@every-app/sdk 0.3.0-rc.10 → 0.3.0-rc.12

package/dist/internal/capabilities.d.ts

@@ -16,18 +16,14 @@
  *    proxy's rules: inference routes only, the model allowlist, the usage
  *    tap. Never a capability: its key would reach the account's credits
  *    and keys on the same host.
- *  - `oauth_client`: a provider's OAuth client (Google's, Microsoft's,
- *    Slack's), held the same way. The gateway completes the token endpoint
- *    calls only, putting the client on them; the app builds the authorize
- *    URL from the public client id (`integrationStatus()`), sends people
- *    back to a callback its manifest entry lists (`redirectPaths`), keeps
- *    the user tokens and calls the provider's API with them itself. Other
- *    providers' clients (GitHub, the social networks) are presets
- *    (./oauthPresets.ts): rows only once an operator adds one. A client shared by apps
- *    with different needs carries a `scopePolicy`: named scope sets an app
- *    lists in its manifest entry's `scopes`, which ./oauthScopes.ts turns
- *    into what the app may ask the provider for and what a token it is
- *    handed may carry.
+ *  - `oauth_client`: an OAuth provider (Google, Microsoft, Slack built
+ *    in; GitHub and others as presets, ./oauthPresets.ts) whose client the
+ *    gateway holds and whose flow it runs. A person connects in an app,
+ *    for exactly the provider scopes the app's manifest entry lists
+ *    (`scopes`); the gateway keeps the tokens and puts the person's token
+ *    on the app's calls to the provider's `api` hosts. Each provider is a
+ *    spec (./oauthSpec.ts), its differences data; ./oauthScopes.ts holds
+ *    the one set of scope rules.
  *  - `service`: something the gateway does itself, with no upstream host
  *    an app names (sending email, listing the organization's members). An
  *    app lists it the same way and calls its routes,
@@ -205,9 +201,9 @@ export interface ApiKeyCapability extends ProviderDetails {
  * An AI provider (OpenAI, OpenRouter, Workers AI): the AI proxy's table as
  * a catalog entry. The app's path is joined onto `origin` and `basePath`
  * (with `{SETTING}` placeholders filled from the Gateway's settings, each
- * URL-encoded) and must be one of `inferenceRoutes` (a POST), unless both
- * the operator (`AI_PROXY_EXTRA_ROUTES`) and the app's manifest (`ai.routes`)
- * allow more (`extraRoutes`). `unstoredRoutes` get `store: false`.
+ * URL-encoded) and must be one of `inferenceRoutes` (a POST), unless the
+ * app's manifest (`ai.routes`) allows more on an entry that takes more
+ * (`extraRoutes`). `unstoredRoutes` get `store: false`.
  * `normalize` names the one response rewrite the gateway has.
  */
 export interface AiProviderCapability extends ProviderDetails {
@@ -231,6 +227,7 @@ export interface AiProviderCapability extends ProviderDetails {
     basePath?: string;
     inferenceRoutes: readonly string[];
     unstoredRoutes?: readonly string[];
+    /** Paths beyond inference an app may name in its manifest's `ai.routes`: OpenAI only. */
     extraRoutes?: boolean;
     normalize?: "workers-ai";
     /**
@@ -288,11 +285,11 @@ export interface AiRoute {
     /** One of the entry's `inferenceRoutes`: `/api/v1/chat/completions`. */
     path: string;
     /**
-     * The seed: the model the Gateway fills in when its operator set none
-     * for this provider (`everyapp ai model`, `org_settings.ai_models`), a
-     * cheap, capable one of the provider's. Data, never the only answer:
-     * read it through `resolveAiDefault` (./aiDefault.ts), which puts the
-     * operator's setting first.
+     * The seed: the model the Gateway fills in when the workspace's default
+     * names this provider without a model (or the order picked it), a
+     * cheap, capable one of the provider's. Read it through
+     * `resolveAiDefault` (./aiDefault.ts), which puts the setting's model
+     * first.
