@fungi.computer/veil 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jamstack Consulting LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,172 @@
-# Temporary Holding Version
+# Veil (`@fungi.computer/veil`)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+This package keeps provider credentials behind trusted Team doors. It owns
+GitHub Connection custody, model-key grants and the Agent's anonymous public-web
+fetch. A guest receives an authorized operation, not the provider token or its
+private locator.
+
+## Set up and check
+
+The host supplies Team Connection authority and a `CredentialCustodian` to
+`createGitHubConnections`. Model input cannot select a repository or private
+locator. The `@fungi.computer/veil/nango` adapter needs a configured Nango
+origin, API key, webhook signing key, integration ID and public Connect URLs;
+these are host secrets or configuration, never browser or model input. Without
+custody configuration, report unavailable rather than manufacturing a
+connection.
+
+Run `pnpm --filter @fungi.computer/veil test` for the package's synthetic
+custody, signed-webhook and public-fetch checks. For an exercised connection
+lifecycle, start with `test/nango-git.test.ts`; a unit test does not prove a
+live Nango service or provider account.
+
+The root export in `src/index.ts` defines Team Connection receipts and
+`createGitHubConnections`. `package.json` lists the Nango, model-key and
+public-fetch subpaths used by trusted hosts; do not import private locators from
+these modules into guest code.
+
+## Nango adapter
+
+`@fungi.computer/veil/nango` exports `createNangoCustodian`. The trusted host
+supplies a Nango server origin, API key, separate webhook signing key, one
+integration ID, and the public Connect UI base and public API URL. These are
+host configuration, never browser or model input. `openSession` returns the
+Connect document browsers open: Nango's issued link, confined to the configured
+Connect UI and pinned to the public API with `apiURL`. Unconfigured hosts must
+report unavailable instead of substituting fake custody.
+
+The adapter uses `@nangohq/node@0.71.6` to verify the raw callback body and
+ordinary `fetch` with each invocation's AbortSignal for REST operations. It does
+not call credential-returning connection inspection. Connect sessions carry
+Team-created attempt/principal/Team tags and restrict the integration. Signed
+webhooks are verified before decoding; the adapter handles only a successful
+`creation` and a failed `refresh` (reconnect evidence) and refuses every other
+operation as `unsupported`. It also checks end-user and organization
+correlation; Team owns final activation and replay decisions. A verified
+completion the Team refuses (late, unknown, superseded, or failing activation)
+is deleted from custody, and the settled deletion is recorded.
+
+Reconciliation queries `/connections` with exact integration, end-user,
+organization and attempt tags and a limit of two. The selected server filters
+before applying that limit: zero matches remain unresolved, multiple matches are
+ambiguous, and every returned row is checked again before a single completion is
+accepted. It never selects the first candidate from an arbitrary page.
+
+The pinned public deletion endpoint returns `200 {success:true}` after deletion
+and `400 {error:{code:"unknown_connection"}}` when the selected connection is
+absent. Other responses, including generic 404 and `success:false`, do not
+settle cleanup. This mapping is specific to the selected server implementation,
+not a generic Nango error policy. Provider/proxy failures stay unavailable,
+except a proxied provider `401` carrying GitHub's own error body, which marks
+the Connection reconnect-required; Nango's own `401` envelope stays unavailable.
+
+The one proxy operation is `GET /proxy/repos/{owner}/{name}` with private Nango
+connection/integration headers. Veil's existing caller decodes credential-free
+metadata and verifies the repository ID. Cancellation stops waiting through the
+maintained transport; it does not prove upstream work stopped or rolled back.
+
+## Public-web door
+
+`@fungi.computer/veil/public-fetch` is the one sanctioned egress for the Agent's
+`web.fetch`. `configuredPublicFetch({ connect, fetch })` returns `get`, an
+anonymous GET that carries no credential and only `Accept` and `User-Agent`
+request headers. Each call resolves the name once (DNS-over-HTTPS through
+`fetch`), refuses the whole name if any answer is not public unicast (IPv4 and
+IPv6, including loopback, private, link-local, metadata, IPv4-mapped, NAT64,
+6to4 and Teredo forms), and passes only those checked addresses to the host's
+socket primitive (`cloudflare:sockets` `connect` in the Hub). The URL's own name
+stays the `Host` header and the TLS server name, so a second lookup cannot move
+the connection. `get` never follows a redirect; the caller's next hop is a new
+call that resolves and checks again. The response is framed by `http-parser-js`;
+compressed, layered-coded and over-long-header responses are refused.
