@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/internal/capabilities.js

@@ -16,11 +16,14 @@
  *    proxy's rules: inference routes only, the model allowlist, the usage
  *    tap. Never a capability: its key would reach the account's credits
  *    and keys on the same host.
- *  - `oauth_client`: a provider's OAuth client (a social network's), held
- *    the same way. The gateway completes the token endpoint calls only,
- *    putting the client on them; the app builds the authorize URL from the
- *    public client id (`integrationStatus()`), keeps the user tokens and
- *    calls the provider's API with them itself. A client shared by apps
+ *  - `oauth_client`: a provider's OAuth client (Google's, Microsoft's,
+ *    Slack's), held the same way. The gateway completes the token endpoint
+ *    calls only, putting the client on them; the app builds the authorize
+ *    URL from the public client id (`integrationStatus()`), sends people
+ *    back to a callback its manifest entry lists (`redirectPaths`), keeps
+ *    the user tokens and calls the provider's API with them itself. Other
+ *    providers' clients (GitHub, the social networks) are presets
+ *    (./oauthPresets.ts): rows only once an operator adds one. A client shared by apps
  *    with different needs carries a `scopePolicy`: named scope sets an app
  *    lists in its manifest entry's `scopes`, which ./oauthScopes.ts turns
  *    into what the app may ask the provider for and what a token it is
@@ -43,6 +46,7 @@ export const DEFAULT_WRITE_METHODS = [
     "PATCH",
     "DELETE",
 ];
+import { CATALOG_ENTRIES } from "./catalog/index.js";
 export const CAPABILITIES = {
     // The AI providers, in the order the AI proxy's table had them.
     openai: {
@@ -69,6 +73,12 @@ export const CAPABILITIES = {
         // More than inference needs both the operator (AI_PROXY_EXTRA_ROUTES)
         // and the app's manifest (`ai.routes`): OpenAI paths only.
         extraRoutes: true,
+        // Tool calling on chat completions needs `reasoning_effort: "none"`
+        // on the GPT-6 family (the responses route takes tools as it is).
+        chat: { path: "/v1/chat/completions", seedModel: "gpt-6-luna" },
+        embeddings: { path: "/v1/embeddings", seedModel: "text-embedding-3-small" },
+        // AI Gateway's OpenAI endpoint takes the path without `/v1`.
+        aig: { slug: "openai", trim: "/v1" },
         hint: "A secret key from the API keys page; the Gateway puts it on every call as a bearer token.",
         verified: { on: "2026-10-25", how: "live" },
     },
@@ -89,7 +99,24 @@ export const CAPABILITIES = {
             "/api/v1/responses",
             "/api/v1/embeddings",
         ],
+        chat: {
+            path: "/api/v1/chat/completions",
+            seedModel: "anthropic/claude-haiku-5.5",
+        },
+        embeddings: {
+            path: "/api/v1/embeddings",
+            seedModel: "openai/text-embedding-3-small",
+        },
+        // AI Gateway's OpenRouter endpoint takes the path without `/api`.
+        aig: { slug: "openrouter", trim: "/api" },
         hint: "An API key from OpenRouter's keys page; the Gateway puts it on every call as a bearer token.",
+        // Every answer's `usage.cost` is the call's price in USD, what
+        // OpenRouter charges the key: read off the tail with the tokens.
+        cost: {
+            unit: "token",
+            responseField: "usage.cost",
+            note: "The answer's usage.cost is the call's price in USD, per model.",
+        },
         verified: { on: "2026-10-25", how: "live" },
     },
     // Workers AI's OpenAI-compatible REST API, in the gateway's own account
@@ -114,9 +141,55 @@ export const CAPABILITIES = {
             "/v1/responses",
         ],
         normalize: "workers-ai",
+        chat: {
+            path: "/v1/chat/completions",
+            seedModel: "@cf/meta/llama-4-scout-17b-16e-instruct",
+        },
+        embeddings: { path: "/v1/embeddings", seedModel: "@cf/baai/bge-m3" },
+        // Workers AI's REST API is AI Gateway's own host: the URL stays and
+        // `cf-aig-gateway-id` names the gateway.
