@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/internal/gatewaySettings.d.ts

@@ -24,7 +24,8 @@ export declare const GATEWAY_OWN_SETTINGS: readonly ["AI_PROXY_EXTRA_ROUTES", "E
 export type SettableGatewaySetting = Exclude<CapabilitySecret, (typeof INSTALL_OWNED_GATEWAY_SETTINGS)[number]> | (typeof GATEWAY_OWN_SETTINGS)[number];
 /**
  * The Gateway's optional settings `everyapp secret set` changes: every
- * setting a catalog provider reads, then the Gateway's own.
+ * setting a catalog provider reads, the Gateway's own, then the sign-in
+ * providers' (`<ID>_SIGNIN_<FIELD>`, ./signInProviders.ts).
  */
 export declare const SETTABLE_GATEWAY_SETTINGS: readonly SettableGatewaySetting[];
 /**
@@ -51,7 +52,7 @@ export declare function isSettableGatewaySetting(name: string): boolean;
  * are typed and check their shape; anything else is a credential and
  * stays hidden.
  */
-export declare const PLAIN_GATEWAY_SETTINGS: readonly ["EMAIL_FROM", "EMAIL_FROM_NAME", "EMAIL_PROVIDER", "EMAIL_PASSWORD_SIGN_IN", "MASTODON_URL", "AI_PROXY_EXTRA_ROUTES", "MCP_OAUTH_ENABLED", "MCP_DCR_ENABLED", "MCP_ALLOWED_ORIGINS", "MCP_AUDIT_RETENTION_DAYS", "CLOUDFLARE_ACCESS_OIDC_ISSUER", "CLOUDFLARE_ACCESS_OIDC_CLIENT_ID", "CLOUDFLARE_ACCESS_OIDC_LABEL", "CLOUDFLARE_ACCESS_TEAM_DOMAIN", "CLOUDFLARE_ACCESS_AUD", "CLOUDFLARE_ACCESS_APPS_AUD", "CLOUDFLARE_ACCESS_AUTO_JOIN_DOMAINS", "CLOUDFLARE_ACCESS_OUTER_RING_AUTO_JOIN", "HOSTED_OPEN_SIGNUP", "BROWSER_APP_INSTALLS", "DISPATCH_NAMESPACE", "THIRD_PARTY_DOMAIN", "EVENTS_ALLOW_PRIVATE_TARGETS"];
+export declare const PLAIN_GATEWAY_SETTINGS: readonly ["EMAIL_FROM", "EMAIL_FROM_NAME", "EMAIL_PROVIDER", "EMAIL_PASSWORD_SIGN_IN", "AI_PROXY_EXTRA_ROUTES", "MCP_OAUTH_ENABLED", "MCP_DCR_ENABLED", "MCP_ALLOWED_ORIGINS", "MCP_AUDIT_RETENTION_DAYS", "CLOUDFLARE_ACCESS_OIDC_ISSUER", "CLOUDFLARE_ACCESS_OIDC_CLIENT_ID", "CLOUDFLARE_ACCESS_OIDC_LABEL", "CLOUDFLARE_ACCESS_TEAM_DOMAIN", "CLOUDFLARE_ACCESS_AUD", "CLOUDFLARE_ACCESS_APPS_AUD", "CLOUDFLARE_ACCESS_AUTO_JOIN_DOMAINS", "CLOUDFLARE_ACCESS_OUTER_RING_AUTO_JOIN", "HOSTED_OPEN_SIGNUP", "BROWSER_APP_INSTALLS", "DISPATCH_NAMESPACE", "THIRD_PARTY_DOMAIN", "EVENTS_ALLOW_PRIVATE_TARGETS"];
 /** Whether a settable Gateway setting's value is a plain value, not a credential. */
 export declare function isPlainGatewaySetting(name: string): boolean;
 /**

