@fungi.computer/veil 0.2.1 → 0.4.0

package/dist/credential-store.js

@@ -0,0 +1,151 @@
+import { Buffer } from "node:buffer";
+import * as Schema from "effect/Schema";
+import { defineIdFamily } from "@fungi.computer/cairn";
+/**
+ * Veil's one encrypted credential store. A host holds a dedicated 32-byte
+ * master key as a host secret; credentials (model API keys, connector tokens)
+ * are sealed under it with WebCrypto AES-GCM, bound to an owner address, and
+ * leave the store only into a callback. Listings carry no secret.
+ */
+/** Stable, secret-free reason a credential could not be sealed, opened or stored. */
+export class CredentialError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "CredentialError";
+    }
+}
+const keySchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/u)));
+const keyIdSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/u)));
+const envelopeSchema = Schema.Struct({
+    version: Schema.Literal(1),
+    keyId: keyIdSchema,
+    iv: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{16}$/u))),
+    ciphertext: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{22,22000}$/u))),
+});
+const encoder = new TextEncoder();
+/**
+ * WebCrypto owns authenticated encryption. `domain` and `context` are the
+ * additional authenticated data: a sealed value opens only for its own owner.
+ */
+export function createCredentialSealer(configuration, domain) {
+    const keys = new Map();
+    let activeKeyId;
+    try {
+        activeKeyId = Schema.decodeUnknownSync(keyIdSchema)(configuration.activeKeyId);
+        for (const [id, encoded] of Object.entries(configuration.keys)) {
+            Schema.decodeUnknownSync(keyIdSchema)(id);
+            const parsed = Schema.decodeUnknownSync(keySchema)(encoded);
+            const bytes = Uint8Array.from(Buffer.from(parsed, "base64url"));
+            if (bytes.length !== 32)
+                throw new CredentialError("unavailable");
+            keys.set(id, crypto.subtle.importKey("raw", bytes, "AES-GCM", false, [
+                "encrypt",
+                "decrypt",
+            ]));
+        }
+        if (!keys.has(activeKeyId))
+            throw new CredentialError("unavailable");
+    }
+    catch {
+        throw new CredentialError("unavailable");
+    }
+    const key = (id) => {
+        const found = keys.get(id);
+        if (!found)
+            throw new CredentialError("denied");
+        return found;
+    };
+    const binding = (keyId, context) => encoder.encode(JSON.stringify([domain, keyId, ...context]));
+    return {
+        async seal(context, credential) {
+            const iv = crypto.getRandomValues(new Uint8Array(12));
+            const ciphertext = await crypto.subtle.encrypt({
+                name: "AES-GCM",
+                iv,
+                additionalData: binding(activeKeyId, context),
+            }, await key(activeKeyId), encoder.encode(credential));
+            return JSON.stringify({
+                version: 1,
+                keyId: activeKeyId,
+                iv: Buffer.from(iv).toString("base64url"),
+                ciphertext: Buffer.from(ciphertext).toString("base64url"),
+            });
+        },
+        async open(context, sealed) {
+            try {
+                const envelope = Schema.decodeUnknownSync(Schema.fromJsonString(envelopeSchema))(sealed);
+                const plaintext = await crypto.subtle.decrypt({
+                    name: "AES-GCM",
+                    iv: Uint8Array.from(Buffer.from(envelope.iv, "base64url")),
+                    additionalData: binding(envelope.keyId, context),
+                }, await key(envelope.keyId), Uint8Array.from(Buffer.from(envelope.ciphertext, "base64url")));
+                return new TextDecoder().decode(plaintext);
+            }
+            catch {
+                throw new CredentialError("denied");
+            }
+        },
+    };
+}
+const ids = defineIdFamily({
+    family: "veil-credential",
+    version: 1,
+    kinds: { credential: { prefix: "cred" } },
+});
+const prefix = "credential:";
+export function createCredentialStore(options) {
+    const now = options.now ?? Date.now;
+    const limit = options.limit ?? 64;
+    const publicRecord = (row) => ({
+        credentialId: row.credentialId,
+        kind: row.kind,
+        label: row.label,
+        createdAt: row.createdAt,
+        validatedAt: row.validatedAt,
+    });
+    const row = async (credentialId) => options.storage.get(`${prefix}${credentialId}`);
+    return {
+        /** Seal one credential bound to its id and kind. */
+        async put(input) {
+            if ((await options.storage.list(prefix)).size >= limit)
+                throw new CredentialError("limit");
+            const credentialId = ids.credential.generate();
+            const at = now();
+            const stored = {
+                credentialId,
+                kind: input.kind,
+                label: input.label,
+                createdAt: at,
+                validatedAt: at,
+                sealed: await options.sealer.seal([credentialId, input.kind], input.secret),
+            };
+            await options.storage.put(`${prefix}${credentialId}`, stored);
+            return publicRecord(stored);
+        },
+        async list(kind) {
+            return [...(await options.storage.list(prefix)).values()]
+                .filter((item) => kind === undefined || item.kind === kind)
+                .map(publicRecord)
+                .sort((a, b) => a.createdAt - b.createdAt);
+        },
+        async get(credentialId) {
+            const found = await row(credentialId);
+            return found === undefined ? null : publicRecord(found);
+        },
+        async remove(credentialId) {
+            return (await options.storage.delete(`${prefix}${credentialId}`))
+                ? "deleted"
+                : "absent";
+        },
+        /** The only way out: the secret exists for the callback and nowhere else. */
+        async withSecret(credentialId, action) {
+            const found = await row(credentialId);
+            if (found === undefined)
+                throw new CredentialError("absent");
+            const secret = await options.sealer.open([found.credentialId, found.kind], found.sealed);
+            return action(secret, publicRecord(found));
+        },
+    };
+}

