@every-app/sdk 0.3.0-rc.2 → 0.3.0-rc.4

package/dist/internal/catalog/index.d.ts

@@ -407,11 +407,20 @@ export declare const CATALOG_ENTRIES: {
         readonly docs: "https://platform.claude.com/settings/keys";
         readonly api: "https://platform.claude.com/docs/en/api/overview";
         readonly origin: "https://api.anthropic.com";
-        readonly inferenceRoutes: readonly ["/v1/messages", "/v1/messages/count_tokens"];
+        readonly inferenceRoutes: readonly ["/v1/messages", "/v1/messages/count_tokens", "/v1/chat/completions"];
+        readonly unstoredRoutes: readonly ["/v1/chat/completions"];
+        readonly shape: "anthropic";
+        readonly chat: {
+            readonly path: "/v1/chat/completions";
+            readonly model: "claude-haiku-5-5";
+        };
+        readonly aig: {
+            readonly slug: "anthropic";
+        };
         readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
         readonly secrets: readonly [{
             readonly name: "ANTHROPIC_API_KEY";
-            readonly hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
         }];
         readonly smoke: {
             readonly method: "GET";
@@ -442,6 +451,14 @@ export declare const CATALOG_ENTRIES: {
         readonly api: "https://ai.google.dev/gemini-api/docs/openai";
         readonly origin: "https://generativelanguage.googleapis.com";
         readonly inferenceRoutes: readonly ["/v1beta/openai/chat/completions", "/v1beta/openai/embeddings", "/v1beta/openai/images/generations"];
+        readonly chat: {
+            readonly path: "/v1beta/openai/chat/completions";
+            readonly model: "gemini-3.1-flash-lite";
+        };
+        readonly embeddings: {
+            readonly path: "/v1beta/openai/embeddings";
+            readonly model: "gemini-embedding-001";
+        };
         readonly hint: "An API key from Google AI Studio; the Gateway sends it as a bearer token. Apps call Gemini's OpenAI-shaped paths under /v1beta/openai.";
         readonly secrets: readonly [{
             readonly name: "GEMINI_API_KEY";
@@ -475,6 +492,17 @@ export declare const CATALOG_ENTRIES: {
         readonly api: "https://docs.mistral.ai/api/";
         readonly origin: "https://api.mistral.ai";
         readonly inferenceRoutes: readonly ["/v1/chat/completions", "/v1/fim/completions", "/v1/embeddings", "/v1/moderations", "/v1/chat/moderations", "/v1/classifications", "/v1/chat/classifications", "/v1/ocr", "/v1/audio/transcriptions", "/v1/audio/speech"];
+        readonly chat: {
+            readonly path: "/v1/chat/completions";
+            readonly model: "mistral-small-latest";
+        };
+        readonly embeddings: {
+            readonly path: "/v1/embeddings";
+            readonly model: "mistral-embed";
+        };
+        readonly aig: {
+            readonly slug: "mistral";
+        };
         readonly hint: "An API key from API Keys in the Mistral Studio console; the Gateway sends it as a bearer token. Free mode needs no card; usage and rate limits apply.";
         readonly secrets: readonly [{
             readonly name: "MISTRAL_API_KEY";
@@ -505,6 +533,14 @@ export declare const CATALOG_ENTRIES: {
         readonly api: "https://console.groq.com/docs/api-reference";
         readonly origin: "https://api.groq.com";
         readonly inferenceRoutes: readonly ["/openai/v1/chat/completions", "/openai/v1/responses", "/openai/v1/audio/transcriptions", "/openai/v1/audio/translations", "/openai/v1/audio/speech"];
+        readonly chat: {
+            readonly path: "/openai/v1/chat/completions";
+            readonly model: "openai/gpt-oss-20b";
+        };
+        readonly aig: {
+            readonly slug: "groq";
+            readonly trim: "/openai/v1";
+        };
         readonly hint: "An API key from the Groq console; the Gateway sends it as a bearer token. Apps call the OpenAI-shaped paths under /openai/v1.";
         readonly secrets: readonly [{
             readonly name: "GROQ_API_KEY";
@@ -538,6 +574,7 @@ export declare const CATALOG_ENTRIES: {
         readonly api: "https://docs.cohere.com/reference/about";
         readonly origin: "https://api.cohere.com";
         readonly inferenceRoutes: readonly ["/v2/chat", "/v2/embed", "/v2/rerank", "/v1/classify", "/v2/audio/transcriptions", "/v2/parse", "/v1/tokenize", "/v1/detokenize"];
+        readonly shape: "other";
         readonly hint: "An API key from the Cohere dashboard; the Gateway sends it as a bearer token. Trial keys are free and limited; production keys are paid.";
         readonly secrets: readonly [{
             readonly name: "COHERE_API_KEY";

