@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/internal/oauthScopes.d.ts

@@ -7,7 +7,7 @@
  * check, the SDK's local-dev twin of it and, later, the proxy and the
  * outbound Worker. Nothing here reads a secret or a token value.
  */
-import type { OAuthScopePolicy } from "./capabilities.js";
+import type { OAuthScopeDialect, OAuthScopePolicy } from "./capabilities.js";
 import type { TokenRequest } from "./oauthClient.js";
 /** Scopes by the token they belong to: the bot or only token, and Slack's user token. */
 export interface ScopeList {
@@ -58,6 +58,54 @@ export declare function carriesToken(json: unknown): boolean;
  * hold to anything.
  */
 export declare function grantedScopes(policy: OAuthScopePolicy, json: unknown): GrantedScopes | null;
+/**
+ * What a token response granted, for the Gateway-owned flow: as
+ * {@link grantedScopes}, except that a `space` or `comma` provider that
+ * names no `scope` at all is taken at its word (RFC 6749 §5.1: the field
+ * is optional when the grant matches the request), so `requested` stands.
+ * The three parsed dialects keep failing closed.
+ */
+export declare function grantedScopesOrRequested(policy: OAuthScopePolicy, json: unknown, requested: ScopeList): GrantedScopes | null;
+/** Why the proxy refuses a held-token call, with what would let it through. */
+export type HeldTokenRefusal = {
+    ok: false;
+    code: "integration_not_connected";
+    /** The declared sets the connection was not granted. */
+    missingSets: string[];
+} | {
+    ok: false;
+    code: "integration_scope_not_allowed" | "integration_method_not_allowed";
+    message: string;
+};
+/**
+ * Whether an app's call with a held token goes through, and under which
+ * set (docs/design/2026-10-oauth-providers.md section 7). In order: every
+ * set the app declares must be among the connection's (else the person
+ * connects again: `integration_not_connected` with the missing sets); the
+ * host must be one of the provider's `api` hosts; the path passes the
+ * segment rules (`scopeRouteAllows`'s: no batch tunnels, no dot segments,
+ * no denied segments); then a declared set with routes must cover the
+ * call, or a declared set without routes covers its hosts by access: a
+ * read set unlocks `readMethods` (GET and HEAD by default), a write set
+ * every method the provider offers. `writes` says whether the method is
+ * one the grant allows beyond reads, decided by the caller as for an
+ * API-key provider.
+ */
+export declare function heldTokenCallAllowed({ policy, declaredSets, connectionSets, hosts, method, upstream, readMethods, writes, }: {
+    policy: OAuthScopePolicy;
+    declaredSets: readonly string[];
+    connectionSets: readonly string[];
+    /** The provider's `api` hosts. */
+    hosts: readonly string[];
+    method: string;
+    upstream: URL;
+    readMethods?: readonly string[];
+    /** Whether `method` is a write the app's grant allows. */
+    writes: boolean;
+}): {
+    ok: true;
+    set: string;
+} | HeldTokenRefusal;
 /**
  * What `granted` carries beyond `allowed`, per token kind, for a refusal's
  * message and log line: the user token's extras as `user:<scope>`. Both
@@ -109,6 +157,13 @@ export declare function rewriteTokenRequestScope(policy: OAuthScopePolicy, sets:
  * the token to a path this never matched.
  */
 export declare function scopeRouteAllows(policy: OAuthScopePolicy, sets: readonly string[], method: string, upstream: URL): string | null;
+/** `scopes` in the dialect's one spelling, deduplicated, order kept. */
+/**
+ * `scopes` in the dialect's canonical spelling (Google's long names,
+ * Microsoft's bare lower-case names), for comparing a set's scopes with
+ * what a token response says it granted.
+ */
+export declare function canonicalScopes(dialect: OAuthScopeDialect, scopes: readonly string[]): string[];
 /**
  * `text` as a JSON object, or null for anything else (an array, a scalar,
  * not JSON). Shared with the gateway's read of a provider's token answer.

