@fungi.computer/veil 0.3.0 → 0.5.0

package/dist/connections/oauth.js

@@ -0,0 +1,239 @@
+import * as Schema from "effect/Schema";
+import { ConnectionsError } from "./contract.js";
+/** Early-refresh margin so a token never expires mid-request. */
+const skewMs = 30_000;
+const tokensSchema = Schema.Struct({
+    access_token: Schema.String,
+    refresh_token: Schema.optional(Schema.String),
+    /** Seconds the access token lives, as the authorization server said. */
+    expires_in: Schema.optional(Schema.Number),
+    obtainedAt: Schema.Number,
+});
+const clientSchema = Schema.Struct({
+    client_id: Schema.String,
+    client_secret: Schema.optional(Schema.String),
+});
+/**
+ * Everything custody seals for one OAuth connection or attempt: the client,
+ * the authorization server it was issued by, the PKCE verifier while an
+ * attempt is pending, and the token set once it completes.
+ */
+const oauthBundleSchema = Schema.Struct({
+    authorizationServerUrl: Schema.String,
+    /** The operator-registered provider this was issued by, when there is one. */
+    provider: Schema.optional(Schema.String),
+    resource: Schema.optional(Schema.String),
+    client: clientSchema,
+    codeVerifier: Schema.optional(Schema.String),
+    tokens: Schema.optional(tokensSchema),
+});
+export const oauthClientJson = Schema.fromJsonString(clientSchema);
+export const oauthBundleJson = Schema.fromJsonString(oauthBundleSchema);
+export const tokenExpired = (bundle, now) => {
+    const tokens = bundle.tokens;
+    return (tokens?.expires_in !== undefined &&
+        tokens.obtainedAt + tokens.expires_in * 1000 - skewMs <= now);
+};
+/** The SDK's exact-optional client shape. */
+const clientInfo = (client) => client.client_secret === undefined
+    ? { client_id: client.client_id }
+    : { client_id: client.client_id, client_secret: client.client_secret };
+const emptyCapture = () => ({
+    authorizeUrl: undefined,
+    codeVerifier: undefined,
+    client: undefined,
+    authorizationServerUrl: undefined,
+    resource: undefined,
+    tokens: undefined,
+});
+function provider(flow, captured) {
+    const provided = flow.own ?? captured.client;
+    const metadata = () => {
+        const base = {
+            redirect_uris: [flow.callbackUrl],
+            client_name: "Fungi Oyster",
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: provided?.client_secret === undefined ? "none" : "client_secret_post",
+        };
+        if (flow.scope !== undefined)
+            base.scope = flow.scope;
+        return base;
+    };
+    const base = {
+        redirectUrl: flow.callbackUrl,
+        get clientMetadata() {
+            return metadata();
+        },
+        clientInformation: async (ctx) => {
+            const known = captured.client ??
+                (ctx === undefined
+                    ? undefined
+                    : await flow.registry?.lookup(ctx.issuer));
+            return known === undefined ? undefined : clientInfo(known);
+        },
+        saveClientInformation: async (info, ctx) => {
+            const client = {
+                client_id: info.client_id,
+                client_secret: info.client_secret,
+            };
+            captured.client = client;
+            if (ctx !== undefined && flow.own === undefined)
+                await flow.registry?.save(ctx.issuer, client);
+        },
+        tokens: () => undefined,
+        saveTokens: (tokens) => {
+            captured.tokens = {
+                access_token: tokens.access_token,
+                refresh_token: tokens.refresh_token,
+                expires_in: tokens.expires_in,
+                obtainedAt: flow.now,
+            };
+        },
+        redirectToAuthorization: (url) => {
+            captured.authorizeUrl = url;
+        },
+        saveCodeVerifier: (verifier) => {
+            captured.codeVerifier = verifier;
+        },
+        codeVerifier: () => {
+            const verifier = captured.codeVerifier ?? flow.resumed?.codeVerifier;
+            if (verifier === undefined)
+                throw new ConnectionsError("denied");
+            return verifier;
+        },
+        saveDiscoveryState: (found) => {
+            captured.authorizationServerUrl = found.authorizationServerUrl;
+            captured.resource = found.resourceMetadata?.resource;
+        },
+        saveResourceUrl: (url) => {
+            captured.resource = url;
+        },
+    };
+    if (flow.state !== undefined) {
+        const state = flow.state;
+        base.state = () => state;
+    }
+    if (flow.resumed !== undefined) {
+        const authorizationServerUrl = flow.resumed.authorizationServerUrl;
