@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.11

package/dist/server/listMembers.js

@@ -1,8 +1,8 @@
 import { ConfigurationError, serviceRoutePath, } from "../internal/index.js";
-import { applyAttribution, checkAttribution, isRequest, } from "./attribution.js";
+import { applyAttribution, attributionFor, isRequest, } from "./attribution.js";
 import { getEveryAppUser } from "./everyApp.js";
-import { BINDING_ORIGIN } from "./gatewayFetch.js";
-import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
+import { BINDING_ORIGIN, gatewayBinding, } from "./gatewayFetch.js";
+import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
 /**
  * The organization's members who can open the app now, through the
  * gateway's `members` capability: people deactivated, removed from the
@@ -19,10 +19,10 @@ import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
  * for a request answers its signed-in user alone, and background work
  * answers no one.
  */
-export async function listMembers({ env, for: target, }) {
-    checkAttribution(env, target, "listMembers");
+export async function listMembers({ env, for: explicitTarget, }) {
+    const target = attributionFor(env, explicitTarget, "listMembers");
     const values = env;
-    const binding = values["EVERY_APP_GATEWAY"];
+    const binding = gatewayBinding(env);
     if (binding) {
         if (typeof binding.fetch !== "function") {
             throw new ConfigurationError("EVERY_APP_GATEWAY is configured but is not a valid service binding.");
@@ -48,7 +48,7 @@ async function listThroughGateway(binding, target) {
         throw new GatewayRefusalError({
             status: response.status,
             code: "members_list_failed",
-            message: `The Every App gateway answered ${response.status} to the members list.`,
+            message: `The EveryApp gateway answered ${response.status} to the members list.`,
         });
     }
     return (await response.json());
@@ -64,11 +64,8 @@ async function listInDev(env, target) {
                 id: user.id,
                 email: user.email,
                 name: "",
-                role: memberRole(user.orgRole),
+                role: user.orgRole,
             },
         ],
     };
 }
-function memberRole(role) {
-    return role === "owner" || role === "admin" ? role : "member";
-}

package/dist/server/refusal.d.ts

@@ -0,0 +1,55 @@
+/** What would make it work, as the Gateway words it. */
+export interface SetupInfo {
+    /** The Gateway settings it needs (`["DATAFORSEO_API_KEY"]`); `[]` when ready or not a setting. */
+    settings: readonly string[];
+    /** One sentence for a person, naming what to set and how; null when ready. */
+    setup: string | null;
+    /** The command an admin runs (`pnpm everyapp configure crm`), or null. */
+    command: string | null;
+}
+/** A refusal the AppGateway binding made itself, not the provider. */
+export interface GatewayRefusal extends SetupInfo {
+    status: number;
+    /** e.g. `capability_not_requested`, `integration_not_configured`. */
+    code: string;
+    message: string;
+}
+/** The refusal codes that mean no model is set up for the call. */
+export declare const AI_NOT_CONFIGURED_CODES: readonly string[];
+/**
+ * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
+ * when the gateway won't send (`email_sender_not_allowed`,
+ * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
+ */
+export declare class GatewayRefusalError extends Error implements GatewayRefusal {
+    readonly status: number;
+    readonly code: string;
+    readonly settings: readonly string[];
+    readonly setup: string | null;
+    readonly command: string | null;
+    constructor({ status, code, message, settings, setup, command, }: Pick<GatewayRefusal, "status" | "code" | "message"> & Partial<SetupInfo>);
+}
+/**
+ * The gateway's own refusal in `response`, or null when the response is the
+ * provider's answer (which may be an error of its own). Reads the body only
+ * for a refusal, so call it before reading the body yourself.
+ */
+export declare function gatewayRefusal(response: Response): Promise<GatewayRefusal | null>;
+/**
+ * The Gateway's refusal behind a thrown error, or null when it isn't one:
+ * a {@link GatewayRefusalError} (`sendEmail()`, `listMembers()`, `emit()`),
+ * an OpenAI SDK `APIError` or an ai-sdk `APICallError` for a call the
+ * Gateway refused (also inside ai-sdk's `RetryError` or an error's
+ * `cause`), or the SDK's local-development `ConfigurationError` for a
+ * missing key, which answers as the deployed refusal would
+ * (`ai_provider_not_configured`, status 503, the `.dev.vars` names).
+ */
+export declare function refusalFromError(error: unknown): GatewayRefusal | null;
+/**
+ * Whether `error` (or a refusal already read) means no model is set up:
+ * `ai_provider_not_configured` or `ai_default_not_configured`, from the
+ * Gateway or, in local development, from the SDK with no key in
+ * `.dev.vars`. Show `refusalFromError(error).setup` to the person.
+ */
+export declare function isAiNotConfigured(error: unknown): boolean;
+//# sourceMappingURL=refusal.d.ts.map