+
+Workerd's `startTls({ expectedServerHostname })` verifies the certificate
+against that name; it reports a verification failure on the first read, which
+the door types as `unavailable`.
+
+## Model credentials and failure handling
+
+`src/model-credentials.ts` selects which key class may serve an inference
+request. Personal keys do not become an App's credential; App-originated
+requests use Team-authorized custody or refuse. The custodian handles provider
+egress and lifecycle. An authorized Team actor can disconnect a Connection; a
+failed refresh marks it reconnect-required. A late or superseded completion is
+not silently activated. A canceled request stops the caller waiting, but does
+not prove the provider stopped work already admitted.
+
+No provider credential, service startup, hosted deployment or backup recovery is
+established by installing or testing this adapter. Verify the configured service
+and Team owner separately. The manifest declares MIT; follow the repository's
+contribution instructions.
+
+## OpenAPI door
+
+`@fungi.computer/veil/openapi` exposes the private `createOpenApiDoor` Promise
+facade. `./openapi-effect` owns the same typed Effect program. Only the Team
+Connector owner calls this door, after checking current attachment revision,
+selected operation and read/write effect. This is not a guest raw-request tool.
+
+Anonymous, API-key header/query and bearer requests share the public-fetch
+socket implementation: public HTTPS only, one checked DNS resolution, pinned
+address with the original Host/TLS name, and no redirect following. The owner
+passes the pinned base URL and the selected operation's declared header names.
+The door refuses reserved headers, auth overrides and targets outside the base
+path. Request and response bodies are capped at 256 KiB, the whole operation at
+30 seconds, and the HTTP parser caps response headers at 64 KiB. Responses carry
+only text/JSON and their media type; upstream cookies and other headers are not
+returned. Non-2xx responses expose `upstream_status` and the numeric status,
+without upstream error text. Common credential echoes are redacted.
+
+`configuredOpenApiDoor` reads `OPENAPI_CREDENTIAL_MASTER_KEY` only in the
+Gatekeeper. This dedicated 32-byte base64url Worker secret seals credentials
+with WebCrypto AES-GCM. The host supplies an `OpenApiCredentialStore` that
+persists ciphertext only, keyed by Team and Connector. Authenticated data binds
+it to that owner, pinned base and auth policy. The store must honor cancellation
+before a write; ciphertext stays with its private owner, never an Agent fact,
+browser DTO or log. Removal is idempotent. Changing the base or auth policy
+requires resealing; a copied ciphertext cannot authorize another owner or host.
+The host owns durable cleanup and key provisioning/recovery; this package does
+not install a secret, persist plaintext or contact a remote service during
+tests. Missing custody or credentials is a typed refusal, not anonymous
+fallback.
+
+OAuth is restricted to host-configured `OpenApiOAuthProvider` ports, backed by
+the existing Nango proxy. The provider fixes its base; a spec cannot choose
+another destination. Nango retains OAuth custody and its own egress policy. No
+generic OAuth provider or new Nango instance is introduced. An unconfigured
+provider refuses `oauth_not_configured`. API-key/bearer traffic never uses
+Nango.
+
+C4's typed refusals are `denied`, `invalid_input`, `invalid_response`,
+`too_large`, `timeout`, `cancelled`, `unavailable`, `credentials_missing`,
+`oauth_not_configured` and `upstream_status` (with numeric `status`). Errors
+never carry request URLs, credential bytes, raw response text or transport
+causes.
+
+The host supplies `networkPolicy.extraPorts` (default empty),
+`deniedHostSuffixes` (exact names plus child names), and `deniedCidrs` for its
+own infrastructure. No deployment addresses are hardcoded. OpenAPI permits HTTPS
+on 443 unless the host explicitly adds a port. The same pinned HTTP adapter
+checks policy against the URL host and **every** checked DNS answer; one denied
+answer refuses the whole call. CIDR parsing and matching belong to ipaddr.js,
+including mapped IPv4. The older anonymous public-web GET contract also permits
+ordinary HTTP port 80; arbitrary ports require host configuration. These
+policies come from trusted host configuration, never Connector data.