+        base.discoveryState = () => ({ authorizationServerUrl });
+    }
+    return base;
+}
+function authOptions(serverUrl, fetchFn, extra) {
+    const options = { serverUrl, fetchFn };
+    if (extra.scope !== undefined)
+        options.scope = extra.scope;
+    if (extra.code !== undefined)
+        options.authorizationCode = extra.code;
+    if (extra.iss !== undefined)
+        options.iss = extra.iss;
+    return options;
+}
+/** Discovery, registration and PKCE through the SDK; returns the redirect and the sealed attempt. */
+export async function startAuthorization(input) {
+    const captured = emptyCapture();
+    captured.client = input.client;
+    const flow = provider({
+        callbackUrl: input.callbackUrl,
+        scope: input.scope,
+        now: 0,
+        resumed: undefined,
+        state: input.state,
+        registry: input.registry,
+        own: input.client,
+    }, captured);
+    const sdk = await import("@modelcontextprotocol/client");
+    const result = await sdk.auth(flow, authOptions(input.serverUrl, input.fetch, { scope: input.scope }));
+    if (result !== "REDIRECT" ||
+        captured.authorizeUrl === undefined ||
+        captured.client === undefined ||
+        captured.codeVerifier === undefined ||
+        captured.authorizationServerUrl === undefined)
+        throw new ConnectionsError("invalid_response");
+    return {
+        authorizeUrl: captured.authorizeUrl.href,
+        bundle: {
+            authorizationServerUrl: captured.authorizationServerUrl,
+            client: captured.client,
+            codeVerifier: captured.codeVerifier,
+            resource: captured.resource,
+            tokens: undefined,
+        },
+    };
+}
+/** Redeem the code; the SDK validates `iss` and PKCE. The issuer must be the one the attempt began with. */
+export async function finishAuthorization(input) {
+    const { bundle } = input;
+    if (bundle.codeVerifier === undefined)
+        throw new ConnectionsError("denied");
+    const captured = emptyCapture();
+    captured.client = bundle.client;
+    const flow = provider({
+        callbackUrl: input.callbackUrl,
+        scope: undefined,
+        now: input.now,
+        resumed: {
+            authorizationServerUrl: bundle.authorizationServerUrl,
+            codeVerifier: bundle.codeVerifier,
+        },
+        state: undefined,
+        registry: undefined,
+        own: bundle.client,
+    }, captured);
+    const sdk = await import("@modelcontextprotocol/client");
+    const result = await sdk.auth(flow, authOptions(input.serverUrl, input.fetch, {
+        code: input.code,
+        iss: input.iss,
+    }));
+    if (result !== "AUTHORIZED" ||
+        captured.tokens === undefined ||
+        captured.authorizationServerUrl !== bundle.authorizationServerUrl)
+        throw new ConnectionsError("denied");
+    return {
+        authorizationServerUrl: bundle.authorizationServerUrl,
+        client: bundle.client,
+        resource: captured.resource ?? bundle.resource,
+        codeVerifier: undefined,
+        tokens: captured.tokens,
+    };
+}
+/**
+ * One refresh grant. A rotated refresh token replaces the old one; the caller
+ * persists the returned bundle before using the new access token.
+ */
+export async function refreshTokens(input) {
+    const { bundle } = input;
+    const held = bundle.tokens?.refresh_token;
+    if (held === undefined)
+        throw new ConnectionsError("reconnect_required");
+    const sdk = await import("@modelcontextprotocol/client");
+    try {
+        const metadata = await sdk.discoverAuthorizationServerMetadata(bundle.authorizationServerUrl, { fetchFn: input.fetch });
+        const options = {
+            clientInformation: clientInfo(bundle.client),
+            refreshToken: held,
+            fetchFn: input.fetch,
+        };
+        if (metadata !== undefined)
+            options.metadata = metadata;
+        if (bundle.resource !== undefined)
+            options.resource = new URL(bundle.resource);
+        const fresh = await sdk.refreshAuthorization(bundle.authorizationServerUrl, options);
+        return {
+            ...bundle,
+            tokens: {
+                access_token: fresh.access_token,
+                refresh_token: fresh.refresh_token ?? held,
+                expires_in: fresh.expires_in,
+                obtainedAt: input.now,
+            },
+        };
+    }
+    catch (cause) {
+        // The server no longer honours the grant: only a new authorization helps.
+        if (sdk.OAuthError.isInstance(cause) && cause.code === "invalid_grant")
+            throw new ConnectionsError("reconnect_required", { cause });
+        throw cause;
+    }
+}

