@every-app/sdk 0.2.0 → 0.3.0-rc.1

package/dist/internal/capabilities.d.ts

@@ -0,0 +1,1344 @@
+/**
+ * The built-in provider catalog: everything the gateway holds a credential
+ * for on apps' behalf (docs/capabilities.md,
+ * docs/design/2026-10-provider-registry.md), of four kinds, each an entry
+ * of data and nothing else, so a provider the catalog doesn't have can be
+ * registered on one gateway as a row of the same shape (./providerSpec.ts,
+ * ./providerRegistry.ts):
+ *
+ *  - `api_key`: a provider whose key the gateway holds. The operator sets
+ *    the key once on the gateway (`everyapp secret set <secret>`), an app lists the provider in its manifest's `capabilities`,
+ *    and the app calls the provider through the AppGateway binding
+ *    (`integrationFetch()`), so no app ever holds the key. `auth` says
+ *    where the key goes on the request ({@link ApiKeyAuth}).
+ *  - `ai`: an AI provider, reached under `providers` in the manifest and
+ *    `/api/ai/<id>` on the binding (`createGatewayFetch()`), with the AI
+ *    proxy's rules: inference routes only, the model allowlist, the usage
+ *    tap. Never a capability: its key would reach the account's credits
+ *    and keys on the same host.
+ *  - `oauth_client`: a provider's OAuth client (a social network's), held
+ *    the same way. The gateway completes the token endpoint calls only,
+ *    putting the client on them; the app builds the authorize URL from the
+ *    public client id (`integrationStatus()`), keeps the user tokens and
+ *    calls the provider's API with them itself. A client shared by apps
+ *    with different needs carries a `scopePolicy`: named scope sets an app
+ *    lists in its manifest entry's `scopes`, which ./oauthScopes.ts turns
+ *    into what the app may ask the provider for and what a token it is
+ *    handed may carry.
+ *  - `service`: something the gateway does itself, with no upstream host
+ *    an app names (sending email, listing the organization's members). An
+ *    app lists it the same way and calls its routes,
+ *    `/api/integrations/<id>/<route>`, through the SDK's own helper
+ *    (`sendEmail()`, `listMembers()`).
+ *
+ * The gateway enforces these definitions, the manifest validator checks
+ * `capabilities` against them, and the SDK reads them for its local-dev
+ * fallback, which calls the provider directly with a developer's own key.
+ * All three import them from here so they cannot drift.
+ */
+/** What an app may ask to do with a capability. */
+export type CapabilityAccess = "read" | "write";
+/**
+ * Where an API-key provider's key goes on a request, as data: the same
+ * four kinds a remote MCP app's credential takes. `secret` is always the
+ * name of a Gateway setting (in local dev, the `.dev.vars` name), never a
+ * value. {@link authorizationFor} turns one into headers or a query
+ * parameter from the settings.
+ */
+export type ApiKeyAuth = 
+/** `Authorization: Bearer <key>`; `scheme` for a provider that spells it `Token` or `Api-Key`. */
+{
+    kind: "bearer";
+    secret: string;
+    scheme?: string;
+}
+/** `<header>: <prefix><key>` (`x-api-key: <key>`, `Authorization: Klaviyo-API-Key <key>`). */
+ | {
+    kind: "header";
+    secret: string;
+    header: string;
+    prefix?: string;
+}
+/** `?<param>=<key>` on the query string. */
+ | {
+    kind: "query";
+    secret: string;
+    param: string;
+}
+/**
+ * `Authorization: Basic base64(user:password)`, the placement said
+ * outright, never guessed from the value: the secret is the password
+ * beside `user` (a literal, Mailgun's `api`; or `{ secret }`, a second
+ * Gateway setting, Twilio's SID), the username with an empty password
+ * (Segment, Mixpanel, Crisp), or the whole `login:password` pair, which
+ * may already be base64-encoded (DataForSEO's rule: a base64 string
+ * never holds a colon).
+ */
+ | {
+    kind: "basic";
+    secret: string;
+    as: "password";
+    user: string | {
+        secret: string;
+    };
+} | {
+    kind: "basic";
+    secret: string;
+    as: "username";
+} | {
+    kind: "basic";
+    secret: string;
+    as: "pair";
+};
+/** What a provider says about one of its Gateway settings, for whoever sets it. */
+export interface ProviderSecretDetail {
+    name: string;
+    /** What kind of key, in one sentence: "A restricted key with read access to Customers is enough." */
+    hint?: string;
+}
+/** What a call costs, for the usage counters and the setup text. */
+export interface ProviderCost {
+    unit: "call" | "result" | "token";
+    usd?: number;
+    note?: string;
+    /**
+     * A top-level field of the provider's JSON answer that reports the
+     * call's cost in US dollars (DataForSEO's `cost`); read off the head of
+     * every answer and added to the usage counters. Absent: nothing is read.
+     */
+    responseField?: string;
+}
+/** The provider's rate limits, as hints beside the counters. */
+export interface ProviderRate {
+    perSecond?: number;
+    perMinute?: number;
+    perDay?: number;
+    note?: string;
+}
+/** One request that costs nothing, for a setup guide's Verify step. */
+export interface SmokeRequest {
+    method: "GET" | "HEAD" | "POST";
+    /** One of the provider's hosts; the first when absent. */
+    host?: string;
+    path: string;
+    /** The statuses that mean the key works. */
+    expect: readonly number[];
+    free: boolean;
+    note?: string;
+}
+/** Whether somebody checked the entry against the provider's docs, and how. */
+export type ProviderVerification = {
+    on: string;
+    how: "docs" | "live";
+} | false;
+/** What every provider may say about itself beyond what the gateway enforces. */
+export interface ProviderDetails {
+    /** What it is for, in one line, for lists and agents. */
+    description?: string;
+    /** The API reference, when it isn't the `docs` page. */
+    api?: string;
+    /**
+     * The setup sentence the "Needs setup" dialog and `everyapp status` show
+     * when there is no guide, or beside one: what the key is and where it
+     * comes from, 1 to 3 sentences.
+     */
+    hint?: string;
+    /** Detail per Gateway setting `auth` names. */
+    secrets?: readonly ProviderSecretDetail[];
+    /** What to say to an agent to try it, after "Use <name> to". */
+    example?: string;
+    cost?: ProviderCost;
+    rate?: ProviderRate;
+    verified?: ProviderVerification;
+    tags?: readonly string[];
+}
+export interface ApiKeyCapability extends ProviderDetails {
+    mode: "api_key";
+    /** The provider's name in errors and logs. */
+    label: string;
+    /** Where the key goes, and which Gateway setting holds it. */
+    auth: ApiKeyAuth;
+    /** Where an operator gets the key: the provider's API access page. */
+    docs: string;
+    /** The everyapp skill's setup guide for it, relative to the skill (`setup/dataforseo.md`); a row has none. */
+    setup?: string;
+    /** The only hosts the key is ever sent to, always over https; may be empty when `hostSetting` names the host. */
+    hosts: readonly string[];
+    /**
+     * A Gateway setting naming the provider's host, for a provider whose host
+     * is the operator's (Shopify's `<shop>.myshopify.com`): a bare host or an
+     * https origin with no path, held to the host rules when read
+     * ({@link apiKeyHosts}). Named after the provider like its key.
