@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.11

package/dist/internal/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAchB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CA8Bd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAmBd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA0BjB"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAC7C,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAqB,CAAC;AAC/E,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;CACtB,GAAG,OAAO,CAMV;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB;;;;OAIG;IACH,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAehB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CAqCd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CA2Bd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU5D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

package/dist/internal/protocol.js

@@ -38,6 +38,15 @@ export const GATEWAY_ERROR_HEADER = "x-everyapp-error";
  * from what browsers send.
  */
 export const ORG_HEADER = "x-everyapp-org";
+/**
+ * On background work's call to an OAuth provider's API: the member whose
+ * connection to this app the call uses. Set by `for: { background: true,
+ * userId }`; the gateway reads it on the held-token branch only, for an
+ * organization's own app, and the perimeter strips it, with every
+ * `x-everyapp-*`, from browsers. It addresses a connection; it is not a
+ * permission: connecting in the app already lets the app use it.
+ */
+export const USER_HEADER = "x-everyapp-user";
 /** 120-second lifetime — caps revocation staleness while surviving clock skew. */
 export const IDENTITY_TTL_SECONDS = 120;
 /** System tokens are minted per call and live at most a minute. */
@@ -62,10 +71,63 @@ export const ISSUER_ENV = "EVERYAPP_IDENTITY_ISSUER";
 export const SHARED_ENV = "EVERYAPP_SHARED";
 /** When set to `1` or `true` in the worker env, the dev identity kid is accepted. */
 export const DEV_ENV = "EVERYAPP_DEV";
+/**
+ * The organization an app's Worker is pinned to (a secret the deploy sends;
+ * in development the stub gateway's organization). `everyApp()` refuses an
+ * identity for any other organization; absent on a shared app's Workers.
+ */
+export const ORG_ID_ENV = "EVERY_APP_ORG_ID";
+/**
+ * The organization the dev gateway's seeded user belongs to. The same value
+ * as `@every-app/sdk/dev`'s, kept apart like {@link DEV_ISSUER} (the same
+ * test pins the two together).
+ */
+export const DEV_ORG_ID = "dev-org";
 /** `sub` claim the gateway mints public-route markers with. */
 export const PUBLIC_MARKER_SUB = "public";
 /** `sub` claim of gateway system tokens. */
 export const SYSTEM_TOKEN_SUB = "system";
+/**
+ * Linked dev (`everyapp dev --gateway`, docs/design/linked-dev.md): the
+ * dev Worker's env names the gateway-lite's loopback forwarder and the
+ * run's nonce, and the SDK builds a `{ fetch }` in place of the missing
+ * `EVERY_APP_GATEWAY` binding from them. Set by `everyAppWorker()` in a
+ * development build from the process environment `everyapp dev` starts
+ * the app with; never deployed.
+ */
+export const LINKED_DEV_URL_ENV = "EVERYAPP_LINKED_DEV_URL";
+export const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
+/** The header the forwarder requires, with the run's nonce: no simple cross-origin request can send it. */
+export const LINKED_DEV_HEADER = "x-everyapp-linked-dev";
+/** Where the gateway-lite serves the forwarder, under the app's own host. */
+export const LINKED_DEV_FORWARD_PATH = "/__everyapp/gateway";
+/**
+ * The channels a tool call arrives on: `mcp` for an AI client's MCP
+ * connection, `agent` for an agent principal the Gateway runs a call for.
+ * Only the ToolBus mints either with a `tc` claim.
+ */
+export const TOOL_CALL_CHANNELS = ["mcp", "agent"];
+/** `act.sub` of an agent principal: `agent:<agt_id>`; `sub` stays its sponsor. */
+export const AGENT_ACTOR_PREFIX = "agent:";