      */
     seedModel: string;
 }
@@ -317,105 +314,10 @@ export interface GatewayServiceCapability {
     /** The everyapp skill's setup guide, when there is anything to set up. */
     setup?: string;
 }
-/** Where the gateway puts an OAuth client on a token request. */
+/** Where the Gateway puts its OAuth client on a token request: the form body or HTTP Basic. */
 export type OAuthClientInjection = "form" | "basic";
-/** A token endpoint an `oauth_client` capability completes, with its rule. */
-export interface OAuthTokenEndpoint {
-    /** The endpoint's host, always over https. */
-    host: string;
-    /** The exact pathname. */
-    path: string;
-    methods: readonly ("GET" | "POST")[];
-    /**
-     * Where the client goes: the form body or HTTP Basic
-     * (injectClientCredentials() in ./oauthClient.ts).
-     */
-    inject: OAuthClientInjection;
-}
-/**
- * One host's allowlist a scope set unlocks. Matched against the raw
- * pathname, case preserved, by `scopeRouteAllows()` in ./oauthScopes.ts:
- * the proxy boundary once the gateway holds tokens, tested data until then.
- */
-export interface OAuthScopeRoute {
-    /** A bare https host, one of the capability's `api` hosts. */
-    host: string;
-    /**
-     * Raw-path entries: exact, or a prefix when the entry ends in `/`. GET
-     * and HEAD go through when one matches.
-     */
-    paths: readonly string[];
-    /**
-     * The read-shaped POSTs a read set allows (queries, watches): anchored,
-     * flagless RegExps over the raw pathname. Every other POST is refused.
-     */
-    posts?: readonly RegExp[];
-}
-/**
- * A named bundle an app lists under `scopes`: what it asks the provider for
- * and what that unlocks.
- */
-export interface OAuthScopeSet {
-    /** What Admin → Apps and a consent page call it: "Gmail (read-only)". */
-    label: string;
-    /**
-     * A read set unlocks GET, HEAD and its `posts` only. No write set exists
-     * on the shared clients yet; adding one is a reviewed registry change.
-     */
-    access: CapabilityAccess;
-    /** The provider's scope strings, requested verbatim (Slack: bot scopes). */
-    scopes: readonly string[];
-    /** Slack's `user_scope` strings, issued to the installing person's own token; absent elsewhere. */
-    userScopes?: readonly string[];
-    routes: readonly OAuthScopeRoute[];
-}
-/**
- * How a provider spells granted scopes in its token response; each has a
- * parser in ./oauthScopes.ts. `space` and `comma` are the plain spellings
- * a registered provider names (`scopeDialect`): a token response without
- * a `scope` field is taken as granted-as-requested (RFC 6749 §5.1).
- */
-export type OAuthScopeDialect = "google" | "microsoft" | "slack" | "space" | "comma";
-/**
- * Everything the gateway needs to hold an app to its scope sets at the
- * token endpoint. Present means an app's entry must list `scopes` and the
- * gateway refuses tokens outside them. Data only: the dialect selects the
- * parser, so the registry stays a table.
- */
-export interface OAuthScopePolicy {
-    sets: Readonly<Record<string, OAuthScopeSet>>;
-    /**
-     * Scopes a token may carry beyond the declared sets without refusal:
-     * identity and refresh scopes, in every spelling the provider uses.
-     * Never a data scope.
-     */
-    tolerated: readonly string[];
-    /**
-     * Scopes every declaring app asks for whatever its sets, on the authorize
-     * URL and Microsoft's token leg (`offline_access`). Always tolerated.
-     */
-    alwaysRequested: readonly string[];
-    dialect: OAuthScopeDialect;
-    /**
-     * The `tokenGrantType()` values the gateway completes through this
-     * client. `null` is a code exchange that carries no `grant_type` (Slack's
-     * oauth.v2.access).
