@fungi.computer/veil 0.3.0 → 0.4.0

package/dist/connections/contract.d.ts

@@ -0,0 +1,141 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import type { PublicEgressPolicy } from "../public-egress-policy.js";
+export type ConnectionsRefusal = "invalid_input" | "denied" | "revoked" | "conflict" | "unsupported" | "too_large" | "reconnect_required" | "invalid_response" | "unavailable";
+/** Fixed codes only: upstream bodies, URLs and credential bytes never enter errors. */
+export declare class ConnectionsError extends Error {
+    readonly code: ConnectionsRefusal;
+    readonly name = "ConnectionsError";
+    constructor(code: ConnectionsRefusal, options?: ErrorOptions);
+}
+export declare const identifier: Schema.String;
+declare const placementSchema: Schema.Union<readonly [Schema.Literal<"bearer">, Schema.Struct<{
+    readonly header: Schema.String;
+}>, Schema.Struct<{
+    readonly query: Schema.String;
+}>]>;
+export type Placement = typeof placementSchema.Type;
+/** How the final request is authorized. OAuth joins this union in slice 3. */
+export declare const credentialSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"none">;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"static">;
+    readonly placement: Schema.Union<readonly [Schema.Literal<"bearer">, Schema.Struct<{
+        readonly header: Schema.String;
+    }>, Schema.Struct<{
+        readonly query: Schema.String;
+    }>]>;
+}>]>;
+export type Credential = typeof credentialSchema.Type;
+export type SurfaceView = Readonly<{
+    kind: "mcp";
+    url: string;
+}> | Readonly<{
+    kind: "openapi";
+    baseUrl: string;
+    table: unknown;
+}>;
+export declare const toolsSchema: Schema.Union<readonly [Schema.Literal<"all">, Schema.$Array<Schema.String>]>;
+export type Tools = typeof toolsSchema.Type;
+export declare const draftSchema: Schema.Struct<{
+    /** Idempotency key: a replay with the same request returns the same connection. */
+    readonly requestId: Schema.String;
+    readonly name: Schema.String;
+    readonly surface: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"mcp">;
+        readonly url: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"openapi">;
+        readonly baseUrl: Schema.String;
+        readonly table: Schema.Unknown;
+    }>]>;
+    readonly credential: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"none">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"static">;
+        readonly placement: Schema.Union<readonly [Schema.Literal<"bearer">, Schema.Struct<{
+            readonly header: Schema.String;
+        }>, Schema.Struct<{
+            readonly query: Schema.String;
+        }>]>;
+    }>]>;
+    readonly secret: Schema.optional<Schema.String>;
+}>;
+export type ConnectionDraft = typeof draftSchema.Type;
+export declare const grantInputSchema: Schema.Struct<{
+    readonly connectionId: Schema.String;
+    readonly agentId: Schema.String;
+    readonly tools: Schema.Union<readonly [Schema.Literal<"all">, Schema.$Array<Schema.String>]>;
+}>;
+export type GrantInput = typeof grantInputSchema.Type;
+export declare const egressRefSchema: Schema.Struct<{
+    readonly connectionId: Schema.String;
+    readonly grantVersion: Schema.Number;
+}>;
+export type EgressRef = typeof egressRefSchema.Type;
+/** Where custody finds one connection; carries no secret. */
+export type CustodyAddress = Readonly<{
+    ownerId: string;
+    connectionId: string;
+    credential: Credential;
+}>;
+/**
+ * Owner-side credential custody. `sealed` stores ciphertext, `nango` a locator.
+ * Only `inject` ever opens a credential, and it sends the request itself.
+ */
+export type CustodyAdapter = Readonly<{
+    put: (address: CustodyAddress, secret: string) => Effect.Effect<string, ConnectionsError>;
+    inject: (address: CustodyAddress, locator: string, request: Request) => Effect.Effect<Response, ConnectionsError>;
+    remove: (address: CustodyAddress, locator: string) => Effect.Effect<"deleted" | "absent", ConnectionsError>;
+}>;
+export type SqlValue = string | number | null;
+/** The owner's SQLite in Cloudflare `ctx.storage` shape. */
+export type SqlStore = Readonly<{
+    sql: Readonly<{
+        exec: (statement: string, ...bindings: SqlValue[]) => Readonly<{
+            toArray: () => readonly unknown[];
+        }>;
+    }>;
+    transactionSync: <A>(operation: () => A) => A;
+}>;
+export type ConnectionsOptions = Readonly<{
+    ownerId: string;
+    store: SqlStore;
+    custody: CustodyAdapter;
+    /** Host authority read: may this actor manage connections, or still stand as a grantor? */
+    authorize: (actorId: string, purpose: "manage" | "grantor") => boolean;
+    egressPolicy?: PublicEgressPolicy;
+    clock: () => number;
+    ids: () => string;
+}>;
+/** Secret-free, versioned, and safe to hand to an Agent. */
+export type ConnectionProjection = Readonly<{
+    revision: number;
+    connections: readonly Readonly<{
+        connectionId: string;
+        name: string;
+        surface: SurfaceView;
+        tools: Tools;
+        authorityVersion: number;
+        grantVersion: number;
+    }>[];
+}>;
+export type ConnectionView = Readonly<{
+    connectionId: string;
+    name: string;
+    surface: Readonly<{
+        kind: "mcp" | "openapi";
+        origin: string;
+    }>;
+    credentialKind: Credential["kind"];
+    state: "active" | "reconnect_required" | "revoked";
+    authorityVersion: number;
+    grants: readonly Readonly<{
+        agentId: string;
+        tools: Tools;
+        version: number;
+    }>[];
+}>;
+/** The Agent's narrowed capability: only the owner opens the credential. */
+export type NarrowFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export {};

