@every-app/sdk 0.3.0-rc.3 → 0.3.0-rc.4

package/dist/server/integrationFetch.js

@@ -1,5 +1,5 @@
 import { ACCOUNT_HEADER, CATALOG, ConfigurationError, GATEWAY_ERROR_HEADER, INTEGRATION_PROXY_PREFIX, OAUTH_TOKEN_BODY_LIMIT, allowedScopes, apiKeyHosts, authorizationFor, capabilitySettings, carriesToken, declaredScopeSets, describeTokenEndpoints, devProviderFile, grantedScopes, heldTokenCallAllowed, injectClientCredentials, integrationProxyPath, oauthClientCredentials, oauthClientOrigin, oauthReadMethods, oauthWriteMethods, providerSettingPrefix, requestedScopes, requestedTokenScopes, resolveDevProvider, rewriteTokenRequestScope, scopeExcess, tokenEndpointFor, tokenGrantType, EMAIL_SENDERS_ENV, chooseEmailProvider, parseEmailList, parseEmailSender, } from "../internal/index.js";
-import { applyAttribution, checkAttribution, } from "./attribution.js";
+import { applyAttribution, attributionFor, } from "./attribution.js";
 import { BINDING_ORIGIN, streamingRequest, } from "./gatewayFetch.js";
 /**
  * A `fetch` for one of the gateway's capabilities. Call the provider's real
@@ -23,9 +23,12 @@ import { BINDING_ORIGIN, streamingRequest, } from "./gatewayFetch.js";
  * provider show <id> --save` writes it), put on the call as the gateway's
  * spec says.
  */
-export function integrationFetch({ env, provider, for: target, account, }) {
+export function integrationFetch({ env, provider, for: explicitTarget, account, }) {
     const catalogEntry = fetchableCapability(provider);
-    checkAttribution(env, target, `integrationFetch("${provider}")`);
+    const what = `integrationFetch("${provider}")`;
+    // Checked now, so a call nobody's fails where the fetch is made; and
+    // again per call, where an identity may since have neared its expiry.
+    attributionFor(env, explicitTarget, what);
     const values = env;
     const binding = values["EVERY_APP_GATEWAY"];
     if (binding && typeof binding.fetch !== "function") {
@@ -55,6 +58,7 @@ export function integrationFetch({ env, provider, for: target, account, }) {
         throw new ConfigurationError(`${integration.label} is unavailable: deploy with the EVERY_APP_GATEWAY binding, or set ${names.join(", ")} in .dev.vars for local development.`);
     }
     return async (input, init) => {
+        const target = attributionFor(env, explicitTarget, what);
         const outbound = new Request(input, init);
         const upstream = new URL(outbound.url);
         const headers = new Headers(outbound.headers);
@@ -501,7 +505,8 @@ function stringValue(value) {
  * set up") up front instead of failing mid-task. An OAuth client's status
  * carries its public `clientId` for the authorize URL.
  */
-export async function integrationStatus({ env, provider, }) {
+export async function integrationStatus({ env, provider, for: explicitTarget, }) {
+    const target = attributionFor(env, explicitTarget, `integrationStatus("${String(provider)}")`);
     const values = env;
     const binding = values["EVERY_APP_GATEWAY"];
     // A provider registered on the gateway is the gateway's to answer for;
@@ -529,7 +534,18 @@ export async function integrationStatus({ env, provider, }) {
             ready: false,
         });
     if (binding && typeof binding.fetch === "function") {
-        const response = await binding.fetch(`${BINDING_ORIGIN}${INTEGRATION_PROXY_PREFIX}/${provider}`);
+        const statusUrl = `${BINDING_ORIGIN}${INTEGRATION_PROXY_PREFIX}/${provider}`;
+        let response;
+        if (target === undefined) {
+            response = await binding.fetch(statusUrl);
+        }
+        else {
+            // Whose status: the person's identity (their OAuth connection) or the
+            // organization's, as a call would carry it.
+            const headers = new Headers();
+            applyAttribution(headers, target);
+            response = await binding.fetch(statusUrl, { headers });
+        }
         if (!response.ok)
             return unavailable();
         return (await response.json());
@@ -685,6 +701,6 @@ export async function gatewayRefusal(response) {
         typeof body === "object" &&
         typeof body.message === "string"
         ? body.message
-        : `The Every App gateway refused the call (${code}).`;
+        : `The EveryApp gateway refused the call (${code}).`;
     return { status: response.status, code, message };
 }

