@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.11

package/dist/server/integrationFetch.js

@@ -1,33 +1,15 @@
-import { CATALOG, ConfigurationError, GATEWAY_ERROR_HEADER, INTEGRATION_PROXY_PREFIX, OAUTH_TOKEN_BODY_LIMIT, allowedScopes, apiKeyHosts, authorizationFor, capabilitySettings, carriesToken, declaredScopeSets, describeTokenEndpoints, devProviderFile, grantedScopes, injectClientCredentials, integrationProxyPath, oauthClientCredentials, oauthClientOrigin, requestedScopes, requestedTokenScopes, resolveDevProvider, rewriteTokenRequestScope, scopeExcess, tokenEndpointFor, tokenGrantType, EMAIL_SENDERS_ENV, chooseEmailProvider, parseEmailList, parseEmailSender, } from "../internal/index.js";
-import { applyAttribution, checkAttribution, } from "./attribution.js";
-import { BINDING_ORIGIN, streamingRequest, } from "./gatewayFetch.js";
-/**
- * A `fetch` for one of the gateway's capabilities. Call the provider's real
- * URLs (`https://api.dataforseo.com/v3/…`); this sends them over the
- * AppGateway binding, which checks the app's manifest lists the capability,
- * injects the key the gateway holds and forwards the call. The app never
- * sees the key. A refusal the gateway makes itself comes back as a response
- * {@link gatewayRefusal} recognizes; anything else is the provider's answer.
- *
- * For an OAuth client (`linkedin`, `mastodon`, ...) it reaches the
- * provider's token endpoints only, and the gateway puts its client on the
- * request: send the code (or refresh token) without `client_id` or
- * `client_secret`. Build the authorize URL with {@link authorizeUrl} from
- * {@link integrationStatus}, and call the provider's API with the user's
- * token directly.
- *
- * In local dev only, with no binding, the developer's own key or client
- * from `.dev.vars` reaches the provider directly, under the gateway's names:
- * a catalog provider's from the catalog, a provider registered on the
- * gateway from its spec in `.everyapp/providers/<id>.json` (`everyapp
- * provider show <id> --save` writes it), put on the call as the gateway's
- * spec says.
- */
-export function integrationFetch({ env, provider, for: target, }) {
+import { APP_ID_ENV, CATALOG, ConfigurationError, GATEWAY_ERROR_HEADER, INTEGRATION_PROXY_PREFIX, apiKeyHosts, authorizationFor, capabilitySettings, devProviderFile, integrationProxyPath, providerSettingPrefix, resolveDevProvider, EMAIL_SENDERS_ENV, chooseEmailProvider, parseEmailList, parseEmailSender, } from "../internal/index.js";
+import { applyAttribution, attributionFor, } from "./attribution.js";
+import { connectPath } from "./connectUrl.js";
+import { BINDING_ORIGIN, gatewayBinding, streamingRequest, } from "./gatewayFetch.js";
+export function integrationFetch({ env, provider, for: explicitTarget, optional = false, }) {
     const catalogEntry = fetchableCapability(provider);
-    checkAttribution(env, target, `integrationFetch("${provider}")`);
+    const what = `integrationFetch("${provider}")`;
+    // Checked now, so a call nobody's fails where the fetch is made; and
+    // again per call, where an identity may since have neared its expiry.
+    attributionFor(env, explicitTarget, what);
     const values = env;
-    const binding = values["EVERY_APP_GATEWAY"];
+    const binding = gatewayBinding(env);
     if (binding && typeof binding.fetch !== "function") {
         throw new ConfigurationError("EVERY_APP_GATEWAY is configured but is not a valid service binding.");
     }
@@ -35,11 +17,18 @@ export function integrationFetch({ env, provider, for: target, }) {
     // or in local dev, the registered row's spec `everyapp dev` hands over.
     const integration = catalogEntry ??
         (binding ? undefined : devRegisteredProvider(provider, values));
-    const local = binding || !integration ? null : localCredentials(integration, values);
-    if (!binding && !local && integration) {
+    // An API-key provider in local dev: the developer's own key. An OAuth
+    // provider decides per call (a dev token, or `integration_not_connected`).