+/** `role` as an {@link OrgRole}: `owner` and `admin` as they are, anything else `member`. */
+export function toOrgRole(role) {
+    return role === "owner" || role === "admin" ? role : "member";
+}
+/** Whether `user` manages the organization: an owner or an admin. */
+export function isAdmin(user) {
+    return user.orgRole === "owner" || user.orgRole === "admin";
+}
+/**
+ * Whether an agent principal made this call: `chan: "agent"` with
+ * `act.sub` `agent:<agt_id>`. `user.id` is still the sponsoring member (the
+ * person accountable for the agent), so key rows by it as for anyone;
+ * `user.actor.sub` names the agent.
+ */
+export function isAgentCall(user) {
+    return (user.channel === "agent" &&
+        user.actor.sub.startsWith(AGENT_ACTOR_PREFIX) &&
+        user.actor.sub.length > AGENT_ACTOR_PREFIX.length);
+}
 export class ProtocolClaimsError extends Error {
     constructor(message) {
         super(message);
@@ -78,6 +140,7 @@ export function identitySubjectToClaims(subject, opts) {
         email: subject.email,
         org_id: subject.orgId,
         org_role: subject.orgRole,
+        ...(subject.orgName ? { org_name: subject.orgName } : {}),
         chan: opts.channel ?? "web",
         act: opts.actor ?? { sub: subject.sub },
         scopes: opts.scopes ?? ["*"],
@@ -112,6 +175,11 @@ export function identityClaimsToEveryAppUser(payload) {
     if (!sub || !email || !orgId || !orgRole) {
         throw new ProtocolClaimsError("identity token missing required claims");
     }
+    // Display only, so a token without it (or with a malformed one) is still
+    // an identity: the app falls back to no name.
+    const orgName = typeof payload.org_name === "string" && payload.org_name
+        ? payload.org_name
+        : undefined;
     const chan = payload.chan ?? "web";
     const act = payload.act ?? { sub };
     const scopes = Array.isArray(payload.scopes)
@@ -122,7 +190,8 @@ export function identityClaimsToEveryAppUser(payload) {
         id: sub,
         email,
         orgId,
-        orgRole,
+        orgRole: toOrgRole(orgRole),
+        ...(orgName ? { orgName } : {}),
         channel: chan,
         actor: { sub: act.sub ?? sub },
         scopes,
@@ -158,6 +227,10 @@ export function assertSystemClaims(payload, purpose) {
         payload.exp - payload.iat > SYSTEM_TOKEN_TTL_SECONDS) {
         throw new ProtocolClaimsError(`system token must expire within ${SYSTEM_TOKEN_TTL_SECONDS}s of issue`);
     }
+    if (purpose === "events.deliver" &&
+        (typeof payload.bh !== "string" || payload.bh.length === 0)) {
+        throw new ProtocolClaimsError("an events.deliver token must name the body it was minted for");
+    }
     return payload;
 }
 let cachedPrivateKey = null;
@@ -219,6 +292,17 @@ export async function mintPublicMarkerJwt(privateKeyPem, opts) {
         .setExpirationTime(nowSec + ttl)
         .sign(key);
 }
+/** SHA-256 of a request body, base64url: what an `events.deliver` token's `bh` names. */
+export async function bodyHash(body) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)));
+    let binary = "";
+    for (const byte of digest)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
 /**
  * Mint the gateway's system token for `x-everyapp-system`: no user, one
  * purpose, one app, one minute. The SDK only accepts it on the endpoint its
@@ -231,10 +315,14 @@ export async function mintSystemJwt(privateKeyPem, opts) {
     }
     const key = await loadPrivateKey(privateKeyPem);
     const nowSec = Math.floor((opts.now ?? Date.now()) / 1000);
+    if (opts.purpose === "events.deliver" && !opts.bodyHash) {
+        throw new RangeError("an events.deliver token needs the body's hash");
+    }
     const claims = {
         typ: "system",
         purpose: opts.purpose,
         jti: crypto.randomUUID(),
+        ...(opts.bodyHash ? { bh: opts.bodyHash } : {}),
     };
     return new SignJWT(claims)
         .setProtectedHeader({