package/dist/internal/catalog/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/internal/catalog/index.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMlB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/internal/catalog/index.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMlB,CAAC"}

package/dist/internal/catalog/inference.d.ts

@@ -10,11 +10,20 @@ export declare const INFERENCE: {
         readonly docs: "https://platform.claude.com/settings/keys";
         readonly api: "https://platform.claude.com/docs/en/api/overview";
         readonly origin: "https://api.anthropic.com";
-        readonly inferenceRoutes: readonly ["/v1/messages", "/v1/messages/count_tokens"];
+        readonly inferenceRoutes: readonly ["/v1/messages", "/v1/messages/count_tokens", "/v1/chat/completions"];
+        readonly unstoredRoutes: readonly ["/v1/chat/completions"];
+        readonly shape: "anthropic";
+        readonly chat: {
+            readonly path: "/v1/chat/completions";
+            readonly model: "claude-haiku-5-5";
+        };
+        readonly aig: {
+            readonly slug: "anthropic";
+        };
         readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
         readonly secrets: readonly [{
             readonly name: "ANTHROPIC_API_KEY";
-            readonly hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
         }];
         readonly smoke: {
             readonly method: "GET";
@@ -45,6 +54,14 @@ export declare const INFERENCE: {
         readonly api: "https://ai.google.dev/gemini-api/docs/openai";
         readonly origin: "https://generativelanguage.googleapis.com";
         readonly inferenceRoutes: readonly ["/v1beta/openai/chat/completions", "/v1beta/openai/embeddings", "/v1beta/openai/images/generations"];
+        readonly chat: {
+            readonly path: "/v1beta/openai/chat/completions";
+            readonly model: "gemini-3.1-flash-lite";
+        };
+        readonly embeddings: {
+            readonly path: "/v1beta/openai/embeddings";
+            readonly model: "gemini-embedding-001";
+        };
         readonly hint: "An API key from Google AI Studio; the Gateway sends it as a bearer token. Apps call Gemini's OpenAI-shaped paths under /v1beta/openai.";
         readonly secrets: readonly [{
             readonly name: "GEMINI_API_KEY";
@@ -78,6 +95,17 @@ export declare const INFERENCE: {
         readonly api: "https://docs.mistral.ai/api/";
         readonly origin: "https://api.mistral.ai";
         readonly inferenceRoutes: readonly ["/v1/chat/completions", "/v1/fim/completions", "/v1/embeddings", "/v1/moderations", "/v1/chat/moderations", "/v1/classifications", "/v1/chat/classifications", "/v1/ocr", "/v1/audio/transcriptions", "/v1/audio/speech"];
+        readonly chat: {
+            readonly path: "/v1/chat/completions";
+            readonly model: "mistral-small-latest";
+        };
+        readonly embeddings: {
+            readonly path: "/v1/embeddings";
+            readonly model: "mistral-embed";
+        };
+        readonly aig: {
+            readonly slug: "mistral";
+        };
         readonly hint: "An API key from API Keys in the Mistral Studio console; the Gateway sends it as a bearer token. Free mode needs no card; usage and rate limits apply.";
         readonly secrets: readonly [{
             readonly name: "MISTRAL_API_KEY";
@@ -108,6 +136,14 @@ export declare const INFERENCE: {
         readonly api: "https://console.groq.com/docs/api-reference";
         readonly origin: "https://api.groq.com";
         readonly inferenceRoutes: readonly ["/openai/v1/chat/completions", "/openai/v1/responses", "/openai/v1/audio/transcriptions", "/openai/v1/audio/translations", "/openai/v1/audio/speech"];
+        readonly chat: {
+            readonly path: "/openai/v1/chat/completions";
+            readonly model: "openai/gpt-oss-20b";
+        };
+        readonly aig: {
+            readonly slug: "groq";
+            readonly trim: "/openai/v1";
+        };
         readonly hint: "An API key from the Groq console; the Gateway sends it as a bearer token. Apps call the OpenAI-shaped paths under /openai/v1.";
         readonly secrets: readonly [{
             readonly name: "GROQ_API_KEY";
@@ -141,6 +177,7 @@ export declare const INFERENCE: {
         readonly api: "https://docs.cohere.com/reference/about";
         readonly origin: "https://api.cohere.com";
         readonly inferenceRoutes: readonly ["/v2/chat", "/v2/embed", "/v2/rerank", "/v1/classify", "/v2/audio/transcriptions", "/v2/parse", "/v1/tokenize", "/v1/detokenize"];
+        readonly shape: "other";
         readonly hint: "An API key from the Cohere dashboard; the Gateway sends it as a bearer token. Trial keys are free and limited; production keys are paid.";
         readonly secrets: readonly [{
             readonly name: "COHERE_API_KEY";