package/dist/server/refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../../src/server/refusal.ts"],"names":[],"mappings":"AAgBA,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGpD,CAAC;AAEF;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,cAAc;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEpB,EACV,MAAM,EACN,IAAI,EACJ,OAAO,EACP,QAAa,EACb,KAAY,EACZ,OAAc,GACf,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAS5E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAKhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAWtE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}

package/dist/server/refusal.js

@@ -0,0 +1,193 @@
+/**
+ * The Gateway's own refusals, read the same way wherever they surface: a
+ * `Response` from a gateway fetch ({@link gatewayRefusal}), the error an
+ * SDK helper throws ({@link GatewayRefusalError}), or the error an AI
+ * client throws for a refused call (an OpenAI SDK's `APIError`, ai-sdk's
+ * `APICallError`) ({@link refusalFromError}).
+ *
+ * A refusal that means "not set up" (`integration_not_configured`,
+ * `ai_provider_not_configured`, `ai_default_not_configured`) carries what
+ * to do in the Gateway's words: `settings` (the setting names it needs),
+ * `setup` (one sentence for a person) and `command` (what an admin runs,
+ * `pnpm everyapp configure <app>`, or null). Show them as they are; never
+ * match the message text or hardcode a setting name or a command.
+ */
+import { ConfigurationError, GATEWAY_ERROR_HEADER } from "../internal/index.js";
+/** The refusal codes that mean no model is set up for the call. */
+export const AI_NOT_CONFIGURED_CODES = [
+    "ai_provider_not_configured",
+    "ai_default_not_configured",
+];
+/**
+ * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
+ * when the gateway won't send (`email_sender_not_allowed`,
+ * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
+ */
+export class GatewayRefusalError extends Error {
+    status;
+    code;
+    settings;
+    setup;
+    command;
+    constructor({ status, code, message, settings = [], setup = null, command = null, }) {
+        super(message);
+        this.name = "GatewayRefusalError";
+        this.status = status;
+        this.code = code;
+        this.settings = settings;
+        this.setup = setup;
+        this.command = command;
+    }
+}
+/**
+ * The gateway's own refusal in `response`, or null when the response is the
+ * provider's answer (which may be an error of its own). Reads the body only
+ * for a refusal, so call it before reading the body yourself.
+ */
+export async function gatewayRefusal(response) {
+    const code = response.headers.get(GATEWAY_ERROR_HEADER);
+    if (!code)
+        return null;
+    const body = await response.json().catch(() => null);
+    return refusalOf(response.status, code, body);
+}
+/**
+ * The Gateway's refusal behind a thrown error, or null when it isn't one:
+ * a {@link GatewayRefusalError} (`sendEmail()`, `listMembers()`, `emit()`),
+ * an OpenAI SDK `APIError` or an ai-sdk `APICallError` for a call the
+ * Gateway refused (also inside ai-sdk's `RetryError` or an error's
+ * `cause`), or the SDK's local-development `ConfigurationError` for a
+ * missing key, which answers as the deployed refusal would
+ * (`ai_provider_not_configured`, status 503, the `.dev.vars` names).
+ */
+export function refusalFromError(error) {
+    const seen = new Set();
+    let current = error;
+    while (current && typeof current === "object" && !seen.has(current)) {
+        seen.add(current);
+        const found = refusalHere(current);
+        if (found)
+            return found;
+        const record = current;
+        current = record["lastError"] ?? record["cause"];
+    }
+    return null;
+}
+/**
+ * Whether `error` (or a refusal already read) means no model is set up:
+ * `ai_provider_not_configured` or `ai_default_not_configured`, from the
+ * Gateway or, in local development, from the SDK with no key in
+ * `.dev.vars`. Show `refusalFromError(error).setup` to the person.
+ */
+export function isAiNotConfigured(error) {
+    const refusal = isRefusal(error) ? error : refusalFromError(error);