+     */
+    hostSetting?: string;
+    /**
+     * Whose data the key reaches: `per-call` (search, scrape, inference:
+     * each call is its own) or `account` (every list is the whole account).
+     * A hosted gateway, where one key would be every tenant's, serves
+     * `account` providers to nobody until it holds per-organization keys.
+     */
+    data?: "per-call" | "account";
+    /** The access levels the provider offers; the manifest may ask for these only. */
+    access: readonly CapabilityAccess[];
+    /** Methods an app asking for `access: "read"` may use. */
+    readMethods: readonly string[];
+    /** Methods an app asking for `access: "write"` may use besides, when the provider offers write; {@link DEFAULT_WRITE_METHODS} when absent. */
+    writeMethods?: readonly string[];
+    /**
+     * Paths no app may reach, each as its run of path segments, refused
+     * wherever those segments appear together in the upstream path however
+     * it is spelled (see {@link isAccountWidePath}). One key serves every app
+     * in every organization, so endpoints that list or describe the whole
+     * provider account would show one app another's work.
+     */
+    accountWidePaths: readonly (readonly string[])[];
+    smoke?: SmokeRequest;
+}
+/**
+ * An AI provider (OpenAI, OpenRouter, Workers AI): the AI proxy's table as
+ * a catalog entry. The app's path is joined onto `origin` and `basePath`
+ * (with `{SETTING}` placeholders filled from the Gateway's settings, each
+ * URL-encoded) and must be one of `inferenceRoutes` (a POST), unless both
+ * the operator (`AI_PROXY_EXTRA_ROUTES`) and the app's manifest (`ai.routes`)
+ * allow more (`extraRoutes`). `unstoredRoutes` get `store: false`.
+ * `normalize` names the one response rewrite the gateway has.
+ */
+export interface AiProviderCapability extends ProviderDetails {
+    mode: "ai";
+    label: string;
+    /** Where the key goes: bearer for the three today; Anthropic's `x-api-key` header is a `header` kind. */
+    auth: ApiKeyAuth;
+    docs: string;
+    setup?: string;
+    /** `https://api.openai.com`. */
+    origin: string;
+    /** Gateway settings the URL needs besides the key (`CLOUDFLARE_ACCOUNT_ID`). */
+    alsoNeeds?: readonly string[];
+    /** Joined onto the origin before every path: `/client/v4/accounts/{CLOUDFLARE_ACCOUNT_ID}/ai`. */
+    basePath?: string;
+    inferenceRoutes: readonly string[];
+    unstoredRoutes?: readonly string[];
+    extraRoutes?: boolean;
+    normalize?: "workers-ai";
+}
+/** What `access: "write"` adds to a provider's read methods when its entry doesn't say. */
+export declare const DEFAULT_WRITE_METHODS: readonly string[];
+/**
+ * A capability the gateway performs itself, with no upstream host:
+ * reached at `/api/integrations/<id>/<route>`.
+ */
+export interface GatewayServiceCapability {
+    mode: "service";
+    /** The capability's name in errors and logs. */
+    label: string;
+    /** The access levels it offers; the manifest may ask for these only. */
+    access: readonly CapabilityAccess[];
+    /** Routes under `/api/integrations/<id>/`, each with the methods it takes. */
+    routes: Readonly<Record<string, readonly string[]>>;
+    /** The gateway settings that make it ready (status, the dev fallback). */
+    settings: readonly string[];
+    /** Settings it reads when set (another transport), ready or not. */
+    optionalSettings: readonly string[];
+    /** The everyapp skill's setup guide, when there is anything to set up. */
+    setup?: string;
+}
+/** Where the gateway puts an OAuth client on a token request. */
+export type OAuthClientInjection = "form" | "basic" | "query" | "json";
+/** A token endpoint an `oauth_client` capability completes, with its rule. */
+export interface OAuthTokenEndpoint {
+    /**
+     * The endpoint's host, always over https. Absent: the host the
+     * capability's `hostSetting` names (an instance the operator chose).
+     */
+    host?: string;
+    /** The exact pathname, or a RegExp for versioned ones (Meta's `/v25.0/oauth/access_token`). */
+    path: string | RegExp;
+    methods: readonly ("GET" | "POST")[];
+    /**
+     * Where the client goes: the form body, HTTP Basic, the query string, or
+     * the JSON body (injectClientCredentials() in ./oauthClient.ts).
+     */
+    inject: OAuthClientInjection;
+    /** The fields' names when not `client_id` / `client_secret` (TikTok's `client_key`). */
+    params?: {
+        clientId?: string;
+        clientSecret?: string;
+    };
+}
+/**
+ * One host's allowlist a scope set unlocks. Matched against the raw
+ * pathname, case preserved, by `scopeRouteAllows()` in ./oauthScopes.ts:
+ * the proxy boundary once the gateway holds tokens, tested data until then.
+ */
+export interface OAuthScopeRoute {
+    /** A bare https host, one of the capability's `api` hosts. */
+    host: string;
+    /**
+     * Raw-path entries: exact, or a prefix when the entry ends in `/`. GET
+     * and HEAD go through when one matches.
+     */
+    paths: readonly string[];
+    /**
+     * The read-shaped POSTs a read set allows (queries, watches): anchored,
+     * flagless RegExps over the raw pathname. Every other POST is refused.
+     */
+    posts?: readonly RegExp[];
+}
+/**
+ * A named bundle an app lists under `scopes`: what it asks the provider for
+ * and what that unlocks.
+ */
+export interface OAuthScopeSet {
+    /** What Admin → Apps and a consent page call it: "Gmail (read-only)". */
+    label: string;
+    /**
+     * A read set unlocks GET, HEAD and its `posts` only. No write set exists
+     * on the shared clients yet; adding one is a reviewed registry change.
+     */
+    access: CapabilityAccess;
+    /** The provider's scope strings, requested verbatim (Slack: bot scopes). */
+    scopes: readonly string[];
+    /** Slack's `user_scope` strings, issued to the installing person's own token; absent elsewhere. */
+    userScopes?: readonly string[];
+    routes: readonly OAuthScopeRoute[];
+}
+/** How a provider spells granted scopes in its token response; each has a parser in ./oauthScopes.ts. */
+export type OAuthScopeDialect = "google" | "microsoft" | "slack";
+/**
+ * Everything the gateway needs to hold an app to its scope sets at the
+ * token endpoint. Present means an app's entry must list `scopes` and the
+ * gateway refuses tokens outside them. Data only: the dialect selects the
+ * parser, so the registry stays a table.
+ */
+export interface OAuthScopePolicy {
+    sets: Readonly<Record<string, OAuthScopeSet>>;
+    /**
+     * Scopes a token may carry beyond the declared sets without refusal:
+     * identity and refresh scopes, in every spelling the provider uses.
+     * Never a data scope.
