@theoremjs/agents 0.0.0-stage → 0.3.1

package/esm/src/kernel/api-catalog.js

@@ -0,0 +1,229 @@
+/** labels-exempt-file: authoring request-field and export meta — not runtime user or model copy (P2) */
+/** The catalog of the fields a `runTurn` request takes, keyed `runTurn.<field>`. */
+export const REQUEST_FIELDS = {
+    'runTurn.pageExecution': {
+        type: 'PageToolExecution',
+        doc: 'Host-issued browser dispatch with a claimed operation and correlated result.',
+    },
+    'runTurn.execution': {
+        type: 'ToolExecutionCoordinator',
+        doc: 'Host-owned atomic tool claims and outcomes. Never sent to providers.',
+    },
+    'runTurn.providerState': {
+        type: 'ProviderCheckpoint',
+        doc: 'Native provider state saved alongside portable history.',
+    },
+    'runTurn.profile': {
+        type: 'string',
+        doc: 'The id of the registered profile the turn runs.',
+        required: true,
+    },
+    'runTurn.input': { type: 'TurnInput', doc: 'What the user sent for the turn.' },
+    'runTurn.input.text': { type: 'string', doc: "The user's message." },
+    'runTurn.input.role': {
+        type: 'string',
+        doc: 'Picks the instruction of that name from identity.systemByRole.',
+        unset: 'The profile instruction',
+    },
+    'runTurn.input.slots': {
+        type: 'Record<string, string>',
+        doc: 'The choice the turn makes for each slot the profile declares in inputs.slots; a slot or a value the profile does not declare is refused.',
+    },
+    'runTurn.input.context': {
+        type: "Partial<Record<'client' | 'server', unknown>>",
+        doc: "What the page (client) or the host (server) wants the model to know, as any JSON or text; a sender the profile's inputs.context does not list, or a package over its maxChars, is refused.",
+        unset: 'No context',
+    },
+    'runTurn.input.attachments': {
+        type: 'Array<TurnBlob | TurnMediaRef>',
+        doc: "Files sent with the turn, as bytes or as a provider file reference; each must pass the profile's inputs.attachments.",
+    },
+    'runTurn.input.voice': {
+        type: 'TurnBlob[]',
+        doc: "Recorded speech sent with the turn; each must pass the profile's inputs.voice.",
+    },
+    'runTurn.input.history': {
+        type: 'TurnHistoryMessage[]',
+        doc: 'The earlier messages of the conversation, when the host keeps them.',
+        unset: 'The turn starts a new conversation',
+    },
+    'runTurn.input.repair': {
+        type: 'TurnRepairRequest',
+        doc: 'A reply your host rejected and why, so that the model writes it again.',
+    },
+    'runTurn.input.historyTokens': {
+        type: 'number',
+        doc: "Your count of the history's tokens, used by compaction that meters history.",
+        unset: "Theorem's own estimate",
+    },
+    'runTurn.input.inputTokens': {
+        type: 'number',
+        doc: "Your count of the whole prompt's tokens, used by compaction that meters input before the call.",
+    },
+    'runTurn.model': {
+        type: 'string',
+        doc: "The model id the turn picks from the profile's models; refused unless the profile sets allowModelSelect.",
+        unset: "The profile's defaultModel",
+    },
+    'runTurn.effort': {
+        type: 'string',
+        doc: "The effort the turn picks from the model's efforts; refused unless the model sets allowEffortSelect.",
+        unset: "The model's default effort",
+    },
+    'runTurn.builtInArgs': {
+        type: 'Record<BuiltinToolId, JsonObject>',
+        doc: "Args for the provider's own tools on the chosen model's builtInTools, by tool id; each is checked by the schema the provider declares for that tool.",
+        unset: 'Each built-in runs with no args',
+    },
+    'runTurn.system': {
+        type: 'SystemPrompt',
+        doc: "An instruction for this request only, added to the profile's own.",
+    },
+    'runTurn.path': {
+        type: 'string',
+        doc: 'The channel the turn comes from; only tools whose paths name it, or *, are offered.',
+        unset: 'Only tools on every path',
+    },
+    'runTurn.sessionPermissions': {
+        type: 'string[]',
+        doc: 'The tools the user has already approved for this session.',
+    },
+    'runTurn.credentials': {
+        type: 'ToolCredentialSource',
+        doc: 'Where an HTTP or MCP tool gets the credential for its auth slot.',
+    },
+    'runTurn.host': {
+        type: 'unknown',
+        doc: 'Your own context, handed to tool handlers as ctx.host; Theorem never reads or records it.',
+    },
+    'runTurn.signal': {
+        type: 'AbortSignal',
+        doc: 'Stops the turn when it aborts, and cancels the provider call where the provider can.',
+    },
+    'runTurn.sessionId': {
+        type: 'string',