+        aig: { slug: "workers-ai", header: true },
         hint: "A Cloudflare API token with Workers AI Read (the Workers AI page's prefilled token); the account is the Gateway's own.",
         verified: { on: "2026-10-25", how: "live" },
     },
+    // Cloudflare AI Gateway: a proxy in front of the other AI providers
+    // (logs, caching, rate limits, spend), with no models of its own. With
+    // AI_GATEWAY_ID set, every call to an `ai` entry that has an `aig` slug
+    // goes through it, the provider's own key still on the call; the
+    // gateway's own token is optional (an authenticated gateway requires
+    // it). Never listed under `providers`: it fronts the entries apps list.
+    "ai-gateway": {
+        mode: "ai",
+        kind: "proxy",
+        label: "Cloudflare AI Gateway",
+        description: "Cloudflare's proxy in front of the other AI providers: logs, caching, rate limits and spend, with each provider's own key.",
+        auth: {
+            kind: "header",
+            header: "cf-aig-authorization",
+            prefix: "Bearer ",
+            secret: "AI_GATEWAY_API_KEY",
+        },
+        authOptional: true,
+        docs: "https://dash.cloudflare.com/?to=/:account/ai/ai-gateway",
+        api: "https://developers.cloudflare.com/ai-gateway/",
+        setup: "setup/ai-gateway.md",
+        origin: "https://gateway.ai.cloudflare.com",
+        alsoNeeds: ["CLOUDFLARE_ACCOUNT_ID", "AI_GATEWAY_ID"],
+        basePath: "/v1/{CLOUDFLARE_ACCOUNT_ID}/{AI_GATEWAY_ID}",
+        inferenceRoutes: [],
+        hint: "The gateway's id from the AI Gateway page (everyapp ai gateway on makes one named everyapp); AI_GATEWAY_API_KEY only for an authenticated gateway, sent as cf-aig-authorization.",
+        secrets: [
+            {
+                name: "AI_GATEWAY_ID",
+                hint: "The AI Gateway's id (its name in the dashboard), in the Gateway's own Cloudflare account.",
+            },
+            {
+                name: "AI_GATEWAY_API_KEY",
+                hint: "An AI Gateway token with Run permission, only when the gateway is authenticated; leave unset for an open gateway.",
+            },
+        ],
+        verified: { on: "2026-10-25", how: "docs" },
+    },
     dataforseo: {
         mode: "api_key",
         label: "DataForSEO",
@@ -223,348 +296,6 @@ export const CAPABILITIES = {
         settings: [],
         optionalSettings: [],
     },
-    // Social networks' OAuth clients (docs/capabilities.md "OAuth clients"):
-    // the gateway completes their token endpoints only. Postiz connects its
-    // channels with them; one client serves every organization on the gateway.
-    linkedin: {
-        mode: "oauth_client",
-        label: "LinkedIn",
-        secrets: {
-            clientId: "LINKEDIN_CLIENT_ID",
-            clientSecret: "LINKEDIN_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "www.linkedin.com",
-                path: "/oauth/v2/accessToken",
-                methods: ["POST"],
-                inject: "form",
-            },
-        ],
-        access: ["write"],
-        console: "https://www.linkedin.com/developers/apps",
-        authorize: {
-            url: "https://www.linkedin.com/oauth/v2/authorization",
-            scopes: [
-                "openid",
-                "profile",
-                "w_member_social",
-                "r_basicprofile",
-                "rw_organization_admin",
-                "w_organization_social",
-                "r_organization_social",
-            ],
-        },
-        api: ["api.linkedin.com"],
-        // Profiles and pages: both callbacks complete on the one client.
-        redirectPaths: [
-            "/integrations/social/linkedin",
-            "/integrations/social/linkedin-page",
-        ],
-    },
-    facebook: {
-        mode: "oauth_client",
-        label: "Facebook",
-        secrets: {
-            clientId: "FACEBOOK_APP_ID",
-            clientSecret: "FACEBOOK_APP_SECRET",
-        },
-        token: [
-            {
-                // The code exchange and the long-lived token exchange, both on a
-                // versioned path (/v25.0/oauth/access_token).