+
+Custody uses `keys: { activeKeyId, keys }`, with dedicated 32-byte base64url
+keys indexed by a bounded non-secret id. Envelopes carry version 1 and key id;
+the key id is authenticated along with Team, Connector, base and auth policy. On
+rotation, retain old keys for reads while all new seals use the active key.
+Retire an old key only once its remaining records have been resealed or removed.
+`configuredOpenApiDoor` uses `OPENAPI_CREDENTIAL_KEY_ID` (default `primary`) for
+`OPENAPI_CREDENTIAL_MASTER_KEY`, plus host-supplied `previousCredentialKeys`.
+Key material never leaves this private custody port. Unknown key ids and
+copied/substituted ids refuse; there is no old-envelope shim.
+
+Responses redact raw, JSON-escaped, percent-encoded, base64 and base64url
+credential echoes before returning a body. Response headers remain limited to
+the media type, with sensitive media types refused; upstream errors still carry
+only the numeric status. OAuth ports now receive `teamId` as well as the private
+locator; the adapter must verify that the connection belongs to that Team. C7
+must obtain the locator exclusively from the Team-owned Connector record and
+collapse connect-unavailable/timeout into one Agent-facing code.

package/dist/best-effort-cleanup.d.ts

@@ -0,0 +1,2 @@
+/** Report cleanup failures without exposing provider or transport details. */
+export declare function bestEffortCleanup(operation: "nango-git-response-body" | "public-fetch-socket", cleanup: () => Promise<void>): Promise<void>;

package/dist/best-effort-cleanup.js

@@ -0,0 +1,5 @@
+import * as Effect from "effect/Effect";
+/** Report cleanup failures without exposing provider or transport details. */
+export async function bestEffortCleanup(operation, cleanup) {
+    return Effect.runPromise(Effect.tryPromise({ try: cleanup, catch: () => operation }).pipe(Effect.tapError(() => Effect.logError("veil.cleanup_failed", { operation })), Effect.ignore));
+}

package/dist/event-verifiers.d.ts

@@ -0,0 +1,80 @@
+/** The ways an inbound event may prove it came from the binding's sender. */
+export declare const EVENT_VERIFIERS: readonly ["fungi-v1", "github", "secret-url", "standard-webhooks"];
+export type EventVerifier = (typeof EVENT_VERIFIERS)[number];
+/** `secret-url` carries an unsigned shared token, so the UI labels it less secure. */
+export declare const EVENT_VERIFIER_SECURITY: {
+    readonly "fungi-v1": "signed";
+    readonly github: "signed";
+    readonly "secret-url": "less_secure";
+    readonly "standard-webhooks": "signed";
+};
+export type EventRefusal = "missing" | "bad_signature" | "stale" | "malformed";
+/** Never carries a secret, a signature or any header value. */
+export type EventVerification = Readonly<{
+    status: "ok";
+    eventId: string;
+}> | Readonly<{
+    status: "refused";
+    reason: EventRefusal;
+}>;
+/** The parts of one inbound request a verifier reads; the caller bounds `body`. */
+export type EventRequest = Readonly<{
+    headers: Pick<Headers, "get">;
+    body: Uint8Array;
+    /** The token the caller extracted from the URL; only `secret-url` reads it. */
+    urlToken: string | null;
+    nowSeconds: number;
+}>;
+/** A signed timestamp further than this from the receiver's clock is refused. */
+export declare const WEBHOOK_SIGNATURE_MAX_SKEW_SECONDS = 300;
+/** The one comparison of secret-derived bytes. Callers pass shape-checked, fixed-length values. */
+export declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;
+/**
+ * Parse the signed-request headers and refuse a stale or future timestamp.
+ * Needs no secret, so an ingress can refuse malformed traffic before it reads
+ * any binding state.
+ */
+export declare function parseFungiSignatureHeaders(input: Readonly<{
+    timestamp: string | null;
+    signature: string | null;
+    nowSeconds: number;
+}>): Readonly<{
+    ok: true;
+    timestamp: number;
+    signature: string;
+}> | Readonly<{
+    ok: false;
+    reason: "missing" | "malformed" | "stale";
+}>;
+/**
+ * `x-fungi-timestamp` plus `x-fungi-signature: v1=HMAC-SHA256(secret, "<timestamp>.<body>")`,
+ * keyed by the decoded secret. The event id is the signature, so a replay of
+ * the same signed request is the same event.
