@every-app/sdk 0.3.0-rc.11 → 0.3.0-rc.13

package/dist/internal/oauthBuiltIns.d.ts

@@ -94,7 +94,7 @@ export declare const BUILT_IN_OAUTH_SPECS: {
                 readonly id: "team_id";
             };
         };
-        readonly hint: "A Slack app with the Gateway's callback as its redirect URL and the bot scopes your apps list.";
+        readonly hint: "A Slack app with the Gateway's callback as its redirect URL and the bot scopes your apps list. The Gateway takes its Client ID and Client Secret, not a bot token (xoxb-).";
     };
 };
 export type BuiltInOAuthId = keyof typeof BUILT_IN_OAUTH_SPECS;

package/dist/internal/oauthBuiltIns.js

@@ -117,6 +117,6 @@ export const BUILT_IN_OAUTH_SPECS = {
                 id: "team_id",
             },
         },
-        hint: "A Slack app with the Gateway's callback as its redirect URL and the bot scopes your apps list.",
+        hint: "A Slack app with the Gateway's callback as its redirect URL and the bot scopes your apps list. The Gateway takes its Client ID and Client Secret, not a bot token (xoxb-).",
     },
 };

package/dist/internal/oauthSpec.d.ts

@@ -22,7 +22,7 @@ export interface SpecProblem {
     message: string;
 }
 /** The fields of `auth` when its kind is `oauth2-user`. */
-export declare const OAUTH_AUTH_FIELDS: readonly ["kind", "authorizeUrl", "tokenUrl", "revokeUrl", "revokeMethod", "clientId", "clientSecret", "inject", "pkce", "scopeSeparator", "scopePrefix", "authorizeParams", "tokenHeaders", "identity", "tolerated"];
+export declare const OAUTH_AUTH_FIELDS: readonly ["kind", "authorizeUrl", "tokenUrl", "revokeUrl", "revokeMethod", "clientId", "clientSecret", "inject", "pkce", "scopeSeparator", "scopePrefix", "authorizeParams", "tokenHeaders", "identity", "tolerated", "resource", "issuer"];
 /**
  * Fields an `oauth2-user` spec had before scopes moved to each app's
  * `everyapp.config.ts`, each with what to write instead: refused with

package/dist/internal/oauthSpec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthSpec.d.ts","sourceRoot":"","sources":["../../src/internal/oauthSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAGpB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAoCD,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,uNAgBpB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAajE,CAAC;AAQF,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AA8GD,2FAA2F;AAC3F,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,WAAW,EAAE,GACtB,MAAM,EAAE,GAAG,SAAS,CA0BtB;AA2DD,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,qBAAqB,CAAC;IAClC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,EAAE,GACtB,eAAe,GAAG,SAAS,CAqK7B;AAwBD,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;QAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;SACrC,CAAC;QACF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,qBAAqB,CAuDvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyDzB"}
+{"version":3,"file":"oauthSpec.d.ts","sourceRoot":"","sources":["../../src/internal/oauthSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAGpB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAoCD,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,6OAkBpB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAajE,CAAC;AAQF,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAyJD,2FAA2F;AAC3F,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,WAAW,EAAE,GACtB,MAAM,EAAE,GAAG,SAAS,CA0BtB;AA2DD,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,qBAAqB,CAAC;IAClC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,EAAE,GACtB,eAAe,GAAG,SAAS,CA6K7B;AAwBD,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;QAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;SACrC,CAAC;QACF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,qBAAqB,CAuDvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2DzB"}