package/dist/connections/contract.js

@@ -0,0 +1,55 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+/** Fixed codes only: upstream bodies, URLs and credential bytes never enter errors. */
+export class ConnectionsError extends Error {
+    code;
+    name = "ConnectionsError";
+    constructor(code, options) {
+        super(code, options);
+        this.code = code;
+    }
+}
+export const identifier = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_.:-]{1,128}$/u)));
+const headerName = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9-]{1,64}$/u)));
+const queryName = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_.-]{1,64}$/u)));
+const version = Schema.Number.pipe(Schema.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(1)));
+const placementSchema = Schema.Union([
+    Schema.Literal("bearer"),
+    Schema.Struct({ header: headerName }),
+    Schema.Struct({ query: queryName }),
+]);
+/** How the final request is authorized. OAuth joins this union in slice 3. */
+export const credentialSchema = Schema.Union([
+    Schema.Struct({ kind: Schema.Literal("none") }),
+    Schema.Struct({ kind: Schema.Literal("static"), placement: placementSchema }),
+]);
+/** What the Agent can call. The OpenAPI table is decoded by Forage before it is stored. */
+const surfaceDraftSchema = Schema.Union([
+    Schema.Struct({ kind: Schema.Literal("mcp"), url: Schema.String }),
+    Schema.Struct({
+        kind: Schema.Literal("openapi"),
+        baseUrl: Schema.String,
+        table: Schema.Unknown,
+    }),
+]);
+export const toolsSchema = Schema.Union([
+    Schema.Literal("all"),
+    Schema.Array(Schema.String.pipe(Schema.check(Schema.isMinLength(1), Schema.isMaxLength(256)))).pipe(Schema.check(Schema.isMaxLength(256))),
+]);
+export const draftSchema = Schema.Struct({
+    /** Idempotency key: a replay with the same request returns the same connection. */
+    requestId: identifier,
+    name: Schema.String.pipe(Schema.check(Schema.isMinLength(1), Schema.isMaxLength(128))),
+    surface: surfaceDraftSchema,
+    credential: credentialSchema,
+    secret: Schema.optional(Schema.String.pipe(Schema.check(Schema.isPattern(/^[\x21-\x7e]{1,16384}$/u)))),
+});
+export const grantInputSchema = Schema.Struct({
+    connectionId: identifier,
+    agentId: identifier,
+    tools: toolsSchema,
+});
+export const egressRefSchema = Schema.Struct({
+    connectionId: identifier,
+    grantVersion: version,
+});

package/dist/connections/core.d.ts

@@ -0,0 +1,48 @@
+import * as Effect from "effect/Effect";
+import { ConnectionsError, type ConnectionDraft, type GrantInput, type ConnectionsOptions, type EgressRef, type NarrowFetch, type SurfaceView } from "./contract.js";
+/** One owner's connections: attempts, connections, grants, receipts and cleanup in its SQLite. */
+export declare function createConnections(options: ConnectionsOptions): {
+    begin: (actor: string, input: ConnectionDraft) => Effect.Effect<{
+        connectionId: string;
+        authorizeUrl: null;
+    }, ConnectionsError, never>;
+    grant: (actor: string, input: GrantInput) => Effect.Effect<{
+        grantVersion: number;
+    }, ConnectionsError, never>;
+    ungrant: (actor: string, input: {
+        connectionId: string;
+        agentId: string;
+    }) => Effect.Effect<void, ConnectionsError, never>;
+    revoke: (actor: string, input: {
+        connectionId: string;
+    }) => Effect.Effect<void, ConnectionsError, never>;
+    projection: (agentId: string) => Effect.Effect<{
+        revision: number;
+        connections: {
+            connectionId: string;
+            name: string;
+            surface: SurfaceView;
+            tools: readonly string[] | "all";
+            authorityVersion: number;
+            grantVersion: number;
+        }[];
+    }, ConnectionsError, never>;
+    list: (actor: string) => Effect.Effect<Readonly<{
+        connectionId: string;
+        name: string;
+        surface: Readonly<{
+            kind: "mcp" | "openapi";
+            origin: string;
+        }>;
+        credentialKind: import("./contract.js").Credential["kind"];
+        state: "active" | "reconnect_required" | "revoked";
+        authorityVersion: number;
+        grants: readonly Readonly<{
+            agentId: string;
+            tools: import("./contract.js").Tools;
+            version: number;
+        }>[];
+    }>[], ConnectionsError, never>;
+    egress: (agentId: string, input: EgressRef) => NarrowFetch;
+    sweep: () => Effect.Effect<void, ConnectionsError, never>;
+};

