session runs. A flow agent embeds its leaves, so they come
+ * from the workflow's own manifest and can't drift from it.
  */
-async function leafDefinition(t, workflow, body, request) {
+function leafDefinition(workflow, body, request) {
     // A flow agent used as a tool: its manifest is inlined in the parent's pinned tool.
     if (request.context.role === "delegate" && !isWorkflowManifest(workflow.manifest)) {
         const flow = flowDelegateManifest(turnManifestOf(workflow), body.agentId);
@@ -319,35 +263,17 @@ async function leafDefinition(t, workflow, body, request) {
             manifest: flow,
             manifestHash: hashManifest(flow),
             implementationVersion: workflow.implementationVersion,
-            pluginRoots: leafPluginRoots(workflow.pluginRoots, body.agentId),
         };
     }
-    if (isWorkflowManifestV2(workflow.manifest)) {
-        const leaf = embeddedAgent(workflow.manifest, body.flow ?? [], body.agentId);
-        if (!leaf || isWorkflowManifestV2(leaf))
-            fail(404, `Agent '${body.agentId}' is not embedded in workflow '${workflow.manifest.id}'`);
-        const manifest = leaf;
-        return {
-            manifest,
-            manifestHash: hashManifest(manifest),
-            implementationVersion: workflow.implementationVersion,
-            pluginRoots: leafPluginRoots(workflow.pluginRoots, body.agentId),
-        };
-    }
-    const definition = await t.get("definitions", body.agentId);
-    if (!definition)
-        fail(404, "Definition not found");
-    return definition;
-}
-/**
- * A v2 workflow keys its leaves' plugin roots `<agentId>/<capability>`, and an agent keys
- * a flow agent it uses as a tool the same way (`<flowId>/<leafId>/<capability>`).
- */
-function leafPluginRoots(roots, agentId) {
-    const own = {};
-    const prefix = `${agentId}/`;
-    for (const [key, root] of Object.entries(roots ?? {}))
-        if (key.startsWith(prefix))
-            own[key.slice(prefix.length)] = root;
-    return own;
+    const leaf = isWorkflowManifest(workflow.manifest)
+        ? embeddedAgent(workflow.manifest, body.flow ?? [], body.agentId)
+        : undefined;
+    if (!leaf || isWorkflowManifest(leaf))
+        return fail(404, `Agent '${body.agentId}' is not embedded in workflow '${workflow.manifest.id}'`);
+    const manifest = leaf;
+    return {
+        manifest,
+        manifestHash: hashManifest(manifest),
+        implementationVersion: workflow.implementationVersion,
+    };
 }

package/dist/tenant/ephemeral.d.ts

@@ -1,5 +1,8 @@
 import { type PostgresClient } from "../store/postgres/connect.js";
+import type { TrustedIssuerConfig } from "./identity-file.js";
+import { type TrustedIssuers } from "./issuers.js";
 import type { Logger, TenantModelConfig } from "./types.js";
+import type { ResolverConfig } from "../vault/sources.js";
 export interface StartEphemeralRuntimeOptions {
     /**
      * Absolute Host root for `host.json`, the admin key and the Tenant's files (vault key,
@@ -12,6 +15,11 @@ export interface StartEphemeralRuntimeOptions {
     name?: string;
     /** An application key for an application principal of the Tenant. Default: a new key. */
     applicationKey?: string;
+    /**
+     * A management key (protocol 8), registered as the key `bootstrap` like
+     * `NYLORUN_MANAGEMENT_KEY_FILE`. Default: a new key.
+     */
+    managementKey?: string;
     adminKey?: string;
     principalId?: string;
     /**
@@ -19,16 +27,21 @@ export interface StartEphemeralRuntimeOptions {
      * admin key derives (`deriveStudioToken` in `@nylorun/admin`).
      */
     studioCredentialHash?: string;
-    /** Allowlisted baseline for childEnv (e.g. PATH). Never read from ambient here. */
-    baseline?: Readonly<Record<string, string>>;
     model?: TenantModelConfig;
     sandboxBackend?: "auto" | "virtual";
     /** When true, close() leaves hostRoot on disk. */
     retainRoot?: boolean;
-    /** Allow browser requests (an `Origin` with a publishable key). Default off. */
-    browserAccess?: boolean;
-    /** Serve the Admin API on its own loopback listener (`adminUrl`). Default off. */
-    operatorListener?: boolean;
+    /**
+     * Trusted issuers whose JWTs the Tenant API accepts (Host feature `trusted-issuers`): the
+     * issuers of an identity file (`parseIdentityFile`), or ones already built with
+     * `createTrustedIssuers`. Default none.
+     */
+    issuers?: readonly TrustedIssuerConfig[] | TrustedIssuers;
+    /**
+     * The operator's credential resolver (F9 C1): asked for a person's MCP credential when the
+     * session's vaults hold none. Default: none (vaults only).
+     */
+    resolver?: ResolverConfig;
     logger?: Logger;
     /**
      * The Postgres database of the Tenant (one Tenant per database): a pool, which the caller
@@ -40,10 +53,10 @@ export interface StartEphemeralRuntimeOptions {
 }
 export interface EphemeralRuntime {
     url: string;
-    /** Where the Admin API answers: `url`, or the operator listener when requested. */
-    adminUrl: string;
     tenantId: string;
     applicationKey: string;
+    /** The Management API's key (`/v1/tenant/*`), principal `bootstrap`. */
+    managementKey: string;
     adminKey: string;
     principalId: string;
     hostRoot: string;