package/dist/internal/catalog/inference.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inference.d.ts","sourceRoot":"","sources":["../../../src/internal/catalog/inference.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkbsD,CAAC"}
+{"version":3,"file":"inference.d.ts","sourceRoot":"","sources":["../../../src/internal/catalog/inference.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkdsD,CAAC"}

package/dist/internal/catalog/inference.js

@@ -1,5 +1,5 @@
 export const INFERENCE = {
-    // Bearer is the documented header today; x-api-key is the legacy fallback. A workspace-scoped key keeps anthropic-workspace-id harmless.
+    // Bearer is the documented header today; x-api-key is the legacy fallback. The Gateway strips anthropic-workspace-id (and x-api-key), so the key alone decides the workspace.
     anthropic: {
         mode: "ai",
         label: "Anthropic",
@@ -11,12 +11,24 @@ export const INFERENCE = {
         docs: "https://platform.claude.com/settings/keys",
         api: "https://platform.claude.com/docs/en/api/overview",
         origin: "https://api.anthropic.com",
-        inferenceRoutes: ["/v1/messages", "/v1/messages/count_tokens"],
+        inferenceRoutes: [
+            "/v1/messages",
+            "/v1/messages/count_tokens",
+            // Anthropic's OpenAI-compatible chat completions (its docs: not a
+            // long-term solution; `strict` is ignored): what the default route
+            // maps onto when Anthropic is the Gateway's default.
+            "/v1/chat/completions",
+        ],
+        unstoredRoutes: ["/v1/chat/completions"],
+        // The Messages API is the shape an app pins `anthropic` for.
+        shape: "anthropic",
+        chat: { path: "/v1/chat/completions", model: "claude-haiku-5-5" },
+        aig: { slug: "anthropic" },
         hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.",
         secrets: [
             {
                 name: "ANTHROPIC_API_KEY",
-                hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.",
+                hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.",
             },
         ],
         smoke: {
@@ -52,6 +64,16 @@ export const INFERENCE = {
             "/v1beta/openai/embeddings",
             "/v1beta/openai/images/generations",
         ],
+        chat: {
+            path: "/v1beta/openai/chat/completions",
+            model: "gemini-3.1-flash-lite",
+        },
+        embeddings: {
+            path: "/v1beta/openai/embeddings",
+            model: "gemini-embedding-001",
+        },
+        // No `aig`: AI Gateway documents Google AI Studio's native form only
+        // (/v1/models/{model}:generateContent), not these OpenAI-shaped paths.
         hint: "An API key from Google AI Studio; the Gateway sends it as a bearer token. Apps call Gemini's OpenAI-shaped paths under /v1beta/openai.",
         secrets: [
             {
@@ -98,6 +120,9 @@ export const INFERENCE = {
             "/v1/audio/transcriptions",
             "/v1/audio/speech",
         ],
+        chat: { path: "/v1/chat/completions", model: "mistral-small-latest" },
+        embeddings: { path: "/v1/embeddings", model: "mistral-embed" },
+        aig: { slug: "mistral" },
         hint: "An API key from API Keys in the Mistral Studio console; the Gateway sends it as a bearer token. Free mode needs no card; usage and rate limits apply.",
         secrets: [
             {
@@ -136,6 +161,9 @@ export const INFERENCE = {
             "/openai/v1/audio/translations",
             "/openai/v1/audio/speech",
         ],
+        chat: { path: "/openai/v1/chat/completions", model: "openai/gpt-oss-20b" },
+        // AI Gateway's Groq endpoint takes the path without `/openai/v1`.
+        aig: { slug: "groq", trim: "/openai/v1" },
         hint: "An API key from the Groq console; the Gateway sends it as a bearer token. Apps call the OpenAI-shaped paths under /openai/v1.",
         secrets: [
             {
@@ -180,6 +208,10 @@ export const INFERENCE = {
             "/v1/tokenize",
             "/v1/detokenize",
         ],
+        // Cohere's own v2 shape: pinned by an app that speaks it, never the
+        // default (its OpenAI-compatible endpoint is on another host,
+        // api.cohere.ai). No `aig`: AI Gateway documents v1 paths only.
+        shape: "other",
         hint: "An API key from the Cohere dashboard; the Gateway sends it as a bearer token. Trial keys are free and limited; production keys are paid.",
         secrets: [
             {
@@ -388,7 +420,7 @@ export const INFERENCE = {
         },
         tags: ["ai", "images", "video", "audio"],
     },
-    // The router forwards X-HF-Bill-To as sent, so an app can bill any organization the token's user belongs to (TODO.md).
+    // The Gateway strips X-HF-Bill-To, so calls bill the token's own account, never another organization the token's user belongs to.
     huggingface: {
         mode: "api_key",
         label: "Hugging Face Inference",