package/dist/connections/core.js

@@ -0,0 +1,372 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { parseOpenApiTable } from "@fungi.computer/forage/openapi";
+import { assertPublicHostName } from "../model-key-network.js";
+import { createPublicEgressPolicy } from "../public-egress-policy.js";
+import { ConnectionsError, credentialSchema, draftSchema, egressRefSchema, grantInputSchema, identifier, toolsSchema, } from "./contract.js";
+import { admitRequest } from "./egress.js";
+const attemptTtlMs = 10 * 60 * 1000;
+const cleanupLimit = 5;
+const json = (schema) => Schema.fromJsonString(schema);
+const connectionRow = Schema.Struct({
+    id: identifier,
+    name: Schema.String,
+    surface: json(Schema.Struct({
+        kind: Schema.Literals(["mcp", "openapi"]),
+        url: Schema.String,
+        table: Schema.NullOr(Schema.Unknown),
+    })),
+    credential: json(credentialSchema),
+    locator: Schema.NullOr(Schema.String),
+    state: Schema.Literals(["active", "reconnect_required", "revoked"]),
+    authorityVersion: Schema.Number,
+});
+const grantRow = Schema.Struct({
+    connectionId: identifier,
+    agentId: identifier,
+    tools: json(toolsSchema),
+    grantor: identifier,
+    version: Schema.Number,
+    active: Schema.Literals([0, 1]),
+});
+const receiptRow = Schema.Struct({
+    fingerprint: Schema.String,
+    result: json(Schema.Struct({ connectionId: identifier })),
+});
+const cleanupRow = Schema.Struct({
+    id: Schema.Number,
+    connectionId: identifier,
+    locator: Schema.String,
+    credential: json(credentialSchema),
+    attempts: Schema.Number,
+});
+const count = Schema.Struct({ n: Schema.Number });
+function decode(schema, input) {
+    try {
+        return Schema.decodeUnknownSync(schema)(input);
+    }
+    catch {
+        throw new ConnectionsError("invalid_input");
+    }
+}
+const sync = (operation) => Effect.try({
+    try: operation,
+    catch: (cause) => cause instanceof ConnectionsError
+        ? cause
+        : new ConnectionsError("unavailable", { cause }),
+});
+const io = (operation) => Effect.tryPromise({
+    try: operation,
+    catch: (cause) => cause instanceof ConnectionsError
+        ? cause
+        : new ConnectionsError("unavailable", { cause }),
+});
+/** One owner's connections: attempts, connections, grants, receipts and cleanup in its SQLite. */
+export function createConnections(options) {
+    const ownerId = decode(identifier, options.ownerId);
+    const { sql, transactionSync } = options.store;
+    const policy = createPublicEgressPolicy(options.egressPolicy);
+    sql.exec(`
+    CREATE TABLE IF NOT EXISTS veil_connection_attempts (
+      state TEXT PRIMARY KEY, connectionId TEXT NOT NULL, actor TEXT NOT NULL,
+      status TEXT NOT NULL, expiresAt INTEGER NOT NULL,
+      pkceVerifierSealed TEXT, issuer TEXT) STRICT;
+    CREATE TABLE IF NOT EXISTS veil_connections (
+      id TEXT PRIMARY KEY, name TEXT NOT NULL, surface TEXT NOT NULL, credential TEXT NOT NULL,
+      locator TEXT, state TEXT NOT NULL, authorityVersion INTEGER NOT NULL) STRICT;
+    CREATE TABLE IF NOT EXISTS veil_connection_grants (
+      connectionId TEXT NOT NULL, agentId TEXT NOT NULL, tools TEXT NOT NULL,
+      grantor TEXT NOT NULL, version INTEGER NOT NULL, active INTEGER NOT NULL,
+      PRIMARY KEY (connectionId, agentId)) STRICT;
+    CREATE TABLE IF NOT EXISTS veil_connection_receipts (
+      requestId TEXT PRIMARY KEY, fingerprint TEXT NOT NULL, result TEXT NOT NULL) STRICT;
+    CREATE TABLE IF NOT EXISTS veil_connection_cleanup (
+      id INTEGER PRIMARY KEY AUTOINCREMENT, connectionId TEXT NOT NULL, locator TEXT NOT NULL,
+      credential TEXT NOT NULL, attempts INTEGER NOT NULL) STRICT;
+    CREATE TABLE IF NOT EXISTS veil_connection_epoch (id INTEGER PRIMARY KEY CHECK (id = 1), revision INTEGER NOT NULL) STRICT;
+    INSERT OR IGNORE INTO veil_connection_epoch VALUES (1, 1);`);
+    const rows = (schema, statement, ...bindings) => sql
+        .exec(statement, ...bindings)
+        .toArray()
+        .map((row) => decode(schema, row));
+    const bump = () => sql.exec("UPDATE veil_connection_epoch SET revision = revision + 1");
+    const authorize = (actor, purpose) => {
+        decode(identifier, actor);
+        if (!options.authorize(actor, purpose))
+            throw new ConnectionsError("denied");
+    };
+    const connection = (id) => {
+        const row = rows(connectionRow, "SELECT * FROM veil_connections WHERE id = ?", id)[0];
+        if (!row)
+            throw new ConnectionsError("denied");
+        return row;
+    };
+    const grant = (id, agentId) => rows(grantRow, "SELECT * FROM veil_connection_grants WHERE connectionId = ? AND agentId = ?", id, agentId)[0];
+    const address = (row) => ({
+        ownerId,
+        connectionId: row.id,
+        credential: row.credential,
+    });
+    /** The surface URL must be public https with nothing the owner did not choose to send. */
+    const publicUrl = (value) => {
+        if (!URL.canParse(value))
+            throw new ConnectionsError("invalid_input");
+        const url = new URL(value);
+        if (url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash)
+            throw new ConnectionsError("invalid_input");
+        try {
+            assertPublicHostName(url.hostname);
+            policy.destination(url);
+        }
+        catch (cause) {
+            throw new ConnectionsError("denied", { cause });
+        }
+        return url.href;
+    };
+    const sweep = () => Effect.gen(function* () {
+        const due = yield* sync(() => rows(cleanupRow, "SELECT * FROM veil_connection_cleanup WHERE attempts < ?", cleanupLimit));
+        for (const job of due) {
+            const outcome = yield* options.custody
+                .remove({
+                ownerId,
+                connectionId: job.connectionId,
+                credential: job.credential,
+            }, job.locator)
+                .pipe(Effect.result);
+            yield* sync(() => {
+                if (outcome._tag === "Success")
+                    sql.exec("DELETE FROM veil_connection_cleanup WHERE id = ?", job.id);
+                else
+                    sql.exec("UPDATE veil_connection_cleanup SET attempts = attempts + 1 WHERE id = ?", job.id);
+            });
+        }
+    });
+    const enqueueCleanup = (row) => {
+        if (row.locator !== null)
+            sql.exec("INSERT INTO veil_connection_cleanup (connectionId, locator, credential, attempts) VALUES (?, ?, ?, 0)", row.id, row.locator, JSON.stringify(row.credential));
+    };
+    const fingerprint = (draft) => JSON.stringify([
+        draft.name,
+        draft.surface.kind,
+        "url" in draft.surface ? draft.surface.url : draft.surface.baseUrl,
+        draft.credential,
+        draft.secret !== undefined,
+    ]);
+    const begin = (actor, input) => Effect.gen(function* () {
+        const draft = yield* sync(() => {
+            authorize(actor, "manage");
+            const parsed = decode(draftSchema, input);
+            if (parsed.credential.kind === "static"
+                ? parsed.secret === undefined
+                : parsed.secret !== undefined)
+                throw new ConnectionsError("invalid_input");
+            return parsed;
+        });
+        const replay = yield* sync(() => {
+            const receipt = rows(receiptRow, "SELECT fingerprint, result FROM veil_connection_receipts WHERE requestId = ?", draft.requestId)[0];
+            if (!receipt)
+                return null;
+            if (receipt.fingerprint !== fingerprint(draft))
+                throw new ConnectionsError("conflict");
+            return receipt.result.connectionId;
+        });
+        if (replay !== null)
+            return { connectionId: replay, authorizeUrl: null };
+        const endpoint = yield* sync(() => publicUrl(draft.surface.kind === "mcp"
+            ? draft.surface.url
+            : draft.surface.baseUrl));
+        const surface = draft.surface;
+        const table = surface.kind === "openapi"
+            ? (yield* io(() => parseOpenApiTable(surface.table))).operations
+            : null;
+        const connectionId = options.ids();
+        const state = options.ids();
+        yield* sync(() => {
+            decode(identifier, connectionId);
+            sql.exec("INSERT INTO veil_connection_attempts (state, connectionId, actor, status, expiresAt) VALUES (?, ?, ?, 'pending', ?)", state, connectionId, actor, options.clock() + attemptTtlMs);
+        });
+        const addr = { ownerId, connectionId, credential: draft.credential };
+        const locator = draft.secret === undefined