+        doc: 'A session key that OpenRouter uses for routing and caching.',
+    },
+    'runTurn.projectId': {
+        type: 'string',
+        doc: 'Your project id, recorded on the trace.',
+    },
+    'runTurn.conversationId': {
+        type: 'string',
+        doc: 'Your conversation id, recorded on the trace.',
+    },
+    'runTurn.metadata': {
+        type: 'Record<string, unknown>',
+        doc: 'Your own values, kept on the trace; Theorem does not read them.',
+    },
+    'runTurn.traceparent': {
+        type: 'string',
+        doc: "The W3C traceparent of your span; the turn's trace joins it as a child.",
+        unset: 'The turn starts a new trace',
+    },
+    'runTurn.links': {
+        type: 'TurnTraceLink[]',
+        doc: 'Earlier traces this turn follows: a resume, a continue, or a retry.',
+    },
+    'runTurn.continueFrom': {
+        type: 'TurnContinueFrom',
+        doc: 'Continues a turn that stopped in a way the profile lets a turn continue.',
+    },
+    'runTurn.continuation': {
+        type: 'number',
+        doc: 'Which continue attempt this is, from 1; checked against the maxContinues of the profile.',
+    },
+    'runTurn.speech': {
+        type: 'TurnSpeech',
+        doc: "This turn's voice, style, and speed; each one given replaces the profile's speech field of that name. Refused on a profile that is not speech.",
+        unset: "The profile's speech settings",
+    },
+    'runTurn.resolveHost': {
+        type: 'ResolveHost',
+        doc: 'Resolves the host name of a remote tool before each request; a name that resolves to a private address is refused.',
+    },
+    'runTurn.onStage': {
+        type: 'StageHandler',
+        doc: 'Your function that sees each stage of a text turn and can answer with what the stage allows.',
+    },
+    'runTurn.onAgentCall': {
+        type: 'AgentCallHook',
+        doc: 'Runs before each agent tool call, to shape the request to the called agent or to refuse the call.',
+        unset: 'The agent runs on what the model sent',
+    },
+};
+/** The catalog of the exports a builder calls by name, keyed by that name. */
+export const API_EXPORTS = {
+    defineProfile: {
+        kind: 'function',
+        doc: 'Checks a profile and returns it; a field the profile type cannot take is a config error.',
+    },
+    registerProfile: {
+        kind: 'function',
+        doc: 'Stores a profile under its id, so that a request can name it.',
+    },
+    registerTool: {
+        kind: 'function',
+        doc: 'Stores a tool under its name, so that a profile can list it in tools.allow.',
+    },
+    registerStructured: {
+        kind: 'function',
+        doc: 'Stores a JSON Schema under an id, so that a profile can name it in outputs.structured.',
+    },
+    registerTraceDestination: {
+        kind: 'function',
+        doc: 'Stores a place to write traces under an id, so that a profile can name it in observability.',
+    },
+    defineProvider: {
+        kind: 'function',
+        doc: 'Validates a provider definition and supplies its typed model helper.',
+    },
+    registerProvider: {
+        kind: 'function',
+        doc: 'Registers a provider instance before profiles reference its ID.',
+    },
+    runTurn: {
+        kind: 'function',
+        doc: 'Runs one turn of a text, image, or speech profile and yields its events.',
+    },
+    runSession: {
+        kind: 'function',
+        doc: 'Runs a realtime voice or video session of a live profile.',
+    },
+    runDecision: {
+        kind: 'function',
+        doc: 'Asks a decision profile its questions about your JSON state and returns checked answers.',
+    },
+    invokeTool: {
+        kind: 'function',
+        doc: 'Runs one registered tool through a profile, with no model.',
+    },
+    runTool: {
+        kind: 'function',
+        doc: 'Runs one registered tool through a profile, with no model, and returns how the call settled.',
+    },
+    compactHistory: {
+        kind: 'function',
+        doc: 'Shortens a conversation history with the compaction the profile sets.',
+    },
+    takeSlot: {
+        kind: 'function',
+        doc: "Takes a client's turn slot on a profile; it answers ok, busy, quota, or not_configured.",
+    },
+    releaseSlot: {
+        kind: 'function',
+        doc: 'Frees the turn slot that takeSlot gave.',
+    },
+    overrideLabels: {
+        kind: 'function',
+        doc: "Replaces status lines for every profile in the process; a profile's own labels wins.",
+    },
+    resetLabels: {
+        kind: 'function',
+        doc: 'Removes every replacement that overrideLabels made.',
+    },
+    TheoremError: {
+        kind: 'class',
+        doc: 'The error Theorem throws; its kind tells your host which status and wording to use.',
+    },
+};

