@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.11

package/dist/internal/signInProviders.d.ts

@@ -0,0 +1,104 @@
+/**
+ * The sign-in providers a Gateway can offer beside passwords ("Continue
+ * with Google"), as data: what each one is called, the Worker secrets it
+ * reads, where the OAuth app is made, the scopes asked for and which claim
+ * becomes the email. One catalog serves the Gateway (which providers are
+ * on, the sign-in page's buttons, Manage workspace → Sign-in), the CLI
+ * (`everyapp signin add|list|show|remove`, `secret set`), the manifest
+ * validator (an app's own secret can never take one of these names) and
+ * the docs' drift tests.
+ *
+ * Naming rule, agreed with the provider registry's conventions
+ * (docs/design/2026-10-provider-registry.md, section 6): a sign-in
+ * provider's settings are `<ID>_SIGNIN_<FIELD>`, with FIELD one of
+ * CLIENT_ID, CLIENT_SECRET, ISSUER, LABEL or TENANT. The `_SIGNIN_` infix is
+ * what keeps the family apart from the API providers' `<ID>_API_KEY`,
+ * `<ID>_CLIENT_ID` (the OAuth clients the Gateway holds for apps) and the
+ * MCP apps' `<ID>_MCP_TOKEN`: `GOOGLE_SIGNIN_CLIENT_ID` is the sign-in
+ * provider's, `GOOGLE_WORKSPACE_CLIENT_ID` the OAuth client apps use, and
+ * a registered provider row or an app manifest can never claim a name in
+ * the family (isSignInSettingName).
+ *
+ * The settings are Worker secrets, set under the Cloudflare login (`everyapp
+ * signin add`, or `secret set`), never from the admin UI or an agent
+ * connection: a stolen session can't add a way in.
+ */
+export declare const SIGN_IN_PROVIDER_IDS: readonly ["google", "microsoft", "github", "apple", "cloudflare", "oidc"];
+export type SignInProviderId = (typeof SIGN_IN_PROVIDER_IDS)[number];
+/** What a setting of a sign-in provider holds. */
+export type SignInSettingRole = "clientId" | "clientSecret" | "issuer" | "label" | "tenant";
+export interface SignInSetting {
+    /** `GOOGLE_SIGNIN_CLIENT_ID`. */
+    readonly name: string;
+    readonly role: SignInSettingRole;
+    /** Without it the provider is off (an incomplete set is reported). */
+    readonly required: boolean;
+    /**
+     * A plain value (an id, a URL, a word) `everyapp secret set` may show as
+     * typed; a credential stays hidden.
+     */
+    readonly plain: boolean;
+    /** One line: what to paste here. */
+    readonly what: string;
+}
+export interface SignInProvider {
+    readonly id: SignInProviderId;
+    /** The button: "Continue with <label>". The `oidc` entry's label is a setting. */
+    readonly label: string;
+    /** Where the OAuth app is created. */
+    readonly console: string;
+    /** What the OAuth app is called there ("OAuth client ID", "App registration"). */
+    readonly appNoun: string;
+    readonly settings: readonly SignInSetting[];
+    /** The scopes requested: identity only, nothing an app could act with. */
+    readonly scopes: readonly string[];
+    /** Which claim becomes the email, and what makes it count as verified. */
+    readonly emailClaim: string;
+    /** The everyapp skill's setup guide, relative to the skill. */
+    readonly setup: `setup/signin-${SignInProviderId}.md`;
+    /** Caveats worth a line in every listing. */
+    readonly notes: readonly string[];
+}
+/** The path Better Auth serves the provider's callback on, under the Gateway's URL. */
+export declare function signInCallbackPath(id: SignInProviderId): string;
+/** The redirect URL to register with the provider, for a Gateway at `gatewayUrl`. */
+export declare function signInCallbackUrl(gatewayUrl: string, id: SignInProviderId): string;
+export declare const SIGN_IN_PROVIDERS: Readonly<Record<SignInProviderId, SignInProvider>>;
+/** The catalog in listing order. */
+export declare const SIGN_IN_PROVIDER_LIST: readonly SignInProvider[];
+export declare function isSignInProviderId(value: string): value is SignInProviderId;
+/**
+ * Every setting a sign-in provider reads, in catalog order: what `everyapp
+ * secret set` accepts for the Gateway, and what the Gateway's dev config
+ * declares.
