@every-app/sdk 0.2.0 → 0.3.0-rc.10

package/dist/internal/organizationName.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The rule for a workspace's name: what the Gateway's setup claim gives
+ * the first organization, what a personal organization is called, and
+ * what a rename takes (Manage workspace → Rename, `everyapp workspace
+ * rename`). The Gateway and the CLI share it so a name the CLI writes is
+ * one the Gateway would have accepted. A name is user input that reaches
+ * other people: the invitation emails it sends, and every member's
+ * organization switcher.
+ */
+export declare const MAX_ORGANIZATION_NAME_LENGTH = 64;
+/**
+ * The name, trimmed and with its runs of whitespace made single spaces, or
+ * null when it is empty, longer than 64 characters, or has a control or
+ * invisible formatting character (line breaks, bidirectional overrides,
+ * zero-width characters) anywhere in it.
+ */
+export declare function validOrganizationName(raw: string): string | null;
+//# sourceMappingURL=organizationName.d.ts.map

package/dist/internal/organizationName.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationName.d.ts","sourceRoot":"","sources":["../../src/internal/organizationName.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKhE"}

package/dist/internal/organizationName.js

@@ -0,0 +1,24 @@
+/**
+ * The rule for a workspace's name: what the Gateway's setup claim gives
+ * the first organization, what a personal organization is called, and
+ * what a rename takes (Manage workspace → Rename, `everyapp workspace
+ * rename`). The Gateway and the CLI share it so a name the CLI writes is
+ * one the Gateway would have accepted. A name is user input that reaches
+ * other people: the invitation emails it sends, and every member's
+ * organization switcher.
+ */
+export const MAX_ORGANIZATION_NAME_LENGTH = 64;
+/**
+ * The name, trimmed and with its runs of whitespace made single spaces, or
+ * null when it is empty, longer than 64 characters, or has a control or
+ * invisible formatting character (line breaks, bidirectional overrides,
+ * zero-width characters) anywhere in it.
+ */
+export function validOrganizationName(raw) {
+    if (/[\p{Cc}\p{Cf}\u2028\u2029]/u.test(raw))
+        return null;
+    const name = raw.trim().replace(/\s+/g, " ");
+    if (!name || [...name].length > MAX_ORGANIZATION_NAME_LENGTH)
+        return null;
+    return name;
+}

package/dist/internal/protocol.d.ts

@@ -6,25 +6,108 @@
  * and gateway-side JWT minters shared by the platform packages.
  */
 import { type JWTPayload } from "jose";
+import type { ToolCallClaim } from "./tools.js";
 export declare const IDENTITY_ALG = "RS256";
 export declare const IDENTITY_KEY_ID = "everyapp-identity";
 export declare const IDENTITY_DEV_KEY_ID = "everyapp-identity-dev";
+/**
+ * The only issuer a dev-kid token may name. The same value as
+ * `@every-app/sdk/dev`'s, kept apart so the Worker never loads the module
+ * `cloudflare.config.ts` does (a test pins the two together).
+ */
+export declare const DEV_ISSUER = "https://gateway.dev.localhost";
 export declare const IDENTITY_HEADER = "x-everyapp-identity";
 export declare const PUBLIC_HEADER = "x-everyapp-public";
+/**
+ * Carries the gateway's system token on its own calls to an app (the tools
+ * catalog fetch). Never an identity: no user, and it only opens the endpoint
+ * named by its `purpose` claim.
+ */
+export declare const SYSTEM_HEADER = "x-everyapp-system";
+/**
+ * On a refusal the AppGateway binding makes itself (the app's manifest lacks
+ * the capability, the gateway holds no key), as opposed to the provider's
+ * own answer passed through: the refusal's code, also in the JSON body.
+ */
+export declare const GATEWAY_ERROR_HEADER = "x-everyapp-error";
+/**
+ * On a shared app's call to the AppGateway binding for work no request
+ * started (a cron, a Workflow step): the organization the work is for. The
+ * gateway believes it only from a shared app's Worker, and only for an
+ * active organization with a live member; an organization's own app may
+ * only name its own. The perimeter strips it, with every `x-everyapp-*`,
+ * from what browsers send.
