@every-app/sdk 0.2.0 → 0.3.0-rc.10

package/dist/server/aiBinding.js

@@ -0,0 +1,294 @@
+/**
+ * `gatewayAiBinding(env)`: the Gateway's AI providers as a Workers AI
+ * binding, for code written against `env.AI.run(model, inputs, options)`.
+ *
+ * An app on Every App needs no `ai` binding of its own to call models: the
+ * Gateway holds the keys, counts the calls and keeps the app to `ai.models`.
+ * Code that already calls `env.AI.run()` (upstream code a port keeps, the
+ * Agents SDK, `workers-ai-provider`) gets this object in its place:
+ *
+ *   const AI = gatewayAiBinding(env, { for: request });
+ *   await AI.run("@cf/meta/llama-3.1-8b-instruct-fast", { messages });
+ *
+ * Each `run()` becomes an OpenAI-compatible call on the provider's route
+ * through the Gateway (`createGatewayFetch`): text generation (`messages`
+ * or `prompt`) on its chat completions route, text embeddings (`text`) on
+ * its embeddings route, answered in Workers AI's shapes (`{ response,
+ * tool_calls, usage }`, `{ shape, data }`, or a stream of `data:
+ * {"response": …}` events with `stream: true`). In local development
+ * without a Gateway, the developer's own key in `.dev.vars` is used, as
+ * `createGatewayFetch` does (WORKERS_AI_API_TOKEN and CLOUDFLARE_ACCOUNT_ID
+ * for Workers AI).
+ */
+import { AI_DEFAULT_MODEL, AI_DEFAULT_PROVIDER, AI_DEFAULT_ROUTES, ConfigurationError, devAiProvider, } from "../internal/index.js";
+import { BINDING_ORIGIN, createGatewayFetch } from "./gatewayFetch.js";
+import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
+/**
+ * A Workers AI binding (`Ai`) over the Gateway: pass it where code takes
+ * `env.AI`. `run()` covers text generation (messages or prompt; tools;
+ * `stream: true`; `returnRawResponse`, which returns the provider's
+ * OpenAI-shaped `Response`) and text embeddings; the binding's other
+ * methods (`gateway()`, `autorag()`, `models()`, `toMarkdown()`, …) and
+ * other tasks (images, audio, batches, websockets) throw
+ * `ConfigurationError`. `options.gateway` is ignored: the Gateway's
+ * operator decides whether calls go through Cloudflare AI Gateway
+ * (`everyapp ai gateway on`).
+ *
+ * Errors are thrown as a binding throws them: `GatewayRefusalError` when
+ * the Gateway refused (`ai_provider_not_configured`, `model_not_allowed`,
+ * …), `ConfigurationError` where createGatewayFetch throws one (no binding
+ * and no dev key), and an `Error` naming the status when the provider
+ * answered with an error. Nothing is checked when the binding is made, so
+ * making one per request costs nothing.
+ */
+export function gatewayAiBinding(env, options = {}) {
+    const provider = options.provider ?? "workers-ai";
+    async function run(model, inputs, runOptions = {}) {
+        if (runOptions.websocket) {
+            throw unsupported("run() with websocket: true");
+        }
+        if (!inputs || typeof inputs !== "object") {
+            throw unsupported("run() without an inputs object");
+        }
+        if (Array.isArray(inputs["requests"])) {
+            throw unsupported("run() with a batch of requests");
+        }
+        const embedding = !("messages" in inputs) && !("prompt" in inputs) && "text" in inputs;
+        if (!embedding && !("messages" in inputs) && !("prompt" in inputs)) {
+            throw unsupported("run() for anything but text generation (messages or prompt) and text embeddings (text)");
+        }
+        const url = `${BINDING_ORIGIN}/api/ai/${provider}${routeOf(provider, embedding ? "embeddings" : "chat")}`;
+        const sent = modelToSend(provider, model, options.models);
+        const body = embedding
+            ? { model: sent, input: inputs["text"] }
+            : chatBody(sent, inputs);
+        const gatewayFetch = createGatewayFetch({
+            env,
+            for: options.for,
+        });
+        const response = await gatewayFetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+            ...(runOptions.signal ? { signal: runOptions.signal } : {}),
+        });
+        if (runOptions.returnRawResponse)
+            return response;
+        await throwIfFailed(response, provider);
+        if (embedding)
+            return embeddingOutput(await response.json());
+        if (inputs["stream"] === true) {
+            if (!response.body)
+                return new ReadableStream();
+            return response.body.pipeThrough(toWorkersAiStream());
+        }
+        return textOutput(await response.json());
+    }
+    const notHere = (method) => () => {
+        throw unsupported(`env.AI.${method}()`);
+    };
+    const binding = {
+        aiGatewayLogId: null,
+        run,
+        gateway: notHere("gateway"),
+        autorag: notHere("autorag"),
+        aiSearch: notHere("aiSearch"),