package/dist/internal/devProviders.d.ts

@@ -16,7 +16,7 @@
  * doesn't parse is ignored until an app asks for its id, which then gets
  * a ConfigurationError naming the file.
  */
-import type { ApiKeyCapability } from "./capabilities.js";
+import { type RegistrableCapability } from "./providerSpec.js";
 /** The dev Worker's binding holding the specs (a copy is in ../cloudflare/worker.ts, kept in step by a test). */
 export declare const DEV_PROVIDERS_ENV = "EVERYAPP_DEV_PROVIDERS";
 /** Where the specs live in an app, relative to its directory. */
@@ -33,7 +33,7 @@ export declare function devProviderFile(id: string): string;
 /** A registered provider resolved for local development, or why it can't be. */
 export type DevProviderLookup = {
     found: true;
-    capability: ApiKeyCapability;
+    capability: RegistrableCapability;
     file: string;
 } | {
     found: false;

package/dist/internal/devProviders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devProviders.d.ts","sourceRoot":"","sources":["../../src/internal/devProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,iHAAiH;AACjH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,OAAO,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBtC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,EAAE,EAAE,MAAM,GACT,iBAAiB,CA+BnB"}
+{"version":3,"file":"devProviders.d.ts","sourceRoot":"","sources":["../../src/internal/devProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,iHAAiH;AACjH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,OAAO,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBtC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,EAAE,EAAE,MAAM,GACT,iBAAiB,CA+BnB"}

package/dist/internal/devProviders.js

@@ -1,4 +1,22 @@
-import { describeSpecProblems, parseProviderSpec } from "./providerSpec.js";
+/**
+ * A provider registered on a gateway, in local development
+ * (docs/design/2026-10-provider-registry.md, section 4). There is no
+ * gateway to ask in `everyapp dev`, so the spec comes from the app's
+ * directory: `everyapp provider add` (run in an app directory) and
+ * `everyapp provider show <id> --save` write it to
+ * `.everyapp/providers/<id>.json`, `everyAppWorker()` reads every such
+ * file when it builds the dev Worker and hands them over as one text
+ * binding, {@link DEV_PROVIDERS_ENV}, and `integrationFetch()`'s local
+ * fallback resolves an id outside the catalog from it, with the
+ * developer's own key from `.dev.vars` under the spec's setting names.
+ *
+ * The binding is JSON: `[{ "file": ".everyapp/providers/stripe.json",
+ * "spec": <the file's JSON, or its text when it isn't JSON> }]`. Each spec
+ * is parsed here, with the same parser `provider add` uses; one that
+ * doesn't parse is ignored until an app asks for its id, which then gets
+ * a ConfigurationError naming the file.
+ */
+import { describeSpecProblems, parseProviderSpec, } from "./providerSpec.js";
 /** The dev Worker's binding holding the specs (a copy is in ../cloudflare/worker.ts, kept in step by a test). */
 export const DEV_PROVIDERS_ENV = "EVERYAPP_DEV_PROVIDERS";
 /** Where the specs live in an app, relative to its directory. */