+            ? null
+            : yield* options.custody.put(addr, draft.secret);
+        const stored = {
+            id: connectionId,
+            name: draft.name,
+            credential: draft.credential,
+            locator,
+            state: "active",
+            authorityVersion: 1,
+            surface: {
+                kind: draft.surface.kind,
+                url: endpoint,
+                table,
+            },
+        };
+        return yield* sync(() => transactionSync(() => {
+            authorize(actor, "manage");
+            const attempt = rows(count, "SELECT COUNT(*) AS n FROM veil_connection_attempts WHERE state = ? AND status = 'pending' AND expiresAt > ?", state, options.clock())[0];
+            if (attempt?.n !== 1)
+                throw new ConnectionsError("denied");
+            sql.exec("INSERT INTO veil_connections VALUES (?, ?, ?, ?, ?, 'active', 1)", stored.id, stored.name, JSON.stringify(stored.surface), JSON.stringify(stored.credential), stored.locator);
+            sql.exec("UPDATE veil_connection_attempts SET status = 'completed' WHERE state = ?", state);
+            sql.exec("INSERT INTO veil_connection_receipts VALUES (?, ?, ?)", draft.requestId, fingerprint(draft), JSON.stringify({ connectionId }));
+            bump();
+            return { connectionId, authorizeUrl: null };
+        })).pipe(Effect.tapError(() => sync(() => {
+            enqueueCleanup(stored);
+        })));
+    });
+    const grantTo = (actor, input) => sync(() => transactionSync(() => {
+        authorize(actor, "manage");
+        const wanted = decode(grantInputSchema, input);
+        const row = connection(wanted.connectionId);
+        if (row.state === "revoked")
+            throw new ConnectionsError("revoked");
+        if (wanted.tools === "all"
+            ? false
+            : row.surface.kind !== "mcp" && wanted.tools.length === 0)
+            throw new ConnectionsError("invalid_input");
+        const tools = JSON.stringify(wanted.tools);
+        const existing = grant(wanted.connectionId, wanted.agentId);
+        if (existing?.active === 1 && JSON.stringify(existing.tools) === tools)
+            return { grantVersion: existing.version };
+        const next = (existing?.version ?? 0) + 1;
+        sql.exec(`INSERT INTO veil_connection_grants VALUES (?, ?, ?, ?, ?, 1)
+           ON CONFLICT (connectionId, agentId) DO UPDATE SET tools = excluded.tools, grantor = excluded.grantor, version = excluded.version, active = 1`, wanted.connectionId, wanted.agentId, tools, actor, next);
+        bump();
+        return { grantVersion: next };
+    }));
+    const ungrant = (actor, input) => sync(() => {
+        transactionSync(() => {
+            authorize(actor, "manage");
+            const wanted = decode(Schema.Struct({ connectionId: identifier, agentId: identifier }), input);
+            const existing = grant(wanted.connectionId, wanted.agentId);
+            if (existing?.active !== 1)
+                return;
+            sql.exec("UPDATE veil_connection_grants SET active = 0, version = version + 1 WHERE connectionId = ? AND agentId = ?", wanted.connectionId, wanted.agentId);
+            bump();
+        });
+    });
+    const revoke = (actor, input) => Effect.gen(function* () {
+        yield* sync(() => {
+            transactionSync(() => {
+                authorize(actor, "manage");
+                const row = connection(decode(identifier, input.connectionId));
+                if (row.state === "revoked")
+                    return;
+                sql.exec("UPDATE veil_connections SET state = 'revoked', locator = NULL, authorityVersion = authorityVersion + 1 WHERE id = ?", row.id);
+                sql.exec("UPDATE veil_connection_grants SET active = 0, version = version + 1 WHERE connectionId = ? AND active = 1", row.id);
+                enqueueCleanup(row);
+                bump();
+            });
+        });
+        yield* sweep();
+    });
+    const projection = (agentId) => Effect.gen(function* () {
+        const stored = yield* sync(() => {
+            decode(identifier, agentId);
+            const revision = rows(Schema.Struct({ revision: Schema.Number }), "SELECT revision FROM veil_connection_epoch")[0]?.revision ?? 1;
+            const granted = rows(grantRow, "SELECT * FROM veil_connection_grants WHERE agentId = ? AND active = 1", agentId);
+            return {
+                revision,
+                granted: granted
+                    .map((g) => ({ g, row: connection(g.connectionId) }))
+                    .filter(({ row }) => row.state === "active"),
+            };
+        });
+        const connections = [];
+        for (const { g, row } of stored.granted) {
+            const surface = row.surface.kind === "mcp"
+                ? { kind: "mcp", url: row.surface.url }
+                : {
+                    kind: "openapi",
+                    baseUrl: row.surface.url,
+                    table: (yield* io(() => parseOpenApiTable(row.surface.table)))
+                        .operations,
+                };
+            connections.push({
+                connectionId: row.id,
+                name: row.name,
+                surface,
+                tools: g.tools,
+                authorityVersion: row.authorityVersion,
+                grantVersion: g.version,
+            });
+        }
+        return {
+            revision: stored.revision,
+            connections,
+        };
+    });
+    const list = (actor) => sync(() => {
+        authorize(actor, "manage");
+        return rows(connectionRow, "SELECT * FROM veil_connections ORDER BY id").map((row) => ({
+            connectionId: row.id,
+            name: row.name,
+            surface: {
+                kind: row.surface.kind,
+                origin: new URL(row.surface.url).origin,
+            },
+            credentialKind: row.credential.kind,
+            state: row.state,
+            authorityVersion: row.authorityVersion,
+            grants: rows(grantRow, "SELECT * FROM veil_connection_grants WHERE connectionId = ? AND active = 1", row.id).map((g) => ({
+                agentId: g.agentId,
+                tools: g.tools,
+                version: g.version,
+            })),
+        }));
+    });
+    /** The grant, the connection and the grantor must all still stand. */
+    const admitted = (agentId, ref) => {
+        decode(identifier, agentId);
+        const row = connection(ref.connectionId);
+        const held = grant(ref.connectionId, agentId);
+        if (row.state === "revoked" ||
+            held?.active !== 1 ||
+            held.version !== ref.grantVersion)
+            throw new ConnectionsError("revoked");
+        if (row.state === "reconnect_required")
+            throw new ConnectionsError("reconnect_required");
+        authorize(held.grantor, "grantor");
+        return { row, tools: held.tools };
+    };
+    const egress = (agentId, input) => {
+        const ref = decode(egressRefSchema, input);
+        return (target, init) => Effect.runPromise(Effect.gen(function* () {
+            const { row, tools } = yield* sync(() => admitted(agentId, ref));
+            const request = yield* io(() => admitRequest({ kind: row.surface.kind, url: row.surface.url }, tools, new Request(target, init), policy));
+            if (row.locator === null && row.credential.kind === "static")
+                return yield* Effect.fail(new ConnectionsError("denied"));
+            const response = yield* options.custody
+                .inject(address(row), row.locator ?? "", request)
+                .pipe(Effect.tapError((error) => error.code === "reconnect_required"
+                ? sync(() => sql.exec("UPDATE veil_connections SET state = 'reconnect_required', authorityVersion = authorityVersion + 1 WHERE id = ? AND state = 'active'", row.id))
+                : Effect.void));
+            const stillCurrent = yield* sync(() => admitted(agentId, ref)).pipe(Effect.result);
+            if (stillCurrent._tag === "Failure" ||
+                response.redirected ||
+                (response.status >= 300 && response.status < 400)) {
+                yield* io(() => response.body?.cancel() ?? Promise.resolve());
+                return yield* Effect.fail(stillCurrent._tag === "Failure"
+                    ? stillCurrent.failure
+                    : new ConnectionsError("invalid_response"));
+            }
+            return response;
+        }));
+    };
+    return {
+        begin,
+        grant: grantTo,
+        ungrant,
+        revoke,
+        projection,
+        list,
+        egress,
+        sweep,
+    };
+}