-     */
-    grantTypes: readonly (string | null)[];
-    /**
-     * What becomes of the token request's `scope` once it passes the check:
-     * `replace` it with the app's requested list (Microsoft's token-leg
-     * extension, which keeps a token to one resource), `drop` it (Google
-     * documents no `scope` on either token leg), or `keep` it (Slack).
-     */
-    requestScope: "replace" | "drop" | "keep";
-    /**
-     * Decoded path segments no set unlocks on any host, compared
-     * case-insensitively: batch tunnels that carry other requests inside, and
-     * resources that reveal secrets under a read scope.
-     */
-    deniedSegments: readonly string[];
-}
+/** How a provider separates scopes in its `scope` parameter and its token answer. */
+export type OAuthScopeSeparator = "space" | "comma";
 /** How a provider names the account a new connection is for, read once after the exchange. */
 export interface OAuthIdentity {
     /** An https URL on one of the provider's `api` hosts, GET with the new token. */
@@ -426,94 +328,74 @@ export interface OAuthIdentity {
     id?: string;
 }
 /**
- * What the Gateway needs to run a provider's authorization-code flow
- * itself (docs/design/2026-10-oauth-providers.md section 5): present on a
- * catalog entry that supports the Gateway-owned flow, and built from a
- * registered row's `auth` (`kind: "oauth2-user"`). Absent: the entry
- * keeps the app-driven flow only (the social networks).
+ * The provider's authorization-code flow as data, from its spec
+ * (./oauthSpec.ts): everything that differs between providers. The
+ * Gateway runs it; an app never sees a token or the client.
  */
 export interface OAuthFlow {
+    /** Where the browser goes to consent (https). */
+    authorizeUrl: string;
     /** The token endpoint the Gateway posts the code and refresh token to (https). */
     tokenUrl: string;
     /** Where a disconnect revokes the token; absent means the tokens die at their expiry. */
     revokeUrl?: string;
     /** The revoke call's method (default POST). */
     revokeMethod?: "POST" | "DELETE";
-    /** Whether the authorize request carries a PKCE S256 challenge (default true). */
+    /** Where the client goes on the token request. */
+    inject: OAuthClientInjection;
+    /** Whether the authorize request carries a PKCE S256 challenge. */
     pkce: boolean;
-    /** How the token response spells what it granted. */
-    scopeDialect: OAuthScopeDialect;
+    scopeSeparator: OAuthScopeSeparator;
+    /**
+     * Joined onto an app's short scope (`gmail.modify`) for the authorize
+     * URL, and taken off a granted one for comparison: Google's
+     * `https://www.googleapis.com/auth/`. Absent: scopes as written.
+     */
+    scopePrefix?: string;
     /** Extra query on the authorize URL (Google's `access_type=offline`). */
     authorizeParams?: Readonly<Record<string, string>>;
     /** Extra headers on the token request (GitHub's `Accept: application/json`). */
     tokenHeaders?: Readonly<Record<string, string>>;
     identity?: OAuthIdentity;
+    /**
+     * Scopes the Gateway adds to every connect, whatever the app lists: what
+     * the identity URL needs, and a refresh token's (Microsoft's
+     * `offline_access`). Tolerated at mint; apps never list them.
+     */
+    identityScopes: readonly string[];
+    /** Scopes a token may carry beyond what was asked without refusal (another spelling of an identity scope). Never a data scope. */
+    tolerated: readonly string[];
 }
 /**
- * A provider's OAuth client the gateway holds. The gateway completes its
- * token endpoints only (`token`), putting the client on each request; the
- * app builds the authorize URL from the public client id and calls the
- * provider's API with the user tokens it keeps.
+ * An OAuth provider the Gateway holds a client for and runs the flow for
+ * (docs/design/2026-11-oauth-simplify.md). A person connects in an app;
+ * the connection is theirs and that app's, for exactly the scopes the
+ * app's `everyapp.config.ts` lists, and the app calls the provider's
+ * `api` hosts through the Gateway, which puts the token on.