+ */
+export declare const ORG_HEADER = "x-everyapp-org";
+/**
+ * Which connection an app's call to an OAuth provider uses: the person's
+ * (`user`, the default when a person is behind the call) or the
+ * organization's (`organization`, the default for background work),
+ * docs/design/2026-10-oauth-providers.md section 7. Set by
+ * `integrationFetch({ account })`; the gateway reads it on the held-token
+ * branch and ignores it elsewhere.
+ */
+export declare const ACCOUNT_HEADER = "x-everyapp-account";
+/** The values {@link ACCOUNT_HEADER} may carry. */
+export type ConnectionAccount = "user" | "organization";
 /** 120-second lifetime — caps revocation staleness while surviving clock skew. */
 export declare const IDENTITY_TTL_SECONDS = 120;
-/** Env var carrying the app id used as the expected identity audience. */
+/** System tokens are minted per call and live at most a minute. */
+export declare const SYSTEM_TOKEN_TTL_SECONDS = 60;
+/** Env var carrying the app's manifest id. */
 export declare const APP_ID_ENV = "EVERYAPP_APP_ID";
+/**
+ * Env var carrying the expected identity audience: the app's Worker name,
+ * which the gateway stamps as `aud` on every token it mints for the app. Two
+ * Workers of one app id (two organizations' copies) never accept each
+ * other's tokens.
+ */
+export declare const AUDIENCE_ENV = "EVERYAPP_AUDIENCE";
 /** Default env var carrying a JSON array of SPKI PEM public keys. */
 export declare const PUBLIC_KEYS_ENV = "EVERYAPP_IDENTITY_PUBLIC_KEYS";
 /** Env var carrying the expected gateway issuer for user identity verification. */
 export declare const ISSUER_ENV = "EVERYAPP_IDENTITY_ISSUER";
+/**
+ * Env var set to `1` on a shared app's Workers (one Worker for every
+ * organization): a gateway call from them must say whom it is for.
+ */
+export declare const SHARED_ENV = "EVERYAPP_SHARED";
 /** When set to `1` or `true` in the worker env, the dev identity kid is accepted. */
 export declare const DEV_ENV = "EVERYAPP_DEV";
+/**
+ * The organization an app's Worker is pinned to (a secret the deploy sends;
+ * in development the stub gateway's organization). `everyApp()` refuses an
+ * identity for any other organization; absent on a shared app's Workers.
+ */
+export declare const ORG_ID_ENV = "EVERY_APP_ORG_ID";
+/**
+ * The organization the dev gateway's seeded user belongs to. The same value
+ * as `@every-app/sdk/dev`'s, kept apart like {@link DEV_ISSUER} (the same
+ * test pins the two together).
+ */
+export declare const DEV_ORG_ID = "dev-org";
 /** `sub` claim the gateway mints public-route markers with. */
 export declare const PUBLIC_MARKER_SUB = "public";
+/** `sub` claim of gateway system tokens. */
+export declare const SYSTEM_TOKEN_SUB = "system";
+/**
+ * Linked dev (`everyapp dev --gateway`, docs/design/linked-dev.md): the
+ * dev Worker's env names the gateway-lite's loopback forwarder and the
+ * run's nonce, and the SDK builds a `{ fetch }` in place of the missing
+ * `EVERY_APP_GATEWAY` binding from them. Set by `everyAppWorker()` in a
+ * development build from the process environment `everyapp dev` starts
+ * the app with; never deployed.
+ */
+export declare const LINKED_DEV_URL_ENV = "EVERYAPP_LINKED_DEV_URL";
+export declare const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
+/** The header the forwarder requires, with the run's nonce: no simple cross-origin request can send it. */
+export declare const LINKED_DEV_HEADER = "x-everyapp-linked-dev";
+/** Where the gateway-lite serves the forwarder, under the app's own host. */
+export declare const LINKED_DEV_FORWARD_PATH = "/__everyapp/gateway";
 export type IdentityChannel = "web" | "api" | "mcp" | "agent";
-export type IdentityTokenType = "user" | "public";
+export type IdentityTokenType = "user" | "public" | "system";
+/** What a system token may open. One purpose per token. */
+export type SystemTokenPurpose = "tools.list";
 /** The actor on whose behalf the request is made (user, MCP client, agent). */
 export interface IdentityActor {
     sub: string;
@@ -34,28 +117,66 @@ export interface IdentitySubject {
     email: string;
     orgId: string;
     orgRole: string;
+    /**
+     * The organization's name as its owners set it (`org_name`), so an app
+     * can show "Acme" rather than an id. Left out when the minter has none.
