@fungi.computer/veil 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,267 @@
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+const text = Schema.NonEmptyString;
+const integer = Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0));
+/** The repository identity selected by the Team, never by model input. */
+export const RepositoryScopeSchema = Schema.Struct({
+    id: integer.check(Schema.isGreaterThan(0)),
+    owner: text,
+    name: text,
+});
+/** Bounded, credential-free metadata returned by the GitHub operation. */
+export const GitHubRepositorySchema = Schema.Struct({
+    id: integer.check(Schema.isGreaterThan(0)),
+    name: text,
+    fullName: text,
+    private: Schema.Boolean,
+    defaultBranch: text,
+});
+const providerRepositorySchema = Schema.Struct({
+    id: GitHubRepositorySchema.fields.id,
+    name: text,
+    full_name: GitHubRepositorySchema.fields.fullName,
+    private: Schema.Boolean,
+    default_branch: text,
+});
+export const ConnectInputSchema = Schema.Struct({
+    requestId: text,
+    actorUserId: text,
+    holderAgentId: text,
+    repository: RepositoryScopeSchema,
+});
+export const AttemptSchema = Schema.Struct({
+    ...ConnectInputSchema.fields,
+    teamId: text,
+    attemptId: text,
+    connectionId: text,
+    integrationId: text,
+    expiresAt: integer,
+});
+/** Produced only by a custodian's verified completion boundary. */
+export const CompletionSchema = Schema.Struct({
+    teamId: text,
+    attemptId: text,
+    principalId: text,
+    integrationId: text,
+    locator: text,
+});
+export const ConnectionReceiptSchema = Schema.Struct({
+    requestId: text,
+    connectionId: text,
+    holderAgentId: text,
+    repository: RepositoryScopeSchema,
+    authorityVersion: integer,
+    status: Schema.Literals(["active", "disconnected"]),
+    cleanup: Schema.Literals(["none", "pending"]),
+});
+export const ReadBindingSchema = Schema.Struct({
+    teamId: text,
+    holderAgentId: text,
+    connectionId: text,
+    repositoryId: integer,
+});
+export const DisconnectInputSchema = Schema.Struct({
+    requestId: text,
+    actorUserId: text,
+    connectionId: text,
+});
+const completionLookupSchema = Schema.Union([
+    Schema.Struct({ status: Schema.Literal("unresolved") }),
+    Schema.Struct({ status: Schema.Literal("ambiguous") }),
+    Schema.Struct({
+        status: Schema.Literal("verified"),
+        completion: CompletionSchema,
+    }),
+]);
+const connectSessionSchema = Schema.Struct({
+    token: text,
+    connectUrl: Schema.String,
+    expiresAt: integer,
+});
+/** Sanitized public failure; an optional cause is retained internally only. */
+export class VeilError extends Error {
+    code;
+    constructor(code, cause) {
+        super(code);
+        this.code = code;
+        this.name = "VeilError";
+        if (cause !== undefined)
+            Object.defineProperty(this, "cause", { value: cause, enumerable: false });
+    }
+}
+const orphanCodes = new Set([
+    "expired",
+    "denied",
+    "conflict",
+    "reconnect_required",
+]);
+function failure(cause) {
+    return new VeilError(cause instanceof VeilError ? cause.code : "unavailable");
+}
+function owned(operation) {
+    return Effect.try({ try: operation, catch: failure });
+}
+function run(program, signal) {
+    return Effect.runPromiseExit(program, signal === undefined ? undefined : { signal }).then((exit) => {
+        if (Exit.isSuccess(exit))
+            return exit.value;
+        const error = Option.getOrUndefined(Cause.findErrorOption(exit.cause));
+        throw (error ??