package/dist/internal/providerRegistry.d.ts

@@ -20,7 +20,8 @@
  *    and not one the gateway serves itself (`refuseHost`, which knows the
  *    gateway's own host and `APP_BASE_DOMAIN`).
  */
-import { type ApiKeyCapability, type Capability, type CapabilityLookup } from "./capabilities.js";
+import { type Capability, type CapabilityLookup } from "./capabilities.js";
+import { type RegistrableCapability } from "./providerSpec.js";
 /** A `providers` row as the gateway or the CLI read it. */
 export interface ProviderRow {
     id: string;
@@ -42,13 +43,17 @@ export interface ProviderRow {
  * The part of a row a key is set for: its hosts, its host setting and its
  * auth, as one canonical string (sorted keys, sorted hosts), so that
  * replacing a row's hosts or auth changes the key and the value it held
- * is no longer read until the operator sets it again.
+ * is no longer read until the operator sets it again. For an OAuth
+ * provider the client is bound to its authorize, token and revoke URLs,
+ * its API hosts, where the client goes on the token request and its
+ * client setting names (`oauth.client-bound-to-endpoints`): an admin who
+ * re-points `tokenUrl` has to paste the secret again.
  */
-export declare function providerBindingKey(capability: ApiKeyCapability): string;
+export declare function providerBindingKey(capability: RegistrableCapability): string;
 /** One registered row as `provider list` and `provider show` report it. */
 export interface RegisteredProvider {
     id: string;
-    capability: ApiKeyCapability;
+    capability: RegistrableCapability;
     /** Whether the row's key was set for the hosts and auth it has now. */
     bound: boolean;
     addedBy: string | null;
@@ -121,18 +126,24 @@ export declare function rowSecretProblem(id: string, name: string, taken: (name:
  * CLI runs it before writing D1, the MCP tool before writing, and the
  * gateway again on every read.
  */
-export declare function checkProviderRow(id: string, capability: ApiKeyCapability, context: {
+export declare function checkProviderRow(id: string, capability: RegistrableCapability, context: {
     /** Settings the other rows hold. */
     rowSettings: ReadonlySet<string>;
     refuseHost?: (host: string) => string | null;
 }): RowRefusal | null;
+/**
+ * Every host a row sends a secret to: an API-key provider's `hosts`; an
+ * OAuth provider's API hosts (the token), and its authorize, token and
+ * revoke hosts (the client). Each passes the row host rules.
+ */
+export declare function registrableHosts(capability: RegistrableCapability): string[];
 /** A row's spec parsed and checked: the capability, or the refusal. */
 export declare function resolveProviderRow(row: ProviderRow, context: {
     rowSettings: ReadonlySet<string>;
     refuseHost?: (host: string) => string | null;
 }): {
     ok: true;
-    capability: ApiKeyCapability;
+    capability: RegistrableCapability;
 } | {
     ok: false;
     refusal: RowRefusal;

package/dist/internal/providerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/internal/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAa3B,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAoBvE;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,gBAAgB,CAAC;IAC7B,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,mFAAmF;IACnF,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,8DAA8D;IAC9D,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C;AAOD,wHAAwH;AACxH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,GAClB,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,MAAM,GAAG,IAAI,CAqBf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE;IACP,oCAAoC;IACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GACA,UAAU,GAAG,IAAI,CAuBnB;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;IACP,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GAEC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyCrC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,SAAS,WAAW,EAAO,EACjC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAqElB;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,EAAE,gBAAqC,CAAC"}
+{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/internal/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CA2B5E;AAoBD,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,qBAAqB,CAAC;IAClC,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,mFAAmF;IACnF,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,8DAA8D;IAC9D,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C;AAOD,wHAAwH;AACxH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,GAClB,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,MAAM,GAAG,IAAI,CAwBf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE;IACP,oCAAoC;IACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GACA,UAAU,GAAG,IAAI,CAuBnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAqB5E;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;IACP,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GAEC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyCrC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,SAAS,WAAW,EAAO,EACjC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAqElB;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,EAAE,gBAAqC,CAAC"}

