@fungi.computer/veil 0.4.0 → 0.6.0

package/dist/connections/discover.d.ts

@@ -0,0 +1,3 @@
+import type { NarrowFetch } from "./contract.js";
+/** The tool names an MCP server offers, listed with the maintained SDK client. */
+export declare function listMcpTools(url: string, fetch: NarrowFetch): Promise<readonly string[]>;

package/dist/connections/discover.js

@@ -0,0 +1,23 @@
+const toolLimit = 1_024;
+/** The tool names an MCP server offers, listed with the maintained SDK client. */
+export async function listMcpTools(url, fetch) {
+    const sdk = await import("@modelcontextprotocol/client");
+    const client = new sdk.Client({ name: "fungi-connections", version: "1" });
+    await client.connect(new sdk.StreamableHTTPClientTransport(new URL(url), {
+        fetch,
+        requestInit: { redirect: "error" },
+    }));
+    try {
+        const names = [];
+        let cursor;
+        do {
+            const page = await client.listTools(cursor === undefined ? undefined : { cursor });
+            names.push(...page.tools.map((tool) => tool.name));
+            cursor = page.nextCursor;
+        } while (cursor !== undefined && names.length < toolLimit);
+        return names.slice(0, toolLimit);
+    }
+    finally {
+        await client.close();
+    }
+}

package/dist/connections/egress.js

@@ -1,5 +1,4 @@
 import * as Schema from "effect/Schema";
-import { isJSONRPCRequest, parseJSONRPCMessage, } from "@modelcontextprotocol/client";
 import { assertPublicHostName } from "../model-key-network.js";
 import { ConnectionsError } from "./contract.js";
 const bodyLimit = 256 * 1024;
@@ -30,8 +29,10 @@ export async function admitRequest(endpoint, tools, request, policy) {
     if (request.body === null)
         return request;
     const bytes = await boundedBytes(request.clone());
-    if (endpoint.kind === "mcp" && tools !== "all") {
+    if (endpoint.kind === "mcp" && Array.isArray(tools)) {
         let name = null;
+        // The SDK stays out of startup: it loads when a listed MCP grant first meets a body.
+        const { isJSONRPCRequest, parseJSONRPCMessage } = await import("@modelcontextprotocol/client");
         try {
             const message = parseJSONRPCMessage(jsonValue(new TextDecoder("utf-8", { fatal: true }).decode(bytes)));
             if (isJSONRPCRequest(message) && message.method === "tools/call")

package/dist/connections/index.d.ts

@@ -1,3 +1,4 @@
 export { createConnections } from "./core.js";
 export { createSealedCustody } from "./sealed.js";
 export * from "./contract.js";
+export * from "./mcp-agent.js";

package/dist/connections/index.js

@@ -1,3 +1,4 @@
 export { createConnections } from "./core.js";
 export { createSealedCustody } from "./sealed.js";
 export * from "./contract.js";
+export * from "./mcp-agent.js";