+ */
+export declare function verifyFungiV1(secret: string, request: EventRequest): EventVerification;
+/**
+ * GitHub's `X-Hub-Signature-256: sha256=HMAC-SHA256(secret, raw body)`, keyed by
+ * the secret's text exactly as it was pasted into GitHub. `X-GitHub-Delivery`
+ * is the event id; GitHub does not sign it, so the receiver must also bound
+ * what one delivery id can admit.
+ */
+export declare function verifyGithub(secret: string, request: EventRequest): EventVerification;
+/**
+ * An unsigned shared token in the URL: anyone who sees the URL can send events,
+ * and the body is not authenticated. The sender supplies no event id and no
+ * timestamp, so every accepted request is a new event with a fresh id.
+ */
+export declare function verifySecretUrl(secret: string, request: EventRequest): EventVerification;
+/**
+ * The Standard Webhooks key bytes behind a binding's secret, in the
+ * `whsec_<base64>` form senders (including Oyster's EVENTS delivery) take.
+ */
+export declare function standardWebhookSecret(secret: string): string;
+/**
+ * Standard Webhooks: `webhook-id`, `webhook-timestamp` and
+ * `webhook-signature: v1,<base64 HMAC-SHA256(key, "id.timestamp.body")>`,
+ * space-separated so senders can rotate keys. The id is signed, so a sender's
+ * re-signed retry keeps its event id and a captured body cannot be replayed
+ * under a new one.
+ */
+export declare function verifyStandardWebhooks(secret: string, request: EventRequest): EventVerification;

package/dist/event-verifiers.js

@@ -0,0 +1,168 @@
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import nodeCrypto from "node:crypto";
+import { z } from "zod";
+/** The ways an inbound event may prove it came from the binding's sender. */
+export const EVENT_VERIFIERS = [
+    "fungi-v1",
+    "github",
+    "secret-url",
+    "standard-webhooks",
+];
+/** `secret-url` carries an unsigned shared token, so the UI labels it less secure. */
+export const EVENT_VERIFIER_SECURITY = {
+    "fungi-v1": "signed",
+    github: "signed",
+    "secret-url": "less_secure",
+    "standard-webhooks": "signed",
+};
+/** Senders that supply no delivery id (secret-url) get one minted here. */
+const eventIds = defineIdFamily({
+    family: "veil",
+    version: 1,
+    kinds: { delivery: { prefix: "event_delivery" } },
+});
+const secretSchema = z.lazy(() => z.string().regex(/^[A-Za-z0-9_-]{43}$/u));
+const fungiSignatureSchema = z.lazy(() => z.string().regex(/^v1=[a-f0-9]{64}$/u));
+const githubSignatureSchema = z.lazy(() => z.string().regex(/^sha256=[a-f0-9]{64}$/u));
+const githubDeliverySchema = z.lazy(() => z.string().regex(/^[A-Za-z0-9._-]{1,128}$/u));
+const timestampSchema = z.lazy(() => z
+    .string()
+    .regex(/^\d{1,12}$/u)
+    .transform(Number)
+    .pipe(z.number().int().nonnegative()));
+/** A signed timestamp further than this from the receiver's clock is refused. */
+export const WEBHOOK_SIGNATURE_MAX_SKEW_SECONDS = 300;
+const refused = (reason) => ({
+    status: "refused",
+    reason,
+});
+/** The one comparison of secret-derived bytes. Callers pass shape-checked, fixed-length values. */
+export function constantTimeEqual(a, b) {
+    return a.length === b.length && nodeCrypto.timingSafeEqual(a, b);
+}
+const present = (value) => value !== null && value !== "";
+/**
+ * Parse the signed-request headers and refuse a stale or future timestamp.
+ * Needs no secret, so an ingress can refuse malformed traffic before it reads
+ * any binding state.
+ */
+export function parseFungiSignatureHeaders(input) {
+    if (!present(input.timestamp) || !present(input.signature))
+        return { ok: false, reason: "missing" };
+    const timestamp = timestampSchema.safeParse(input.timestamp);
+    const signature = fungiSignatureSchema.safeParse(input.signature);
+    if (!timestamp.success || !signature.success)
+        return { ok: false, reason: "malformed" };
+    if (Math.abs(input.nowSeconds - timestamp.data) >
+        WEBHOOK_SIGNATURE_MAX_SKEW_SECONDS)
+        return { ok: false, reason: "stale" };
+    return { ok: true, timestamp: timestamp.data, signature: signature.data };
+}
+/**
+ * `x-fungi-timestamp` plus `x-fungi-signature: v1=HMAC-SHA256(secret, "<timestamp>.<body>")`,
+ * keyed by the decoded secret. The event id is the signature, so a replay of
+ * the same signed request is the same event.