package/dist/connections/openapi.d.ts

@@ -0,0 +1,36 @@
+import type { OpenApiOperation } from "@fungi.computer/forage/openapi";
+import { z } from "zod";
+import { type Tools } from "./contract.js";
+/** Stored operations are decoded again on every use; the digest binds what the owner approved. */
+export declare function decodeTable(stored: readonly unknown[] | null | undefined): Promise<{
+    operations: {
+        status: "supported";
+        name: string;
+        method: "GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE";
+        path: string;
+        effect: "write" | "read";
+        description: string & z.core.$brand<"ThirdPartyText">;
+        textSource: "third_party";
+        tags: (string & z.core.$brand<"ThirdPartyText">)[];
+        parameters: {
+            name: string;
+            in: "header" | "path" | "query";
+            required: boolean;
+            schema: boolean | Record<string, z.core.util.JSONType>;
+            style?: string | undefined;
+            explode?: boolean | undefined;
+            allowReserved?: boolean | undefined;
+        }[];
+        input: boolean | Record<string, z.core.util.JSONType>;
+        output: boolean | Record<string, z.core.util.JSONType>;
+    }[];
+    digest: string;
+}>;
+/** Whether a grant admits one operation by name and stored effect. */
+export declare function admits(tools: Tools, operation: Pick<OpenApiOperation, "name" | "effect">): boolean;
+/** Builds only a stored operation's request; the core alone attaches the credential. */
+export declare function operationRequest(baseUrl: string, operation: OpenApiOperation, rawInput: unknown): Promise<Request>;
+/** The stored output schema is the contract for what an Agent may see. */
+export declare function operationOutput(operation: OpenApiOperation, text: string): Promise<z.core.util.JSONType>;
+/** A response body as text, refusing more than the response cap. */
+export declare function boundedText(response: Response): Promise<string>;