package/dist/internal/oauthScopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthScopes.d.ts","sourceRoot":"","sources":["../../src/internal/oauthScopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAEV,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,yFAAyF;AACzF,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GACtC,MAAM,EAAE,GAAG,IAAI,CAejB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,SAAS,CASX;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,SAAS,CASX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CASnD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,OAAO,GACZ,aAAa,GAAG,IAAI,CA6BtB;AA+BD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS,GACjB,MAAM,EAAE,CASV;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,YAAY,GACpB,aAAa,GAAG,IAAI,CAStB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,YAAY,GACpB,YAAY,CA+Bd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,GAAG,GACZ,MAAM,GAAG,IAAI,CAsBf;AAwJD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMvE"}
+{"version":3,"file":"oauthScopes.d.ts","sourceRoot":"","sources":["../../src/internal/oauthScopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,yFAAyF;AACzF,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GACtC,MAAM,EAAE,GAAG,IAAI,CAejB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,SAAS,CASX;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,SAAS,CASX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CASnD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,OAAO,GACZ,aAAa,GAAG,IAAI,CAkCtB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,GACnB,aAAa,GAAG,IAAI,CAYtB;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GACxB;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,2BAA2B,CAAC;IAClC,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,+BAA+B,GAAG,gCAAgC,CAAC;IACzE,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACN,YAAY,EACZ,cAAc,EACd,KAAK,EACL,MAAM,EACN,QAAQ,EACR,WAA6B,EAC7B,MAAM,GACP,EAAE;IACD,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,kCAAkC;IAClC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,GAAG,CAAC;IACd,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CA6C/C;AA+BD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS,GACjB,MAAM,EAAE,CASV;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,YAAY,GACpB,aAAa,GAAG,IAAI,CAStB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,YAAY,GACpB,YAAY,CA+Bd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,GAAG,GACZ,MAAM,GAAG,IAAI,CAsBf;AAoED,wEAAwE;AACxE;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,MAAM,EAAE,CAEV;AAwFD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMvE"}

package/dist/internal/oauthScopes.js

@@ -30,7 +30,7 @@ export function declaredScopeSets(policy, entry) {
 export function requestedScopes(policy, sets) {
     const scopes = [];
     const userScopes = [];
-    for (const [, set] of declaredSets(policy, sets)) {
+    for (const [, set] of setsOf(policy, sets)) {
         pushNew(scopes, set.scopes);
         pushNew(userScopes, set.userScopes ?? []);
     }
@@ -103,7 +103,91 @@ export function grantedScopes(policy, json) {
         }
         case "slack":
             return slackGrantedScopes(body);
+        case "space":
+        case "comma": {
+            const scopes = splitScopes(policy.dialect, body["scope"]);
+            return scopes ? { scopes } : null;
+        }
+    }
+}
+/**
+ * What a token response granted, for the Gateway-owned flow: as
+ * {@link grantedScopes}, except that a `space` or `comma` provider that
+ * names no `scope` at all is taken at its word (RFC 6749 §5.1: the field
+ * is optional when the grant matches the request), so `requested` stands.
+ * The three parsed dialects keep failing closed.
+ */
+export function grantedScopesOrRequested(policy, json, requested) {
+    const granted = grantedScopes(policy, json);
+    if (granted)
+        return granted;
+    const body = record(json);
+    if (body &&
+        body["scope"] === undefined &&
+        (policy.dialect === "space" || policy.dialect === "comma")) {
+        return { scopes: canonical(policy.dialect, requested.scopes) };
     }
+    return null;
+}
+/**
+ * Whether an app's call with a held token goes through, and under which
+ * set (docs/design/2026-10-oauth-providers.md section 7). In order: every
+ * set the app declares must be among the connection's (else the person
+ * connects again: `integration_not_connected` with the missing sets); the
+ * host must be one of the provider's `api` hosts; the path passes the
+ * segment rules (`scopeRouteAllows`'s: no batch tunnels, no dot segments,
+ * no denied segments); then a declared set with routes must cover the
+ * call, or a declared set without routes covers its hosts by access: a
+ * read set unlocks `readMethods` (GET and HEAD by default), a write set
+ * every method the provider offers. `writes` says whether the method is
+ * one the grant allows beyond reads, decided by the caller as for an
+ * API-key provider.