+    return refusal !== null && AI_NOT_CONFIGURED_CODES.includes(refusal.code);
+}
+function isRefusal(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        !(value instanceof Error) &&
+        typeof value.code === "string" &&
+        typeof value.status === "number");
+}
+function refusalHere(error) {
+    // A Response is read with gatewayRefusal(), which can read its body.
+    if (error instanceof Response)
+        return null;
+    if (error instanceof GatewayRefusalError) {
+        return {
+            status: error.status,
+            code: error.code,
+            message: error.message,
+            settings: error.settings,
+            setup: error.setup,
+            command: error.command,
+        };
+    }
+    if (error instanceof ConfigurationError) {
+        if (!error.code)
+            return null;
+        return {
+            status: 503,
+            code: error.code,
+            message: error.message,
+            settings: error.settings,
+            setup: error.message,
+            command: null,
+        };
+    }
+    const record = error;
+    // ai-sdk's APICallError: lowercase header names, the body as text.
+    const responseHeaders = record["responseHeaders"];
+    if (responseHeaders && typeof responseHeaders === "object") {
+        const code = headerOf(responseHeaders, GATEWAY_ERROR_HEADER);
+        if (!code)
+            return null;
+        return refusalOf(numberOf(record["statusCode"]), code, parseJson(record["responseBody"]), messageOf(error));
+    }
+    // An OpenAI SDK APIError: `headers` (Headers or a record), `status`,
+    // and `error`, the body's `error` object (which carries the same fields).
+    const headers = record["headers"];
+    if (headers && typeof headers === "object" && "status" in record) {
+        const code = headerOf(headers, GATEWAY_ERROR_HEADER);
+        if (!code)
+            return null;
+        return refusalOf(numberOf(record["status"]), code, record["error"], messageOf(error));
+    }
+    return null;
+}
+/** A refusal from its status, code and body (the Gateway's `{ code, message, … }`, or OpenAI's `{ error: {…} }`). */
+function refusalOf(status, code, body, fallback) {
+    const top = recordOf(body);
+    const inner = recordOf(top?.["error"]);
+    const field = (name) => top?.[name] ?? inner?.[name];
+    const message = stringOf(top?.["message"]) ??
+        stringOf(inner?.["message"]) ??
+        fallback ??
+        `The EveryApp gateway refused the call (${code}).`;
+    const settings = field("settings");
+    return {
+        status,
+        code,
+        message,
+        settings: Array.isArray(settings)
+            ? settings.filter((name) => typeof name === "string")
+            : [],
+        setup: stringOf(field("setup")) ?? null,
+        command: stringOf(field("command")) ?? null,
+    };
+}
+function headerOf(headers, name) {
+    if (typeof headers.get === "function") {
+        return headers.get(name);
+    }
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === name && typeof value === "string")
+            return value;
+    }
+    return null;
+}
+function recordOf(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function stringOf(value) {
+    return typeof value === "string" && value ? value : undefined;
+}
+function numberOf(value) {
+    return typeof value === "number" ? value : 0;
+}
+function parseJson(value) {
+    if (typeof value !== "string")
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function messageOf(error) {
+    return error instanceof Error && error.message ? error.message : undefined;
+}

package/dist/server/sendEmail.d.ts

@@ -35,5 +35,5 @@ export interface SendEmailOptions {
  * `.dev.vars` it goes out for real through Email Sending's REST API, from
  * the developer's own account.
  */
-export declare function sendEmail({ env, for: target, message, }: SendEmailOptions): Promise<SendEmailResult>;
+export declare function sendEmail({ env, for: explicitTarget, message, }: SendEmailOptions): Promise<SendEmailResult>;
 //# sourceMappingURL=sendEmail.d.ts.map

