@fungi.computer/veil 0.0.0-stage → 0.1.0

package/dist/openapi-effect.js

@@ -0,0 +1,284 @@
+import { Buffer } from "node:buffer";
+import { createPublicEgressPolicy } from "./public-egress-policy.js";
+import * as Effect from "effect/Effect";
+import { VeilError } from "./index.js";
+import { OpenApiError, } from "./openapi-contract.js";
+import { createOpenApiSecrets } from "./openapi-secrets.js";
+import { createPublicHttp } from "./public-fetch.js";
+import { assertPublicHostName } from "./model-key-network.js";
+import { readOpenApiBody } from "./openapi-http.js";
+const credentialEncodings = (credential) => [
+    ...new Set([
+        credential,
+        `Bearer ${credential}`,
+        JSON.stringify(credential).slice(1, -1),
+        encodeURIComponent(credential),
+        encodeURIComponent(credential).replace(/%[0-9A-F]{2}/gu, (part) => part.toLowerCase()),
+        Buffer.from(credential).toString("base64"),
+        Buffer.from(credential).toString("base64url"),
+    ]),
+];
+const encoder = new TextEncoder();
+const bodyLimit = 256 * 1024;
+const methods = new Set([
+    "GET",
+    "HEAD",
+    "OPTIONS",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+]);
+const forbiddenHeader = (name) => [
+    "authorization",
+    "cookie",
+    "host",
+    "content-length",
+    "connection",
+    "transfer-encoding",
+    "accept-encoding",
+    "set-cookie",
+    "upgrade",
+    "te",
+    "trailer",
+    "keep-alive",
+    "expect",
+    "via",
+    "forwarded",
+    "x-real-ip",
+    "max-forwards",
+    "x-http-method-override",
+    "x-method-override",
+    "x-http-method",
+].includes(name.toLowerCase()) ||
+    /^(proxy-|x-forwarded-|nango-|cf-)/iu.test(name);
+function sanitize(cause) {
+    if (cause instanceof OpenApiError)
+        return cause;
+    if (cause instanceof VeilError) {
+        switch (cause.code) {
+            case "denied":
+            case "invalid_input":
+            case "invalid_response":
+            case "cancelled":
+                return new OpenApiError(cause.code);
+        }
+    }
+    return new OpenApiError("unavailable");
+}
+const io = (operation) => Effect.tryPromise({ try: operation, catch: sanitize });
+const policy = (operation) => Effect.try({ try: operation, catch: sanitize });
+const bounded = (operation) => operation.pipe(Effect.timeoutOrElse({
+    duration: "30 seconds",
+    orElse: () => Effect.fail(new OpenApiError("timeout")),
+}));
+/** Public HTTPS only. The Team supplies the pinned base, not the spec at call time. */
+function base(access) {
+    let url;
+    try {
+        url = new URL(access.baseUrl);
+    }
+    catch {
+        throw new OpenApiError("invalid_input");
+    }
+    if (!access.teamId ||
+        !access.connectorId ||
+        url.protocol !== "https:" ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash)
+        throw new OpenApiError("invalid_input");
+    try {
+        assertPublicHostName(url.hostname);
+    }
+    catch {
+        throw new OpenApiError("denied");
+    }
+    return url;
+}
+function target(access, request, declaredHeaders) {
+    const pinned = base(access);
+    const url = new URL(request.url);
+    const root = pinned.pathname.replace(/\/+$/u, "");
+    if (url.origin !== pinned.origin ||
+        url.username ||
+        url.password ||
+        url.hash ||
+        !(url.pathname === root || url.pathname.startsWith(`${root}/`)) ||
+        !methods.has(request.method))
+        throw new OpenApiError("denied");
+    // URL normalizes literal dot segments. Encoded separators/dots must not reach an upstream decoder.
+    if (/%(?:2e|2f|5c|25)/iu.test(url.pathname))
+        throw new OpenApiError("denied");
+    const allowed = new Set([
+        "accept",
+        "content-type",
+        ...declaredHeaders.map((name) => name.toLowerCase()),
+    ]);
+    for (const [name] of request.headers) {
+        if (!allowed.has(name) ||
+            forbiddenHeader(name) ||
+            (access.auth.kind === "api_key_header" &&
+                name.toLowerCase() === access.auth.param.toLowerCase()))
+            throw new OpenApiError("denied");
+    }
+    if (access.auth.kind === "api_key_query" &&
+        url.searchParams.has(access.auth.param))
+        throw new OpenApiError("denied");
+    return url;
+}
+function credentialPolicy(access, credential) {
+    base(access);
+    if (access.auth.kind === "oauth") {
+        if (credential !== undefined)
+            throw new OpenApiError("invalid_input");
+        return;
+    }
+    if (access.auth.kind === "none") {
+        if (credential !== undefined)
+            throw new OpenApiError("invalid_input");
+        return;
+    }
+    if (access.auth.kind === "api_key_header" ||
+        access.auth.kind === "api_key_query") {
+        if (!/^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,128}$/u.test(access.auth.param))
+            throw new OpenApiError("invalid_input");
+        if (access.auth.kind === "api_key_header" &&
+            forbiddenHeader(access.auth.param))
+            throw new OpenApiError("invalid_input");
+    }
+    if (credential !== undefined) {
+        if (credential.length === 0 ||
+            encoder.encode(credential).byteLength > 16 * 1024 ||
+            /[\r\n\0]/u.test(credential))
+            throw new OpenApiError("invalid_input");
+        if (access.auth.kind !== "api_key_query") {
+            try {
+                new Headers({ authorization: credential });
+            }
+            catch {
+                throw new OpenApiError("invalid_input");
+            }
+        }
+    }
+}
+export function createOpenApiEffects(options) {
+    const http = createPublicHttp(options);
+    const networkPolicy = createPublicEgressPolicy(options.networkPolicy);
+    const secrets = options.custody === undefined
+        ? undefined