+ */
+export function heldTokenCallAllowed({ policy, declaredSets, connectionSets, hosts, method, upstream, readMethods = ["GET", "HEAD"], writes, }) {
+    const missingSets = declaredSets.filter((name) => !connectionSets.includes(name));
+    if (missingSets.length > 0) {
+        return { ok: false, code: "integration_not_connected", missingSets };
+    }
+    if (upstream.protocol !== "https:" || !hosts.includes(upstream.host)) {
+        return {
+            ok: false,
+            code: "integration_scope_not_allowed",
+            message: `${upstream.host} is not a host this provider's token reaches (${hosts.join(", ")}).`,
+        };
+    }
+    if (!safeSegments(policy, upstream.pathname)) {
+        return {
+            ok: false,
+            code: "integration_scope_not_allowed",
+            message: `${upstream.pathname} is a path no scope set unlocks.`,
+        };
+    }
+    const verb = method.toUpperCase();
+    const reads = readMethods.includes(verb);
+    // A set's routes decide first: a read-shaped POST a read set lists
+    // under `posts` (a search, a query) is a read whatever the grant.
+    const routed = scopeRouteAllows(policy, declaredSets, verb, upstream);
+    if (routed)
+        return { ok: true, set: routed };
+    if (!reads && !writes) {
+        return {
+            ok: false,
+            code: "integration_method_not_allowed",
+            message: `${verb} ${upstream.pathname}: calls may use ${readMethods.join(" or ")} with access: "read"; ${verb} needs access: "write" in the app's capabilities entry, on a provider that offers it, or a scope set whose routes list it.`,
+        };
+    }
+    for (const [name, set] of setsOf(policy, declaredSets)) {
+        if (set.routes.length > 0)
+            continue;
+        if (reads || (writes && set.access === "write")) {
+            return { ok: true, set: name };
+        }
+    }
+    return {
+        ok: false,
+        code: "integration_scope_not_allowed",
+        message: `${verb} ${upstream.pathname} is outside the scope sets this app declares (${declaredSets.join(", ")}).`,
+    };
 }
 /**
  * Slack answers with up to two tokens, each with its own scopes: the bot
@@ -243,7 +327,7 @@ export function rewriteTokenRequestScope(policy, sets, request) {
 export function scopeRouteAllows(policy, sets, method, upstream) {
     if (upstream.protocol !== "https:")
         return null;
-    const onHost = declaredSets(policy, sets).flatMap(([name, set]) => set.routes
+    const onHost = setsOf(policy, sets).flatMap(([name, set]) => set.routes
         .filter((route) => route.host === upstream.host)
         .map((route) => [name, route]));
     if (onHost.length === 0)
@@ -318,7 +402,7 @@ function safeSegment(text, denied) {
     return !text.split("/").some((part) => DOT_SEGMENT.test(part));
 }
 /** The policy's sets in registry order, keeping those `names` declares. */
-function declaredSets(policy, names) {
+function setsOf(policy, names) {
     return Object.entries(policy.sets).filter(([name]) => names.includes(name));
 }
 const GOOGLE_ALIASES = new Map([
@@ -327,6 +411,14 @@ const GOOGLE_ALIASES = new Map([
 ]);
 const GRAPH_PREFIX = /^https:\/\/graph\.microsoft\.com\//i;
 /** `scopes` in the dialect's one spelling, deduplicated, order kept. */
+/**
+ * `scopes` in the dialect's canonical spelling (Google's long names,
+ * Microsoft's bare lower-case names), for comparing a set's scopes with
+ * what a token response says it granted.