package/dist/internal/oauthSpec.js

@@ -47,6 +47,8 @@ export const OAUTH_AUTH_FIELDS = [
     "tokenHeaders",
     "identity",
     "tolerated",
+    "resource",
+    "issuer",
 ];
 /**
  * Fields an `oauth2-user` spec had before scopes moved to each app's
@@ -110,7 +112,9 @@ function endpoint(value, path, problems, { query }) {
         parsed.hash) {
         problems.push({
             path,
-            message: "must be an https URL with no port, credentials or fragment",
+            message: parsed.port
+                ? `must be an https URL on the default port (${parsed.port} is not: the Gateway's OAuth requests go to port 443 only), with no credentials or fragment`
+                : "must be an https URL with no port, credentials or fragment",
         });
         return undefined;
     }
@@ -120,6 +124,42 @@ function endpoint(value, path, problems, { query }) {
     }
     return { url, host: parsed.hostname.toLowerCase() };
 }
+/**
+ * An https URL that names something rather than being fetched (an RFC
+ * 8707 resource, an RFC 8414 issuer): a port is allowed, credentials and a
+ * fragment are not, and an issuer takes no query either.
+ */
+function identifierUrl(value, path, problems, { query }) {
+    if (value === undefined)
+        return undefined;
+    const url = printable(value, path, problems, 2048);
+    if (url === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        problems.push({ path, message: "must be an https URL" });
+        return undefined;
+    }
+    if (parsed.protocol !== "https:" ||
+        parsed.username ||
+        parsed.password ||
+        parsed.hash ||
+        url.includes("#")) {
+        problems.push({
+            path,
+            message: "must be an https URL with no credentials or fragment",
+        });
+        return undefined;
+    }
+    if (!query && parsed.search) {
+        problems.push({ path, message: "may not carry a query string" });
+        return undefined;
+    }
+    return url;
+}
 function settingName(value, path, problems) {
     if (typeof value !== "string" || !/^[A-Z][A-Z0-9_]{2,63}$/.test(value)) {
         problems.push({
@@ -345,6 +385,12 @@ export function parseOAuthUserSpec(input, common, problems) {
     });
     const parsedIdentity = identity(auth["identity"], common.hosts, problems);
     const tolerated = scopeList(auth["tolerated"], "auth.tolerated", problems);
+    const resource = identifierUrl(auth["resource"], "auth.resource", problems, {
+        query: true,
+    });
+    const issuer = identifierUrl(auth["issuer"], "auth.issuer", problems, {
+        query: false,
+    });
     if (!authorize ||
         !token ||
         clientId === undefined ||
@@ -371,6 +417,8 @@ export function parseOAuthUserSpec(input, common, problems) {
             : { identity: parsedIdentity.identity }),
         identityScopes: parsedIdentity?.scopes ?? [],
         tolerated: tolerated ?? [],
+        ...(resource === undefined ? {} : { resource }),
+        ...(issuer === undefined ? {} : { issuer }),
     };
     const capability = oauthCapabilityOf(common, {
         clientId,
@@ -510,6 +558,8 @@ export function oauthSpecOf(id, capability) {
             ...(flow.tolerated.length === 0
                 ? {}
                 : { tolerated: [...flow.tolerated] }),
+            ...(flow.resource === undefined ? {} : { resource: flow.resource }),
+            ...(flow.issuer === undefined ? {} : { issuer: flow.issuer }),
         },
         ...(capability.hint === undefined ? {} : { hint: capability.hint }),
         ...(capability.example === undefined

package/dist/internal/protocol.d.ts

@@ -102,19 +102,11 @@ export declare const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
 export declare const LINKED_DEV_HEADER = "x-everyapp-linked-dev";
 /** Where the gateway-lite serves the forwarder, under the app's own host. */
 export declare const LINKED_DEV_FORWARD_PATH = "/__everyapp/gateway";
-export type IdentityChannel = "web" | "api" | "mcp" | "agent";
-/**
- * The channels a tool call arrives on: `mcp` for an AI client's MCP
- * connection, `agent` for an agent principal the Gateway runs a call for.
- * Only the ToolBus mints either with a `tc` claim.
- */
-export declare const TOOL_CALL_CHANNELS: readonly IdentityChannel[];
-/** `act.sub` of an agent principal: `agent:<agt_id>`; `sub` stays its sponsor. */
-export declare const AGENT_ACTOR_PREFIX = "agent:";
+export type IdentityChannel = "web" | "api" | "mcp";
 export type IdentityTokenType = "user" | "public" | "system";
 /** What a system token may open. One purpose per token. */
 export type SystemTokenPurpose = "tools.list" | "events.deliver";
-/** The actor on whose behalf the request is made (user, MCP client, agent). */
+/** The actor on whose behalf the request is made (user, MCP client). */
 export interface IdentityActor {
     sub: string;
 }
@@ -141,16 +133,6 @@ export declare function toOrgRole(role: unknown): OrgRole;
 export declare function isAdmin(user: {
     orgRole: OrgRole | string;
 }): boolean;
-/**
- * Whether an agent principal made this call: `chan: "agent"` with
- * `act.sub` `agent:<agt_id>`. `user.id` is still the sponsoring member (the
- * person accountable for the agent), so key rows by it as for anyone;
- * `user.actor.sub` names the agent.
- */
-export declare function isAgentCall(user: {
-    channel: IdentityChannel;
-    actor: IdentityActor;
-}): boolean;
 export interface EveryAppUser {
     /** User id (the `sub` claim). */
     id: string;
@@ -167,15 +149,14 @@ export interface EveryAppUser {
     channel: IdentityChannel;
     /**
      * The acting principal: the user id, the credential acting for them
-     * (`pat:<id>`, `oauth:<id>`, `access:<email>`), or an agent
-     * (`agent:<agt_id>`, on `channel: "agent"`; {@link isAgentCall}).
+     * (`pat:<id>`, `oauth:<id>`, `access:<email>`).
      */
     actor: IdentityActor;
     scopes: string[];
     jti: string;
     /**
-     * Set only on a tool call (`channel: "mcp"` or `"agent"`): the one call
-     * this identity was minted for.
+     * Set only on a tool call (`channel: "mcp"`): the one call this
+     * identity was minted for.
      */
     toolCall?: ToolCallClaim;
 }

