@fungi.computer/veil 0.4.0 → 0.6.0

package/dist/index.d.ts

@@ -1,173 +1,3 @@
-import * as Schema from "effect/Schema";
-/** The repository identity selected by the Team, never by model input. */
-export declare const RepositoryScopeSchema: Schema.Struct<{
-    readonly id: Schema.Number;
-    readonly owner: Schema.NonEmptyString;
-    readonly name: Schema.NonEmptyString;
-}>;
-export type RepositoryScope = Schema.Schema.Type<typeof RepositoryScopeSchema>;
-/** Bounded, credential-free metadata returned by the GitHub operation. */
-export declare const GitHubRepositorySchema: Schema.Struct<{
-    readonly id: Schema.Number;
-    readonly name: Schema.NonEmptyString;
-    readonly fullName: Schema.NonEmptyString;
-    readonly private: Schema.Boolean;
-    readonly defaultBranch: Schema.NonEmptyString;
-}>;
-export type GitHubRepository = Schema.Schema.Type<typeof GitHubRepositorySchema>;
-export declare const ConnectInputSchema: Schema.Struct<{
-    readonly requestId: Schema.NonEmptyString;
-    readonly actorUserId: Schema.NonEmptyString;
-    readonly holderAgentId: Schema.NonEmptyString;
-    readonly repository: Schema.Struct<{
-        readonly id: Schema.Number;
-        readonly owner: Schema.NonEmptyString;
-        readonly name: Schema.NonEmptyString;
-    }>;
-}>;
-export type ConnectInput = Schema.Schema.Type<typeof ConnectInputSchema>;
-export declare const AttemptSchema: Schema.Struct<{
-    readonly teamId: Schema.NonEmptyString;
-    readonly attemptId: Schema.NonEmptyString;
-    readonly connectionId: Schema.NonEmptyString;
-    readonly integrationId: Schema.NonEmptyString;
-    readonly expiresAt: Schema.Number;
-    readonly requestId: Schema.NonEmptyString;
-    readonly actorUserId: Schema.NonEmptyString;
-    readonly holderAgentId: Schema.NonEmptyString;
-    readonly repository: Schema.Struct<{
-        readonly id: Schema.Number;
-        readonly owner: Schema.NonEmptyString;
-        readonly name: Schema.NonEmptyString;
-    }>;
-}>;
-export type ConnectionAttempt = Schema.Schema.Type<typeof AttemptSchema>;
-/** Custody correlation is independent of the resource receiving the Connection. */
-export type CustodyCorrelation = Pick<ConnectionAttempt, "teamId" | "attemptId" | "actorUserId" | "integrationId">;
-/** Produced only by a custodian's verified completion boundary. */
-export declare const CompletionSchema: Schema.Struct<{
-    readonly teamId: Schema.NonEmptyString;
-    readonly attemptId: Schema.NonEmptyString;
-    readonly principalId: Schema.NonEmptyString;
-    readonly integrationId: Schema.NonEmptyString;
-    readonly locator: Schema.NonEmptyString;
-}>;
-export type VerifiedCompletion = Schema.Schema.Type<typeof CompletionSchema>;
-export declare const ConnectionReceiptSchema: Schema.Struct<{
-    readonly requestId: Schema.NonEmptyString;
-    readonly connectionId: Schema.NonEmptyString;
-    readonly holderAgentId: Schema.NonEmptyString;
-    readonly repository: Schema.Struct<{
-        readonly id: Schema.Number;
-        readonly owner: Schema.NonEmptyString;
-        readonly name: Schema.NonEmptyString;
-    }>;
-    readonly authorityVersion: Schema.Number;
-    readonly status: Schema.Literals<readonly ["active", "disconnected"]>;
-    readonly cleanup: Schema.Literals<readonly ["none", "pending"]>;
-}>;
-export type ConnectionReceipt = Schema.Schema.Type<typeof ConnectionReceiptSchema>;
-export declare const ReadBindingSchema: Schema.Struct<{
-    readonly teamId: Schema.NonEmptyString;
-    readonly holderAgentId: Schema.NonEmptyString;
-    readonly connectionId: Schema.NonEmptyString;
-    readonly repositoryId: Schema.Number;
-}>;
-export type ReadBinding = Schema.Schema.Type<typeof ReadBindingSchema>;
-export declare const DisconnectInputSchema: Schema.Struct<{
-    readonly requestId: Schema.NonEmptyString;
-    readonly actorUserId: Schema.NonEmptyString;
-    readonly connectionId: Schema.NonEmptyString;
-}>;
-export type DisconnectInput = Schema.Schema.Type<typeof DisconnectInputSchema>;
-/** Private to the Team owner and its trusted custodian adapter. */
-export type RepositoryAccess = Readonly<{
-    locator: string;
-    repository: RepositoryScope;
-}>;
-export type PreparedCompletion = Readonly<{
-    status: "pending";
-    attempt: ConnectionAttempt;
-}> | Readonly<{
-    status: "completed";
-    receipt: ConnectionReceipt;
-}>;
-/** Why a verified completion's Nango connection is not held by the Team. */