package/dist/index.d.ts

@@ -227,7 +227,7 @@ export declare function createGitHubConnections(options: Readonly<{
         status: "completed";
         connectionId: string;
         authorityVersion: number;
-        custody: "deleted" | "absent";
+        custody: "absent" | "deleted";
     }>;
     readRepository: (binding: ReadBinding, signal?: AbortSignal) => Promise<{
         id: number;

package/dist/model-credentials.d.ts

@@ -3,12 +3,11 @@
  * provider login policy: the local runtime, the TUI login registry and the Hub
  * read it; none of them decides visibility on its own.
  *
- * Stance: like Pi and OpenCode, offer a person's own subscription locally and
- * hosted, and turn a provider off through `subscriptionKillSwitch` if it
- * objects or blocks tokens. A subscription is always one person's: never
- * Team-scoped, shared or pooled. The new OpenAI ChatGPT plan flow is
- * local-only; hosted use awaits OpenAI approval. The retired Codex provider
- * is forbidden on both hosts.
+ * Offer a person's own Claude or ChatGPT subscription locally, never on
+ * hosted Fungi. A subscription is always one person's: never Team-scoped,
+ * shared or pooled. `subscriptionKillSwitch` can turn off a provider if it
+ * objects or blocks tokens. Hosted BYOK uses API keys. The retired Codex
+ * provider is forbidden on both hosts.
  * See wiki/3-resources/decisions/adr-byok-model-keys-v1.md.
  */
 /** The owner's own machine, or Fungi's servers acting for a Team. */
@@ -69,7 +68,9 @@ export declare const modelCredentialPolicy: Readonly<{
                 status: "allowed";
             }>;
             hosted: Readonly<{
-                status: "allowed";
+                status: "forbidden";
+                reason: string;
+                source: string;
             }>;
         };
     };