  */
 export interface OAuthClientCapability {
     mode: "oauth_client";
-    /** The provider's name in errors and logs. */
+    /** The provider's name in errors, pages and logs. */
     label: string;
-    /** Gateway secret names. No `clientSecret`: a public client, the id alone. */
+    /** Gateway setting names. No `clientSecret`: a public client, the id alone. */
     secrets: {
         clientId: string;
         clientSecret?: string;
     };
-    /** The only calls the gateway completes; anything else is refused. */
-    token: readonly OAuthTokenEndpoint[];
-    /**
-     * Obtaining and refreshing user tokens with the operator's client
-     * writes, so a catalog client is `["write"]`. A registered OAuth
-     * provider says what the proxy may do with the held token: read, write
-     * or both (docs/design/2026-10-oauth-providers.md section 7).
-     */
-    access: readonly CapabilityAccess[];
-    /** Where the operator registers the client. */
+    /** Where the operator registers the client (the spec's `docs`). */
     console: string;
     /** The everyapp skill's setup guide for the client, when one exists. */
     setup?: string;
-    /**
-     * The authorize endpoint the app sends people to and the scopes the
-     * client must be allowed: the operator's checklist and the docs. With
-     * a `scopePolicy`, the union of its sets' scopes and `alwaysRequested`.
-     */
-    authorize: {
-        url: string;
-        scopes: readonly string[];
-    };
-    /**
-     * Named scope sets an app lists in its manifest entry's `scopes`, for a
-     * client several apps share with different needs. Absent: the whole
-     * client is the grant.
-     */
-    scopePolicy?: OAuthScopePolicy;
-    /**
-     * Hosts the app calls afterwards with the user's token; the Gateway's
-     * held-token branch forwards to these alone, and a scope policy's
-     * routes are on them.
-     */
+    /** The only hosts the held token is ever sent to, over https. */
     api: readonly string[];
-    /** The Gateway-owned flow, when the entry supports it. */
-    flow?: OAuthFlow;
-    /** A registered OAuth provider's spec fields (a catalog client has `setup` instead). */
+    flow: OAuthFlow;
+    /** What it is for, in one line. */
     description?: string;
     /** The API reference (a spec's `api`), optional. */
     reference?: string;
     hint?: string;
     example?: string;
     tags?: readonly string[];
-    /**
-     * A registered OAuth provider's methods: what a read grant may use
-     * (default GET and HEAD) and what a write grant adds (default the
-     * API-key default). A catalog client leaves both unset.
-     */
-    readMethods?: readonly string[];
-    writeMethods?: readonly string[];
 }
 export type Capability = ApiKeyCapability | AiProviderCapability | OAuthClientCapability | GatewayServiceCapability;
 export declare const CAPABILITIES: {
@@ -1724,6 +1606,41 @@ export declare const CAPABILITIES: {
         };
         readonly tags: readonly ["weather", "forecast"];
     };
+    readonly daytona: {
+        readonly mode: "api_key";
+        readonly label: "Daytona";
+        readonly description: "Sandboxes for running code: create, start, stop, archive and delete sandboxes, and manage their snapshots and volumes.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "DAYTONA_API_KEY";
+        };
+        readonly docs: "https://www.daytona.io/docs/en/api-keys/";
+        readonly api: "https://www.daytona.io/docs/en/tools/api/";
+        readonly hosts: readonly ["app.daytona.io"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["organizations"], readonly ["organization"], readonly ["billing"], readonly ["api-keys"], readonly ["users"], readonly ["audit"], readonly ["webhooks"], readonly ["secret"], readonly ["docker-registry"], readonly ["object-storage"], readonly ["regions"], readonly ["runners"], readonly ["for-runner"], readonly ["jobs"], readonly ["warm-pools"], readonly ["preview"], readonly ["ssh-access", "validate"]];
+        readonly hint: "An API key from the Daytona dashboard's Keys page, with only the permissions the apps need; the Gateway sends it as a bearer token to app.daytona.io. Any key of an organization reaches every running sandbox in it, so give the Gateway a Daytona organization of its own.";
+        readonly secrets: readonly [{
+            readonly name: "DAYTONA_API_KEY";