package/dist/connections/egress.d.ts

@@ -0,0 +1,8 @@
+import type { createPublicEgressPolicy } from "../public-egress-policy.js";
+import { type Tools } from "./contract.js";
+export type Endpoint = Readonly<{
+    kind: "mcp" | "openapi";
+    url: string;
+}>;
+/** One request, one verdict. The caller holds the grant; this proves the request stays inside it. */
+export declare function admitRequest(endpoint: Endpoint, tools: Tools, request: Request, policy: ReturnType<typeof createPublicEgressPolicy>): Promise<Request>;

package/dist/connections/egress.js

@@ -0,0 +1,77 @@
+import * as Schema from "effect/Schema";
+import { isJSONRPCRequest, parseJSONRPCMessage, } from "@modelcontextprotocol/client";
+import { assertPublicHostName } from "../model-key-network.js";
+import { ConnectionsError } from "./contract.js";
+const bodyLimit = 256 * 1024;
+const owned = ["authorization", "proxy-authorization", "cookie"];
+const jsonValue = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Unknown));
+const toolCall = Schema.decodeUnknownSync(Schema.Struct({ name: Schema.String }));
+/** One request, one verdict. The caller holds the grant; this proves the request stays inside it. */
+export async function admitRequest(endpoint, tools, request, policy) {
+    const target = new URL(request.url);
+    const base = new URL(endpoint.url);
+    const inside = endpoint.kind === "mcp"
+        ? target.href === base.href
+        : target.origin === base.origin &&
+            target.pathname.startsWith(base.pathname.endsWith("/") ? base.pathname : `${base.pathname}/`);
+    if (!inside ||
+        request.redirect !== "error" ||
+        target.username ||
+        target.password ||
+        owned.some((name) => request.headers.has(name)))
+        throw new ConnectionsError("denied");
+    try {
+        assertPublicHostName(target.hostname);
+        policy.destination(target);
+    }
+    catch (cause) {
+        throw new ConnectionsError("denied", { cause });
+    }
+    if (request.body === null)
+        return request;
+    const bytes = await boundedBytes(request.clone());
+    if (endpoint.kind === "mcp" && tools !== "all") {
+        let name = null;
+        try {
+            const message = parseJSONRPCMessage(jsonValue(new TextDecoder("utf-8", { fatal: true }).decode(bytes)));
+            if (isJSONRPCRequest(message) && message.method === "tools/call")
+                name = toolCall(message.params).name;
+        }
+        catch (cause) {
+            throw new ConnectionsError("denied", { cause });
+        }
+        if (name !== null && !tools.includes(name))
+            throw new ConnectionsError("denied");
+    }
+    return new Request(request.url, {
+        method: request.method,
+        headers: request.headers,
+        body: bytes,
+        redirect: request.redirect,
+        signal: request.signal,
+    });
+}
+/** Read the body once, stopping as soon as it passes the byte cap. */
+async function boundedBytes(request) {
+    const chunks = [];
+    let size = 0;
+    const reader = request.body?.getReader();
+    for (;;) {
+        const next = await reader?.read();
+        if (next === undefined || next.done)
+            break;
+        size += next.value.byteLength;
+        if (size > bodyLimit) {
+            await reader?.cancel();
+            throw new ConnectionsError("too_large");
+        }
+        chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}

package/dist/connections/index.d.ts

@@ -0,0 +1,3 @@
+export { createConnections } from "./core.js";
+export { createSealedCustody } from "./sealed.js";
+export * from "./contract.js";

package/dist/connections/index.js

@@ -0,0 +1,3 @@
+export { createConnections } from "./core.js";
+export { createSealedCustody } from "./sealed.js";
+export * from "./contract.js";