+            new VeilError(Cause.hasInterrupts(exit.cause) ? "cancelled" : "unavailable"));
+    });
+}
+/** One Effect policy behind the ordinary connect and GitHub Gatekeeper calls. */
+export function createGitHubConnections(options) {
+    const { owner, custodian } = options;
+    const repository = (access) => Effect.gen(function* () {
+        const raw = yield* Effect.tryPromise({
+            try: (signal) => custodian.readRepository(access, signal),
+            catch: failure,
+        });
+        const result = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(providerRepositorySchema))(raw).pipe(Effect.mapError(() => new VeilError("invalid_response")));
+        if (result.id !== access.repository.id)
+            return yield* Effect.fail(new VeilError("denied"));
+        return {
+            id: result.id,
+            name: result.name,
+            fullName: result.full_name,
+            private: result.private,
+            defaultBranch: result.default_branch,
+        };
+    });
+    /** Delete a verified connection the Team will never hold, then refuse it. */
+    const release = (completion, code) => Effect.gen(function* () {
+        const raw = yield* Effect.tryPromise({
+            try: (signal) => custodian.deleteConnection(completion.locator, signal),
+            catch: failure,
+        });
+        const custody = yield* Schema.decodeUnknownEffect(Schema.Literals(["deleted", "absent"]))(raw).pipe(Effect.mapError(() => new VeilError("invalid_response")));
+        yield* owned(() => {
+            owner.recordOrphan(completion, code, custody);
+        });
+        return yield* Effect.fail(new VeilError(code));
+    });
+    const activate = (verified) => Effect.gen(function* () {
+        const completion = yield* Schema.decodeUnknownEffect(CompletionSchema)(verified).pipe(Effect.mapError(() => new VeilError("invalid_completion")));
+        const prepared = yield* owned(() => owner.prepareCompletion(completion));
+        if (prepared.status === "completed")
+            return prepared.receipt;
+        if (prepared.status === "orphaned")
+            return yield* release(completion, prepared.code);
+        const { attempt } = prepared;
+        return yield* Effect.gen(function* () {
+            const metadata = yield* repository({
+                locator: completion.locator,
+                repository: attempt.repository,
+            });
+            return yield* Effect.tryPromise({
+                try: async () => owner.activate(completion, metadata),
+                catch: failure,
+            });
+        }).pipe(Effect.catchIf((error) => orphanCodes.has(error.code), (error) => Effect.gen(function* () {
+            // A concurrent delivery of this same completion may have won.
+            const settled = yield* owned(() => owner.prepareCompletion(completion));
+            if (settled.status === "completed")
+                return settled.receipt;
+            return yield* release(completion, error.code);
+        })));
+    });
+    return {
+        connect: (input, signal) => run(Effect.gen(function* () {
+            const command = yield* Schema.decodeUnknownEffect(ConnectInputSchema)(input).pipe(Effect.mapError(() => new VeilError("invalid_input")));
+            const prepared = yield* owned(() => owner.begin(command));
+            if (prepared.status === "completed")
+                return prepared;
+            const { attempt } = prepared;
+            const rawSession = yield* Effect.tryPromise({
+                try: (control) => custodian.openSession({
+                    teamId: attempt.teamId,
+                    attemptId: attempt.attemptId,
+                    principalId: attempt.actorUserId,
+                    integrationId: attempt.integrationId,
+                }, control),
+                catch: failure,
+            });
+            const session = yield* Schema.decodeUnknownEffect(connectSessionSchema)(rawSession).pipe(Effect.mapError(() => new VeilError("invalid_response")));
+            return {
+                status: "pending",
+                attemptId: attempt.attemptId,
+                ...session,
+            };
+        }), signal),
+        /** The one entry for signed custodian webhooks: activation or reconnect evidence. */
+        complete: (rawBody, signature, signal) => run(Effect.gen(function* () {
+            const event = yield* Effect.tryPromise({
+                try: () => custodian.verifyWebhook(rawBody, signature),
+                catch: failure,
+            });
+            if (event.operation === "creation")
+                return yield* activate(event.completion);
+            const completion = yield* Schema.decodeUnknownEffect(CompletionSchema)(event.completion).pipe(Effect.mapError(() => new VeilError("invalid_completion")));
+            const prepared = yield* owned(() => owner.prepareCompletion(completion));
+            if (prepared.status !== "completed")
+                return { status: "not_held" };
