@fungi.computer/veil 0.0.0-stage → 0.1.0

package/dist/model-key-grants.js

@@ -0,0 +1,107 @@
+import * as Schema from "effect/Schema";
+import { VeilError } from "./index.js";
+import { assertPublicResolution, createDnsOverHttpsResolver, } from "./model-key-network.js";
+import { modelKeyProviders, } from "./model-keys.js";
+const grantClaimsSchema = Schema.Struct({
+    v: Schema.Literal(1),
+    teamId: Schema.NonEmptyString,
+    keyId: Schema.NonEmptyString,
+    locator: Schema.NonEmptyString,
+    provider: Schema.Literals(modelKeyProviders),
+    baseUrl: Schema.NonEmptyString,
+    /** The personal key's owner, re-checked for membership at each egress. */
+    ownerUserId: Schema.NullOr(Schema.NonEmptyString),
+    expiresAt: Schema.Number,
+});
+const PREFIX = "mkg1";
+const encoder = new TextEncoder();
+const base64Url = (bytes) => btoa(String.fromCharCode(...bytes))
+    .replaceAll("+", "-")
+    .replaceAll("/", "_")
+    .replace(/=+$/u, "");
+const fromBase64Url = (text) => {
+    const binary = atob(text.replaceAll("-", "+").replaceAll("_", "/"));
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+};
+/** Grants are bound to exactly one Team and runner as authenticated data. */
+const binding = (teamId, subject) => encoder.encode(`${PREFIX}\n${teamId}\n${subject.kind}\n${subject.id}`);
+/** Issue and open grants under a key only the custodian's credential derives. */
+export function createModelKeyGrants(options) {
+    if (options.custodySecret.length === 0)
+        throw new VeilError("unavailable");
+    const now = options.now ?? Date.now;
+    const key = (async () => {
+        const material = await crypto.subtle.importKey("raw", encoder.encode(options.custodySecret), "HKDF", false, ["deriveKey"]);
+        return crypto.subtle.deriveKey({
+            name: "HKDF",
+            hash: "SHA-256",
+            salt: encoder.encode("fungi.veil.model-key-grant"),
+            info: encoder.encode(PREFIX),
+        }, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+    })();
+    return {
+        async issue(subject, claims) {
+            const iv = crypto.getRandomValues(new Uint8Array(12));
+            const sealed = await crypto.subtle.encrypt({
+                name: "AES-GCM",
+                iv,
+                additionalData: binding(claims.teamId, subject),
+            }, await key, encoder.encode(JSON.stringify({ v: 1, ...claims })));
+            return `${PREFIX}.${base64Url(iv)}.${base64Url(new Uint8Array(sealed))}`;
+        },
+        /** The custodian's check: authentic, for this Team and runner, unexpired. */
+        async open(grant, expected) {
+            const [prefix, iv, sealed, extra] = grant.split(".");
+            if (prefix !== PREFIX ||
+                iv === undefined ||
+                sealed === undefined ||
+                extra !== undefined)
+                throw new VeilError("denied");
+            let claims;
+            try {
+                const opened = await crypto.subtle.decrypt({
+                    name: "AES-GCM",
+                    iv: fromBase64Url(iv),
+                    additionalData: binding(expected.teamId, expected.subject),
+                }, await key, fromBase64Url(sealed));
+                claims = Schema.decodeUnknownSync(Schema.fromJsonString(grantClaimsSchema))(new TextDecoder().decode(opened));
+            }
+            catch {
+                throw new VeilError("denied");
+            }
+            if (claims.teamId !== expected.teamId)
+                throw new VeilError("denied");
+            if (claims.expiresAt <= now())
+                throw new VeilError("expired");
+            return claims;
+        },
+    };
+}
+/**
+ * Final model egress for a runner holding a grant. The custodian opens the
+ * grant, re-checks the personal key owner's membership and a Team-named base
+ * URL's public resolution, then attaches the sealed key upstream.
+ */
+export function createModelKeyEgress(options) {
+    const resolveHost = options.resolveHost ?? createDnsOverHttpsResolver();
+    return {
+        async send(grant, expected, request) {
+            const claims = await options.grants.open(grant, expected);
+            if (claims.provider !== expected.provider)
+                throw new VeilError("denied");
+            // A departed member's key never pays, even before removal cleanup lands.
+            if (claims.ownerUserId !== null) {
+                const member = await options.ownerIsMember(claims.teamId, claims.ownerUserId);
+                if (member !== "allowed")
+                    throw new VeilError(member === "denied" ? "denied" : "unavailable");
+            }
+            if (claims.provider === "openai-compatible")
+                await assertPublicResolution(new URL(claims.baseUrl).hostname, resolveHost, request.signal);
+            return await options.custodian().send({
+                locator: claims.locator,
+                provider: claims.provider,
+                baseUrl: claims.baseUrl,
+            }, request);
+        },
+    };
+}

