@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/internal/protocol.d.ts

@@ -39,6 +39,17 @@ export declare const GATEWAY_ERROR_HEADER = "x-everyapp-error";
  * from what browsers send.
  */
 export declare const ORG_HEADER = "x-everyapp-org";
+/**
+ * Which connection an app's call to an OAuth provider uses: the person's
+ * (`user`, the default when a person is behind the call) or the
+ * organization's (`organization`, the default for background work),
+ * docs/design/2026-10-oauth-providers.md section 7. Set by
+ * `integrationFetch({ account })`; the gateway reads it on the held-token
+ * branch and ignores it elsewhere.
+ */
+export declare const ACCOUNT_HEADER = "x-everyapp-account";
+/** The values {@link ACCOUNT_HEADER} may carry. */
+export type ConnectionAccount = "user" | "organization";
 /** 120-second lifetime — caps revocation staleness while surviving clock skew. */
 export declare const IDENTITY_TTL_SECONDS = 120;
 /** System tokens are minted per call and live at most a minute. */
@@ -63,10 +74,36 @@ export declare const ISSUER_ENV = "EVERYAPP_IDENTITY_ISSUER";
 export declare const SHARED_ENV = "EVERYAPP_SHARED";
 /** When set to `1` or `true` in the worker env, the dev identity kid is accepted. */
 export declare const DEV_ENV = "EVERYAPP_DEV";
+/**
+ * The organization an app's Worker is pinned to (a secret the deploy sends;
+ * in development the stub gateway's organization). `everyApp()` refuses an
+ * identity for any other organization; absent on a shared app's Workers.
+ */
+export declare const ORG_ID_ENV = "EVERY_APP_ORG_ID";
+/**
+ * The organization the dev gateway's seeded user belongs to. The same value
+ * as `@every-app/sdk/dev`'s, kept apart like {@link DEV_ISSUER} (the same
+ * test pins the two together).
+ */
+export declare const DEV_ORG_ID = "dev-org";
 /** `sub` claim the gateway mints public-route markers with. */
 export declare const PUBLIC_MARKER_SUB = "public";
 /** `sub` claim of gateway system tokens. */
 export declare const SYSTEM_TOKEN_SUB = "system";
+/**
+ * Linked dev (`everyapp dev --gateway`, docs/design/linked-dev.md): the
+ * dev Worker's env names the gateway-lite's loopback forwarder and the
+ * run's nonce, and the SDK builds a `{ fetch }` in place of the missing
+ * `EVERY_APP_GATEWAY` binding from them. Set by `everyAppWorker()` in a
+ * development build from the process environment `everyapp dev` starts
+ * the app with; never deployed.
+ */
+export declare const LINKED_DEV_URL_ENV = "EVERYAPP_LINKED_DEV_URL";
+export declare const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
+/** The header the forwarder requires, with the run's nonce: no simple cross-origin request can send it. */
+export declare const LINKED_DEV_HEADER = "x-everyapp-linked-dev";
+/** Where the gateway-lite serves the forwarder, under the app's own host. */
+export declare const LINKED_DEV_FORWARD_PATH = "/__everyapp/gateway";
 export type IdentityChannel = "web" | "api" | "mcp" | "agent";
 export type IdentityTokenType = "user" | "public" | "system";
 /** What a system token may open. One purpose per token. */
@@ -80,13 +117,37 @@ export interface IdentitySubject {
     email: string;
     orgId: string;
     orgRole: string;
+    /**
+     * The organization's name as its owners set it (`org_name`), so an app
+     * can show "Acme" rather than an id. Left out when the minter has none.
+     */
+    orgName?: string;
 }
+/**
+ * A member's role in the organization, as the identity token carries it.
+ * Owners and admins manage; anything the Gateway might mint that an app
+ * doesn't know is read as `member`.
+ */
+export type OrgRole = "owner" | "admin" | "member";
+/** `role` as an {@link OrgRole}: `owner` and `admin` as they are, anything else `member`. */
+export declare function toOrgRole(role: unknown): OrgRole;
+/** Whether `user` manages the organization: an owner or an admin. */
+export declare function isAdmin(user: {
+    orgRole: OrgRole | string;
+}): boolean;
 export interface EveryAppUser {
     /** User id (the `sub` claim). */
     id: string;
     email: string;
     orgId: string;
-    orgRole: string;
+    orgRole: OrgRole;
+    /**
+     * The organization's display name (the `org_name` claim), as its owners
+     * set it: trimmed, at most 64 characters, no control characters. Show
+     * it; never key data by it (names change, `orgId` doesn't). Undefined
+     * when the token carries none.