+ */
+export function canonicalScopes(dialect, scopes) {
+    return canonical(dialect, [...scopes]);
+}
 function canonical(dialect, scopes) {
     return pushNew([], scopes.map((scope) => {
         switch (dialect) {
@@ -335,6 +427,8 @@ function canonical(dialect, scopes) {
             case "microsoft":
                 return scope.replace(GRAPH_PREFIX, "").toLowerCase();
             case "slack":
+            case "space":
+            case "comma":
                 return scope;
         }
     }));
@@ -347,7 +441,7 @@ function canonical(dialect, scopes) {
 function splitScopes(dialect, value) {
     if (typeof value !== "string")
         return null;
-    const separator = dialect === "slack" ? /[,\s]+/ : /\s+/;
+    const separator = dialect === "slack" || dialect === "comma" ? /[,\s]+/ : /\s+/;
     const scopes = canonical(dialect, value.split(separator).filter(Boolean));
     return scopes.length > 0 ? scopes : null;
 }

package/dist/internal/oauthSpec.d.ts

@@ -0,0 +1,102 @@
+/**
+ * The `oauth2-user` half of a provider spec
+ * (docs/design/2026-10-oauth-providers.md section 3): a registered OAuth
+ * provider, or a preset (./oauthPresets.ts), as JSON, turned into the
+ * same {@link OAuthClientCapability} a catalog client is, with a `flow`
+ * the Gateway runs itself. `parseProviderSpec` (./providerSpec.ts) hands
+ * the common fields here once it sees `auth.kind: "oauth2-user"`; nothing
+ * here reads a value: a spec names Gateway settings, never holds one.
+ */
+import { type CapabilityAccess, type OAuthClientCapability, type OAuthScopeSet } from "./capabilities.js";
+export interface SpecProblem {
+    path: string;
+    message: string;
+}
+/** A scope set's name: `identity`, or `<area>.<access>` (`repo.read`), lowercase. */
+export declare const SCOPE_SET_NAME: RegExp;
+/** Segments no set unlocks on any host: batch tunnels carry whole requests inside. */
+export declare const DEFAULT_DENIED_SEGMENTS: readonly string[];
+/** The fields of `auth` when its kind is `oauth2-user`. */
+export declare const OAUTH_AUTH_FIELDS: readonly ["kind", "authorizeUrl", "tokenUrl", "revokeUrl", "revokeMethod", "clientId", "clientSecret", "inject", "pkce", "scopeDialect", "authorizeParams", "tokenHeaders", "identity"];
+/** The common fields `parseProviderSpec` parsed before handing over. */
+export interface OAuthSpecCommon {
+    id: string;
+    name: string;
+    docs: string;
+    hosts: readonly string[];
+    description?: string;
+    reference?: string;
+    access?: readonly CapabilityAccess[];
+    readMethods?: readonly string[];
+    writeMethods?: readonly string[];
+    hint?: string;
+    example?: string;
+    tags?: readonly string[];
+}
+/**
+ * One scope set (`{ label, access, scopes, userScopes?, routes? }`) at
+ * `at`, its routes on `hosts` alone; undefined when a field is wrong,
+ * every problem reported. `overlay`: a set added to a built-in client
+ * must name a scope and say what it unlocks (a set with no routes unlocks
+ * nothing on the held-token path); a spec's own set may leave both empty
+ * (Notion's sets carry no scope string).