package/dist/model-credentials.js

@@ -3,17 +3,21 @@
  * provider login policy: the local runtime, the TUI login registry and the Hub
  * read it; none of them decides visibility on its own.
  *
- * Stance: like Pi and OpenCode, offer a person's own subscription locally and
- * hosted, and turn a provider off through `subscriptionKillSwitch` if it
- * objects or blocks tokens. A subscription is always one person's: never
- * Team-scoped, shared or pooled. The new OpenAI ChatGPT plan flow is
- * local-only; hosted use awaits OpenAI approval. The retired Codex provider
- * is forbidden on both hosts.
+ * Offer a person's own Claude or ChatGPT subscription locally, never on
+ * hosted Fungi. A subscription is always one person's: never Team-scoped,
+ * shared or pooled. `subscriptionKillSwitch` can turn off a provider if it
+ * objects or blocks tokens. Hosted BYOK uses API keys. The retired Codex
+ * provider is forbidden on both hosts.
  * See wiki/3-resources/decisions/adr-byok-model-keys-v1.md.
  */
 const allowed = { status: "allowed" };
 const unreviewed = { status: "unreviewed" };
 const notOffered = {
+    status: "forbidden",
+    reason: "Fungi does not offer this credential method on this host",
+    source: "wiki/3-resources/decisions/adr-byok-model-keys-v1.md",
+};
+const providerNotOffered = {
     status: "forbidden",
     reason: "The provider does not offer this credential method",
     source: "provider documentation",
@@ -25,7 +29,7 @@ const retiredCodex = {
 };
 const apiKeyOnly = {
     api_key: { local: allowed, hosted: allowed },
-    subscription: { local: notOffered, hosted: notOffered },
+    subscription: { local: providerNotOffered, hosted: providerNotOffered },
 };
 /**
  * Reviewed providers, keyed by Pi provider id. `openai-compatible` is a
@@ -38,9 +42,8 @@ export const modelCredentialPolicy = Object.freeze({
     },
     anthropic: {
         api_key: { local: allowed, hosted: allowed },
-        // Local: Pi's Claude Pro/Max OAuth, as Pi and OpenCode ship it. Hosted: the
-        // unmodified Claude Code binary on the owner's Computer, signed in by them.
-        subscription: { local: allowed, hosted: allowed },
+        // Local: Pi's Claude Pro/Max OAuth. Hosted: no Claude subscription login.
+        subscription: { local: allowed, hosted: notOffered },
     },
     "openai-codex": {
         api_key: { local: retiredCodex, hosted: retiredCodex },
@@ -52,8 +55,8 @@ export const modelCredentialPolicy = Object.freeze({
             local: allowed,
             hosted: {
                 status: "forbidden",
-                reason: "ChatGPT plan usage in a hosted app requires OpenAI approval",
-                source: "https://developers.openai.com/siwc/token-sharing-open-source",
+                reason: "Fungi does not offer ChatGPT subscription sign-in on hosted Fungi; approval alone would not enable it",
+                source: "wiki/3-resources/decisions/adr-byok-model-keys-v1.md",
             },
         },
     },

package/dist/model-keys.d.ts

@@ -11,6 +11,30 @@ export declare function isModelKeyProvider(value: string): value is ModelKeyProv
 export declare function modelKeyBaseUrl(provider: ModelKeyProvider, configured?: string | null, options?: Readonly<{
     allowLocalDev?: boolean;
 }>): string;
+/** A stored key as an owner sees it: no secret, no custody locator. */
+export type ModelKeyRecord = Readonly<{
+    keyId: string;
+    provider: ModelKeyProvider;
+    label: string;
+    createdAt: number;
+    validatedAt: number;
+}>;
+/**
+ * The neutral model-key seam every host composes: standalone Oyster over
+ * Veil's credential store, the Hub over its Nango custodian. `seal` validates
+ * with the provider before storing; `send` is the only place a key meets a
+ * request.
+ */
+export type ModelKeyVault = Readonly<{
+    seal: (input: Readonly<{
+        provider: string;
+        label: string;
+        apiKey: string;
+    }>) => Promise<ModelKeyRecord>;
+    list: () => Promise<readonly ModelKeyRecord[]>;
+    remove: (keyId: string) => Promise<"deleted" | "absent">;
+    send: (keyId: string, request: Request) => Promise<Response>;
+}>;
 /** Private to the Team owner and the custodian adapter; never a public field. */
 export type ModelKeyAccess = Readonly<{
     locator: string;