+     */
+    orgName?: string;
     channel: IdentityChannel;
     /** The acting principal (user, or `mcp:<client>` / agent). */
     actor: IdentityActor;
@@ -103,6 +164,8 @@ export interface IdentityClaims extends JWTPayload {
     email: string;
     org_id: string;
     org_role: string;
+    /** The organization's display name; absent when the minter had none. */
+    org_name?: string;
     chan: IdentityChannel;
     act: IdentityActor;
     scopes: string[];

package/dist/internal/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAchB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CA8Bd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAmBd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA0BjB"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,uBAAuB,CAAC;AACnD,mDAAmD;AACnD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,cAAc,CAAC;AACxD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAEpE;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAehB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CAqCd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAmBd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA0BjB"}

package/dist/internal/protocol.js

@@ -38,6 +38,15 @@ export const GATEWAY_ERROR_HEADER = "x-everyapp-error";
  * from what browsers send.
  */
 export const ORG_HEADER = "x-everyapp-org";
+/**
+ * Which connection an app's call to an OAuth provider uses: the person's
+ * (`user`, the default when a person is behind the call) or the
+ * organization's (`organization`, the default for background work),
+ * docs/design/2026-10-oauth-providers.md section 7. Set by
+ * `integrationFetch({ account })`; the gateway reads it on the held-token
+ * branch and ignores it elsewhere.
+ */
+export const ACCOUNT_HEADER = "x-everyapp-account";
 /** 120-second lifetime — caps revocation staleness while surviving clock skew. */
 export const IDENTITY_TTL_SECONDS = 120;
 /** System tokens are minted per call and live at most a minute. */
@@ -62,10 +71,44 @@ export const ISSUER_ENV = "EVERYAPP_IDENTITY_ISSUER";
 export const SHARED_ENV = "EVERYAPP_SHARED";
 /** When set to `1` or `true` in the worker env, the dev identity kid is accepted. */
 export const DEV_ENV = "EVERYAPP_DEV";
+/**
+ * The organization an app's Worker is pinned to (a secret the deploy sends;
+ * in development the stub gateway's organization). `everyApp()` refuses an
+ * identity for any other organization; absent on a shared app's Workers.
+ */
+export const ORG_ID_ENV = "EVERY_APP_ORG_ID";
+/**
+ * The organization the dev gateway's seeded user belongs to. The same value
+ * as `@every-app/sdk/dev`'s, kept apart like {@link DEV_ISSUER} (the same
+ * test pins the two together).
+ */
+export const DEV_ORG_ID = "dev-org";
 /** `sub` claim the gateway mints public-route markers with. */
 export const PUBLIC_MARKER_SUB = "public";
 /** `sub` claim of gateway system tokens. */
 export const SYSTEM_TOKEN_SUB = "system";
+/**
+ * Linked dev (`everyapp dev --gateway`, docs/design/linked-dev.md): the
+ * dev Worker's env names the gateway-lite's loopback forwarder and the
+ * run's nonce, and the SDK builds a `{ fetch }` in place of the missing
+ * `EVERY_APP_GATEWAY` binding from them. Set by `everyAppWorker()` in a
+ * development build from the process environment `everyapp dev` starts
+ * the app with; never deployed.