package/dist/model-key-network.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Where a Team-supplied OpenAI-compatible base URL may point. Fungi's
+ * custodian fetches it from inside Fungi's own network, so every name must
+ * resolve only to public unicast addresses, checked at intake and again
+ * before each egress (SSRF defence; see
+ * wiki/3-resources/decisions/adr-byok-model-keys-v1.md).
+ */
+/** Resolves a hostname to its A and AAAA addresses. */
+export type HostResolver = (hostname: string, signal: AbortSignal) => Promise<readonly string[]>;
+/** Whether an address literal is public unicast. Non-literals return null. */
+export declare function publicAddress(address: string): boolean | null;
+/** Static checks on a base URL's host, before any resolution. */
+export declare function assertPublicHostName(hostname: string): void;
+/**
+ * The one canonical text for a literal address, or null for a name. A caller
+ * that connects to a literal passes this form so the socket layer reads exactly
+ * the address that was classified.
+ */
+export declare function canonicalAddress(address: string): string | null;
+/**
+ * Resolve once and return the checked addresses in canonical form. Every answer
+ * must be public: one inward answer refuses the name, and no answer is
+ * unavailable. A literal address is its own single answer.
+ */
+export declare function resolvePublicAddresses(hostname: string, resolve: HostResolver, signal: AbortSignal): Promise<readonly string[]>;
+/** Every address the name resolves to must be public; no answer is unavailable. */
+export declare function assertPublicResolution(hostname: string, resolve: HostResolver, signal: AbortSignal): Promise<void>;
+/**
+ * Resolve through DNS-over-HTTPS JSON (Cloudflare's public resolver), which a
+ * Worker can reach where it has no socket DNS. CNAME chains are followed by the
+ * resolver; only A (1) and AAAA (28) data are returned.
+ */
+export declare function createDnsOverHttpsResolver(fetcher?: typeof fetch, endpoint?: string): HostResolver;