package/dist/internal/gatewaySettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatewaySettings.d.ts","sourceRoot":"","sources":["../../src/internal/gatewaySettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,mLASjC,CAAC;AAMX,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElE;AAoBD,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,yrBAkCvB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAC9B,OAAO,CAAC,gBAAgB,EAAE,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC,GAC1E,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,sBAAsB,EAGtE,CAAC;AAIF;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAgC,CAAC;AAEvE,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,omBAwBmB,CAAC;AAIvD,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,6EAIa,CAAC;AAIvD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,iGAAiG;AACjG,eAAO,MAAM,yBAAyB,yDAI5B,CAAC;AAEX,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAmBD,iDAAiD;AACjD,eAAO,MAAM,8BAA8B,sFAC0C,CAAC;AAEtF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM7D;AAED,4EAA4E;AAC5E,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAQ5E"}
+{"version":3,"file":"gatewaySettings.d.ts","sourceRoot":"","sources":["../../src/internal/gatewaySettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAM3B;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,mLASjC,CAAC;AAMX,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElE;AAmBD,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,yrBAkCvB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAC9B,OAAO,CAAC,gBAAgB,EAAE,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC,GAC1E,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,sBAAsB,EAItE,CAAC;AAIF;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAgC,CAAC;AAEvE,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,olBAuBmB,CAAC;AASvD,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,6EAIa,CAAC;AAIvD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,iGAAiG;AACjG,eAAO,MAAM,yBAAyB,yDAI5B,CAAC;AAEX,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAmBD,iDAAiD;AACjD,eAAO,MAAM,8BAA8B,sFAC0C,CAAC;AAEtF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM7D;AAED,4EAA4E;AAC5E,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAQ5E"}

package/dist/internal/gatewaySettings.js

@@ -11,6 +11,7 @@
  * declaring every settable one.
  */
 import { CAPABILITIES, CAPABILITY_IDS, capabilitySettings, } from "./capabilities.js";
+import { PLAIN_SIGN_IN_SETTINGS, SIGN_IN_GATEWAY_SETTINGS, } from "./signInProviders.js";
 /**
  * The Gateway's own settings: the install writes them once (`everyapp
  * setup`), or an operator by hand (THIRD_PARTY_DEPLOYS), and `everyapp
@@ -33,8 +34,7 @@ export function isInstallOwnedGatewaySetting(name) {
 }
 /**
  * The settings the catalog's providers read (the AI providers' keys, the
- * API-key providers' keys, the OAuth clients and the Mastodon instance's
- * URL), in catalog order, the install's own left out: what `everyapp
+ * API-key providers' keys and hosts, the OAuth clients), in catalog order, the install's own left out: what `everyapp
  * secret set` accepts because a provider reads it. A gateway's registered
  * rows add theirs at run time (providerRegistry.settingNames()).
  */
@@ -75,7 +75,7 @@ export const GATEWAY_OWN_SETTINGS = [
     // gate, THIRD_PARTY_DEPLOYS, is never set from here: it is opened by
     // hand once the launch checks pass (docs/runbooks/hosted-install.md).
     "CF_DEPLOY_TOKEN",
-    // Self-hosted browser installs are on by default; "off" opts out.
+    // Self-hosted Gateway app installs: off unless exactly "on" (everyapp deploy-token add).
     "BROWSER_APP_INSTALLS",
     "DISPATCH_NAMESPACE",
     "THIRD_PARTY_DOMAIN",
@@ -84,11 +84,13 @@ export const GATEWAY_OWN_SETTINGS = [
 ];
 /**
  * The Gateway's optional settings `everyapp secret set` changes: every
- * setting a catalog provider reads, then the Gateway's own.
+ * setting a catalog provider reads, the Gateway's own, then the sign-in
+ * providers' (`<ID>_SIGNIN_<FIELD>`, ./signInProviders.ts).
  */
 export const SETTABLE_GATEWAY_SETTINGS = [
     ...PROVIDER_GATEWAY_SETTINGS,
     ...GATEWAY_OWN_SETTINGS,
+    ...SIGN_IN_GATEWAY_SETTINGS,
 ];
 const SETTABLE = new Set(SETTABLE_GATEWAY_SETTINGS);
 /**
@@ -124,7 +126,6 @@ export const PLAIN_GATEWAY_SETTINGS = [
     "EMAIL_FROM_NAME",
     "EMAIL_PROVIDER",
     "EMAIL_PASSWORD_SIGN_IN",
-    "MASTODON_URL",
     "AI_PROXY_EXTRA_ROUTES",
     "MCP_OAUTH_ENABLED",
     "MCP_DCR_ENABLED",
@@ -144,7 +145,12 @@ export const PLAIN_GATEWAY_SETTINGS = [
     "THIRD_PARTY_DOMAIN",
     "EVENTS_ALLOW_PRIVATE_TARGETS",
 ];
-const PLAIN = new Set(PLAIN_GATEWAY_SETTINGS);
+const PLAIN = new Set([
+    ...PLAIN_GATEWAY_SETTINGS,
+    // The sign-in providers' ids, issuer, label and tenant; their client
+    // secrets are credentials.
+    ...PLAIN_SIGN_IN_SETTINGS,
+]);
 /** Whether a settable Gateway setting's value is a plain value, not a credential. */
 export function isPlainGatewaySetting(name) {
     return PLAIN.has(name);