+        websearch: notHere("websearch"),
+        models: notHere("models"),
+        toMarkdown: notHere("toMarkdown"),
+    };
+    // `Ai` is the app's own Workers types' class (it changes with each
+    // version); the object above is its working subset, the rest throwing.
+    return binding;
+}
+function unsupported(what) {
+    return new ConfigurationError(`${what} isn't available through the Every App gateway; call the provider's routes with createGatewayFetch() instead.`);
+}
+/** The provider's path for a chat or an embeddings call, under `/api/ai/<provider>`. */
+function routeOf(provider, kind) {
+    if (provider === AI_DEFAULT_PROVIDER)
+        return AI_DEFAULT_ROUTES[kind];
+    const spec = devAiProvider(provider);
+    if (!spec) {
+        throw new ConfigurationError(`gatewayAiBinding: ${JSON.stringify(provider)} is not an AI provider of the catalog.`);
+    }
+    const route = spec[kind];
+    if (!route) {
+        throw new ConfigurationError(`gatewayAiBinding: ${provider} has no OpenAI-compatible ${kind === "chat" ? "chat completions" : "embeddings"} route.`);
+    }
+    return route.path;
+}
+function modelToSend(provider, model, models) {
+    const mapped = models && Object.hasOwn(models, model) ? models[model] : null;
+    if (mapped)
+        return mapped;
+    if (provider === AI_DEFAULT_PROVIDER && model.startsWith("@cf/")) {
+        return AI_DEFAULT_MODEL;
+    }
+    return model;
+}
+/**
+ * Workers AI's text generation inputs as a chat completions body: `prompt`
+ * as one user message, legacy tools (`{ name, description, parameters }`)
+ * as OpenAI's, everything else (max_tokens, temperature, response_format,
+ * stream, …) as it is. Never adds `stream_options` (Workers AI refuses it
+ * on a call that doesn't stream).
+ */
+function chatBody(model, inputs) {
+    const { prompt, messages, tools, raw: _raw, lora: _lora, ...rest } = inputs;
+    const body = {
+        ...rest,
+        model,
+        messages: messages ??
+            (typeof prompt === "string" ? [{ role: "user", content: prompt }] : []),
+    };
+    if (Array.isArray(tools))
+        body["tools"] = tools.map(openAiTool);
+    return body;
+}
+function openAiTool(tool) {
+    if (!isRecord(tool) || "function" in tool)
+        return tool;
+    const { name, description, parameters } = tool;
+    return {
+        type: "function",
+        function: {
+            name,
+            ...(description === undefined ? {} : { description }),
+            ...(parameters === undefined ? {} : { parameters }),
+        },
+    };
+}
+async function throwIfFailed(response, provider) {
+    if (response.ok)
+        return;
+    const refusal = await gatewayRefusal(response.clone());
+    if (refusal)
+        throw new GatewayRefusalError(refusal);
+    const text = await response.text().catch(() => "");
+    throw new Error(`AI (${provider}) answered ${response.status}${text ? `: ${text.slice(0, 500)}` : ""}`);
+}
+/** A chat completion as Workers AI answers text generation. */
+function textOutput(body) {
+    const choice = firstChoice(body);
+    const message = isRecord(choice?.["message"]) ? choice["message"] : {};
+    const toolCalls = workersAiToolCalls(message["tool_calls"]);
+    const usage = isRecord(body) ? body["usage"] : undefined;
+    return {
+        // Workers AI may send an all-digit reply as a JSON number.
+        response: textOf(message["content"]),
+        ...(toolCalls ? { tool_calls: toolCalls } : {}),
+        ...(isRecord(usage) ? { usage } : {}),
+    };
+}
+/**
+ * OpenAI tool calls as both forms Workers AI answers with: the legacy
+ * `{ name, arguments }` (arguments parsed) and the OpenAI-shaped
+ * `{ id, type, function }`.
+ */
+function workersAiToolCalls(calls) {
+    if (!Array.isArray(calls) || calls.length === 0)
+        return undefined;
+    return calls.filter(isRecord).map((call) => {
+        const fn = isRecord(call["function"]) ? call["function"] : {};
+        const args = fn["arguments"];
+        return {
+            ...(call["id"] === undefined ? {} : { id: call["id"] }),
+            type: "function",
+            function: { name: fn["name"], arguments: args },
+            name: fn["name"],
+            arguments: typeof args === "string" ? parsedOr(args) : args,
+        };
+    });
+}
+/** Embeddings as Workers AI answers them: `{ shape: [rows, dimensions], data }`. */
+function embeddingOutput(body) {
+    const rows = isRecord(body) && Array.isArray(body["data"]) ? body["data"] : [];
+    const data = rows
+        .filter(isRecord)
+        .sort((a, b) => Number(a["index"] ?? 0) - Number(b["index"] ?? 0))
+        .map((row) => Array.isArray(row["embedding"]) ? row["embedding"] : []);
+    return { shape: [data.length, data[0]?.length ?? 0], data };