+     */
+    tolerated: readonly string[];
+    /**
+     * Scopes every declaring app asks for whatever its sets, on the authorize
+     * URL and Microsoft's token leg (`offline_access`). Always tolerated.
+     */
+    alwaysRequested: readonly string[];
+    dialect: OAuthScopeDialect;
+    /**
+     * The `tokenGrantType()` values the gateway completes through this
+     * client. `null` is a code exchange that carries no `grant_type` (Slack's
+     * oauth.v2.access).
+     */
+    grantTypes: readonly (string | null)[];
+    /**
+     * What becomes of the token request's `scope` once it passes the check:
+     * `replace` it with the app's requested list (Microsoft's token-leg
+     * extension, which keeps a token to one resource), `drop` it (Google
+     * documents no `scope` on either token leg), or `keep` it (Slack).
+     */
+    requestScope: "replace" | "drop" | "keep";
+    /**
+     * Decoded path segments no set unlocks on any host, compared
+     * case-insensitively: batch tunnels that carry other requests inside, and
+     * resources that reveal secrets under a read scope.
+     */
+    deniedSegments: readonly string[];
+}
+/**
+ * A provider's OAuth client the gateway holds. The gateway completes its
+ * token endpoints only (`token`), putting the client on each request; the
+ * app builds the authorize URL from the public client id and calls the
+ * provider's API with the user tokens it keeps.
+ */
+export interface OAuthClientCapability {
+    mode: "oauth_client";
+    /** The provider's name in errors and logs. */
+    label: string;
+    /** Gateway secret names. No `clientSecret`: a public client, the id alone. */
+    secrets: {
+        clientId: string;
+        clientSecret?: string;
+    };
+    /** The only calls the gateway completes; anything else is refused. */
+    token: readonly OAuthTokenEndpoint[];
+    /**
+     * A gateway setting naming the provider's origin, for a provider with no
+     * fixed one (Mastodon's instance): the host of `token` entries without
+     * their own, and of the authorize URL.
+     */
+    hostSetting?: string;
+    /** The origin when `hostSetting` is unset. */
+    defaultOrigin?: string;
+    /** Obtaining and refreshing user tokens with the operator's client writes. */
+    access: readonly ["write"];
+    /** Where the operator registers the client. */
+    console: string;
+    /** The everyapp skill's setup guide for the client, when one exists. */
+    setup?: string;
+    /**
+     * The authorize endpoint the app sends people to (a path on the
+     * `hostSetting` origin when the provider has none fixed) and the scopes
+     * the client must be allowed: the operator's checklist and the docs. With
+     * a `scopePolicy`, the union of its sets' scopes and `alwaysRequested`.
+     */
+    authorize: {
+        url: string;
+        scopes: readonly string[];
+    };
+    /**
+     * Named scope sets an app lists in its manifest entry's `scopes`, for a
+     * client several apps share with different needs. Absent: the whole
+     * client is the grant, as for Postiz's social networks.
+     */
+    scopePolicy?: OAuthScopePolicy;
+    /** Hosts the app calls afterwards with the user's token (docs only); a scope policy's routes are on them. */
+    api: readonly string[];
+    /**
+     * The redirect paths the operator registers, on the app's host
+     * (`https://<app>.<APP_BASE_DOMAIN><path>`): Postiz's callback pages, the
+     * first app to use these clients.
+     */
+    redirectPaths: readonly string[];
+}
+export type Capability = ApiKeyCapability | AiProviderCapability | OAuthClientCapability | GatewayServiceCapability;
+export declare const CAPABILITIES: {
+    readonly openai: {
+        readonly mode: "ai";
+        readonly label: "OpenAI";
+        readonly description: "OpenAI's models: responses, chat, embeddings, audio, images.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "OPENAI_API_KEY";
+        };
+        readonly docs: "https://platform.openai.com/api-keys";
+        readonly api: "https://platform.openai.com/docs/api-reference";
+        readonly setup: "setup/openai.md";
+        readonly origin: "https://api.openai.com";
+        readonly inferenceRoutes: readonly ["/v1/responses", "/v1/chat/completions", "/v1/embeddings", "/v1/audio/speech", "/v1/audio/transcriptions", "/v1/audio/translations", "/v1/images/generations", "/v1/images/edits", "/v1/images/variations"];
+        readonly unstoredRoutes: readonly ["/v1/responses", "/v1/chat/completions"];
+        readonly extraRoutes: true;
+        readonly hint: "A secret key from the API keys page; the Gateway puts it on every call as a bearer token.";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "live";
+        };
+    };
+    readonly openrouter: {
+        readonly mode: "ai";
+        readonly label: "OpenRouter";
+        readonly description: "One key for many models, through OpenAI's API shape.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "OPENROUTER_API_KEY";
+        };
+        readonly docs: "https://openrouter.ai/settings/keys";
+        readonly api: "https://openrouter.ai/docs";
+        readonly setup: "setup/openrouter.md";
+        readonly origin: "https://openrouter.ai";
+        readonly inferenceRoutes: readonly ["/api/v1/chat/completions", "/api/v1/completions", "/api/v1/responses", "/api/v1/embeddings"];
+        readonly hint: "An API key from OpenRouter's keys page; the Gateway puts it on every call as a bearer token.";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "live";
+        };
+    };
+    readonly "workers-ai": {
+        readonly mode: "ai";
+        readonly label: "Workers AI";
+        readonly description: "Cloudflare's models, in the Gateway's own account.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "WORKERS_AI_API_TOKEN";
+        };
+        readonly docs: "https://dash.cloudflare.com/profile/api-tokens";
+        readonly api: "https://developers.cloudflare.com/workers-ai/";
+        readonly setup: "setup/workers-ai.md";
+        readonly origin: "https://api.cloudflare.com";
+        readonly alsoNeeds: readonly ["CLOUDFLARE_ACCOUNT_ID"];
+        readonly basePath: "/client/v4/accounts/{CLOUDFLARE_ACCOUNT_ID}/ai";
+        readonly inferenceRoutes: readonly ["/v1/chat/completions", "/v1/embeddings", "/v1/responses"];
+        readonly normalize: "workers-ai";
+        readonly hint: "A Cloudflare API token with Workers AI Read (the Workers AI page's prefilled token); the account is the Gateway's own.";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "live";
+        };
+    };
+    readonly dataforseo: {
+        readonly mode: "api_key";
+        readonly label: "DataForSEO";
+        readonly description: "SEO data: keyword metrics, live search results, domain rankings, backlinks.";
+        readonly auth: {
+            readonly kind: "basic";
+            readonly secret: "DATAFORSEO_API_KEY";
+            readonly as: "pair";
+        };
+        readonly docs: "https://app.dataforseo.com/api-access";
+        readonly api: "https://docs.dataforseo.com/v3/";
+        readonly setup: "setup/dataforseo.md";
+        readonly hosts: readonly ["api.dataforseo.com", "sandbox.dataforseo.com"];
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [readonly ["tasks_ready"], readonly ["tasks_fixed"], readonly ["id_list"], readonly ["errors"], readonly ["appendix", "user_data"], readonly ["appendix", "webhook_resend"]];
+        readonly hint: "The API login and password from API Access, as login:password (or that pair base64-encoded); the Gateway sends them as HTTP Basic.";
+        readonly secrets: readonly [{
+            readonly name: "DATAFORSEO_API_KEY";
+            readonly hint: "login:password, or its base64; never the dashboard sign-in password.";
+        }];
+        readonly cost: {
+            readonly unit: "call";
+            readonly responseField: "cost";
+            readonly note: "A Google SERP $0.002 per 10 results; a Labs task $0.012 plus $0.00012 per item.";
+        };
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v3/appendix/user_data";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Account-wide, so the Gateway refuses it for apps; run it from the person's terminal.";