+     */
+    orgName?: string;
 }
+/**
+ * A member's role in the organization, as the identity token carries it.
+ * Owners and admins manage; anything the Gateway might mint that an app
+ * doesn't know is read as `member`.
+ */
+export type OrgRole = "owner" | "admin" | "member";
+/** `role` as an {@link OrgRole}: `owner` and `admin` as they are, anything else `member`. */
+export declare function toOrgRole(role: unknown): OrgRole;
+/** Whether `user` manages the organization: an owner or an admin. */
+export declare function isAdmin(user: {
+    orgRole: OrgRole | string;
+}): boolean;
 export interface EveryAppUser {
     /** User id (the `sub` claim). */
     id: string;
     email: string;
     orgId: string;
-    orgRole: string;
+    orgRole: OrgRole;
+    /**
+     * The organization's display name (the `org_name` claim), as its owners
+     * set it: trimmed, at most 64 characters, no control characters. Show
+     * it; never key data by it (names change, `orgId` doesn't). Undefined
+     * when the token carries none.
+     */
+    orgName?: string;
     channel: IdentityChannel;
     /** The acting principal (user, or `mcp:<client>` / agent). */
     actor: IdentityActor;
     scopes: string[];
     jti: string;
+    /**
+     * Set only on an MCP tool call (`channel: "mcp"`): the one call this
+     * identity was minted for.
+     */
+    toolCall?: ToolCallClaim;
 }
 export interface IdentityClaims extends JWTPayload {
     typ: "user";
     email: string;
     org_id: string;
     org_role: string;
+    /** The organization's display name; absent when the minter had none. */
+    org_name?: string;
     chan: IdentityChannel;
     act: IdentityActor;
     scopes: string[];
     jti: string;
+    /** Tool-call binding; only the gateway's ToolBus mints it. */
+    tc?: ToolCallClaim;
+}
+export interface SystemClaims extends JWTPayload {
+    typ: "system";
+    purpose: SystemTokenPurpose;
+    jti: string;
 }
 export interface PublicMarkerClaims extends JWTPayload {
     typ: "public";
@@ -69,11 +190,18 @@ export declare function identitySubjectToClaims(subject: IdentitySubject, opts:
     channel?: IdentityChannel;
     actor?: IdentityActor;
     scopes?: string[];
+    toolCall?: ToolCallClaim;
     jti: string;
 }): IdentityClaims;
 export declare function identityClaimsToEveryAppUser(payload: JWTPayload): EveryAppUser;
 export declare function publicMarkerClaims(jti: string): PublicMarkerClaims;
 export declare function assertPublicMarkerClaims(payload: JWTPayload): void;
+/**
+ * A system token opens exactly one endpoint and lives at most
+ * {@link SYSTEM_TOKEN_TTL_SECONDS}: a leaked one is short-lived and useless
+ * anywhere else.
+ */
+export declare function assertSystemClaims(payload: JWTPayload, purpose: SystemTokenPurpose): SystemClaims;
 export interface MintIdentityOptions {
     subject: IdentitySubject;
     /** The app id this token is scoped to — becomes the `aud` claim. */
@@ -82,6 +210,8 @@ export interface MintIdentityOptions {
     channel?: IdentityChannel;
     actor?: IdentityActor;
     scopes?: string[];
+    /** Bind the token to one MCP tool call (`tc` claim). ToolBus only. */
+    toolCall?: ToolCallClaim;
     ttlSeconds?: number;
     now?: number;
     /** Header kid. Defaults to the production kid; dev mints with the dev kid. */
@@ -108,4 +238,21 @@ export interface MintPublicMarkerOptions {
  * an identity token.