package/dist/model-key-network.js

@@ -0,0 +1,202 @@
+import * as Schema from "effect/Schema";
+import { VeilError } from "./index.js";
+const deniedSuffixes = [
+    ".localhost",
+    ".local",
+    ".internal",
+    ".lan",
+    ".home.arpa",
+    ".intranet",
+    ".corp",
+];
+function ipv4Octets(value) {
+    const parts = value.split(".");
+    if (parts.length !== 4)
+        return null;
+    const octets = parts.map((part) => /^(0|[1-9][0-9]{0,2})$/u.test(part) ? Number(part) : Number.NaN);
+    return octets.every((octet) => octet >= 0 && octet <= 255) ? octets : null;
+}
+function publicIpv4([a = 0, b = 0, c = 0]) {
+    return !(a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        a >= 224 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 0 && (c === 0 || c === 2)) ||
+        (a === 192 && b === 88 && c === 99) ||
+        (a === 192 && b === 168) ||
+        (a === 198 && (b === 18 || b === 19)) ||
+        (a === 198 && b === 51 && c === 100) ||
+        (a === 203 && b === 0 && c === 113));
+}
+/** Expand an IPv6 literal to eight 16-bit groups, or null if it is not one. */
+function ipv6Groups(value) {
+    let text = value.toLowerCase();
+    if (!/^[0-9a-f:.]+$/u.test(text) || !text.includes(":"))
+        return null;
+    const lastColon = text.lastIndexOf(":");
+    const suffix = text.slice(lastColon + 1);
+    if (suffix.includes(".")) {
+        // Rewrite a trailing dotted IPv4 as its two hex groups.
+        const octets = ipv4Octets(suffix);
+        if (octets === null)
+            return null;
+        const [a = 0, b = 0, c = 0, d = 0] = octets;
+        text = `${text.slice(0, lastColon + 1)}${(a * 256 + b).toString(16)}:${(c * 256 + d).toString(16)}`;
+    }
+    const halves = text.split("::");
+    if (halves.length > 2)
+        return null;
+    const read = (part) => part === undefined || part === "" ? [] : part.split(":");
+    const head = read(halves[0]);
+    const rest = read(halves[1]);
+    const groups = [...head, ...rest].map((group) => /^[0-9a-f]{1,4}$/u.test(group) ? Number.parseInt(group, 16) : Number.NaN);
+    if (groups.some(Number.isNaN))
+        return null;
+    if (halves.length === 1)
+        return groups.length === 8 ? groups : null;
+    if (groups.length >= 8)
+        return null;
+    return [
+        ...groups.slice(0, head.length),
+        ...Array.from({ length: 8 - groups.length }, () => 0),
+        ...groups.slice(head.length),
+    ];
+}
+function publicIpv6(groups) {
+    const [g0 = 0, g1 = 0, g2 = 0, g3 = 0, g4 = 0, g5 = 0, g6 = 0, g7 = 0] = groups;
+    const embedded = [g6 >> 8, g6 & 255, g7 >> 8, g7 & 255];
+    // ::/96 holds the unspecified address, loopback and deprecated IPv4-compatible
+    // addresses; none is public unicast.
+    if (groups.slice(0, 6).every((group) => group === 0))
+        return false;
+    // IPv4-mapped ::ffff:a.b.c.d and NAT64 64:ff9b::a.b.c.d carry an IPv4 target.
+    if (groups.slice(0, 5).every((group) => group === 0) && g5 === 0xffff)
+        return publicIpv4(embedded);
+    if (g0 === 0x64 &&
+        g1 === 0xff9b &&
+        g2 === 0 &&
+        g3 === 0 &&
+        g4 === 0 &&
+        g5 === 0)
+        return publicIpv4(embedded);
+    // 6to4 2002:AABB:CCDD:: embeds an IPv4 target in its second and third groups.
+    if (g0 === 0x2002)
+        return publicIpv4([g1 >> 8, g1 & 255, g2 >> 8, g2 & 255]);
+    return !(
+    // Local-use NAT64 64:ff9b:1::/48 and Teredo 2001::/32 hide an IPv4 target.
+    (g0 === 0x64 && g1 === 0xff9b) ||
+        (g0 === 0x2001 && g1 === 0) ||
+        (g0 & 0xfe00) === 0xfc00 ||
+        (g0 & 0xffc0) === 0xfe80 ||
+        (g0 & 0xffc0) === 0xfec0 ||
+        (g0 === 0 &&
+            g1 === 0 &&
+            g2 === 0 &&
+            g3 === 0 &&
+            g4 === 0xffff &&
+            g5 === 0) ||
+        (g0 === 0x2001 && g1 === 2 && g2 === 0) ||
+        (g0 === 0x2001 && (g1 & 0xfff0) === 0x10) ||
+        (g0 & 0xff00) === 0xff00 ||
+        (g0 === 0x2001 && g1 === 0x0db8) ||
+        (g0 === 0x0100 && groups.slice(1, 4).every((group) => group === 0)));