+ */
+export declare const SIGN_IN_GATEWAY_SETTINGS: readonly string[];
+/** The plain (non-credential) ones among them: ids, the issuer, the label, the tenant. */
+export declare const PLAIN_SIGN_IN_SETTINGS: readonly string[];
+/**
+ * The family: any name of the shape `<ID>_SIGNIN_<FIELD>`. Reserved for the
+ * catalog above, whether or not an entry reads the name today, so no
+ * registered provider row and no app manifest can ever take one.
+ */
+export declare const SIGN_IN_SETTING_PATTERN: RegExp;
+export declare function isSignInSettingName(name: string): boolean;
+/** The provider a setting belongs to, if one reads it. */
+export declare function signInProviderOfSetting(name: string): SignInProvider | null;
+/** Whether a provider is on, off, or half set up, from which names are set. */
+export type SignInProviderStatus = "on" | "off" | "incomplete";
+export interface SignInProviderState {
+    readonly id: SignInProviderId;
+    readonly status: SignInProviderStatus;
+    /** The required settings not set (empty when on or off). */
+    readonly missing: readonly string[];
+    /** The settings set, required or not. */
+    readonly set: readonly string[];
+}
+/**
+ * A provider's state from which of its settings exist: on when every
+ * required one is set, off when none at all is, incomplete in between (the
+ * Gateway refuses to half-configure a sign-in: the provider is off and the
+ * problem is reported).
+ */
+export declare function signInProviderState(provider: SignInProvider, isSet: (name: string) => boolean): SignInProviderState;
+//# sourceMappingURL=signInProviders.d.ts.map

package/dist/internal/signInProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInProviders.d.ts","sourceRoot":"","sources":["../../src/internal/signInProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,eAAO,MAAM,oBAAoB,2EAOvB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,cAAc,GACd,QAAQ,GACR,OAAO,GACP,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,gBAAgB,gBAAgB,KAAK,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,GAAG,MAAM,CAE/D;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,gBAAgB,GACnB,MAAM,CAER;AA8BD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CACtC,MAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAyIzC,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,qBAAqB,EAAE,SAAS,cAAc,EACF,CAAC;AAE1D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,gBAAgB,CAE3E;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGnD,CAAC;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAKjD,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QACsC,CAAC;AAE3E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,0DAA0D;AAC1D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAO3E;AAED,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,KAAK,GAAG,YAAY,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,yCAAyC;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,mBAAmB,CAiBrB"}

package/dist/internal/signInProviders.js

@@ -0,0 +1,245 @@
+/**
+ * The sign-in providers a Gateway can offer beside passwords ("Continue
+ * with Google"), as data: what each one is called, the Worker secrets it
+ * reads, where the OAuth app is made, the scopes asked for and which claim
+ * becomes the email. One catalog serves the Gateway (which providers are
+ * on, the sign-in page's buttons, Manage workspace → Sign-in), the CLI
+ * (`everyapp signin add|list|show|remove`, `secret set`), the manifest
+ * validator (an app's own secret can never take one of these names) and
+ * the docs' drift tests.
+ *
+ * Naming rule, agreed with the provider registry's conventions
+ * (docs/design/2026-10-provider-registry.md, section 6): a sign-in
+ * provider's settings are `<ID>_SIGNIN_<FIELD>`, with FIELD one of
+ * CLIENT_ID, CLIENT_SECRET, ISSUER, LABEL or TENANT. The `_SIGNIN_` infix is
+ * what keeps the family apart from the API providers' `<ID>_API_KEY`,
+ * `<ID>_CLIENT_ID` (the OAuth clients the Gateway holds for apps) and the
+ * MCP apps' `<ID>_MCP_TOKEN`: `GOOGLE_SIGNIN_CLIENT_ID` is the sign-in
+ * provider's, `GOOGLE_WORKSPACE_CLIENT_ID` the OAuth client apps use, and
+ * a registered provider row or an app manifest can never claim a name in
+ * the family (isSignInSettingName).