package/dist/connections/sealed.d.ts

@@ -0,0 +1,21 @@
+import { type CustodyAdapter } from "./contract.js";
+/**
+ * The slice of Veil's one credential store (`createCredentialStore`) that sealed
+ * custody needs: ciphertext at rest, the secret released only into a callback.
+ */
+export type CredentialVault = Readonly<{
+    put: (input: {
+        kind: string;
+        label: string;
+        secret: string;
+    }) => Promise<{
+        credentialId: string;
+    }>;
+    withSecret: <T>(credentialId: string, action: (secret: string) => Promise<T> | T) => Promise<T>;
+    remove: (credentialId: string) => Promise<"deleted" | "absent">;
+}>;
+/** Default custody: a thin adapter over the shared credential store. `send` is the checked public transport. */
+export declare function createSealedCustody(options: {
+    vault: CredentialVault;
+    send: (request: Request) => Promise<Response>;
+}): CustodyAdapter;

package/dist/connections/sealed.js

@@ -0,0 +1,54 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { ConnectionsError, } from "./contract.js";
+/** Where a static secret rides on the final request. */
+function applyPlacement(request, placement, secret) {
+    if (placement !== "bearer" && "query" in placement) {
+        const target = new URL(request.url);
+        target.searchParams.set(placement.query, secret);
+        return new Request(target.href, request);
+    }
+    const headers = new Headers(request.headers);
+    if (placement === "bearer")
+        headers.set("authorization", `Bearer ${secret}`);
+    else
+        headers.set(placement.header, secret);
+    return new Request(request, { headers });
+}
+const failure = Schema.decodeUnknownSync(Schema.Struct({ code: Schema.String }));
+const refusal = (cause) => {
+    if (cause instanceof ConnectionsError)
+        return cause;
+    try {
+        const { code } = failure(cause);
+        return new ConnectionsError(code === "absent" || code === "denied"
+            ? "reconnect_required"
+            : "unavailable", { cause });
+    }
+    catch {
+        return new ConnectionsError("unavailable", { cause });
+    }
+};
+/** Default custody: a thin adapter over the shared credential store. `send` is the checked public transport. */
+export function createSealedCustody(options) {
+    return {
+        put: (address, secret) => Effect.tryPromise({
+            try: async () => (await options.vault.put({
+                kind: "connection",
+                label: address.connectionId,
+                secret,
+            })).credentialId,
+            catch: refusal,
+        }),
+        inject: (address, locator, request) => Effect.tryPromise({
+            try: () => options.vault.withSecret(locator, (secret) => options.send(address.credential.kind === "static"
+                ? applyPlacement(request, address.credential.placement, secret)
+                : request)),
+            catch: refusal,
+        }),
+        remove: (_address, locator) => Effect.tryPromise({
+            try: () => options.vault.remove(locator),
+            catch: refusal,
+        }),
+    };
+}

package/dist/credential-store.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Veil's one encrypted credential store. A host holds a dedicated 32-byte
+ * master key as a host secret; credentials (model API keys, connector tokens)
+ * are sealed under it with WebCrypto AES-GCM, bound to an owner address, and
+ * leave the store only into a callback. Listings carry no secret.
+ */
+/** Stable, secret-free reason a credential could not be sealed, opened or stored. */
+export declare class CredentialError extends Error {
+    readonly code: "unavailable" | "denied" | "absent" | "limit";
+    constructor(code: "unavailable" | "denied" | "absent" | "limit");
+}
+/** Dedicated 32-byte base64url keys; the active key seals, retained keys open. */
+export type CredentialKeyring = Readonly<{
+    activeKeyId: string;
+    keys: Readonly<Record<string, string>>;
+}>;
+/**
+ * WebCrypto owns authenticated encryption. `domain` and `context` are the
+ * additional authenticated data: a sealed value opens only for its own owner.
+ */
+export declare function createCredentialSealer(configuration: CredentialKeyring, domain: string): {
+    seal(context: readonly (string | null)[], credential: string): Promise<string>;
+    open(context: readonly (string | null)[], sealed: string): Promise<string>;
+};
+export type CredentialSealer = ReturnType<typeof createCredentialSealer>;
+/** What a listing shows: no secret, no ciphertext. */
+export type CredentialRecord = Readonly<{
+    credentialId: string;
+    kind: string;
+    label: string;
+    createdAt: number;
+    validatedAt: number;
+}>;
+/** One stored row: the listing fields plus the sealed envelope. */
+export type StoredCredential = CredentialRecord & Readonly<{
+    sealed: string;
+}>;
+/** Durable Object style key-value storage; the store owns the `credential:` prefix. */
+export type CredentialStorage = Readonly<{
+    get(key: string): Promise<StoredCredential | undefined>;
+    put(key: string, value: StoredCredential): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    list(prefix: string): Promise<Map<string, StoredCredential>>;
+}>;
+export declare function createCredentialStore(options: {
+    storage: CredentialStorage;
+    sealer: CredentialSealer;
+    now?: () => number;
+    /** Most credentials one store holds. */
+    limit?: number;
+}): {
+    /** Seal one credential bound to its id and kind. */
+    put(input: {
+        kind: string;
+        label: string;
+        secret: string;
+    }): Promise<CredentialRecord>;
+    list(kind?: string): Promise<readonly CredentialRecord[]>;
+    get(credentialId: string): Promise<CredentialRecord | null>;
+    remove(credentialId: string): Promise<"deleted" | "absent">;
+    /** The only way out: the secret exists for the callback and nowhere else. */
+    withSecret<T>(credentialId: string, action: (secret: string, record: CredentialRecord) => Promise<T> | T): Promise<T>;
+};
+export type CredentialStore = ReturnType<typeof createCredentialStore>;