+}
+/** Whether an address literal is public unicast. Non-literals return null. */
+export function publicAddress(address) {
+    const bare = address.replace(/^\[|\]$/gu, "");
+    const v4 = ipv4Octets(bare);
+    if (v4 !== null)
+        return publicIpv4(v4);
+    const v6 = ipv6Groups(bare);
+    return v6 === null ? null : publicIpv6(v6);
+}
+/** Static checks on a base URL's host, before any resolution. */
+export function assertPublicHostName(hostname) {
+    const host = hostname.toLowerCase().replace(/\.$/u, "");
+    const literal = publicAddress(host);
+    if (literal !== null) {
+        if (!literal)
+            throw new VeilError("denied");
+        return;
+    }
+    if (host === "localhost" ||
+        !host.includes(".") ||
+        deniedSuffixes.some((suffix) => host.endsWith(suffix)))
+        throw new VeilError("denied");
+}
+/**
+ * The one canonical text for a literal address, or null for a name. A caller
+ * that connects to a literal passes this form so the socket layer reads exactly
+ * the address that was classified.
+ */
+export function canonicalAddress(address) {
+    const bare = address.replace(/^\[|\]$/gu, "");
+    const v4 = ipv4Octets(bare);
+    if (v4 !== null)
+        return v4.join(".");
+    const v6 = ipv6Groups(bare);
+    return v6 === null ? null : v6.map((group) => group.toString(16)).join(":");
+}
+/**
+ * Resolve once and return the checked addresses in canonical form. Every answer
+ * must be public: one inward answer refuses the name, and no answer is
+ * unavailable. A literal address is its own single answer.
+ */
+export async function resolvePublicAddresses(hostname, resolve, signal) {
+    assertPublicHostName(hostname);
+    const literal = canonicalAddress(hostname.replace(/\.$/u, ""));
+    if (literal !== null)
+        return [literal];
+    let answers;
+    try {
+        answers = await resolve(hostname, signal);
+    }
+    catch {
+        throw new VeilError(signal.aborted ? "cancelled" : "unavailable");
+    }
+    if (answers.length === 0)
+        throw new VeilError("unavailable");
+    const addresses = new Set();
+    for (const answer of answers) {
+        const canonical = canonicalAddress(answer);
+        if (canonical === null || publicAddress(canonical) !== true)
+            throw new VeilError("denied");
+        addresses.add(canonical);
+    }
+    return [...addresses];
+}
+/** Every address the name resolves to must be public; no answer is unavailable. */
+export async function assertPublicResolution(hostname, resolve, signal) {
+    await resolvePublicAddresses(hostname, resolve, signal);
+}
+const dohAnswerSchema = Schema.Struct({
+    Answer: Schema.optional(Schema.Array(Schema.Struct({ type: Schema.Number, data: Schema.String }))),
+});
+/**
+ * Resolve through DNS-over-HTTPS JSON (Cloudflare's public resolver), which a
+ * Worker can reach where it has no socket DNS. CNAME chains are followed by the
+ * resolver; only A (1) and AAAA (28) data are returned.
+ */
+export function createDnsOverHttpsResolver(fetcher = fetch, endpoint = "https://cloudflare-dns.com/dns-query") {
+    return async (hostname, signal) => {
+        const answers = await Promise.all(["A", "AAAA"].map(async (type) => {
+            const url = new URL(endpoint);
+            url.searchParams.set("name", hostname);
+            url.searchParams.set("type", type);
+            const response = await fetcher(url, {
+                headers: { accept: "application/dns-json" },
+                signal,
+                // Workers reject `redirect: "error"`; a 3xx is simply not `ok`.
+                redirect: "manual",
+            });
+            if (!response.ok)
+                throw new VeilError("unavailable");
+            const decoded = Schema.decodeUnknownSync(Schema.fromJsonString(dohAnswerSchema))(await response.text());
+            return (decoded.Answer ?? []).flatMap((entry) => entry.type === 1 || entry.type === 28 ? [entry.data] : []);
+        }));
+        return answers.flat();
+    };
+}