+ *
+ * The settings are Worker secrets, set under the Cloudflare login (`everyapp
+ * signin add`, or `secret set`), never from the admin UI or an agent
+ * connection: a stolen session can't add a way in.
+ */
+export const SIGN_IN_PROVIDER_IDS = [
+    "google",
+    "microsoft",
+    "github",
+    "apple",
+    "cloudflare",
+    "oidc",
+];
+/** The path Better Auth serves the provider's callback on, under the Gateway's URL. */
+export function signInCallbackPath(id) {
+    return `/api/auth/callback/${id}`;
+}
+/** The redirect URL to register with the provider, for a Gateway at `gatewayUrl`. */
+export function signInCallbackUrl(gatewayUrl, id) {
+    return `${gatewayUrl.replace(/\/+$/, "")}${signInCallbackPath(id)}`;
+}
+function settingName(id, field) {
+    return `${id.toUpperCase()}_SIGNIN_${field}`;
+}
+function clientPair(id, what) {
+    return [
+        {
+            name: settingName(id, "CLIENT_ID"),
+            role: "clientId",
+            required: true,
+            plain: true,
+            what: what.clientId,
+        },
+        {
+            name: settingName(id, "CLIENT_SECRET"),
+            role: "clientSecret",
+            required: true,
+            plain: false,
+            what: what.clientSecret,
+        },
+    ];
+}
+const IDENTITY_SCOPES = ["openid", "email", "profile"];
+export const SIGN_IN_PROVIDERS = {
+    google: {
+        id: "google",
+        label: "Google",
+        console: "https://console.cloud.google.com/apis/credentials",
+        appNoun: "OAuth client ID (Web application)",
+        settings: clientPair("google", {
+            clientId: "The OAuth client's Client ID (ends in .apps.googleusercontent.com)",
+            clientSecret: "The OAuth client's Client secret",
+        }),
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email`, counted as verified only when its `email_verified` is true (every Google account's own address is)",
+        setup: "setup/signin-google.md",
+        notes: [
+            "An OAuth consent screen still in Testing only signs in the test users listed on it; publish it for everyone else.",
+        ],
+    },
+    microsoft: {
+        id: "microsoft",
+        label: "Microsoft",
+        console: "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+        appNoun: "App registration",
+        settings: [
+            ...clientPair("microsoft", {
+                clientId: "The app registration's Application (client) ID",
+                clientSecret: "A client secret from Certificates & secrets (it expires; 24 months at most)",
+            }),
+            {
+                name: settingName("microsoft", "TENANT"),
+                role: "tenant",
+                required: false,
+                plain: true,
+                what: "The Directory (tenant) ID to pin sign-in to your own directory; unset means any Microsoft account (common), which then needs the xms_edov claim",
+            },
+        ],
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email`, counted as verified when MICROSOFT_SIGNIN_TENANT pins your own directory, or the token carries `xms_edov: true` (the optional claim that says the domain's owner verified it), `email_verified: true`, a matching `verified_primary_email`, or comes from a personal Microsoft account",
+        setup: "setup/signin-microsoft.md",
+        notes: [
+            "Without MICROSOFT_SIGNIN_TENANT, add the optional claims `email` and `xms_edov` under Token configuration, or every sign-in is refused as unverified: any tenant's admin can put any address on their users.",
+        ],
+    },
+    github: {
+        id: "github",
+        label: "GitHub",
+        console: "https://github.com/settings/developers",
+        appNoun: "OAuth App",
+        settings: clientPair("github", {
+            clientId: "The OAuth App's Client ID",
+            clientSecret: "A client secret generated on the OAuth App",
+        }),
+        scopes: ["read:user", "user:email"],
+        emailClaim: "the primary address from GitHub's emails API, counted as verified only when GitHub marks it verified",
+        setup: "setup/signin-github.md",
+        notes: [
+            "GitHub Apps are something else: make an OAuth App (Settings → Developer settings → OAuth Apps).",
+        ],
+    },
+    apple: {
+        id: "apple",