+}
+/**
+ * An OpenAI chat completions event stream as Workers AI streams text:
+ * one `data: {"response": "<token>"}` event per chunk with text (tool call
+ * deltas and usage alongside), then `data: [DONE]`.
+ */
+function toWorkersAiStream() {
+    const decoder = new TextDecoder();
+    const encoder = new TextEncoder();
+    let pending = "";
+    const convert = (line) => {
+        const match = /^data:[ ]?(.*?)\r?$/s.exec(line);
+        if (!match)
+            return "";
+        const data = match[1].trim();
+        if (data === "[DONE]")
+            return "data: [DONE]\n\n";
+        let chunk;
+        try {
+            chunk = JSON.parse(data);
+        }
+        catch {
+            return "";
+        }
+        const choice = firstChoice(chunk);
+        const delta = isRecord(choice?.["delta"]) ? choice["delta"] : {};
+        const usage = isRecord(chunk) ? chunk["usage"] : undefined;
+        const toolCalls = Array.isArray(delta["tool_calls"])
+            ? delta["tool_calls"]
+            : undefined;
+        const event = {
+            response: textOf(delta["content"]),
+            ...(toolCalls ? { tool_calls: toolCalls } : {}),
+            ...(isRecord(usage) ? { usage } : {}),
+        };
+        if (!event.response && !toolCalls && !isRecord(usage))
+            return "";
+        return `data: ${JSON.stringify(event)}\n\n`;
+    };
+    return new TransformStream({
+        transform(bytes, controller) {
+            pending += decoder.decode(bytes, { stream: true });
+            const end = pending.lastIndexOf("\n");
+            if (end === -1)
+                return;
+            const lines = pending.slice(0, end).split("\n");
+            pending = pending.slice(end + 1);
+            const out = lines.map(convert).join("");
+            if (out)
+                controller.enqueue(encoder.encode(out));
+        },
+        flush(controller) {
+            pending += decoder.decode();
+            const out = convert(pending);
+            if (out)
+                controller.enqueue(encoder.encode(out));
+        },
+    });
+}
+function firstChoice(body) {
+    if (!isRecord(body) || !Array.isArray(body["choices"]))
+        return undefined;
+    const choice = body["choices"][0];
+    return isRecord(choice) ? choice : undefined;
+}
+function textOf(content) {
+    if (typeof content === "string")
+        return content;
+    if (typeof content === "number")
+        return String(content);
+    return "";
+}
+function parsedOr(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/server/attribution.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Whom a call through the gateway is for, which decides the organization
+ * it counts against. Left out, it comes from the request context: the
+ * request `everyApp()` is serving (its person, while the identity is good),
+ * or the organization `withOrganization()` named. Given explicitly:
+ *
+ *  - the inbound `Request`: its person, by the identity the gateway put on
+ *    it (forwarded as is);
+ *  - `{ background: true, organizationId }`: work no request started (a
+ *    cron, a Workflow step, a queue). A shared app's Worker serves every
+ *    organization, so it names the one the work is for, which the gateway
+ *    checks is active and has a live member. An organization's own app may
+ *    leave it out (the gateway knows its organization) and may only name
+ *    its own.
+ */
+export type GatewayCallFor = Request | {
+    background: true;
+    organizationId?: string;
+};
+/**
+ * A gateway call that doesn't say whom it is for where it must: from a
+ * shared app's Worker, with neither the request nor an organization.
+ */
+export declare class AttributionError extends Error {
+    readonly code = "attribution_required";
+    constructor(message: string);
+}
+/**
+ * Whom the call is for, checked before any call is made: `target` as the
+ * app passed it, else the request context's answer
+ * ({@link attributionFromContext}; a `RequestContextError` outside every
+ * context). A shared app's Worker must end up with the request or an
+ * organization, and anything passed must be one of the two shapes.
+ */
+export declare function attributionFor(env: object, target: GatewayCallFor | undefined, what: string): GatewayCallFor | undefined;
+/**
+ * Put the call's attribution on its headers: the request's identity, or the
+ * background work's organization, and never one the app set itself.
+ */
+export declare function applyAttribution(headers: Headers, target: GatewayCallFor | undefined): void;
+/** Whether `for` is the inbound request (rather than background work). */
+export declare function isRequest(value: unknown): value is Request;
+//# sourceMappingURL=attribution.d.ts.map