package/dist/openapi-secrets.d.ts

@@ -1,5 +1,5 @@
 import { type OpenApiCredentialKeyring, type OpenApiAccess } from "./openapi-contract.js";
-/** WebCrypto owns authenticated encryption; the owner address and policy are its AAD. */
+/** Connector credentials sealed by Veil's one credential sealer. */
 export declare function createOpenApiSecrets(configuration: OpenApiCredentialKeyring): {
     seal(access: OpenApiAccess, credential: string): Promise<string>;
     open(access: OpenApiAccess, sealed: string): Promise<string>;

package/dist/openapi-secrets.js

@@ -1,76 +1,37 @@
-import { Buffer } from "node:buffer";
-import * as Schema from "effect/Schema";
 import { OpenApiError, } from "./openapi-contract.js";
-const keySchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/u)));
-const keyIdSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/u)));
-const envelopeSchema = Schema.Struct({
-    version: Schema.Literal(1),
-    keyId: keyIdSchema,
-    iv: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{16}$/u))),
-    ciphertext: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{22,22000}$/u))),
-});
-const encoder = new TextEncoder();
-const binding = (access, keyId) => encoder.encode(JSON.stringify([
-    "fungi.veil.openapi.v1",
-    keyId,
+import { createCredentialSealer } from "./credential-store.js";
+/** The connector's owner address and policy are the sealed value's context. */
+const context = (access) => [
     access.teamId,
     access.connectorId,
     access.baseUrl,
     access.auth.kind,
-    access.auth.kind === "api_key_header" ||
-        access.auth.kind === "api_key_query"
+    access.auth.kind === "api_key_header" || access.auth.kind === "api_key_query"
         ? access.auth.param
         : null,
-]));
-/** WebCrypto owns authenticated encryption; the owner address and policy are its AAD. */
+];
+/** Connector credentials sealed by Veil's one credential sealer. */
 export function createOpenApiSecrets(configuration) {
-    const keys = new Map();
-    let activeKeyId;
-    try {
-        activeKeyId = Schema.decodeUnknownSync(keyIdSchema)(configuration.activeKeyId);
-        for (const [id, encoded] of Object.entries(configuration.keys)) {
-            Schema.decodeUnknownSync(keyIdSchema)(id);
-            const parsed = Schema.decodeUnknownSync(keySchema)(encoded);
-            const bytes = Uint8Array.from(Buffer.from(parsed, "base64url"));
-            if (bytes.length !== 32)
-                throw new OpenApiError("unavailable");
-            keys.set(id, crypto.subtle.importKey("raw", bytes, "AES-GCM", false, [
-                "encrypt",
-                "decrypt",
-            ]));
+    const sealer = (() => {
+        try {
+            return createCredentialSealer(configuration, "fungi.veil.openapi.v1");
         }
-        if (!keys.has(activeKeyId))
+        catch {
             throw new OpenApiError("unavailable");
-    }
-    catch {
-        throw new OpenApiError("unavailable");
-    }
-    const key = (id) => {
-        const found = keys.get(id);
-        if (!found)
-            throw new OpenApiError("denied");
-        return found;
-    };
+        }
+    })();
     return {
         async seal(access, credential) {
-            const iv = crypto.getRandomValues(new Uint8Array(12));
-            const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: binding(access, activeKeyId) }, await key(activeKeyId), encoder.encode(credential));
-            return JSON.stringify({
-                version: 1,
-                keyId: activeKeyId,
-                iv: Buffer.from(iv).toString("base64url"),
-                ciphertext: Buffer.from(ciphertext).toString("base64url"),
-            });
+            try {
+                return await sealer.seal(context(access), credential);
+            }
+            catch {
+                throw new OpenApiError("denied");
+            }
         },
         async open(access, sealed) {
             try {
-                const envelope = Schema.decodeUnknownSync(Schema.fromJsonString(envelopeSchema))(sealed);
-                const plaintext = await crypto.subtle.decrypt({
-                    name: "AES-GCM",
-                    iv: Uint8Array.from(Buffer.from(envelope.iv, "base64url")),
-                    additionalData: binding(access, envelope.keyId),
-                }, await key(envelope.keyId), Uint8Array.from(Buffer.from(envelope.ciphertext, "base64url")));
-                return new TextDecoder().decode(plaintext);
+                return await sealer.open(context(access), sealed);
             }
             catch {
                 throw new OpenApiError("denied");