package/esm/src/kernel/auth/credential-source.d.ts

@@ -0,0 +1,23 @@
+import type { ToolCredential } from './types.js';
+/**
+ * Where a call's tool credentials come from. The kernel reads a slot only when a
+ * tool that signs in runs, so a turn opens no credential it does not use.
+ */
+export interface ToolCredentialSource {
+    /** The slot's credential, or `undefined` when the person has not signed in. */
+    get(slot: string): Promise<ToolCredential | undefined>;
+    /**
+     * A new credential for the slot: a refreshed OAuth token, or a key typed at a
+     * sign-in gate. The call goes on only once it resolves, so persist it here; a
+     * rotated refresh token lost to a closed stream cannot be recovered.
+     */
+    set(slot: string, credential: ToolCredential): Promise<void>;
+    /**
+     * The secret of a confidential OAuth client, read when the kernel refreshes a token
+     * issued to `clientId`. Omit it for public clients. The secret is the host's, not
+     * the person's, so it never lives on a stored credential.
+     */
+    clientSecret?(clientId: string): Promise<string | undefined>;
+}
+/** A source held in memory, seeded from `initial` (copied, never written back). */
+export declare function memoryCredentialSource(initial?: Readonly<Record<string, ToolCredential>>): ToolCredentialSource;

package/esm/src/kernel/auth/credential-source.js

@@ -0,0 +1,11 @@
+/** A source held in memory, seeded from `initial` (copied, never written back). */
+export function memoryCredentialSource(initial = {}) {
+    const slots = new Map(Object.entries(initial));
+    return {
+        get: (slot) => Promise.resolve(slots.get(slot)),
+        set: (slot, credential) => {
+            slots.set(slot, credential);
+            return Promise.resolve();
+        },
+    };
+}