package/dist/connections/openapi.js

@@ -0,0 +1,120 @@
+import * as Schema from "effect/Schema";
+import { z } from "zod";
+import { ConnectionsError } from "./contract.js";
+/** Stored operations are decoded again on every use; the digest binds what the owner approved. */
+export async function decodeTable(stored) {
+    try {
+        // Forage loads on first use, never at Team startup.
+        const { parseOpenApiTable } = await import("@fungi.computer/forage/openapi");
+        return await parseOpenApiTable(stored);
+    }
+    catch (cause) {
+        throw new ConnectionsError("unavailable", { cause });
+    }
+}
+/** Whether a grant admits one operation by name and stored effect. */
+export function admits(tools, operation) {
+    if (tools === "all")
+        return true;
+    if (Array.isArray(tools))
+        return tools.includes(operation.name);
+    return operation.effect === "read";
+}
+function hasControlCharacters(value) {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code < 32 || code === 127)
+            return true;
+    }
+    return false;
+}
+/** Builds only a stored operation's request; the core alone attaches the credential. */
+export async function operationRequest(baseUrl, operation, rawInput) {
+    const { jsonSchemaToZod } = await import("@fungi.computer/forage");
+    try {
+        const input = z
+            .record(z.string(), z.json())
+            .parse(jsonSchemaToZod(operation.input).parse(rawInput));
+        const base = new URL(baseUrl);
+        let path = operation.path;
+        const headers = new Headers();
+        const query = new URLSearchParams();
+        for (const parameter of operation.parameters) {
+            const value = input[parameter.name];
+            if (value === undefined || value === null)
+                continue;
+            const scalar = z
+                .union([z.string(), z.number(), z.boolean()])
+                .parse(value);
+            if (parameter.in === "path") {
+                const segment = String(scalar);
+                if (!segment ||
+                    segment === "." ||
+                    segment === ".." ||
+                    segment.includes("/") ||
+                    segment.includes("\\") ||
+                    hasControlCharacters(segment) ||
+                    /%(?:2e|2f|5c|25)/iu.test(segment))
+                    throw new ConnectionsError("invalid_input");
+                path = path.replace(`{${parameter.name}}`, encodeURIComponent(segment));
+            }
+            else if (parameter.in === "query")
+                query.set(parameter.name, String(scalar));
+            else
+                headers.set(parameter.name, String(scalar));
+        }
+        const basePath = `${base.pathname.replace(/\/$/u, "")}/`;
+        const url = new URL(`${basePath}${path.slice(1)}`, base.origin);
+        if (url.origin !== base.origin || !url.pathname.startsWith(basePath))
+            throw new ConnectionsError("invalid_input");
+        url.search = query.toString();
+        const body = input.body === undefined ? undefined : JSON.stringify(input.body);
+        if (body !== undefined)
+            headers.set("Content-Type", "application/json");
+        const init = {
+            method: operation.method,
+            headers,
+            redirect: "error",
+        };
+        if (body !== undefined)
+            init.body = body;
+        return new Request(url, init);
+    }
+    catch (cause) {
+        if (cause instanceof ConnectionsError)
+            throw cause;
+        throw new ConnectionsError("invalid_input", { cause });
+    }
+}
+/** The stored output schema is the contract for what an Agent may see. */
+export async function operationOutput(operation, text) {
+    const { jsonSchemaToZod } = await import("@fungi.computer/forage");
+    try {
+        return z
+            .json()
+            .parse(jsonSchemaToZod(operation.output).parse(Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Unknown))(text)));
+    }
+    catch (cause) {
+        throw new ConnectionsError("invalid_response", { cause });
+    }
+}
+const responseLimit = 4 * 1024 * 1024;
+/** A response body as text, refusing more than the response cap. */
+export async function boundedText(response) {
+    const reader = response.body?.getReader();
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    let size = 0;
+    let text = "";
+    for (;;) {
+        const next = await reader?.read();
+        if (next === undefined || next.done)
+            break;
+        size += next.value.byteLength;
+        if (size > responseLimit) {
+            await reader?.cancel();
+            throw new ConnectionsError("too_large");
+        }
+        text += decoder.decode(next.value, { stream: true });
+    }
+    return text + decoder.decode();
+}

package/dist/connections/sealed.d.ts

@@ -0,0 +1,21 @@
+import { type CustodyAdapter } from "./contract.js";
+/**
+ * The slice of Veil's one credential store (`createCredentialStore`) that sealed
+ * custody needs: ciphertext at rest, the secret released only into a callback.
+ */
+export type CredentialVault = Readonly<{
+    put: (input: {
+        kind: string;
+        label: string;
+        secret: string;
+    }) => Promise<{
+        credentialId: string;
+    }>;
+    withSecret: <T>(credentialId: string, action: (secret: string) => Promise<T> | T) => Promise<T>;
+    remove: (credentialId: string) => Promise<"deleted" | "absent">;
+}>;
+/** Default custody: a thin adapter over the shared credential store. `send` is the checked public transport. */
+export declare function createSealedCustody(options: {
+    vault: CredentialVault;
+    send: (request: Request) => Promise<Response>;
+}): CustodyAdapter;