package/dist/internal/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAC7C,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAqB,CAAC;AAC/E,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;CACtB,GAAG,OAAO,CAMV;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB;;;;OAIG;IACH,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAehB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CAqCd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CA2Bd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU5D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA8BjB"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAC7C,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAEjE,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAEpE;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB;;;OAGG;IACH,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAehB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CAqCd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CA2Bd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU5D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

package/dist/internal/protocol.js

@@ -101,14 +101,6 @@ export const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
 export const LINKED_DEV_HEADER = "x-everyapp-linked-dev";
 /** Where the gateway-lite serves the forwarder, under the app's own host. */
 export const LINKED_DEV_FORWARD_PATH = "/__everyapp/gateway";
-/**
- * The channels a tool call arrives on: `mcp` for an AI client's MCP
- * connection, `agent` for an agent principal the Gateway runs a call for.
- * Only the ToolBus mints either with a `tc` claim.
- */
-export const TOOL_CALL_CHANNELS = ["mcp", "agent"];
-/** `act.sub` of an agent principal: `agent:<agt_id>`; `sub` stays its sponsor. */
-export const AGENT_ACTOR_PREFIX = "agent:";
 /** `role` as an {@link OrgRole}: `owner` and `admin` as they are, anything else `member`. */
 export function toOrgRole(role) {
     return role === "owner" || role === "admin" ? role : "member";
@@ -117,17 +109,6 @@ export function toOrgRole(role) {
 export function isAdmin(user) {
     return user.orgRole === "owner" || user.orgRole === "admin";
 }
-/**
- * Whether an agent principal made this call: `chan: "agent"` with
- * `act.sub` `agent:<agt_id>`. `user.id` is still the sponsoring member (the
- * person accountable for the agent), so key rows by it as for anyone;
- * `user.actor.sub` names the agent.
- */
-export function isAgentCall(user) {
-    return (user.channel === "agent" &&
-        user.actor.sub.startsWith(AGENT_ACTOR_PREFIX) &&
-        user.actor.sub.length > AGENT_ACTOR_PREFIX.length);
-}
 export class ProtocolClaimsError extends Error {
     constructor(message) {
         super(message);

package/dist/internal/providerRegistry.d.ts

@@ -45,9 +45,10 @@ export interface ProviderRow {
  * replacing a row's hosts or auth changes the key and the value it held
  * is no longer read until the operator sets it again. For an OAuth
  * provider the client is bound to its authorize, token and revoke URLs,
- * its API hosts, where the client goes on the token request and its
- * client setting names (`oauth.client-bound-to-endpoints`): an admin who
- * re-points `tokenUrl` has to paste the secret again.
+ * its API hosts, where the client goes on the token request, its client
+ * setting names, and its `resource` and `issuer` when it has them
+ * (`oauth.client-bound-to-endpoints`): an admin who re-points `tokenUrl`
+ * has to paste the secret again.
  */
 export declare function providerBindingKey(capability: RegistrableCapability): string;
 /** One registered row as `provider list` and `provider show` report it. */