package/dist/server/listMembers.d.ts

@@ -28,5 +28,5 @@ export interface ListMembersOptions {
  * for a request answers its signed-in user alone, and background work
  * answers no one.
  */
-export declare function listMembers({ env, for: target, }: ListMembersOptions): Promise<ListMembersResult>;
+export declare function listMembers({ env, for: explicitTarget, }: ListMembersOptions): Promise<ListMembersResult>;
 //# sourceMappingURL=listMembers.d.ts.map

package/dist/server/listMembers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listMembers.d.ts","sourceRoot":"","sources":["../../src/server/listMembers.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAK1B,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,EAChC,GAAG,EACH,GAAG,EAAE,MAAM,GACZ,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoBjD"}
+{"version":3,"file":"listMembers.d.ts","sourceRoot":"","sources":["../../src/server/listMembers.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAK1B,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,EAChC,GAAG,EACH,GAAG,EAAE,cAAc,GACpB,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoBjD"}

package/dist/server/listMembers.js

@@ -1,5 +1,5 @@
 import { ConfigurationError, serviceRoutePath, } from "../internal/index.js";
-import { applyAttribution, checkAttribution, isRequest, } from "./attribution.js";
+import { applyAttribution, attributionFor, isRequest, } from "./attribution.js";
 import { getEveryAppUser } from "./everyApp.js";
 import { BINDING_ORIGIN } from "./gatewayFetch.js";
 import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
@@ -19,8 +19,8 @@ import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
  * for a request answers its signed-in user alone, and background work
  * answers no one.
  */
-export async function listMembers({ env, for: target, }) {
-    checkAttribution(env, target, "listMembers");
+export async function listMembers({ env, for: explicitTarget, }) {
+    const target = attributionFor(env, explicitTarget, "listMembers");
     const values = env;
     const binding = values["EVERY_APP_GATEWAY"];
     if (binding) {
@@ -48,7 +48,7 @@ async function listThroughGateway(binding, target) {
         throw new GatewayRefusalError({
             status: response.status,
             code: "members_list_failed",
-            message: `The Every App gateway answered ${response.status} to the members list.`,
+            message: `The EveryApp gateway answered ${response.status} to the members list.`,
         });
     }
     return (await response.json());
@@ -64,11 +64,8 @@ async function listInDev(env, target) {
                 id: user.id,
                 email: user.email,
                 name: "",
-                role: memberRole(user.orgRole),
+                role: user.orgRole,
             },
         ],
     };
 }
-function memberRole(role) {
-    return role === "owner" || role === "admin" ? role : "member";
-}

package/dist/server/sendEmail.d.ts

@@ -35,5 +35,5 @@ export interface SendEmailOptions {
  * `.dev.vars` it goes out for real through Email Sending's REST API, from
  * the developer's own account.
  */
-export declare function sendEmail({ env, for: target, message, }: SendEmailOptions): Promise<SendEmailResult>;
+export declare function sendEmail({ env, for: explicitTarget, message, }: SendEmailOptions): Promise<SendEmailResult>;
 //# sourceMappingURL=sendEmail.d.ts.map

package/dist/server/sendEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sendEmail.d.ts","sourceRoot":"","sources":["../../src/server/sendEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,GAAG,EACH,GAAG,EAAE,MAAM,EACX,OAAO,GACR,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoB7C"}
+{"version":3,"file":"sendEmail.d.ts","sourceRoot":"","sources":["../../src/server/sendEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,GAAG,EACH,GAAG,EAAE,cAAc,EACnB,OAAO,GACR,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoB7C"}

package/dist/server/sendEmail.js

@@ -1,5 +1,5 @@
 import { ConfigurationError, EMAIL_SENDERS_ENV, emailDomain, emailProviderRefusal, emailRestBody, emailRestUrl, emailSenderRefusal, parseEmailList, parseEmailSender, parseSendEmailMessage, readEmailRestResponse, senderAllowed, serviceRoutePath, } from "../internal/index.js";
-import { applyAttribution, checkAttribution, } from "./attribution.js";
+import { applyAttribution, attributionFor, } from "./attribution.js";
 import { BINDING_ORIGIN } from "./gatewayFetch.js";
 import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
 /**
@@ -19,8 +19,8 @@ import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
  * `.dev.vars` it goes out for real through Email Sending's REST API, from
  * the developer's own account.
  */
-export async function sendEmail({ env, for: target, message, }) {
-    checkAttribution(env, target, "sendEmail");
+export async function sendEmail({ env, for: explicitTarget, message, }) {
+    const target = attributionFor(env, explicitTarget, "sendEmail");
     const values = env;
     const binding = values["EVERY_APP_GATEWAY"];
     if (binding) {
@@ -49,7 +49,7 @@ async function sendThroughGateway(binding, target, message) {
         throw new GatewayRefusalError({
             status: response.status,
             code: "email_send_failed",
-            message: `The Every App gateway answered ${response.status} to the send.`,
+            message: `The EveryApp gateway answered ${response.status} to the send.`,
         });
     }
     return (await response.json());