+    const local = binding || integration?.mode !== "api_key"
+        ? null
+        : localAuthorization(integration, values);
+    if (!binding && integration?.mode === "api_key" && !local) {
+        if (optional)
+            return null;
         throw new ConfigurationError(`${integration.label} is unavailable: deploy with the EVERY_APP_GATEWAY binding, or set ${capabilitySettings(integration).join(", ")} in .dev.vars for local development.`);
     }
     return async (input, init) => {
+        const target = attributionFor(env, explicitTarget, what);
         const outbound = new Request(input, init);
         const upstream = new URL(outbound.url);
         const headers = new Headers(outbound.headers);
@@ -54,24 +43,13 @@ export function integrationFetch({ env, provider, for: target, }) {
             applyAttribution(headers, target);
             return binding.fetch(streamingRequest(`${BINDING_ORIGIN}${integrationProxyPath(provider, upstream)}`, outbound, headers));
         }
-        if (integration.mode === "oauth_client") {
-            return oauthClientCall({
-                provider: provider,
-                capability: integration,
-                outbound,
-                upstream,
-                headers,
-                values,
-                ...(binding
-                    ? { binding, target }
-                    : { client: local }),
-            });
-        }
         // In local dev a provider's host setting (`.dev.vars`) adds its host,
         // as the gateway's setting does there.
-        const hosts = binding
-            ? [...integration.hosts]
-            : apiKeyHosts(integration, values);
+        const hosts = integration.mode === "oauth_client"
+            ? [...integration.api]
+            : binding
+                ? [...integration.hosts]
+                : apiKeyHosts(integration, values);
         if (upstream.protocol !== "https:" || !hosts.includes(upstream.host)) {
             throw new TypeError(`integrationFetch("${provider}") only reaches ${hosts.join(", ")}, not ${upstream.host}.`);
         }
@@ -80,6 +58,16 @@ export function integrationFetch({ env, provider, for: target, }) {
             return binding.fetch(streamingRequest(`${BINDING_ORIGIN}${integrationProxyPath(provider, upstream)}`, outbound, headers));
         }
         applyAttribution(headers, undefined);
+        if (integration.mode === "oauth_client") {
+            return devHeldTokenCall({
+                provider,
+                capability: integration,
+                outbound,
+                upstream,
+                headers,
+                values,
+            });
+        }
         // The developer's own key, put where the provider's entry says, as the
         // gateway would put its own.
         const auth = local;
@@ -93,233 +81,100 @@ export function integrationFetch({ env, provider, for: target, }) {
     };
 }
 /**
- * The developer's own key or client from `.dev.vars` (with EVERYAPP_DEV
- * set), under the gateway's names; null until every setting it needs is.
+ * The `.dev.vars` name of a held token for `provider` in local dev
+ * (`GOOGLE_WORKSPACE_ACCESS_TOKEN`, `GITHUB_ACCESS_TOKEN`): a token the
+ * developer obtained themselves, standing in for the connection the
+ * gateway would hold. Dev-only: the gateway never reads it.
  */
-function localCredentials(integration, values) {
-    if (!values["EVERYAPP_DEV"])
-        return null;
-    if (integration.mode === "oauth_client") {
-        return oauthClientCredentials(integration, values);
-    }
-    return authorizationFor(integration, values);
+export function devAccessTokenName(provider) {
+    return `${providerSettingPrefix(provider)}ACCESS_TOKEN`;
 }
 /**
- * A call to an OAuth client's token endpoint: over the binding, where the
- * gateway puts its client on it, or in local dev straight to the provider
- * with the developer's client put on it by the gateway's own rule.
+ * Where a person connects `provider` in this app:
+ * `/connect/<id>?app=<EVERYAPP_APP_ID>`, as the gateway's refusal and
+ * status name it (without the app id when the env has none).
  */
-async function oauthClientCall({ provider, capability, outbound, upstream, headers, values, binding, target, client, }) {
-    // With the binding the gateway resolves the provider's origin (Mastodon's
-    // instance) and refuses any other, so any origin stands in for it here.
-    const settings = binding && capability.hostSetting
-        ? { [capability.hostSetting]: upstream.origin }
-        : values;
-    const endpoint = tokenEndpointFor(capability, upstream, settings);
-    const method = outbound.method.toUpperCase();
-    if (!endpoint || !endpoint.methods.includes(method)) {
-        throw new TypeError(`integrationFetch("${provider}") only reaches ${capability.label}'s token endpoints (${describeTokenEndpoints(capability)}), not ${method} ${upstream.origin}${upstream.pathname}. Call its API with the user's token directly.`);
-    }
-    if (binding) {
-        applyAttribution(headers, target);
-        return binding.fetch(streamingRequest(`${BINDING_ORIGIN}${integrationProxyPath(provider, upstream)}`, outbound, headers));
-    }
-    applyAttribution(headers, undefined);
-    // The gateway's scope checks, in its order, answering its refusals: an
-    // app sees in `everyapp dev` what the gateway will say.