package/dist/server/sendEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sendEmail.d.ts","sourceRoot":"","sources":["../../src/server/sendEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,GAAG,EACH,GAAG,EAAE,MAAM,EACX,OAAO,GACR,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoB7C"}
+{"version":3,"file":"sendEmail.d.ts","sourceRoot":"","sources":["../../src/server/sendEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAQ1B,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,GAAG,EACH,GAAG,EAAE,cAAc,EACnB,OAAO,GACR,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB7C"}

package/dist/server/sendEmail.js

@@ -1,7 +1,7 @@
 import { ConfigurationError, EMAIL_SENDERS_ENV, emailDomain, emailProviderRefusal, emailRestBody, emailRestUrl, emailSenderRefusal, parseEmailList, parseEmailSender, parseSendEmailMessage, readEmailRestResponse, senderAllowed, serviceRoutePath, } from "../internal/index.js";
-import { applyAttribution, checkAttribution, } from "./attribution.js";
-import { BINDING_ORIGIN } from "./gatewayFetch.js";
-import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
+import { applyAttribution, attributionFor, } from "./attribution.js";
+import { BINDING_ORIGIN, gatewayBinding, } from "./gatewayFetch.js";
+import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
 /**
  * Send an email through the gateway's `email` capability: its sender
  * (EMAIL_FROM) unless `message.from` names an address the installation's
@@ -19,10 +19,10 @@ import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
  * `.dev.vars` it goes out for real through Email Sending's REST API, from
  * the developer's own account.
  */
-export async function sendEmail({ env, for: target, message, }) {
-    checkAttribution(env, target, "sendEmail");
+export async function sendEmail({ env, for: explicitTarget, message, }) {
+    const target = attributionFor(env, explicitTarget, "sendEmail");
     const values = env;
-    const binding = values["EVERY_APP_GATEWAY"];
+    const binding = gatewayBinding(env);
     if (binding) {
         if (typeof binding.fetch !== "function") {
             throw new ConfigurationError("EVERY_APP_GATEWAY is configured but is not a valid service binding.");
@@ -49,7 +49,7 @@ async function sendThroughGateway(binding, target, message) {
         throw new GatewayRefusalError({
             status: response.status,
             code: "email_send_failed",
-            message: `The Every App gateway answered ${response.status} to the send.`,
+            message: `The EveryApp gateway answered ${response.status} to the send.`,
         });
     }
     return (await response.json());

package/dist/server/tools.d.ts

@@ -17,7 +17,8 @@
  *
  * Apps never speak MCP. The gateway snapshots this catalog at deploy, serves
  * MCP clients from the snapshot, and calls a tool over the internal tools
- * contract (../internal/tools.ts) with a verified `chan: "mcp"` identity.
+ * contract (../internal/tools.ts) with a verified `chan: "mcp"` or
+ * `chan: "agent"` identity.
  *
  * `input` and `output` accept any validator implementing Standard Schema and
  * Standard JSON Schema (zod >= 4.2 does both), or a plain
@@ -81,7 +82,11 @@ export interface PlainToolSchema<Output = unknown> {
 export type ToolSchema<Output = unknown> = StandardSchemaWithJSON<unknown, Output> | PlainToolSchema<Output>;
 /** What a tool handler receives besides its validated input. */
 export interface ToolContext<TEnv = Cloudflare.Env> {
-    /** The verified caller. `channel` is "mcp"; `toolCall` names this call. */
+    /**
+     * The verified caller. `channel` is "mcp" (an AI client) or "agent" (an
+     * agent principal: `isAgentCall(user)`, `actor.sub` `agent:<id>`, `id`
+     * its sponsor); `toolCall` names this call.
+     */
     user: EveryAppUser;
     env: TEnv;
     ctx: ExecutionContextLike;