+        };
+        readonly example: "find keyword ideas for a page about running shoes";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "live";
+        };
+    };
+    readonly context: {
+        readonly mode: "api_key";
+        readonly label: "Context.dev";
+        readonly description: "Scrapes and renders web pages, JavaScript included.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "CONTEXT_API_KEY";
+        };
+        readonly docs: "https://context.dev/";
+        readonly setup: "setup/context.md";
+        readonly hosts: readonly ["api.context.dev"];
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "An API key from the Context.dev dashboard; the Gateway puts it on every call as a bearer token.";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "live";
+        };
+    };
+    readonly email: {
+        readonly mode: "service";
+        readonly label: "Email";
+        readonly access: readonly ["write"];
+        readonly routes: {
+            readonly send: readonly ["POST"];
+        };
+        readonly settings: readonly ["EMAIL_FROM", "EMAIL_FROM_NAME"];
+        readonly optionalSettings: readonly ["EMAIL_REST_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID", "RESEND_API_KEY", "EMAIL_PROVIDER"];
+        readonly setup: "setup/email.md";
+    };
+    readonly members: {
+        readonly mode: "service";
+        readonly label: "Members";
+        readonly access: readonly ["read"];
+        readonly routes: {
+            readonly list: readonly ["GET"];
+        };
+        readonly settings: readonly [];
+        readonly optionalSettings: readonly [];
+    };
+    readonly linkedin: {
+        readonly mode: "oauth_client";
+        readonly label: "LinkedIn";
+        readonly secrets: {
+            readonly clientId: "LINKEDIN_CLIENT_ID";
+            readonly clientSecret: "LINKEDIN_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "www.linkedin.com";
+            readonly path: "/oauth/v2/accessToken";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://www.linkedin.com/developers/apps";
+        readonly authorize: {
+            readonly url: "https://www.linkedin.com/oauth/v2/authorization";
+            readonly scopes: readonly ["openid", "profile", "w_member_social", "r_basicprofile", "rw_organization_admin", "w_organization_social", "r_organization_social"];
+        };
+        readonly api: readonly ["api.linkedin.com"];
+        readonly redirectPaths: readonly ["/integrations/social/linkedin", "/integrations/social/linkedin-page"];
+    };
+    readonly facebook: {
+        readonly mode: "oauth_client";
+        readonly label: "Facebook";
+        readonly secrets: {
+            readonly clientId: "FACEBOOK_APP_ID";
+            readonly clientSecret: "FACEBOOK_APP_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "graph.facebook.com";
+            readonly path: RegExp;
+            readonly methods: readonly ["GET", "POST"];
+            readonly inject: "query";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://developers.facebook.com/apps";
+        readonly authorize: {
+            readonly url: "https://www.facebook.com/v25.0/dialog/oauth";
+            readonly scopes: readonly ["pages_show_list", "business_management", "pages_manage_posts", "pages_manage_engagement", "pages_read_engagement", "read_insights", "instagram_basic", "instagram_content_publish", "instagram_manage_comments", "instagram_manage_insights"];
+        };
+        readonly api: readonly ["graph.facebook.com", "graph.instagram.com"];
+        readonly redirectPaths: readonly ["/integrations/social/facebook", "/integrations/social/instagram"];
+    };
+    readonly instagram: {
+        readonly mode: "oauth_client";
+        readonly label: "Instagram";
+        readonly secrets: {
+            readonly clientId: "INSTAGRAM_APP_ID";
+            readonly clientSecret: "INSTAGRAM_APP_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "api.instagram.com";
+            readonly path: "/oauth/access_token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }, {
+            readonly host: "graph.instagram.com";
+            readonly path: "/access_token";
+            readonly methods: readonly ["GET"];
+            readonly inject: "query";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://developers.facebook.com/apps";
+        readonly authorize: {
+            readonly url: "https://www.instagram.com/oauth/authorize";
+            readonly scopes: readonly ["instagram_business_basic", "instagram_business_content_publish", "instagram_business_manage_comments", "instagram_business_manage_insights"];
+        };
+        readonly api: readonly ["graph.instagram.com"];
+        readonly redirectPaths: readonly ["/integrations/social/instagram-standalone"];
+    };
+    readonly threads: {
+        readonly mode: "oauth_client";
+        readonly label: "Threads";
+        readonly secrets: {
+            readonly clientId: "THREADS_APP_ID";
+            readonly clientSecret: "THREADS_APP_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "graph.threads.net";
+            readonly path: "/oauth/access_token";
+            readonly methods: readonly ["GET", "POST"];
+            readonly inject: "query";
+        }, {
+            readonly host: "graph.threads.net";
+            readonly path: "/access_token";
+            readonly methods: readonly ["GET"];
+            readonly inject: "query";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://developers.facebook.com/apps";
+        readonly authorize: {
+            readonly url: "https://threads.net/oauth/authorize";
+            readonly scopes: readonly ["threads_basic", "threads_content_publish", "threads_manage_replies", "threads_manage_insights"];
+        };
+        readonly api: readonly ["graph.threads.net"];
+        readonly redirectPaths: readonly ["/integrations/social/threads"];
+    };
+    readonly youtube: {
+        readonly mode: "oauth_client";
+        readonly label: "YouTube";
+        readonly secrets: {
+            readonly clientId: "YOUTUBE_CLIENT_ID";
+            readonly clientSecret: "YOUTUBE_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "oauth2.googleapis.com";
+            readonly path: "/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://console.cloud.google.com/apis/credentials";
+        readonly setup: "setup/google.md";
+        readonly authorize: {
+            readonly url: "https://accounts.google.com/o/oauth2/v2/auth";
+            readonly scopes: readonly ["https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/youtube", "https://www.googleapis.com/auth/youtube.force-ssl", "https://www.googleapis.com/auth/youtube.readonly", "https://www.googleapis.com/auth/youtube.upload", "https://www.googleapis.com/auth/youtubepartner", "https://www.googleapis.com/auth/yt-analytics.readonly", "https://www.googleapis.com/auth/business.manage"];
+        };
+        readonly api: readonly ["www.googleapis.com", "youtubeanalytics.googleapis.com", "mybusinessaccountmanagement.googleapis.com", "mybusinessbusinessinformation.googleapis.com", "mybusiness.googleapis.com", "businessprofileperformance.googleapis.com"];
+        readonly redirectPaths: readonly ["/integrations/social/youtube", "/integrations/social/gmb"];
+    };
+    readonly tiktok: {
+        readonly mode: "oauth_client";
+        readonly label: "TikTok";
+        readonly secrets: {
+            readonly clientId: "TIKTOK_CLIENT_ID";
+            readonly clientSecret: "TIKTOK_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "open.tiktokapis.com";
+            readonly path: "/v2/oauth/token/";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+            readonly params: {
+                readonly clientId: "client_key";
+            };
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://developers.tiktok.com/apps";
+        readonly authorize: {
+            readonly url: "https://www.tiktok.com/v2/auth/authorize/";
+            readonly scopes: readonly ["video.list", "user.info.basic", "video.publish", "video.upload", "user.info.profile", "user.info.stats"];