  */
 export declare function mintPublicMarkerJwt(privateKeyPem: string, opts: MintPublicMarkerOptions): Promise<string>;
+export interface MintSystemTokenOptions {
+    /** The app id the token is for — becomes the `aud` claim. */
+    audience: string;
+    issuer: string;
+    purpose: SystemTokenPurpose;
+    /** At most {@link SYSTEM_TOKEN_TTL_SECONDS}. */
+    ttlSeconds?: number;
+    now?: number;
+    /** Header kid. Defaults to the production kid; dev mints with the dev kid. */
+    keyId?: string;
+}
+/**
+ * Mint the gateway's system token for `x-everyapp-system`: no user, one
+ * purpose, one app, one minute. The SDK only accepts it on the endpoint its
+ * purpose names, and never as an identity.
+ */
+export declare function mintSystemJwt(privateKeyPem: string, opts: MintSystemTokenOptions): Promise<string>;
 //# sourceMappingURL=protocol.d.ts.map

package/dist/internal/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAE7D,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,0EAA0E;AAC1E,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElD,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAWhB;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CA4Bd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,uBAAuB,CAAC;AACnD,mDAAmD;AACnD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,cAAc,CAAC;AACxD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAEpE;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAehB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CAqCd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAmBd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA0BjB"}

package/dist/internal/protocol.js

@@ -9,20 +9,106 @@ import { SignJWT, importPKCS8 } from "jose";
 export const IDENTITY_ALG = "RS256";
 export const IDENTITY_KEY_ID = "everyapp-identity";
 export const IDENTITY_DEV_KEY_ID = "everyapp-identity-dev";
+/**
+ * The only issuer a dev-kid token may name. The same value as
+ * `@every-app/sdk/dev`'s, kept apart so the Worker never loads the module
+ * `cloudflare.config.ts` does (a test pins the two together).
+ */
+export const DEV_ISSUER = "https://gateway.dev.localhost";
 export const IDENTITY_HEADER = "x-everyapp-identity";
 export const PUBLIC_HEADER = "x-everyapp-public";
+/**
+ * Carries the gateway's system token on its own calls to an app (the tools
+ * catalog fetch). Never an identity: no user, and it only opens the endpoint
+ * named by its `purpose` claim.
+ */
+export const SYSTEM_HEADER = "x-everyapp-system";
+/**
+ * On a refusal the AppGateway binding makes itself (the app's manifest lacks
+ * the capability, the gateway holds no key), as opposed to the provider's
+ * own answer passed through: the refusal's code, also in the JSON body.
+ */
+export const GATEWAY_ERROR_HEADER = "x-everyapp-error";
+/**
+ * On a shared app's call to the AppGateway binding for work no request
+ * started (a cron, a Workflow step): the organization the work is for. The
+ * gateway believes it only from a shared app's Worker, and only for an
+ * active organization with a live member; an organization's own app may
+ * only name its own. The perimeter strips it, with every `x-everyapp-*`,
+ * from what browsers send.
+ */
+export const ORG_HEADER = "x-everyapp-org";
+/**
+ * Which connection an app's call to an OAuth provider uses: the person's
+ * (`user`, the default when a person is behind the call) or the
+ * organization's (`organization`, the default for background work),
+ * docs/design/2026-10-oauth-providers.md section 7. Set by
+ * `integrationFetch({ account })`; the gateway reads it on the held-token
+ * branch and ignores it elsewhere.
+ */
+export const ACCOUNT_HEADER = "x-everyapp-account";
 /** 120-second lifetime — caps revocation staleness while surviving clock skew. */
 export const IDENTITY_TTL_SECONDS = 120;
-/** Env var carrying the app id used as the expected identity audience. */
+/** System tokens are minted per call and live at most a minute. */
+export const SYSTEM_TOKEN_TTL_SECONDS = 60;
+/** Env var carrying the app's manifest id. */
 export const APP_ID_ENV = "EVERYAPP_APP_ID";
+/**
+ * Env var carrying the expected identity audience: the app's Worker name,
+ * which the gateway stamps as `aud` on every token it mints for the app. Two
+ * Workers of one app id (two organizations' copies) never accept each
+ * other's tokens.