+ */
+export function verifyFungiV1(secret, request) {
+    const headers = parseFungiSignatureHeaders({
+        timestamp: request.headers.get("x-fungi-timestamp"),
+        signature: request.headers.get("x-fungi-signature"),
+        nowSeconds: request.nowSeconds,
+    });
+    if (!headers.ok)
+        return refused(headers.reason);
+    const expected = nodeCrypto
+        .createHmac("sha256", Buffer.from(secret, "base64url"))
+        .update(`${String(headers.timestamp)}.`)
+        .update(request.body)
+        .digest();
+    const claimed = headers.signature.slice(3);
+    if (!constantTimeEqual(expected, Buffer.from(claimed, "hex")))
+        return refused("bad_signature");
+    return { status: "ok", eventId: claimed };
+}
+/**
+ * GitHub's `X-Hub-Signature-256: sha256=HMAC-SHA256(secret, raw body)`, keyed by
+ * the secret's text exactly as it was pasted into GitHub. `X-GitHub-Delivery`
+ * is the event id; GitHub does not sign it, so the receiver must also bound
+ * what one delivery id can admit.
+ */
+export function verifyGithub(secret, request) {
+    const signature = request.headers.get("x-hub-signature-256");
+    const delivery = request.headers.get("x-github-delivery");
+    if (!present(signature) || !present(delivery))
+        return refused("missing");
+    const parsedSignature = githubSignatureSchema.safeParse(signature);
+    const parsedDelivery = githubDeliverySchema.safeParse(delivery);
+    if (!parsedSignature.success || !parsedDelivery.success)
+        return refused("malformed");
+    const expected = nodeCrypto
+        .createHmac("sha256", Buffer.from(secret, "utf8"))
+        .update(request.body)
+        .digest();
+    if (!constantTimeEqual(expected, Buffer.from(parsedSignature.data.slice(7), "hex")))
+        return refused("bad_signature");
+    return { status: "ok", eventId: parsedDelivery.data };
+}
+/**
+ * An unsigned shared token in the URL: anyone who sees the URL can send events,
+ * and the body is not authenticated. The sender supplies no event id and no
+ * timestamp, so every accepted request is a new event with a fresh id.
+ */
+export function verifySecretUrl(secret, request) {
+    if (!present(request.urlToken))
+        return refused("missing");
+    const token = secretSchema.safeParse(request.urlToken);
+    if (!token.success)
+        return refused("malformed");
+    if (!constantTimeEqual(Buffer.from(token.data, "utf8"), Buffer.from(secret, "utf8")))
+        return refused("bad_signature");
+    return { status: "ok", eventId: eventIds.delivery.generate() };
+}
+const standardIdSchema = z.lazy(() => z.string().regex(/^[\x21-\x7e]{1,256}$/u));
+const standardSignatureSchema = z.lazy(() => z
+    .string()
+    .regex(/^v1,[A-Za-z0-9+/]+={0,2}$/u)
+    .transform((value) => Buffer.from(value.slice(3), "base64")));
+/**
+ * The Standard Webhooks key bytes behind a binding's secret, in the
+ * `whsec_<base64>` form senders (including Oyster's EVENTS delivery) take.
+ */
+export function standardWebhookSecret(secret) {
+    return `whsec_${Buffer.from(secret, "base64url").toString("base64")}`;
+}
+/**
+ * Standard Webhooks: `webhook-id`, `webhook-timestamp` and
+ * `webhook-signature: v1,<base64 HMAC-SHA256(key, "id.timestamp.body")>`,
+ * space-separated so senders can rotate keys. The id is signed, so a sender's
+ * re-signed retry keeps its event id and a captured body cannot be replayed
+ * under a new one.