package/dist/model-keys.d.ts

@@ -0,0 +1,42 @@
+/** Providers a Team may bring its own API key for on hosted Fungi. */
+export declare const modelKeyProviders: readonly ["anthropic", "openai", "openrouter", "openai-compatible"];
+export type ModelKeyProvider = (typeof modelKeyProviders)[number];
+export declare function isModelKeyProvider(value: string): value is ModelKeyProvider;
+/**
+ * Canonical base URL for a sealed key. Only an OpenAI-compatible key names its
+ * own base: HTTPS without credentials, query or fragment, on a public host.
+ * Plain HTTP to a loopback host is accepted only with `allowLocalDev`.
+ * Resolution is checked separately with `assertPublicResolution`.
+ */
+export declare function modelKeyBaseUrl(provider: ModelKeyProvider, configured?: string | null, options?: Readonly<{
+    allowLocalDev?: boolean;
+}>): string;
+/** Private to the Team owner and the custodian adapter; never a public field. */
+export type ModelKeyAccess = Readonly<{
+    locator: string;
+    provider: ModelKeyProvider;
+    baseUrl: string;
+}>;
+/**
+ * Write-only custody for Team model API keys. The key enters once through
+ * `seal`; nothing returns it. `send` attaches it at final egress.
+ */
+export type ModelKeyCustodian = Readonly<{
+    seal: (input: Readonly<{
+        teamId: string;
+        /** Private custody id chosen by the owner, distinct from the public key id. */
+        locator: string;
+        provider: ModelKeyProvider;
+        apiKey: string;
+    }>, signal: AbortSignal) => Promise<void>;
+    send: (access: ModelKeyAccess, request: Request) => Promise<Response>;
+    remove: (access: Pick<ModelKeyAccess, "locator" | "provider">, signal: AbortSignal) => Promise<"deleted" | "absent">;
+}>;
+/** The exact supplier target, confined below the sealed key's base URL. */
+export declare function modelKeyTarget(access: ModelKeyAccess, request: Request): URL;
+/** Copy only supplier-meaningful headers; the caller's auth is dropped. */
+export declare function modelKeyForwardedHeaders(request: Request): Headers;
+/** A cheap authenticated read that proves a key works without spending tokens. */
+export declare function modelKeyValidationRequest(access: Pick<ModelKeyAccess, "provider" | "baseUrl">, signal: AbortSignal): Request;
+/** Read a validation response: only an auth refusal says the key itself is bad. */
+export declare function modelKeyValidationResult(status: number): "valid" | "rejected" | "unavailable";