+            readonly hint: "An API key from the Daytona dashboard's Keys page: write:sandboxes and delete:sandboxes (and the snapshot or volume ones) only if an app needs them, and never manage:api_keys, manage:secrets, manage:billing or the region and runner permissions.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/api/sandbox";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the organization's sandboxes; any key may read them.";
+        };
+        readonly example: "start a sandbox from my snapshot and stop it when the run is done";
+        readonly verified: {
+            readonly on: "2026-11-01";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["sandbox", "compute", "hosting"];
+    };
     readonly postmark: {
         readonly mode: "api_key";
         readonly label: "Postmark";
@@ -2702,303 +2619,22 @@ export declare const CAPABILITIES: {
         readonly settings: readonly [];
         readonly optionalSettings: readonly [];
     };
-    readonly slack: {
-        readonly mode: "oauth_client";
-        readonly label: "Slack";
-        readonly secrets: {
-            readonly clientId: "SLACK_CLIENT_ID";
-            readonly clientSecret: "SLACK_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "slack.com";
-            readonly path: "/api/oauth.v2.access";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://api.slack.com/apps";
-        readonly setup: "setup/slack.md";
-        readonly authorize: {
-            readonly url: "https://slack.com/oauth/v2/authorize";
-            readonly scopes: readonly ["channels:read", "groups:read", "users:read", "users:read.email", "chat:write", "chat:write.public", "chat:write.customize", "channels:join", "channels:manage", "groups:write", "channels:write.invites", "groups:write.invites", "im:write", "files:write", "channels:write"];
-        };
-        readonly scopePolicy: {
-            readonly dialect: "slack";
-            readonly grantTypes: readonly [null, "refresh_token"];
-            readonly requestScope: "keep";
-            readonly alwaysRequested: readonly [];
-            readonly tolerated: readonly [];
-            readonly deniedSegments: readonly [];
-            readonly sets: {
-                readonly "channels.read": {
-                    readonly label: "Channels (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["channels:read", "groups:read"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/conversations.list", "/api/conversations.info", "/api/conversations.members", "/api/users.conversations"];
-                        readonly posts: readonly [RegExp, RegExp];
-                    }];
-                };
-                readonly "users.read": {
-                    readonly label: "Members (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["users:read"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/users.list", "/api/users.info", "/api/users.getPresence", "/api/bots.info"];
-                        readonly posts: readonly [RegExp, RegExp];
-                    }];
-                };
-                readonly "users.email": {
-                    readonly label: "Members' email addresses (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["users:read.email"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/users.lookupByEmail"];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "messages.write": {
-                    readonly label: "Messages (post as the app)";
-                    readonly access: "write";
-                    readonly scopes: readonly ["chat:write", "chat:write.public", "chat:write.customize"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/chat.scheduledMessages.list"];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "channels.join": {
-                    readonly label: "Channels (join public ones)";
-                    readonly access: "write";
-                    readonly scopes: readonly ["channels:join"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly [];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "channels.manage": {
-                    readonly label: "Channels (create, manage and invite to; open DMs)";
-                    readonly access: "write";
-                    readonly scopes: readonly ["channels:manage", "groups:write", "channels:write.invites", "groups:write.invites", "im:write"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly [];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "files.write": {
-                    readonly label: "Files (upload)";
-                    readonly access: "write";
-                    readonly scopes: readonly ["files:write"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly [];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "user-channels.manage": {