package/dist/internal/identity.d.ts

@@ -1,12 +1,23 @@
-import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, type SystemClaims, type SystemTokenPurpose } from "./protocol.js";
-export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, };
+import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, type SystemClaims, type SystemTokenPurpose } from "./protocol.js";
+export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, };
 export declare class IdentityError extends Error {
     readonly status = 401;
     constructor(message: string);
 }
 export declare class ConfigurationError extends Error {
     readonly status = 500;
-    constructor(message: string);
+    /**
+     * The Gateway refusal code the same gap gets once deployed
+     * (`ai_provider_not_configured`, `ai_default_not_configured`), when the
+     * error is "not set up" rather than a mistake in the code.
+     */
+    readonly code: string | undefined;
+    /** The settings that would close the gap (`.dev.vars` names in local dev). */
+    readonly settings: readonly string[];
+    constructor(message: string, setup?: {
+        code: string;
+        settings?: readonly string[];
+    });
 }
 /**
  * Parse the public key set from an env var value. Accepts a JSON array of PEM
@@ -35,6 +46,25 @@ export interface VerifyOptions {
  * claims).
  */
 export declare function verifyIdentityJwt(token: string, options: VerifyOptions): Promise<EveryAppUser>;
+/** A verified identity, with when it stops being one. */
+export interface VerifiedIdentity {
+    user: EveryAppUser;
+    /** The token's `exp`, in epoch milliseconds. */
+    expiresAt: number;
+}
+/**
+ * {@link verifyIdentityJwt}, keeping the token's expiry: the SDK's request
+ * context stops forwarding an identity shortly before it, and goes on as
+ * the organization's background work.
+ */
+export declare function verifyIdentity(token: string, options: VerifyOptions): Promise<VerifiedIdentity>;
+/**
+ * The organization pin: a deployed Worker serves one organization
+ * (`EVERY_APP_ORG_ID`), and an identity for any other is refused, whatever
+ * its audience says. Throws {@link IdentityError} on a mismatch; a Worker
+ * with no pin (a shared app's) accepts every organization.
+ */
+export declare function assertOrganizationPin(user: EveryAppUser, organizationId: string | undefined): void;
 /**
  * Verify the gateway's system token (the value of `x-everyapp-system`)
  * fail-closed, for exactly one purpose. A user identity or public marker is
@@ -56,9 +86,16 @@ export interface IdentityResult {
     user: EveryAppUser | null;
     /** True when the gateway marked this request as a public route. */
     isPublic: boolean;
+    /** When the identity expires (epoch ms); null on a public route. */
+    expiresAt: number | null;
 }
 export interface RequestIdentityOptions {
     audience: string;
+    /**
+     * The organization this Worker is pinned to ({@link ORG_ID_ENV}): an
+     * identity for another is refused. Undefined accepts every organization.
+     */
+    organizationId?: string;
     /** Provide keys directly, or let {@link getIdentityFromRequest} read env. */
     publicKeys?: string[];
     /** Env bag to read {@link PUBLIC_KEYS_ENV} / {@link DEV_ENV} from. */
@@ -84,5 +121,5 @@ export declare function resolveVerifyOptions(options: RequestIdentityOptions): V
  * problem — including a bare/forged public header — so a re-exposed worker
  * fails closed.
  */
-export declare function getIdentityFromRequest(request: Request, options: RequestIdentityOptions): Promise<IdentityResult>;
+export declare function getIdentityFromRequest(request: Request | Headers, options: RequestIdentityOptions): Promise<IdentityResult>;
 //# sourceMappingURL=identity.d.ts.map