+        };
+        readonly api: readonly ["open.tiktokapis.com"];
+        readonly redirectPaths: readonly ["/integrations/social/tiktok"];
+    };
+    readonly "tiktok-business": {
+        readonly mode: "oauth_client";
+        readonly label: "TikTok Business";
+        readonly secrets: {
+            readonly clientId: "TIKTOK_BUSINESS_CLIENT_ID";
+            readonly clientSecret: "TIKTOK_BUSINESS_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "business-api.tiktok.com";
+            readonly path: "/open_api/v1.3/tt_user/oauth2/token/";
+            readonly methods: readonly ["POST"];
+            readonly inject: "json";
+        }, {
+            readonly host: "business-api.tiktok.com";
+            readonly path: "/open_api/v1.3/tt_user/oauth2/refresh_token/";
+            readonly methods: readonly ["POST"];
+            readonly inject: "json";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://business-api.tiktok.com/portal/apps";
+        readonly authorize: {
+            readonly url: "https://www.tiktok.com/v2/auth/authorize/";
+            readonly scopes: readonly ["user.info.basic", "user.info.username", "user.info.stats", "video.list", "video.upload", "video.publish"];
+        };
+        readonly api: readonly ["business-api.tiktok.com"];
+        readonly redirectPaths: readonly ["/integrations/social/tiktok-business/"];
+    };
+    readonly reddit: {
+        readonly mode: "oauth_client";
+        readonly label: "Reddit";
+        readonly secrets: {
+            readonly clientId: "REDDIT_CLIENT_ID";
+            readonly clientSecret: "REDDIT_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "www.reddit.com";
+            readonly path: "/api/v1/access_token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "basic";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://www.reddit.com/prefs/apps";
+        readonly authorize: {
+            readonly url: "https://www.reddit.com/api/v1/authorize";
+            readonly scopes: readonly ["read", "identity", "submit", "flair"];
+        };
+        readonly api: readonly ["oauth.reddit.com"];
+        readonly redirectPaths: readonly ["/integrations/social/reddit"];
+    };
+    readonly pinterest: {
+        readonly mode: "oauth_client";
+        readonly label: "Pinterest";
+        readonly secrets: {
+            readonly clientId: "PINTEREST_CLIENT_ID";
+            readonly clientSecret: "PINTEREST_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "api.pinterest.com";
+            readonly path: "/v5/oauth/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "basic";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://developers.pinterest.com/apps/";
+        readonly authorize: {
+            readonly url: "https://www.pinterest.com/oauth/";
+            readonly scopes: readonly ["boards:read", "boards:write", "pins:read", "pins:write", "user_accounts:read"];
+        };
+        readonly api: readonly ["api.pinterest.com"];
+        readonly redirectPaths: readonly ["/integrations/social/pinterest"];
+    };
+    readonly discord: {
+        readonly mode: "oauth_client";
+        readonly label: "Discord";
+        readonly secrets: {
+            readonly clientId: "DISCORD_CLIENT_ID";
+            readonly clientSecret: "DISCORD_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "discord.com";
+            readonly path: "/api/oauth2/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "basic";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://discord.com/developers/applications";
+        readonly authorize: {
+            readonly url: "https://discord.com/oauth2/authorize";
+            readonly scopes: readonly ["bot", "identify", "guilds"];
+        };
+        readonly api: readonly ["discord.com"];
+        readonly redirectPaths: readonly ["/integrations/social/discord"];
+    };
+    readonly slack: {
+        readonly mode: "oauth_client";
+        readonly label: "Slack";
+        readonly secrets: {
+            readonly clientId: "SLACK_CLIENT_ID";
+            readonly clientSecret: "SLACK_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "slack.com";
+            readonly path: "/api/oauth.v2.access";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://api.slack.com/apps";
+        readonly setup: "setup/slack.md";
+        readonly authorize: {
+            readonly url: "https://slack.com/oauth/v2/authorize";
+            readonly scopes: readonly ["channels:read", "groups:read", "users:read", "users:read.email", "chat:write", "chat:write.public", "chat:write.customize", "channels:join", "channels:manage", "groups:write", "channels:write.invites", "groups:write.invites", "im:write", "files:write", "channels:write"];
+        };
+        readonly scopePolicy: {
+            readonly dialect: "slack";
+            readonly grantTypes: readonly [null, "refresh_token"];
+            readonly requestScope: "keep";
+            readonly alwaysRequested: readonly [];
+            readonly tolerated: readonly [];
+            readonly deniedSegments: readonly [];
+            readonly sets: {
+                readonly "channels.read": {
+                    readonly label: "Channels (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["channels:read", "groups:read"];
+                    readonly routes: readonly [{
+                        readonly host: "slack.com";
+                        readonly paths: readonly ["/api/conversations.list", "/api/conversations.info", "/api/conversations.members", "/api/users.conversations"];
+                        readonly posts: readonly [RegExp, RegExp];
+                    }];
+                };
+                readonly "users.read": {
+                    readonly label: "Members (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["users:read"];
+                    readonly routes: readonly [{
+                        readonly host: "slack.com";
+                        readonly paths: readonly ["/api/users.list", "/api/users.info", "/api/users.getPresence", "/api/bots.info"];
+                        readonly posts: readonly [RegExp, RegExp];
+                    }];
+                };
+                readonly "users.email": {
+                    readonly label: "Members' email addresses (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["users:read.email"];
+                    readonly routes: readonly [{
+                        readonly host: "slack.com";
+                        readonly paths: readonly ["/api/users.lookupByEmail"];
+                        readonly posts: readonly [RegExp];
+                    }];
+                };
+                readonly "messages.write": {
+                    readonly label: "Messages (post as the app)";
+                    readonly access: "write";
+                    readonly scopes: readonly ["chat:write", "chat:write.public", "chat:write.customize"];
+                    readonly routes: readonly [{
+                        readonly host: "slack.com";
+                        readonly paths: readonly ["/api/chat.scheduledMessages.list"];
+                        readonly posts: readonly [RegExp];
+                    }];
+                };
+                readonly "channels.join": {
+                    readonly label: "Channels (join public ones)";
+                    readonly access: "write";
+                    readonly scopes: readonly ["channels:join"];
+                    readonly routes: readonly [{
+                        readonly host: "slack.com";
+                        readonly paths: readonly [];
+                        readonly posts: readonly [RegExp];
+                    }];
+                };
+                readonly "channels.manage": {
+                    readonly label: "Channels (create, manage and invite to; open DMs)";
+                    readonly access: "write";
+                    readonly scopes: readonly ["channels:manage", "groups:write", "channels:write.invites", "groups:write.invites", "im:write"];
+                    readonly routes: readonly [{
+                        readonly host: "slack.com";
+                        readonly paths: readonly [];
+                        readonly posts: readonly [RegExp];