package/dist/connections/internal.d.ts

@@ -0,0 +1,78 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { ConnectionsError } from "./contract.js";
+export declare const json: <S extends Schema.Top>(schema: S) => Schema.fromJsonString<S>;
+export declare const connectionRow: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly surface: Schema.fromJsonString<Schema.Struct<{
+        readonly kind: Schema.Literals<readonly ["mcp", "openapi"]>;
+        readonly url: Schema.String;
+        readonly table: Schema.NullOr<Schema.$Array<Schema.Unknown>>;
+        /** Digest of the decoded table, kept so listings need no decoding. */
+        readonly digest: Schema.optional<Schema.NullOr<Schema.String>>;
+        /** Display text for owners; the unique `name` is the binding. */
+        readonly label: Schema.optional<Schema.String>;
+    }>>;
+    readonly credential: Schema.fromJsonString<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"none">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"static">;
+        readonly placement: Schema.Union<readonly [Schema.Literal<"bearer">, Schema.Struct<{
+            readonly header: Schema.String;
+        }>, Schema.Struct<{
+            readonly query: Schema.String;
+        }>]>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth">;
+        readonly scope: Schema.optional<Schema.String>;
+        readonly clientId: Schema.optional<Schema.String>;
+        readonly provider: Schema.optional<Schema.String>;
+    }>]>>;
+    readonly locator: Schema.NullOr<Schema.String>;
+    readonly state: Schema.Literals<readonly ["pending", "active", "reconnect_required", "revoked"]>;
+    readonly authorityVersion: Schema.Number;
+    readonly version: Schema.Number;
+}>;
+export type ConnectionRow = typeof connectionRow.Type;
+export declare const attemptRow: Schema.Struct<{
+    readonly state: Schema.String;
+    readonly connectionId: Schema.String;
+    readonly actor: Schema.String;
+    readonly status: Schema.String;
+    readonly expiresAt: Schema.Number;
+    readonly pkceVerifierSealed: Schema.NullOr<Schema.String>;
+    /** The authorization server, or `custody:<integration>` when a custodian runs the sign-in. */
+    readonly issuer: Schema.NullOr<Schema.String>;
+}>;
+export type AttemptRow = typeof attemptRow.Type;
+export declare const registryRow: Schema.Struct<{
+    readonly locator: Schema.String;
+}>;
+export declare function decode<S extends Schema.Decoder<unknown>>(schema: S, input: unknown): S["Type"];
+export declare const sync: <A>(operation: () => A) => Effect.Effect<A, ConnectionsError, never>;
+export declare const io: <A>(operation: () => Promise<A>) => Effect.Effect<A, ConnectionsError, never>;
+export declare const cleanupRow: Schema.Struct<{
+    readonly id: Schema.Number;
+    readonly connectionId: Schema.String;
+    readonly locator: Schema.String;
+    readonly credential: Schema.fromJsonString<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"none">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"static">;
+        readonly placement: Schema.Union<readonly [Schema.Literal<"bearer">, Schema.Struct<{
+            readonly header: Schema.String;
+        }>, Schema.Struct<{
+            readonly query: Schema.String;
+        }>]>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth">;
+        readonly scope: Schema.optional<Schema.String>;
+        readonly clientId: Schema.optional<Schema.String>;
+        readonly provider: Schema.optional<Schema.String>;
+    }>]>>;
+    readonly attempts: Schema.Number;
+}>;
+export declare const count: Schema.Struct<{
+    readonly n: Schema.Number;
+}>;

package/dist/connections/internal.js

@@ -0,0 +1,66 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { ConnectionsError, credentialSchema, identifier } from "./contract.js";
+export const json = (schema) => Schema.fromJsonString(schema);
+export const connectionRow = Schema.Struct({
+    id: identifier,
+    name: Schema.String,
+    surface: json(Schema.Struct({
+        kind: Schema.Literals(["mcp", "openapi"]),
+        url: Schema.String,
+        table: Schema.NullOr(Schema.Array(Schema.Unknown)),
+        /** Digest of the decoded table, kept so listings need no decoding. */
+        digest: Schema.optional(Schema.NullOr(Schema.String)),
+        /** Display text for owners; the unique `name` is the binding. */
+        label: Schema.optional(Schema.String),
+    })),
+    credential: json(credentialSchema),
+    locator: Schema.NullOr(Schema.String),
+    state: Schema.Literals([
+        "pending",
+        "active",
+        "reconnect_required",
+        "revoked",
+    ]),
+    authorityVersion: Schema.Number,
+    version: Schema.Number,
+});
+export const attemptRow = Schema.Struct({
+    state: Schema.String,
+    connectionId: identifier,
+    actor: identifier,
+    status: Schema.String,
+    expiresAt: Schema.Number,
+    pkceVerifierSealed: Schema.NullOr(Schema.String),
+    /** The authorization server, or `custody:<integration>` when a custodian runs the sign-in. */
+    issuer: Schema.NullOr(Schema.String),
+});
+export const registryRow = Schema.Struct({ locator: Schema.String });
+export function decode(schema, input) {
+    try {
+        return Schema.decodeUnknownSync(schema)(input);
+    }
+    catch {
+        throw new ConnectionsError("invalid_input");
+    }
+}
+export const sync = (operation) => Effect.try({
+    try: operation,
+    catch: (cause) => cause instanceof ConnectionsError
+        ? cause
+        : new ConnectionsError("unavailable", { cause }),
+});
+export const io = (operation) => Effect.tryPromise({
+    try: operation,
+    catch: (cause) => cause instanceof ConnectionsError
+        ? cause
+        : new ConnectionsError("unavailable", { cause }),
+});
+export const cleanupRow = Schema.Struct({
+    id: Schema.Number,
+    connectionId: identifier,
+    locator: Schema.String,
+    credential: json(credentialSchema),
+    attempts: Schema.Number,
+});
+export const count = Schema.Struct({ n: Schema.Number });