package/dist/internal/events.d.ts

@@ -9,7 +9,7 @@
  * apps/every-app-gateway/src/server/events/catalogue.ts; this module knows
  * the names, versions and one-line descriptions only.
  */
-export type EventGroup = "member" | "app" | "cap" | "tool" | "connection" | "token" | "access" | "signin_provider" | "mcp_app" | "provider" | "ping";
+export type EventGroup = "member" | "organization" | "app" | "cap" | "group" | "tool" | "connection" | "token" | "access" | "signin_provider" | "mcp_app" | "provider" | "subscription" | "ai" | "ping";
 export interface EventTypeInfo {
     /** `member.joined`, `cap.reached`, … */
     readonly type: string;
@@ -56,8 +56,19 @@ export declare const EVENT_SUBSCRIPTIONS_MAX = 25;
 /** A webhook signing secret's length. */
 export declare const EVENT_SECRET_MIN_LENGTH = 16;
 export declare const EVENT_SECRET_MAX_LENGTH = 128;
-/** Events and deliveries are kept this long. */
+/**
+ * Deliveries (the queue and its log) are kept this long. Events themselves
+ * are the audit log and live longer ({@link AUDIT_RETENTION_DAYS}).
+ */
 export declare const EVENT_RETENTION_DAYS = 30;
+/**
+ * Events are kept this long: Admin → Activity → Audit, `everyapp workspace
+ * audit` and `everyapp_workspace_audit` read them back. A constant, not a
+ * setting.
+ */
+export declare const AUDIT_RETENTION_DAYS = 90;
+/** The most audit rows one page carries, on every surface. */
+export declare const AUDIT_PAGE_MAX = 200;
 /** A subscription's URL. */
 export declare const EVENT_URL_MAX_LENGTH = 2048;
 /** A subscription's name. */

package/dist/internal/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/internal/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,KAAK,GACL,KAAK,GACL,MAAM,GACN,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,iBAAiB,GACjB,SAAS,GACT,UAAU,GACV,MAAM,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AASD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,aAAa,EAkD/C,CAAC;AAIF,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,QAA0C,CAAC;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWhE;AAED,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,QAAW,CAAC;AACjD,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAC9C,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,sCAAsC;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,yCAAyC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,gDAAgD;AAChD,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,6BAA6B;AAC7B,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AACF,eAAO,MAAM,2BAA2B,QAAmC,CAAC;AAC5E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,kDAAkD;AAClD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAWxD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,4CAA4C;AAC5C,eAAO,MAAM,WAAW,+BAAgC,CAAC;AACzD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,+BAAgC,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAM1E;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,OAAO,CAET;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAalE;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QACkE,CAAC;AAEtG,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3B,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,gBAAgB,CAAC,CAAC;AAqBvC;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,QAAQ,SAA2B,GAClC,cAAc,CAmDhB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uBAAuB;AACvB,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAY5C"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/internal/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,cAAc,GACd,KAAK,GACL,KAAK,GACL,OAAO,GACP,MAAM,GACN,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,iBAAiB,GACjB,SAAS,GACT,UAAU,GACV,cAAc,GACd,IAAI,GACJ,MAAM,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AASD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,aAAa,EAkI/C,CAAC;AAIF,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,QAA0C,CAAC;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWhE;AAED,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,QAAW,CAAC;AACjD,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAC9C,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,sCAAsC;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,yCAAyC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,8DAA8D;AAC9D,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,6BAA6B;AAC7B,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AACF,eAAO,MAAM,2BAA2B,QAAmC,CAAC;AAC5E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,kDAAkD;AAClD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAWxD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,4CAA4C;AAC5C,eAAO,MAAM,WAAW,+BAAgC,CAAC;AACzD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,+BAAgC,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAU1E;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,OAAO,CAET;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAalE;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QACkE,CAAC;AAEtG,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3B,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,gBAAgB,CAAC,CAAC;AAqBvC;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,QAAQ,SAA2B,GAClC,cAAc,CAmDhB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uBAAuB;AACvB,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAY5C"}