+                    }];
+                };
+                readonly "files.write": {
+                    readonly label: "Files (upload)";
+                    readonly access: "write";
+                    readonly scopes: readonly ["files:write"];
+                    readonly routes: readonly [{
+                        readonly host: "slack.com";
+                        readonly paths: readonly [];
+                        readonly posts: readonly [RegExp];
+                    }];
+                };
+                readonly "user-channels.manage": {
+                    readonly label: "Channels (as the installing person: read, manage, invite to)";
+                    readonly access: "write";
+                    readonly scopes: readonly [];
+                    readonly userScopes: readonly ["channels:read", "channels:write", "groups:read", "groups:write"];
+                    readonly routes: readonly [{
+                        readonly host: "slack.com";
+                        readonly paths: readonly ["/api/conversations.list", "/api/conversations.info", "/api/conversations.members", "/api/users.conversations"];
+                        readonly posts: readonly [RegExp, RegExp];
+                    }];
+                };
+            };
+        };
+        readonly api: readonly ["slack.com"];
+        readonly redirectPaths: readonly ["/integrations/social/slack", "/integrations/slack/callback"];
+    };
+    readonly mastodon: {
+        readonly mode: "oauth_client";
+        readonly label: "Mastodon";
+        readonly secrets: {
+            readonly clientId: "MASTODON_CLIENT_ID";
+            readonly clientSecret: "MASTODON_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly path: "/oauth/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly hostSetting: "MASTODON_URL";
+        readonly defaultOrigin: "https://mastodon.social";
+        readonly access: readonly ["write"];
+        readonly console: "/settings/applications";
+        readonly authorize: {
+            readonly url: "/oauth/authorize";
+            readonly scopes: readonly ["write:statuses", "profile", "write:media"];
+        };
+        readonly api: readonly [];
+        readonly redirectPaths: readonly ["/integrations/social/mastodon"];
+    };
+    readonly kick: {
+        readonly mode: "oauth_client";
+        readonly label: "Kick";
+        readonly secrets: {
+            readonly clientId: "KICK_CLIENT_ID";
+            readonly clientSecret: "KICK_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "id.kick.com";
+            readonly path: "/oauth/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://kick.com/settings/developer";
+        readonly authorize: {
+            readonly url: "https://id.kick.com/oauth/authorize";
+            readonly scopes: readonly ["chat:write", "user:read", "channel:read"];
+        };
+        readonly api: readonly ["api.kick.com"];
+        readonly redirectPaths: readonly ["/integrations/social/kick"];
+    };
+    readonly twitch: {
+        readonly mode: "oauth_client";
+        readonly label: "Twitch";
+        readonly secrets: {
+            readonly clientId: "TWITCH_CLIENT_ID";
+            readonly clientSecret: "TWITCH_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "id.twitch.tv";
+            readonly path: "/oauth2/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://dev.twitch.tv/console/apps";
+        readonly authorize: {
+            readonly url: "https://id.twitch.tv/oauth2/authorize";
+            readonly scopes: readonly ["user:write:chat", "user:read:chat", "moderator:manage:announcements"];
+        };
+        readonly api: readonly ["api.twitch.tv"];
+        readonly redirectPaths: readonly ["/integrations/social/twitch"];
+    };
+    readonly tumblr: {
+        readonly mode: "oauth_client";
+        readonly label: "Tumblr";
+        readonly secrets: {
+            readonly clientId: "TUMBLR_CLIENT_ID";
+            readonly clientSecret: "TUMBLR_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "api.tumblr.com";
+            readonly path: "/v2/oauth2/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://www.tumblr.com/oauth/apps";
+        readonly authorize: {
+            readonly url: "https://www.tumblr.com/oauth2/authorize";
+            readonly scopes: readonly ["write", "offline_access"];
+        };
+        readonly api: readonly ["api.tumblr.com"];
+        readonly redirectPaths: readonly ["/integrations/social/tumblr"];
+    };
+    readonly dribbble: {
+        readonly mode: "oauth_client";
+        readonly label: "Dribbble";
+        readonly secrets: {
+            readonly clientId: "DRIBBBLE_CLIENT_ID";
+            readonly clientSecret: "DRIBBBLE_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "dribbble.com";
+            readonly path: "/oauth/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "query";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://dribbble.com/account/applications";
+        readonly authorize: {
+            readonly url: "https://dribbble.com/oauth/authorize";
+            readonly scopes: readonly ["public", "upload"];
+        };
+        readonly api: readonly ["api.dribbble.com"];
+        readonly redirectPaths: readonly ["/integrations/social/dribbble"];
+    };
+    readonly "google-workspace": {
+        readonly mode: "oauth_client";
+        readonly label: "Google (Gmail, Calendar, Search Console and Analytics)";
+        readonly secrets: {
+            readonly clientId: "GOOGLE_WORKSPACE_CLIENT_ID";
+            readonly clientSecret: "GOOGLE_WORKSPACE_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "oauth2.googleapis.com";
+            readonly path: "/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://console.cloud.google.com/apis/credentials";
+        readonly setup: "setup/google.md";
+        readonly authorize: {
+            readonly url: "https://accounts.google.com/o/oauth2/v2/auth";
+            readonly scopes: readonly ["openid", "email", "profile", "https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/calendar.readonly", "https://www.googleapis.com/auth/webmasters.readonly", "https://www.googleapis.com/auth/analytics.readonly"];
+        };
+        readonly scopePolicy: {
+            readonly dialect: "google";
+            readonly grantTypes: readonly ["authorization_code", "refresh_token"];
+            readonly requestScope: "drop";
+            readonly alwaysRequested: readonly [];
+            readonly tolerated: readonly ["openid", "email", "profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile"];
+            readonly deniedSegments: readonly ["batch", "measurementProtocolSecrets"];
+            readonly sets: {
+                readonly identity: {
+                    readonly label: "Google account (who you are)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["openid", "email", "profile"];
+                    readonly routes: readonly [{
+                        readonly host: "openidconnect.googleapis.com";
+                        readonly paths: readonly ["/v1/userinfo"];
+                    }, {
+                        readonly host: "www.googleapis.com";
+                        readonly paths: readonly ["/oauth2/v2/userinfo", "/oauth2/v3/userinfo", "/userinfo/v2/me"];
+                    }];
+                };
+                readonly "gmail.read": {
+                    readonly label: "Gmail (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["https://www.googleapis.com/auth/gmail.readonly"];
+                    readonly routes: readonly [{
+                        readonly host: "gmail.googleapis.com";
+                        readonly paths: readonly ["/gmail/v1/users/"];
+                        readonly posts: readonly [RegExp];
+                    }];
+                };
+                readonly "calendar.read": {
+                    readonly label: "Google Calendar (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["https://www.googleapis.com/auth/calendar.readonly"];
+                    readonly routes: readonly [{
+                        readonly host: "www.googleapis.com";