package/dist/model-keys.js

@@ -0,0 +1,115 @@
+import { VeilError } from "./index.js";
+import { assertPublicHostName, publicAddress } from "./model-key-network.js";
+/** Providers a Team may bring its own API key for on hosted Fungi. */
+export const modelKeyProviders = [
+    "anthropic",
+    "openai",
+    "openrouter",
+    "openai-compatible",
+];
+export function isModelKeyProvider(value) {
+    return modelKeyProviders.some((provider) => provider === value);
+}
+/** The supplier base each provider's Pi client targets. */
+const providerBaseUrls = {
+    anthropic: "https://api.anthropic.com",
+    openai: "https://api.openai.com/v1",
+    openrouter: "https://openrouter.ai/api/v1",
+};
+/**
+ * Canonical base URL for a sealed key. Only an OpenAI-compatible key names its
+ * own base: HTTPS without credentials, query or fragment, on a public host.
+ * Plain HTTP to a loopback host is accepted only with `allowLocalDev`.
+ * Resolution is checked separately with `assertPublicResolution`.
+ */
+export function modelKeyBaseUrl(provider, configured, options = {}) {
+    if (provider !== "openai-compatible") {
+        if (configured !== undefined && configured !== null)
+            throw new VeilError("invalid_input");
+        return providerBaseUrls[provider];
+    }
+    let url;
+    try {
+        url = new URL(configured ?? "");
+    }
+    catch {
+        throw new VeilError("invalid_input");
+    }
+    if (url.username || url.password || url.search || url.hash)
+        throw new VeilError("invalid_input");
+    const loopback = url.hostname === "localhost" ||
+        (publicAddress(url.hostname) === false &&
+            /^(127\.|\[::1\]$)/u.test(url.hostname));
+    if (options.allowLocalDev === true && loopback) {
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            throw new VeilError("invalid_input");
+        return url.href.replace(/\/+$/u, "");
+    }
+    if (url.protocol !== "https:")
+        throw new VeilError("invalid_input");
+    try {
+        assertPublicHostName(url.hostname);
+    }
+    catch {
+        throw new VeilError("invalid_input");
+    }
+    return url.href.replace(/\/+$/u, "");
+}
+/** Request headers a supplier call may carry; credentials are never among them. */
+const forwardedHeaders = [
+    "accept",
+    "content-type",
+    "anthropic-version",
+    "anthropic-beta",
+    "openai-beta",
+];
+/** The exact supplier target, confined below the sealed key's base URL. */
+export function modelKeyTarget(access, request) {
+    const base = new URL(`${access.baseUrl}/`);
+    let target;
+    try {
+        target = new URL(request.url);
+    }
+    catch {
+        throw new VeilError("denied");
+    }
+    if (target.origin !== base.origin ||
+        !`${target.pathname}/`.startsWith(base.pathname) ||
+        target.username ||
+        target.password ||
+        target.hash ||
+        target.pathname.split("/").some((part) => part === "." || part === ".."))
+        throw new VeilError("denied");
+    if (!["GET", "POST"].includes(request.method))
+        throw new VeilError("denied");
+    return target;
+}
+/** Copy only supplier-meaningful headers; the caller's auth is dropped. */
+export function modelKeyForwardedHeaders(request) {
+    const headers = new Headers();
+    for (const name of forwardedHeaders) {
+        const value = request.headers.get(name);
+        if (value !== null)
+            headers.set(name, value);
+    }
+    return headers;
+}
+/** A cheap authenticated read that proves a key works without spending tokens. */
+export function modelKeyValidationRequest(access, signal) {
+    const path = access.provider === "openrouter" ? "/key" : "/models";
+    const url = access.provider === "anthropic"
+        ? `${access.baseUrl}/v1/models?limit=1`
+        : `${access.baseUrl}${path}`;
+    const headers = new Headers({ accept: "application/json" });
+    if (access.provider === "anthropic")
+        headers.set("anthropic-version", "2023-06-01");
+    return new Request(url, { method: "GET", headers, signal });
+}
+/** Read a validation response: only an auth refusal says the key itself is bad. */
+export function modelKeyValidationResult(status) {
+    if (status >= 200 && status < 300)
+        return "valid";
+    if (status === 401 || status === 403)
+        return "rejected";
+    return "unavailable";
+}

package/dist/nango-custody-http.d.ts

@@ -0,0 +1,16 @@
+/** Shared Nango API-key transport policy for private credential custodians. */
+export declare function createNangoCustodyHttp(options: Readonly<{
+    serverUrl: string;
+    apiKey: string;
+}>): {
+    importCredential(input: Readonly<{
+        integrationId: string;
+        locator: string;
+        teamId: string;
+        credential: string;
+    }>, signal: AbortSignal): Promise<void>;
+    removeConnection(locator: string, integrationId: string, signal: AbortSignal): Promise<"deleted" | "absent">;
+    call: (path: string, signal: AbortSignal, init: RequestInit & {
+        headers?: Headers;
+    }) => Promise<Response>;
+};