+ */
+export declare function parseScopeSet(raw: unknown, at: string, hosts: readonly string[], problems: SpecProblem[], { overlay }?: {
+    overlay?: boolean;
+}): OAuthScopeSet | undefined;
+/** What `parseScopeSetOverlay` returns. */
+export type ParsedScopeSetOverlay = {
+    ok: true;
+    name: string;
+    set: OAuthScopeSet;
+} | {
+    ok: false;
+    problems: SpecProblem[];
+};
+/**
+ * A scope set an operator adds to a built-in OAuth client
+ * (`everyapp provider scope-set add google-workspace gmail-send.json`):
+ * `{ "name": "gmail.send", "label", "access", "scopes", "routes" }`, held
+ * to the rules a built-in set is (the set's shape, routes on the client's
+ * `api` hosts alone, anchored `posts`) plus two of its own: `access` is
+ * said outright (a write set is never implied by its scopes) and `routes`
+ * is required. A `provider` field, when present, must be `id`. The name
+ * may not be one of the client's own sets: an overlay adds, never
+ * replaces. Nothing here reads a value.
+ */
+export declare function parseScopeSetOverlay(input: unknown, client: {
+    id: string;
+    capability: OAuthClientCapability;
+}): ParsedScopeSetOverlay;
+/**
+ * `capability` with `sets` added to its scope policy: the sets after the
+ * client's own, in the order given, and each set's scopes added to the
+ * authorize URL's list (what the operator's client must be allowed), as
+ * `parseOAuthUserSpec` builds it. A name the client already has is left
+ * as the client's (the registry refuses such an overlay before this).
+ */
+export declare function withScopeSets(capability: OAuthClientCapability, sets: Readonly<Record<string, OAuthScopeSet>>): OAuthClientCapability;
+/** What `parseOAuthUserSpec` returns on success, before the registry's rules. */
+export interface ParsedOAuthSpec {
+    capability: OAuthClientCapability;
+    /** Every host a row's rules must accept: the API hosts and the endpoints'. */
+    hosts: string[];
+}
+/**
+ * Parse the OAuth half of a spec whose `auth.kind` is `oauth2-user`:
+ * `auth` itself, `scopeSets`, `alwaysRequested` and `tolerated`, with
+ * the common fields already parsed. Every problem is reported; on
+ * success the catalog-shaped capability with its `flow`.
+ */
+export declare function parseOAuthUserSpec(input: Record<string, unknown>, common: OAuthSpecCommon, problems: SpecProblem[]): ParsedOAuthSpec | undefined;
+/**
+ * The JSON spec of an OAuth capability that has a `flow` (`provider
+ * show`, a preset's round trip): `parseProviderSpec` of it gives the
+ * capability back. A catalog client without a `flow` has no spec.
+ */
+export declare function oauthSpecOf(id: string, capability: OAuthClientCapability): Record<string, unknown> | null;
+/** The methods a held-token write may use on `capability` beyond its reads. */
+export declare function oauthWriteMethods(capability: OAuthClientCapability): readonly string[];
+/** The methods a read grant may use on `capability` (GET and HEAD unless the spec says). */
+export declare function oauthReadMethods(capability: OAuthClientCapability): readonly string[];
+//# sourceMappingURL=oauthSpec.d.ts.map

package/dist/internal/oauthSpec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthSpec.d.ts","sourceRoot":"","sources":["../../src/internal/oauthSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAO1B,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,eAAO,MAAM,cAAc,QAC0B,CAAC;AA4BtD,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAwB,CAAC;AAE9E,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,yLAcpB,CAAC;AAEX,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACrC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAkPD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,WAAW,EAAE,EACvB,EAAE,OAAe,EAAE,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,aAAa,GAAG,SAAS,CA+C3B;AA2CD,2CAA2C;AAC3C,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,aAAa,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GACxD,qBAAqB,CAkDvB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAC5C,qBAAqB,CAiBvB;AAuDD,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,qBAAqB,CAAC;IAClC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,EAAE,GACtB,eAAe,GAAG,SAAS,CAoN7B;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAyFhC;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,qBAAqB,GAChC,SAAS,MAAM,EAAE,CAEnB;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,qBAAqB,GAChC,SAAS,MAAM,EAAE,CAEnB"}