package/dist/internal/providerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/internal/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CA2B5E;AAoBD,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,qBAAqB,CAAC;IAClC,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,mFAAmF;IACnF,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,8DAA8D;IAC9D,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C;AAOD,wHAAwH;AACxH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,GAClB,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,MAAM,GAAG,IAAI,CAwBf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE;IACP,oCAAoC;IACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GACA,UAAU,GAAG,IAAI,CAuBnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAqB5E;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;IACP,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GAEC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyCrC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,SAAS,WAAW,EAAO,EACjC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAqElB;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,EAAE,gBAAqC,CAAC"}
+{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/internal/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CAkC5E;AAoBD,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,qBAAqB,CAAC;IAClC,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,mFAAmF;IACnF,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,8DAA8D;IAC9D,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C;AAOD,wHAAwH;AACxH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,GAClB,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,MAAM,GAAG,IAAI,CAwBf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE;IACP,oCAAoC;IACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GACA,UAAU,GAAG,IAAI,CAuBnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAqB5E;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;IACP,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GAEC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyCrC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,SAAS,WAAW,EAAO,EACjC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAqElB;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,EAAE,gBAAqC,CAAC"}

package/dist/internal/providerRegistry.js

@@ -30,9 +30,10 @@ import { describeSpecProblems, parseProviderSpec, PROVIDER_ID, } from "./provide
  * replacing a row's hosts or auth changes the key and the value it held
  * is no longer read until the operator sets it again. For an OAuth
  * provider the client is bound to its authorize, token and revoke URLs,
- * its API hosts, where the client goes on the token request and its
- * client setting names (`oauth.client-bound-to-endpoints`): an admin who
- * re-points `tokenUrl` has to paste the secret again.
+ * its API hosts, where the client goes on the token request, its client
+ * setting names, and its `resource` and `issuer` when it has them
+ * (`oauth.client-bound-to-endpoints`): an admin who re-points `tokenUrl`
+ * has to paste the secret again.
  */
 export function providerBindingKey(capability) {
     if (capability.mode === "ai") {
@@ -54,6 +55,13 @@ export function providerBindingKey(capability) {
             clientId: capability.secrets.clientId,
             clientSecret: capability.secrets.clientSecret ?? null,
             hosts: [...capability.api].sort(),
+            // Only when present, so a row without them keeps the key it was bound to.
+            ...(capability.flow?.resource === undefined
+                ? {}
+                : { resource: capability.flow.resource }),
+            ...(capability.flow?.issuer === undefined
+                ? {}
+                : { issuer: capability.flow.issuer }),
         });
     }
     return JSON.stringify({