+        : createOpenApiSecrets(options.custody.keys);
+    const store = options.custody?.store;
+    return {
+        seal: (access, credential) => bounded(Effect.gen(function* () {
+            yield* policy(() => {
+                credentialPolicy(access, credential);
+                networkPolicy.destination(base(access));
+            });
+            if (!secrets || !store)
+                return yield* Effect.fail(new OpenApiError("unavailable"));
+            const sealed = yield* io(() => secrets.seal(access, credential));
+            yield* io((signal) => store.write(access, sealed, signal));
+        })),
+        remove: (address) => bounded(io((signal) => {
+            if (!store)
+                throw new OpenApiError("unavailable");
+            return store.remove(address, signal);
+        })),
+        send: (access, request, declaredHeaders = []) => bounded(Effect.gen(function* () {
+            const url = yield* policy(() => target(access, request, declaredHeaders));
+            yield* policy(() => {
+                credentialPolicy(access);
+                networkPolicy.destination(url);
+            });
+            const oauth = access.auth.kind === "oauth" &&
+                options.oauthProviders !== undefined &&
+                Object.hasOwn(options.oauthProviders, access.auth.provider)
+                ? options.oauthProviders[access.auth.provider]
+                : undefined;
+            if (access.auth.kind === "oauth") {
+                if (!oauth)
+                    return yield* Effect.fail(new OpenApiError("oauth_not_configured"));
+                // Known provider host/path only. A spec cannot redirect OAuth custody to its server.
+                if (oauth.baseUrl !== access.baseUrl || !access.auth.locator)
+                    return yield* Effect.fail(new OpenApiError("denied"));
+            }
+            const body = yield* io((signal) => readOpenApiBody(request.body, bodyLimit, signal));
+            let credential;
+            if (access.auth.kind !== "none" && access.auth.kind !== "oauth") {
+                if (!secrets || !store)
+                    return yield* Effect.fail(new OpenApiError("unavailable"));
+                const sealed = yield* io((signal) => store.read(access, signal));
+                if (sealed === null)
+                    return yield* Effect.fail(new OpenApiError("credentials_missing"));
+                credential = yield* io(() => secrets.open(access, sealed));
+            }
+            return yield* io(async (signal) => {
+                const headers = new Headers(request.headers);
+                if (credential !== undefined) {
+                    switch (access.auth.kind) {
+                        case "bearer":
+                            headers.set("authorization", `Bearer ${credential}`);
+                            break;
+                        case "api_key_header":
+                            headers.set(access.auth.param, credential);
+                            break;
+                        case "api_key_query":
+                            url.searchParams.set(access.auth.param, credential);
+                            break;
+                    }
+                }
+                let response;
+                if (access.auth.kind === "oauth" && oauth) {
+                    const init = {
+                        method: request.method,
+                        headers,
+                        signal,
+                        redirect: "manual",
+                    };
+                    if (!["GET", "HEAD"].includes(request.method))
+                        init.body = body;
+                    response = await oauth.send(access.teamId, access.auth.locator, new Request(url, init));
+                }
+                else {
+                    response = await http.send({
+                        url,
+                        method: request.method,
+                        headers,
+                        body,
+                        signal,
+                    });
+                }
+                const bytes = await readOpenApiBody(response.body, bodyLimit, signal);
+                // An untrusted server must not turn any common credential encoding into a model result.
+                const safeBody = credential === undefined
+                    ? bytes
+                    : encoder.encode(credentialEncodings(credential)
+                        .sort((a, b) => b.length - a.length)
+                        .reduce((body, value) => body.replaceAll(value, "[REDACTED]"), new TextDecoder().decode(bytes)));
+                if (safeBody.byteLength > bodyLimit)
+                    throw new OpenApiError("too_large");
+                if (!response.ok)
+                    throw new OpenApiError("upstream_status", response.status);
+                const contentType = (response.headers.get("content-type") ?? "")
+                    .split(";")[0]
+                    ?.trim()
+                    .toLowerCase() ?? "";
+                if (credential !== undefined &&
+                    credentialEncodings(credential).some((value) => contentType.includes(value.toLowerCase())))
+                    throw new OpenApiError("invalid_response");
+                if (bytes.byteLength > 0 &&
+                    !/^(application\/(?:[a-z0-9.+-]+\+)?json|text\/[a-z0-9.+-]+)(?:\s*;|$)/iu.test(contentType))
+                    throw new OpenApiError("invalid_response");
+                return new Response([204, 205, 304].includes(response.status) ||
+                    request.method === "HEAD"
+                    ? null
+                    : safeBody, {
+                    status: response.status,
+                    headers: contentType === "" ? {} : { "content-type": contentType },
+                });
+            });
+        })),
+    };
+}