+                        readonly paths: readonly ["/calendar/v3/"];
+                        readonly posts: readonly [RegExp, RegExp, RegExp, RegExp];
+                    }];
+                };
+                readonly "search-console.read": {
+                    readonly label: "Search Console (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["https://www.googleapis.com/auth/webmasters.readonly"];
+                    readonly routes: readonly [{
+                        readonly host: "www.googleapis.com";
+                        readonly paths: readonly ["/webmasters/v3/"];
+                        readonly posts: readonly [RegExp];
+                    }, {
+                        readonly host: "searchconsole.googleapis.com";
+                        readonly paths: readonly ["/webmasters/v3/"];
+                        readonly posts: readonly [RegExp, RegExp];
+                    }];
+                };
+                readonly "analytics.read": {
+                    readonly label: "Google Analytics (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["https://www.googleapis.com/auth/analytics.readonly"];
+                    readonly routes: readonly [{
+                        readonly host: "analyticsdata.googleapis.com";
+                        readonly paths: readonly ["/v1beta/properties/"];
+                        readonly posts: readonly [RegExp];
+                    }, {
+                        readonly host: "analyticsadmin.googleapis.com";
+                        readonly paths: readonly ["/v1beta/accountSummaries", "/v1beta/accounts", "/v1beta/accounts/", "/v1beta/properties", "/v1beta/properties/", "/v1alpha/properties/"];
+                    }];
+                };
+            };
+        };
+        readonly api: readonly ["gmail.googleapis.com", "www.googleapis.com", "searchconsole.googleapis.com", "analyticsdata.googleapis.com", "analyticsadmin.googleapis.com", "openidconnect.googleapis.com"];
+        readonly redirectPaths: readonly ["/integrations/google/callback"];
+    };
+    readonly "microsoft-365": {
+        readonly mode: "oauth_client";
+        readonly label: "Microsoft 365 (Outlook mail and calendar)";
+        readonly secrets: {
+            readonly clientId: "MICROSOFT_365_CLIENT_ID";
+            readonly clientSecret: "MICROSOFT_365_CLIENT_SECRET";
+        };
+        readonly token: readonly [{
+            readonly host: "login.microsoftonline.com";
+            readonly path: "/common/oauth2/v2.0/token";
+            readonly methods: readonly ["POST"];
+            readonly inject: "form";
+        }];
+        readonly access: readonly ["write"];
+        readonly console: "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade";
+        readonly setup: "setup/microsoft-365.md";
+        readonly authorize: {
+            readonly url: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
+            readonly scopes: readonly ["offline_access", "User.Read", "Mail.Read", "Calendars.Read"];
+        };
+        readonly scopePolicy: {
+            readonly dialect: "microsoft";
+            readonly grantTypes: readonly ["authorization_code", "refresh_token"];
+            readonly requestScope: "replace";
+            readonly alwaysRequested: readonly ["offline_access"];
+            readonly tolerated: readonly ["openid", "profile", "email", "offline_access", "User.Read"];
+            readonly deniedSegments: readonly ["$batch", "beta"];
+            readonly sets: {
+                readonly identity: {
+                    readonly label: "Microsoft account (who you are)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["User.Read"];
+                    readonly routes: readonly [{
+                        readonly host: "graph.microsoft.com";
+                        readonly paths: readonly ["/v1.0/me", "/oidc/userinfo"];
+                    }];
+                };
+                readonly "mail.read": {
+                    readonly label: "Outlook mail (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["Mail.Read"];
+                    readonly routes: readonly [{
+                        readonly host: "graph.microsoft.com";
+                        readonly paths: readonly ["/v1.0/me/messages", "/v1.0/me/messages/", "/v1.0/me/mailFolders", "/v1.0/me/mailFolders/"];
+                    }];
+                };
+                readonly "calendar.read": {
+                    readonly label: "Outlook calendar (read-only)";
+                    readonly access: "read";
+                    readonly scopes: readonly ["Calendars.Read"];
+                    readonly routes: readonly [{
+                        readonly host: "graph.microsoft.com";
+                        readonly paths: readonly ["/v1.0/me/calendar", "/v1.0/me/calendar/", "/v1.0/me/calendars", "/v1.0/me/calendars/", "/v1.0/me/events", "/v1.0/me/events/", "/v1.0/me/calendarView", "/v1.0/me/calendarView/"];
+                        readonly posts: readonly [RegExp];
+                    }];
+                };
+            };
+        };
+        readonly api: readonly ["graph.microsoft.com"];
+        readonly redirectPaths: readonly ["/integrations/microsoft/callback"];
+    };
+};
+export type CapabilityId = keyof typeof CAPABILITIES;
+type CapabilityIdOf<Mode extends Capability["mode"]> = {
+    [K in CapabilityId]: (typeof CAPABILITIES)[K]["mode"] extends Mode ? K : never;
+}[CapabilityId];
+/** Capabilities an app calls with `integrationFetch()`: providers whose key the gateway holds. */
+export type ApiKeyCapabilityId = CapabilityIdOf<"api_key">;
+/** The AI providers an app lists under `providers` and calls with `createGatewayFetch()`. */
+export type AiProviderId = CapabilityIdOf<"ai">;
+/** Capabilities the gateway performs itself, each with its SDK helper. */
+export type ServiceCapabilityId = CapabilityIdOf<"service">;
+/** OAuth clients whose token endpoints apps reach with `integrationFetch()`. */
+export type OAuthClientCapabilityId = CapabilityIdOf<"oauth_client">;
+/**
+ * The scope set names an OAuth client offers; `never` for a client without
+ * a scope policy. Distributes over a union of ids, so a generic over two
+ * clients gets every name either offers rather than the names they share.
+ */
+export type OAuthScopeSetName<Id extends OAuthClientCapabilityId> = Id extends unknown ? (typeof CAPABILITIES)[Id] extends {
+    scopePolicy: {
+        sets: infer S;
+    };
+} ? keyof S & string : never : never;
+/** The Gateway settings an `auth` block names: the key, and a Basic username held as a setting. */
+type AuthSettingsOf<A> = (A extends {
+    secret: infer S extends string;
+} ? S : never) | (A extends {
+    username: {
+        secret: infer U extends string;
+    };
+} ? U : never);
+type SettingsOf<C> = C extends {
+    settings: readonly (infer S extends string)[];
+    optionalSettings: readonly (infer O extends string)[];
+} ? S | O : C extends {
+    secrets: infer S;
+    token: unknown;
+} ? (S[keyof S] & string) | (C extends {
+    hostSetting: infer H extends string;
+} ? H : never) : C extends {
+    auth: infer A;
+} ? AuthSettingsOf<A> | (C extends {
+    alsoNeeds: readonly (infer N extends string)[];
+} ? N : never) : never;
+/** The gateway settings capabilities read: keys, clients, senders, transports. */
+export type CapabilitySecret = SettingsOf<(typeof CAPABILITIES)[CapabilityId]>;
+/** The Gateway settings an API-key or AI provider's `auth` names: the key first, then a Basic username held as a setting. */
+export declare function authSettingNames(auth: ApiKeyAuth): string[];
+/** Every gateway setting `capability` reads, the ones it needs first. */
+export declare function capabilitySettings(capability: Capability): readonly string[];
+export declare const CAPABILITY_IDS: CapabilityId[];
+export declare function isCapabilityId(value: unknown): value is CapabilityId;
+/**
+ * Where a provider id is looked up: the built-in catalog alone
+ * ({@link CATALOG}), or the catalog and one gateway's registered rows
+ * (`providerRegistry()` in ./providerRegistry.ts). Everything that brokers,
+ * validates or describes a provider takes one, so a registered row is a
+ * provider wherever a catalog entry is.