package/dist/internal/remoteMcp.d.ts

@@ -1,34 +1,65 @@
+/**
+ * Remote MCP apps: any remote MCP server registered on a gateway by URL
+ * (`everyapp mcp add <url>`, Admin → Apps → Add app → "Add an MCP server",
+ * `everyapp_mcp_add`), served to members' AI clients as an MCP app of the
+ * Gateway's own, like a built-in provider app (./providerApps.ts) but with
+ * its tools read from the server and each call forwarded to it
+ * (docs/design/2026-10-mcp-by-url.md, docs/design/2026-11-mcp-apps-auth.md).
+ *
+ * The registration record is the app row's manifest: `id`, `name`,
+ * `description` and a `remote` block ({@link RemoteMcpBlock}): the one URL
+ * the Gateway ever fetches, its credential ({@link RemoteMcpAuth}: none, or
+ * a provider of the registry, whose key or OAuth connection the Gateway
+ * holds and binds to the provider's hosts), how a tool's risk is decided
+ * when the server's annotations don't say, the operator's per-tool
+ * overrides, and a revision the writers bump so the Gateway re-lists the
+ * tools on first use after a change. An app with a provider also lists it
+ * under `capabilities` ({@link remoteMcpAppManifest}), so the settings
+ * model treats its key or client as any app's.
+ *
+ * A credential the registrar gives at `mcp add` becomes a provider row of
+ * the app's own, `<appId>-mcp` ({@link remoteMcpProviderId}; the specs are
+ * built in ./mcpOAuth.ts): an API-key row for a static value
+ * (`<APPID>_MCP_TOKEN`), a discovered `oauth2-user` row for OAuth
+ * (`<APPID>_MCP_CLIENT_ID`, `_SECRET`).
+ *
+ * Everything here is pure and shared by the CLI, the perimeter's registry
+ * rules, the Gateway (which serves the row and validates again at every
+ * fetch) and the settings model (./appSettings.ts), so the rules cannot
+ * drift: what the URL may be, what the credential may be, how a server's
+ * tool names become the ToolBus's, and what risk a tool gets.
+ */
+import { type Capability, type CapabilitySettings } from "./capabilities.js";
 import { type ToolRisk } from "./tools.js";
-export declare const REMOTE_MCP_AUTH_KINDS: readonly ["none", "bearer", "header", "basic", "oauth"];
+/** The kinds a stored `remote.auth` block may have. */
+export declare const REMOTE_MCP_AUTH_KINDS: readonly ["none", "provider"];
 export type RemoteMcpAuthKind = (typeof REMOTE_MCP_AUTH_KINDS)[number];
 /**
- * How the Gateway authenticates to the server. `secret` is the name of
- * the Gateway setting holding the value ({@link remoteMcpSecretName}),
- * never the value. `oauth` is recorded so the app can say what the server
- * wants; it is not served (the design's section 10).
+ * How the Gateway authenticates to the server: nothing, or a provider of
+ * the registry (a catalog entry such as `elevenlabs`, a registered row, or
+ * the row `everyapp mcp add` synthesizes for the app,
+ * {@link remoteMcpProviderId}). The credential lives with the provider and
+ * is bound to its hosts (`providers.value-bound-to-hosts`); the block only
+ * names it. With an OAuth provider each member connects their own
+ * account in the app.
  */
 export type RemoteMcpAuth = {
     kind: "none";
-}
-/** `Authorization: Bearer <value>`. */
- | {
-    kind: "bearer";
-    secret: string;
-}
-/** `<header>: <prefix><value>`. */
- | {
-    kind: "header";
-    secret: string;
-    header: string;
-    prefix?: string;
-}
-/** The value is `user:password`; sent as `Authorization: Basic <base64>`. */
- | {
-    kind: "basic";
-    secret: string;
 } | {
-    kind: "oauth";
+    kind: "provider";
+    provider: string;
 };
+/**
+ * What the registrar may ask for at `mcp add` (`--auth`): none, a static
+ * credential the add turns into a synthesized API-key provider row, or
+ * OAuth, a discovered `oauth2-user` row (./mcpOAuth.ts).
+ */
+export declare const REMOTE_MCP_CREDENTIAL_KINDS: readonly ["none", "bearer", "header", "query", "basic", "oauth"];
+export type RemoteMcpCredentialKind = (typeof REMOTE_MCP_CREDENTIAL_KINDS)[number];
+/** The static credential kinds: one value, placed as the synthesized row's `auth` says. */
+export type RemoteMcpStaticKind = Exclude<RemoteMcpCredentialKind, "none" | "oauth">;
+/** Why an old registration (`bearer`, `header`, `basic`, `oauth` with a `secret`) no longer parses. */
+export declare const REMOTE_MCP_AUTH_PREDATES = "this registration predates provider credentials; remove it and add it again";
 /**
  * How a tool's risk is decided for the app. `annotations`: from the
  * server's hints ({@link remoteToolRisk}); `read` or `write`: every tool,
@@ -57,13 +88,55 @@ export interface RemoteMcpManifest {
     name: string;
     description: string;
     remote: RemoteMcpBlock;
+    /** The provider the app's credential is, listed as a deployed app lists one ({@link remoteMcpAppManifest}). */
+    capabilities?: Record<string, RemoteMcpCapabilityEntry>;
 }
 /** The manifest fields the Gateway reads, as a stored manifest has them. */
 export interface RemoteMcpManifestLike {
     readonly remote?: unknown;
 }
-/** The default credential name for an app id: `treg` → `TREG_MCP_TOKEN`. */