-                    readonly label: "Channels (as the installing person: read, manage, invite to)";
-                    readonly access: "write";
-                    readonly scopes: readonly [];
-                    readonly userScopes: readonly ["channels:read", "channels:write", "groups:read", "groups:write"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/conversations.list", "/api/conversations.info", "/api/conversations.members", "/api/users.conversations"];
-                        readonly posts: readonly [RegExp, RegExp];
-                    }];
-                };
-            };
-        };
-        readonly api: readonly ["slack.com"];
-        readonly flow: {
-            readonly tokenUrl: "https://slack.com/api/oauth.v2.access";
-            readonly revokeUrl: "https://slack.com/api/auth.revoke";
-            readonly pkce: false;
-            readonly scopeDialect: "slack";
-            readonly identity: {
-                readonly url: "https://slack.com/api/auth.test";
-                readonly label: "team";
-                readonly id: "user_id";
-            };
+    readonly slack: OAuthClientCapability & {
+        secrets: {
+            clientId: "SLACK_CLIENT_ID";
+            clientSecret: "SLACK_CLIENT_SECRET";
         };
     };
-    readonly "google-workspace": {
-        readonly mode: "oauth_client";
-        readonly label: "Google (Gmail, Calendar, Search Console and Analytics)";
-        readonly secrets: {
-            readonly clientId: "GOOGLE_WORKSPACE_CLIENT_ID";
-            readonly clientSecret: "GOOGLE_WORKSPACE_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "oauth2.googleapis.com";
-            readonly path: "/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://console.cloud.google.com/apis/credentials";
-        readonly setup: "setup/google.md";
-        readonly authorize: {
-            readonly url: "https://accounts.google.com/o/oauth2/v2/auth";
-            readonly scopes: readonly ["openid", "email", "profile", "https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/calendar.readonly", "https://www.googleapis.com/auth/webmasters.readonly", "https://www.googleapis.com/auth/analytics.readonly"];
-        };
-        readonly scopePolicy: {
-            readonly dialect: "google";
-            readonly grantTypes: readonly ["authorization_code", "refresh_token"];
-            readonly requestScope: "drop";
-            readonly alwaysRequested: readonly [];
-            readonly tolerated: readonly ["openid", "email", "profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile"];
-            readonly deniedSegments: readonly ["batch", "measurementProtocolSecrets"];
-            readonly sets: {
-                readonly identity: {
-                    readonly label: "Google account (who you are)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["openid", "email", "profile"];
-                    readonly routes: readonly [{
-                        readonly host: "openidconnect.googleapis.com";
-                        readonly paths: readonly ["/v1/userinfo"];
-                    }, {
-                        readonly host: "www.googleapis.com";
-                        readonly paths: readonly ["/oauth2/v2/userinfo", "/oauth2/v3/userinfo", "/userinfo/v2/me"];
-                    }];
-                };
-                readonly "gmail.read": {
-                    readonly label: "Gmail (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["https://www.googleapis.com/auth/gmail.readonly"];
-                    readonly routes: readonly [{
-                        readonly host: "gmail.googleapis.com";
-                        readonly paths: readonly ["/gmail/v1/users/"];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "calendar.read": {
-                    readonly label: "Google Calendar (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["https://www.googleapis.com/auth/calendar.readonly"];
-                    readonly routes: readonly [{
-                        readonly host: "www.googleapis.com";
-                        readonly paths: readonly ["/calendar/v3/"];
-                        readonly posts: readonly [RegExp, RegExp, RegExp, RegExp];
-                    }];
-                };
-                readonly "search-console.read": {
-                    readonly label: "Search Console (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["https://www.googleapis.com/auth/webmasters.readonly"];