package/dist/credential-store.js

@@ -0,0 +1,151 @@
+import { Buffer } from "node:buffer";
+import * as Schema from "effect/Schema";
+import { defineIdFamily } from "@fungi.computer/cairn";
+/**
+ * Veil's one encrypted credential store. A host holds a dedicated 32-byte
+ * master key as a host secret; credentials (model API keys, connector tokens)
+ * are sealed under it with WebCrypto AES-GCM, bound to an owner address, and
+ * leave the store only into a callback. Listings carry no secret.
+ */
+/** Stable, secret-free reason a credential could not be sealed, opened or stored. */
+export class CredentialError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "CredentialError";
+    }
+}
+const keySchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/u)));
+const keyIdSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/u)));
+const envelopeSchema = Schema.Struct({
+    version: Schema.Literal(1),
+    keyId: keyIdSchema,
+    iv: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{16}$/u))),
+    ciphertext: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{22,22000}$/u))),
+});
+const encoder = new TextEncoder();
+/**
+ * WebCrypto owns authenticated encryption. `domain` and `context` are the
+ * additional authenticated data: a sealed value opens only for its own owner.
+ */
+export function createCredentialSealer(configuration, domain) {
+    const keys = new Map();
+    let activeKeyId;
+    try {
+        activeKeyId = Schema.decodeUnknownSync(keyIdSchema)(configuration.activeKeyId);
+        for (const [id, encoded] of Object.entries(configuration.keys)) {
+            Schema.decodeUnknownSync(keyIdSchema)(id);
+            const parsed = Schema.decodeUnknownSync(keySchema)(encoded);
+            const bytes = Uint8Array.from(Buffer.from(parsed, "base64url"));
+            if (bytes.length !== 32)
+                throw new CredentialError("unavailable");
+            keys.set(id, crypto.subtle.importKey("raw", bytes, "AES-GCM", false, [
+                "encrypt",
+                "decrypt",
+            ]));
+        }
+        if (!keys.has(activeKeyId))
+            throw new CredentialError("unavailable");
+    }
+    catch {
+        throw new CredentialError("unavailable");
+    }
+    const key = (id) => {
+        const found = keys.get(id);
+        if (!found)
+            throw new CredentialError("denied");
+        return found;
+    };
+    const binding = (keyId, context) => encoder.encode(JSON.stringify([domain, keyId, ...context]));
+    return {
+        async seal(context, credential) {
+            const iv = crypto.getRandomValues(new Uint8Array(12));
+            const ciphertext = await crypto.subtle.encrypt({
+                name: "AES-GCM",
+                iv,
+                additionalData: binding(activeKeyId, context),
+            }, await key(activeKeyId), encoder.encode(credential));
+            return JSON.stringify({
+                version: 1,
+                keyId: activeKeyId,
+                iv: Buffer.from(iv).toString("base64url"),
+                ciphertext: Buffer.from(ciphertext).toString("base64url"),
+            });
+        },
+        async open(context, sealed) {
+            try {
+                const envelope = Schema.decodeUnknownSync(Schema.fromJsonString(envelopeSchema))(sealed);
+                const plaintext = await crypto.subtle.decrypt({
+                    name: "AES-GCM",
+                    iv: Uint8Array.from(Buffer.from(envelope.iv, "base64url")),
+                    additionalData: binding(envelope.keyId, context),
+                }, await key(envelope.keyId), Uint8Array.from(Buffer.from(envelope.ciphertext, "base64url")));
+                return new TextDecoder().decode(plaintext);
+            }
+            catch {
+                throw new CredentialError("denied");
+            }
+        },
+    };
+}
+const ids = defineIdFamily({
+    family: "veil-credential",
+    version: 1,
+    kinds: { credential: { prefix: "cred" } },
+});
+const prefix = "credential:";
+export function createCredentialStore(options) {
+    const now = options.now ?? Date.now;
+    const limit = options.limit ?? 64;
+    const publicRecord = (row) => ({
+        credentialId: row.credentialId,
+        kind: row.kind,
+        label: row.label,
+        createdAt: row.createdAt,
+        validatedAt: row.validatedAt,
+    });
+    const row = async (credentialId) => options.storage.get(`${prefix}${credentialId}`);
+    return {
+        /** Seal one credential bound to its id and kind. */
+        async put(input) {
+            if ((await options.storage.list(prefix)).size >= limit)
+                throw new CredentialError("limit");
+            const credentialId = ids.credential.generate();
+            const at = now();
+            const stored = {
+                credentialId,
+                kind: input.kind,
+                label: input.label,
+                createdAt: at,
+                validatedAt: at,
+                sealed: await options.sealer.seal([credentialId, input.kind], input.secret),
+            };
+            await options.storage.put(`${prefix}${credentialId}`, stored);
+            return publicRecord(stored);
+        },
+        async list(kind) {
+            return [...(await options.storage.list(prefix)).values()]
+                .filter((item) => kind === undefined || item.kind === kind)
+                .map(publicRecord)
+                .sort((a, b) => a.createdAt - b.createdAt);
+        },
+        async get(credentialId) {
+            const found = await row(credentialId);
+            return found === undefined ? null : publicRecord(found);
+        },
+        async remove(credentialId) {
+            return (await options.storage.delete(`${prefix}${credentialId}`))
+                ? "deleted"
+                : "absent";
+        },
+        /** The only way out: the secret exists for the callback and nowhere else. */
+        async withSecret(credentialId, action) {
+            const found = await row(credentialId);
+            if (found === undefined)
+                throw new CredentialError("absent");
+            const secret = await options.sealer.open([found.credentialId, found.kind], found.sealed);
+            return action(secret, publicRecord(found));
+        },
+    };
+}

package/dist/index.d.ts

@@ -227,7 +227,7 @@ export declare function createGitHubConnections(options: Readonly<{
         status: "completed";
         connectionId: string;
         authorityVersion: number;
-        custody: "deleted" | "absent";
+        custody: "absent" | "deleted";
     }>;
     readRepository: (binding: ReadBinding, signal?: AbortSignal) => Promise<{
         id: number;

package/dist/model-keys.d.ts

@@ -11,6 +11,30 @@ export declare function isModelKeyProvider(value: string): value is ModelKeyProv
 export declare function modelKeyBaseUrl(provider: ModelKeyProvider, configured?: string | null, options?: Readonly<{
     allowLocalDev?: boolean;
 }>): string;
+/** A stored key as an owner sees it: no secret, no custody locator. */
+export type ModelKeyRecord = Readonly<{
+    keyId: string;
+    provider: ModelKeyProvider;
+    label: string;
+    createdAt: number;
+    validatedAt: number;
+}>;
+/**
+ * The neutral model-key seam every host composes: standalone Oyster over
+ * Veil's credential store, the Hub over its Nango custodian. `seal` validates
+ * with the provider before storing; `send` is the only place a key meets a
+ * request.
+ */
+export type ModelKeyVault = Readonly<{
+    seal: (input: Readonly<{
+        provider: string;
+        label: string;
+        apiKey: string;
+    }>) => Promise<ModelKeyRecord>;
+    list: () => Promise<readonly ModelKeyRecord[]>;
+    remove: (keyId: string) => Promise<"deleted" | "absent">;
+    send: (keyId: string, request: Request) => Promise<Response>;
+}>;
 /** Private to the Team owner and the custodian adapter; never a public field. */
 export type ModelKeyAccess = Readonly<{
     locator: string;