package/dist/openapi-http.d.ts

@@ -0,0 +1,2 @@
+/** Read the wire once under a byte cap, including chunked bodies without Content-Length. */
+export declare function readOpenApiBody(body: ReadableStream<Uint8Array> | null, limit: number, signal: AbortSignal): Promise<Uint8Array>;

package/dist/openapi-http.js

@@ -0,0 +1,37 @@
+import { OpenApiError } from "./openapi-contract.js";
+/** Read the wire once under a byte cap, including chunked bodies without Content-Length. */
+export async function readOpenApiBody(body, limit, signal) {
+    if (body === null)
+        return new Uint8Array();
+    const reader = body.getReader();
+    const cancel = () => {
+        void reader.cancel();
+    };
+    signal.addEventListener("abort", cancel, { once: true });
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            signal.throwIfAborted();
+            const next = await reader.read();
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > limit)
+                throw new OpenApiError("too_large");
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        signal.removeEventListener("abort", cancel);
+        await reader.cancel();
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}

package/dist/openapi-secrets.d.ts

@@ -0,0 +1,6 @@
+import { type OpenApiCredentialKeyring, type OpenApiAccess } from "./openapi-contract.js";
+/** WebCrypto owns authenticated encryption; the owner address and policy are its AAD. */
+export declare function createOpenApiSecrets(configuration: OpenApiCredentialKeyring): {
+    seal(access: OpenApiAccess, credential: string): Promise<string>;
+    open(access: OpenApiAccess, sealed: string): Promise<string>;
+};