package/dist/connections/mcp-agent.d.ts

@@ -0,0 +1,37 @@
+import { type ConnectionProjection, type EgressRef, type NarrowFetch } from "./contract.js";
+/** One Agent MCP request as plain data, so it can cross a Durable Object RPC boundary. */
+export type McpRequestData = Readonly<{
+    url: string;
+    method: string;
+    headers: readonly (readonly [string, string])[];
+    body: ArrayBuffer | null;
+}>;
+/** A refusal crosses RPC as data: a stable code, never a message. */
+export type McpRefusal = Readonly<{
+    error: string;
+}>;
+export declare function mcpRequestData(request: Request): Promise<McpRequestData>;
+/**
+ * Complete one Agent MCP request on the owner side, the only place a
+ * credential opens. A refusal comes back as a code, never a thrown message.
+ */
+export declare function answerMcpRequest(egress: (agentId: string, ref: EgressRef) => NarrowFetch, agentId: string, ref: EgressRef, data: McpRequestData): Promise<Response | McpRefusal>;
+/**
+ * The Agent half of MCP: the servers a projection grants, and a fetch that is
+ * completed by the owner. Spread into the host's Knapsack MCP source; no
+ * header, token or locator is ever held on this side.
+ */
+export declare function mcpAgentSource(input: {
+    read: () => Promise<ConnectionProjection>;
+    fetch: (ref: EgressRef, request: Request) => Promise<Response>;
+}): {
+    read: () => Promise<{
+        version: string;
+        servers: {
+            id: string;
+            name: string;
+            url: import("url").URL;
+        }[];
+    }>;
+    fetch: (url: string | URL, init?: RequestInit) => Promise<Response>;
+};

package/dist/connections/mcp-agent.js

@@ -0,0 +1,75 @@
+import { ConnectionsError, } from "./contract.js";
+export async function mcpRequestData(request) {
+    return {
+        url: request.url,
+        method: request.method,
+        headers: [...request.headers],
+        body: request.body === null ? null : await request.arrayBuffer(),
+    };
+}
+/**
+ * Complete one Agent MCP request on the owner side, the only place a
+ * credential opens. A refusal comes back as a code, never a thrown message.
+ */
+export async function answerMcpRequest(egress, agentId, ref, data) {
+    try {
+        const init = {
+            method: data.method,
+            headers: data.headers.map(([name, value]) => [name, value]),
+            redirect: "error",
+        };
+        if (data.body !== null)
+            init.body = data.body;
+        return await egress(agentId, ref)(new Request(data.url, init));
+    }
+    catch (cause) {
+        if (cause instanceof ConnectionsError)
+            return { error: cause.code };
+        throw cause;
+    }
+}
+/**
+ * The Agent half of MCP: the servers a projection grants, and a fetch that is
+ * completed by the owner. Spread into the host's Knapsack MCP source; no
+ * header, token or locator is ever held on this side.
+ */
+export function mcpAgentSource(input) {
+    const refs = new Map();
+    return {
+        read: async () => {
+            const granted = await input.read();
+            refs.clear();
+            const servers = granted.connections.flatMap((connection) => {
+                if (connection.surface.kind !== "mcp")
+                    return [];
+                refs.set(new URL(connection.surface.url).href, {
+                    connectionId: connection.connectionId,
+                    grantVersion: connection.grantVersion,
+                });
+                return [
+                    {
+                        id: `mcp.${connection.connectionId}`,
+                        name: connection.name,
+                        url: new URL(connection.surface.url),
+                    },
+                ];
+            });
+            return {
+                // Secret-free: ids, versions and endpoints.
+                version: JSON.stringify(granted.connections.map((c) => [
+                    c.connectionId,
+                    c.grantVersion,
+                    c.authorityVersion,
+                ])),
+                servers,
+            };
+        },
+        fetch: (url, init) => {
+            const request = new Request(url, init);
+            const ref = refs.get(request.url);
+            return ref === undefined
+                ? Promise.reject(new Error("MCP server is not connected"))
+                : input.fetch(ref, request);
+        },
+    };
+}