package/dist/internal/providerRegistry.js

@@ -22,15 +22,49 @@
  */
 import { CAPABILITIES, CAPABILITY_IDS, capabilitySettings, } from "./capabilities.js";
 import { isDevOnlyGatewaySetting, isInstallOwnedGatewaySetting, isReservedAppSecretName, isSettableGatewaySetting, } from "./gatewaySettings.js";
+import { isSignInSettingName } from "./signInProviders.js";
 import { describeSpecProblems, parseProviderSpec, PROVIDER_ID, } from "./providerSpec.js";
 /**
  * The part of a row a key is set for: its hosts, its host setting and its
  * auth, as one canonical string (sorted keys, sorted hosts), so that
  * replacing a row's hosts or auth changes the key and the value it held
- * is no longer read until the operator sets it again.
+ * is no longer read until the operator sets it again. For an OAuth
+ * provider the client is bound to its authorize, token and revoke URLs,
+ * its API hosts, where the client goes on the token request and its
+ * client setting names (`oauth.client-bound-to-endpoints`): an admin who
+ * re-points `tokenUrl` has to paste the secret again.
  */
 export function providerBindingKey(capability) {
-    const auth = Object.fromEntries(Object.entries(capability.auth)
+    if (capability.mode === "ai") {
+        // An `ai` row's key is bound to where the proxy sends it: its base URL and the key's placement.
+        return JSON.stringify({
+            kind: "ai",
+            auth: sortedAuth(capability.auth),
+            origin: capability.origin,
+            basePath: capability.basePath ?? null,
+        });
+    }
+    if (capability.mode === "oauth_client") {
+        return JSON.stringify({
+            kind: "oauth2-user",
+            authorizeUrl: capability.flow.authorizeUrl,
+            tokenUrl: capability.flow.tokenUrl,
+            revokeUrl: capability.flow.revokeUrl ?? null,
+            inject: capability.flow.inject,
+            clientId: capability.secrets.clientId,
+            clientSecret: capability.secrets.clientSecret ?? null,
+            hosts: [...capability.api].sort(),
+        });
+    }
+    return JSON.stringify({
+        auth: sortedAuth(capability.auth),
+        hostSetting: capability.hostSetting ?? null,
+        hosts: [...capability.hosts].sort(),
+    });
+}
+/** An auth block with its keys sorted, one level down too, for a canonical key. */
+function sortedAuth(auth) {
+    return Object.fromEntries(Object.entries(auth)
         .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
         .map(([field, value]) => [
         field,
@@ -38,11 +72,6 @@ export function providerBindingKey(capability) {
             ? Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))
             : value,
     ]));
-    return JSON.stringify({
-        auth,
-        hostSetting: capability.hostSetting ?? null,
-        hosts: [...capability.hosts].sort(),
-    });
 }
 /** The reserved app id no provider may take. */
 const RESERVED_IDS = new Set(["everyapp"]);
@@ -116,6 +145,9 @@ export function rowSecretProblem(id, name, taken) {
     if (isReservedAppSecretName(name)) {
         return `${name} is a name everyapp sets itself`;
     }
+    if (isSignInSettingName(name)) {
+        return `${name} is a sign-in provider's setting name (every <ID>_SIGNIN_<FIELD> name is the Gateway's, set with \`everyapp signin add\`)`;
+    }
     if (isSettableGatewaySetting(name)) {
         return `${name} is a Gateway setting another provider or the Gateway reads`;
     }
@@ -143,7 +175,7 @@ export function checkProviderRow(id, capability, context) {
             return { id, code: "PROVIDER_SECRET_TAKEN", message: problem };
         }
     }
-    for (const host of capability.hosts) {
+    for (const host of registrableHosts(capability)) {
         const problem = publicHostProblem(host) ?? context.refuseHost?.(host);
         if (problem) {
             return { id, code: "PROVIDER_HOST_REFUSED", message: problem };
@@ -151,6 +183,37 @@ export function checkProviderRow(id, capability, context) {
     }
     return null;
 }
+/**
+ * Every host a row sends a secret to: an API-key provider's `hosts`; an
+ * OAuth provider's API hosts (the token), and its authorize, token and
+ * revoke hosts (the client). Each passes the row host rules.
+ */
+export function registrableHosts(capability) {
+    if (capability.mode === "api_key")
+        return [...capability.hosts];
+    if (capability.mode === "ai")
+        return [new URL(capability.origin).hostname.toLowerCase()];
+    const hosts = [...capability.api];
+    const urls = [
+        capability.flow.authorizeUrl,
+        capability.flow.tokenUrl,
+        capability.flow.revokeUrl,
+        capability.flow.identity?.url,
+    ];
+    for (const url of urls) {
+        if (!url)
+            continue;
+        try {
+            const host = new URL(url).hostname.toLowerCase();
+            if (!hosts.includes(host))
+                hosts.push(host);
+        }
+        catch {
+            // The parser refused it already.
+        }
+    }
+    return hosts;
+}
 /** A row's spec parsed and checked: the capability, or the refusal. */
 export function resolveProviderRow(row, context) {
     let spec = row.spec;