package/dist/server/attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB,OAAO,GACP;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,0BAA0B;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,GACX,cAAc,GAAG,SAAS,CAI5B;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,GAAG,SAAS,GACjC,IAAI,CAUN;AASD,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAO1D"}

package/dist/server/attribution.js

@@ -0,0 +1,75 @@
+import { IDENTITY_HEADER, ORG_HEADER, SHARED_ENV } from "../internal/index.js";
+import { attributionFromContext } from "./context.js";
+/**
+ * A gateway call that doesn't say whom it is for where it must: from a
+ * shared app's Worker, with neither the request nor an organization.
+ */
+export class AttributionError extends Error {
+    code = "attribution_required";
+    constructor(message) {
+        super(message);
+        this.name = "AttributionError";
+    }
+}
+/**
+ * Whom the call is for, checked before any call is made: `target` as the
+ * app passed it, else the request context's answer
+ * ({@link attributionFromContext}; a `RequestContextError` outside every
+ * context). A shared app's Worker must end up with the request or an
+ * organization, and anything passed must be one of the two shapes.
+ */
+export function attributionFor(env, target, what) {
+    const resolved = target === undefined ? attributionFromContext(what) : target;
+    checkAttribution(env, resolved, what);
+    return resolved;
+}
+function checkAttribution(env, target, what) {
+    if (target !== undefined && !isRequest(target)) {
+        if (target === null || typeof target !== "object" || !target.background) {
+            throw new AttributionError(`${what}: \`for\` is the inbound Request or { background: true, organizationId }.`);
+        }
+        if (target.organizationId !== undefined &&
+            !nonEmpty(target.organizationId)) {
+            throw new AttributionError(`${what}: { background: true, organizationId } needs a non-empty organization id.`);
+        }
+    }
+    if (!isSharedWorker(env))
+        return;
+    if (target === undefined || (!isRequest(target) && !target.organizationId)) {
+        throw new AttributionError(`${what} in a shared app's Worker serves every organization, so it must say whom the call is for: for: request, or for: { background: true, organizationId } for work no request started.`);
+    }
+}
+/**
+ * Put the call's attribution on its headers: the request's identity, or the
+ * background work's organization, and never one the app set itself.
+ */
+export function applyAttribution(headers, target) {
+    headers.delete(IDENTITY_HEADER);
+    headers.delete(ORG_HEADER);
+    if (target === undefined)
+        return;
+    if (isRequest(target)) {
+        const identity = target.headers.get(IDENTITY_HEADER);
+        if (identity)
+            headers.set(IDENTITY_HEADER, identity);
+        return;
+    }
+    if (target.organizationId)
+        headers.set(ORG_HEADER, target.organizationId);
+}
+function isSharedWorker(env) {
+    const value = env[SHARED_ENV];
+    return value === "1" || value === "true" || value === true;
+}
+// Duck-typed: a Request from another realm (a test runner, a polyfill) is
+// still the request.
+/** Whether `for` is the inbound request (rather than background work). */
+export function isRequest(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "headers" in value &&
+        typeof value.headers?.get === "function");
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}