+ */
+export const LINKED_DEV_URL_ENV = "EVERYAPP_LINKED_DEV_URL";
+export const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
+/** The header the forwarder requires, with the run's nonce: no simple cross-origin request can send it. */
+export const LINKED_DEV_HEADER = "x-everyapp-linked-dev";
+/** Where the gateway-lite serves the forwarder, under the app's own host. */
+export const LINKED_DEV_FORWARD_PATH = "/__everyapp/gateway";
+/** `role` as an {@link OrgRole}: `owner` and `admin` as they are, anything else `member`. */
+export function toOrgRole(role) {
+    return role === "owner" || role === "admin" ? role : "member";
+}
+/** Whether `user` manages the organization: an owner or an admin. */
+export function isAdmin(user) {
+    return user.orgRole === "owner" || user.orgRole === "admin";
+}
 export class ProtocolClaimsError extends Error {
     constructor(message) {
         super(message);
@@ -78,6 +121,7 @@ export function identitySubjectToClaims(subject, opts) {
         email: subject.email,
         org_id: subject.orgId,
         org_role: subject.orgRole,
+        ...(subject.orgName ? { org_name: subject.orgName } : {}),
         chan: opts.channel ?? "web",
         act: opts.actor ?? { sub: subject.sub },
         scopes: opts.scopes ?? ["*"],
@@ -112,6 +156,11 @@ export function identityClaimsToEveryAppUser(payload) {
     if (!sub || !email || !orgId || !orgRole) {
         throw new ProtocolClaimsError("identity token missing required claims");
     }
+    // Display only, so a token without it (or with a malformed one) is still
+    // an identity: the app falls back to no name.
+    const orgName = typeof payload.org_name === "string" && payload.org_name
+        ? payload.org_name
+        : undefined;
     const chan = payload.chan ?? "web";
     const act = payload.act ?? { sub };
     const scopes = Array.isArray(payload.scopes)
@@ -122,7 +171,8 @@ export function identityClaimsToEveryAppUser(payload) {
         id: sub,
         email,
         orgId,
-        orgRole,
+        orgRole: toOrgRole(orgRole),
+        ...(orgName ? { orgName } : {}),
         channel: chan,
         actor: { sub: act.sub ?? sub },
         scopes,

package/dist/internal/providerRegistry.d.ts

@@ -19,8 +19,20 @@
  *    an IP literal, localhost, or a `.local`, `.internal` or `.arpa` name)
  *    and not one the gateway serves itself (`refuseHost`, which knows the
  *    gateway's own host and `APP_BASE_DOMAIN`).
+ *
+ * A second kind of row, a scope-set overlay (`provider_scope_sets`,
+ * `everyapp provider scope-set add`), adds a named scope set to a
+ * built-in OAuth client that has scope sets (Google, Microsoft, Slack):
+ * its scopes, and the routes on the client's own API hosts it unlocks,
+ * checked by the rules a built-in set is checked by
+ * (`providers.scope-set-overlay-within-client`). An overlay never replaces
+ * one of the client's own sets, never names a host outside the client's
+ * `api`, and never applies to a registered row (an operator replaces the
+ * row's spec instead). Apps list an overlay set under `scopes` as they
+ * list a built-in one.
  */
-import { type ApiKeyCapability, type Capability, type CapabilityLookup } from "./capabilities.js";
+import { type Capability, type CapabilityLookup, type OAuthClientCapability, type OAuthScopeSet } from "./capabilities.js";
+import { type RegistrableCapability } from "./providerSpec.js";
 /** A `providers` row as the gateway or the CLI read it. */
 export interface ProviderRow {
     id: string;
@@ -38,17 +50,48 @@ export interface ProviderRow {
     /** When, in epoch milliseconds. */
     addedAt?: number | null;
 }
+/** A `provider_scope_sets` row as the gateway or the CLI read it. */
+export interface ScopeSetRow {
+    /** The built-in OAuth client the set belongs to (`google-workspace`). */
+    providerId: string;
+    /** The set's name, what an app lists under `scopes` (`gmail.send`). */
+    name: string;
+    /** The set's spec, as JSON text or already parsed (`parseScopeSetOverlay`'s shape). */
+    spec: unknown;
+    addedBy?: string | null;
+    addedAt?: number | null;
+}
+/** One overlay the registry serves, as `provider show` reports it. */
+export interface RegisteredScopeSet {
+    providerId: string;
+    name: string;
+    set: OAuthScopeSet;
+    addedBy: string | null;
+    addedAt: number | null;
+}
+export type ScopeSetRefusalCode = "SCOPE_SET_INVALID" | "SCOPE_SET_PROVIDER_UNKNOWN" | "SCOPE_SET_BUILTIN";
+/** Why an overlay row is not a scope set on this gateway. */
+export interface ScopeSetRefusal {
+    providerId: string;
+    name: string;
+    code: ScopeSetRefusalCode;
+    message: string;
+}
 /**
  * The part of a row a key is set for: its hosts, its host setting and its
  * auth, as one canonical string (sorted keys, sorted hosts), so that
  * replacing a row's hosts or auth changes the key and the value it held
- * is no longer read until the operator sets it again.