-                    readonly routes: readonly [{
-                        readonly host: "www.googleapis.com";
-                        readonly paths: readonly ["/webmasters/v3/"];
-                        readonly posts: readonly [RegExp];
-                    }, {
-                        readonly host: "searchconsole.googleapis.com";
-                        readonly paths: readonly ["/webmasters/v3/"];
-                        readonly posts: readonly [RegExp, RegExp];
-                    }];
-                };
-                readonly "analytics.read": {
-                    readonly label: "Google Analytics (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["https://www.googleapis.com/auth/analytics.readonly"];
-                    readonly routes: readonly [{
-                        readonly host: "analyticsdata.googleapis.com";
-                        readonly paths: readonly ["/v1beta/properties/"];
-                        readonly posts: readonly [RegExp];
-                    }, {
-                        readonly host: "analyticsadmin.googleapis.com";
-                        readonly paths: readonly ["/v1beta/accountSummaries", "/v1beta/accounts", "/v1beta/accounts/", "/v1beta/properties", "/v1beta/properties/", "/v1alpha/properties/"];
-                    }];
-                };
-            };
-        };
-        readonly api: readonly ["gmail.googleapis.com", "www.googleapis.com", "searchconsole.googleapis.com", "analyticsdata.googleapis.com", "analyticsadmin.googleapis.com", "openidconnect.googleapis.com"];
-        readonly flow: {
-            readonly tokenUrl: "https://oauth2.googleapis.com/token";
-            readonly pkce: true;
-            readonly scopeDialect: "google";
-            readonly authorizeParams: {
-                readonly access_type: "offline";
-                readonly prompt: "consent";
-            };
-            readonly identity: {
-                readonly url: "https://openidconnect.googleapis.com/v1/userinfo";
-                readonly label: "email";
-                readonly id: "sub";
-            };
+    readonly "google-workspace": OAuthClientCapability & {
+        secrets: {
+            clientId: "GOOGLE_WORKSPACE_CLIENT_ID";
+            clientSecret: "GOOGLE_WORKSPACE_CLIENT_SECRET";
         };
     };
-    readonly "microsoft-365": {
-        readonly mode: "oauth_client";
-        readonly label: "Microsoft 365 (Outlook mail and calendar)";
-        readonly secrets: {
-            readonly clientId: "MICROSOFT_365_CLIENT_ID";
-            readonly clientSecret: "MICROSOFT_365_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "login.microsoftonline.com";
-            readonly path: "/common/oauth2/v2.0/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade";
-        readonly setup: "setup/microsoft-365.md";
-        readonly authorize: {
-            readonly url: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
-            readonly scopes: readonly ["offline_access", "User.Read", "Mail.Read", "Calendars.Read"];
-        };
-        readonly scopePolicy: {
-            readonly dialect: "microsoft";
-            readonly grantTypes: readonly ["authorization_code", "refresh_token"];
-            readonly requestScope: "replace";
-            readonly alwaysRequested: readonly ["offline_access"];
-            readonly tolerated: readonly ["openid", "profile", "email", "offline_access", "User.Read"];
-            readonly deniedSegments: readonly ["$batch", "beta"];
-            readonly sets: {
-                readonly identity: {
-                    readonly label: "Microsoft account (who you are)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["User.Read"];
-                    readonly routes: readonly [{
-                        readonly host: "graph.microsoft.com";
-                        readonly paths: readonly ["/v1.0/me", "/oidc/userinfo"];
-                    }];
-                };
-                readonly "mail.read": {
-                    readonly label: "Outlook mail (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["Mail.Read"];
-                    readonly routes: readonly [{
-                        readonly host: "graph.microsoft.com";
-                        readonly paths: readonly ["/v1.0/me/messages", "/v1.0/me/messages/", "/v1.0/me/mailFolders", "/v1.0/me/mailFolders/"];
-                    }];
-                };
-                readonly "calendar.read": {
-                    readonly label: "Outlook calendar (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["Calendars.Read"];