-                host: "graph.facebook.com",
-                path: /^\/v\d+\.\d+\/oauth\/access_token$/,
-                methods: ["GET", "POST"],
-                inject: "query",
-            },
-        ],
-        access: ["write"],
-        console: "https://developers.facebook.com/apps",
-        authorize: {
-            url: "https://www.facebook.com/v25.0/dialog/oauth",
-            // Facebook pages, and Instagram business accounts through them.
-            scopes: [
-                "pages_show_list",
-                "business_management",
-                "pages_manage_posts",
-                "pages_manage_engagement",
-                "pages_read_engagement",
-                "read_insights",
-                "instagram_basic",
-                "instagram_content_publish",
-                "instagram_manage_comments",
-                "instagram_manage_insights",
-            ],
-        },
-        api: ["graph.facebook.com", "graph.instagram.com"],
-        redirectPaths: [
-            "/integrations/social/facebook",
-            "/integrations/social/instagram",
-        ],
-    },
-    instagram: {
-        mode: "oauth_client",
-        label: "Instagram",
-        secrets: {
-            clientId: "INSTAGRAM_APP_ID",
-            clientSecret: "INSTAGRAM_APP_SECRET",
-        },
-        token: [
-            // The code exchange, then the long-lived token exchange.
-            {
-                host: "api.instagram.com",
-                path: "/oauth/access_token",
-                methods: ["POST"],
-                inject: "form",
-            },
-            {
-                host: "graph.instagram.com",
-                path: "/access_token",
-                methods: ["GET"],
-                inject: "query",
-            },
-        ],
-        access: ["write"],
-        console: "https://developers.facebook.com/apps",
-        authorize: {
-            url: "https://www.instagram.com/oauth/authorize",
-            scopes: [
-                "instagram_business_basic",
-                "instagram_business_content_publish",
-                "instagram_business_manage_comments",
-                "instagram_business_manage_insights",
-            ],
-        },
-        api: ["graph.instagram.com"],
-        redirectPaths: ["/integrations/social/instagram-standalone"],
-    },
-    threads: {
-        mode: "oauth_client",
-        label: "Threads",
-        secrets: { clientId: "THREADS_APP_ID", clientSecret: "THREADS_APP_SECRET" },
-        token: [
-            // The code exchange, then the long-lived token exchange.
-            {
-                host: "graph.threads.net",
-                path: "/oauth/access_token",
-                methods: ["GET", "POST"],
-                inject: "query",
-            },
-            {
-                host: "graph.threads.net",
-                path: "/access_token",
-                methods: ["GET"],
-                inject: "query",
-            },
-        ],
-        access: ["write"],
-        console: "https://developers.facebook.com/apps",
-        authorize: {
-            url: "https://threads.net/oauth/authorize",
-            scopes: [
-                "threads_basic",
-                "threads_content_publish",
-                "threads_manage_replies",
-                "threads_manage_insights",
-            ],
-        },
-        api: ["graph.threads.net"],
-        redirectPaths: ["/integrations/social/threads"],
-    },
-    youtube: {
-        mode: "oauth_client",
-        label: "YouTube",
-        secrets: {
-            clientId: "YOUTUBE_CLIENT_ID",
-            clientSecret: "YOUTUBE_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "oauth2.googleapis.com",
-                path: "/token",
-                methods: ["POST"],
-                inject: "form",
-            },
-        ],
-        access: ["write"],
-        console: "https://console.cloud.google.com/apis/credentials",
-        setup: "setup/google.md",
-        authorize: {
-            url: "https://accounts.google.com/o/oauth2/v2/auth",
-            // YouTube channels, and Google Business Profiles on the same client.