+ */
+export const AUDIENCE_ENV = "EVERYAPP_AUDIENCE";
 /** Default env var carrying a JSON array of SPKI PEM public keys. */
 export const PUBLIC_KEYS_ENV = "EVERYAPP_IDENTITY_PUBLIC_KEYS";
 /** Env var carrying the expected gateway issuer for user identity verification. */
 export const ISSUER_ENV = "EVERYAPP_IDENTITY_ISSUER";
+/**
+ * Env var set to `1` on a shared app's Workers (one Worker for every
+ * organization): a gateway call from them must say whom it is for.
+ */
+export const SHARED_ENV = "EVERYAPP_SHARED";
 /** When set to `1` or `true` in the worker env, the dev identity kid is accepted. */
 export const DEV_ENV = "EVERYAPP_DEV";
+/**
+ * The organization an app's Worker is pinned to (a secret the deploy sends;
+ * in development the stub gateway's organization). `everyApp()` refuses an
+ * identity for any other organization; absent on a shared app's Workers.
+ */
+export const ORG_ID_ENV = "EVERY_APP_ORG_ID";
+/**
+ * The organization the dev gateway's seeded user belongs to. The same value
+ * as `@every-app/sdk/dev`'s, kept apart like {@link DEV_ISSUER} (the same
+ * test pins the two together).
+ */
+export const DEV_ORG_ID = "dev-org";
 /** `sub` claim the gateway mints public-route markers with. */
 export const PUBLIC_MARKER_SUB = "public";
+/** `sub` claim of gateway system tokens. */
+export const SYSTEM_TOKEN_SUB = "system";
+/**
+ * Linked dev (`everyapp dev --gateway`, docs/design/linked-dev.md): the
+ * dev Worker's env names the gateway-lite's loopback forwarder and the
+ * run's nonce, and the SDK builds a `{ fetch }` in place of the missing
+ * `EVERY_APP_GATEWAY` binding from them. Set by `everyAppWorker()` in a
+ * development build from the process environment `everyapp dev` starts
+ * the app with; never deployed.
+ */
+export const LINKED_DEV_URL_ENV = "EVERYAPP_LINKED_DEV_URL";
+export const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
+/** The header the forwarder requires, with the run's nonce: no simple cross-origin request can send it. */
+export const LINKED_DEV_HEADER = "x-everyapp-linked-dev";
+/** Where the gateway-lite serves the forwarder, under the app's own host. */
+export const LINKED_DEV_FORWARD_PATH = "/__everyapp/gateway";
+/** `role` as an {@link OrgRole}: `owner` and `admin` as they are, anything else `member`. */
+export function toOrgRole(role) {
+    return role === "owner" || role === "admin" ? role : "member";
+}
+/** Whether `user` manages the organization: an owner or an admin. */
+export function isAdmin(user) {
+    return user.orgRole === "owner" || user.orgRole === "admin";
+}
 export class ProtocolClaimsError extends Error {
     constructor(message) {
         super(message);
@@ -35,12 +121,30 @@ export function identitySubjectToClaims(subject, opts) {
         email: subject.email,
         org_id: subject.orgId,
         org_role: subject.orgRole,
+        ...(subject.orgName ? { org_name: subject.orgName } : {}),
         chan: opts.channel ?? "web",
         act: opts.actor ?? { sub: subject.sub },
         scopes: opts.scopes ?? ["*"],
         jti: opts.jti,
+        ...(opts.toolCall
+            ? { tc: { id: opts.toolCall.id, name: opts.toolCall.name } }
+            : {}),
     };
 }
+function parseToolCallClaim(value) {
+    if (value === undefined)
+        return undefined;
+    const claim = value;
+    if (!claim ||
+        typeof claim !== "object" ||
+        typeof claim.id !== "string" ||
+        typeof claim.name !== "string" ||
+        !claim.id ||
+        !claim.name) {
+        throw new ProtocolClaimsError("identity token has a malformed tc claim");
+    }
+    return { id: claim.id, name: claim.name };
+}
 export function identityClaimsToEveryAppUser(payload) {
     if (payload.typ !== "user") {
         throw new ProtocolClaimsError("identity token has wrong typ");
@@ -52,20 +156,28 @@ export function identityClaimsToEveryAppUser(payload) {
     if (!sub || !email || !orgId || !orgRole) {
         throw new ProtocolClaimsError("identity token missing required claims");
     }
+    // Display only, so a token without it (or with a malformed one) is still
+    // an identity: the app falls back to no name.