+        label: "Apple",
+        console: "https://developer.apple.com/account/resources/identifiers/list/serviceId",
+        appNoun: "Services ID",
+        settings: clientPair("apple", {
+            clientId: "The Services ID's identifier (com.example.gateway)",
+            clientSecret: "The client secret JWT you generate from your Sign in with Apple key (ES256; valid six months at most, then generate it again)",
+        }),
+        scopes: ["email", "name"],
+        emailClaim: "the ID token's `email`, counted as verified only when its `email_verified` is true; someone who chose Hide My Email arrives as a @privaterelay.appleid.com address, which no invitation names",
+        setup: "setup/signin-apple.md",
+        notes: [
+            "Apple returns to the Gateway with a POST; behind the outer ring, `everyapp access on` leaves /api/auth/callback/apple public (it only redirects to the same URL as a GET, which Access then checks).",
+            "The client secret is a JWT that expires within six months: generate a new one before then or sign-in stops.",
+        ],
+    },
+    cloudflare: {
+        id: "cloudflare",
+        label: "Cloudflare",
+        console: "https://dash.cloudflare.com/?to=/:account/oauth-clients",
+        appNoun: "OAuth client (Manage Account → OAuth clients)",
+        settings: clientPair("cloudflare", {
+            clientId: "The OAuth client's Client ID",
+            clientSecret: "The OAuth client's Client secret",
+        }),
+        scopes: ["user-details.read"],
+        emailClaim: "the Cloudflare API's /user `email` (the account's sign-in address). Cloudflare reports no verified flag, so the email counts as verified on the strength of the client being private: only members of your Cloudflare account can authorize it, and they got in by accepting an invitation sent to that address",
+        setup: "setup/signin-cloudflare.md",
+        notes: [
+            "Keep the client private (the default): a public client lets any Cloudflare user sign in, and Cloudflare says nothing about whether their address is verified. Making a client public is permanent.",
+            "The Cloudflare account's members sign in; for everyone else use Cloudflare Access's one-time PIN (`everyapp access on`) or another provider.",
+        ],
+    },
+    oidc: {
+        id: "oidc",
+        label: "SSO",
+        console: "your identity provider's admin console",
+        appNoun: "OpenID Connect client (web application, authorization code)",
+        settings: [
+            {
+                name: settingName("oidc", "ISSUER"),
+                role: "issuer",
+                required: true,
+                plain: true,
+                what: "The issuer URL (https://…), which serves /.well-known/openid-configuration",
+            },
+            ...clientPair("oidc", {
+                clientId: "The client ID",
+                clientSecret: "The client secret",
+            }),
+            {
+                name: settingName("oidc", "LABEL"),
+                role: "label",
+                required: false,
+                plain: true,
+                what: 'The button text after "Continue with" (default "SSO")',
+            },
+        ],
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email` (else the userinfo endpoint's), counted as verified only when `email_verified` is true",
+        setup: "setup/signin-oidc.md",
+        notes: [
+            "Cloudflare Access has its own settings (CLOUDFLARE_ACCESS_OIDC_*, `everyapp access`): use those for Access, this for Okta, Keycloak, Auth0, Authentik, Google Workspace as an OIDC issuer and the like. For Microsoft Entra ID use the `microsoft` provider: Entra's ID tokens carry no `email_verified`, so through this entry every sign-in would be refused as unverified.",
+            "ID tokens must be signed with RS256 (every major provider's default).",
+        ],
+    },
+};
+/** The catalog in listing order. */
+export const SIGN_IN_PROVIDER_LIST = SIGN_IN_PROVIDER_IDS.map((id) => SIGN_IN_PROVIDERS[id]);
+export function isSignInProviderId(value) {
+    return SIGN_IN_PROVIDER_IDS.includes(value);
+}
+/**
+ * Every setting a sign-in provider reads, in catalog order: what `everyapp
+ * secret set` accepts for the Gateway, and what the Gateway's dev config
+ * declares.