-export declare function remoteMcpSecretName(id: string): string;
+/**
+ * Why `header` can't carry a remote MCP server's static credential, or
+ * null when it can: an HTTP header name the MCP transport and the Gateway
+ * don't set themselves.
+ */
+export declare function remoteMcpHeaderProblem(header: unknown): string | null;
+/**
+ * The provider row `everyapp mcp add` writes for an app's own credential:
+ * `<appId>-mcp` (`treg` → `treg-mcp`), its settings `TREG_MCP_*`.
+ */
+export declare function remoteMcpProviderId(appId: string): string;
+/** Whether `providerId` is `appId`'s synthesized row ({@link remoteMcpProviderId}). */
+export declare function isRemoteMcpProviderIdOf(providerId: string, appId: string): boolean;
+/** The static credential's setting on the synthesized row: `treg` → `TREG_MCP_TOKEN`. */
+export declare function remoteMcpTokenSetting(appId: string): string;
+/** The OAuth client id's setting on the synthesized row: `treg` → `TREG_MCP_CLIENT_ID`. */
+export declare function remoteMcpClientIdSetting(appId: string): string;
+/** The OAuth client secret's setting on the synthesized row: `treg` → `TREG_MCP_CLIENT_SECRET`. */
+export declare function remoteMcpClientSecretSetting(appId: string): string;
+/**
+ * The redirect URI of an app's synthesized OAuth row, what a server's
+ * client is registered with: `<gateway origin>/connect/<appId>-mcp/callback`.
+ */
+export declare function remoteMcpRedirectUri(gatewayUrl: string, appId: string): string;
+/** Where the Gateway serves its OAuth client metadata documents (public, bypassed behind Access). */
+export declare const REMOTE_MCP_CLIENT_METADATA_PREFIX = "/oauth-clients/";
+/**
+ * The Gateway's client id at a server that takes OAuth client ID metadata
+ * documents (CIMD) instead of registration: the URL of the document that
+ * describes the client, `<gateway origin>/oauth-clients/<appId>-mcp`.
+ * Null for a Gateway that isn't on https (a local one): an authorization
+ * server fetches the document, and only from https.
+ */
+export declare function remoteMcpClientMetadataUrl(gatewayUrl: string, appId: string): string | null;
+/**
+ * The hosts a provider sends its credential to, the hosts an MCP URL
+ * using it must be on: an API-key provider's `hosts` (and its host
+ * setting's value, given `settings`), an OAuth provider's API hosts. Null
+ * for a provider a remote MCP app can't use: an AI provider, a service,
+ * or an OAuth client the Gateway runs no flow for.
+ */
+export declare function remoteMcpProviderHosts(capability: Capability, settings?: CapabilitySettings): string[] | null;
 /** Whether `id` can be a remote MCP app's id (kebab-case, at most 32, not reserved, not a built-in's). */
 export declare function remoteMcpIdProblem(id: string): string | null;
 /**
@@ -88,14 +161,25 @@ export declare function reservedUpstreamHosts(): string[];
  * `https:` (or `http:` and loopback hosts only while the Gateway itself
  * runs on `http://`, local dev), a host name rather than an address, no
  * credentials or fragment in it, not the Gateway's own origin or one of
- * its app hosts, and not a provider whose key the Gateway holds. The
- * Gateway checks the stored URL again before every fetch, so a row edited
- * by hand is refused the same way.
- */
-export declare function remoteMcpUrlProblem(url: string, env: RemoteMcpUrlEnv): string | null;
-/** The credential name's problem, or null: in the family, and bounded. */
-export declare function remoteMcpSecretProblem(name: unknown): string | null;
-/** The auth block's problem, or the block as typed. */
+ * its app hosts, and not a provider whose key the Gateway holds
+ * ({@link reservedUpstreamHosts}) unless the app names that provider:
+ * `providerHosts` are the hosts of the provider the app's credential is
+ * (never an app's own synthesized row), and a reserved host among them is
+ * allowed (`mcp add https://api.elevenlabs.io/v1/mcp --provider
+ * elevenlabs`). The Gateway's own origin, its app domains and IPs stay
+ * refused always. The Gateway checks the stored URL again before every
+ * fetch, so a row edited by hand is refused the same way.
+ */
+export declare function remoteMcpUrlProblem(url: string, env: RemoteMcpUrlEnv, options?: {
+    providerHosts?: readonly string[];
+}): string | null;
+/**
+ * The auth block's problem, or the block as typed: `{ kind: "none" }`,
+ * or `{ kind: "provider", provider }` naming a provider id. A
+ * block of the kinds before provider credentials (`bearer`, `header`,
+ * `basic`, `oauth`) is refused with {@link REMOTE_MCP_AUTH_PREDATES}: such
+ * a row serves nothing and reads as needing setup.
+ */
 export declare function parseRemoteMcpAuth(raw: unknown): {
     ok: true;
     auth: RemoteMcpAuth;
@@ -103,6 +187,8 @@ export declare function parseRemoteMcpAuth(raw: unknown): {
     ok: false;
     problem: string;
 };
+/** The provider the block names, or null for `none`. */
+export declare function remoteMcpProviderOf(auth: RemoteMcpAuth): string | null;
 /**
