External calls, first-class.
Outbound from authored code defaults to a typed GovernedConnection — not an HTTP client with a hardcoded API key. Secret references via IKeyRing. Declarative egress policy. Per-environment overrides. Observability and redaction baked in. The bounded ctx.http escape hatch exists for cases without a first-class connection — but raw network egress with embedded credentials is blocked at three layers.
One canonical entity. Many adapter kinds.
HTTP, OAuth, gRPC
Generic external endpoints. Authorization flows, signed requests, retries, timeouts — all declarative.
SMTP, SMS, payment, broker
Email gateways, Twilio-style SMS, Stripe-style payment, message brokers. Each with a typed connection contract that reflects the integration's actual shape.
LLM, KMS, search, custom
Anthropic / OpenAI / DeepSeek / Moonshot for hosted LLM. AWS KMS / Azure KV / Vault for keys. Search providers. Custom ConnectionTypes for anything else.
Secret references via the key ring
Connections never carry raw credentials. They reference secrets through IKeyRing — config: or env: refs only, secret: rejected. Rotation goes through the key ring, never the connection row.
Egress policy
Declarative allowed-host / allowed-path constraints. The managed HTTP escape hatch (ctx.http) honors the policy. Raw network egress is blocked in language SDKs, the build module allowlist, and the runtime isolate.
Observability + redaction
Every connection invocation surfaces in the canonical observability relay. Redaction policies strip secrets from trails before they land. The audit trail tells you what was called, never what credential was used.
Branch / environment overrides
Connections are branchable. A staging branch can point Stripe at the test endpoint without touching production state. Environment bindings layer on top of the base connection.
Tier-aware capability surface
Connections declare which execution surfaces may invoke them. Edge-tier connections are usable from edge handlers; non-edge connections are not. BridgeCapabilityEnforcer fails closed at runtime.
Installable as surfaces
A connection can be exposed via PublishedSurface. A consumer project installs it once, scopes the grant, and uses it like any internal capability.
HTTP, OAuth, SMTP, SMS, payment, LLM, KMS, broker, custom
SDK, compile, runtime
Per-branch, per-environment
Always through the key ring
External integrations that can be audited.
Define the connection. Vadyl handles the secrets, the egress policy, the observability, the per-environment overrides. Your handler calls ctx.connections.<name>.<op>(...) — never raw HTTP with embedded keys.