package/dist/openapi-secrets.d.ts

@@ -1,5 +1,5 @@
 import { type OpenApiCredentialKeyring, type OpenApiAccess } from "./openapi-contract.js";
-/** WebCrypto owns authenticated encryption; the owner address and policy are its AAD. */
+/** Connector credentials sealed by Veil's one credential sealer. */
 export declare function createOpenApiSecrets(configuration: OpenApiCredentialKeyring): {
     seal(access: OpenApiAccess, credential: string): Promise<string>;
     open(access: OpenApiAccess, sealed: string): Promise<string>;

package/dist/openapi-secrets.js

@@ -1,76 +1,37 @@
-import { Buffer } from "node:buffer";
-import * as Schema from "effect/Schema";
 import { OpenApiError, } from "./openapi-contract.js";
-const keySchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/u)));
-const keyIdSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/u)));
-const envelopeSchema = Schema.Struct({
-    version: Schema.Literal(1),
-    keyId: keyIdSchema,
-    iv: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{16}$/u))),
-    ciphertext: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{22,22000}$/u))),
-});
-const encoder = new TextEncoder();
-const binding = (access, keyId) => encoder.encode(JSON.stringify([
-    "fungi.veil.openapi.v1",
-    keyId,
+import { createCredentialSealer } from "./credential-store.js";
+/** The connector's owner address and policy are the sealed value's context. */
+const context = (access) => [
     access.teamId,
     access.connectorId,
     access.baseUrl,
     access.auth.kind,
-    access.auth.kind === "api_key_header" ||
-        access.auth.kind === "api_key_query"
+    access.auth.kind === "api_key_header" || access.auth.kind === "api_key_query"
         ? access.auth.param
         : null,
-]));
-/** WebCrypto owns authenticated encryption; the owner address and policy are its AAD. */
+];
+/** Connector credentials sealed by Veil's one credential sealer. */
 export function createOpenApiSecrets(configuration) {
-    const keys = new Map();
-    let activeKeyId;
-    try {
-        activeKeyId = Schema.decodeUnknownSync(keyIdSchema)(configuration.activeKeyId);
-        for (const [id, encoded] of Object.entries(configuration.keys)) {
-            Schema.decodeUnknownSync(keyIdSchema)(id);
-            const parsed = Schema.decodeUnknownSync(keySchema)(encoded);
-            const bytes = Uint8Array.from(Buffer.from(parsed, "base64url"));
-            if (bytes.length !== 32)
-                throw new OpenApiError("unavailable");
-            keys.set(id, crypto.subtle.importKey("raw", bytes, "AES-GCM", false, [
-                "encrypt",
-                "decrypt",
-            ]));
+    const sealer = (() => {
+        try {
+            return createCredentialSealer(configuration, "fungi.veil.openapi.v1");
         }
-        if (!keys.has(activeKeyId))
+        catch {
             throw new OpenApiError("unavailable");
-    }
-    catch {
-        throw new OpenApiError("unavailable");
-    }
-    const key = (id) => {
-        const found = keys.get(id);
-        if (!found)
-            throw new OpenApiError("denied");
-        return found;
-    };
+        }
+    })();
     return {
         async seal(access, credential) {
-            const iv = crypto.getRandomValues(new Uint8Array(12));
-            const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: binding(access, activeKeyId) }, await key(activeKeyId), encoder.encode(credential));
-            return JSON.stringify({
-                version: 1,
-                keyId: activeKeyId,
-                iv: Buffer.from(iv).toString("base64url"),
-                ciphertext: Buffer.from(ciphertext).toString("base64url"),
-            });
+            try {
+                return await sealer.seal(context(access), credential);
+            }
+            catch {
+                throw new OpenApiError("denied");
+            }
         },
         async open(access, sealed) {
             try {
-                const envelope = Schema.decodeUnknownSync(Schema.fromJsonString(envelopeSchema))(sealed);
-                const plaintext = await crypto.subtle.decrypt({
-                    name: "AES-GCM",
-                    iv: Uint8Array.from(Buffer.from(envelope.iv, "base64url")),
-                    additionalData: binding(access, envelope.keyId),
-                }, await key(envelope.keyId), Uint8Array.from(Buffer.from(envelope.ciphertext, "base64url")));
-                return new TextDecoder().decode(plaintext);
+                return await sealer.open(context(access), sealed);
             }
             catch {
                 throw new OpenApiError("denied");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/veil",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "author": "Levi <levi@technomancy.dev>",
   "description": "Team-authorized credential custody and provider access",
   "type": "module",
@@ -23,6 +23,10 @@
       "types": "./dist/model-credentials.d.ts",
       "import": "./dist/model-credentials.js"
     },
+    "./credential-store": {
+      "types": "./dist/credential-store.d.ts",
+      "import": "./dist/credential-store.js"
+    },
     "./model-keys": {
       "types": "./dist/model-keys.d.ts",
       "import": "./dist/model-keys.js"
@@ -78,6 +82,10 @@
     "./owned-infrastructure": {
       "types": "./dist/owned-infrastructure.d.ts",
       "import": "./dist/owned-infrastructure.js"
+    },
+    "./connections": {
+      "types": "./dist/connections/index.d.ts",
+      "import": "./dist/connections/index.js"
     }
   },
   "files": [
@@ -87,6 +95,8 @@
   ],
   "dependencies": {
     "@fungi.computer/cairn": "0.1.0",
+    "@fungi.computer/forage": "0.3.1",
+    "@modelcontextprotocol/client": "2.0.0",
     "@nangohq/node": "0.71.6",
     "effect": "4.0.2",
     "http-parser-js": "0.5.10",
@@ -94,6 +104,7 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
+    "@fungi.computer/watchdog": "0.1.0",
     "@types/node": "24.13.3",
     "typescript": "5.9.3",
     "vitest": "4.1.11"