package/dist/connections/nango.d.ts

@@ -0,0 +1,30 @@
+import { type CustodyAdapter, type CustodyCompletion } from "./contract.js";
+/**
+ * Trusted host configuration. `staticIntegrationId` is an API-key integration
+ * whose proxy attaches the credential an owner pasted; OAuth connections name
+ * their own integration when they begin. The Connect document and API URLs
+ * are public and independent of the internal `serverUrl`.
+ */
+export type NangoCustodyOptions = Readonly<{
+    serverUrl: string;
+    apiKey: string;
+    webhookSigningKey: string;
+    staticIntegrationId: string;
+    connectBaseUrl: string;
+    publicApiUrl: string;
+    requestTimeoutMs?: number;
+}>;
+/** A custodian that also verifies its signed completion for the host. */
+export type ConnectionsCustodian = CustodyAdapter & Readonly<{
+    verifyCompletion: (rawBody: string, signature: string) => Promise<CustodyCompletion & Readonly<{
+        ownerId: string;
+    }>>;
+}>;
+/**
+ * Nango as a `CustodyAdapter`: `put` imports an API-key connection, `inject`
+ * sends through Nango's proxy (which attaches and refreshes the credential),
+ * `remove` deletes the connection, and `connect` opens a Connect session for
+ * an authorization Nango runs. `verifyCompletion` turns its signed webhook
+ * into a `CustodyCompletion` for the core.
+ */
+export declare function createNangoCustody(options: NangoCustodyOptions): ConnectionsCustodian;

