@every-app/sdk 0.3.0-rc.10 → 0.3.0-rc.11

package/dist/internal/oauthSpec.d.ts

@@ -1,23 +1,34 @@
 /**
- * The `oauth2-user` half of a provider spec
- * (docs/design/2026-10-oauth-providers.md section 3): a registered OAuth
- * provider, or a preset (./oauthPresets.ts), as JSON, turned into the
- * same {@link OAuthClientCapability} a catalog client is, with a `flow`
- * the Gateway runs itself. `parseProviderSpec` (./providerSpec.ts) hands
- * the common fields here once it sees `auth.kind: "oauth2-user"`; nothing
- * here reads a value: a spec names Gateway settings, never holds one.
+ * The `oauth2-user` half of a provider spec: a registered OAuth provider,
+ * a preset (./oauthPresets.ts) or a built-in one (./oauthBuiltIns.ts), as
+ * JSON, turned into an {@link OAuthClientCapability} whose `flow` the
+ * Gateway runs. `parseProviderSpec` (./providerSpec.ts) hands the common
+ * fields here once it sees `auth.kind: "oauth2-user"`. Nothing here reads
+ * a value: a spec names Gateway settings, never holds one.
+ *
+ * Every difference between providers is a field here, never code: the
+ * endpoints, how the client goes on the token request, PKCE, the scope
+ * separator and prefix, extra authorize parameters and token headers, the
+ * identity URL with the scopes it needs, and the scopes a token may carry
+ * beyond what was asked (`tolerated`). Which scopes an app gets is its own
+ * `everyapp.config.ts`, never the spec.
+ *
+ * Only type imports from ./capabilities.ts: the catalog builds its
+ * built-in entries with {@link oauthCapabilityFromSpec} at load.
  */
-import { type CapabilityAccess, type OAuthClientCapability, type OAuthScopeSet } from "./capabilities.js";
+import type { OAuthClientCapability, OAuthClientInjection, OAuthScopeSeparator } from "./capabilities.js";
 export interface SpecProblem {
     path: string;
     message: string;
 }
-/** A scope set's name: `identity`, or `<area>.<access>` (`repo.read`), lowercase. */
-export declare const SCOPE_SET_NAME: RegExp;
-/** Segments no set unlocks on any host: batch tunnels carry whole requests inside. */
-export declare const DEFAULT_DENIED_SEGMENTS: readonly string[];
 /** The fields of `auth` when its kind is `oauth2-user`. */
-export declare const OAUTH_AUTH_FIELDS: readonly ["kind", "authorizeUrl", "tokenUrl", "revokeUrl", "revokeMethod", "clientId", "clientSecret", "inject", "pkce", "scopeDialect", "authorizeParams", "tokenHeaders", "identity"];
+export declare const OAUTH_AUTH_FIELDS: readonly ["kind", "authorizeUrl", "tokenUrl", "revokeUrl", "revokeMethod", "clientId", "clientSecret", "inject", "pkce", "scopeSeparator", "scopePrefix", "authorizeParams", "tokenHeaders", "identity", "tolerated"];
+/**
+ * Fields an `oauth2-user` spec had before scopes moved to each app's
+ * `everyapp.config.ts`, each with what to write instead: refused with
+ * that message rather than "unknown field".
+ */
+export declare const REMOVED_OAUTH_FIELDS: Readonly<Record<string, string>>;
 /** The common fields `parseProviderSpec` parsed before handing over. */
 export interface OAuthSpecCommon {
     id: string;
@@ -26,56 +37,12 @@ export interface OAuthSpecCommon {
     hosts: readonly string[];
     description?: string;
     reference?: string;
-    access?: readonly CapabilityAccess[];
-    readMethods?: readonly string[];
-    writeMethods?: readonly string[];
     hint?: string;
     example?: string;
     tags?: readonly string[];
 }
-/**
- * One scope set (`{ label, access, scopes, userScopes?, routes? }`) at
- * `at`, its routes on `hosts` alone; undefined when a field is wrong,
- * every problem reported. `overlay`: a set added to a built-in client
- * must name a scope and say what it unlocks (a set with no routes unlocks
- * nothing on the held-token path); a spec's own set may leave both empty
- * (Notion's sets carry no scope string).
- */
-export declare function parseScopeSet(raw: unknown, at: string, hosts: readonly string[], problems: SpecProblem[], { overlay }?: {
-    overlay?: boolean;
-}): OAuthScopeSet | undefined;
-/** What `parseScopeSetOverlay` returns. */
-export type ParsedScopeSetOverlay = {
-    ok: true;
-    name: string;
-    set: OAuthScopeSet;
-} | {
-    ok: false;
-    problems: SpecProblem[];
-};
-/**
- * A scope set an operator adds to a built-in OAuth client
- * (`everyapp provider scope-set add google-workspace gmail-send.json`):
- * `{ "name": "gmail.send", "label", "access", "scopes", "routes" }`, held
- * to the rules a built-in set is (the set's shape, routes on the client's
- * `api` hosts alone, anchored `posts`) plus two of its own: `access` is
- * said outright (a write set is never implied by its scopes) and `routes`
- * is required. A `provider` field, when present, must be `id`. The name
- * may not be one of the client's own sets: an overlay adds, never
- * replaces. Nothing here reads a value.
- */
-export declare function parseScopeSetOverlay(input: unknown, client: {
-    id: string;
-    capability: OAuthClientCapability;
-}): ParsedScopeSetOverlay;
-/**
- * `capability` with `sets` added to its scope policy: the sets after the
- * client's own, in the order given, and each set's scopes added to the
- * authorize URL's list (what the operator's client must be allowed), as
- * `parseOAuthUserSpec` builds it. A name the client already has is left
- * as the client's (the registry refuses such an overlay before this).
- */
-export declare function withScopeSets(capability: OAuthClientCapability, sets: Readonly<Record<string, OAuthScopeSet>>): OAuthClientCapability;
+/** A list of provider scope strings: each one scope, with no space or comma, each once. */
+export declare function scopeList(value: unknown, path: string, problems: SpecProblem[]): string[] | undefined;
 /** What `parseOAuthUserSpec` returns on success, before the registry's rules. */
 export interface ParsedOAuthSpec {
     capability: OAuthClientCapability;
@@ -83,20 +50,54 @@ export interface ParsedOAuthSpec {
     hosts: string[];
 }
 /**
- * Parse the OAuth half of a spec whose `auth.kind` is `oauth2-user`:
- * `auth` itself, `scopeSets`, `alwaysRequested` and `tolerated`, with
- * the common fields already parsed. Every problem is reported; on
- * success the catalog-shaped capability with its `flow`.
+ * Parse the OAuth half of a spec whose `auth.kind` is `oauth2-user`, with
+ * the common fields already parsed. Every problem is reported; on success
+ * the capability with its `flow`.
  */
 export declare function parseOAuthUserSpec(input: Record<string, unknown>, common: OAuthSpecCommon, problems: SpecProblem[]): ParsedOAuthSpec | undefined;
+/** The JSON shape of an `oauth2-user` spec, as the built-ins and presets write it. */
+export interface OAuthSpecJson {
+    readonly id: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly docs: string;
+    readonly api?: string;
+    readonly hosts: readonly string[];
+    readonly auth: {
+        readonly kind: "oauth2-user";
+        readonly authorizeUrl: string;
+        readonly tokenUrl: string;
+        readonly revokeUrl?: string;
+        readonly revokeMethod?: "POST" | "DELETE";
+        readonly clientId: string;
+        readonly clientSecret?: string;
+        readonly inject?: OAuthClientInjection;
+        readonly pkce?: boolean;
+        readonly scopeSeparator?: OAuthScopeSeparator;
+        readonly scopePrefix?: string;
+        readonly authorizeParams?: Readonly<Record<string, string>>;
+        readonly tokenHeaders?: Readonly<Record<string, string>>;
+        readonly identity?: {
+            readonly url: string;
+            readonly label: string;
+            readonly id?: string;
+            readonly scopes?: readonly string[];
+        };
+        readonly tolerated?: readonly string[];
+    };
+    readonly hint?: string;
+    readonly example?: string;
+    readonly tags?: readonly string[];
+}
+/**
+ * A spec already known to be good (a built-in, checked by its test) as
+ * its capability, without the parse: what the catalog runs at load, where
+ * calling the full parser would be an import cycle.
+ */
+export declare function oauthCapabilityFromSpec(spec: OAuthSpecJson): OAuthClientCapability;
 /**
- * The JSON spec of an OAuth capability that has a `flow` (`provider
- * show`, a preset's round trip): `parseProviderSpec` of it gives the
- * capability back. A catalog client without a `flow` has no spec.
+ * The JSON spec of an OAuth capability (`provider show`, a preset's round
+ * trip): `parseProviderSpec` of it gives the capability back.
  */
-export declare function oauthSpecOf(id: string, capability: OAuthClientCapability): Record<string, unknown> | null;
-/** The methods a held-token write may use on `capability` beyond its reads. */
-export declare function oauthWriteMethods(capability: OAuthClientCapability): readonly string[];
-/** The methods a read grant may use on `capability` (GET and HEAD unless the spec says). */
-export declare function oauthReadMethods(capability: OAuthClientCapability): readonly string[];
+export declare function oauthSpecOf(id: string, capability: OAuthClientCapability): Record<string, unknown>;
 //# sourceMappingURL=oauthSpec.d.ts.map