package/dist/server/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/server/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,4DAA4D;AAC5D,eAAO,MAAM,WAAW,UAAU,CAAC;AASnC;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAID,KAAK,mBAAmB,GAAG,WAAW,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvE,UAAU,aAAa;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;CAChE;AAED,KAAK,cAAc,CAAC,MAAM,IACtB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAAE,CAAC;AAEtD,UAAU,mBAAmB,CAAC,KAAK,EAAE,MAAM;IACzC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAC5D,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,CAAC,EACX;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAClD,SAAS,CAAC;CACf;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;IACrE,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG;QACzD,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;KAClD,CAAC;CACH;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe,CAAC,MAAM,GAAG,OAAO;IAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CACN,KAAK,EAAE,OAAO,GACb,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;CAC7D;AAED,MAAM,MAAM,UAAU,CAAC,MAAM,GAAG,OAAO,IACnC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,GACvC,eAAe,CAAC,MAAM,CAAC,CAAC;AAE5B,gEAAgE;AAChE,MAAM,WAAW,WAAW,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG;IAChD,2EAA2E;IAC3E,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,oBAAoB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC9C,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;CAC3D;AAED,QAAA,MAAM,WAAW,eAAoC,CAAC;AAEtD,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GAAG,UAAU,CAMb;AAQD,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,UAAU,gBAAgB;IACxB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC/C,uDAAuD;IACvD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACjC;AAID,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAMnE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,KAAK,EAAE;KAAG,CAAC,IAAI,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CAAE,EAC3D,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CA+BT;AA+ND,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAEzC,qCAAqC;AACrC,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQ/B;AAiBD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CAuC3B"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/server/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,4DAA4D;AAC5D,eAAO,MAAM,WAAW,UAAU,CAAC;AASnC;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAID,KAAK,mBAAmB,GAAG,WAAW,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvE,UAAU,aAAa;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;CAChE;AAED,KAAK,cAAc,CAAC,MAAM,IACtB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAAE,CAAC;AAEtD,UAAU,mBAAmB,CAAC,KAAK,EAAE,MAAM;IACzC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAC5D,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,CAAC,EACX;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAClD,SAAS,CAAC;CACf;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;IACrE,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG;QACzD,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;KAClD,CAAC;CACH;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe,CAAC,MAAM,GAAG,OAAO;IAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CACN,KAAK,EAAE,OAAO,GACb,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;CAC7D;AAED,MAAM,MAAM,UAAU,CAAC,MAAM,GAAG,OAAO,IACnC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,GACvC,eAAe,CAAC,MAAM,CAAC,CAAC;AAE5B,gEAAgE;AAChE,MAAM,WAAW,WAAW,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG;IAChD;;;;OAIG;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,oBAAoB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC9C,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;CAC3D;AAED,QAAA,MAAM,WAAW,eAAoC,CAAC;AAEtD,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GAAG,UAAU,CAMb;AAQD,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,UAAU,gBAAgB;IACxB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC/C,uDAAuD;IACvD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACjC;AAID,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAMnE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,KAAK,EAAE;KAAG,CAAC,IAAI,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CAAE,EAC3D,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CA+BT;AA+ND,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAEzC,qCAAqC;AACrC,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQ/B;AAiBD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CAuC3B"}

package/dist/server/tools.js

@@ -17,7 +17,8 @@
  *
  * Apps never speak MCP. The gateway snapshots this catalog at deploy, serves
  * MCP clients from the snapshot, and calls a tool over the internal tools
- * contract (../internal/tools.ts) with a verified `chan: "mcp"` identity.
+ * contract (../internal/tools.ts) with a verified `chan: "mcp"` or
+ * `chan: "agent"` identity.
  *
  * `input` and `output` accept any validator implementing Standard Schema and
  * Standard JSON Schema (zod >= 4.2 does both), or a plain