package/dist/server/authorizeUrl.d.ts

@@ -0,0 +1,43 @@
+import { type OAuthClientCapabilityId } from "../internal/index.js";
+import type { OAuthClientIntegrationStatus } from "./integrationFetch.js";
+export interface AuthorizeUrlOptions {
+    /** The OAuth client, as listed in the manifest's `capabilities`. */
+    provider: OAuthClientCapabilityId;
+    /** What `integrationStatus()` answered for it, ready and with its `clientId`. */
+    status: OAuthClientIntegrationStatus;
+    /** One of the redirect URIs the operator registered on the client. */
+    redirectUri: string;
+    /** The app's own anti-forgery value, checked when the person comes back. */
+    state: string;
+    /** PKCE: the S256 challenge of the verifier the app keeps for the exchange. */
+    codeChallenge?: string;
+    /**
+     * The provider's extras (`prompt`, `login_hint`, Google's `hd`). Never
+     * one of the parameters this helper sets (PKCE's and the provider's own
+     * included), nor Google's `include_granted_scopes`.
+     */
+    params?: Record<string, string>;
+}
+/**
+ * The provider's authorize URL to send a person to, for a client with
+ * scope sets (`google-workspace`, `microsoft-365`, `slack`), built from the
+ * capability's status: the registry's authorize endpoint (or the instance
+ * the status names), `client_id`, `response_type=code`, `redirect_uri`,
+ * `state`, and the scopes the status allows this app, which are exactly
+ * what the gateway will let the token carry. Each provider's own needs
+ * are added: Google's `access_type=offline` (a refresh token), Microsoft's
+ * `response_mode=query`, Slack's comma-joined `scope` and its `user_scope`
+ * (the status's `userScopes`, when the app's sets include a user set). With
+ * `codeChallenge`, PKCE as S256. The app keeps its `state` and verifier
+ * for the callback.
+ *
+ * A client without scope sets is refused: the
+ * registry's checklist for one isn't what the gateway holds a token to,
+ * so an app builds that URL itself from the status's `clientId`.
+ *
+ * Throws a `TypeError` naming the fix when the client has no scope sets,
+ * when the status isn't ready or has no `clientId`, when the status lacks
+ * `scopes`, or when `params` names a parameter the helper sets.
+ */
+export declare function authorizeUrl({ provider, status, redirectUri, state, codeChallenge, params, }: AuthorizeUrlOptions): URL;
+//# sourceMappingURL=authorizeUrl.d.ts.map

package/dist/server/authorizeUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizeUrl.d.ts","sourceRoot":"","sources":["../../src/server/authorizeUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAE1E,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,QAAQ,EAAE,uBAAuB,CAAC;IAClC,iFAAiF;IACjF,MAAM,EAAE,4BAA4B,CAAC;IACrC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAgCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,MAAM,EACN,WAAW,EACX,KAAK,EACL,aAAa,EACb,MAAM,GACP,EAAE,mBAAmB,GAAG,GAAG,CAqD3B"}