-export type OrphanCode = "expired" | "denied" | "conflict" | "reconnect_required";
-/** A verified completion is held (completed), still activatable (pending), or an
- * orphan whose external connection the Team will never hold. */
-export type CompletionDecision = PreparedCompletion | Readonly<{
-    status: "orphaned";
-    code: OrphanCode;
-}>;
-/** Terminal custodian evidence that the held credential no longer works. */
-export type ReconnectReason = "refresh_failed" | "provider_unauthorized";
-export type ReconnectOutcome = Readonly<{
-    status: "reconnect_required";
-    connectionId: string;
-}> | Readonly<{
-    status: "not_held";
-}>;
-/** Signed Nango auth webhooks this Team handles; every other operation is refused. */
-export type VerifiedWebhook = Readonly<{
-    operation: "creation" | "refresh_failed";
-    completion: VerifiedCompletion;
-}>;
-export type CleanupWork = Readonly<{
-    connectionId: string;
-    authorityVersion: number;
-    locator: string;
-}>;
-declare const completionLookupSchema: Schema.Union<readonly [Schema.Struct<{
-    readonly status: Schema.Literal<"unresolved">;
-}>, Schema.Struct<{
-    readonly status: Schema.Literal<"ambiguous">;
-}>, Schema.Struct<{
-    readonly status: Schema.Literal<"verified">;
-    readonly completion: Schema.Struct<{
-        readonly teamId: Schema.NonEmptyString;
-        readonly attemptId: Schema.NonEmptyString;
-        readonly principalId: Schema.NonEmptyString;
-        readonly integrationId: Schema.NonEmptyString;
-        readonly locator: Schema.NonEmptyString;
-    }>;
-}>]>;
-/** Private Team operations. Mutations may await the native SQL+wake commit. */
-export type TeamConnectionsOwner = Readonly<{
-    begin: (input: ConnectInput) => PreparedCompletion;
-    readAttempt: (input: ConnectInput) => PreparedCompletion;
-    prepareCompletion: (input: VerifiedCompletion) => CompletionDecision;
-    /** Records the settled external deletion of a connection the Team never held. */
-    recordOrphan: (input: VerifiedCompletion, code: OrphanCode, custody: "deleted" | "absent") => void;
-    /** Marks the active Connection holding this locator as needing reconnection. */
-    requireReconnect: (locator: string, reason: ReconnectReason) => ReconnectOutcome;
-    activate: (input: VerifiedCompletion, repository: GitHubRepository) => ConnectionReceipt | Promise<ConnectionReceipt>;
-    authorize: (binding: ReadBinding) => RepositoryAccess;
-    disconnect: (input: DisconnectInput) => ConnectionReceipt | Promise<ConnectionReceipt>;
-    nextCleanup: () => CleanupWork | undefined;
-    acknowledgeCleanup: (work: CleanupWork) => void;
-}>;
-/** Ordinary Promise port. Only this trusted edge touches external custody. */
-export type CredentialCustodian = Readonly<{
-    openSession: (input: Readonly<{
-        teamId: string;
-        attemptId: string;
-        principalId: string;
-        integrationId: string;
-    }>, signal: AbortSignal) => Promise<Readonly<{
-        token: string;
-        connectUrl: string;
-        expiresAt: number;
-    }>>;
-    /** Connection creation only; refuses every other signed operation. */
-    verifyCompletion: (rawBody: string, signature: string) => Promise<VerifiedCompletion>;
-    verifyWebhook: (rawBody: string, signature: string) => Promise<VerifiedWebhook>;
-    /** Verified means supported complete correlation, never an arbitrary list-page candidate. */
-    findCompletion: (attempt: CustodyCorrelation, signal: AbortSignal) => Promise<Schema.Schema.Type<typeof completionLookupSchema>>;
-    /** Only confirmed deletion or a specifically decoded missing-connection result settles cleanup. */
-    deleteConnection: (locator: string, signal: AbortSignal) => Promise<"deleted" | "absent">;
-    readRepository: (access: RepositoryAccess, signal: AbortSignal) => Promise<string>;
-}>;
 /** Sanitized public failure; an optional cause is retained internally only. */
 export declare class VeilError extends Error {
     readonly code: "denied" | "invalid_input" | "invalid_completion" | "invalid_response" | "conflict" | "ambiguous" | "expired" | "unavailable" | "github_not_configured" | "cancelled" | "reconnect_required" | "unsupported"
@@ -181,74 +11,3 @@ export declare class VeilError extends Error {
     /** The provider's rate limit refused this request; retry later. */
      | "rate_limited", cause?: unknown);
 }
-/** One Effect policy behind the ordinary connect and GitHub Gatekeeper calls. */