package/dist/server/toolsEndpoint.d.ts

@@ -7,7 +7,9 @@
  *  - `/__everyapp/tools/list` needs the gateway's system token for this app
  *    (purpose "tools.list"). It describes tools; it never runs them.
  *  - `/__everyapp/tools/call` needs an identity token minted for this exact
- *    call: `chan: "mcp"` plus a `tc` claim naming the tool and call id. The
+ *    call: `chan: "mcp"` (an AI client's MCP connection) or `chan: "agent"`
+ *    (an agent principal, `act.sub` `agent:<id>`, with its sponsor as `sub`),
+ *    plus a `tc` claim naming the tool and call id. The
  *    token's scopes must include the scope the tool's risk requires; `*` does
  *    not count, because the ToolBus only ever mints explicit scopes.
  *

package/dist/server/toolsEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolsEndpoint.d.ts","sourceRoot":"","sources":["../../src/server/toolsEndpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAcL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAoFD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B"}
+{"version":3,"file":"toolsEndpoint.d.ts","sourceRoot":"","sources":["../../src/server/toolsEndpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAgBL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAoFD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B"}

package/dist/server/toolsEndpoint.js

@@ -7,14 +7,17 @@
  *  - `/__everyapp/tools/list` needs the gateway's system token for this app
  *    (purpose "tools.list"). It describes tools; it never runs them.
  *  - `/__everyapp/tools/call` needs an identity token minted for this exact
- *    call: `chan: "mcp"` plus a `tc` claim naming the tool and call id. The
+ *    call: `chan: "mcp"` (an AI client's MCP connection) or `chan: "agent"`
+ *    (an agent principal, `act.sub` `agent:<id>`, with its sponsor as `sub`),
+ *    plus a `tc` claim naming the tool and call id. The
  *    token's scopes must include the scope the tool's risk requires; `*` does
  *    not count, because the ToolBus only ever mints explicit scopes.
  *
  * The perimeter also refuses these paths from outside and strips inbound
  * `x-everyapp-*` headers, so only the gateway's ToolBus ever reaches them.
  */
-import { ConfigurationError, IDENTITY_HEADER, IdentityError, SYSTEM_HEADER, TOOLS_CALL_PATH, TOOLS_LIST_PATH, TOOLS_PROTOCOL_VERSION, catalogHash, requiredScopeForRisk, resolveVerifyOptions, verifyIdentityJwt, verifySystemJwt, } from "../internal/index.js";
+import { ConfigurationError, IDENTITY_HEADER, IdentityError, SYSTEM_HEADER, TOOL_CALL_CHANNELS, TOOLS_CALL_PATH, TOOLS_LIST_PATH, TOOLS_PROTOCOL_VERSION, assertOrganizationPin, catalogHash, isAgentCall, requiredScopeForRisk, resolveVerifyOptions, verifyIdentity, verifySystemJwt, } from "../internal/index.js";
+import { serveRequest } from "./context.js";
 import { SDK_VERSION, ToolError, toToolResult, toolSetInternals, validateWithSchema, } from "./tools.js";
 function toolsJson(status, body, headers = {}) {
     return Response.json(body, {
@@ -148,9 +151,12 @@ function parseCallRequest(body) {
     return { v: TOOLS_PROTOCOL_VERSION, name, arguments: args, callId };
 }
 async function callTool(request, env, ctx, verify, options) {
-    let user;
+    let user, expiresAt;
     try {
-        user = await verifyIdentityJwt(request.headers.get(IDENTITY_HEADER) ?? "", verify);
+        ({ user, expiresAt } = await verifyIdentity(request.headers.get(IDENTITY_HEADER) ?? "", verify));
+        // The same pin as the handler path: a call for another organization's
+        // install never runs a tool here.
+        assertOrganizationPin(user, options.identity.organizationId);
     }
     catch (error) {
         if (error instanceof IdentityError) {
@@ -158,7 +164,11 @@ async function callTool(request, env, ctx, verify, options) {
         }
         throw error;
     }
-    if (user.channel !== "mcp" || !user.toolCall) {
+    if (!TOOL_CALL_CHANNELS.includes(user.channel) ||
+        !user.toolCall ||
+        // An agent call names its agent; a `chan: "agent"` token without one
+        // is not something the ToolBus mints.
+        (user.channel === "agent" && !isAgentCall(user))) {
         return toolsError(403, "forbidden", "Tool calls need an identity the gateway minted for this call.");
     }
     const call = parseCallRequest(await readJsonBody(request));
@@ -194,13 +204,15 @@ async function callTool(request, env, ctx, verify, options) {
     });
     let result;
     try {
-        const value = await tool.handler(input.value, {
+        // The call runs in the request context like a page would: currentUser()
+        // is the caller, and its Gateway calls are attributed to them.
+        const value = await serveRequest({ request, user, expiresAt }, () => tool.handler(input.value, {
             user,
             env: env,
             ctx,
             request,
             callId: call.callId,
-        });
+        }));
         result = await toToolResult(tool, value);
     }
     catch (error) {