package/dist/server/authorizeUrl.js

@@ -0,0 +1,106 @@
+import { CAPABILITIES, ConfigurationError, } from "../internal/index.js";
+/**
+ * Parameters the helper owns: the status decides the scopes, the caller's
+ * other arguments decide the rest (PKCE from `codeChallenge`, always as
+ * S256), each provider's own are fixed (Google's `access_type=offline` is
+ * what gets a refresh token, Microsoft's `response_mode=query` is what
+ * the callback reads), and Google's `include_granted_scopes` would widen
+ * the token to every scope the person ever granted this client, which the
+ * gateway refuses (`integration_scope_exceeded`).
+ */
+const RESERVED_PARAMS = [
+    "scope",
+    "user_scope",
+    "client_id",
+    "redirect_uri",
+    "state",
+    "response_type",
+    "code_challenge",
+    "code_challenge_method",
+    "access_type",
+    "response_mode",
+    "include_granted_scopes",
+];
+/** The OAuth clients with scope sets: the ones this helper builds for. */
+function scopedClientIds() {
+    return Object.entries(CAPABILITIES)
+        .filter(([, found]) => found.mode === "oauth_client" && found.scopePolicy)
+        .map(([id]) => id);
+}
+/**
+ * The provider's authorize URL to send a person to, for a client with
+ * scope sets (`google-workspace`, `microsoft-365`, `slack`), built from the
+ * capability's status: the registry's authorize endpoint (or the instance
+ * the status names), `client_id`, `response_type=code`, `redirect_uri`,
+ * `state`, and the scopes the status allows this app, which are exactly
+ * what the gateway will let the token carry. Each provider's own needs
+ * are added: Google's `access_type=offline` (a refresh token), Microsoft's
+ * `response_mode=query`, Slack's comma-joined `scope` and its `user_scope`
+ * (the status's `userScopes`, when the app's sets include a user set). With
+ * `codeChallenge`, PKCE as S256. The app keeps its `state` and verifier
+ * for the callback.
+ *
+ * A client without scope sets is refused: the
+ * registry's checklist for one isn't what the gateway holds a token to,
+ * so an app builds that URL itself from the status's `clientId`.
+ *
+ * Throws a `TypeError` naming the fix when the client has no scope sets,
+ * when the status isn't ready or has no `clientId`, when the status lacks
+ * `scopes`, or when `params` names a parameter the helper sets.
+ */
+export function authorizeUrl({ provider, status, redirectUri, state, codeChallenge, params, }) {
+    const capability = oauthClientCapability(provider);
+    if (!capability.scopePolicy) {
+        throw new TypeError(`authorizeUrl() builds URLs for clients with scope sets (${scopedClientIds().join(", ")}); build ${capability.label}'s authorize URL yourself from the status's clientId.`);
+    }
+    if (!status.ready || !status.clientId) {
+        throw new TypeError(`authorizeUrl(${JSON.stringify(provider)}) needs a ready status with a clientId, and integrationStatus() answered ready: ${String(status.ready)}. Show ${capability.label} as not available instead: its operator sets the client up on the gateway, and an app lists the scope sets it uses in everyapp.config.ts.`);
+    }
+    if (!status.scopes) {
+        throw new TypeError(`authorizeUrl(${JSON.stringify(provider)}) takes ${capability.label}'s scopes from integrationStatus().scopes, which this status lacks: pass the status as the gateway (or everyapp dev) answered it.`);
+    }
+    for (const name of Object.keys(params ?? {})) {
+        if (!RESERVED_PARAMS.includes(name))
+            continue;
+        throw new TypeError(name === "include_granted_scopes"
+            ? `authorizeUrl(${JSON.stringify(provider)}): include_granted_scopes would widen the token to every scope the person granted this client, which the gateway refuses (integration_scope_exceeded); leave it out of params.`
+            : `authorizeUrl(${JSON.stringify(provider)}) sets ${name} itself; leave it out of params.`);
+    }
+    const url = new URL(capability.authorize.url);
+    // The status speaks for the gateway: its scopes are the token's ceiling.
+    const scopes = status.scopes;
+    const slack = url.host === "slack.com";
+    url.searchParams.set("client_id", status.clientId);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("state", state);
+    url.searchParams.set("scope", scopes.join(slack ? "," : " "));
+    if (status.userScopes && status.userScopes.length > 0) {
+        url.searchParams.set("user_scope", status.userScopes.join(","));
+    }
+    if (codeChallenge) {
+        url.searchParams.set("code_challenge", codeChallenge);
+        url.searchParams.set("code_challenge_method", "S256");
+    }
+    if (url.host === "accounts.google.com") {
+        // Without it Google issues no refresh token.
+        url.searchParams.set("access_type", "offline");
+    }
+    else if (url.host === "login.microsoftonline.com") {
+        url.searchParams.set("response_mode", "query");
+    }
+    for (const [name, value] of Object.entries(params ?? {})) {
+        url.searchParams.set(name, value);
+    }
+    return url;
+}
+/** The OAuth client `provider` names, from plain JavaScript or a stale type too. */
+function oauthClientCapability(provider) {
+    const found = Object.hasOwn(CAPABILITIES, provider)
+        ? CAPABILITIES[provider]
+        : undefined;
+    if (found?.mode !== "oauth_client") {
+        throw new ConfigurationError(`${JSON.stringify(String(provider))} isn't an OAuth client the gateway holds.`);
+    }
+    return found;
+}