-export declare function createGitHubConnections(options: Readonly<{
-    owner: TeamConnectionsOwner;
-    custodian: CredentialCustodian;
-}>): {
-    connect: (input: ConnectInput, signal?: AbortSignal) => Promise<Readonly<{
-        status: "completed";
-        receipt: ConnectionReceipt;
-    }> | {
-        token: string;
-        connectUrl: string;
-        expiresAt: number;
-        status: "pending";
-        attemptId: string;
-    }>;
-    /** The one entry for signed custodian webhooks: activation or reconnect evidence. */
-    complete: (rawBody: string, signature: string, signal?: AbortSignal) => Promise<{
-        readonly requestId: string;
-        readonly connectionId: string;
-        readonly holderAgentId: string;
-        readonly repository: {
-            readonly id: number;
-            readonly owner: string;
-            readonly name: string;
-        };
-        readonly authorityVersion: number;
-        readonly status: "active" | "disconnected";
-        readonly cleanup: "none" | "pending";
-    } | ReconnectOutcome>;
-    reconcile: (input: ConnectInput, signal?: AbortSignal) => Promise<Readonly<{
-        status: "completed";
-        receipt: ConnectionReceipt;
-    }> | {
-        status: "pending";
-        attemptId: string;
-    }>;
-    /** One bounded host recovery call; durable pending work survives interrupted or uncertain deletion. */
-    cleanupOne: (signal?: AbortSignal) => Promise<{
-        status: "idle";
-        connectionId?: never;
-        authorityVersion?: never;
-        custody?: never;
-    } | {
-        status: "completed";
-        connectionId: string;
-        authorityVersion: number;
-        custody: "absent" | "deleted";
-    }>;
-    readRepository: (binding: ReadBinding, signal?: AbortSignal) => Promise<{
-        id: number;
-        name: string;
-        fullName: string;
-        private: boolean;
-        defaultBranch: string;
-    }>;
-    disconnect: (input: DisconnectInput) => Promise<{
-        readonly requestId: string;
-        readonly connectionId: string;
-        readonly holderAgentId: string;
-        readonly repository: {
-            readonly id: number;
-            readonly owner: string;
-            readonly name: string;
-        };
-        readonly authorityVersion: number;
-        readonly status: "active" | "disconnected";
-        readonly cleanup: "none" | "pending";
-    }>;
-};
-export type GitHubConnections = ReturnType<typeof createGitHubConnections>;
-export {};

package/dist/index.js

@@ -1,86 +1,3 @@
-import * as Cause from "effect/Cause";
-import * as Effect from "effect/Effect";
-import * as Exit from "effect/Exit";
-import * as Option from "effect/Option";
-import * as Schema from "effect/Schema";
-const text = Schema.NonEmptyString;
-const integer = Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0));
-/** The repository identity selected by the Team, never by model input. */
-export const RepositoryScopeSchema = Schema.Struct({
-    id: integer.check(Schema.isGreaterThan(0)),
-    owner: text,
-    name: text,
-});
-/** Bounded, credential-free metadata returned by the GitHub operation. */
-export const GitHubRepositorySchema = Schema.Struct({
-    id: integer.check(Schema.isGreaterThan(0)),
-    name: text,
-    fullName: text,
-    private: Schema.Boolean,
-    defaultBranch: text,
-});
-const providerRepositorySchema = Schema.Struct({
-    id: GitHubRepositorySchema.fields.id,
-    name: text,
-    full_name: GitHubRepositorySchema.fields.fullName,
-    private: Schema.Boolean,
-    default_branch: text,
-});
-export const ConnectInputSchema = Schema.Struct({
-    requestId: text,
-    actorUserId: text,
-    holderAgentId: text,
-    repository: RepositoryScopeSchema,
-});
-export const AttemptSchema = Schema.Struct({
-    ...ConnectInputSchema.fields,
-    teamId: text,
-    attemptId: text,
-    connectionId: text,
-    integrationId: text,
-    expiresAt: integer,
-});
-/** Produced only by a custodian's verified completion boundary. */
-export const CompletionSchema = Schema.Struct({
-    teamId: text,
-    attemptId: text,
-    principalId: text,
-    integrationId: text,
-    locator: text,
-});
-export const ConnectionReceiptSchema = Schema.Struct({
-    requestId: text,
-    connectionId: text,
-    holderAgentId: text,
-    repository: RepositoryScopeSchema,
-    authorityVersion: integer,
-    status: Schema.Literals(["active", "disconnected"]),