package/dist/openapi-secrets.js

@@ -0,0 +1,80 @@
+import { Buffer } from "node:buffer";
+import * as Schema from "effect/Schema";
+import { OpenApiError, } from "./openapi-contract.js";
+const keySchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/u)));
+const keyIdSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/u)));
+const envelopeSchema = Schema.Struct({
+    version: Schema.Literal(1),
+    keyId: keyIdSchema,
+    iv: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{16}$/u))),
+    ciphertext: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{22,22000}$/u))),
+});
+const encoder = new TextEncoder();
+const binding = (access, keyId) => encoder.encode(JSON.stringify([
+    "fungi.veil.openapi.v1",
+    keyId,
+    access.teamId,
+    access.connectorId,
+    access.baseUrl,
+    access.auth.kind,
+    access.auth.kind === "api_key_header" ||
+        access.auth.kind === "api_key_query"
+        ? access.auth.param
+        : null,
+]));
+/** WebCrypto owns authenticated encryption; the owner address and policy are its AAD. */
+export function createOpenApiSecrets(configuration) {
+    const keys = new Map();
+    let activeKeyId;
+    try {
+        activeKeyId = Schema.decodeUnknownSync(keyIdSchema)(configuration.activeKeyId);
+        for (const [id, encoded] of Object.entries(configuration.keys)) {
+            Schema.decodeUnknownSync(keyIdSchema)(id);
+            const parsed = Schema.decodeUnknownSync(keySchema)(encoded);
+            const bytes = Uint8Array.from(Buffer.from(parsed, "base64url"));
+            if (bytes.length !== 32)
+                throw new OpenApiError("unavailable");
+            keys.set(id, crypto.subtle.importKey("raw", bytes, "AES-GCM", false, [
+                "encrypt",
+                "decrypt",
+            ]));
+        }
+        if (!keys.has(activeKeyId))
+            throw new OpenApiError("unavailable");
+    }
+    catch {
+        throw new OpenApiError("unavailable");
+    }
+    const key = (id) => {
+        const found = keys.get(id);
+        if (!found)
+            throw new OpenApiError("denied");
+        return found;
+    };
+    return {
+        async seal(access, credential) {
+            const iv = crypto.getRandomValues(new Uint8Array(12));
+            const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: binding(access, activeKeyId) }, await key(activeKeyId), encoder.encode(credential));
+            return JSON.stringify({
+                version: 1,
+                keyId: activeKeyId,
+                iv: Buffer.from(iv).toString("base64url"),
+                ciphertext: Buffer.from(ciphertext).toString("base64url"),
+            });
+        },
+        async open(access, sealed) {
+            try {
+                const envelope = Schema.decodeUnknownSync(Schema.fromJsonString(envelopeSchema))(sealed);
+                const plaintext = await crypto.subtle.decrypt({
+                    name: "AES-GCM",
+                    iv: Uint8Array.from(Buffer.from(envelope.iv, "base64url")),
+                    additionalData: binding(access, envelope.keyId),
+                }, await key(envelope.keyId), Uint8Array.from(Buffer.from(envelope.ciphertext, "base64url")));
+                return new TextDecoder().decode(plaintext);
+            }
+            catch {
+                throw new OpenApiError("denied");
+            }
+        },
+    };
+}

package/dist/openapi.d.ts

@@ -0,0 +1,5 @@
+import { OpenApiError, type OpenApiDoor, type OpenApiDoorOptions } from "./openapi-contract.js";
+export { OpenApiError };
+export type { PublicEgressPolicy } from "./public-egress-policy.js";
+export type { OpenApiAccess, OpenApiAuth, OpenApiCredentialAddress, OpenApiCredentialKeyring, OpenApiCredentialStore, OpenApiDoor, OpenApiDoorOptions, OpenApiOAuthProvider, OpenApiRefusal, } from "./openapi-contract.js";
+export declare function createOpenApiDoor(options: OpenApiDoorOptions): OpenApiDoor;

package/dist/openapi.js

@@ -0,0 +1,24 @@
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Cause from "effect/Cause";
+import * as Option from "effect/Option";
+import { OpenApiError, } from "./openapi-contract.js";
+import { createOpenApiEffects } from "./openapi-effect.js";
+export { OpenApiError };
+/** The one Promise facade; cancellation interrupts the same Effect-owned operation. */
+function run(effect, signal) {
+    return Effect.runPromiseExit(effect, { signal }).then((exit) => {
+        if (Exit.isSuccess(exit))
+            return exit.value;
+        throw (Option.getOrUndefined(Cause.findErrorOption(exit.cause)) ??
+            new OpenApiError(Cause.hasInterrupts(exit.cause) ? "cancelled" : "unavailable"));
+    });
+}
+export function createOpenApiDoor(options) {
+    const effects = createOpenApiEffects(options);
+    return {
+        seal: (access, credential, signal) => run(effects.seal(access, credential), signal),
+        send: (access, request, declaredHeaders) => run(effects.send(access, request, declaredHeaders), request.signal),
+        remove: (address, signal) => run(effects.remove(address), signal),
+    };
+}