+            return yield* owned(() => owner.requireReconnect(completion.locator, "refresh_failed"));
+        }), signal),
+        reconcile: (input, signal) => run(Effect.gen(function* () {
+            const command = yield* Schema.decodeUnknownEffect(ConnectInputSchema)(input).pipe(Effect.mapError(() => new VeilError("invalid_input")));
+            const prepared = yield* owned(() => owner.readAttempt(command));
+            if (prepared.status === "completed")
+                return prepared;
+            const raw = yield* Effect.tryPromise({
+                try: (control) => custodian.findCompletion(prepared.attempt, control),
+                catch: failure,
+            });
+            const result = yield* Schema.decodeUnknownEffect(completionLookupSchema)(raw).pipe(Effect.mapError(() => new VeilError("invalid_response")));
+            if (result.status === "ambiguous")
+                return yield* Effect.fail(new VeilError("ambiguous"));
+            if (result.status === "unresolved")
+                return {
+                    status: "pending",
+                    attemptId: prepared.attempt.attemptId,
+                };
+            if (result.completion.attemptId !== prepared.attempt.attemptId)
+                return yield* Effect.fail(new VeilError("invalid_completion"));
+            const receipt = yield* activate(result.completion);
+            return { status: "completed", receipt };
+        }), signal),
+        /** One bounded host recovery call; durable pending work survives interrupted or uncertain deletion. */
+        cleanupOne: (signal) => run(Effect.gen(function* () {
+            const work = yield* owned(() => owner.nextCleanup());
+            if (work === undefined)
+                return { status: "idle" };
+            const raw = yield* Effect.tryPromise({
+                try: (control) => custodian.deleteConnection(work.locator, control),
+                catch: failure,
+            });
+            const custody = yield* Schema.decodeUnknownEffect(Schema.Literals(["deleted", "absent"]))(raw).pipe(Effect.mapError(() => new VeilError("invalid_response")));
+            yield* owned(() => {
+                owner.acknowledgeCleanup(work);
+            });
+            return {
+                status: "completed",
+                connectionId: work.connectionId,
+                authorityVersion: work.authorityVersion,
+                custody,
+            };
+        }), signal),
+        readRepository: (binding, signal) => run(Effect.gen(function* () {
+            const command = yield* Schema.decodeUnknownEffect(ReadBindingSchema)(binding).pipe(Effect.mapError(() => new VeilError("invalid_input")));
+            // Admission is the fresh owner decision immediately before this one egress.
+            const access = yield* owned(() => owner.authorize(command));
+            return yield* repository(access).pipe(Effect.tapError((error) => error.code === "reconnect_required"
+                ? owned(() => owner.requireReconnect(access.locator, "provider_unauthorized")).pipe(Effect.asVoid)
+                : Effect.void));
+        }), signal),
+        disconnect: (input) => run(Effect.gen(function* () {
+            const command = yield* Schema.decodeUnknownEffect(DisconnectInputSchema)(input).pipe(Effect.mapError(() => new VeilError("invalid_input")));
+            return yield* Effect.tryPromise({
+                try: async () => owner.disconnect(command),
+                catch: failure,
+            });
+        })),
+    };
+}

package/dist/model-credentials.d.ts

@@ -0,0 +1,226 @@
+/**
+ * Which model credentials Fungi may use, and where. This is the single owner of
+ * provider login policy: the local runtime, the TUI login registry and the Hub
+ * read it; none of them decides visibility on its own.
+ *
+ * Stance: like Pi and OpenCode, offer a person's own subscription locally and
+ * hosted, and turn a provider off through `subscriptionKillSwitch` if it
+ * objects or blocks tokens. A subscription is always one person's: never
+ * Team-scoped, shared or pooled. The new OpenAI ChatGPT plan flow is
+ * local-only; hosted use awaits OpenAI approval. The retired Codex provider
+ * is forbidden on both hosts.
+ * See wiki/3-resources/decisions/adr-byok-model-keys-v1.md.
+ */
+/** The owner's own machine, or Fungi's servers acting for a Team. */
+export type CredentialHost = "local" | "hosted";
+/** A provider API key, or the provider's consumer subscription sign-in. */
+export type CredentialMethod = "api_key" | "subscription";
+export type CredentialPermission = Readonly<{
+    status: "allowed";
+}> | Readonly<{
+    status: "forbidden";
+    reason: string;
+    source: string;
+}>
+/** Not reviewed against the provider's terms: local status quo, never hosted. */
+ | Readonly<{
+    status: "unreviewed";
+}>;
+/**
+ * Reviewed providers, keyed by Pi provider id. `openai-compatible` is a
+ * Team-configured OpenAI-shaped base URL, authenticated by an API key.
