@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.2

package/dist/internal/providerSpec.js

@@ -26,7 +26,12 @@ const SEGMENT = /^[a-z0-9_-]{1,64}$/;
 const HEADER_NAME = /^[A-Za-z0-9-]{1,64}$/;
 const QUERY_PARAM = /^[A-Za-z0-9_.-]{1,64}$/;
 const SCHEME = /^[A-Za-z][A-Za-z0-9-]{0,31}$/;
-const RESPONSE_FIELD = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+/**
+ * A JSON field name, or a dotted path to a nested one (`usage.cost`, at
+ * most four segments): the capability proxy reads a top-level name off the
+ * answer's head, the AI proxy a path into the usage object off its tail.
+ */
+const RESPONSE_FIELD = /^[A-Za-z_][A-Za-z0-9_]{0,63}(?:\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/;
 const DATE = /^\d{4}-\d{2}-\d{2}$/;
 const TAG = /^[a-z][a-z0-9-]{0,31}$/;
 /** Control and format characters: in no text a spec carries. */
@@ -475,11 +480,11 @@ function cost(value, problems) {
     }
     const usd = nonNegative(value["usd"], "cost.usd", problems);
     const note = text(value["note"], "cost.note", problems, { max: 200 });
-    const responseField = text(value["responseField"], "cost.responseField", problems, { max: 64 });
+    const responseField = text(value["responseField"], "cost.responseField", problems, { max: 128 });
     if (responseField !== undefined && !RESPONSE_FIELD.test(responseField)) {
         problems.push({
             path: "cost.responseField",
-            message: "must be a JSON field name",
+            message: "must be a JSON field name, or a dotted path to a nested one",
         });
     }
     if (unit !== "call" && unit !== "result" && unit !== "token")
@@ -635,8 +640,15 @@ export function parseProviderSpec(input) {
         problems.push({ path: "access", message: "must list read, write or both" });
     }
     const readMethods = methods(input["readMethods"], "readMethods", problems);
-    if (readMethods && readMethods.length === 0) {
-        problems.push({ path: "readMethods", message: "must list a method" });
+    // A write-only provider (a sender, a GraphQL API) reads with nothing:
+    // every call needs the write grant. Anything that offers read lists how.
+    if (readMethods &&
+        readMethods.length === 0 &&
+        (!Array.isArray(access) || access.includes("read"))) {
+        problems.push({
+            path: "readMethods",
+            message: "must list a method unless access is write alone",
+        });
     }
     const writeMethods = methods(input["writeMethods"], "writeMethods", problems);
     const paths = accountWidePaths(input["accountWidePaths"], problems);

package/dist/internal/signInProviders.d.ts

@@ -0,0 +1,104 @@
+/**
+ * The sign-in providers a Gateway can offer beside passwords ("Continue
+ * with Google"), as data: what each one is called, the Worker secrets it
+ * reads, where the OAuth app is made, the scopes asked for and which claim
+ * becomes the email. One catalog serves the Gateway (which providers are
+ * on, the sign-in page's buttons, Manage workspace → Sign-in), the CLI
+ * (`everyapp signin add|list|show|remove`, `secret set`), the manifest
+ * validator (an app's own secret can never take one of these names) and
+ * the docs' drift tests.
+ *
+ * Naming rule, agreed with the provider registry's conventions
+ * (docs/design/2026-10-provider-registry.md, section 6): a sign-in
+ * provider's settings are `<ID>_SIGNIN_<FIELD>`, with FIELD one of
+ * CLIENT_ID, CLIENT_SECRET, ISSUER, LABEL or TENANT. The `_SIGNIN_` infix is
+ * what keeps the family apart from the API providers' `<ID>_API_KEY`,
+ * `<ID>_CLIENT_ID` (the OAuth clients the Gateway holds for apps) and the
+ * MCP apps' `<ID>_MCP_TOKEN`: `GOOGLE_SIGNIN_CLIENT_ID` is the sign-in
+ * provider's, `GOOGLE_WORKSPACE_CLIENT_ID` the OAuth client apps use, and
+ * a registered provider row or an app manifest can never claim a name in
+ * the family (isSignInSettingName).
+ *
+ * The settings are Worker secrets, set under the Cloudflare login (`everyapp
+ * signin add`, or `secret set`), never from the admin UI or an agent
+ * connection: a stolen session can't add a way in.