+ * is no longer read until the operator sets it again. For an OAuth
+ * provider the client is bound to its authorize, token and revoke URLs,
+ * its API hosts, where the client goes on the token request and its
+ * client setting names (`oauth.client-bound-to-endpoints`): an admin who
+ * re-points `tokenUrl` has to paste the secret again.
  */
-export declare function providerBindingKey(capability: ApiKeyCapability): string;
+export declare function providerBindingKey(capability: RegistrableCapability): string;
 /** One registered row as `provider list` and `provider show` report it. */
 export interface RegisteredProvider {
     id: string;
-    capability: ApiKeyCapability;
+    capability: RegistrableCapability;
     /** Whether the row's key was set for the hosts and auth it has now. */
     bound: boolean;
     addedBy: string | null;
@@ -80,6 +123,12 @@ export interface ProviderRegistry extends CapabilityLookup {
     rows(): readonly RegisteredProvider[];
     /** The rows this registry left out, each with why. */
     readonly rejected: readonly RowRefusal[];
+    /** The scope-set overlays this registry applied to built-in clients, in row order. */
+    scopeSets(): readonly RegisteredScopeSet[];
+    /** Where a client's scope set comes from: its catalog entry, an overlay row, or nowhere. */
+    scopeSetSource(providerId: string, name: string): "catalog" | "row" | undefined;
+    /** The overlay rows this registry left out, each with why. */
+    readonly rejectedScopeSets: readonly ScopeSetRefusal[];
 }
 export interface ProviderRegistryOptions {
     /**
@@ -88,6 +137,8 @@ export interface ProviderRegistryOptions {
      * the rest (IP literals, localhost, `.internal`).
      */
     refuseHost?: (host: string) => string | null;
+    /** The scope-set overlays (`provider_scope_sets`), applied to the catalog's OAuth clients. */
+    scopeSets?: readonly ScopeSetRow[];
 }
 /** The prefix a provider's own Gateway settings carry: `stripe` → `STRIPE_`, `tiktok-business` → `TIKTOK_BUSINESS_`. */
 export declare function providerSettingPrefix(id: string): string;
@@ -121,22 +172,42 @@ export declare function rowSecretProblem(id: string, name: string, taken: (name:
  * CLI runs it before writing D1, the MCP tool before writing, and the
  * gateway again on every read.
  */
-export declare function checkProviderRow(id: string, capability: ApiKeyCapability, context: {
+export declare function checkProviderRow(id: string, capability: RegistrableCapability, context: {
     /** Settings the other rows hold. */
     rowSettings: ReadonlySet<string>;
     refuseHost?: (host: string) => string | null;
 }): RowRefusal | null;
+/**
+ * Every host a row sends a secret to: an API-key provider's `hosts`; an
+ * OAuth provider's API hosts (the token), and its authorize, token and
+ * revoke hosts (the client). Each passes the row host rules.
+ */
+export declare function registrableHosts(capability: RegistrableCapability): string[];
 /** A row's spec parsed and checked: the capability, or the refusal. */
 export declare function resolveProviderRow(row: ProviderRow, context: {
     rowSettings: ReadonlySet<string>;
     refuseHost?: (host: string) => string | null;
 }): {
     ok: true;
-    capability: ApiKeyCapability;
+    capability: RegistrableCapability;
 } | {
     ok: false;
     refusal: RowRefusal;
 };
+/**
+ * The built-in OAuth client an overlay may extend: a catalog entry of mode
+ * `oauth_client` with a scope policy. Null for anything else (an API-key
+ * entry, a client without sets, a registered row, an unknown id).
+ */
+export declare function overlayableClient(providerId: string): OAuthClientCapability | null;
+/** An overlay row's spec parsed and checked against its client: the set, or the refusal. */
+export declare function resolveScopeSetRow(row: ScopeSetRow): {
+    ok: true;
+    set: OAuthScopeSet;
+} | {
+    ok: false;
+    refusal: ScopeSetRefusal;
+};
 /**
  * The catalog and `rows` as one registry. Rows are taken in order; a row
  * whose settings another earlier row holds is the one refused.