+ */
+export declare const modelCredentialPolicy: Readonly<{
+    fungi: {
+        api_key: {
+            local: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+            hosted: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+        };
+        subscription: {
+            local: Readonly<{
+                status: "allowed";
+            }>;
+            hosted: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+        };
+    };
+    anthropic: {
+        api_key: {
+            local: Readonly<{
+                status: "allowed";
+            }>;
+            hosted: Readonly<{
+                status: "allowed";
+            }>;
+        };
+        subscription: {
+            local: Readonly<{
+                status: "allowed";
+            }>;
+            hosted: Readonly<{
+                status: "allowed";
+            }>;
+        };
+    };
+    "openai-codex": {
+        api_key: {
+            local: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+            hosted: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+        };
+        subscription: {
+            local: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+            hosted: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+        };
+    };
+    openai: {
+        api_key: {
+            local: Readonly<{
+                status: "allowed";
+            }>;
+            hosted: Readonly<{
+                status: "allowed";
+            }>;
+        };
+        subscription: {
+            local: Readonly<{
+                status: "allowed";
+            }>;
+            hosted: {
+                status: "forbidden";
+                reason: string;
+                source: string;
+            };
+        };
+    };
+    openrouter: {
+        api_key: {
+            local: Readonly<{
+                status: "allowed";
+            }>;
+            hosted: Readonly<{
+                status: "allowed";
+            }>;
+        };
+        subscription: {
+            local: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+            hosted: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+        };
+    };
+    "openai-compatible": {
+        api_key: {
+            local: Readonly<{
+                status: "allowed";
+            }>;
+            hosted: Readonly<{
+                status: "allowed";
+            }>;
+        };
+        subscription: {
+            local: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+            hosted: Readonly<{
+                status: "forbidden";
+                reason: string;
+                source: string;
+            }>;
+        };
+    };
+}>;
+/**
+ * Per-provider off switch for subscription sign-in, local and hosted alike.
+ * Set an entry to `true` when a provider objects or starts refusing tokens.
+ */
+export declare const subscriptionKillSwitch: Readonly<Record<string, boolean>>;
+/**
+ * Read a runtime kill-switch override: a comma-separated provider list such as
+ * `anthropic,openai`. Hosts supply it from runtime configuration (a
+ * Worker secret or an environment variable), so turning a provider off needs
+ * no code change or release. An override can only switch providers off.
+ */
+export declare function subscriptionKillSwitchFrom(raw: string | undefined): Readonly<Record<string, boolean>>;
+/** The one decision every login surface and credential store consults. */
+export declare function modelCredentialPermission(providerId: string, method: CredentialMethod, host: CredentialHost): CredentialPermission;
+/** Who owns a credential: one Fungi user, or the whole Team. */
+export type CredentialScope = "user" | "team";
+export type LoginRequest = Readonly<{
+    providerId: string;
+    method: CredentialMethod;
+    host: CredentialHost;
+    scope: CredentialScope;
+}>;
+/**
+ * Whether this login may be offered or this credential attached. A
+ * subscription belongs to one person: it is never Team-scoped, shared or
+ * pooled, and a provider's kill switch turns it off. Unreviewed providers stay
+ * local.
+ */
+export declare function loginAllowed(request: LoginRequest, killSwitch?: Readonly<Record<string, boolean>>): boolean;
+/** The owner recorded with a stored credential. */
+export type CredentialBinding = Readonly<{
+    scope: "user";
+    teamId: string;
+    userId: string;
+}> | Readonly<{
+    scope: "team";
+    teamId: string;
+}>;
+/**
+ * The run asking to use a credential. An Agent or Computer acts for the user
+ * who owns it; a Team key is its own actor and owns no personal credential.
+ */
+export type CredentialRunner = Readonly<{
+    teamId: string;
+    kind: "user";
+    userId: string;
+}> | Readonly<{
+    teamId: string;
+    kind: "agent" | "computer";
+    ownerUserId: string;
+}> | Readonly<{
+    teamId: string;
+    kind: "team-key";
+}>;
+/**
+ * Whether a run may use a stored credential. Team credentials serve any run in
+ * their Team; a user's credential serves only that user and their own Agents
+ * and Computers, never another member's run or a Team key.