+ */
+export declare const SIGN_IN_PROVIDER_IDS: readonly ["google", "microsoft", "github", "apple", "cloudflare", "oidc"];
+export type SignInProviderId = (typeof SIGN_IN_PROVIDER_IDS)[number];
+/** What a setting of a sign-in provider holds. */
+export type SignInSettingRole = "clientId" | "clientSecret" | "issuer" | "label" | "tenant";
+export interface SignInSetting {
+    /** `GOOGLE_SIGNIN_CLIENT_ID`. */
+    readonly name: string;
+    readonly role: SignInSettingRole;
+    /** Without it the provider is off (an incomplete set is reported). */
+    readonly required: boolean;
+    /**
+     * A plain value (an id, a URL, a word) `everyapp secret set` may show as
+     * typed; a credential stays hidden.
+     */
+    readonly plain: boolean;
+    /** One line: what to paste here. */
+    readonly what: string;
+}
+export interface SignInProvider {
+    readonly id: SignInProviderId;
+    /** The button: "Continue with <label>". The `oidc` entry's label is a setting. */
+    readonly label: string;
+    /** Where the OAuth app is created. */
+    readonly console: string;
+    /** What the OAuth app is called there ("OAuth client ID", "App registration"). */
+    readonly appNoun: string;
+    readonly settings: readonly SignInSetting[];
+    /** The scopes requested: identity only, nothing an app could act with. */
+    readonly scopes: readonly string[];
+    /** Which claim becomes the email, and what makes it count as verified. */
+    readonly emailClaim: string;
+    /** The everyapp skill's setup guide, relative to the skill. */
+    readonly setup: `setup/signin-${SignInProviderId}.md`;
+    /** Caveats worth a line in every listing. */
+    readonly notes: readonly string[];
+}
+/** The path Better Auth serves the provider's callback on, under the Gateway's URL. */
+export declare function signInCallbackPath(id: SignInProviderId): string;
+/** The redirect URL to register with the provider, for a Gateway at `gatewayUrl`. */
+export declare function signInCallbackUrl(gatewayUrl: string, id: SignInProviderId): string;
+export declare const SIGN_IN_PROVIDERS: Readonly<Record<SignInProviderId, SignInProvider>>;
+/** The catalog in listing order. */
+export declare const SIGN_IN_PROVIDER_LIST: readonly SignInProvider[];
+export declare function isSignInProviderId(value: string): value is SignInProviderId;
+/**
+ * Every setting a sign-in provider reads, in catalog order: what `everyapp
+ * secret set` accepts for the Gateway, and what the Gateway's dev config
+ * declares.
+ */
+export declare const SIGN_IN_GATEWAY_SETTINGS: readonly string[];
+/** The plain (non-credential) ones among them: ids, the issuer, the label, the tenant. */
+export declare const PLAIN_SIGN_IN_SETTINGS: readonly string[];
+/**
+ * The family: any name of the shape `<ID>_SIGNIN_<FIELD>`. Reserved for the
+ * catalog above, whether or not an entry reads the name today, so no
+ * registered provider row and no app manifest can ever take one.
+ */
+export declare const SIGN_IN_SETTING_PATTERN: RegExp;
+export declare function isSignInSettingName(name: string): boolean;
+/** The provider a setting belongs to, if one reads it. */
+export declare function signInProviderOfSetting(name: string): SignInProvider | null;
+/** Whether a provider is on, off, or half set up, from which names are set. */
+export type SignInProviderStatus = "on" | "off" | "incomplete";
+export interface SignInProviderState {
+    readonly id: SignInProviderId;
+    readonly status: SignInProviderStatus;
+    /** The required settings not set (empty when on or off). */
+    readonly missing: readonly string[];
+    /** The settings set, required or not. */
+    readonly set: readonly string[];
+}
+/**
+ * A provider's state from which of its settings exist: on when every
+ * required one is set, off when none at all is, incomplete in between (the
+ * Gateway refuses to half-configure a sign-in: the provider is off and the
+ * problem is reported).