package/dist/connections/sealed.js

@@ -0,0 +1,73 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { oauthBundleJson } from "./oauth.js";
+import { ConnectionsError, } from "./contract.js";
+/** Where a static secret rides on the final request. */
+function applyPlacement(request, placement, secret) {
+    if (placement !== "bearer" && "query" in placement) {
+        const target = new URL(request.url);
+        target.searchParams.set(placement.query, secret);
+        return new Request(target.href, request);
+    }
+    const headers = new Headers(request.headers);
+    if (placement === "bearer")
+        headers.set("authorization", `Bearer ${secret}`);
+    else
+        headers.set(placement.header, secret);
+    return new Request(request, { headers });
+}
+const failure = Schema.decodeUnknownSync(Schema.Struct({ code: Schema.String }));
+const refusal = (cause) => {
+    if (cause instanceof ConnectionsError)
+        return cause;
+    try {
+        const { code } = failure(cause);
+        return new ConnectionsError(code === "absent" || code === "denied"
+            ? "reconnect_required"
+            : "unavailable", { cause });
+    }
+    catch {
+        return new ConnectionsError("unavailable", { cause });
+    }
+};
+/** Attach the sealed secret the way the credential says. */
+function authorized(credential, secret, request) {
+    if (credential.kind === "static")
+        return applyPlacement(request, credential.placement, secret);
+    if (credential.kind === "none")
+        return request;
+    const bundle = Schema.decodeUnknownOption(oauthBundleJson)(secret);
+    if (bundle._tag === "None" || bundle.value.tokens === undefined)
+        throw new ConnectionsError("reconnect_required");
+    return applyPlacement(request, "bearer", bundle.value.tokens.access_token);
+}
+/** Default custody: a thin adapter over the shared credential store. `send` is the checked public transport. */
+export function createSealedCustody(options) {
+    return {
+        put: (address, secret) => Effect.tryPromise({
+            try: async () => (await options.vault.put({
+                kind: "connection",
+                label: address.connectionId,
+                secret,
+            })).credentialId,
+            catch: refusal,
+        }),
+        inject: (address, locator, request) => address.credential.kind === "none"
+            ? Effect.tryPromise({
+                try: () => options.send(request),
+                catch: refusal,
+            })
+            : Effect.tryPromise({
+                try: () => options.vault.withSecret(locator, (secret) => options.send(authorized(address.credential, secret, request))),
+                catch: refusal,
+            }),
+        open: (_address, locator) => Effect.tryPromise({
+            try: () => options.vault.withSecret(locator, (secret) => secret),
+            catch: refusal,
+        }),
+        remove: (_address, locator) => Effect.tryPromise({
+            try: () => options.vault.remove(locator),
+            catch: refusal,
+        }),
+    };
+}

package/dist/connections/source.d.ts

@@ -0,0 +1,17 @@
+import { type CapabilitySource } from "@fungi.computer/mycelium";
+import { z } from "zod";
+import { type ConnectionProjection, type EgressRef } from "./contract.js";
+/**
+ * The Agent half for OpenAPI connections: one Mycelium module per granted
+ * connection, its operations built from the stored table and admitted by the
+ * grant. Every call is completed by the owner; nothing here holds a credential.
+ * MCP connections stay with the host's Knapsack source.
+ */
+export declare function connectionsSource(input: {
+    id: string;
+    /** Told when a granted connection cannot be offered, with its id and nothing else. */
+    onSkipped?: (connectionId: string) => void;
+    read: () => Promise<ConnectionProjection>;
+    subscribe: (invalidate: () => void) => () => void;
+    call: (ref: EgressRef, operation: string, arguments_: z.core.output<ReturnType<typeof z.json>>) => Promise<z.core.output<ReturnType<typeof z.json>>>;
+}): CapabilitySource;