package/dist/tenant/ephemeral.js

@@ -24,6 +24,7 @@ import { createTenantLogger } from "./logger.js";
 import { hostPaths, tenantPaths } from "./paths.js";
 import { hostPrincipals } from "./principals.js";
 import { openTenantRuntime } from "./runtime.js";
+import { createTrustedIssuers } from "./issuers.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -64,8 +65,12 @@ export async function startEphemeralRuntime(options) {
             warn() { },
             error() { },
         };
-    const baseline = options.baseline ?? {};
     const model = options.model ?? { kind: "scripted", output: "ok" };
+    const issuers = options.issuers === undefined
+        ? undefined
+        : Array.isArray(options.issuers)
+            ? createTrustedIssuers(options.issuers)
+            : options.issuers;
     const configFor = (tenantId) => {
         const tenant = tenantPaths(hostRoot);
         // A seeded `sandbox.backend` setting overrides this when the Tenant opens.
@@ -76,11 +81,8 @@ export async function startEphemeralRuntime(options) {
             paths: tenant,
             sandbox: { backend: sandboxBackend },
             model,
-            childEnv: Object.freeze({
-                ...baseline,
-                HOME: tenant.home,
-                TMPDIR: tenant.tmp,
-            }),
+            ...(issuers ? { issuers } : {}),
+            ...(options.resolver ? { resolver: options.resolver } : {}),
             logger: createTenantLogger({
                 tenantId,
                 logPath: tenant.log,
@@ -92,6 +94,7 @@ export async function startEphemeralRuntime(options) {
         ? createPostgresClient(options.database)
         : undefined;
     const applicationKey = options.applicationKey ?? mintBearerToken();
+    const managementKey = options.managementKey ?? mintBearerToken();
     const principalId = options.principalId ?? `principal_${randomBytes(8).toString("hex")}`;
     const module = createTenantModule({
         open: createPostgresTenantOpener({
@@ -103,6 +106,7 @@ export async function startEphemeralRuntime(options) {
                 principals: hostPrincipals({
                     adminKey,
                     application: { principalId, key: applicationKey },
+                    bootstrapKey: managementKey,
                     ...(options.studioCredentialHash
                         ? { studioCredentialHash: options.studioCredentialHash }
                         : {}),
@@ -139,13 +143,8 @@ export async function startEphemeralRuntime(options) {
             hostRoot,
             module,
             config: hostConfig,
-            credentials,
             logger,
             coreVersion: coreVersion(),
-            browserAccess: options.browserAccess === true,
-            ...(options.operatorListener
-                ? { operator: { host: "127.0.0.1", port: 0 } }
-                : {}),
         });
         // Opens the Tenant: creates it in the database first when it holds none.
         await host.listen();
@@ -166,9 +165,9 @@ export async function startEphemeralRuntime(options) {
     let closed = false;
     return {
         url: started.url,
-        adminUrl: started.adminUrl,
         tenantId,
         applicationKey,
+        managementKey,
         adminKey,
         principalId,
         hostRoot,

package/dist/tenant/host-token.js

@@ -17,7 +17,7 @@
  * The host token is accepted only by the Harness API listener (a connection serving that one
  * sandbox, and `host.renew`); the egress token only by egress-gate, as the proxy credential
  * (`Proxy-Authorization`). Neither is a bearer anywhere else: the Tenant API's bearer check
- * accepts subject tokens only, and the gates run tokens only.
+ * accepts trusted issuers' tokens only, and the gates run tokens only.
  *
  * Verification reads the key row on every call (a revoked key refuses at once) and, with
  * `currentHost`, the sandbox's row (one indexed read): the epoch must be the sandbox's, the
@@ -25,7 +25,7 @@
  */
 import { randomUUID } from "node:crypto";
 import { errors, importJWK, jwtVerify } from "jose";
-import { subjectTokenIssuer } from "@nylorun/core/contracts";
+import { tenantTokenIssuer } from "@nylorun/core/contracts";
 import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
 export const HOST_TOKEN_TYP = "nylorun-host+jwt";
 export const HOST_TOKEN_AUD = "nylorun-harness-api";
@@ -52,7 +52,7 @@ export async function mintEgressToken(signer, request) {
     const { token } = await signer.keys.sign({
         typ: EGRESS_TOKEN_TYP,
         claims: {
-            iss: subjectTokenIssuer(tenantId),
+            iss: tenantTokenIssuer(tenantId),
             aud: EGRESS_TOKEN_AUD,
             sbx: sandboxId,
             epc: epoch,
@@ -73,7 +73,7 @@ export async function mintHostTokens(signer, host) {
         signer.keys.sign({
             typ: HOST_TOKEN_TYP,
             claims: {
-                iss: subjectTokenIssuer(tenantId),
+                iss: tenantTokenIssuer(tenantId),
                 aud: HOST_TOKEN_AUD,
                 sub: host.sandboxId,
                 sbx: host.sandboxId,
@@ -126,7 +126,7 @@ export async function verifyHostToken(store, tenantId, raw, kind, cache = new Ma
     try {
         const verified = await jwtVerify(raw, key, {
             algorithms: ["ES256"],
-            issuer: subjectTokenIssuer(tenantId),
+            issuer: tenantTokenIssuer(tenantId),
             audience: aud,
             typ,
             clockTolerance: CLOCK_TOLERANCE_SECONDS,