package/dist/internal/providerSpec.d.ts

@@ -6,30 +6,41 @@
  * JSON into an {@link ApiKeyCapability} or names every problem; nothing
  * here reads a value: a spec names Gateway settings, never holds one.
  *
- * This slice parses API-key providers (`auth.kind` bearer, header, query
- * or basic). An AI provider or an OAuth client is a catalog entry only;
- * the parser says so rather than guessing.
+ * Three kinds parse: API-key providers (`auth.kind` bearer, header, query
+ * or basic), OAuth providers (`auth.kind` oauth2-user, the half in
+ * ./oauthSpec.ts: the Gateway runs the flow and holds the tokens,
+ * docs/design/2026-10-oauth-providers.md), and OpenAI-compatible model
+ * providers (`mode: "ai"`: a `baseUrl`, the key's placement, the models
+ * it serves and the default, its inference routes; the AI proxy serves a
+ * row exactly as it serves a catalog `ai` entry, inference POSTs alone,
+ * `store: false` on chat, the usage tap, so a new model vendor is a
+ * registered spec, not a catalog release).
  *
  * The rules that make a row safe on a particular gateway (its secret names
  * are its own, its hosts are public, it shadows no catalog entry) are the
  * registry's (./providerRegistry.ts), run after this parse.
  */
-import { type ApiKeyCapability } from "./capabilities.js";
+import { type AiProviderCapability, type ApiKeyCapability, type OAuthClientCapability } from "./capabilities.js";
 /** A provider id: lowercase, a letter first, 2 to 40 characters. */
 export declare const PROVIDER_ID: RegExp;
 /** A Gateway setting name a provider may hold: upper case, 3 to 64 characters. */
 export declare const PROVIDER_SECRET_NAME: RegExp;
 /** A bare lowercase host with at least one dot: labels of letters, digits and hyphens. */
 export declare const PROVIDER_HOST: RegExp;
+/** What an `ai` row serves by default: chat, and embeddings when it names an embeddings model. */
+export declare const AI_SPEC_CHAT_ROUTE = "/v1/chat/completions";
+export declare const AI_SPEC_EMBEDDINGS_ROUTE = "/v1/embeddings";
 export interface ProviderSpecProblem {
     /** Dotted: `auth.secret`, `hosts.1`, or `(root)`. */
     path: string;
     message: string;
 }
+/** What a row or a preset may be: an API key, an OAuth provider with a `flow`, or an OpenAI-compatible model provider. */
+export type RegistrableCapability = ApiKeyCapability | OAuthClientCapability | AiProviderCapability;
 export type ParsedProviderSpec = {
     ok: true;
     id: string;
-    capability: ApiKeyCapability;
+    capability: RegistrableCapability;
 } | {
     ok: false;
     problems: ProviderSpecProblem[];
@@ -49,7 +60,7 @@ export declare function describeSpecProblems(problems: readonly ProviderSpecProb
  * defaults the parser fills in spelled out, so `parseProviderSpec` of it
  * gives the entry back.
  */
-export declare function providerSpecOf(id: string, capability: ApiKeyCapability): Record<string, unknown>;
+export declare function providerSpecOf(id: string, capability: RegistrableCapability): Record<string, unknown>;
 /** The methods an app with `access: "write"` may use on `capability` besides its read methods. */
-export declare function writeMethodsOf(capability: ApiKeyCapability): readonly string[];
+export declare function writeMethodsOf(capability: RegistrableCapability): readonly string[];
 //# sourceMappingURL=providerSpec.d.ts.map

package/dist/internal/providerSpec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerSpec.d.ts","sourceRoot":"","sources":["../../src/internal/providerSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAIL,KAAK,gBAAgB,EAMtB,MAAM,mBAAmB,CAAC;AAE3B,oEAAoE;AACpE,eAAO,MAAM,WAAW,QAA2B,CAAC;AACpD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAC7D,0FAA0F;AAC1F,eAAO,MAAM,aAAa,QACoD,CAAC;AA0D/E,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AA+fnD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAqKpE;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,GACvC,MAAM,CAIR;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwCzB;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAC5B,UAAU,EAAE,gBAAgB,GAC3B,SAAS,MAAM,EAAE,CAEnB"}
+{"version":3,"file":"providerSpec.d.ts","sourceRoot":"","sources":["../../src/internal/providerSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAGL,KAAK,oBAAoB,EAEzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAM3B,MAAM,mBAAmB,CAAC;AAO3B,oEAAoE;AACpE,eAAO,MAAM,WAAW,QAA2B,CAAC;AACpD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAC7D,0FAA0F;AAC1F,eAAO,MAAM,aAAa,QACoD,CAAC;AA4C/E,kGAAkG;AAClG,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAkEzD,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0HAA0H;AAC1H,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AA+iBnD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAsNpE;AAkOD,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,GACvC,MAAM,CAIR;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+FzB;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAC5B,UAAU,EAAE,qBAAqB,GAChC,SAAS,MAAM,EAAE,CAKnB"}