package/dist/owned-infrastructure.d.ts

@@ -0,0 +1,13 @@
+import { z } from "zod";
+/** Inventory structure only; Veil owns CIDR/domain matching and public-unicast admission. */
+declare const ownedInfrastructureSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    publicAddressAdmission: z.ZodLiteral<"@fungi.computer/veil/public-fetch">;
+    deniedCidrs: z.ZodArray<z.ZodString>;
+    deniedHostSuffixes: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** CTO-approved host inventory. Never populate it from a Connector or OpenAPI document. */
+export type OwnedInfrastructure = z.infer<typeof ownedInfrastructureSchema>;
+/** Decode an inventory at the file or binding boundary; missing/empty data refuses. */
+export declare function parseOwnedInfrastructure(input: unknown): OwnedInfrastructure;
+export {};

package/dist/owned-infrastructure.js

@@ -0,0 +1,17 @@
+import { validatePublicEgressPolicyEntries } from "./public-egress-policy.js";
+import { z } from "zod";
+/** Inventory structure only; Veil owns CIDR/domain matching and public-unicast admission. */
+const ownedInfrastructureSchema = z
+    .strictObject({
+    version: z.literal(1),
+    publicAddressAdmission: z.literal("@fungi.computer/veil/public-fetch"),
+    deniedCidrs: z.array(z.string().min(1).max(128)).min(1).max(256),
+    deniedHostSuffixes: z.array(z.string().min(1).max(253)).min(1).max(256),
+})
+    .refine(validatePublicEgressPolicyEntries, {
+    message: "Owned infrastructure entries must be canonical, distinct CIDRs and domain suffixes",
+});
+/** Decode an inventory at the file or binding boundary; missing/empty data refuses. */
+export function parseOwnedInfrastructure(input) {
+    return ownedInfrastructureSchema.parse(input);
+}

package/dist/provider-egress.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Provider egress, `veil.fetch` for Fungi's own platform keys (V1b). The Hub
+ * names a route and hands over a request that carries no credential; Veil
+ * checks the destination against that route's allowed origin and path, then
+ * attaches the platform key itself. The key value never crosses back: not in a
+ * returned value, not in a thrown error (only fixed `VeilError` codes), and
+ * not in anything this module logs (it logs nothing).
+ *
+ * Routes:
+ * - `camel`: Camel's hosted stream, `Authorization: Bearer`.
+ * - `ai-gateway`: Cloudflare AI Gateway's OpenAI-compatible route, with the
+ *   gateway token as `cf-aig-authorization` and no `Authorization`.
+ * - `parallel`: Parallel Search, directly or through the AI Gateway's
+ *   `/parallel` route, with `x-api-key`.
+ * - `ai-gateway-logs`: Cloudflare's API log read used for usage
+ *   reconciliation, `Authorization: Bearer` with the gateway token.
+ */
+/** Private Worker bindings read only here; never Team storage or responses. */
+export type ProviderKeyBindings = Readonly<{
+    CAMEL_API_KEY?: string;
+    /** Cloudflare API token; authorizes AI Gateway calls and log reads. */
+    AI_GATEWAY_AUTH_TOKEN?: string;
+    PARALLEL_API_KEY?: string;
+    /** Cloudflare account that owns the gateway; routes are scoped to it. */
+    AI_GATEWAY_ACCOUNT_ID?: string;
+    AI_GATEWAY_ID?: string;
+}>;
+export type ProviderRoute = "camel" | "ai-gateway" | "parallel" | "ai-gateway-logs";
+/**
+ * The provider-key door. `fetch` is the transport the authorized request is
+ * finally sent on (a test double, or the Hub's telemetry-wrapped fetch).
+ */
+export declare function createProviderEgress(env: ProviderKeyBindings, options?: Readonly<{
+    fetch?: typeof globalThis.fetch;
+}>): {
+    /** Whether this route's credential is configured; reveals no value. */
+    credentialed(route: ProviderRoute): boolean;
+    /** The route's public base URL, or `null` while it is not configured. */
+    baseUrl(route: ProviderRoute): string | null;
+    /**
+     * Send a credential-free request to a route. Refuses (`denied`) any
+     * destination outside the route and (`unavailable`) a route with no
+     * credential. Redirects are never followed, so a redirect cannot carry
+     * the key to another origin (workerd has no `error` mode; `manual` hands
+     * the 3xx back instead).
+     */
+    fetch(route: ProviderRoute, input: string | URL | Request, init?: RequestInit): Promise<Response>;
+};
+export type ProviderEgress = ReturnType<typeof createProviderEgress>;
+/** A `fetch` bound to one route, for consumers that take a plain fetch. */
+export declare function providerFetch(egress: ProviderEgress, route: ProviderRoute): typeof globalThis.fetch;