+ */
+export declare function signInProviderState(provider: SignInProvider, isSet: (name: string) => boolean): SignInProviderState;
+//# sourceMappingURL=signInProviders.d.ts.map

package/dist/internal/signInProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInProviders.d.ts","sourceRoot":"","sources":["../../src/internal/signInProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,eAAO,MAAM,oBAAoB,2EAOvB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,cAAc,GACd,QAAQ,GACR,OAAO,GACP,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,gBAAgB,gBAAgB,KAAK,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,GAAG,MAAM,CAE/D;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,gBAAgB,GACnB,MAAM,CAER;AA8BD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CACtC,MAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAyIzC,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,qBAAqB,EAAE,SAAS,cAAc,EACF,CAAC;AAE1D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,gBAAgB,CAE3E;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGnD,CAAC;AAEJ,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAKjD,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QACsC,CAAC;AAE3E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,0DAA0D;AAC1D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAO3E;AAED,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,KAAK,GAAG,YAAY,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,yCAAyC;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,mBAAmB,CAUrB"}

package/dist/internal/signInProviders.js

@@ -0,0 +1,238 @@
+/**
+ * The sign-in providers a Gateway can offer beside passwords ("Continue
+ * with Google"), as data: what each one is called, the Worker secrets it
+ * reads, where the OAuth app is made, the scopes asked for and which claim
+ * becomes the email. One catalog serves the Gateway (which providers are
+ * on, the sign-in page's buttons, Manage workspace → Sign-in), the CLI
+ * (`everyapp signin add|list|show|remove`, `secret set`), the manifest
+ * validator (an app's own secret can never take one of these names) and
+ * the docs' drift tests.
+ *
+ * Naming rule, agreed with the provider registry's conventions
+ * (docs/design/2026-10-provider-registry.md, section 6): a sign-in
+ * provider's settings are `<ID>_SIGNIN_<FIELD>`, with FIELD one of
+ * CLIENT_ID, CLIENT_SECRET, ISSUER, LABEL or TENANT. The `_SIGNIN_` infix is
+ * what keeps the family apart from the API providers' `<ID>_API_KEY`,
+ * `<ID>_CLIENT_ID` (the OAuth clients the Gateway holds for apps) and the
+ * MCP apps' `<ID>_MCP_TOKEN`: `GOOGLE_SIGNIN_CLIENT_ID` is the sign-in
+ * provider's, `GOOGLE_WORKSPACE_CLIENT_ID` the OAuth client apps use, and
+ * a registered provider row or an app manifest can never claim a name in
+ * the family (isSignInSettingName).
+ *
+ * The settings are Worker secrets, set under the Cloudflare login (`everyapp
+ * signin add`, or `secret set`), never from the admin UI or an agent
+ * connection: a stolen session can't add a way in.
+ */
+export const SIGN_IN_PROVIDER_IDS = [
+    "google",
+    "microsoft",
+    "github",
+    "apple",
+    "cloudflare",
+    "oidc",
+];
+/** The path Better Auth serves the provider's callback on, under the Gateway's URL. */
+export function signInCallbackPath(id) {
+    return `/api/auth/callback/${id}`;
+}
+/** The redirect URL to register with the provider, for a Gateway at `gatewayUrl`. */
+export function signInCallbackUrl(gatewayUrl, id) {
+    return `${gatewayUrl.replace(/\/+$/, "")}${signInCallbackPath(id)}`;
+}
+function settingName(id, field) {
+    return `${id.toUpperCase()}_SIGNIN_${field}`;
+}
+function clientPair(id, what) {
+    return [
+        {
+            name: settingName(id, "CLIENT_ID"),
+            role: "clientId",
+            required: true,
+            plain: true,
+            what: what.clientId,
+        },
+        {
+            name: settingName(id, "CLIENT_SECRET"),
+            role: "clientSecret",
+            required: true,
+            plain: false,
+            what: what.clientSecret,
+        },
+    ];
+}
+const IDENTITY_SCOPES = ["openid", "email", "profile"];
+export const SIGN_IN_PROVIDERS = {
+    google: {
+        id: "google",
+        label: "Google",
+        console: "https://console.cloud.google.com/apis/credentials",
+        appNoun: "OAuth client ID (Web application)",
+        settings: clientPair("google", {
+            clientId: "The OAuth client's Client ID (ends in .apps.googleusercontent.com)",
+            clientSecret: "The OAuth client's Client secret",
+        }),
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email`, counted as verified only when its `email_verified` is true (every Google account's own address is)",
+        setup: "setup/signin-google.md",
+        notes: [
+            "An OAuth consent screen still in Testing only signs in the test users listed on it; publish it for everyone else.",
+        ],
+    },
+    microsoft: {
+        id: "microsoft",
+        label: "Microsoft",
+        console: "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+        appNoun: "App registration",
+        settings: [
+            ...clientPair("microsoft", {
+                clientId: "The app registration's Application (client) ID",
+                clientSecret: "A client secret from Certificates & secrets (it expires; 24 months at most)",
+            }),
+            {
+                name: settingName("microsoft", "TENANT"),
+                role: "tenant",
+                required: false,
+                plain: true,
+                what: "The Directory (tenant) ID to pin sign-in to your own directory; unset means any Microsoft account (common), which then needs the xms_edov claim",