package/dist/internal/events.js

@@ -24,16 +24,29 @@ export const EVENT_TYPES = [
     entry("member", "member.reactivated", "A member was reactivated"),
     entry("member", "member.removed", "A member was removed"),
     entry("member", "member.password_reset", "A member reset their password"),
+    entry("member", "member.invitation_cancelled", "A pending invitation was cancelled"),
+    entry("organization", "organization.renamed", "The workspace was renamed"),
     entry("app", "app.installed", "An app was installed on the Gateway"),
     entry("app", "app.updated", "An app was redeployed"),
+    entry("app", "app.live", "An app went live on the Gateway"),
     entry("app", "app.removed", "An app was removed from the Gateway"),
     entry("app", "app.needs_setup", "An app needs a setting before it opens"),
     entry("app", "app.ready", "An app has every setting it needs"),
     entry("app", "app.paused_cap", "An app is paused: its monthly cap is reached"),
     entry("app", "app.tools_changed", "An app's AI tools changed"),
+    entry("app", "app.renamed", "An app's name or description changed"),
+    entry("app", "app.settings_changed", "An app's settings were set or unset (names only)"),
+    entry("app", "app.access_changed", "Who can open an app changed"),
+    entry("app", "app.email_changed", "An app's email senders or inbound changed"),
     entry("cap", "cap.warning", "An app is at 80% of its monthly cap"),
     entry("cap", "cap.reached", "An app reached its monthly cap"),
     entry("cap", "cap.raised", "An app's monthly cap, or the workspace default, was raised or removed"),
+    entry("cap", "cap.changed", "An app's monthly cap, or the workspace default, was set or lowered"),
+    entry("group", "group.created", "A group was created"),
+    entry("group", "group.updated", "A group was renamed or described"),
+    entry("group", "group.removed", "A group was removed"),
+    entry("group", "group.members_changed", "A group's members changed"),
+    entry("group", "group.apps_changed", "The apps a group opens changed"),
     entry("tool", "tool.blocked", "An AI client's tool call was blocked"),
     entry("tool", "tool.error", "An AI client's tool call failed"),
     entry("connection", "connection.created", "An AI app was connected"),
@@ -47,8 +60,19 @@ export const EVENT_TYPES = [
     entry("mcp_app", "mcp_app.removed", "An MCP app was removed"),
     entry("mcp_app", "mcp_app.enabled", "An MCP app is being served again"),
     entry("mcp_app", "mcp_app.disabled", "An MCP app stopped being served"),
-    entry("provider", "provider.added", "An API provider was registered"),
-    entry("provider", "provider.removed", "An API provider was removed"),
+    entry("mcp_app", "mcp_app.updated", "An MCP app's risk default, name or description changed"),
+    entry("mcp_app", "mcp_app.tool_changed", "One tool of an MCP app was overridden: its risk, or on/off"),
+    entry("provider", "provider.added", "A provider was registered"),
+    entry("provider", "provider.removed", "A provider was removed"),
+    entry("provider", "provider.updated", "A provider's spec or OAuth client was replaced"),
+    entry("provider", "provider.connected", "Someone connected an account at an OAuth provider"),
+    entry("provider", "provider.disconnected", "An OAuth provider account was disconnected"),
+    entry("provider", "provider.connection_expired", "An OAuth provider refused to refresh a connection; it needs reconnecting"),
+    entry("subscription", "subscription.created", "An event subscription was added"),
+    entry("subscription", "subscription.updated", "An event subscription was changed, paused or resumed"),
+    entry("subscription", "subscription.removed", "An event subscription was removed"),
+    entry("subscription", "subscription.redelivered", "A delivery was queued again by hand"),
+    entry("ai", "ai.default_changed", "The default model provider changed"),
     entry("ping", "ping", "A test event, sent to one subscription on request"),
 ];
 const typesByName = new Map(EVENT_TYPES.map((info) => [info.type, info]));
@@ -101,8 +125,19 @@ export const EVENT_SUBSCRIPTIONS_MAX = 25;
 /** A webhook signing secret's length. */
 export const EVENT_SECRET_MIN_LENGTH = 16;
 export const EVENT_SECRET_MAX_LENGTH = 128;
-/** Events and deliveries are kept this long. */
+/**
+ * Deliveries (the queue and its log) are kept this long. Events themselves
+ * are the audit log and live longer ({@link AUDIT_RETENTION_DAYS}).
+ */
 export const EVENT_RETENTION_DAYS = 30;
+/**
+ * Events are kept this long: Admin → Activity → Audit, `everyapp workspace
+ * audit` and `everyapp_workspace_audit` read them back. A constant, not a
+ * setting.
+ */
+export const AUDIT_RETENTION_DAYS = 90;
+/** The most audit rows one page carries, on every surface. */
+export const AUDIT_PAGE_MAX = 200;
 /** A subscription's URL. */
 export const EVENT_URL_MAX_LENGTH = 2048;
 /** A subscription's name. */
@@ -174,8 +209,11 @@ export const EVENT_EMAIL_RECIPIENTS = ["owners", "admins"];
  * gateway's app events and every app's own.
  */
 export function eventPatternMatches(pattern, type) {
+    // Everything but a test ping and the bus's own housekeeping: a webhook
+    // hears about subscriptions only when it names `subscription.*`, so a
+    // catch-all's first delivery is the event it was made for, not itself.
     if (pattern === "*")
-        return type !== "ping";
+        return type !== "ping" && !type.startsWith("subscription.");
     if (pattern.endsWith(".*")) {
         return type.startsWith(pattern.slice(0, -1));
     }