package/dist/internal/oauthSpec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthSpec.d.ts","sourceRoot":"","sources":["../../src/internal/oauthSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAO1B,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,eAAO,MAAM,cAAc,QAC0B,CAAC;AA4BtD,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAwB,CAAC;AAE9E,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,yLAcpB,CAAC;AAEX,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACrC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAkPD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,WAAW,EAAE,EACvB,EAAE,OAAe,EAAE,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,aAAa,GAAG,SAAS,CA+C3B;AA2CD,2CAA2C;AAC3C,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,aAAa,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GACxD,qBAAqB,CAkDvB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAC5C,qBAAqB,CAiBvB;AAuDD,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,qBAAqB,CAAC;IAClC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,EAAE,GACtB,eAAe,GAAG,SAAS,CAoN7B;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAyFhC;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,qBAAqB,GAChC,SAAS,MAAM,EAAE,CAEnB;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,qBAAqB,GAChC,SAAS,MAAM,EAAE,CAEnB"}
+{"version":3,"file":"oauthSpec.d.ts","sourceRoot":"","sources":["../../src/internal/oauthSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAGpB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAoCD,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,uNAgBpB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAajE,CAAC;AAQF,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AA8GD,2FAA2F;AAC3F,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,WAAW,EAAE,GACtB,MAAM,EAAE,GAAG,SAAS,CA0BtB;AA2DD,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,qBAAqB,CAAC;IAClC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,EAAE,GACtB,eAAe,GAAG,SAAS,CAqK7B;AAwBD,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;QAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;SACrC,CAAC;QACF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,qBAAqB,CAuDvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyDzB"}