package/dist/connections/nango.js

@@ -0,0 +1,179 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { authWebhookSchema, connectDocument, publicUrl, sessionSchema, tagsSchema, webhookEnvelopeSchema, } from "../nango.js";
+import { createNangoCustodyHttp } from "../nango-custody-http.js";
+import { VeilError } from "../index.js";
+import { ConnectionsError, } from "./contract.js";
+const defaultTimeoutMs = 10_000;
+const decode = (schema, raw) => {
+    try {
+        return Schema.decodeUnknownSync(Schema.fromJsonString(schema))(raw);
+    }
+    catch (cause) {
+        throw new ConnectionsError("invalid_response", { cause });
+    }
+};
+/** Nango says no body of ours is wrong; any failure to speak with it is an outage. */
+const outage = (cause) => cause instanceof ConnectionsError
+    ? cause
+    : cause instanceof VeilError
+        ? new ConnectionsError(cause.code === "invalid_response"
+            ? "invalid_response"
+            : "unavailable", { cause })
+        : new ConnectionsError("unavailable", { cause });
+const attempt = (body) => Effect.tryPromise({ try: body, catch: outage });
+const connectionsSchema = Schema.Struct({
+    connections: Schema.Array(Schema.Struct({
+        connection_id: Schema.NonEmptyString,
+        provider_config_key: Schema.NonEmptyString,
+        tags: tagsSchema,
+        end_user: Schema.Struct({
+            id: Schema.NonEmptyString,
+            organization: Schema.Struct({ id: Schema.NonEmptyString }),
+        }),
+    })),
+});
+/**
+ * Nango as a `CustodyAdapter`: `put` imports an API-key connection, `inject`
+ * sends through Nango's proxy (which attaches and refreshes the credential),
+ * `remove` deletes the connection, and `connect` opens a Connect session for
+ * an authorization Nango runs. `verifyCompletion` turns its signed webhook
+ * into a `CustodyCompletion` for the core.
+ */
+export function createNangoCustody(options) {
+    const http = createNangoCustodyHttp(options);
+    const connectBase = publicUrl(options.connectBaseUrl);
+    if (!connectBase.pathname.endsWith("/"))
+        connectBase.pathname += "/";
+    const publicApi = publicUrl(options.publicApiUrl);
+    const timeoutMs = options.requestTimeoutMs ?? defaultTimeoutMs;
+    const signal = () => AbortSignal.timeout(timeoutMs);
+    return {
+        put: (address, secret) => attempt(async () => {
+            if (address.credential.kind !== "static")
+                throw new ConnectionsError("unsupported");
+            await http.importCredential({
+                integrationId: options.staticIntegrationId,
+                locator: address.connectionId,
+                teamId: address.ownerId,
+                credential: secret,
+            }, signal());
+            return address.connectionId;
+        }),
+        inject: (address, locator, request) => attempt(async () => {
+            const target = new URL(request.url);
+            const headers = new Headers();
+            for (const [name, value] of request.headers)
+                headers.set(`Nango-Proxy-${name}`, value);
+            const contentType = request.headers.get("content-type");
+            if (contentType !== null)
+                headers.set("Content-Type", contentType);
+            headers.set("Provider-Config-Key", address.credential.kind === "oauth" &&
+                address.credential.provider !== undefined
+                ? address.credential.provider
+                : options.staticIntegrationId);
+            headers.set("Connection-Id", locator);
+            headers.set("Base-Url-Override", target.origin);
+            headers.set("Retries", "0");
+            const response = await http.call(`/proxy${target.pathname}${target.search}`, request.signal, {
+                method: request.method,
+                headers,
+                body: request.method === "GET" ? null : request.body,
+                // Native Node fetch requires this for a stream; Workers accepts it.
+                duplex: "half",
+            });
+            // Nango's own refusal of a connection it no longer holds is not the provider's answer.
+            if (response.status === 404) {
+                await response.body?.cancel();
+                throw new ConnectionsError("reconnect_required");
+            }
+            return response;
+        }),
+        remove: (address, locator) => attempt(() => http.removeConnection(locator, address.credential.kind === "oauth" &&
+            address.credential.provider !== undefined
+            ? address.credential.provider
+            : options.staticIntegrationId, signal())),
+        connect: (address, session) => attempt(async () => {
+            const response = await http.call("/connect/sessions", signal(), {
+                method: "POST",
+                headers: new Headers({ "Content-Type": "application/json" }),
+                body: JSON.stringify({
+                    allowed_integrations: [session.integrationId],
+                    end_user: { id: session.actor },
+                    organization: { id: address.ownerId },
+                    tags: {
+                        veil_team_id: address.ownerId,
+                        veil_attempt_id: session.state,
+                        veil_principal_id: session.actor,
+                    },
+                }),
+            });
+            if (!response.ok)
+                throw new ConnectionsError("unavailable");
+            const { data } = decode(sessionSchema, await response.text());
+            return {
+                connectUrl: connectDocument({ token: data.token, connectUrl: data.connect_link }, connectBase, publicApi),
+                expiresAt: data.expires_at.getTime(),
+            };
+        }),
+        find: (address, session) => attempt(async () => {
+            const query = new URLSearchParams({
+                integrationId: session.integrationId,
+                endUserId: session.actor,
+                endUserOrganizationId: address.ownerId,
+                limit: "2",
+                page: "0",
+            });
+            query.set("tags[veil_team_id]", address.ownerId);
+            query.set("tags[veil_attempt_id]", session.state);
+            query.set("tags[veil_principal_id]", session.actor);
+            const response = await http.call(`/connections?${query.toString()}`, signal(), {});
+            if (!response.ok)
+                throw new ConnectionsError("unavailable");
+            const { connections } = decode(connectionsSchema, await response.text());
+            // The server filters before its limit; two rows prove ambiguity.
+            for (const row of connections)
+                if (row.provider_config_key !== session.integrationId ||
+                    row.end_user.id !== session.actor ||
+                    row.end_user.organization.id !== address.ownerId ||
+                    row.tags.veil_team_id !== address.ownerId ||
+                    row.tags.veil_attempt_id !== session.state ||
+                    row.tags.veil_principal_id !== session.actor)
+                    throw new ConnectionsError("invalid_response");
+            const [only, second] = connections;
+            if (only === undefined)
+                return { status: "unresolved" };
+            if (second !== undefined)
+                return { status: "ambiguous" };
+            return { status: "found", locator: only.connection_id };
+        }),
+        verifyCompletion: async (rawBody, signature) => {
+            // Maintained HMAC over the raw body first; only then decode the event.
+            const { Nango } = await import("@nangohq/node");
+            const verifier = new Nango({
+                host: new URL(options.serverUrl).origin,
+                apiKey: options.apiKey,
+                webhookSigningKey: options.webhookSigningKey,
+            });
+            if (!verifier.verifyIncomingWebhookRequest(rawBody, {
+                "X-Nango-Hmac-Sha256": signature,
+            }))
+                throw new ConnectionsError("denied");
+            const envelope = decode(webhookEnvelopeSchema, rawBody);
+            if (envelope.type !== "auth" || envelope.operation !== "creation")
+                throw new ConnectionsError("unsupported");
+            const row = decode(authWebhookSchema, rawBody);
+            if (!row.success ||
+                row.endUser.endUserId !== row.tags.veil_principal_id ||
+                row.endUser.organizationId !== row.tags.veil_team_id)
+                throw new ConnectionsError("denied");
+            return {
+                ownerId: row.tags.veil_team_id,
+                state: row.tags.veil_attempt_id,
+                locator: row.connectionId,
+                principalId: row.tags.veil_principal_id,
+                integrationId: row.providerConfigKey,
+            };
+        },
+    };
+}