package/dist/internal/providerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/internal/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAa3B,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAoBvE;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,gBAAgB,CAAC;IAC7B,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,mFAAmF;IACnF,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,8DAA8D;IAC9D,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C;AAOD,wHAAwH;AACxH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,GAClB,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,MAAM,GAAG,IAAI,CAqBf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE;IACP,oCAAoC;IACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GACA,UAAU,GAAG,IAAI,CAuBnB;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;IACP,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GAEC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyCrC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,SAAS,WAAW,EAAO,EACjC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAqElB;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,EAAE,gBAAqC,CAAC"}
+{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/internal/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC3B,mBAAmB,GACnB,4BAA4B,GAC5B,mBAAmB,CAAC;AAExB,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CA2B5E;AAoBD,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,qBAAqB,CAAC;IAClC,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,mFAAmF;IACnF,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,8DAA8D;IAC9D,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC,sFAAsF;IACtF,SAAS,IAAI,SAAS,kBAAkB,EAAE,CAAC;IAC3C,4FAA4F;IAC5F,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,eAAe,EAAE,CAAC;CACxD;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C,8FAA8F;IAC9F,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACpC;AAOD,wHAAwH;AACxH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,GAClB,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,MAAM,GAAG,IAAI,CAwBf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE;IACP,oCAAoC;IACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GACA,UAAU,GAAG,IAAI,CAuBnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAqB5E;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;IACP,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GAEC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyCrC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,GACjB,qBAAqB,GAAG,IAAI,CAQ9B;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAoC5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,SAAS,WAAW,EAAO,EACjC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAiIlB;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,EAAE,gBAAqC,CAAC"}

package/dist/internal/providerRegistry.js

@@ -19,18 +19,64 @@
  *    an IP literal, localhost, or a `.local`, `.internal` or `.arpa` name)
  *    and not one the gateway serves itself (`refuseHost`, which knows the
  *    gateway's own host and `APP_BASE_DOMAIN`).
+ *
+ * A second kind of row, a scope-set overlay (`provider_scope_sets`,
+ * `everyapp provider scope-set add`), adds a named scope set to a
+ * built-in OAuth client that has scope sets (Google, Microsoft, Slack):
+ * its scopes, and the routes on the client's own API hosts it unlocks,
+ * checked by the rules a built-in set is checked by
+ * (`providers.scope-set-overlay-within-client`). An overlay never replaces
+ * one of the client's own sets, never names a host outside the client's
+ * `api`, and never applies to a registered row (an operator replaces the
+ * row's spec instead). Apps list an overlay set under `scopes` as they
+ * list a built-in one.
  */
 import { CAPABILITIES, CAPABILITY_IDS, capabilitySettings, } from "./capabilities.js";
 import { isDevOnlyGatewaySetting, isInstallOwnedGatewaySetting, isReservedAppSecretName, isSettableGatewaySetting, } from "./gatewaySettings.js";
+import { parseScopeSetOverlay, withScopeSets } from "./oauthSpec.js";
+import { isSignInSettingName } from "./signInProviders.js";
 import { describeSpecProblems, parseProviderSpec, PROVIDER_ID, } from "./providerSpec.js";
 /**
  * The part of a row a key is set for: its hosts, its host setting and its
  * auth, as one canonical string (sorted keys, sorted hosts), so that
  * replacing a row's hosts or auth changes the key and the value it held
- * is no longer read until the operator sets it again.
+ * is no longer read until the operator sets it again. For an OAuth
+ * provider the client is bound to its authorize, token and revoke URLs,
+ * its API hosts, where the client goes on the token request and its
+ * client setting names (`oauth.client-bound-to-endpoints`): an admin who
+ * re-points `tokenUrl` has to paste the secret again.
  */
 export function providerBindingKey(capability) {
-    const auth = Object.fromEntries(Object.entries(capability.auth)
+    if (capability.mode === "ai") {
+        // An `ai` row's key is bound to where the proxy sends it: its base URL and the key's placement.