+ */
+export function verifyStandardWebhooks(secret, request) {
+    const id = request.headers.get("webhook-id");
+    const timestamp = request.headers.get("webhook-timestamp");
+    const signatures = request.headers.get("webhook-signature");
+    if (!present(id) || !present(timestamp) || !present(signatures))
+        return refused("missing");
+    const parsedId = standardIdSchema.safeParse(id);
+    const parsedTimestamp = timestampSchema.safeParse(timestamp);
+    const parsedSignatures = signatures
+        .split(" ")
+        .map((value) => standardSignatureSchema.safeParse(value));
+    if (!parsedId.success ||
+        !parsedTimestamp.success ||
+        parsedSignatures.some((parsed) => !parsed.success))
+        return refused("malformed");
+    if (Math.abs(request.nowSeconds - parsedTimestamp.data) >
+        WEBHOOK_SIGNATURE_MAX_SKEW_SECONDS)
+        return refused("stale");
+    const expected = nodeCrypto
+        .createHmac("sha256", Buffer.from(secret, "base64url"))
+        .update(`${parsedId.data}.${String(parsedTimestamp.data)}.`)
+        .update(request.body)
+        .digest();
+    const matched = parsedSignatures.some((parsed) => parsed.success && constantTimeEqual(expected, parsed.data));
+    return matched
+        ? { status: "ok", eventId: parsedId.data }
+        : refused("bad_signature");
+}

package/dist/gatekeeper.d.ts

@@ -0,0 +1,202 @@
+import { type OpenApiCredentialStore, type OpenApiOAuthProvider, type OpenApiDoorOptions } from "./openapi.js";
+import { type OpenApiEffects } from "./openapi-effect.js";
+import type { PublicConnect } from "./public-fetch.js";
+import { type WorldSeatCustodian } from "./world-seat.js";
+import type { ModelKeyCustodian } from "./model-keys.js";
+import { createModelKeyEgress, type ModelKeyGrants } from "./model-key-grants.js";
+import { providerFetch, type ProviderEgress, type ProviderKeyBindings, type ProviderRoute } from "./provider-egress.js";
+import * as Schema from "effect/Schema";
+/**
+ * The Gatekeeper: the one place the Hub's Nango key, webhook signing key,
+ * provider/model-key integration ids, and platform provider keys (Camel, the
+ * AI Gateway token, Parallel) are read out of the Worker environment and
+ * turned into a custodian or egress. These `configured*` functions are the custody
+ * boundary (`V1`): the Hub hands them its own `env` object opaquely and gets
+ * back an opaque custodian/egress handle, never the secret values themselves.
+ * No file outside `packages/veil` may read `env.NANGO_*` or
+ * `env.WEBHOOK_TRIGGER_MASTER_KEY`, `env.CAMEL_API_KEY`,
+ * `env.AI_GATEWAY_AUTH_TOKEN` or `env.PARALLEL_API_KEY` directly; the static
+ * boundary test `apps/hub/test/veil-custody-boundary.test.ts` enforces it.
+ * Hub code reaches a provider only through `configuredProviderEgress`.
+ */
+export { providerFetch };
+export type { ProviderEgress, ProviderRoute };
+/** Private Worker bindings, never Team storage or public response fields. */
+export type VeilBindings = ProviderKeyBindings & Readonly<{
+    WEBHOOK_TRIGGER_MASTER_KEY?: string;
+    /** Dedicated custody root for Team OpenAPI API-key/bearer credentials. */
+    OPENAPI_CREDENTIAL_MASTER_KEY?: string;
+    OPENAPI_CREDENTIAL_KEY_ID?: string;
+    NANGO_SERVER_URL?: string;
+    NANGO_API_KEY?: string;
+    NANGO_WEBHOOK_SIGNING_KEY?: string;
+    NANGO_GITHUB_INTEGRATION_ID?: string;
+    NANGO_GITHUB_GIT_INTEGRATION_ID?: string;
+    /** Public Connect UI base that Nango's issued links must stay under. */
+    NANGO_CONNECT_BASE_URL?: string;
+    /** Public Nango API origin the Connect UI in the browser must call. */
+    NANGO_PUBLIC_API_URL?: string;
+    /** Nango API-key integrations holding Team and personal model keys. */
+    NANGO_ANTHROPIC_KEY_INTEGRATION_ID?: string;
+    NANGO_OPENAI_KEY_INTEGRATION_ID?: string;
+    NANGO_OPENROUTER_KEY_INTEGRATION_ID?: string;
+    /** A bearer-token integration used with a per-key base URL override. */
+    NANGO_OPENAI_COMPATIBLE_KEY_INTEGRATION_ID?: string;
+    /** A bearer-token integration holding App world-seat tokens. */
+    NANGO_WORLD_INTEGRATION_ID?: string;
+    /**
+     * Exactly `enabled` only in a local/dev Hub (the checked-in local Worker
+     * config). It admits a loopback world seat endpoint; production never sets
+     * it and no URL can turn it on.