package/esm/src/kernel/auth/crypto.d.ts

@@ -0,0 +1,56 @@
+/** RFC 4648 base64url, without padding. */
+export declare function toBase64Url(bytes: Uint8Array): string;
+/** Decodes base64url text into bytes. */
+export declare function fromBase64Url(base64url: string): Uint8Array<ArrayBuffer>;
+/** RFC 7636 §4.1: 43 to 128 characters, drawn without modulo bias. */
+export declare function generateCodeVerifier(length?: number): string;
+/** RFC 7636 §4.2 S256. */
+export declare function computeCodeChallenge(verifier: string): Promise<string>;
+/** What a sealed PKCE state carries between starting and finishing a sign-in. */
+export interface SealedStatePayload {
+    codeVerifier: string;
+    expectedIssuer: string;
+    /** RFC 9207: a response without `iss` is refused. */
+    issRequired: boolean;
+    /** Fixed when the flow began. */
+    tokenEndpoint: string;
+    resource: string;
+    redirectUri: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    clientId: string;
+    /** SHA-256 of the host's session binding. */
+    sessionBinding: string;
+    /** The scopes the flow asked for; a grant may hold none beyond them. Empty asks for the server's default. */
+    scopes: string[];
+}
+/** Encrypted, not only signed: the state crosses the browser and the server, and the PKCE verifier must stay secret. */
+export declare function sealStatePayload(payload: SealedStatePayload, secret: string): Promise<string>;
+/** Opens a sealed PKCE state; throws when the secret or the seal is wrong. */
+export declare function unsealStatePayload(sealed: string, secret: string): Promise<SealedStatePayload>;
+/** What `sealSecret` takes: the plaintext and the sealing key. */
+export interface SealSecretInput {
+    plaintext: string;
+    /** The host's sealing key: at least 32 bytes, kept apart from where sealed values are stored. */
+    key: string;
+    /** What the sealed value belongs to, such as owner, slot, and row. Opening needs the same list. */
+    binding: readonly string[];
+    /** Names `key`, so a rotated key still opens what an older one sealed. */
+    keyVersion: number;
+}
+/**
+ * Seals a stored credential. AES-256-GCM under a key derived per seal; the key
+ * version and binding are authenticated, so a value copied to another owner,
+ * slot or row does not open.
+ */
+export declare function sealSecret(input: SealSecretInput): Promise<string>;
+/** What `openSecret` takes: the sealed value and the keys still in use. */
+export interface OpenSecretInput {
+    sealed: string;
+    /** Every key still in use, by version. */
+    keys: Readonly<Record<number, string>>;
+    /** The binding the value was sealed with. */
+    binding: readonly string[];
+}
+/** Opens what `sealSecret` sealed; throws when the envelope, key version, or binding does not match. */
+export declare function openSecret(input: OpenSecretInput): Promise<string>;