+        return JSON.stringify({
+            kind: "ai",
+            auth: sortedAuth(capability.auth),
+            origin: capability.origin,
+            basePath: capability.basePath ?? null,
+        });
+    }
+    if (capability.mode === "oauth_client") {
+        return JSON.stringify({
+            kind: "oauth2-user",
+            authorizeUrl: capability.authorize.url,
+            tokenUrl: capability.flow?.tokenUrl ?? null,
+            revokeUrl: capability.flow?.revokeUrl ?? null,
+            inject: capability.token[0]?.inject ?? "form",
+            clientId: capability.secrets.clientId,
+            clientSecret: capability.secrets.clientSecret ?? null,
+            hosts: [...capability.api].sort(),
+        });
+    }
+    return JSON.stringify({
+        auth: sortedAuth(capability.auth),
+        hostSetting: capability.hostSetting ?? null,
+        hosts: [...capability.hosts].sort(),
+    });
+}
+/** An auth block with its keys sorted, one level down too, for a canonical key. */
+function sortedAuth(auth) {
+    return Object.fromEntries(Object.entries(auth)
         .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
         .map(([field, value]) => [
         field,
@@ -38,11 +84,6 @@ export function providerBindingKey(capability) {
             ? Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))
             : value,
     ]));
-    return JSON.stringify({
-        auth,
-        hostSetting: capability.hostSetting ?? null,
-        hosts: [...capability.hosts].sort(),
-    });
 }
 /** The reserved app id no provider may take. */
 const RESERVED_IDS = new Set(["everyapp"]);
@@ -116,6 +157,9 @@ export function rowSecretProblem(id, name, taken) {
     if (isReservedAppSecretName(name)) {
         return `${name} is a name everyapp sets itself`;
     }
+    if (isSignInSettingName(name)) {
+        return `${name} is a sign-in provider's setting name (every <ID>_SIGNIN_<FIELD> name is the Gateway's, set with \`everyapp signin add\`)`;
+    }
     if (isSettableGatewaySetting(name)) {
         return `${name} is a Gateway setting another provider or the Gateway reads`;
     }
@@ -143,7 +187,7 @@ export function checkProviderRow(id, capability, context) {
             return { id, code: "PROVIDER_SECRET_TAKEN", message: problem };
         }
     }
-    for (const host of capability.hosts) {
+    for (const host of registrableHosts(capability)) {
         const problem = publicHostProblem(host) ?? context.refuseHost?.(host);
         if (problem) {
             return { id, code: "PROVIDER_HOST_REFUSED", message: problem };
@@ -151,6 +195,37 @@ export function checkProviderRow(id, capability, context) {
     }
     return null;
 }
+/**
+ * Every host a row sends a secret to: an API-key provider's `hosts`; an
+ * OAuth provider's API hosts (the token), and its authorize, token and
+ * revoke hosts (the client). Each passes the row host rules.
+ */
+export function registrableHosts(capability) {
+    if (capability.mode === "api_key")
+        return [...capability.hosts];
+    if (capability.mode === "ai")
+        return [new URL(capability.origin).hostname.toLowerCase()];
+    const hosts = [...capability.api];
+    const urls = [
+        capability.authorize.url,
+        capability.flow?.tokenUrl,
+        capability.flow?.revokeUrl,
+        capability.flow?.identity?.url,
+    ];
+    for (const url of urls) {
+        if (!url)
+            continue;
+        try {
+            const host = new URL(url).hostname.toLowerCase();
+            if (!hosts.includes(host))
+                hosts.push(host);
+        }
+        catch {
+            // The parser refused it already.
+        }
+    }
+    return hosts;
+}
 /** A row's spec parsed and checked: the capability, or the refusal. */
 export function resolveProviderRow(row, context) {
     let spec = row.spec;
@@ -195,12 +270,92 @@ export function resolveProviderRow(row, context) {
         ? { ok: false, refusal }
         : { ok: true, capability: parsed.capability };
 }
+/**
+ * The built-in OAuth client an overlay may extend: a catalog entry of mode
+ * `oauth_client` with a scope policy. Null for anything else (an API-key
+ * entry, a client without sets, a registered row, an unknown id).