-            scopes: [
-                "https://www.googleapis.com/auth/userinfo.profile",
-                "https://www.googleapis.com/auth/userinfo.email",
-                "https://www.googleapis.com/auth/youtube",
-                "https://www.googleapis.com/auth/youtube.force-ssl",
-                "https://www.googleapis.com/auth/youtube.readonly",
-                "https://www.googleapis.com/auth/youtube.upload",
-                "https://www.googleapis.com/auth/youtubepartner",
-                "https://www.googleapis.com/auth/yt-analytics.readonly",
-                "https://www.googleapis.com/auth/business.manage",
-            ],
-        },
-        api: [
-            "www.googleapis.com",
-            "youtubeanalytics.googleapis.com",
-            "mybusinessaccountmanagement.googleapis.com",
-            "mybusinessbusinessinformation.googleapis.com",
-            "mybusiness.googleapis.com",
-            "businessprofileperformance.googleapis.com",
-        ],
-        redirectPaths: ["/integrations/social/youtube", "/integrations/social/gmb"],
-    },
-    tiktok: {
-        mode: "oauth_client",
-        label: "TikTok",
-        secrets: {
-            clientId: "TIKTOK_CLIENT_ID",
-            clientSecret: "TIKTOK_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "open.tiktokapis.com",
-                path: "/v2/oauth/token/",
-                methods: ["POST"],
-                inject: "form",
-                // TikTok calls the client id its client key.
-                params: { clientId: "client_key" },
-            },
-        ],
-        access: ["write"],
-        console: "https://developers.tiktok.com/apps",
-        authorize: {
-            url: "https://www.tiktok.com/v2/auth/authorize/",
-            scopes: [
-                "video.list",
-                "user.info.basic",
-                "video.publish",
-                "video.upload",
-                "user.info.profile",
-                "user.info.stats",
-            ],
-        },
-        api: ["open.tiktokapis.com"],
-        redirectPaths: ["/integrations/social/tiktok"],
-    },
-    "tiktok-business": {
-        mode: "oauth_client",
-        label: "TikTok Business",
-        secrets: {
-            clientId: "TIKTOK_BUSINESS_CLIENT_ID",
-            clientSecret: "TIKTOK_BUSINESS_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "business-api.tiktok.com",
-                path: "/open_api/v1.3/tt_user/oauth2/token/",
-                methods: ["POST"],
-                inject: "json",
-            },
-            {
-                host: "business-api.tiktok.com",
-                path: "/open_api/v1.3/tt_user/oauth2/refresh_token/",
-                methods: ["POST"],
-                inject: "json",
-            },
-        ],
-        access: ["write"],
-        console: "https://business-api.tiktok.com/portal/apps",
-        authorize: {
-            url: "https://www.tiktok.com/v2/auth/authorize/",
-            scopes: [
-                "user.info.basic",
-                "user.info.username",
-                "user.info.stats",
-                "video.list",
-                "video.upload",
-                "video.publish",
-            ],
-        },
-        api: ["business-api.tiktok.com"],
-        // TikTok Business wants the trailing slash.
-        redirectPaths: ["/integrations/social/tiktok-business/"],
-    },
-    reddit: {
-        mode: "oauth_client",
-        label: "Reddit",
-        secrets: {
-            clientId: "REDDIT_CLIENT_ID",
-            clientSecret: "REDDIT_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "www.reddit.com",
-                path: "/api/v1/access_token",
-                methods: ["POST"],
-                inject: "basic",
-            },
-        ],
-        access: ["write"],
-        console: "https://www.reddit.com/prefs/apps",
-        authorize: {
-            url: "https://www.reddit.com/api/v1/authorize",
-            scopes: ["read", "identity", "submit", "flair"],
-        },
-        api: ["oauth.reddit.com"],
-        redirectPaths: ["/integrations/social/reddit"],
-    },
-    pinterest: {
-        mode: "oauth_client",
-        label: "Pinterest",
-        secrets: {
-            clientId: "PINTEREST_CLIENT_ID",
-            clientSecret: "PINTEREST_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "api.pinterest.com",
-                path: "/v5/oauth/token",
-                methods: ["POST"],
-                inject: "basic",
-            },
-        ],
-        access: ["write"],
-        console: "https://developers.pinterest.com/apps/",
-        authorize: {
-            url: "https://www.pinterest.com/oauth/",
-            scopes: [
-                "boards:read",
-                "boards:write",
-                "pins:read",
-                "pins:write",
-                "user_accounts:read",
-            ],
-        },
-        api: ["api.pinterest.com"],
-        redirectPaths: ["/integrations/social/pinterest"],
-    },
-    discord: {
-        mode: "oauth_client",
-        label: "Discord",
-        secrets: {
-            clientId: "DISCORD_CLIENT_ID",
-            clientSecret: "DISCORD_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "discord.com",
-                path: "/api/oauth2/token",
-                methods: ["POST"],
-                inject: "basic",
-            },
-        ],
-        access: ["write"],
-        console: "https://discord.com/developers/applications",
-        // The server install; posting uses the bot's token, an app secret.