+ */
+export const SIGN_IN_GATEWAY_SETTINGS = SIGN_IN_PROVIDER_LIST.flatMap((provider) => provider.settings.map((setting) => setting.name));
+/** The plain (non-credential) ones among them: ids, the issuer, the label, the tenant. */
+export const PLAIN_SIGN_IN_SETTINGS = SIGN_IN_PROVIDER_LIST.flatMap((provider) => provider.settings
+    .filter((setting) => setting.plain)
+    .map((setting) => setting.name));
+/**
+ * The family: any name of the shape `<ID>_SIGNIN_<FIELD>`. Reserved for the
+ * catalog above, whether or not an entry reads the name today, so no
+ * registered provider row and no app manifest can ever take one.
+ */
+export const SIGN_IN_SETTING_PATTERN = /^[A-Z][A-Z0-9_]*_SIGNIN_(CLIENT_ID|CLIENT_SECRET|ISSUER|LABEL|TENANT)$/;
+export function isSignInSettingName(name) {
+    return SIGN_IN_SETTING_PATTERN.test(name);
+}
+/** The provider a setting belongs to, if one reads it. */
+export function signInProviderOfSetting(name) {
+    for (const provider of SIGN_IN_PROVIDER_LIST) {
+        if (provider.settings.some((setting) => setting.name === name)) {
+            return provider;
+        }
+    }
+    return null;
+}
+/**
+ * A provider's state from which of its settings exist: on when every
+ * required one is set, off when none at all is, incomplete in between (the
+ * Gateway refuses to half-configure a sign-in: the provider is off and the
+ * problem is reported).
+ */
+export function signInProviderState(provider, isSet) {
+    const set = provider.settings
+        .filter((setting) => isSet(setting.name))
+        .map((setting) => setting.name);
+    const unset = provider.settings
+        .filter((setting) => setting.required && !isSet(setting.name))
+        .map((setting) => setting.name);
+    const status = unset.length === 0 ? "on" : set.length === 0 ? "off" : "incomplete";
+    // `missing` names what a half-set provider still needs; a provider nobody
+    // started setting up isn't missing anything, it is off.
+    return {
+        id: provider.id,
+        status,
+        missing: status === "incomplete" ? unset : [],
+        set,
+    };
+}

package/dist/internal/tools.d.ts

@@ -4,7 +4,8 @@
  * gateway's service binding and never public:
  *
  *   POST /__everyapp/tools/list  x-everyapp-system JWT (purpose "tools.list")
- *   POST /__everyapp/tools/call  x-everyapp-identity JWT, chan "mcp" + tc claim
+ *   POST /__everyapp/tools/call  x-everyapp-identity JWT, chan "mcp" or
+ *                                "agent" + tc claim
  *
  * MCP itself (protocol eras, headers, envelopes) stays in the gateway; apps
  * only ever speak this small versioned JSON shape. Both sides import the
@@ -16,7 +17,7 @@ export declare const TOOLS_LIST_PATH = "/__everyapp/tools/list";
 export declare const TOOLS_CALL_PATH = "/__everyapp/tools/call";
 export declare const TOOL_RISKS: readonly ["read", "write", "destructive"];
 export type ToolRisk = (typeof TOOL_RISKS)[number];
-/** Scopes the gateway mints on `chan: "mcp"` identities, one per risk. */
+/** Scopes the gateway mints on tool-call identities (`chan: "mcp"` or `"agent"`), one per risk. */
 export declare const MCP_READ_SCOPE = "mcp:read";
 export declare const MCP_WRITE_SCOPE = "mcp:write";
 /** Never minted in v1: destructive tools are hidden until approvals exist. */
@@ -24,7 +25,7 @@ export declare const MCP_DESTRUCTIVE_SCOPE = "mcp:destructive";
 /** Local tool names: lowercase snake_case, at most 48 characters. */
 export declare const TOOL_NAME_PATTERN: RegExp;
 export declare function isToolRisk(value: unknown): value is ToolRisk;
-/** The exact scope a `chan: "mcp"` identity must carry to call a tool. */
+/** The exact scope a tool-call identity must carry to call a tool. */
 export declare function requiredScopeForRisk(risk: ToolRisk): string;
 export interface ToolAnnotationsV1 {
     idempotentHint?: boolean;