+    const orgName = typeof payload.org_name === "string" && payload.org_name
+        ? payload.org_name
+        : undefined;
     const chan = payload.chan ?? "web";
     const act = payload.act ?? { sub };
     const scopes = Array.isArray(payload.scopes)
         ? payload.scopes.filter((scope) => typeof scope === "string")
         : ["*"];
+    const toolCall = parseToolCallClaim(payload.tc);
     return {
         id: sub,
         email,
         orgId,
-        orgRole,
+        orgRole: toOrgRole(orgRole),
+        ...(orgName ? { orgName } : {}),
         channel: chan,
         actor: { sub: act.sub ?? sub },
         scopes,
         jti: payload.jti ?? "",
+        ...(toolCall ? { toolCall } : {}),
     };
 }
 export function publicMarkerClaims(jti) {
@@ -79,6 +191,25 @@ export function assertPublicMarkerClaims(payload) {
         throw new ProtocolClaimsError("token is not a public-route marker");
     }
 }
+/**
+ * A system token opens exactly one endpoint and lives at most
+ * {@link SYSTEM_TOKEN_TTL_SECONDS}: a leaked one is short-lived and useless
+ * anywhere else.
+ */
+export function assertSystemClaims(payload, purpose) {
+    if (payload.typ !== "system" || payload.sub !== SYSTEM_TOKEN_SUB) {
+        throw new ProtocolClaimsError("token is not a system token");
+    }
+    if (payload.purpose !== purpose) {
+        throw new ProtocolClaimsError(`system token purpose "${String(payload.purpose)}" is not "${purpose}"`);
+    }
+    if (typeof payload.iat !== "number" ||
+        typeof payload.exp !== "number" ||
+        payload.exp - payload.iat > SYSTEM_TOKEN_TTL_SECONDS) {
+        throw new ProtocolClaimsError(`system token must expire within ${SYSTEM_TOKEN_TTL_SECONDS}s of issue`);
+    }
+    return payload;
+}
 let cachedPrivateKey = null;
 async function loadPrivateKey(privateKeyPem) {
     const pem = privateKeyPem.replace(/\\n/g, "\n");
@@ -102,6 +233,7 @@ export async function mintIdentityJwt(privateKeyPem, opts) {
         channel: opts.channel,
         actor: opts.actor,
         scopes: opts.scopes,
+        toolCall: opts.toolCall,
         jti,
     }))
         .setProtectedHeader({
@@ -137,3 +269,32 @@ export async function mintPublicMarkerJwt(privateKeyPem, opts) {
         .setExpirationTime(nowSec + ttl)
         .sign(key);
 }
+/**
+ * Mint the gateway's system token for `x-everyapp-system`: no user, one
+ * purpose, one app, one minute. The SDK only accepts it on the endpoint its
+ * purpose names, and never as an identity.
+ */
+export async function mintSystemJwt(privateKeyPem, opts) {
+    const ttl = opts.ttlSeconds ?? SYSTEM_TOKEN_TTL_SECONDS;
+    if (ttl <= 0 || ttl > SYSTEM_TOKEN_TTL_SECONDS) {
+        throw new RangeError(`system tokens live at most ${SYSTEM_TOKEN_TTL_SECONDS}s (got ${ttl})`);
+    }
+    const key = await loadPrivateKey(privateKeyPem);
+    const nowSec = Math.floor((opts.now ?? Date.now()) / 1000);
+    const claims = {
+        typ: "system",
+        purpose: opts.purpose,
+        jti: crypto.randomUUID(),
+    };
+    return new SignJWT(claims)
+        .setProtectedHeader({
+        alg: IDENTITY_ALG,
+        kid: opts.keyId ?? IDENTITY_KEY_ID,
+    })
+        .setIssuer(opts.issuer)
+        .setSubject(SYSTEM_TOKEN_SUB)
+        .setAudience(opts.audience)
+        .setIssuedAt(nowSec)
+        .setExpirationTime(nowSec + ttl)
+        .sign(key);
+}

package/dist/internal/providerApps.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Provider apps, "MCP apps" to the person: a data provider (DataForSEO
+ * today) offered to members as an app of the Gateway's own, with no page
+ * and no Worker to deploy. The operator turns it on (`everyapp mcp on
+ * <id>`) and sets the provider's key as a Gateway setting; the Gateway then
+ * serves the provider's tools on its `/mcp` under `<id>_<tool>` names, with
+ * the key never leaving the Gateway, every call attributed to the member
+ * who made it, counted and audited like an app's capability calls. The
+ * launcher lists it under "MCP apps" and its card opens the "Use it from
+ * your agent" dialog instead of a page (docs/design/2026-10-mcp-apps-ui.md).