+     */
+    HUB_LOCAL_MODE?: string;
+}>;
+export declare function configuredGitHubState(env: VeilBindings): {
+    github: "off";
+    metadataIntegrationId?: never;
+    gitIntegrationId?: never;
+} | {
+    github: "on";
+    metadataIntegrationId: string;
+    gitIntegrationId: string;
+};
+/**
+ * `veil.fetch` for platform provider keys. The Hub names a route and sends a
+ * credential-free request; Veil checks the destination and attaches the key.
+ * `fetch` is only the final transport (telemetry, or a test double).
+ */
+export declare function configuredProviderEgress(env: VeilBindings, options?: Readonly<{
+    fetch?: typeof globalThis.fetch;
+}>): ProviderEgress;
+/** The Worker secret is the only custody root for per-trigger signing bytes. */
+export declare function configuredWebhookTriggerSecrets(env: VeilBindings): {
+    kind: "unavailable";
+    custodian?: never;
+    cause?: never;
+} | {
+    kind: "ready";
+    custodian: {
+        reveal: (input: import("./webhook-trigger-secrets.js").EventBindingAddress) => Promise<string>;
+        verify(input: import("./event-verifiers.js").EventRequest & Readonly<{
+            verifier: import("./event-verifiers.js").EventVerifier;
+            address: import("./webhook-trigger-secrets.js").EventBindingAddress;
+        }>): Promise<import("./event-verifiers.js").EventVerification>;
+    };
+    cause?: never;
+} | {
+    kind: "unavailable";
+    cause: unknown;
+    custodian?: never;
+};
+/** Model API keys use their own integrations; none are required to boot. */
+export declare function configuredModelKeyCustodian(env: VeilBindings): ModelKeyCustodian;
+/**
+ * Model-key grants are sealed under a key derived from the custodian's own
+ * Nango credential, so only a holder of custody can issue or open one.
+ */
+export declare function configuredModelKeyGrants(env: VeilBindings): ModelKeyGrants;
+/** World-seat tokens use their own integration; it is not required to boot. */
+export declare function configuredWorldSeatCustodian(env: VeilBindings): WorldSeatCustodian;
+/** The seat endpoint rule for this host: public HTTPS, or loopback when local. */
+export declare function configuredWorldSeatEndpoint(env: VeilBindings): (endpoint: string) => string;
+/** Final model egress a runner reaches with a delivered grant, never via TeamDO. */
+export declare function configuredModelKeyEgress(env: VeilBindings, options: Readonly<{
+    ownerIsMember: Parameters<typeof createModelKeyEgress>[0]["ownerIsMember"];
+}>): {
+    send(grant: string, expected: Readonly<{
+        teamId: string;
+        subject: import("./model-key-grants.js").ModelKeyGrantSubject;
+        provider: import("./model-keys.js").ModelKeyProvider;
+    }>, request: Request): Promise<Response>;
+};
+export declare function configuredVeilCustodian(env: VeilBindings): Readonly<{
+    openSession: (input: Readonly<{
+        teamId: string;
+        attemptId: string;
+        principalId: string;
+        integrationId: string;
+    }>, signal: AbortSignal) => Promise<Readonly<{
+        token: string;
+        connectUrl: string;
+        expiresAt: number;
+    }>>;
+    verifyCompletion: (rawBody: string, signature: string) => Promise<import("./index.js").VerifiedCompletion>;
+    verifyWebhook: (rawBody: string, signature: string) => Promise<import("./index.js").VerifiedWebhook>;
+    findCompletion: (attempt: import("./index.js").CustodyCorrelation, signal: AbortSignal) => Promise<Schema.Schema.Type<Schema.Union<readonly [Schema.Struct<{
+        readonly status: Schema.Literal<"unresolved">;
+    }>, Schema.Struct<{
+        readonly status: Schema.Literal<"ambiguous">;
+    }>, Schema.Struct<{
+        readonly status: Schema.Literal<"verified">;
+        readonly completion: Schema.Struct<{
+            readonly teamId: Schema.NonEmptyString;
+            readonly attemptId: Schema.NonEmptyString;
+            readonly principalId: Schema.NonEmptyString;
+            readonly integrationId: Schema.NonEmptyString;
+            readonly locator: Schema.NonEmptyString;
+        }>;
+    }>]>>>;
+    deleteConnection: (locator: string, signal: AbortSignal) => Promise<"deleted" | "absent">;
+    readRepository: (access: import("./index.js").RepositoryAccess, signal: AbortSignal) => Promise<string>;
+}>;
+/** Git Connect/cleanup and final egress use the same Git-profile integration.