package/dist/server/connectUrl.d.ts

@@ -0,0 +1,21 @@
+import type { ConnectionAccount } from "../internal/index.js";
+export interface ConnectUrlOptions {
+    /** The Worker env: `GATEWAY_URL`, which every deployed Worker and `everyapp dev` set. */
+    env: object;
+    /** The OAuth provider's id (`google-workspace`, `github`). */
+    provider: string;
+    /**
+     * Where to send the person afterwards: the app's own URL (absolute) or
+     * a path on the Gateway. Absent: Settings → Connected accounts.
+     */
+    returnTo?: string;
+    /** Whose connection to make: the person's (default) or the organization's (owner or admin). */
+    account?: ConnectionAccount;
+    /** Scope sets to ask for; absent: the union every active app that lists the provider declares. */
+    sets?: readonly string[];
+}
+/** The path of the connect page for `provider` on the Gateway. */
+export declare function connectPath(provider: string): string;
+/** The absolute URL that starts the Gateway-owned flow for `provider`. */
+export declare function connectUrl({ env, provider, returnTo, account, sets, }: ConnectUrlOptions): string;
+//# sourceMappingURL=connectUrl.d.ts.map

package/dist/server/connectUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectUrl.d.ts","sourceRoot":"","sources":["../../src/server/connectUrl.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,kGAAkG;IAClG,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,EACzB,GAAG,EACH,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,IAAI,GACL,EAAE,iBAAiB,GAAG,MAAM,CAmB5B"}

package/dist/server/connectUrl.js

@@ -0,0 +1,37 @@
+/**
+ * Where an app sends a person to connect an OAuth provider the Gateway
+ * runs the flow for (docs/design/2026-10-oauth-providers.md section 5):
+ * `<gateway>/connect/<id>?return=<back here>&account=<user|organization>`.
+ * The Gateway checks the session, asks the provider for the union of the
+ * sets every active app declares, finishes on its own callback and sends
+ * the browser back to `returnTo`, which must be a path on the Gateway or
+ * an https URL on one of its app hosts (in local dev also localhost).
+ */
+import { ConfigurationError } from "../internal/index.js";
+/** The path of the connect page for `provider` on the Gateway. */
+export function connectPath(provider) {
+    return `/connect/${encodeURIComponent(provider)}`;
+}
+/** The absolute URL that starts the Gateway-owned flow for `provider`. */
+export function connectUrl({ env, provider, returnTo, account, sets, }) {
+    const values = env;
+    const gateway = values["GATEWAY_URL"];
+    if (typeof gateway !== "string" || !gateway.trim()) {
+        throw new ConfigurationError("connectUrl() needs GATEWAY_URL in the Worker env: the deploy sets it, and everyapp dev sets it to the local gateway.");
+    }
+    let base;
+    try {
+        base = new URL(gateway.trim());
+    }
+    catch {
+        throw new ConfigurationError(`GATEWAY_URL isn't a URL: ${gateway}`);
+    }
+    const url = new URL(connectPath(provider), base.origin);
+    if (returnTo)
+        url.searchParams.set("return", returnTo);
+    if (account)
+        url.searchParams.set("account", account);
+    if (sets && sets.length > 0)
+        url.searchParams.set("sets", sets.join(","));
+    return url.toString();
+}