-        authorize: {
-            url: "https://discord.com/oauth2/authorize",
-            scopes: ["bot", "identify", "guilds"],
-        },
-        api: ["discord.com"],
-        redirectPaths: ["/integrations/social/discord"],
-    },
     slack: {
         mode: "oauth_client",
         label: "Slack",
@@ -774,136 +505,26 @@ export const CAPABILITIES = {
             },
         },
         api: ["slack.com"],
-        redirectPaths: [
-            "/integrations/social/slack",
-            "/integrations/slack/callback",
-        ],
-    },
-    mastodon: {
-        mode: "oauth_client",
-        label: "Mastodon",
-        secrets: {
-            clientId: "MASTODON_CLIENT_ID",
-            clientSecret: "MASTODON_CLIENT_SECRET",
-        },
-        // On the instance the operator registered the client on.
-        token: [{ path: "/oauth/token", methods: ["POST"], inject: "form" }],
-        hostSetting: "MASTODON_URL",
-        defaultOrigin: "https://mastodon.social",
-        access: ["write"],
-        console: "/settings/applications",
-        authorize: {
-            url: "/oauth/authorize",
-            scopes: ["write:statuses", "profile", "write:media"],
-        },
-        api: [],
-        redirectPaths: ["/integrations/social/mastodon"],
-    },
-    kick: {
-        mode: "oauth_client",
-        label: "Kick",
-        secrets: { clientId: "KICK_CLIENT_ID", clientSecret: "KICK_CLIENT_SECRET" },
-        token: [
-            {
-                host: "id.kick.com",
-                path: "/oauth/token",
-                methods: ["POST"],
-                inject: "form",
+        // Slack refuses `code_challenge`; `auth.test` names the workspace and
+        // the installing person.
+        flow: {
+            tokenUrl: "https://slack.com/api/oauth.v2.access",
+            revokeUrl: "https://slack.com/api/auth.revoke",
+            pkce: false,
+            scopeDialect: "slack",
+            identity: {
+                url: "https://slack.com/api/auth.test",
+                label: "team",
+                id: "user_id",
             },
-        ],
-        access: ["write"],
-        console: "https://kick.com/settings/developer",
-        authorize: {
-            url: "https://id.kick.com/oauth/authorize",
-            scopes: ["chat:write", "user:read", "channel:read"],
         },
-        api: ["api.kick.com"],
-        redirectPaths: ["/integrations/social/kick"],
-    },
-    twitch: {
-        mode: "oauth_client",
-        label: "Twitch",
-        secrets: {
-            clientId: "TWITCH_CLIENT_ID",
-            clientSecret: "TWITCH_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "id.twitch.tv",
-                path: "/oauth2/token",
-                methods: ["POST"],
-                inject: "form",
-            },
-        ],
-        access: ["write"],
-        console: "https://dev.twitch.tv/console/apps",
-        authorize: {
-            url: "https://id.twitch.tv/oauth2/authorize",
-            scopes: [
-                "user:write:chat",
-                "user:read:chat",
-                "moderator:manage:announcements",
-            ],
-        },
-        // Helix also wants the public client id, as Client-Id, on every call.
-        api: ["api.twitch.tv"],
-        redirectPaths: ["/integrations/social/twitch"],
-    },
-    tumblr: {
-        mode: "oauth_client",
-        label: "Tumblr",
-        secrets: {
-            clientId: "TUMBLR_CLIENT_ID",
-            clientSecret: "TUMBLR_CLIENT_SECRET",
-        },
-        token: [
-            {
-                host: "api.tumblr.com",
-                path: "/v2/oauth2/token",
-                methods: ["POST"],
-                inject: "form",
-            },
-        ],
-        access: ["write"],
-        console: "https://www.tumblr.com/oauth/apps",
-        authorize: {
-            url: "https://www.tumblr.com/oauth2/authorize",
-            scopes: ["write", "offline_access"],
-        },
-        api: ["api.tumblr.com"],
-        redirectPaths: ["/integrations/social/tumblr"],
-    },
-    dribbble: {
-        mode: "oauth_client",
-        label: "Dribbble",
-        secrets: {
-            clientId: "DRIBBBLE_CLIENT_ID",
-            clientSecret: "DRIBBBLE_CLIENT_SECRET",
-        },
-        token: [
-            {
-                // A POST that takes the client in its query string.