@@ -55,7 +56,7 @@ export interface ToolsListResponseV1 {
     /** Tools the SDK left out because it can't describe them, and why. */
     warnings?: string[];
 }
-/** The `tc` identity claim: binds a `chan: "mcp"` token to one call. */
+/** The `tc` identity claim: binds a tool-call token (`chan: "mcp"` or `"agent"`) to one call. */
 export interface ToolCallClaim {
     id: string;
     name: string;

package/dist/internal/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/internal/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AACxC,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,eAAe,2BAA8B,CAAC;AAC3D,eAAO,MAAM,eAAe,2BAA8B,CAAC;AAE3D,eAAO,MAAM,UAAU,2CAA4C,CAAC;AACpE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,0EAA0E;AAC1E,eAAO,MAAM,cAAc,aAAa,CAAC;AACzC,eAAO,MAAM,eAAe,cAAc,CAAC;AAC3C,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAA2B,CAAC;AAE1D,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAK5D;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAS3D;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;CACN;AAED,MAAM,WAAW,mBAAmB;IAClC,CAAC,EAAE,CAAC,CAAC;IACL,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,mBAAmB,GACnB,iBAAiB,GACjB,WAAW,GACX,iBAAiB,GACjB,oBAAoB,GACpB,eAAe,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAaD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC,MAAM,CAAC,CAUlB"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/internal/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AACxC,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,eAAe,2BAA8B,CAAC;AAC3D,eAAO,MAAM,eAAe,2BAA8B,CAAC;AAE3D,eAAO,MAAM,UAAU,2CAA4C,CAAC;AACpE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,cAAc,aAAa,CAAC;AACzC,eAAO,MAAM,eAAe,cAAc,CAAC;AAC3C,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAA2B,CAAC;AAE1D,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAK5D;AAED,sEAAsE;AACtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAS3D;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;CACN;AAED,MAAM,WAAW,mBAAmB;IAClC,CAAC,EAAE,CAAC,CAAC;IACL,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,iGAAiG;AACjG,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,mBAAmB,GACnB,iBAAiB,GACjB,WAAW,GACX,iBAAiB,GACjB,oBAAoB,GACpB,eAAe,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAaD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC,MAAM,CAAC,CAUlB"}

package/dist/internal/tools.js

@@ -4,7 +4,8 @@
  * gateway's service binding and never public:
  *
  *   POST /__everyapp/tools/list  x-everyapp-system JWT (purpose "tools.list")
- *   POST /__everyapp/tools/call  x-everyapp-identity JWT, chan "mcp" + tc claim
+ *   POST /__everyapp/tools/call  x-everyapp-identity JWT, chan "mcp" or
+ *                                "agent" + tc claim
  *
  * MCP itself (protocol eras, headers, envelopes) stays in the gateway; apps
  * only ever speak this small versioned JSON shape. Both sides import the
@@ -15,7 +16,7 @@ export const TOOLS_PATH_PREFIX = "/__everyapp/tools";
 export const TOOLS_LIST_PATH = `${TOOLS_PATH_PREFIX}/list`;
 export const TOOLS_CALL_PATH = `${TOOLS_PATH_PREFIX}/call`;
 export const TOOL_RISKS = ["read", "write", "destructive"];
-/** Scopes the gateway mints on `chan: "mcp"` identities, one per risk. */
+/** Scopes the gateway mints on tool-call identities (`chan: "mcp"` or `"agent"`), one per risk. */
 export const MCP_READ_SCOPE = "mcp:read";
 export const MCP_WRITE_SCOPE = "mcp:write";
 /** Never minted in v1: destructive tools are hidden until approvals exist. */
@@ -26,7 +27,7 @@ export function isToolRisk(value) {
     return (typeof value === "string" &&
         TOOL_RISKS.includes(value));
 }
-/** The exact scope a `chan: "mcp"` identity must carry to call a tool. */
+/** The exact scope a tool-call identity must carry to call a tool. */
 export function requiredScopeForRisk(risk) {
     switch (risk) {
         case "read":