package/dist/internal/identity.d.ts

@@ -1,5 +1,5 @@
-import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, type SystemClaims, type SystemTokenPurpose } from "./protocol.js";
-export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, };
+import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, type SystemClaims, type SystemTokenPurpose } from "./protocol.js";
+export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, };
 export declare class IdentityError extends Error {
     readonly status = 401;
     constructor(message: string);
@@ -35,6 +35,25 @@ export interface VerifyOptions {
  * claims).
  */
 export declare function verifyIdentityJwt(token: string, options: VerifyOptions): Promise<EveryAppUser>;
+/** A verified identity, with when it stops being one. */
+export interface VerifiedIdentity {
+    user: EveryAppUser;
+    /** The token's `exp`, in epoch milliseconds. */
+    expiresAt: number;
+}
+/**
+ * {@link verifyIdentityJwt}, keeping the token's expiry: the SDK's request
+ * context stops forwarding an identity shortly before it, and goes on as
+ * the organization's background work.
+ */
+export declare function verifyIdentity(token: string, options: VerifyOptions): Promise<VerifiedIdentity>;
+/**
+ * The organization pin: a deployed Worker serves one organization
+ * (`EVERY_APP_ORG_ID`), and an identity for any other is refused, whatever
+ * its audience says. Throws {@link IdentityError} on a mismatch; a Worker
+ * with no pin (a shared app's) accepts every organization.
+ */
+export declare function assertOrganizationPin(user: EveryAppUser, organizationId: string | undefined): void;
 /**
  * Verify the gateway's system token (the value of `x-everyapp-system`)
  * fail-closed, for exactly one purpose. A user identity or public marker is
@@ -56,9 +75,16 @@ export interface IdentityResult {
     user: EveryAppUser | null;
     /** True when the gateway marked this request as a public route. */
     isPublic: boolean;
+    /** When the identity expires (epoch ms); null on a public route. */
+    expiresAt: number | null;
 }
 export interface RequestIdentityOptions {
     audience: string;
+    /**
+     * The organization this Worker is pinned to ({@link ORG_ID_ENV}): an
+     * identity for another is refused. Undefined accepts every organization.
+     */
+    organizationId?: string;
     /** Provide keys directly, or let {@link getIdentityFromRequest} read env. */
     publicKeys?: string[];
     /** Env bag to read {@link PUBLIC_KEYS_ENV} / {@link DEV_ENV} from. */
@@ -84,5 +110,5 @@ export declare function resolveVerifyOptions(options: RequestIdentityOptions): V
  * problem — including a bare/forged public header — so a re-exposed worker
  * fails closed.
  */
-export declare function getIdentityFromRequest(request: Request, options: RequestIdentityOptions): Promise<IdentityResult>;
+export declare function getIdentityFromRequest(request: Request | Headers, options: RequestIdentityOptions): Promise<IdentityResult>;
 //# sourceMappingURL=identity.d.ts.map

package/dist/internal/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/internal/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EAKjB,KAAK,YAAY,EACjB,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,CA8B7E;AAYD,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAeD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACvD,OAAO,CAAC,YAAY,CAAC,CAUvB;AAoED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,aAAa,CAwBf;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAiBzB"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/internal/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EAKjB,KAAK,YAAY,EACjB,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,CA8B7E;AAYD,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAeD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAY3B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAMN;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACvD,OAAO,CAAC,YAAY,CAAC,CAUvB;AAoED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,aAAa,CAwBf;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAmBzB"}