package/dist/tenant/identity-file.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The identity file (Host feature `trusted-issuers`, F9 I2): the YAML file
+ * `NYLORUN_IDENTITY_FILE` names, listing the issuers whose JWTs the Tenant API accepts as
+ * bearers. Read once at boot (`host/main.ts`); a change takes a restart. A malformed file stops
+ * the boot with a message naming the issuer and the field.
+ *
+ * ```yaml
+ * issuers:
+ *   - name: keycloak
+ *     issuer: https://sso.acme.dev/realms/eng
+ *     audience: nylorun
+ *     jwks: https://sso.acme.dev/realms/eng/protocol/openid-connect/certs  # or keys: [<PEM>]
+ *     subject: "u:{sub}"                         # scalar claims only
+ *     scopes: { claim: nylorun_scopes }          # or { fixed: [sessions:own, agents:read] }
+ *     allowedScopes: [agents:read, sessions:own, sandboxes:write, studio]
+ *     agents: [support]                          # optional allowlist; absent means all
+ *     sandboxes: ["{org_id}/*"]                  # optional grants; absent reaches none
+ *     maxLifetime: 15m
+ * ```
+ */
+import { type KeyObject } from "node:crypto";
+import { type IssuerScope } from "@nylorun/core/contracts";
+/** The JWT algorithms an issuer may sign with. */
+export declare const ISSUER_ALGORITHMS: readonly ["RS256", "ES256", "EdDSA"];
+export type IssuerAlgorithm = (typeof ISSUER_ALGORITHMS)[number];
+/** A public key an issuer signs with, and the one algorithm it verifies. */
+export interface IssuerKey {
+    readonly key: KeyObject;
+    readonly alg: IssuerAlgorithm;
+    readonly kid?: string;
+}
+/** One trusted issuer, as the identity file declares it. */
+export interface TrustedIssuerConfig {
+    /** Its name: `issuer:<name>` in `GET /v1/me` and the token's role. */
+    readonly name: string;
+    /** The `iss` its tokens carry, exactly. */
+    readonly issuer: string;
+    /** The `aud` its tokens must carry. */
+    readonly audience: string;
+    /** Where its public keys are fetched (a JWKS URL); or `keys`. */
+    readonly jwks?: string;
+    /** Its public keys, given in the file (PEM); or `jwks`. */
+    readonly keys?: readonly IssuerKey[];
+    /** The subject template, such as `u:{sub}`: at least one claim reference. */
+    readonly subject: string;
+    /** Where its tokens' scopes come from: a claim, or a fixed list. */
+    readonly scopes: {
+        readonly claim: string;
+    } | {
+        readonly fixed: readonly IssuerScope[];
+    };
+    /** The scopes its tokens may carry; others are dropped. */
+    readonly allowedScopes: readonly IssuerScope[];
+    /** The agents its tokens reach; absent reaches all. */
+    readonly agents?: readonly string[];
+    /** Sandbox grant templates, such as `{org_id}/*`; absent reaches no sandbox. */
+    readonly sandboxes?: readonly string[];
+    /** The longest `exp - iat` it may sign, in seconds. */
+    readonly maxLifetimeSeconds: number;
+}
+/** A malformed identity file: the message names the issuer and the field. */
+export declare class IdentityFileError extends Error {
+    constructor(message: string);
+}
+/** The claim names a template references. */
+export declare function claimReferences(template: string): string[];
+/** `template` with every reference replaced by `value(claim)`; undefined when one has none. */
+export declare function renderTemplate(template: string, value: (claim: string) => string | undefined): string | undefined;
+/** A PEM public key an issuer may sign with, and its algorithm; throws a message otherwise. */
+export declare function issuerKey(key: KeyObject, kid?: string): IssuerKey;
+/**
+ * The issuers of an identity file's text. Throws `IdentityFileError` naming the file, the issuer
+ * and the field when the file is malformed.
+ */
+export declare function parseIdentityFile(text: string, source?: string): TrustedIssuerConfig[];