+ * No metadata Connection locator is translated into this profile. Veil confines
+ * the issued Connect document to the configured public Connect URLs. */
+export declare function configuredComputerGitCustodian(env: VeilBindings): {
+    integrationId: string;
+    openSession: (input: Readonly<{
+        teamId: string;
+        attemptId: string;
+        principalId: string;
+        integrationId: string;
+    }>, signal: AbortSignal) => Promise<Readonly<{
+        token: string;
+        connectUrl: string;
+        expiresAt: number;
+    }>>;
+    verifyCompletion: (rawBody: string, signature: string) => Promise<import("./index.js").VerifiedCompletion>;
+    verifyWebhook: (rawBody: string, signature: string) => Promise<import("./index.js").VerifiedWebhook>;
+    findCompletion: (attempt: import("./index.js").CustodyCorrelation, signal: AbortSignal) => Promise<Schema.Schema.Type<Schema.Union<readonly [Schema.Struct<{
+        readonly status: Schema.Literal<"unresolved">;
+    }>, Schema.Struct<{
+        readonly status: Schema.Literal<"ambiguous">;
+    }>, Schema.Struct<{
+        readonly status: Schema.Literal<"verified">;
+        readonly completion: Schema.Struct<{
+            readonly teamId: Schema.NonEmptyString;
+            readonly attemptId: Schema.NonEmptyString;
+            readonly principalId: Schema.NonEmptyString;
+            readonly integrationId: Schema.NonEmptyString;
+            readonly locator: Schema.NonEmptyString;
+        }>;
+    }>]>>>;
+    deleteConnection: (locator: string, signal: AbortSignal) => Promise<"deleted" | "absent">;
+    readGit: (access: import("./nango-git.js").GitRepositoryAccess, request: Request) => Promise<Response>;
+};
+/** The decoded key selects one of the two configured profiles only. The
+ * selected maintained custodian still verifies the original signed body. */
+export declare function verifyVeilWebhook(env: VeilBindings, rawBody: string, signature: string): Promise<{
+    operation: "creation" | "refresh_failed";
+    completion: import("./index.js").VerifiedCompletion;
+    profile: "computer-git";
+} | {
+    operation: "creation" | "refresh_failed";
+    completion: import("./index.js").VerifiedCompletion;
+    profile: "agent-metadata";
+}>;
+export type OpenApiHostOptions = Readonly<{
+    connect: PublicConnect;
+    fetch: typeof fetch;
+    store: OpenApiCredentialStore;
+    networkPolicy?: OpenApiDoorOptions["networkPolicy"];
+    previousCredentialKeys?: Readonly<Record<string, string>>;
+    oauthProviders?: Readonly<Record<string, OpenApiOAuthProvider>>;
+}>;
+/** Anonymous calls need no secret; API-key/bearer calls require configured Veil custody. */
+export declare function configuredOpenApiDoor(env: VeilBindings, options: OpenApiHostOptions): Readonly<{
+    seal: (access: import("./openapi-contract.js").OpenApiAccess, credential: string, signal: AbortSignal) => Promise<void>;
+    send: (access: import("./openapi-contract.js").OpenApiAccess, request: Request, declaredHeaders?: readonly string[]) => Promise<Response>;
+    remove: (address: import("./openapi-contract.js").OpenApiCredentialAddress, signal: AbortSignal) => Promise<"deleted" | "absent">;
+}>;
+/** Owned composition retains canonical Effects; secrets are read only by Gatekeeper. */
+export declare function configuredOpenApiEffects(env: VeilBindings, options: OpenApiHostOptions): OpenApiEffects;