package/dist/internal/identity.js

@@ -9,8 +9,8 @@
  * survives verification produces a user.
  */
 import { importSPKI, jwtVerify, decodeProtectedHeader, } from "jose";
-import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, assertPublicMarkerClaims, assertSystemClaims, identityClaimsToEveryAppUser, ProtocolClaimsError, } from "./protocol.js";
-export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, };
+import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, assertPublicMarkerClaims, assertSystemClaims, identityClaimsToEveryAppUser, ProtocolClaimsError, } from "./protocol.js";
+export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, };
 export class IdentityError extends Error {
     status = 401;
     constructor(message) {
@@ -81,9 +81,19 @@ function assertDevIssuer(options) {
  * claims).
  */
 export async function verifyIdentityJwt(token, options) {
+    return (await verifyIdentity(token, options)).user;
+}
+/**
+ * {@link verifyIdentityJwt}, keeping the token's expiry: the SDK's request
+ * context stops forwarding an identity shortly before it, and goes on as
+ * the organization's background work.
+ */
+export async function verifyIdentity(token, options) {
     const payload = await verifyPinnedJwt(token, options, "user");
     try {
-        return identityClaimsToEveryAppUser(payload);
+        const user = identityClaimsToEveryAppUser(payload);
+        // `exp` is a required claim (verifyPinnedJwt); jose checked it.
+        return { user, expiresAt: payload.exp * 1000 };
     }
     catch (error) {
         if (error instanceof ProtocolClaimsError) {
@@ -92,6 +102,17 @@ export async function verifyIdentityJwt(token, options) {
         throw error;
     }
 }
+/**
+ * The organization pin: a deployed Worker serves one organization
+ * (`EVERY_APP_ORG_ID`), and an identity for any other is refused, whatever
+ * its audience says. Throws {@link IdentityError} on a mismatch; a Worker
+ * with no pin (a shared app's) accepts every organization.
+ */
+export function assertOrganizationPin(user, organizationId) {
+    if (organizationId && user.orgId !== organizationId) {
+        throw new IdentityError(`identity is for organization "${user.orgId}", and this Worker serves organization "${organizationId}" (${ORG_ID_ENV})`);
+    }
+}
 /**
  * Verify the gateway's system token (the value of `x-everyapp-system`)
  * fail-closed, for exactly one purpose. A user identity or public marker is
@@ -137,7 +158,7 @@ async function verifyPinnedJwt(token, options, expectedTyp) {
         throw new IdentityError(`unexpected kid "${header.kid}"`);
     }
     if (expectedTyp !== "public" && !options.issuer) {
-        throw new IdentityError(`${ISSUER_ENV} not configured — deploy with the Every App CLI or provide an explicit issuer.`);
+        throw new IdentityError(`${ISSUER_ENV} not configured — deploy with the EveryApp CLI or provide an explicit issuer.`);
     }
     const verifyOpts = {
         algorithms: [IDENTITY_ALG],
@@ -217,15 +238,22 @@ export function resolveVerifyOptions(options) {
  */
 export async function getIdentityFromRequest(request, options) {
     const verifyOptions = resolveVerifyOptions(options);
-    const publicMarker = request.headers.get(PUBLIC_HEADER);
+    const headers = isRequestLike(request) ? request.headers : request;
+    const publicMarker = headers.get(PUBLIC_HEADER);
     if (publicMarker) {
         await verifyPublicMarkerJwt(publicMarker, verifyOptions);
-        return { user: null, isPublic: true };
+        return { user: null, isPublic: true, expiresAt: null };
     }
-    const token = request.headers.get(IDENTITY_HEADER);
+    const token = headers.get(IDENTITY_HEADER);
     if (!token) {
         throw new IdentityError("request reached the app without an identity token (not proxied through the gateway?)");
     }
-    const user = await verifyIdentityJwt(token, verifyOptions);
-    return { user, isPublic: false };
+    const { user, expiresAt } = await verifyIdentity(token, verifyOptions);
+    assertOrganizationPin(user, options.organizationId);
+    return { user, isPublic: false, expiresAt };
+}
+// Duck-typed: a Request from another realm (a test runner, a polyfill) still
+// carries its headers the same way.
+function isRequestLike(value) {
+    return "headers" in value && typeof value.headers?.get === "function";
 }