-    const policy = capability.scopePolicy;
-    const grant = policy
-        ? devScopeSets(policy, provider, capability.label, values)
-        : null;
-    if (grant && "problem" in grant) {
-        return devRefusal(403, grant.code, grant.problem);
-    }
-    const sets = grant?.sets;
-    const body = method === "GET" ? null : await outbound.text();
-    if (body !== null &&
-        new TextEncoder().encode(body).byteLength > OAUTH_TOKEN_BODY_LIMIT) {
-        throw new TypeError(`A token request's body is at most ${OAUTH_TOKEN_BODY_LIMIT / 1024} KiB.`);
-    }
-    if (policy &&
-        ["grant_type", "scope", "user_scope"].some((name) => upstream.searchParams.has(name))) {
-        return devRefusal(400, "integration_body_invalid", "Put grant_type, scope and user_scope in the token request's body, not its query string; the gateway decides on the body.");
+function appConnectPath(provider, values) {
+    const app = stringValue(values[APP_ID_ENV]);
+    return app
+        ? `${connectPath(provider)}?app=${encodeURIComponent(app)}`
+        : connectPath(provider);
+}
+/**
+ * An app's call to an OAuth provider's API in local dev, with no
+ * gateway: the developer's own token from `.dev.vars` as the bearer,
+ * straight to the provider (the host was checked already), or the
+ * gateway's `integration_not_connected` refusal without one.
+ */
+async function devHeldTokenCall({ provider, capability, outbound, upstream, headers, values, }) {
+    const token = stringValue(values[devAccessTokenName(provider)]);
+    if (!token) {
+        const path = appConnectPath(provider, values);
+        return devRefusal(409, "integration_not_connected", `${capability.label} isn't connected here. In local dev, set ${devAccessTokenName(provider)} in .dev.vars to a token you obtained yourself; deployed, the person connects in the app at ${path}.`, { connectPath: path, reconnect: false });
     }
-    let injected = injectClientCredentials({ url: upstream, headers, body }, endpoint, client);
-    if (!injected.ok)
-        throw new TypeError(injected.problem);
-    if (policy && sets) {
-        const refused = refuseTokenRequest(policy, capability, sets, injected);
-        if (refused)
-            return refused;
-        injected = {
-            ok: true,
-            ...rewriteTokenRequestScope(policy, sets, injected),
-        };
+    const method = outbound.method.toUpperCase();
+    headers.set("authorization", `Bearer ${token}`);
+    for (const name of ["access_token", "token"]) {
+        upstream.searchParams.delete(name);
     }
-    const response = await fetch(new Request(injected.url, {
+    headers.delete("x-http-method-override");
+    return fetch(new Request(upstream.toString(), {
         method,
-        headers: injected.headers,
-        body: injected.body,
+        headers,
+        body: method === "GET" || method === "HEAD" ? null : outbound.body,
         signal: outbound.signal,
-        // As the gateway: the client never follows a redirect.
+        // As the gateway: the token never follows a redirect.
         redirect: "manual",
+        ...(method === "GET" || method === "HEAD" ? {} : { duplex: "half" }),
     }));
-    if (!policy || !sets || !response.ok)
-        return response;
-    return checkTokenResponse(policy, capability, sets, response);
+}
+/**
+ * The developer's own key from `.dev.vars` (with EVERYAPP_DEV set), under
+ * the gateway's names; null until every setting it needs is.
+ */
+function localAuthorization(integration, values) {
+    if (!values["EVERYAPP_DEV"])
+        return null;
+    return authorizationFor(integration, values);
 }
 /**
  * The gateway's refusal shape (`{ error, code, message }`, the code in
  * `x-everyapp-error`) from the local-dev twin, so {@link gatewayRefusal}
  * reads it the same way.