package/dist/internal/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/internal/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EAKjB,KAAK,YAAY,EACjB,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,CA8B7E;AAYD,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAeD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACvD,OAAO,CAAC,YAAY,CAAC,CAUvB;AAoED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,aAAa,CAwBf;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAiBzB"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/internal/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EAKjB,KAAK,YAAY,EACjB,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,OAAO;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEnC,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE;CAOzD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,CA8B7E;AAYD,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAeD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAY3B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAMN;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACvD,OAAO,CAAC,YAAY,CAAC,CAUvB;AAoED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,aAAa,CAwBf;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAmBzB"}

package/dist/internal/identity.js

@@ -9,8 +9,8 @@
  * survives verification produces a user.
  */
 import { importSPKI, jwtVerify, decodeProtectedHeader, } from "jose";
-import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, assertPublicMarkerClaims, assertSystemClaims, identityClaimsToEveryAppUser, ProtocolClaimsError, } from "./protocol.js";
-export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, };
+import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, assertPublicMarkerClaims, assertSystemClaims, identityClaimsToEveryAppUser, ProtocolClaimsError, } from "./protocol.js";
+export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, };
 export class IdentityError extends Error {
     status = 401;
     constructor(message) {
@@ -20,9 +20,19 @@ export class IdentityError extends Error {
 }
 export class ConfigurationError extends Error {
     status = 500;
-    constructor(message) {
+    /**
+     * The Gateway refusal code the same gap gets once deployed
+     * (`ai_provider_not_configured`, `ai_default_not_configured`), when the
+     * error is "not set up" rather than a mistake in the code.
+     */
+    code;
+    /** The settings that would close the gap (`.dev.vars` names in local dev). */
+    settings;
+    constructor(message, setup) {
         super(message);
         this.name = "ConfigurationError";
+        this.code = setup?.code;
+        this.settings = setup?.settings ?? [];
     }
 }
 /**
@@ -81,9 +91,19 @@ function assertDevIssuer(options) {
  * claims).
  */
 export async function verifyIdentityJwt(token, options) {
+    return (await verifyIdentity(token, options)).user;
+}
+/**
+ * {@link verifyIdentityJwt}, keeping the token's expiry: the SDK's request
+ * context stops forwarding an identity shortly before it, and goes on as
+ * the organization's background work.
+ */
+export async function verifyIdentity(token, options) {
     const payload = await verifyPinnedJwt(token, options, "user");
     try {
-        return identityClaimsToEveryAppUser(payload);
+        const user = identityClaimsToEveryAppUser(payload);
+        // `exp` is a required claim (verifyPinnedJwt); jose checked it.
+        return { user, expiresAt: payload.exp * 1000 };
     }
     catch (error) {
         if (error instanceof ProtocolClaimsError) {
@@ -92,6 +112,17 @@ export async function verifyIdentityJwt(token, options) {
         throw error;
     }
 }
+/**
+ * The organization pin: a deployed Worker serves one organization
+ * (`EVERY_APP_ORG_ID`), and an identity for any other is refused, whatever
+ * its audience says. Throws {@link IdentityError} on a mismatch; a Worker
+ * with no pin (a shared app's) accepts every organization.
+ */
+export function assertOrganizationPin(user, organizationId) {
+    if (organizationId && user.orgId !== organizationId) {
+        throw new IdentityError(`identity is for organization "${user.orgId}", and this Worker serves organization "${organizationId}" (${ORG_ID_ENV})`);
+    }
+}
 /**
  * Verify the gateway's system token (the value of `x-everyapp-system`)
  * fail-closed, for exactly one purpose. A user identity or public marker is
@@ -137,7 +168,7 @@ async function verifyPinnedJwt(token, options, expectedTyp) {
         throw new IdentityError(`unexpected kid "${header.kid}"`);
     }
     if (expectedTyp !== "public" && !options.issuer) {
-        throw new IdentityError(`${ISSUER_ENV} not configured — deploy with the Every App CLI or provide an explicit issuer.`);
+        throw new IdentityError(`${ISSUER_ENV} not configured — deploy with the EveryApp CLI or provide an explicit issuer.`);
     }
     const verifyOpts = {
         algorithms: [IDENTITY_ALG],
@@ -217,15 +248,22 @@ export function resolveVerifyOptions(options) {
  */
 export async function getIdentityFromRequest(request, options) {
     const verifyOptions = resolveVerifyOptions(options);
-    const publicMarker = request.headers.get(PUBLIC_HEADER);
+    const headers = isRequestLike(request) ? request.headers : request;
+    const publicMarker = headers.get(PUBLIC_HEADER);
     if (publicMarker) {
         await verifyPublicMarkerJwt(publicMarker, verifyOptions);
-        return { user: null, isPublic: true };
+        return { user: null, isPublic: true, expiresAt: null };
     }
-    const token = request.headers.get(IDENTITY_HEADER);
+    const token = headers.get(IDENTITY_HEADER);
     if (!token) {
         throw new IdentityError("request reached the app without an identity token (not proxied through the gateway?)");
     }
-    const user = await verifyIdentityJwt(token, verifyOptions);
-    return { user, isPublic: false };
+    const { user, expiresAt } = await verifyIdentity(token, verifyOptions);
+    assertOrganizationPin(user, options.organizationId);
+    return { user, isPublic: false, expiresAt };
+}
+// Duck-typed: a Request from another realm (a test runner, a polyfill) still
+// carries its headers the same way.
+function isRequestLike(value) {
+    return "headers" in value && typeof value.headers?.get === "function";
 }