+ */
+export interface CapabilityLookup {
+    get(id: string): Capability | undefined;
+    /** Every id, in order: the catalog's, then a gateway's rows. */
+    ids(): readonly string[];
+    /**
+     * Whether `id`'s settings may be read now: a registered row's only while
+     * its key was set for the hosts and auth it has (the registry's rule);
+     * absent, as for the catalog alone, every entry's may.
+     */
+    bound?(id: string): boolean;
+}
+/** The built-in catalog as a lookup: what every surface reads without a gateway's rows. */
+export declare const CATALOG: CapabilityLookup;
+/** The ids an app may list under `capabilities`: every provider but the AI ones, which go under `providers`. */
+export declare function capabilityIdsOf(lookup: CapabilityLookup): string[];
+/**
+ * The settings `capability` needs on a request, read from the Gateway's
+ * settings (or `.dev.vars`): the headers to set and the query parameters
+ * to add, or null while any setting its `auth` names is unset or blank.
+ * Values are trimmed. A Basic key without a username is `login:password`
+ * to encode, or taken as already encoded when it holds no colon.
+ */
+export declare function authorizationFor(capability: ApiKeyCapability | AiProviderCapability, settings: CapabilitySettings): Authorization | null;
+/** What {@link authorizationFor} puts on a request. */
+export interface Authorization {
+    headers: Record<string, string>;
+    query: Record<string, string>;
+}
+/** {@link authorizationFor} for an `auth` block alone (the SDK's AI fallback holds the block, not the entry). */
+export declare function authorizationOf(auth: ApiKeyAuth, settings: CapabilitySettings): Authorization | null;
+/**
+ * The host a provider's `hostSetting` names, from its value: a bare host
+ * or an https origin with nothing else (no path, port, query, userinfo),
+ * lowercased; null when unset or not of that shape. The host rules a row
+ * must pass apply to it when the registry reads the row.
+ */
+export declare function hostSettingValue(value: unknown): string | null;
+/**
+ * The hosts an API-key provider's key may be sent to: the entry's own,
+ * and the one its `hostSetting` names when that is set and well-formed.
+ */
+export declare function apiKeyHosts(capability: ApiKeyCapability, settings?: CapabilitySettings): string[];
+/** Where AppGateway serves capability calls. */
+export declare const INTEGRATION_PROXY_PREFIX = "/api/integrations";
+/**
+ * The AppGateway path for a call to `upstream`:
+ * `/api/integrations/<id>/<host><path>?<query>`. The host is in the path so
+ * a provider with several API hosts needs no other channel.
+ */
+export declare function integrationProxyPath(id: ApiKeyCapabilityId | OAuthClientCapabilityId | (string & {}), upstream: URL): string;
+/** The AppGateway path of a service capability's route: `/api/integrations/<id>/<route>`. */
+export declare function serviceRoutePath(id: ServiceCapabilityId, route: string): string;
+/** What an AppGateway capability path names. */
+export type IntegrationProxyRoute = 
+/** A call the gateway forwards to the provider's `upstream` with its key. */
+{
+    kind: "api_key";
+    id: string;
+    capability: ApiKeyCapability;
+    upstream: URL;
+}
+/** A call to one of an OAuth client's token endpoints, with its rule. */
+ | {
+    kind: "oauth_client";
+    id: string;
+    capability: OAuthClientCapability;
+    upstream: URL;
+    endpoint: OAuthTokenEndpoint;
+}
+/** A call to one of the routes a service capability declares. */
+ | {
+    kind: "service";
+    id: ServiceCapabilityId;
+    capability: GatewayServiceCapability;
+    route: string;
+};
+/** Gateway settings by name: the gateway's env, or `.dev.vars` in dev. */
+export type CapabilitySettings = Readonly<Record<string, unknown>>;
+/**
+ * The capability call an AppGateway path names, or null when the path names
+ * an unknown capability (or an AI provider, which has its own route), a
+ * host outside the provider's, a path that could leave that host, a path
+ * that isn't one of an OAuth client's token endpoints, or a route a service
+ * capability doesn't declare. `settings` resolves an OAuth client's
+ * `hostSetting` (Mastodon's instance); `lookup` is where the id is found,
+ * the catalog alone by default.
+ */
+export declare function parseIntegrationProxyPath(pathname: string, search: string, settings?: CapabilitySettings, lookup?: CapabilityLookup): IntegrationProxyRoute | null;
+/**
+ * The origin an OAuth client's `hostSetting` names (its default when the
+ * setting is unset), or null for a client with a fixed host or a setting
+ * that isn't an https origin. A bare host is taken as https.
+ */
+export declare function oauthClientOrigin(capability: OAuthClientCapability, settings: CapabilitySettings | undefined): string | null;
+/**
+ * The token endpoint `upstream` is, by its exact host and path (a RegExp
+ * for a versioned one), or null. Its method is the caller's to check.
+ */
+export declare function tokenEndpointFor(capability: OAuthClientCapability, upstream: URL, settings: CapabilitySettings | undefined): OAuthTokenEndpoint | null;
+/** An OAuth client's token endpoints, as `POST https://host/path` lines for messages. */
+export declare function describeTokenEndpoints(capability: OAuthClientCapability): string;
+/** A token endpoint's path as people read it: a versioned one as `/v<version>/oauth/access_token`. */
+export declare function tokenPathText(path: string | RegExp): string;
+/**
+ * The command that gives the gateway `capability`'s client:
+ * `pnpm everyapp secret set <ID> <SECRET> [<HOST SETTING>]`.
+ */
+export declare function oauthClientSecretSetCommand(capability: OAuthClientCapability): string;
+/**
+ * Whether `pathname` reaches one of the capability's account-wide paths,
+ * however it is spelled: percent-encoded (twice, even), in another case,
+ * with a suffix on a segment, with doubled or backslash separators, or with
+ * a trailing segment. A path that doesn't decode, or that holds control
+ * characters or whitespace once decoded, counts as one; so does anything
+ * outside ASCII for a provider that has account-wide paths, since how it
+ * folds case is its own business.
+ */
+export declare function isAccountWidePath(capability: ApiKeyCapability, pathname: string): boolean;
+/** The base64 of `text`'s UTF-8 bytes (`btoa` takes Latin-1 only). */
+export declare function base64Utf8(text: string): string;
+export {};
+//# sourceMappingURL=capabilities.d.ts.map