  */
-function devRefusal(status, code, message) {
-    const labels = {
-        400: "Bad Request",
-        403: "Forbidden",
-        502: "Bad Gateway",
-    };
-    return Response.json({ error: labels[status] ?? "Error", code, message }, { status, headers: { [GATEWAY_ERROR_HEADER]: code } });
+function devRefusal(status, code, message, extra = {}) {
+    const labels = { 409: "Conflict" };
+    return Response.json({ error: labels[status] ?? "Error", code, message, ...extra }, { status, headers: { [GATEWAY_ERROR_HEADER]: code } });
 }
 /**
- * The scope sets the manifest declares for `id`, read from
+ * The manifest's entry for `id` in local dev, from
  * EVERYAPP_DEV_CAPABILITIES (the manifest's `capabilities` as JSON, which
- * `everyAppWorker()` writes in dev), or the gateway's refusal, in its
- * order: the client not listed for writing (`capability_not_requested`),
- * then a void grant (`integration_scopes_undeclared`: the variable
- * missing, the entry without usable `scopes`, or a set this registry
- * doesn't offer). Fails closed like the gateway: a hand-rolled dev harness
- * that passes no capabilities gets nothing.
+ * `everyAppWorker()` writes in dev): the entry, `null` when the manifest
+ * doesn't list it, `undefined` when the variable is missing or isn't JSON
+ * (a hand-rolled harness), so nothing is known.
  */
-function devScopeSets(policy, id, label, values) {
-    const offered = Object.keys(policy.sets).join(", ");
+function devManifestEntry(id, values) {
     const raw = values["EVERYAPP_DEV_CAPABILITIES"];
+    if (typeof raw !== "string")
+        return undefined;
     let capabilities;
     try {
-        capabilities =
-            typeof raw === "string" ? jsonRecord(JSON.parse(raw)) : undefined;
+        capabilities = jsonRecord(JSON.parse(raw));
     }
     catch {
-        capabilities = undefined;
-    }
-    if (!capabilities) {
-        return {
-            code: "integration_scopes_undeclared",
-            problem: `${label}'s scope sets aren't known here: everyapp dev passes the manifest's capabilities to the Worker as EVERYAPP_DEV_CAPABILITIES when everyapp.config.ts builds it with everyAppWorker() from @every-app/sdk/cloudflare.`,
-        };
-    }
-    const entry = Object.hasOwn(capabilities, id)
-        ? jsonRecord(capabilities[id])
-        : undefined;
-    // The gateway's check 2: listing the client for writing is the grant.
-    if (entry?.["access"] !== "write") {
-        return {
-            code: "capability_not_requested",
-            problem: `This app doesn't list ${label} in its capabilities. Add capabilities: { ${JSON.stringify(id)}: { access: "write" } } to everyapp.config.ts and start everyapp dev again.`,
-        };
-    }
-    const sets = declaredScopeSets(policy, entry);
-    if (sets)
-        return { sets };
-    const listed = entry["scopes"];
-    const unknown = Array.isArray(listed)
-        ? listed.filter((name) => typeof name === "string" && !Object.hasOwn(policy.sets, name))
-        : [];
-    if (unknown.length > 0) {
-        return {
-            code: "integration_scopes_undeclared",
-            problem: `This app's ${label} entry names scope sets this SDK doesn't offer: ${unknown.join(", ")}. It offers: ${offered}. Fix everyapp.config.ts and start everyapp dev again, or update @every-app/sdk if it is older than the set.`,
-        };
+        return undefined;
     }
-    return {
-        code: "integration_scopes_undeclared",
-        problem: `This app lists ${label} without the scope sets it uses. Add scopes: [...] (one or more of: ${offered}) to its ${JSON.stringify(id)} entry in everyapp.config.ts and start everyapp dev again.`,
-    };
+    if (!capabilities)
+        return undefined;
+    return Object.hasOwn(capabilities, id)
+        ? (jsonRecord(capabilities[id]) ?? null)
+        : null;
 }
 function jsonRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
         : undefined;
 }
-/**
- * The gateway's checks on a token request before it goes out: the grant
- * type must be one the policy completes, and a `scope` the body names must
- * stay within the sets. Null when the request may go.