package/dist/internal/index.d.ts

@@ -2,6 +2,7 @@ export * from "./protocol.js";
 export * from "./tools.js";
 export * from "./capabilities.js";
 export * from "./aiProviders.js";
+export * from "./aiDefault.js";
 export * from "./gatewaySettings.js";
 export * from "./appSettings.js";
 export * from "./email.js";
@@ -9,11 +10,15 @@ export * from "./members.js";
 export * from "./organizationName.js";
 export * from "./oauthClient.js";
 export * from "./oauthScopes.js";
+export * from "./oauthSpec.js";
+export * from "./oauthPresets.js";
 export * from "./providerApps.js";
 export * from "./events.js";
+export * from "./audit.js";
 export * from "./providerSpec.js";
 export * from "./providerRegistry.js";
 export * from "./remoteMcp.js";
+export * from "./signInProviders.js";
 export * from "./devProviders.js";
-export { ConfigurationError, IdentityError, getIdentityFromRequest, parsePublicKeys, resolveVerifyOptions, verifyIdentityJwt, verifyPublicMarkerJwt, verifySystemJwt, type IdentityResult, type RequestIdentityOptions, type VerifyOptions, } from "./identity.js";
+export { ConfigurationError, IdentityError, assertOrganizationPin, getIdentityFromRequest, parsePublicKeys, resolveVerifyOptions, verifyIdentity, verifyIdentityJwt, verifyPublicMarkerJwt, verifySystemJwt, type IdentityResult, type RequestIdentityOptions, type VerifiedIdentity, type VerifyOptions, } from "./identity.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/internal/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/internal/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/internal/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC"}

package/dist/internal/index.js

@@ -2,6 +2,7 @@ export * from "./protocol.js";
 export * from "./tools.js";
 export * from "./capabilities.js";
 export * from "./aiProviders.js";
+export * from "./aiDefault.js";
 export * from "./gatewaySettings.js";
 export * from "./appSettings.js";
 export * from "./email.js";
@@ -9,10 +10,14 @@ export * from "./members.js";
 export * from "./organizationName.js";
 export * from "./oauthClient.js";
 export * from "./oauthScopes.js";
+export * from "./oauthSpec.js";
+export * from "./oauthPresets.js";
 export * from "./providerApps.js";
 export * from "./events.js";
+export * from "./audit.js";
 export * from "./providerSpec.js";
 export * from "./providerRegistry.js";
 export * from "./remoteMcp.js";
+export * from "./signInProviders.js";
 export * from "./devProviders.js";
-export { ConfigurationError, IdentityError, getIdentityFromRequest, parsePublicKeys, resolveVerifyOptions, verifyIdentityJwt, verifyPublicMarkerJwt, verifySystemJwt, } from "./identity.js";
+export { ConfigurationError, IdentityError, assertOrganizationPin, getIdentityFromRequest, parsePublicKeys, resolveVerifyOptions, verifyIdentity, verifyIdentityJwt, verifyPublicMarkerJwt, verifySystemJwt, } from "./identity.js";