package/dist/server/toolsEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolsEndpoint.d.ts","sourceRoot":"","sources":["../../src/server/toolsEndpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAcL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAoFD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B"}
+{"version":3,"file":"toolsEndpoint.d.ts","sourceRoot":"","sources":["../../src/server/toolsEndpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAcL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAoFD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B"}

package/dist/server/toolsEndpoint.js

@@ -14,7 +14,8 @@
  * The perimeter also refuses these paths from outside and strips inbound
  * `x-everyapp-*` headers, so only the gateway's ToolBus ever reaches them.
  */
-import { ConfigurationError, IDENTITY_HEADER, IdentityError, SYSTEM_HEADER, TOOLS_CALL_PATH, TOOLS_LIST_PATH, TOOLS_PROTOCOL_VERSION, catalogHash, requiredScopeForRisk, resolveVerifyOptions, verifyIdentityJwt, verifySystemJwt, } from "../internal/index.js";
+import { ConfigurationError, IDENTITY_HEADER, IdentityError, SYSTEM_HEADER, TOOLS_CALL_PATH, TOOLS_LIST_PATH, TOOLS_PROTOCOL_VERSION, assertOrganizationPin, catalogHash, requiredScopeForRisk, resolveVerifyOptions, verifyIdentity, verifySystemJwt, } from "../internal/index.js";
+import { serveRequest } from "./context.js";
 import { SDK_VERSION, ToolError, toToolResult, toolSetInternals, validateWithSchema, } from "./tools.js";
 function toolsJson(status, body, headers = {}) {
     return Response.json(body, {
@@ -148,9 +149,12 @@ function parseCallRequest(body) {
     return { v: TOOLS_PROTOCOL_VERSION, name, arguments: args, callId };
 }
 async function callTool(request, env, ctx, verify, options) {
-    let user;
+    let user, expiresAt;
     try {
-        user = await verifyIdentityJwt(request.headers.get(IDENTITY_HEADER) ?? "", verify);
+        ({ user, expiresAt } = await verifyIdentity(request.headers.get(IDENTITY_HEADER) ?? "", verify));
+        // The same pin as the handler path: a call for another organization's
+        // install never runs a tool here.
+        assertOrganizationPin(user, options.identity.organizationId);
     }
     catch (error) {
         if (error instanceof IdentityError) {
@@ -194,13 +198,15 @@ async function callTool(request, env, ctx, verify, options) {
     });
     let result;
     try {
-        const value = await tool.handler(input.value, {
+        // The call runs in the request context like a page would: currentUser()
+        // is the caller, and its Gateway calls are attributed to them.
+        const value = await serveRequest({ request, user, expiresAt }, () => tool.handler(input.value, {
             user,
             env: env,
             ctx,
             request,
             callId: call.callId,
-        });
+        }));
         result = await toToolResult(tool, value);
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@every-app/sdk",
-  "version": "0.3.0-rc.3",
+  "version": "0.3.0-rc.4",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -30,28 +30,27 @@
     "dist",
     "README.md"
   ],
-  "peerDependencies": {
+  "scripts": {
+    "prebuild": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "build": "tsc -p tsconfig.build.json",
+    "types:check": "tsc --noEmit",
+    "format:check": "prettier --check .",
+    "format:write": "prettier . --write",
+    "test": "vitest run --silent",
+    "test:watch": "vitest",
+    "check:esm-relative-imports": "node ./scripts/check-esm-relative-imports.mjs"
+  },
+  "dependencies": {
     "jose": "^6.2.5"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20251014.0",
     "@types/node": "^22.18.13",
-    "jose": "^6.2.12",
     "prettier": "^3.6.2",
     "typescript": "^5.9.3",
     "vite": "^7.1.2",
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^3.2.6",
     "zod": "^4.2.0"
-  },
-  "scripts": {
-    "prebuild": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
-    "build": "tsc -p tsconfig.build.json",
-    "types:check": "tsc --noEmit",
-    "format:check": "prettier --check .",
-    "format:write": "prettier . --write",
-    "test": "vitest run --silent",
-    "test:watch": "vitest",
-    "check:esm-relative-imports": "node ./scripts/check-esm-relative-imports.mjs"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Every App, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.