- */
-function refuseTokenRequest(policy, capability, sets, request) {
-    const grantType = tokenGrantType(request);
-    if (!policy.grantTypes.includes(grantType)) {
-        const completes = policy.grantTypes.map((type) => type === null ? "a code exchange without grant_type" : type);
-        const asked = grantType === null
-            ? "a request without grant_type"
-            : grantType === "other"
-                ? "this request's grant_type"
-                : grantType;
-        return devRefusal(403, "integration_grant_not_allowed", `Through the gateway, ${capability.label} completes ${completes.join(" and ")} grants only; ${asked} isn't one of them. An app never gets app-level tokens with the operator's client.`);
-    }
-    const asked = requestedTokenScopes(policy, request);
-    const excess = asked ? scopeExcess(asked, allowedScopes(policy, sets)) : [];
-    if (excess.length > 0) {
-        return devRefusal(403, "integration_scope_not_allowed", `This app may ask ${capability.label} for ${sets.join(", ")} (${requestedScopes(policy, sets).scopes.join(", ")}); the request also asks ${excess.join(", ")}. Build the authorize URL and the token request from integrationStatus().scopes.`);
-    }
-    return null;
-}
-/**
- * The gateway's check on a provider's 2xx answer: a token it carries must
- * name scopes, and those must stay within the sets; on a refusal the
- * answer is dropped, never forwarded, so no app holds a token outside its
- * grant. An answer without a token (Slack's `ok: false`) is the app's to
- * read. A non-2xx answer never reaches here.
- */
-async function checkTokenResponse(policy, capability, sets, response) {
-    const invalid = () => devRefusal(502, "integration_response_invalid", `${capability.label} answered with something that isn't a token response (over ${OAUTH_TOKEN_BODY_LIMIT / 1024} KiB or not a JSON object); nothing was passed on.`);
-    const bytes = await response.arrayBuffer();
-    if (bytes.byteLength > OAUTH_TOKEN_BODY_LIMIT)
-        return invalid();
-    const text = new TextDecoder().decode(bytes);
-    let json;
-    try {
-        json = JSON.parse(text);
-    }
-    catch {
-        return invalid();
-    }
-    if (!json || typeof json !== "object" || Array.isArray(json)) {
-        return invalid();
-    }
-    // The body was decoded on read: its length and encoding headers no
-    // longer describe it.
-    const headers = new Headers(response.headers);
-    for (const name of [
-        "set-cookie",
-        "content-length",
-        "content-encoding",
-        "transfer-encoding",
-    ]) {
-        headers.delete(name);
-    }
-    const forward = () => new Response(text, {
-        status: response.status,
-        statusText: response.statusText,
-        headers,
-    });
-    if (!carriesToken(json))
-        return forward();
-    const granted = grantedScopes(policy, json);
-    if (!granted) {
-        return devRefusal(502, "integration_scope_unverified", `${capability.label} issued a token without saying which scopes it carries, so the gateway can't hold it to this app's scope sets; nothing was passed on. Ask the person to connect again.`);
-    }
-    const excess = scopeExcess(granted, allowedScopes(policy, sets));
-    if (excess.length > 0) {
-        const remedy = {
-            google: "Ask for only the scopes integrationStatus() returns, without include_granted_scopes, and connect again; if the app needs more, add the scope set to everyapp.config.ts and deploy.",
-            microsoft: "On a shared Microsoft client a token carries everything the person consented to this client: have them remove this app's consent at https://myapplications.microsoft.com and connect again, or add the scope set to everyapp.config.ts and deploy.",
-            slack: "Slack scopes add up per workspace installation: reinstall the app in the workspace with only the status's scopes, or add the scope set to everyapp.config.ts and deploy.",
-        }[policy.dialect];
-        return devRefusal(403, "integration_scope_exceeded", `${capability.label} granted scopes this app doesn't declare: ${excess.join(", ")}. It declares ${sets.join(", ")} (${requestedScopes(policy, sets).scopes.join(", ")}). Nothing was passed on. ${remedy}`);
-    }
-    return forward();
-}
 /**
  * A provider outside the catalog in local dev (no binding): the gateway
  * row's spec from EVERYAPP_DEV_PROVIDERS (`.everyapp/providers/<id>.json`,
@@ -333,6 +188,9 @@ function devRegisteredProvider(provider, values) {
     const resolved = resolveDevProvider(values, provider);
     if (!resolved.found)
         throw new ConfigurationError(resolved.problem);
+    if (resolved.capability.mode === "ai") {
+        throw new ConfigurationError(`${provider} is an AI provider: list it under providers and call it with createGatewayFetch(), not integrationFetch().`);
+    }
     return resolved.capability;
 }
 /**
@@ -358,12 +216,64 @@ function stringValue(value) {
 /**
  * Whether the app can use an integration right now, without calling the
  * provider: show "an admin needs to set up DataForSEO" (or "sending isn't
- * set up") up front instead of failing mid-task. An OAuth client's status
- * carries its public `clientId` for the authorize URL.