package/dist/internal/members.d.ts

@@ -4,8 +4,9 @@
  * gateway builds it, the SDK's `listMembers()` returns it, and its local-dev
  * fallback answers in the same shape. Types only.
  */
-/** A member's role in the organization. */
-export type OrganizationMemberRole = "owner" | "admin" | "member";
+import type { OrgRole } from "./protocol.js";
+/** A member's role in the organization: the identity token's {@link OrgRole}. */
+export type OrganizationMemberRole = OrgRole;
 /**
  * One member of the organization who can open the app: not deactivated,
  * and, for an organization's own app, granted it.

package/dist/internal/members.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../src/internal/members.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,2CAA2C;AAC3C,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElE;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,sBAAsB,CAAC;CAC9B;AAED,2BAA2B;AAC3B,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,yEAAyE;AACzE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,SAAS,CAAC;IACtB,0CAA0C;IAC1C,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,IAAI,CAAC;IACjB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB"}
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../src/internal/members.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,iFAAiF;AACjF,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE7C;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,sBAAsB,CAAC;CAC9B;AAED,2BAA2B;AAC3B,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,yEAAyE;AACzE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,SAAS,CAAC;IACtB,0CAA0C;IAC1C,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,IAAI,CAAC;IACjB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB"}

package/dist/internal/oauthClient.d.ts

@@ -15,8 +15,7 @@ export interface OAuthClientCredentials {
 }
 /**
  * The client `settings` hold for `capability`, or null until every setting
- * it needs is set: the id, the secret (unless it is a public client), and a
- * `hostSetting` that is an https origin when it is set at all.
+ * it needs is set: the id, and the secret unless it is a public client.
  */
 export declare function oauthClientCredentials(capability: OAuthClientCapability, settings: CapabilitySettings): OAuthClientCredentials | null;
 /** A token request: where it goes, its headers, its (buffered) body. */
@@ -32,26 +31,25 @@ export type InjectedTokenRequest = ({
     problem: string;
 };
 /**
- * `request` with `client` put where `rule` says (the form body, HTTP Basic,
- * the query string or the JSON body), and every client credential the app
- * sent removed wherever it was: the `Authorization` header, and
- * `client_id`/`client_secret` (or the rule's names for them, in any case) in
- * the query string and the body. Bodies are re-serialised from their parsed
- * values, so a crafted body can't carry a second secret past the parser.
- * Token requests are form-encoded or JSON; anything else is refused.
+ * `request` with `client` put where `rule` says (the form body or HTTP
+ * Basic), and every client credential the app sent removed wherever it
+ * was: the `Authorization` header, and `client_id`/`client_secret` (in any
+ * case) in the query string and the body. The body is re-serialised from
+ * its parsed values, so a crafted body can't carry a second secret past
+ * the parser. Token requests are form-encoded; anything else is refused.
  */
 export declare function injectClientCredentials(request: TokenRequest, rule: OAuthTokenEndpoint, client: OAuthClientCredentials): InjectedTokenRequest;
 /**
  * The grants the gateway completes: each ends in a user's own tokens. The
  * client-credentials grant, and anything else a network serves on the same
  * endpoint, would mint a token for the gateway's own application instead,
- * which on Meta, Discord, Twitch or Kick manages the application's
- * settings, its webhooks and every tenant's tokens.
+ * which on many providers manages the application's settings, its
+ * webhooks and every tenant's tokens.
  */
 export declare const USER_BOUND_GRANT_TYPES: ReadonlySet<string>;
 /**
  * A token request's `grant_type` as the app sent it, from its body or query
- * string, or null when it names none (Meta's code exchange). Never the
+ * string, or null when it names none (Slack's code exchange). Never the
  * request's other fields.
  */
 export declare function requestedGrantType(request: TokenRequest): string | null;