+ */
+export declare function credentialUsableBy(binding: CredentialBinding, runner: CredentialRunner): boolean;

package/dist/model-credentials.js

@@ -0,0 +1,133 @@
+/**
+ * Which model credentials Fungi may use, and where. This is the single owner of
+ * provider login policy: the local runtime, the TUI login registry and the Hub
+ * read it; none of them decides visibility on its own.
+ *
+ * Stance: like Pi and OpenCode, offer a person's own subscription locally and
+ * hosted, and turn a provider off through `subscriptionKillSwitch` if it
+ * objects or blocks tokens. A subscription is always one person's: never
+ * Team-scoped, shared or pooled. The new OpenAI ChatGPT plan flow is
+ * local-only; hosted use awaits OpenAI approval. The retired Codex provider
+ * is forbidden on both hosts.
+ * See wiki/3-resources/decisions/adr-byok-model-keys-v1.md.
+ */
+const allowed = { status: "allowed" };
+const unreviewed = { status: "unreviewed" };
+const notOffered = {
+    status: "forbidden",
+    reason: "The provider does not offer this credential method",
+    source: "provider documentation",
+};
+const retiredCodex = {
+    status: "forbidden",
+    reason: "Use OpenAI instead of the retired OpenAI Codex provider",
+    source: "wiki/3-resources/decisions/adr-byok-model-keys-v1.md",
+};
+const apiKeyOnly = {
+    api_key: { local: allowed, hosted: allowed },
+    subscription: { local: notOffered, hosted: notOffered },
+};
+/**
+ * Reviewed providers, keyed by Pi provider id. `openai-compatible` is a
+ * Team-configured OpenAI-shaped base URL, authenticated by an API key.
+ */
+export const modelCredentialPolicy = Object.freeze({
+    fungi: {
+        api_key: { local: notOffered, hosted: notOffered },
+        subscription: { local: allowed, hosted: notOffered },
+    },
+    anthropic: {
+        api_key: { local: allowed, hosted: allowed },
+        // Local: Pi's Claude Pro/Max OAuth, as Pi and OpenCode ship it. Hosted: the
+        // unmodified Claude Code binary on the owner's Computer, signed in by them.
+        subscription: { local: allowed, hosted: allowed },
+    },
+    "openai-codex": {
+        api_key: { local: retiredCodex, hosted: retiredCodex },
+        subscription: { local: retiredCodex, hosted: retiredCodex },
+    },
+    openai: {
+        api_key: { local: allowed, hosted: allowed },
+        subscription: {
+            local: allowed,
+            hosted: {
+                status: "forbidden",
+                reason: "ChatGPT plan usage in a hosted app requires OpenAI approval",
+                source: "https://developers.openai.com/siwc/token-sharing-open-source",
+            },
+        },
+    },
+    openrouter: apiKeyOnly,
+    "openai-compatible": apiKeyOnly,
+});
+const reviewedPolicies = new Map(Object.entries(modelCredentialPolicy));
+/**
+ * Per-provider off switch for subscription sign-in, local and hosted alike.
+ * Set an entry to `true` when a provider objects or starts refusing tokens.
+ */
+export const subscriptionKillSwitch = Object.freeze({ fungi: false, anthropic: false, openai: false });
+/**
+ * Read a runtime kill-switch override: a comma-separated provider list such as
+ * `anthropic,openai`. Hosts supply it from runtime configuration (a
+ * Worker secret or an environment variable), so turning a provider off needs
+ * no code change or release. An override can only switch providers off.
+ */
+export function subscriptionKillSwitchFrom(raw) {
+    const killed = (raw ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((providerId) => /^[a-z0-9][a-z0-9-]{0,63}$/u.test(providerId))
+        .map((providerId) => [providerId, true]);
+    return Object.freeze({
+        ...subscriptionKillSwitch,
+        ...Object.fromEntries(killed),
+    });
+}
+/** The one decision every login surface and credential store consults. */
+export function modelCredentialPermission(providerId, method, host) {
+    const policy = reviewedPolicies.get(providerId);
+    return policy?.[method][host] ?? unreviewed;
+}
+/**
+ * Whether this login may be offered or this credential attached. A
+ * subscription belongs to one person: it is never Team-scoped, shared or
+ * pooled, and a provider's kill switch turns it off. Unreviewed providers stay
+ * local.