+ *
+ * A provider app is an `apps` row of tier {@link PROVIDER_APP_TIER} with no
+ * hostname and no Worker name: the perimeter never routes it, and the
+ * Gateway reaches its tools in-process rather than over a service binding.
+ * Its manifest is generated here, so the settings model
+ * (./appSettings.ts) reads the provider's key as a required Gateway setting
+ * like any app's capability. The registry rules that write the row are in
+ * `@every-app/perimeter/registry` (providerApps.ts); the Gateway serves it
+ * from `apps/every-app-gateway/src/server/provider-apps/`.
+ */
+import { type ApiKeyCapabilityId } from "./capabilities.js";
+/** The `apps.tier` of a provider app: no Worker, served by the Gateway itself. */
+export declare const PROVIDER_APP_TIER = "provider";
+export interface ProviderAppDefinition {
+    /** The app id (its slug and tool-name prefix): lowercase, no underscore. */
+    id: string;
+    /** What Admin → Apps and the launcher call it. */
+    name: string;
+    /** What it is for, as the app library and `everyapp_list_apps` tell it. */
+    description: string;
+    /**
+     * The `api_key` capability whose Gateway setting holds the key and whose
+     * proxy rules (hosts, methods, account-wide paths) every tool call obeys.
+     */
+    capability: ApiKeyCapabilityId;
+    /** Why the app lists the capability: the manifest entry's `why`. */
+    why: string;
+    /**
+     * What to say to an agent to try it, after "Use <name> to": the "Use it
+     * from your agent" dialog's example sentence.
+     */
+    example: string;
+}
+export declare const PROVIDER_APPS: {
+    readonly dataforseo: {
+        readonly id: "dataforseo";
+        readonly name: "DataForSEO";
+        readonly description: "SEO data for your agent: keyword metrics and suggestions, live Google results, domain rankings, competitors and backlinks, through the Gateway's DataForSEO key.";
+        readonly capability: "dataforseo";
+        readonly why: "Serves DataForSEO's keyword, search-result, domain and backlink data to members' AI clients.";
+        readonly example: "find keyword ideas for a page about running shoes";
+    };
+};
+export type ProviderAppId = keyof typeof PROVIDER_APPS;
+/** The provider app ids, in a stable order. */
+export declare const PROVIDER_APP_IDS: ProviderAppId[];
+export declare function isProviderAppId(id: string): id is ProviderAppId;
+/** The Gateway setting that holds a provider app's key (`DATAFORSEO_API_KEY`). */
+export declare function providerAppKeySetting(id: ProviderAppId): string;
+/**
+ * The manifest a provider app's registry row stores: what a deployed app
+ * would declare to use the same capability, so Admin → Apps, the settings
+ * model and the integration proxy read it like any app's. Read-only
+ * access: every provider app only reads data.
+ */
+export declare function providerAppManifest(id: ProviderAppId): {
+    id: string;
+    name: string;
+    description: string;
+    capabilities: Record<string, {
+        access: "read";
+        why: string;
+    }>;
+};
+//# sourceMappingURL=providerApps.d.ts.map

package/dist/internal/providerApps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerApps.d.ts","sourceRoot":"","sources":["../../src/internal/providerApps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAE5C,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAC/B,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,aAAa;;;;;;;;;CAUgC,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,aAAa,CAAC;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB,EAEjB,aAAa,EAAE,CAAC;AAE5B,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,aAAa,CAE/D;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,aAAa,GAAG;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D,CAUA"}