package/dist/internal/oauthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthClient.d.ts","sourceRoot":"","sources":["../../src/internal/oauthClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,kBAAkB,GAC3B,sBAAsB,GAAG,IAAI,CAW/B;AAMD,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,YAAY,CAAC,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAKnC;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,sBAAsB,GAC7B,oBAAoB,CAyFtB;AAaD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAOrD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAUvE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAInE"}
+{"version":3,"file":"oauthClient.d.ts","sourceRoot":"","sources":["../../src/internal/oauthClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,kBAAkB,GAC3B,sBAAsB,GAAG,IAAI,CAQ/B;AAMD,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,YAAY,CAAC,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAOnC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,sBAAsB,GAC7B,oBAAoB,CAoDtB;AAUD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAIrD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAQvE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAInE"}

package/dist/internal/oauthClient.js

@@ -4,13 +4,12 @@
  * app's token request, and the SDK's local-dev fallback, which puts the
  * developer's own on it the same way.
  */
-import { base64Utf8, oauthClientOrigin, } from "./capabilities.js";
+import { base64Utf8, } from "./capabilities.js";
 /** The largest token request body the gateway reads: real ones are a few hundred bytes. */
 export const OAUTH_TOKEN_BODY_LIMIT = 64 * 1024;
 /**
  * The client `settings` hold for `capability`, or null until every setting
- * it needs is set: the id, the secret (unless it is a public client), and a
- * `hostSetting` that is an https origin when it is set at all.
+ * it needs is set: the id, and the secret unless it is a public client.
  */
 export function oauthClientCredentials(capability, settings) {
     const clientId = settingValue(settings[capability.secrets.clientId]);
@@ -20,72 +19,53 @@ export function oauthClientCredentials(capability, settings) {
         : undefined;
     if (!clientId || (secretName && !clientSecret))
         return null;
-    if (capability.hostSetting && !oauthClientOrigin(capability, settings)) {
-        return null;
-    }
     return { clientId, ...(clientSecret ? { clientSecret } : {}) };
 }
 function settingValue(value) {
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 const FORM = "application/x-www-form-urlencoded";
-const JSON_TYPE = "application/json";
+const isCredential = (name) => ["client_id", "client_secret"].includes(name.toLowerCase());
 /**
- * `request` with `client` put where `rule` says (the form body, HTTP Basic,
- * the query string or the JSON body), and every client credential the app
- * sent removed wherever it was: the `Authorization` header, and
- * `client_id`/`client_secret` (or the rule's names for them, in any case) in
- * the query string and the body. Bodies are re-serialised from their parsed
- * values, so a crafted body can't carry a second secret past the parser.
- * Token requests are form-encoded or JSON; anything else is refused.
+ * `request` with `client` put where `rule` says (the form body or HTTP
+ * Basic), and every client credential the app sent removed wherever it
+ * was: the `Authorization` header, and `client_id`/`client_secret` (in any
+ * case) in the query string and the body. The body is re-serialised from
+ * its parsed values, so a crafted body can't carry a second secret past
+ * the parser. Token requests are form-encoded; anything else is refused.
  */
 export function injectClientCredentials(request, rule, client) {
-    const idName = rule.params?.clientId ?? "client_id";
-    const secretName = rule.params?.clientSecret ?? "client_secret";
-    const credentialNames = new Set(["client_id", "client_secret", idName, secretName].map((name) => name.toLowerCase()));
-    const isCredential = (name) => credentialNames.has(name.toLowerCase());
     const fields = [
-        [idName, client.clientId],
+        ["client_id", client.clientId],
         ...(client.clientSecret
-            ? [[secretName, client.clientSecret]]
+            ? [["client_secret", client.clientSecret]]
             : []),
     ];
     // The query keeps the app's other fields as they were sent.
     const url = new URL(request.url);
-    const query = url.search
+    url.search = url.search
         .slice(1)
         .split("&")
         .filter((pair) => {
         const [name] = new URLSearchParams(pair).keys();
         return pair !== "" && !(name !== undefined && isCredential(name));
-    });