+            },
+        ],
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email`, counted as verified when MICROSOFT_SIGNIN_TENANT pins your own directory, or the token carries `xms_edov: true` (the optional claim that says the domain's owner verified it), `email_verified: true`, a matching `verified_primary_email`, or comes from a personal Microsoft account",
+        setup: "setup/signin-microsoft.md",
+        notes: [
+            "Without MICROSOFT_SIGNIN_TENANT, add the optional claims `email` and `xms_edov` under Token configuration, or every sign-in is refused as unverified: any tenant's admin can put any address on their users.",
+        ],
+    },
+    github: {
+        id: "github",
+        label: "GitHub",
+        console: "https://github.com/settings/developers",
+        appNoun: "OAuth App",
+        settings: clientPair("github", {
+            clientId: "The OAuth App's Client ID",
+            clientSecret: "A client secret generated on the OAuth App",
+        }),
+        scopes: ["read:user", "user:email"],
+        emailClaim: "the primary address from GitHub's emails API, counted as verified only when GitHub marks it verified",
+        setup: "setup/signin-github.md",
+        notes: [
+            "GitHub Apps are something else: make an OAuth App (Settings → Developer settings → OAuth Apps).",
+        ],
+    },
+    apple: {
+        id: "apple",
+        label: "Apple",
+        console: "https://developer.apple.com/account/resources/identifiers/list/serviceId",
+        appNoun: "Services ID",
+        settings: clientPair("apple", {
+            clientId: "The Services ID's identifier (com.example.gateway)",
+            clientSecret: "The client secret JWT you generate from your Sign in with Apple key (ES256; valid six months at most, then generate it again)",
+        }),
+        scopes: ["email", "name"],
+        emailClaim: "the ID token's `email`, counted as verified only when its `email_verified` is true; someone who chose Hide My Email arrives as a @privaterelay.appleid.com address, which no invitation names",
+        setup: "setup/signin-apple.md",
+        notes: [
+            "Apple returns to the Gateway with a POST; behind the outer ring, `everyapp access on` leaves /api/auth/callback/apple public (it only redirects to the same URL as a GET, which Access then checks).",
+            "The client secret is a JWT that expires within six months: generate a new one before then or sign-in stops.",
+        ],
+    },
+    cloudflare: {
+        id: "cloudflare",
+        label: "Cloudflare",
+        console: "https://dash.cloudflare.com/?to=/:account/oauth-clients",
+        appNoun: "OAuth client (Manage Account → OAuth clients)",
+        settings: clientPair("cloudflare", {
+            clientId: "The OAuth client's Client ID",
+            clientSecret: "The OAuth client's Client secret",
+        }),
+        scopes: ["user-details.read"],
+        emailClaim: "the Cloudflare API's /user `email` (the account's sign-in address). Cloudflare reports no verified flag, so the email counts as verified on the strength of the client being private: only members of your Cloudflare account can authorize it, and they got in by accepting an invitation sent to that address",
+        setup: "setup/signin-cloudflare.md",
+        notes: [
+            "Keep the client private (the default): a public client lets any Cloudflare user sign in, and Cloudflare says nothing about whether their address is verified. Making a client public is permanent.",
+            "The Cloudflare account's members sign in; for everyone else use Cloudflare Access's one-time PIN (`everyapp access on`) or another provider.",
+        ],
+    },
+    oidc: {
+        id: "oidc",
+        label: "SSO",
+        console: "your identity provider's admin console",
+        appNoun: "OpenID Connect client (web application, authorization code)",
+        settings: [
+            {
+                name: settingName("oidc", "ISSUER"),
+                role: "issuer",
+                required: true,
+                plain: true,
+                what: "The issuer URL (https://…), which serves /.well-known/openid-configuration",
+            },
+            ...clientPair("oidc", {
+                clientId: "The client ID",
+                clientSecret: "The client secret",
+            }),
+            {
+                name: settingName("oidc", "LABEL"),
+                role: "label",
+                required: false,
+                plain: true,
+                what: 'The button text after "Continue with" (default "SSO")',
+            },
+        ],
+        scopes: IDENTITY_SCOPES,
+        emailClaim: "the ID token's `email` (else the userinfo endpoint's), counted as verified only when `email_verified` is true",
+        setup: "setup/signin-oidc.md",
+        notes: [
+            "Cloudflare Access has its own settings (CLOUDFLARE_ACCESS_OIDC_*, `everyapp access`): use those for Access, this for Okta, Entra ID, Google Workspace as an OIDC issuer, Keycloak, Auth0 and the like.",
+            "ID tokens must be signed with RS256 (every major provider's default).",
+        ],
+    },
+};
+/** The catalog in listing order. */
+export const SIGN_IN_PROVIDER_LIST = SIGN_IN_PROVIDER_IDS.map((id) => SIGN_IN_PROVIDERS[id]);
+export function isSignInProviderId(value) {
+    return SIGN_IN_PROVIDER_IDS.includes(value);
+}
+/**
+ * Every setting a sign-in provider reads, in catalog order: what `everyapp
+ * secret set` accepts for the Gateway, and what the Gateway's dev config
+ * declares.