  * The `remote` block of a stored manifest, checked field by field (a row
  * edited by hand must not make the Gateway send a credential anywhere the
@@ -123,10 +209,14 @@ export declare function parseRemoteMcpBlock(raw: unknown): {
  * as needing setup, see app-setup).
  */
 export declare function remoteMcpOf(manifest: unknown): RemoteMcpBlock | null;
+/**
+ * Why a stored manifest's `remote` block can't be read, or null when it
+ * can or there is none: {@link REMOTE_MCP_AUTH_PREDATES} for a block from
+ * before provider credentials.
+ */
+export declare function remoteMcpBlockProblem(manifest: unknown): string | null;
 /** Whether a stored manifest declares a remote MCP server at all (well-formed or not). */
 export declare function hasRemoteMcpBlock(manifest: unknown): boolean;
-/** The credential's setting name the block declares, if its kind takes one. */
-export declare function remoteMcpSecretOf(auth: RemoteMcpAuth): string | null;
 /**
  * A description for a row that gave none: the server's origin, read as a
  * sentence. The origin only: a path or query may carry something the
@@ -143,23 +233,46 @@ export declare function remoteMcpDefaultDescription(name: string, url: string):
 export declare function remoteToolOverride(block: Pick<RemoteMcpBlock, "tools">, upstreamName: string): RemoteMcpToolOverride | undefined;
 /** Whether a server's tool name can travel in an HTTP header (`Mcp-Name`): visible ASCII, bounded. */
 export declare function isHeaderSafeToolName(name: string): boolean;
-/** The manifest a remote MCP app's row stores, from what the registrar gave. */
+/**
+ * The entry a remote MCP app's manifest lists its provider under
+ * (`capabilities`), as a deployed app lists one: `{ access, why }` for an
+ * API-key provider, `{ scopes, why }` for an OAuth one.
+ */
+export type RemoteMcpCapabilityEntry = {
+    access: "read";
+    why: string;
+} | {
+    scopes: string[];
+    why: string;
+};
+/**
+ * The manifest a remote MCP app's row stores, from what the registrar
+ * gave. An app with a provider credential lists the provider under
+ * `capabilities` like a deployed app that uses it, so the settings model
+ * (./appSettings.ts) asks for its key or client, `secret list` names it
+ * and the connect flow asks for its scopes: nothing about a remote app's
+ * credential is special there. `providerCapability` is the provider as
+ * the registry resolves it (the synthesized row's, before it is written);
+ * for an OAuth provider the entry lists `scopes`, the server's own scope
+ * strings the connect asks for (discovery's, or none: the server decides).
+ */
 export declare function remoteMcpAppManifest(input: {
     id: string;
     name?: string | null;
     description?: string | null;
     remote: RemoteMcpBlock;
+    providerCapability?: Capability | null;
+    /** An OAuth provider's scopes the connect asks for. */
+    scopes?: readonly string[] | null;
 }): RemoteMcpManifest;
 /** How a tool got its risk: the server's hint, the app's default, the operator's override, or the fallback. */
 export type RemoteToolRiskSource = "hint" | "app" | "override" | "default";
 /**
  * A tool's risk for the Gateway. An override wins; then the app's `read`
- * or `write` default; then the server's hints, read conservatively: an
- * explicit `readOnlyHint: true` is `read`, an explicit `destructiveHint:
- * true` is `destructive` (hidden until approvals exist), and anything
- * else, a missing hint included, is `write`. The spec's missing-means-true
- * default for `destructiveHint` is not followed: it would hide every
- * unhinted tool.
+ * or `write` default; then the server's hints: an explicit `readOnlyHint:
+ * true` is `read`, and anything else, a missing hint included, is `write`.
+ * A write tool keeps the server's `destructiveHint`, so clients still ask
+ * before calling it.
  */
 export declare function remoteToolRisk(hints: {
     readOnlyHint?: unknown;
@@ -179,10 +292,12 @@ export declare function remoteToolEnabled(block: Pick<RemoteMcpBlock, "tools">,
  */
 export declare function normalizeRemoteToolName(name: string): string | null;
 /**
- * The request headers that carry the credential for `auth`, from the
- * setting's value. The value never appears anywhere else.
+ * Plain words for how the app authenticates, for lists and dialogs. With
+ * the provider's capability as the registry resolves it: "bearer token",
+ * "header X-Api-Key", "query parameter key", "user and password" (an
+ * API-key provider; "<kind>, <provider>'s key" when the provider isn't
+ * the app's own synthesized row), or "OAuth, each member connects" (an
+ * OAuth provider). Without it, the provider's id.
  */
-export declare function remoteMcpAuthHeaders(auth: RemoteMcpAuth, value: string): Record<string, string>;
-/** Plain words for an auth kind, for lists and dialogs. */
-export declare function remoteMcpAuthLabel(auth: RemoteMcpAuth): string;
+export declare function remoteMcpAuthLabel(auth: RemoteMcpAuth, capability?: Capability | null): string;
 //# sourceMappingURL=remoteMcp.d.ts.map