-                host: "dribbble.com",
-                path: "/oauth/token",
-                methods: ["POST"],
-                inject: "query",
-            },
-        ],
-        access: ["write"],
-        console: "https://dribbble.com/account/applications",
-        authorize: {
-            url: "https://dribbble.com/oauth/authorize",
-            scopes: ["public", "upload"],
-        },
-        api: ["api.dribbble.com"],
-        redirectPaths: ["/integrations/social/dribbble"],
     },
     // Clients several apps share with different needs, so each app lists the
     // scope sets it uses: Open CRM reads a member's own mailbox and calendar
     // (`gmail.read`, `calendar.read`; `identity`, `mail.read`), OpenSEO reads
     // a site's Search Console and Analytics (`identity`, `search-console.read`,
     // `analytics.read`). Every set is read-only. Google's is one Cloud project
-    // apart from YouTube's; Gmail's read scope is restricted and needs
+    // apart from the YouTube preset's; Gmail's read scope is restricted and needs
     // Google's verification, and whether Search Console and Analytics share
     // that consent screen with it is the operator's choice when verifying.
     "google-workspace": {
@@ -1067,7 +688,21 @@ export const CAPABILITIES = {
             "analyticsadmin.googleapis.com",
             "openidconnect.googleapis.com",
         ],
-        redirectPaths: ["/integrations/google/callback"],
+        // The Gateway-owned flow: a refresh token needs `access_type=offline`,
+        // and `prompt=consent` makes Google issue one on every connect. No
+        // revoke: Google's `/revoke` is per person per client and would also
+        // kill the tokens an app-driven OpenSEO holds under the same client.
+        flow: {
+            tokenUrl: "https://oauth2.googleapis.com/token",
+            pkce: true,
+            scopeDialect: "google",
+            authorizeParams: { access_type: "offline", prompt: "consent" },
+            identity: {
+                url: "https://openidconnect.googleapis.com/v1/userinfo",
+                label: "email",
+                id: "sub",
+            },
+        },
     },
     "microsoft-365": {
         mode: "oauth_client",
@@ -1162,8 +797,20 @@ export const CAPABILITIES = {
             },
         },
         api: ["graph.microsoft.com"],
-        redirectPaths: ["/integrations/microsoft/callback"],
+        flow: {
+            tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+            pkce: true,
+            scopeDialect: "microsoft",
+            identity: {
+                url: "https://graph.microsoft.com/v1.0/me",
+                label: "userPrincipalName",
+                id: "id",
+            },
+        },
     },
+    // The first fifty beyond the entries above (catalog/*.ts, PR 3 of the
+    // provider registry), after them so the derived lists keep their order.
+    ...CATALOG_ENTRIES,
 };
 /** The Gateway settings an API-key or AI provider's `auth` names: the key first, then a Basic username held as a setting. */
 export function authSettingNames(auth) {
@@ -1193,7 +840,6 @@ export function capabilitySettings(capability) {
                 ...(capability.secrets.clientSecret
                     ? [capability.secrets.clientSecret]
                     : []),
-                ...(capability.hostSetting ? [capability.hostSetting] : []),
             ];
     }
 }
@@ -1315,8 +961,8 @@ export function serviceRoutePath(id, route) {
  * an unknown capability (or an AI provider, which has its own route), a
  * host outside the provider's, a path that could leave that host, a path
  * that isn't one of an OAuth client's token endpoints, or a route a service
- * capability doesn't declare. `settings` resolves an OAuth client's
- * `hostSetting` (Mastodon's instance); `lookup` is where the id is found,
+ * capability doesn't declare. `settings` resolves an API-key provider's
+ * `hostSetting` (a Shopify store's host); `lookup` is where the id is found,
  * the catalog alone by default.