-                    readonly routes: readonly [{
-                        readonly host: "graph.microsoft.com";
-                        readonly paths: readonly ["/v1.0/me/calendar", "/v1.0/me/calendar/", "/v1.0/me/calendars", "/v1.0/me/calendars/", "/v1.0/me/events", "/v1.0/me/events/", "/v1.0/me/calendarView", "/v1.0/me/calendarView/"];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-            };
-        };
-        readonly api: readonly ["graph.microsoft.com"];
-        readonly flow: {
-            readonly tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token";
-            readonly pkce: true;
-            readonly scopeDialect: "microsoft";
-            readonly identity: {
-                readonly url: "https://graph.microsoft.com/v1.0/me";
-                readonly label: "userPrincipalName";
-                readonly id: "id";
-            };
+    readonly "microsoft-365": OAuthClientCapability & {
+        secrets: {
+            clientId: "MICROSOFT_365_CLIENT_ID";
+            clientSecret: "MICROSOFT_365_CLIENT_SECRET";
         };
     };
 };
@@ -3012,18 +2648,8 @@ export type ApiKeyCapabilityId = CapabilityIdOf<"api_key">;
 export type AiProviderId = CapabilityIdOf<"ai">;
 /** Capabilities the gateway performs itself, each with its SDK helper. */
 export type ServiceCapabilityId = CapabilityIdOf<"service">;
-/** OAuth clients whose token endpoints apps reach with `integrationFetch()`. */
+/** The built-in OAuth providers whose APIs apps reach with `integrationFetch()`. */
 export type OAuthClientCapabilityId = CapabilityIdOf<"oauth_client">;
-/**
- * The scope set names an OAuth client offers; `never` for a client without
- * a scope policy. Distributes over a union of ids, so a generic over two
- * clients gets every name either offers rather than the names they share.
- */
-export type OAuthScopeSetName<Id extends OAuthClientCapabilityId> = Id extends unknown ? (typeof CAPABILITIES)[Id] extends {
-    scopePolicy: {
-        sets: infer S;
-    };
-} ? keyof S & string : never : never;
 /** The Gateway settings an `auth` block names: the key, and a Basic username held as a setting. */
 type AuthSettingsOf<A> = (A extends {
     secret: infer S extends string;
@@ -3037,7 +2663,7 @@ type SettingsOf<C> = C extends {
     optionalSettings: readonly (infer O extends string)[];
 } ? S | O : C extends {
     secrets: infer S;
-    token: unknown;
+    flow: unknown;
 } ? S[keyof S] & string : C extends {
     auth: infer A;
 } ? AuthSettingsOf<A> | (C extends {
@@ -3119,13 +2745,12 @@ export type IntegrationProxyRoute =
     capability: ApiKeyCapability;
     upstream: URL;
 }
-/** A call to one of an OAuth client's token endpoints, with its rule. */
+/** A call to one of an OAuth provider's API hosts, which goes with the person's held token. */
  | {
     kind: "oauth_client";
     id: string;
     capability: OAuthClientCapability;
     upstream: URL;
-    endpoint: OAuthTokenEndpoint;
 }
 /** A call to one of the routes a service capability declares. */
  | {
@@ -3139,20 +2764,12 @@ export type CapabilitySettings = Readonly<Record<string, unknown>>;
 /**
  * The capability call an AppGateway path names, or null when the path names
  * an unknown capability (or an AI provider, which has its own route), a
- * host outside the provider's, a path that could leave that host, a path
- * that isn't one of an OAuth client's token endpoints, or a route a service
- * capability doesn't declare. `settings` resolves an API-key provider's
+ * host outside the provider's, a path that could leave that host, or a
+ * route a service capability doesn't declare. `settings` resolves an API-key provider's
  * `hostSetting` (a Shopify store's host); `lookup` is where the id is found,
  * the catalog alone by default.
  */
 export declare function parseIntegrationProxyPath(pathname: string, search: string, settings?: CapabilitySettings, lookup?: CapabilityLookup): IntegrationProxyRoute | null;
-/**
- * The token endpoint `upstream` is, by its exact host and path, or null.
- * Its method is the caller's to check.
- */
-export declare function tokenEndpointFor(capability: OAuthClientCapability, upstream: URL): OAuthTokenEndpoint | null;
-/** An OAuth client's token endpoints, as `POST https://host/path` lines for messages. */
-export declare function describeTokenEndpoints(capability: OAuthClientCapability): string;
 /**
  * The command that gives the gateway `capability`'s client:
  * `pnpm everyapp secret set <ID> <SECRET>`.