+ * set up", or "connect Google") up front instead of failing mid-task. An
+ * OAuth provider's status carries the person's connection in this app and
+ * where to connect.
+ */
+export async function integrationStatus({ env, provider, for: explicitTarget, }) {
+    const status = await readIntegrationStatus({
+        env,
+        provider,
+        ...(explicitTarget === undefined ? {} : { for: explicitTarget }),
+    });
+    return withSetup(status, String(provider), env);
+}
+/**
+ * `status` with its setup fields: the Gateway's as it sent them, or in
+ * local development (no binding) the `.dev.vars` names a status that
+ * isn't configured lacks.
  */
-export async function integrationStatus({ env, provider, }) {
+function withSetup(status, provider, values) {
+    const binding = gatewayBinding(values);
+    if (binding || !status.requested || status.configured) {
+        return {
+            ...status,
+            settings: Array.isArray(status.settings) ? status.settings : [],
+            setup: typeof status.setup === "string" ? status.setup : null,
+            command: typeof status.command === "string" ? status.command : null,
+        };
+    }
+    const integration = CATALOG.get(provider) ?? devRegisteredProvider(provider, values);
+    const label = integration?.label ?? provider;
+    if (integration?.mode === "oauth_client") {
+        // In dev a token stands in for the connection; the client is the
+        // deployed gateway's alone.
+        const name = devAccessTokenName(provider);
+        return {
+            ...status,
+            settings: [name],
+            setup: `${label} isn't connected for local development: set ${name} in .dev.vars to a token you obtained yourself.`,
+            command: null,
+        };
+    }
+    const settings = provider === "email"
+        ? ["EMAIL_FROM"]
+        : integration
+            ? [...capabilitySettings(integration)]
+            : [];
+    return {
+        ...status,
+        settings,
+        setup: settings.length
+            ? `${label} isn't set up for local development: set ${settings.join(" and ")} in .dev.vars.`
+            : `${label} isn't set up for local development.`,
+        command: null,
+    };
+}
+async function readIntegrationStatus({ env, provider, for: explicitTarget, }) {
+    const target = attributionFor(env, explicitTarget, `integrationStatus("${String(provider)}")`);
     const values = env;
-    const binding = values["EVERY_APP_GATEWAY"];
+    const binding = gatewayBinding(env);
     // A provider registered on the gateway is the gateway's to answer for;
     // without one, the catalog, or in local dev the row's spec from
     // `.everyapp/providers/<id>.json`.
@@ -383,13 +293,34 @@ export async function integrationStatus({ env, provider, }) {
             senders: [],
             provider: null,
         }
-        : {
-            requested: false,
-            configured: false,
-            ready: false,
-        });
+        : integration?.mode === "oauth_client"
+            ? {
+                requested: false,
+                configured: false,
+                ready: false,
+                scopes: [],
+                connectPath: null,
+                connection: null,
+            }
+            : {
+                requested: false,
+                configured: false,
+                ready: false,
+            });
     if (binding && typeof binding.fetch === "function") {
-        const response = await binding.fetch(`${BINDING_ORIGIN}${INTEGRATION_PROXY_PREFIX}/${provider}`);
+        const statusUrl = `${BINDING_ORIGIN}${INTEGRATION_PROXY_PREFIX}/${provider}`;
+        let response;
+        if (target === undefined) {
+            response = await binding.fetch(statusUrl);
+        }
+        else {
+            // Whose status: the person's identity (their connection in this
+            // app), the member background work names, or the organization's,
+            // as a call would carry it.
+            const headers = new Headers();
+            applyAttribution(headers, target);
+            response = await binding.fetch(statusUrl, { headers });
+        }
         if (!response.ok)
             return unavailable();
         return (await response.json());
@@ -409,7 +340,7 @@ export async function integrationStatus({ env, provider, }) {
         };
     }
     if (integration.mode === "oauth_client") {
-        return devOAuthClientStatus(provider, integration, values);
+        return devOAuthStatus(String(provider), values);
     }
     const configured = Boolean(values["EVERYAPP_DEV"] && authorizationFor(integration, values));
     return {
@@ -419,48 +350,36 @@ export async function integrationStatus({ env, provider, }) {
     };
 }
 /**
- * An OAuth client in local dev, with no gateway: the developer's own, from
- * `.dev.vars`, and for a client with scope sets the manifest's, from
- * EVERYAPP_DEV_CAPABILITIES, shaped as the gateway's status is: an app
- * that doesn't list the client is told nothing, and a void grant is not
- * ready and hides the client id.