package/esm/src/kernel/auth/crypto.js

@@ -0,0 +1,163 @@
+import { base64ToBytes, bytesToBase64 } from '../util/base64.js';
+/** RFC 4648 base64url, without padding. */
+export function toBase64Url(bytes) {
+    return bytesToBase64(bytes).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Decodes base64url text into bytes. */
+export function fromBase64Url(base64url) {
+    let base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+    while (base64.length % 4 !== 0) {
+        base64 += '=';
+    }
+    try {
+        return base64ToBytes(base64);
+    }
+    catch (err) {
+        throw new Error(`Invalid base64url encoding: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** RFC 7636 §4.1: 43 to 128 characters, drawn without modulo bias. */
+export function generateCodeVerifier(length = 64) {
+    if (length < 43 || length > 128) {
+        throw new RangeError(`Invalid PKCE code_verifier length: ${length}. RFC 7636 Section 4.1 requires length between 43 and 128 characters.`);
+    }
+    const validChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+    const maxValid = 256 - (256 % validChars.length); // why: 198 (66 * 3): rejecting above it removes modulo bias
+    let verifier = '';
+    const buffer = new Uint8Array(length * 2);
+    while (verifier.length < length) {
+        crypto.getRandomValues(buffer);
+        for (let i = 0; i < buffer.length && verifier.length < length; i++) {
+            const val = buffer[i];
+            if (val !== undefined && val < maxValid) {
+                verifier += validChars[val % validChars.length];
+            }
+        }
+    }
+    return verifier;
+}
+/** RFC 7636 §4.2 S256. */
+export async function computeCodeChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const digest = await crypto.subtle.digest('SHA-256', data);
+    return toBase64Url(new Uint8Array(digest));
+}
+/** A secret shorter than 256 bits would be the weak link. */
+const MIN_SECRET_BYTES = 32;
+/** Public domain-separation labels, not secrets: each use of a host secret derives a key no other use shares. */
+const STATE_CONTEXT = 'theorem/oauth-state/v1';
+const SEAL_CONTEXT = 'theorem/sealed-secret/v1';
+const IV_BYTES = 12;
+/** A fresh salt per seal gives every seal its own key, so no key sees enough random nonces for one to repeat. */
+const SALT_BYTES = 32;
+/** Authenticated with the ciphertext, so a later scheme can be told apart and an old one is never guessed at. */
+const ENVELOPE_VERSION = 'v1';
+async function sealKey(secret, salt, info, label) {
+    const encoder = new TextEncoder();
+    const secretBytes = encoder.encode(secret);
+    if (secretBytes.length < MIN_SECRET_BYTES) {
+        throw new RangeError(`${label} must be at least ${MIN_SECRET_BYTES} bytes; got ${secretBytes.length}`);
+    }
+    const base = await crypto.subtle.importKey('raw', secretBytes, 'HKDF', false, ['deriveKey']);
+    return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: salt, info: encoder.encode(info) }, base, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+/** `salt.iv.ciphertext`, base64url: AES-256-GCM under a key derived per seal. */
+async function sealBytes(plaintext, secret, scheme) {
+    const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+    const key = await sealKey(secret, salt, scheme.info, scheme.label);
+    const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+    const ciphertext = await crypto.subtle.encrypt({
+        name: 'AES-GCM',
+        iv: iv,
+        additionalData: new TextEncoder().encode(scheme.associatedData),
+    }, key, new TextEncoder().encode(plaintext));
+    return [toBase64Url(salt), toBase64Url(iv), toBase64Url(new Uint8Array(ciphertext))].join('.');
+}
+/** The plaintext `sealBytes` sealed, or null when the envelope does not open under this secret and data. */
+async function openBytes(parts, secret, scheme) {
+    const [saltB64, ivB64, ciphertextB64] = parts;
+    if (saltB64 === undefined || ivB64 === undefined || ciphertextB64 === undefined)
+        return null;
+    const key = await sealKey(secret, fromBase64Url(saltB64), scheme.info, scheme.label);
+    try {
+        const plaintext = await crypto.subtle.decrypt({
+            name: 'AES-GCM',
+            iv: fromBase64Url(ivB64),
+            additionalData: new TextEncoder().encode(scheme.associatedData),
+        }, key, fromBase64Url(ciphertextB64));
+        return new TextDecoder().decode(plaintext);
+    }
+    catch {
+        return null;
+    }
+}
+const STATE_SCHEME = {
+    info: STATE_CONTEXT,
+    label: 'OAuth state secret', // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    associatedData: ENVELOPE_VERSION,
+};
+/** Encrypted, not only signed: the state crosses the browser and the server, and the PKCE verifier must stay secret. */
+export async function sealStatePayload(payload, secret) {
+    const envelope = await sealBytes(JSON.stringify(payload), secret, STATE_SCHEME);
+    return [ENVELOPE_VERSION, envelope].join('.');
+}
+/** Opens a sealed PKCE state; throws when the secret or the seal is wrong. */
+export async function unsealStatePayload(sealed, secret) {
+    const [version, ...parts] = sealed.split('.');
+    if (version !== ENVELOPE_VERSION || parts.length !== 3) {
+        throw new Error('Invalid sealed state format'); // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    const plaintext = await openBytes(parts, secret, STATE_SCHEME);
+    if (plaintext === null) {
+        throw new Error('OAuth state could not be opened: it was tampered with, corrupted, or sealed with another secret');
+    }
+    const payload = JSON.parse(plaintext);
+    if (!Array.isArray(payload.scopes)) {
+        throw new Error('Invalid sealed state format'); // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    if (Date.now() > payload.expiresAt) {
+        throw new Error('OAuth state has expired'); // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    return payload;
+}
+function secretScheme(keyVersion, binding) {
+    return {
+        info: SEAL_CONTEXT,
+        label: 'Secret sealing key', // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        associatedData: JSON.stringify([ENVELOPE_VERSION, keyVersion, binding]),
+    };
+}
+function assertKeyVersion(keyVersion) {
+    if (!Number.isSafeInteger(keyVersion) || keyVersion < 0) {
+        throw new RangeError(`Key version must be a non-negative integer; got ${keyVersion}`); // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+}
+/**
+ * Seals a stored credential. AES-256-GCM under a key derived per seal; the key
+ * version and binding are authenticated, so a value copied to another owner,
+ * slot or row does not open.
+ */
+export async function sealSecret(input) {
+    assertKeyVersion(input.keyVersion);
+    const scheme = secretScheme(input.keyVersion, input.binding);
+    const envelope = await sealBytes(input.plaintext, input.key, scheme);
+    return [ENVELOPE_VERSION, String(input.keyVersion), envelope].join('.');
+}
+/** Opens what `sealSecret` sealed; throws when the envelope, key version, or binding does not match. */
+export async function openSecret(input) {
+    const [version, keyVersionText, ...parts] = input.sealed.split('.');
+    const keyVersion = Number(keyVersionText);
+    if (version !== ENVELOPE_VERSION || parts.length !== 3 || !/^\d+$/.test(keyVersionText ?? '')) {
+        throw new Error('Invalid sealed secret format'); // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    const key = input.keys[keyVersion];
+    if (key === undefined) {
+        throw new Error(`No key for sealed secret key version ${keyVersion}`); // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    const plaintext = await openBytes(parts, key, secretScheme(keyVersion, input.binding));
+    if (plaintext === null) {
+        throw new Error('Sealed secret could not be opened: it was tampered with, bound to something else, or sealed with another key');
+    }
+    return plaintext;
+}