-    cleanup: Schema.Literals(["none", "pending"]),
-});
-export const ReadBindingSchema = Schema.Struct({
-    teamId: text,
-    holderAgentId: text,
-    connectionId: text,
-    repositoryId: integer,
-});
-export const DisconnectInputSchema = Schema.Struct({
-    requestId: text,
-    actorUserId: text,
-    connectionId: text,
-});
-const completionLookupSchema = Schema.Union([
-    Schema.Struct({ status: Schema.Literal("unresolved") }),
-    Schema.Struct({ status: Schema.Literal("ambiguous") }),
-    Schema.Struct({
-        status: Schema.Literal("verified"),
-        completion: CompletionSchema,
-    }),
-]);
-const connectSessionSchema = Schema.Struct({
-    token: text,
-    connectUrl: Schema.String,
-    expiresAt: integer,
-});
 /** Sanitized public failure; an optional cause is retained internally only. */
 export class VeilError extends Error {
     code;
@@ -92,176 +9,3 @@ export class VeilError extends Error {
             Object.defineProperty(this, "cause", { value: cause, enumerable: false });
     }
 }
-const orphanCodes = new Set([
-    "expired",
-    "denied",
-    "conflict",
-    "reconnect_required",
-]);
-function failure(cause) {
-    return new VeilError(cause instanceof VeilError ? cause.code : "unavailable");
-}
-function owned(operation) {
-    return Effect.try({ try: operation, catch: failure });
-}
-function run(program, signal) {
-    return Effect.runPromiseExit(program, signal === undefined ? undefined : { signal }).then((exit) => {
-        if (Exit.isSuccess(exit))
-            return exit.value;
-        const error = Option.getOrUndefined(Cause.findErrorOption(exit.cause));
-        throw (error ??
-            new VeilError(Cause.hasInterrupts(exit.cause) ? "cancelled" : "unavailable"));
-    });
-}
-/** One Effect policy behind the ordinary connect and GitHub Gatekeeper calls. */
-export function createGitHubConnections(options) {
-    const { owner, custodian } = options;
-    const repository = (access) => Effect.gen(function* () {
-        const raw = yield* Effect.tryPromise({
-            try: (signal) => custodian.readRepository(access, signal),
-            catch: failure,
-        });
-        const result = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(providerRepositorySchema))(raw).pipe(Effect.mapError(() => new VeilError("invalid_response")));
-        if (result.id !== access.repository.id)
-            return yield* Effect.fail(new VeilError("denied"));
-        return {
-            id: result.id,
-            name: result.name,
-            fullName: result.full_name,
-            private: result.private,
-            defaultBranch: result.default_branch,
-        };
-    });
-    /** Delete a verified connection the Team will never hold, then refuse it. */
-    const release = (completion, code) => Effect.gen(function* () {
-        const raw = yield* Effect.tryPromise({
-            try: (signal) => custodian.deleteConnection(completion.locator, signal),
-            catch: failure,
-        });
-        const custody = yield* Schema.decodeUnknownEffect(Schema.Literals(["deleted", "absent"]))(raw).pipe(Effect.mapError(() => new VeilError("invalid_response")));
-        yield* owned(() => {
-            owner.recordOrphan(completion, code, custody);
-        });
-        return yield* Effect.fail(new VeilError(code));
-    });
-    const activate = (verified) => Effect.gen(function* () {
-        const completion = yield* Schema.decodeUnknownEffect(CompletionSchema)(verified).pipe(Effect.mapError(() => new VeilError("invalid_completion")));
-        const prepared = yield* owned(() => owner.prepareCompletion(completion));
-        if (prepared.status === "completed")
-            return prepared.receipt;
-        if (prepared.status === "orphaned")
-            return yield* release(completion, prepared.code);
-        const { attempt } = prepared;
-        return yield* Effect.gen(function* () {
-            const metadata = yield* repository({
-                locator: completion.locator,
-                repository: attempt.repository,
-            });
-            return yield* Effect.tryPromise({
-                try: async () => owner.activate(completion, metadata),
-                catch: failure,
-            });
-        }).pipe(Effect.catchIf((error) => orphanCodes.has(error.code), (error) => Effect.gen(function* () {
-            // A concurrent delivery of this same completion may have won.