package/dist/connections/oauth-flow.d.ts

@@ -0,0 +1,83 @@
+import * as Effect from "effect/Effect";
+import type { createPublicEgressPolicy } from "../public-egress-policy.js";
+import { ConnectionsError, type CompleteInput, type CustodyCompletion, type ConnectionDraft, type ConnectionsOptions } from "./contract.js";
+import { type AttemptRow, type ConnectionRow } from "./internal.js";
+/**
+ * The narrow, transactional slice of the owner's SQLite the OAuth flow needs.
+ * Every method is one synchronous owner transaction; the flow never sees SQL.
+ */
+export type OAuthStore = Readonly<{
+    connection: (id: string) => ConnectionRow;
+    /** A pending connection, its attempt and the begin receipt, or nothing. */
+    recordPending: (input: {
+        actor: string;
+        connection: ConnectionRow;
+        state: string;
+        /** The sealed PKCE verifier; none when the custodian runs the authorization. */
+        attemptLocator: string | null;
+        issuer: string;
+        requestId: string;
+        fingerprint: string;
+        authorizeUrl: string;
+    }) => void;
+    /** Consume a live attempt for its actor, or retire it when expired. */
+    claim: (actor: string, input: CompleteInput) => {
+        attempt: AttemptRow;
+        wanted: CompleteInput;
+        expired: boolean;
+    };
+    /** Consume a live attempt the custodian runs; expired ones retire. */
+    claimCustody: (state: string, principalId: string) => {
+        attempt: AttemptRow;
+        expired: boolean;
+    };
+    /** The attempt failed: withdraw the pending connection and clean its verifier. */
+    fail: (attempt: AttemptRow) => void;
+    /** Pending becomes active with its token locator; false when it is no longer pending. */
+    activate: (row: ConnectionRow, attempt: AttemptRow, locator: string) => boolean;
+    /** Queue a sealed locator for deletion. */
+    discard: (connectionId: string, locator: string, credential: ConnectionRow["credential"]) => void;
+    /** Replace the live locator after a refresh, or report why it cannot. */
+    swap: (row: ConnectionRow, held: string, locator: string) => "applied" | ConnectionRow["state"];
+    clientLocator: (issuer: string) => string | undefined;
+    saveClientLocator: (issuer: string, locator: string) => void;
+}>;
+/** Discovery, sign-in, token refresh and the registered-client record for OAuth connections. */
+export declare function createOAuthFlow(deps: {
+    ownerId: string;
+    custody: ConnectionsOptions["custody"];
+    oauth: ConnectionsOptions["oauth"];
+    clock: () => number;
+    ids: () => string;
+    policy: ReturnType<typeof createPublicEgressPolicy>;
+    store: OAuthStore;
+    sweep: () => Effect.Effect<void, ConnectionsError>;
+}): {
+    begin: (actor: string, draft: ConnectionDraft, credential: Extract<ConnectionDraft["credential"], {
+        kind: "oauth";
+    }>, endpoint: string, fingerprint: string, openapi: Readonly<{
+        table: readonly unknown[];
+        digest: string;
+    }> | null) => Effect.Effect<{
+        connectionId: string;
+        authorizeUrl: string;
+        attemptId: string;
+    }, ConnectionsError, never>;
+    beginCustody: (actor: string, draft: ConnectionDraft, credential: Extract<ConnectionDraft["credential"], {
+        kind: "oauth";
+    }>, endpoint: string, fingerprint: string, openapi: Readonly<{
+        table: readonly unknown[];
+        digest: string;
+    }> | null, kind: "mcp" | "openapi") => Effect.Effect<{
+        connectionId: string;
+        authorizeUrl: string;
+        attemptId: string;
+    }, ConnectionsError, never>;
+    complete: (actor: string, input: CompleteInput) => Effect.Effect<{
+        connectionId: string;
+    }, ConnectionsError, never>;
+    completeCustody: (input: CustodyCompletion) => Effect.Effect<{
+        connectionId: string;
+    }, ConnectionsError, never>;
+    send: (row: ConnectionRow, request: Request) => Effect.Effect<Response, ConnectionsError, never>;
+};