package/dist/internal/remoteMcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remoteMcp.d.ts","sourceRoot":"","sources":["../../src/internal/remoteMcp.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAiC,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1E,eAAO,MAAM,qBAAqB,yDAMxB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,uCAAuC;GACrC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACpC,mCAAmC;GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACrE,6EAA6E;GAC3E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,2CAI3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC7C,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAmCD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA8B7D;AAED,MAAM,WAAW,eAAe;IAC9B,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAMD,oFAAoF;AACpF,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAehD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,eAAe,GACnB,MAAM,GAAG,IAAI,CAkEf;AAMD,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASnE;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAkDpE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAyEtE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAIpE;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAE5D;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQ7E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,EACpC,YAAY,EAAE,MAAM,GACnB,qBAAqB,GAAG,SAAS,CASnC;AAED,sGAAsG;AACtG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;CACxB,GAAG,iBAAiB,CAMpB;AAED,+GAA+G;AAC/G,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EACxE,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,EAC7C,YAAY,EAAE,MAAM,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAWlD;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,EACpC,YAAY,EAAE,MAAM,GACnB,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAenE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AASD,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAa9D"}
+{"version":3,"file":"remoteMcp.d.ts","sourceRoot":"","sources":["../../src/internal/remoteMcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAiC,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1E,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,+BAAgC,CAAC;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,kEAO9B,CAAC;AACX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/C,2FAA2F;AAC3F,MAAM,MAAM,mBAAmB,GAAG,OAAO,CACvC,uBAAuB,EACvB,MAAM,GAAG,OAAO,CACjB,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,wBAAwB,gFAC0C,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,2CAI3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC7C,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,+GAA+G;IAC/G,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;CACzD;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAmCD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQrE;AAOD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAET;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,2FAA2F;AAC3F,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,mGAAmG;AACnG,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,MAAM,CAQR;AAED,qGAAqG;AACrG,eAAO,MAAM,iCAAiC,oBAAoB,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,IAAI,CAUf;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,UAAU,EACtB,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,MAAM,EAAE,GAAG,IAAI,CAMjB;AAED,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA8B7D;AAED,MAAM,WAAW,eAAe;IAC9B,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAMD,oFAAoF;AACpF,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAehD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAClD,MAAM,GAAG,IAAI,CAqEf;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0CpE;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAEtE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAyEtE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAItE;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQ7E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,EACpC,YAAY,EAAE,MAAM,GACnB,qBAAqB,GAAG,SAAS,CASnC;AAED,sGAAsG;AACtG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB,kBAAkB,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,uDAAuD;IACvD,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,GAAG,iBAAiB,CA4BpB;AAED,+GAA+G;AAC/G,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS,CAAC;AAE3E;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EACxE,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,EAC7C,YAAY,EAAE,MAAM,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CASlD;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,EACpC,YAAY,EAAE,MAAM,GACnB,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAenE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,GAC7B,MAAM,CAuBR"}