+ * An OAuth provider in local dev, with no gateway, shaped as the
+ * gateway's status is: the scopes from the manifest's entry
+ * (EVERYAPP_DEV_CAPABILITIES), and a token in `.dev.vars` standing in for
+ * a connection that holds them all. An app whose manifest doesn't list
+ * the provider is told nothing.
  */
-function devOAuthClientStatus(id, capability, values) {
-    const client = values["EVERYAPP_DEV"]
-        ? oauthClientCredentials(capability, values)
-        : null;
-    const origin = oauthClientOrigin(capability, values);
-    const policy = capability.scopePolicy;
-    const grant = policy
-        ? devScopeSets(policy, id, capability.label, values)
-        : null;
-    if (grant && "problem" in grant) {
-        if (grant.code === "capability_not_requested") {
-            return { requested: false, configured: false, ready: false };
-        }
+function devOAuthStatus(id, values) {
+    const entry = devManifestEntry(id, values);
+    if (entry === null) {
         return {
-            requested: true,
-            configured: Boolean(client),
+            requested: false,
+            configured: false,
             ready: false,
-            scopeSets: [],
+            scopes: [],
+            connectPath: null,
+            connection: null,
         };
     }
-    const asked = policy && grant ? requestedScopes(policy, grant.sets) : null;
+    const listed = entry?.["scopes"];
+    const scopes = Array.isArray(listed)
+        ? listed.filter((scope) => typeof scope === "string")
+        : [];
+    const token = Boolean(stringValue(values[devAccessTokenName(id)]));
     return {
         requested: true,
-        configured: Boolean(client),
-        ready: Boolean(client),
-        ...(client ? { clientId: client.clientId } : {}),
-        ...(client && origin ? { origin } : {}),
-        ...(client && grant && asked
-            ? {
-                scopeSets: grant.sets,
-                scopes: asked.scopes,
-                ...(asked.userScopes.length > 0
-                    ? { userScopes: asked.userScopes }
-                    : {}),
-            }
-            : {}),
+        configured: token,
+        ready: token,
+        scopes,
+        connectPath: appConnectPath(id, values),
+        connection: token ? { label: null, scopes, ready: true } : null,
     };
 }
 /**
@@ -492,35 +411,3 @@ function devEmailStatus(values) {
         provider: configured && choice.ok ? choice.provider : null,
     };
 }
-/**
- * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
- * when the gateway won't send (`email_sender_not_allowed`,
- * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
- */
-export class GatewayRefusalError extends Error {
-    status;
-    code;
-    constructor({ status, code, message }) {
-        super(message);
-        this.name = "GatewayRefusalError";
-        this.status = status;
-        this.code = code;
-    }
-}
-/**
- * The gateway's own refusal in `response`, or null when the response is the
- * provider's answer (which may be an error of its own). Reads the body only
- * for a refusal, so call it before reading the body yourself.
- */
-export async function gatewayRefusal(response) {
-    const code = response.headers.get(GATEWAY_ERROR_HEADER);
-    if (!code)
-        return null;
-    const body = await response.json().catch(() => null);
-    const message = body &&
-        typeof body === "object" &&
-        typeof body.message === "string"
-        ? body.message
-        : `The Every App gateway refused the call (${code}).`;
-    return { status: response.status, code, message };
-}

package/dist/server/listMembers.d.ts

@@ -28,5 +28,5 @@ export interface ListMembersOptions {
  * for a request answers its signed-in user alone, and background work
  * answers no one.
  */
-export declare function listMembers({ env, for: target, }: ListMembersOptions): Promise<ListMembersResult>;
+export declare function listMembers({ env, for: explicitTarget, }: ListMembersOptions): Promise<ListMembersResult>;
 //# sourceMappingURL=listMembers.d.ts.map

package/dist/server/listMembers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listMembers.d.ts","sourceRoot":"","sources":["../../src/server/listMembers.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAK1B,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,EAChC,GAAG,EACH,GAAG,EAAE,MAAM,GACZ,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoBjD"}
+{"version":3,"file":"listMembers.d.ts","sourceRoot":"","sources":["../../src/server/listMembers.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAS1B,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,EAChC,GAAG,EACH,GAAG,EAAE,cAAc,GACpB,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkBjD"}