package/dist/nango-custody-http.js

@@ -0,0 +1,93 @@
+import * as Schema from "effect/Schema";
+import { VeilError } from "./index.js";
+const importedSchema = Schema.Struct({ connection_id: Schema.NonEmptyString });
+const deletedSchema = Schema.Struct({ success: Schema.Literal(true) });
+const absentSchema = Schema.Struct({
+    error: Schema.Struct({ code: Schema.Literal("unknown_connection") }),
+});
+/** Shared Nango API-key transport policy for private credential custodians. */
+export function createNangoCustodyHttp(options) {
+    let server;
+    try {
+        server = new URL(options.serverUrl);
+    }
+    catch {
+        throw new VeilError("invalid_input");
+    }
+    if (!options.apiKey ||
+        server.username ||
+        server.password ||
+        server.search ||
+        server.hash ||
+        server.pathname !== "/" ||
+        !(server.protocol === "https:" ||
+            (server.protocol === "http:" &&
+                ["localhost", "127.0.0.1", "[::1]"].includes(server.hostname))))
+        throw new VeilError("invalid_input");
+    const call = async (path, signal, init) => {
+        const headers = init.headers ?? new Headers();
+        headers.set("Authorization", `Bearer ${options.apiKey}`);
+        try {
+            signal.throwIfAborted();
+            return await fetch(new URL(path, server), {
+                ...init,
+                headers,
+                signal,
+                redirect: "manual",
+            });
+        }
+        catch {
+            throw new VeilError(signal.aborted ? "cancelled" : "unavailable");
+        }
+    };
+    const text = async (response, signal) => {
+        try {
+            return await response.text();
+        }
+        catch {
+            throw new VeilError(signal.aborted ? "cancelled" : "unavailable");
+        }
+    };
+    const decode = (schema, raw) => {
+        try {
+            return Schema.decodeUnknownSync(Schema.fromJsonString(schema))(raw);
+        }
+        catch {
+            throw new VeilError("invalid_response");
+        }
+    };
+    return {
+        async importCredential(input, signal) {
+            const response = await call("/connections", signal, {
+                method: "POST",
+                headers: new Headers({ "Content-Type": "application/json" }),
+                body: JSON.stringify({
+                    provider_config_key: input.integrationId,
+                    connection_id: input.locator,
+                    credentials: { type: "API_KEY", apiKey: input.credential },
+                    tags: { veil_team_id: input.teamId },
+                }),
+            });
+            const raw = await text(response, signal);
+            if (!response.ok)
+                throw new VeilError("unavailable");
+            const imported = decode(importedSchema, raw);
+            if (imported.connection_id !== input.locator)
+                throw new VeilError("invalid_response");
+        },
+        async removeConnection(locator, integrationId, signal) {
+            const query = new URLSearchParams({ provider_config_key: integrationId });
+            const response = await call(`/connections/${encodeURIComponent(locator)}?${query.toString()}`, signal, { method: "DELETE" });
+            const raw = await text(response, signal);
+            if (response.status === 400) {
+                decode(absentSchema, raw);
+                return "absent";
+            }
+            if (!response.ok)
+                throw new VeilError("unavailable");
+            decode(deletedSchema, raw);
+            return "deleted";
+        },
+        call,
+    };
+}

package/dist/nango-git.d.ts

@@ -0,0 +1,19 @@
+/** Private Team-owned Computer authorization, never an Agent metadata Grant. */
+export type GitRepositoryAccess = Readonly<{
+    repository: Readonly<{
+        owner: string;
+        name: string;
+    }>;
+    locator: string;
+    integrationId: string;
+}>;
+/** The caller must obtain fresh Computer/repository authorization before each
+ * invocation. This adapter owns Nango control headers, not authorization state. */
+export declare function createNangoGitCustodian(options: Readonly<{
+    serverUrl: string;
+    apiKey: string;
+    integrationId: string;
+}>): {
+    /** Fetch, clone and push for one authorized repository. */
+    readGit(access: GitRepositoryAccess, request: Request): Promise<Response>;
+};