+ */
+export function overlayableClient(providerId) {
+    if (!CAPABILITY_IDS.includes(providerId))
+        return null;
+    const capability = CAPABILITIES[providerId];
+    return capability.mode === "oauth_client" && capability.scopePolicy
+        ? capability
+        : null;
+}
+/** An overlay row's spec parsed and checked against its client: the set, or the refusal. */
+export function resolveScopeSetRow(row) {
+    const refuse = (code, message) => ({
+        ok: false,
+        refusal: { providerId: row.providerId, name: row.name, code, message },
+    });
+    const client = overlayableClient(row.providerId);
+    if (!client) {
+        return refuse("SCOPE_SET_PROVIDER_UNKNOWN", `${row.providerId} isn't a built-in OAuth client with scope sets (google-workspace, microsoft-365, slack); a registered provider's sets are in its spec`);
+    }
+    if (Object.hasOwn(client.scopePolicy.sets, row.name)) {
+        return refuse("SCOPE_SET_BUILTIN", `${row.name} is one of ${row.providerId}'s own sets; an overlay adds a set, never replaces one`);
+    }
+    let spec = row.spec;
+    if (typeof spec === "string") {
+        try {
+            spec = JSON.parse(spec);
+        }
+        catch {
+            return refuse("SCOPE_SET_INVALID", "the stored spec isn't JSON");
+        }
+    }
+    const parsed = parseScopeSetOverlay(typeof spec === "object" && spec !== null && !Array.isArray(spec)
+        ? { ...spec, name: row.name }
+        : spec, { id: row.providerId, capability: client });
+    if (!parsed.ok) {
+        return refuse("SCOPE_SET_INVALID", describeSpecProblems(parsed.problems));
+    }
+    return { ok: true, set: parsed.set };
+}
 /**
  * The catalog and `rows` as one registry. Rows are taken in order; a row
  * whose settings another earlier row holds is the one refused.
  */
 export function providerRegistry(rows = [], options = {}) {
     const catalog = new Map(CAPABILITY_IDS.map((id) => [id, CAPABILITIES[id]]));
+    // Scope-set overlays on the catalog's OAuth clients, before any row is
+    // looked at: a row never shadows the catalog, with or without overlays.
+    const overlays = [];
+    const rejectedScopeSets = [];
+    const overlaySets = new Map();
+    for (const row of options.scopeSets ?? []) {
+        if (overlays.some((each) => each.providerId === row.providerId && each.name === row.name)) {
+            rejectedScopeSets.push({
+                providerId: row.providerId,
+                name: row.name,
+                code: "SCOPE_SET_INVALID",
+                message: "listed twice",
+            });
+            continue;
+        }
+        const resolved = resolveScopeSetRow(row);
+        if (!resolved.ok) {
+            rejectedScopeSets.push(resolved.refusal);
+            continue;
+        }
+        overlays.push({
+            providerId: row.providerId,
+            name: row.name,
+            set: resolved.set,
+            addedBy: row.addedBy ?? null,
+            addedAt: row.addedAt ?? null,
+        });
+        const sets = overlaySets.get(row.providerId) ?? {};
+        sets[row.name] = resolved.set;
+        overlaySets.set(row.providerId, sets);
+    }
+    for (const [id, sets] of overlaySets) {
+        const client = catalog.get(id);
+        if (client?.mode === "oauth_client") {
+            catalog.set(id, withScopeSets(client, sets));
+        }
+    }
     const accepted = new Map();
     const rejected = [];
     const rowSettings = new Set();
@@ -256,6 +411,21 @@ export function providerRegistry(rows = [], options = {}) {
         },
         rows: () => [...accepted.values()],
         rejected,
+        scopeSets: () => [...overlays],
+        scopeSetSource: (providerId, name) => {
+            if (overlays.some((each) => each.providerId === providerId && each.name === name)) {
+                return "row";
+            }
+            const capability = CAPABILITY_IDS.includes(providerId)
+                ? CAPABILITIES[providerId]
+                : undefined;
+            return capability?.mode === "oauth_client" &&
+                capability.scopePolicy &&
+                Object.hasOwn(capability.scopePolicy.sets, name)
+                ? "catalog"
+                : undefined;
+        },
+        rejectedScopeSets,
     };
 }
 /** The catalog alone, as a registry: what every surface reads without a gateway's rows. */