@fungi.computer/veil 0.3.0 → 0.5.0

package/dist/openapi-secrets.js

@@ -1,76 +1,37 @@
-import { Buffer } from "node:buffer";
-import * as Schema from "effect/Schema";
 import { OpenApiError, } from "./openapi-contract.js";
-const keySchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/u)));
-const keyIdSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/u)));
-const envelopeSchema = Schema.Struct({
-    version: Schema.Literal(1),
-    keyId: keyIdSchema,
-    iv: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{16}$/u))),
-    ciphertext: Schema.String.pipe(Schema.check(Schema.isPattern(/^[A-Za-z0-9_-]{22,22000}$/u))),
-});
-const encoder = new TextEncoder();
-const binding = (access, keyId) => encoder.encode(JSON.stringify([
-    "fungi.veil.openapi.v1",
-    keyId,
+import { createCredentialSealer } from "./credential-store.js";
+/** The connector's owner address and policy are the sealed value's context. */
+const context = (access) => [
     access.teamId,
     access.connectorId,
     access.baseUrl,
     access.auth.kind,
-    access.auth.kind === "api_key_header" ||
-        access.auth.kind === "api_key_query"
+    access.auth.kind === "api_key_header" || access.auth.kind === "api_key_query"
         ? access.auth.param
         : null,
-]));
-/** WebCrypto owns authenticated encryption; the owner address and policy are its AAD. */
+];
+/** Connector credentials sealed by Veil's one credential sealer. */
 export function createOpenApiSecrets(configuration) {
-    const keys = new Map();
-    let activeKeyId;
-    try {
-        activeKeyId = Schema.decodeUnknownSync(keyIdSchema)(configuration.activeKeyId);
-        for (const [id, encoded] of Object.entries(configuration.keys)) {
-            Schema.decodeUnknownSync(keyIdSchema)(id);
-            const parsed = Schema.decodeUnknownSync(keySchema)(encoded);
-            const bytes = Uint8Array.from(Buffer.from(parsed, "base64url"));
-            if (bytes.length !== 32)
-                throw new OpenApiError("unavailable");
-            keys.set(id, crypto.subtle.importKey("raw", bytes, "AES-GCM", false, [
-                "encrypt",
-                "decrypt",
-            ]));
+    const sealer = (() => {
+        try {
+            return createCredentialSealer(configuration, "fungi.veil.openapi.v1");
         }
-        if (!keys.has(activeKeyId))
+        catch {
             throw new OpenApiError("unavailable");
-    }
-    catch {
-        throw new OpenApiError("unavailable");
-    }
-    const key = (id) => {
-        const found = keys.get(id);
-        if (!found)
-            throw new OpenApiError("denied");
-        return found;
-    };
+        }
+    })();
     return {
         async seal(access, credential) {
-            const iv = crypto.getRandomValues(new Uint8Array(12));
-            const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: binding(access, activeKeyId) }, await key(activeKeyId), encoder.encode(credential));
-            return JSON.stringify({
-                version: 1,
-                keyId: activeKeyId,
-                iv: Buffer.from(iv).toString("base64url"),
-                ciphertext: Buffer.from(ciphertext).toString("base64url"),
-            });
+            try {
+                return await sealer.seal(context(access), credential);
+            }
+            catch {
+                throw new OpenApiError("denied");
+            }
         },
         async open(access, sealed) {
             try {
-                const envelope = Schema.decodeUnknownSync(Schema.fromJsonString(envelopeSchema))(sealed);
-                const plaintext = await crypto.subtle.decrypt({
-                    name: "AES-GCM",
-                    iv: Uint8Array.from(Buffer.from(envelope.iv, "base64url")),
-                    additionalData: binding(access, envelope.keyId),
-                }, await key(envelope.keyId), Uint8Array.from(Buffer.from(envelope.ciphertext, "base64url")));
-                return new TextDecoder().decode(plaintext);
+                return await sealer.open(context(access), sealed);
             }
             catch {
                 throw new OpenApiError("denied");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/veil",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "author": "Levi <levi@technomancy.dev>",
   "description": "Team-authorized credential custody and provider access",
   "type": "module",
@@ -23,6 +23,10 @@
       "types": "./dist/model-credentials.d.ts",
       "import": "./dist/model-credentials.js"
     },
+    "./credential-store": {
+      "types": "./dist/credential-store.d.ts",
+      "import": "./dist/credential-store.js"
+    },
     "./model-keys": {
       "types": "./dist/model-keys.d.ts",
       "import": "./dist/model-keys.js"
@@ -78,6 +82,18 @@
     "./owned-infrastructure": {
       "types": "./dist/owned-infrastructure.d.ts",
       "import": "./dist/owned-infrastructure.js"
+    },
+    "./connections": {
+      "types": "./dist/connections/index.d.ts",
+      "import": "./dist/connections/index.js"
+    },
+    "./connections/nango": {
+      "types": "./dist/connections/nango.d.ts",
+      "import": "./dist/connections/nango.js"
+    },
+    "./connections/source": {
+      "types": "./dist/connections/source.d.ts",
+      "import": "./dist/connections/source.js"
     }
   },
   "files": [
@@ -87,6 +103,9 @@
   ],
   "dependencies": {
     "@fungi.computer/cairn": "0.1.0",
+    "@fungi.computer/forage": "0.3.1",
+    "@fungi.computer/mycelium": "0.3.4",
+    "@modelcontextprotocol/client": "2.0.0",
     "@nangohq/node": "0.71.6",
     "effect": "4.0.2",
     "http-parser-js": "0.5.10",
@@ -94,6 +113,8 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
+    "@fungi.computer/watchdog": "0.1.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "@types/node": "24.13.3",
     "typescript": "5.9.3",
     "vitest": "4.1.11"