package/esm/src/kernel/auth/mod.d.ts

@@ -0,0 +1,5 @@
+export * from './credential-source.js';
+export * from './crypto.js';
+export * from './oauth.js';
+export * from './typed-secret.js';
+export * from './types.js';

package/esm/src/kernel/auth/mod.js

@@ -0,0 +1,5 @@
+export * from './credential-source.js';
+export * from './crypto.js';
+export * from './oauth.js';
+export * from './typed-secret.js';
+export * from './types.js';

package/esm/src/kernel/auth/oauth.d.ts

@@ -0,0 +1,18 @@
+import type { AuthorizationServerMetadata, CreatePkceFlowOptions, ExchangePkceCodeOptions, ExchangePkceCodeResult, OAuthTransportOptions, PkceFlowResult, ProtectedResourceMetadata, RefreshOAuthTokenOptions } from './types.js';
+/** `undefined` on HTTP 404. RFC 9728 §3.3: a `resource` not identical to `resourceUrl` is refused. */
+export declare function discoverResourceMetadata(resourceUrl: string, transport?: OAuthTransportOptions): Promise<ProtectedResourceMetadata | undefined>;
+/** A non-OK URL moves on to the next; metadata that answers but fails validation is refused outright. */
+export declare function discoverAuthServerMetadata(issuer: string, transport?: OAuthTransportOptions): Promise<AuthorizationServerMetadata>;
+/** Stateless: the verifier, expected issuer, token endpoint, and resource are sealed into `state`. */
+export declare function createOAuthPkceFlow(options: CreatePkceFlowOptions): Promise<PkceFlowResult>;
+/** RFC 9207 §2.4: `iss` is required when the server advertises it, and byte-exact (no URL normalization). */
+export declare function validateIssuer(expectedIssuer: string, receivedIss: string | undefined, issRequired: boolean): void;
+/**
+ * Requires the session that began the flow (RFC 6749 §10.12), the same `redirect_uri` (§4.1.3)
+ * and a valid `iss` (RFC 9207); posts to the token endpoint sealed in `state`, never a caller's.
+ */
+export declare function exchangeOAuthPkce(options: ExchangePkceCodeOptions): Promise<ExchangePkceCodeResult>;
+/** Exchanges a refresh token for new tokens at the token endpoint; both the endpoint and the resource must be https URLs. */
+export declare function refreshOAuthToken(options: RefreshOAuthTokenOptions): Promise<ExchangePkceCodeResult>;
+/** RFC 8707: the same origin, and the resource's path or below it. */
+export declare function tokenAudienceCovers(resource: string, url: URL): boolean;