+ */
+export function loginAllowed(request, killSwitch = subscriptionKillSwitch) {
+    if (request.method === "subscription") {
+        if (request.scope !== "user")
+            return false;
+        if (killSwitch[request.providerId] === true)
+            return false;
+    }
+    const permission = modelCredentialPermission(request.providerId, request.method, request.host);
+    switch (permission.status) {
+        case "allowed":
+            return true;
+        case "forbidden":
+            return false;
+        case "unreviewed":
+            return request.host === "local";
+    }
+}
+/**
+ * Whether a run may use a stored credential. Team credentials serve any run in
+ * their Team; a user's credential serves only that user and their own Agents
+ * and Computers, never another member's run or a Team key.
+ */
+export function credentialUsableBy(binding, runner) {
+    if (binding.teamId !== runner.teamId)
+        return false;
+    if (binding.scope === "team")
+        return true;
+    switch (runner.kind) {
+        case "user":
+            return runner.userId === binding.userId;
+        case "agent":
+        case "computer":
+            return runner.ownerUserId === binding.userId;
+        case "team-key":
+            return false;
+    }
+}

package/dist/model-key-grants.d.ts

@@ -0,0 +1,56 @@
+import { type HostResolver } from "./model-key-network.js";
+import { type ModelKeyCustodian, type ModelKeyProvider } from "./model-keys.js";
+/**
+ * Model-key egress grants. The Team owner decides which runner may use which
+ * sealed key and issues a grant for each decision; the grant travels down in a
+ * secret-free projection to the runner's host. Only the custodian can open it:
+ * it is AES-GCM sealed under a key derived from the custodian's own credential,
+ * bound to the Team and runner, and expires. Opening it is the custodian's
+ * authorization check, so no request bytes return to the Team owner.
+ */
+/** The runner a grant is bound to; the host supplies it from its own admission. */
+export type ModelKeyGrantSubject = Readonly<{
+    kind: "agent" | "user" | "team-key";
+    id: string;
+}>;
+export type ModelKeyGrantClaims = Readonly<{
+    teamId: string;
+    keyId: string;
+    locator: string;
+    provider: ModelKeyProvider;
+    baseUrl: string;
+    ownerUserId: string | null;
+    expiresAt: number;
+}>;
+/** Issue and open grants under a key only the custodian's credential derives. */
+export declare function createModelKeyGrants(options: Readonly<{
+    custodySecret: string;
+    now?: () => number;
+}>): {
+    issue(subject: ModelKeyGrantSubject, claims: ModelKeyGrantClaims): Promise<string>;
+    /** The custodian's check: authentic, for this Team and runner, unexpired. */
+    open(grant: string, expected: Readonly<{
+        teamId: string;
+        subject: ModelKeyGrantSubject;
+    }>): Promise<ModelKeyGrantClaims>;
+};
+export type ModelKeyGrants = ReturnType<typeof createModelKeyGrants>;
+/**
+ * Final model egress for a runner holding a grant. The custodian opens the
+ * grant, re-checks the personal key owner's membership and a Team-named base
+ * URL's public resolution, then attaches the sealed key upstream.
+ */
+export declare function createModelKeyEgress(options: Readonly<{
+    grants: ModelKeyGrants;
+    custodian: () => ModelKeyCustodian;
+    /** Whether the personal key's owner is still a member of the Team. */
+    ownerIsMember: (teamId: string, userId: string) => Promise<"allowed" | "denied" | "unavailable">;
+    resolveHost?: HostResolver;
+}>): {
+    send(grant: string, expected: Readonly<{
+        teamId: string;
+        subject: ModelKeyGrantSubject;
+        provider: ModelKeyProvider;
+    }>, request: Request): Promise<Response>;
+};
+export type ModelKeyEgress = ReturnType<typeof createModelKeyEgress>;