  */
 export function parseIntegrationProxyPath(pathname, search, settings, lookup = CATALOG) {
@@ -1340,10 +986,10 @@ export function parseIntegrationProxyPath(pathname, search, settings, lookup = C
         };
     }
     if (capability.mode === "oauth_client") {
-        const upstream = oauthClientHosts(capability, settings).includes(host)
+        const upstream = capability.token.some((rule) => rule.host === host)
             ? httpsUpstream(host, path ?? "/", search)
             : null;
-        const endpoint = upstream && tokenEndpointFor(capability, upstream, settings);
+        const endpoint = upstream && tokenEndpointFor(capability, upstream);
         if (!upstream || !endpoint)
             return null;
         return { kind: "oauth_client", id, capability, upstream, endpoint };
@@ -1368,80 +1014,23 @@ function httpsUpstream(host, path, search) {
     return upstream;
 }
 /**
- * The origin an OAuth client's `hostSetting` names (its default when the
- * setting is unset), or null for a client with a fixed host or a setting
- * that isn't an https origin. A bare host is taken as https.
+ * The token endpoint `upstream` is, by its exact host and path, or null.
+ * Its method is the caller's to check.
  */
-export function oauthClientOrigin(capability, settings) {
-    if (!capability.hostSetting)
-        return null;
-    const set = settings?.[capability.hostSetting];
-    const value = typeof set === "string" && set.trim()
-        ? set.trim()
-        : capability.defaultOrigin;
-    if (!value)
-        return null;
-    let url;
-    try {
-        url = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `https://${value}`);
-    }
-    catch {
-        return null;
-    }
-    // An origin and nothing else: the paths are the provider's own.
-    const bare = url.pathname === "/" &&
-        !url.search &&
-        !url.hash &&
-        !url.username &&
-        !url.password;
-    return url.protocol === "https:" && bare ? url.origin : null;
-}
-/** The host an OAuth client's `hostSetting` names, or null. */
-function settingHost(capability, settings) {
-    const origin = oauthClientOrigin(capability, settings);
-    return origin ? new URL(origin).host : null;
-}
-/** The hosts an OAuth client's token endpoints are on. */
-function oauthClientHosts(capability, settings) {
-    const fromSetting = settingHost(capability, settings);
-    return [
-        ...new Set(capability.token.flatMap(({ host }) => {
-            const resolved = host ?? fromSetting;
-            return resolved ? [resolved] : [];
-        })),
-    ];
-}
-/**
- * The token endpoint `upstream` is, by its exact host and path (a RegExp
- * for a versioned one), or null. Its method is the caller's to check.
- */
-export function tokenEndpointFor(capability, upstream, settings) {
+export function tokenEndpointFor(capability, upstream) {
     if (upstream.protocol !== "https:")
         return null;
-    const fromSetting = settingHost(capability, settings);
-    return (capability.token.find(({ host, path }) => (host ?? fromSetting) === upstream.host &&
-        (typeof path === "string"
-            ? path === upstream.pathname
-            : path.test(upstream.pathname))) ?? null);
+    return (capability.token.find(({ host, path }) => host === upstream.host && path === upstream.pathname) ?? null);
 }
 /** An OAuth client's token endpoints, as `POST https://host/path` lines for messages. */
 export function describeTokenEndpoints(capability) {
     return capability.token
-        .map(({ host, path, methods }) => `${methods.join("/")} https://${host ?? `<${capability.hostSetting}>`}${tokenPathText(path)}`)
+        .map(({ host, path, methods }) => `${methods.join("/")} https://${host}${path}`)
         .join(", ");
 }
-/** A token endpoint's path as people read it: a versioned one as `/v<version>/oauth/access_token`. */
-export function tokenPathText(path) {
-    if (typeof path === "string")
-        return path;
-    return path.source
-        .replace(/^\^|\$$/g, "")
-        .replace(/v\\d\+\\\.\\d\+/g, "v<version>")
-        .replace(/\\(.)/g, "$1");
-}
 /**
  * The command that gives the gateway `capability`'s client:
- * `pnpm everyapp secret set <ID> <SECRET> [<HOST SETTING>]`.
+ * `pnpm everyapp secret set <ID> <SECRET>`.
  */
 export function oauthClientSecretSetCommand(capability) {
     return `pnpm everyapp secret set ${capabilitySettings(capability).join(" ")}`;