-            const settled = yield* owned(() => owner.prepareCompletion(completion));
-            if (settled.status === "completed")
-                return settled.receipt;
-            return yield* release(completion, error.code);
-        })));
-    });
-    return {
-        connect: (input, signal) => run(Effect.gen(function* () {
-            const command = yield* Schema.decodeUnknownEffect(ConnectInputSchema)(input).pipe(Effect.mapError(() => new VeilError("invalid_input")));
-            const prepared = yield* owned(() => owner.begin(command));
-            if (prepared.status === "completed")
-                return prepared;
-            const { attempt } = prepared;
-            const rawSession = yield* Effect.tryPromise({
-                try: (control) => custodian.openSession({
-                    teamId: attempt.teamId,
-                    attemptId: attempt.attemptId,
-                    principalId: attempt.actorUserId,
-                    integrationId: attempt.integrationId,
-                }, control),
-                catch: failure,
-            });
-            const session = yield* Schema.decodeUnknownEffect(connectSessionSchema)(rawSession).pipe(Effect.mapError(() => new VeilError("invalid_response")));
-            return {
-                status: "pending",
-                attemptId: attempt.attemptId,
-                ...session,
-            };
-        }), signal),
-        /** The one entry for signed custodian webhooks: activation or reconnect evidence. */
-        complete: (rawBody, signature, signal) => run(Effect.gen(function* () {
-            const event = yield* Effect.tryPromise({
-                try: () => custodian.verifyWebhook(rawBody, signature),
-                catch: failure,
-            });
-            if (event.operation === "creation")
-                return yield* activate(event.completion);
-            const completion = yield* Schema.decodeUnknownEffect(CompletionSchema)(event.completion).pipe(Effect.mapError(() => new VeilError("invalid_completion")));
-            const prepared = yield* owned(() => owner.prepareCompletion(completion));
-            if (prepared.status !== "completed")
-                return { status: "not_held" };
-            return yield* owned(() => owner.requireReconnect(completion.locator, "refresh_failed"));
-        }), signal),
-        reconcile: (input, signal) => run(Effect.gen(function* () {
-            const command = yield* Schema.decodeUnknownEffect(ConnectInputSchema)(input).pipe(Effect.mapError(() => new VeilError("invalid_input")));
-            const prepared = yield* owned(() => owner.readAttempt(command));
-            if (prepared.status === "completed")
-                return prepared;
-            const raw = yield* Effect.tryPromise({
-                try: (control) => custodian.findCompletion(prepared.attempt, control),
-                catch: failure,
-            });
-            const result = yield* Schema.decodeUnknownEffect(completionLookupSchema)(raw).pipe(Effect.mapError(() => new VeilError("invalid_response")));
-            if (result.status === "ambiguous")
-                return yield* Effect.fail(new VeilError("ambiguous"));
-            if (result.status === "unresolved")
-                return {
-                    status: "pending",
-                    attemptId: prepared.attempt.attemptId,
-                };
-            if (result.completion.attemptId !== prepared.attempt.attemptId)
-                return yield* Effect.fail(new VeilError("invalid_completion"));
-            const receipt = yield* activate(result.completion);
-            return { status: "completed", receipt };
-        }), signal),
-        /** One bounded host recovery call; durable pending work survives interrupted or uncertain deletion. */
-        cleanupOne: (signal) => run(Effect.gen(function* () {
-            const work = yield* owned(() => owner.nextCleanup());
-            if (work === undefined)
-                return { status: "idle" };
-            const raw = yield* Effect.tryPromise({
-                try: (control) => custodian.deleteConnection(work.locator, control),
-                catch: failure,
-            });
-            const custody = yield* Schema.decodeUnknownEffect(Schema.Literals(["deleted", "absent"]))(raw).pipe(Effect.mapError(() => new VeilError("invalid_response")));
-            yield* owned(() => {
-                owner.acknowledgeCleanup(work);
-            });
-            return {
-                status: "completed",
-                connectionId: work.connectionId,
-                authorityVersion: work.authorityVersion,
-                custody,
-            };
-        }), signal),
-        readRepository: (binding, signal) => run(Effect.gen(function* () {
-            const command = yield* Schema.decodeUnknownEffect(ReadBindingSchema)(binding).pipe(Effect.mapError(() => new VeilError("invalid_input")));
-            // Admission is the fresh owner decision immediately before this one egress.