package/dist/provider-egress.d.ts

@@ -14,6 +14,9 @@
  *   `/parallel` route, with `x-api-key`.
  * - `ai-gateway-logs`: Cloudflare's API log read used for usage
  *   reconciliation, `Authorization: Bearer` with the gateway token.
+ * - `solana-rpc` / `solana-rpc-fallback`: finalized snapshot reads through
+ *   Helius / QuickNode, with private query / path credentials.
+ * - `sanctions-screen`: the official OFAC SDN XML export, without a key.
  */
 /** Private Worker bindings read only here; never Team storage or responses. */
 export type ProviderKeyBindings = Readonly<{
@@ -24,8 +27,16 @@ export type ProviderKeyBindings = Readonly<{
     /** Cloudflare account that owns the gateway; routes are scoped to it. */
     AI_GATEWAY_ACCOUNT_ID?: string;
     AI_GATEWAY_ID?: string;
+    /** Credential-free Helius mainnet root; the key is a separate Worker secret. */
+    SOLANA_RPC_URL?: string;
+    SOLANA_RPC_API_KEY?: string;
+    /** Credential-free QuickNode Solana mainnet root; token is a Worker secret. */
+    SOLANA_RPC_FALLBACK_URL?: string;
+    SOLANA_RPC_FALLBACK_API_KEY?: string;
+    /** Opt-in to the pinned public OFAC SDN XML export. No API key is needed. */
+    SANCTIONS_SDN_URL?: string;
 }>;
-export type ProviderRoute = "camel" | "ai-gateway" | "parallel" | "ai-gateway-logs";
+export type ProviderRoute = "camel" | "ai-gateway" | "parallel" | "ai-gateway-logs" | "solana-rpc" | "solana-rpc-fallback" | "sanctions-screen";
 /**
  * The provider-key door. `fetch` is the transport the authorized request is
  * finally sent on (a test double, or the Hub's telemetry-wrapped fetch).
@@ -33,16 +44,16 @@ export type ProviderRoute = "camel" | "ai-gateway" | "parallel" | "ai-gateway-lo
 export declare function createProviderEgress(env: ProviderKeyBindings, options?: Readonly<{
     fetch?: typeof globalThis.fetch;
 }>): {
-    /** Whether this route's credential is configured; reveals no value. */
+    /** Whether required custody/configuration is present; reveals no value. */
     credentialed(route: ProviderRoute): boolean;
     /** The route's public base URL, or `null` while it is not configured. */
     baseUrl(route: ProviderRoute): string | null;
     /**
      * Send a credential-free request to a route. Refuses (`denied`) any
      * destination outside the route and (`unavailable`) a route with no
-     * credential. Redirects are never followed, so a redirect cannot carry
-     * the key to another origin (workerd has no `error` mode; `manual` hands
-     * the 3xx back instead).
+     * credential. Credentialed routes never follow redirects (workerd has no
+     * `error` mode; `manual` hands the 3xx back instead). Only the anonymous
+     * sanctions GET may follow one pinned OFAC government-S3 302.
      */
     fetch(route: ProviderRoute, input: string | URL | Request, init?: RequestInit): Promise<Response>;
 };