package/dist/connections/source.js

@@ -0,0 +1,111 @@
+import { CapabilityFailed, Mycelium, } from "@fungi.computer/mycelium";
+import { jsonSchemaToZod } from "@fungi.computer/forage";
+import * as Effect from "effect/Effect";
+import { z } from "zod";
+import { ConnectionsError, } from "./contract.js";
+import { admits, decodeTable } from "./openapi.js";
+/** A table that no longer decodes is not offered; the caller is told which connection. */
+async function tryDecode(table) {
+    const outcome = await Effect.runPromise(Effect.result(Effect.tryPromise(() => decodeTable(table))));
+    return outcome._tag === "Success" ? outcome.success : null;
+}
+/**
+ * The Agent half for OpenAPI connections: one Mycelium module per granted
+ * connection, its operations built from the stored table and admitted by the
+ * grant. Every call is completed by the owner; nothing here holds a credential.
+ * MCP connections stay with the host's Knapsack source.
+ */
+export function connectionsSource(input) {
+    return {
+        id: input.id,
+        acquire: async ({ signal, invalidate }) => {
+            signal.throwIfAborted();
+            const unsubscribe = input.subscribe(invalidate);
+            const release = () => {
+                unsubscribe();
+                return Promise.resolve();
+            };
+            try {
+                const captured = await input.read();
+                signal.throwIfAborted();
+                const modules = [];
+                for (const connection of captured.connections) {
+                    if (connection.surface.kind !== "openapi")
+                        continue;
+                    // The projection crossed a boundary: decode its table again and match the digest.
+                    const decoded = await tryDecode(connection.surface.table);
+                    if (decoded?.digest !== connection.surface.digest) {
+                        input.onSkipped?.(connection.connectionId);
+                        continue;
+                    }
+                    const ref = {
+                        connectionId: connection.connectionId,
+                        grantVersion: connection.grantVersion,
+                    };
+                    const connectorModule = Mycelium.module({
+                        id: `connector:${connection.connectionId}`,
+                        name: connection.name,
+                        description: `Third-party connector: ${connection.name}`,
+                        operations: Object.fromEntries(decoded.operations
+                            .filter((operation) => admits(connection.tools, operation))
+                            .map((operation) => [
+                            operation.name,
+                            Mycelium.operation({
+                                replay: "unsafe",
+                                access: operation.effect,
+                                description: `Third-party API text: ${operation.description}\nEffect: ${operation.effect}.`,
+                                input: jsonSchemaToZod(operation.input).pipe(z.json()),
+                                output: z.strictObject({
+                                    textSource: z.literal("third_party"),
+                                    value: jsonSchemaToZod(operation.output).pipe(z.json()),
+                                }),
+                                execute: async (arguments_, context) => {
+                                    context.signal.throwIfAborted();
+                                    try {
+                                        return {
+                                            textSource: "third_party",
+                                            value: await input.call(ref, operation.name, z.json().parse(arguments_)),
+                                        };
+                                    }
+                                    catch (cause) {
+                                        throw new CapabilityFailed({
+                                            namespace: "connectors",
+                                            operation: operation.name,
+                                            cause: {
+                                                kind: "OperationFailed",
+                                                message: cause instanceof ConnectionsError
+                                                    ? cause.code
+                                                    : "unavailable",
+                                            },
+                                            rawCause: cause,
+                                        });
+                                    }
+                                },
+                            }),
+                        ])),
+                    });
+                    modules.push(connectorModule);
+                }
+                return {
+                    snapshot: {
+                        version: JSON.stringify([
+                            captured.revision,
+                            ...captured.connections.map((connection) => [
+                                connection.connectionId,
+                                connection.version,
+                                connection.authorityVersion,
+                                connection.grantVersion,
+                            ]),
+                        ]),
+                        modules,
+                    },
+                    release,
+                };
+            }
+            catch (error) {
+                await release();
+                throw error;
+            }
+        },
+    };
+}

package/dist/connections/update.d.ts

@@ -0,0 +1,41 @@
+import * as Effect from "effect/Effect";
+import { ConnectionsError, type ConnectionsOptions, type UpdateInput } from "./contract.js";
+import { type ConnectionRow } from "./internal.js";
+/** The owner's SQLite as `update` sees it; every method is one synchronous step or transaction. */
+export type UpdateStore = Readonly<{
+    authorize: (actor: string) => void;
+    connection: (id: string) => ConnectionRow;
+    /** A recorded update by request id, with the stamp it was recorded under. */
+    receipt: (requestId: string) => Readonly<{
+        stamp: string;
+        connectionId: string;
+        version: number;
+    }> | null;
+    checkName: (name: string, exceptId: string) => void;
+    publicUrl: (value: string) => string;
+    commit: (input: Readonly<{
+        actor: string;
+        update: UpdateInput;
+        stamp: string;
+        row: ConnectionRow;
+        baseUrl: string;
+        table: ConnectionRow["surface"]["table"];
+        digest: string | null;
+        credential: ConnectionRow["credential"];
+        locator: string | null;
+    }>) => {
+        connectionId: string;
+        version: number;
+    };
+    /** Queue a sealed locator for deletion. */
+    discard: (connectionId: string, locator: string, credential: ConnectionRow["credential"]) => void;
+}>;
+/** Owner edits guarded by the version the owner last saw; replays are idempotent. */
+export declare function createUpdate(deps: {
+    ownerId: string;
+    custody: ConnectionsOptions["custody"];
+    store: UpdateStore;
+}): (actor: string, raw: UpdateInput) => Effect.Effect<{
+    connectionId: string;
+    version: number;
+}, ConnectionsError, never>;