+ */
+export const SIGN_IN_GATEWAY_SETTINGS = SIGN_IN_PROVIDER_LIST.flatMap((provider) => provider.settings.map((setting) => setting.name));
+/** The plain (non-credential) ones among them: ids, the issuer, the label, the tenant. */
+export const PLAIN_SIGN_IN_SETTINGS = SIGN_IN_PROVIDER_LIST.flatMap((provider) => provider.settings
+    .filter((setting) => setting.plain)
+    .map((setting) => setting.name));
+/**
+ * The family: any name of the shape `<ID>_SIGNIN_<FIELD>`. Reserved for the
+ * catalog above, whether or not an entry reads the name today, so no
+ * registered provider row and no app manifest can ever take one.
+ */
+export const SIGN_IN_SETTING_PATTERN = /^[A-Z][A-Z0-9_]*_SIGNIN_(CLIENT_ID|CLIENT_SECRET|ISSUER|LABEL|TENANT)$/;
+export function isSignInSettingName(name) {
+    return SIGN_IN_SETTING_PATTERN.test(name);
+}
+/** The provider a setting belongs to, if one reads it. */
+export function signInProviderOfSetting(name) {
+    for (const provider of SIGN_IN_PROVIDER_LIST) {
+        if (provider.settings.some((setting) => setting.name === name)) {
+            return provider;
+        }
+    }
+    return null;
+}
+/**
+ * A provider's state from which of its settings exist: on when every
+ * required one is set, off when none at all is, incomplete in between (the
+ * Gateway refuses to half-configure a sign-in: the provider is off and the
+ * problem is reported).
+ */
+export function signInProviderState(provider, isSet) {
+    const set = provider.settings
+        .filter((setting) => isSet(setting.name))
+        .map((setting) => setting.name);
+    const missing = provider.settings
+        .filter((setting) => setting.required && !isSet(setting.name))
+        .map((setting) => setting.name);
+    const status = missing.length === 0 ? "on" : set.length === 0 ? "off" : "incomplete";
+    return { id: provider.id, status, missing, set };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@every-app/sdk",
-  "version": "0.3.0-rc.1",
+  "version": "0.3.0-rc.2",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -30,16 +30,6 @@
     "dist",
     "README.md"
   ],
-  "scripts": {
-    "prebuild": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
-    "build": "tsc -p tsconfig.build.json",
-    "types:check": "tsc --noEmit",
-    "format:check": "prettier --check .",
-    "format:write": "prettier . --write",
-    "test": "vitest run --silent",
-    "test:watch": "vitest",
-    "check:esm-relative-imports": "node ./scripts/check-esm-relative-imports.mjs"
-  },
   "peerDependencies": {
     "jose": "^6.2.5"
   },
@@ -53,5 +43,15 @@
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^3.2.6",
     "zod": "^4.2.0"
+  },
+  "scripts": {
+    "prebuild": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "build": "tsc -p tsconfig.build.json",
+    "types:check": "tsc --noEmit",
+    "format:check": "prettier --check .",
+    "format:write": "prettier . --write",
+    "test": "vitest run --silent",
+    "test:watch": "vitest",
+    "check:esm-relative-imports": "node ./scripts/check-esm-relative-imports.mjs"
   }
-}
+}