package/dist/server/webhooks.d.ts

@@ -0,0 +1,56 @@
+export type WebhookProvider = "slack" | "github" | "everyapp";
+export interface VerifyWebhookOptions {
+    provider: WebhookProvider;
+    /** The signing secret, or several while one rotates. Empty ones are ignored. */
+    secret: string | readonly string[];
+    /** How far a signed timestamp may be from now (Slack, EveryApp). Default 300 s. */
+    toleranceSeconds?: number;
+    /** The largest body read before giving up. Default 5 MiB. */
+    maxBytes?: number;
+    /** The clock, for tests. */
+    now?: Date;
+}
+export type WebhookRefusalReason = 
+/** No usable secret was passed: a configuration fault, never the sender's. */
+"no_secret"
+/** The provider's signature header is absent. */
+ | "missing_signature"
+/** A signature or timestamp header that isn't the provider's shape. */
+ | "malformed"
+/** The signed timestamp is outside the tolerance. */
+ | "expired"
+/** The body is larger than `maxBytes`. */
+ | "too_large"
+/** The body was already read, or its stream failed mid-read. */
+ | "unreadable"
+/** No secret verifies the signature. */
+ | "mismatch";
+export type WebhookVerification = {
+    ok: true;
+    /** The body exactly as signed. The request's own body is consumed: parse this. */
+    body: string;
+    /** The provider's id for this delivery, for deduplication; null when it sends none. */
+    deliveryId: string | null;
+    /** The signed timestamp in seconds; null for GitHub, which signs none. */
+    timestamp: number | null;
+} | {
+    ok: false;
+    reason: WebhookRefusalReason;
+};
+/** The default body limit: well above Slack's payloads and most of GitHub's (whose cap is 25 MB). */
+export declare const WEBHOOK_MAX_BYTES_DEFAULT: number;
+/**
+ * Verify `request` as a `provider` webhook signed with `secret`. Reads the
+ * body (at most `maxBytes`) and returns it on success; never throws for a
+ * bad delivery, so a handler answers `401` on `{ ok: false }`. Throws a
+ * `TypeError` only for a programming error: an unknown `provider`, or a
+ * `toleranceSeconds` or `maxBytes` that is negative, NaN or infinite.
+ *
+ * ```ts
+ * const check = await verifyWebhook(request, { provider: "slack", secret: env.SLACK_SIGNING_SECRET });
+ * if (!check.ok) return new Response(null, { status: 401 });
+ * const params = new URLSearchParams(check.body);
+ * ```
+ */
+export declare function verifyWebhook(request: Request, options: VerifyWebhookOptions): Promise<WebhookVerification>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/server/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/server/webhooks.ts"],"names":[],"mappings":"AAiCA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,eAAe,CAAC;IAC1B,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACnC,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,oBAAoB;AAC9B,8EAA8E;AAC5E,WAAW;AACb,iDAAiD;GAC/C,mBAAmB;AACrB,uEAAuE;GACrE,WAAW;AACb,qDAAqD;GACnD,SAAS;AACX,0CAA0C;GACxC,WAAW;AACb,gEAAgE;GAC9D,YAAY;AACd,wCAAwC;GACtC,UAAU,CAAC;AAEf,MAAM,MAAM,mBAAmB,GAC3B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEhD,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,QAAkB,CAAC;AAMzD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B"}