-            const access = yield* owned(() => owner.authorize(command));
-            return yield* repository(access).pipe(Effect.tapError((error) => error.code === "reconnect_required"
-                ? owned(() => owner.requireReconnect(access.locator, "provider_unauthorized")).pipe(Effect.asVoid)
-                : Effect.void));
-        }), signal),
-        disconnect: (input) => run(Effect.gen(function* () {
-            const command = yield* Schema.decodeUnknownEffect(DisconnectInputSchema)(input).pipe(Effect.mapError(() => new VeilError("invalid_input")));
-            return yield* Effect.tryPromise({
-                try: async () => owner.disconnect(command),
-                catch: failure,
-            });
-        })),
-    };
-}

package/dist/nango.d.ts

@@ -1,16 +1,41 @@
-import { type CredentialCustodian } from "./index.js";
-/** Trusted host configuration; never supplied by a model or Connect browser.
- * The public Connect document and API URLs are independent of the internal
- * serverUrl the Hub uses for custody. */
-export type NangoCustodianOptions = Readonly<{
-    serverUrl: string;
-    apiKey: string;
-    webhookSigningKey: string;
-    integrationId: string;
-    connectBaseUrl: string;
-    publicApiUrl: string;
-    /** Deadline for one custodian request and its body; a miss is `unavailable`. */
-    requestTimeoutMs?: number;
+import * as Schema from "effect/Schema";
+export declare const tagsSchema: Schema.Struct<{
+    readonly veil_team_id: Schema.NonEmptyString;
+    readonly veil_attempt_id: Schema.NonEmptyString;
+    readonly veil_principal_id: Schema.NonEmptyString;
 }>;
-/** Pinned Nango Connect/connection REST contract and maintained raw-body verifier. */
-export declare function createNangoCustodian(options: NangoCustodianOptions): CredentialCustodian;
+export declare const sessionSchema: Schema.Struct<{
+    readonly data: Schema.Struct<{
+        readonly token: Schema.NonEmptyString;
+        readonly connect_link: Schema.NonEmptyString;
+        readonly expires_at: Schema.DateFromString;
+    }>;
+}>;
+export declare const webhookEnvelopeSchema: Schema.Struct<{
+    readonly type: Schema.NonEmptyString;
+    readonly operation: Schema.optional<Schema.NonEmptyString>;
+}>;
+/** Nango auth webhook fields shared by creation and refresh notifications. */
+export declare const authWebhookSchema: Schema.Struct<{
+    readonly type: Schema.Literal<"auth">;
+    readonly operation: Schema.Literals<readonly ["creation", "refresh"]>;
+    readonly success: Schema.Boolean;
+    readonly connectionId: Schema.NonEmptyString;
+    readonly providerConfigKey: Schema.NonEmptyString;
+    readonly tags: Schema.Struct<{
+        readonly veil_team_id: Schema.NonEmptyString;
+        readonly veil_attempt_id: Schema.NonEmptyString;
+        readonly veil_principal_id: Schema.NonEmptyString;
+    }>;
+    readonly endUser: Schema.Struct<{
+        readonly endUserId: Schema.NonEmptyString;
+        readonly organizationId: Schema.NonEmptyString;
+    }>;
+}>;
+export declare function publicUrl(value: string): URL;
+/** The Connect document handed to browsers: Nango's issued link, confined to
+ * the configured Connect UI and pinned to the configured public API. */
+export declare function connectDocument(session: Readonly<{
+    token: string;
+    connectUrl: string;
+}>, base: URL, api: URL): string;