-    if (rule.inject === "query") {
-        query.push(new URLSearchParams(fields).toString());
-    }
-    url.search = query.join("&");
+    })
+        .join("&");
     const headers = new Headers(request.headers);
     headers.delete("authorization");
     headers.delete("content-length");
     if (rule.inject === "basic") {
         headers.set("authorization", `Basic ${base64Utf8(`${client.clientId}:${client.clientSecret ?? ""}`)}`);
     }
-    const type = mediaType(headers.get("content-type"));
     let body = request.body;
     if (body === null || body === "") {
-        // Nothing the app sent; the form and JSON rules make the body.
+        // Nothing the app sent; the form rule makes the body.
         if (rule.inject === "form") {
             headers.set("content-type", FORM);
             body = new URLSearchParams(fields).toString();
         }
-        else if (rule.inject === "json") {
-            headers.set("content-type", JSON_TYPE);
-            body = JSON.stringify(Object.fromEntries(fields));
-        }
     }
-    else if (type === FORM) {
-        if (rule.inject === "json") {
-            return { ok: false, problem: "This token endpoint takes a JSON body." };
-        }
+    else if (mediaType(headers.get("content-type")) === FORM) {
         const params = new URLSearchParams(body);
         for (const name of new Set([...params.keys()].filter(isCredential))) {
             params.delete(name);
@@ -96,31 +76,10 @@ export function injectClientCredentials(request, rule, client) {
         }
         body = params.toString();
     }
-    else if (type === JSON_TYPE) {
-        if (rule.inject === "form") {
-            return {
-                ok: false,
-                problem: `This token endpoint takes a form-encoded body (${FORM}).`,
-            };
-        }
-        const parsed = jsonObject(body);
-        if (!parsed) {
-            return { ok: false, problem: "The body is not a JSON object." };
-        }
-        for (const name of Object.keys(parsed)) {
-            if (isCredential(name))
-                delete parsed[name];
-        }
-        if (rule.inject === "json") {
-            for (const [name, value] of fields)
-                parsed[name] = value;
-        }
-        body = JSON.stringify(parsed);
-    }
     else {
         return {
             ok: false,
-            problem: `A token request's body is form-encoded (${FORM}) or JSON (${JSON_TYPE}).`,
+            problem: `A token request's body is form-encoded (${FORM}).`,
         };
     }
     return { ok: true, url, headers, body };
@@ -130,29 +89,23 @@ const GRANT_TYPES = new Set([
     "authorization_code",
     "refresh_token",
     "client_credentials",
-    "fb_exchange_token",
-    "ig_exchange_token",
-    "th_exchange_token",
     "urn:ietf:params:oauth:grant-type:token-exchange",
 ]);
 /**
  * The grants the gateway completes: each ends in a user's own tokens. The
  * client-credentials grant, and anything else a network serves on the same
  * endpoint, would mint a token for the gateway's own application instead,
- * which on Meta, Discord, Twitch or Kick manages the application's
- * settings, its webhooks and every tenant's tokens.
+ * which on many providers manages the application's settings, its
+ * webhooks and every tenant's tokens.
  */
 export const USER_BOUND_GRANT_TYPES = new Set([
     "authorization_code",
     "refresh_token",
-    "fb_exchange_token",
-    "ig_exchange_token",
-    "th_exchange_token",
     "urn:ietf:params:oauth:grant-type:token-exchange",
 ]);
 /**
  * A token request's `grant_type` as the app sent it, from its body or query
- * string, or null when it names none (Meta's code exchange). Never the
+ * string, or null when it names none (Slack's code exchange). Never the
  * request's other fields.
  */
 export function requestedGrantType(request) {
@@ -161,9 +114,6 @@ export function requestedGrantType(request) {
     if (request.body && type === FORM) {
         value = new URLSearchParams(request.body).get("grant_type");
     }
-    else if (request.body && type === JSON_TYPE) {
-        value = jsonObject(request.body)?.["grant_type"] ?? null;
-    }
     value ??= request.url.searchParams.get("grant_type");
     return typeof value === "string" && value ? value : null;
 }
@@ -181,14 +131,3 @@ export function tokenGrantType(request) {
 function mediaType(contentType) {
     return (contentType ?? "").split(";")[0].trim().toLowerCase();
 }
-function jsonObject(text) {
-    try {
-        const value = JSON.parse(text);
-        return value && typeof value === "object" && !Array.isArray(value)
-            ? value
-            : null;
-    }
-    catch {
-        return null;
-    }
-}