@every-app/sdk 0.3.0-rc.4 → 0.3.0-rc.5

package/dist/server/gatewayFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatewayFetch.d.ts","sourceRoot":"","sources":["../../src/server/gatewayFetch.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,cAAc,sCAAsC,CAAC;AAGlE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,eAAe;IAC9B,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,eAAe,CAAC;IACrB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,GAAG,EACH,GAAG,EAAE,cAAc,GACpB,EAAE,yBAAyB,GAAG,OAAO,KAAK,CAuE1C;AAwCD,sFAAsF;AACtF,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAUT"}
+{"version":3,"file":"gatewayFetch.d.ts","sourceRoot":"","sources":["../../src/server/gatewayFetch.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,cAAc,sCAAsC,CAAC;AAGlE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE;AAeD,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACtD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,OAAO,KAAK,CAAC;AAsHhB,sFAAsF;AACtF,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAUT"}

package/dist/server/gatewayFetch.js

@@ -2,13 +2,8 @@ import { AI_DEFAULT_MODEL, AI_DEFAULT_PROVIDER, AI_DEFAULT_ROUTES, aiProviderSet
 import { applyAttribution, attributionFor, } from "./attribution.js";
 export const BINDING_ORIGIN = "http://every-app-gateway.internal";
 const AI_PROXY_PREFIX = "/api/ai/";
-/**
- * Create a fetch for the gateway's AI providers (`/api/ai/<provider>/…`),
- * backed by the private gateway service binding. In local dev only, the
- * developer's own provider key from `.dev.vars` is a direct-provider
- * fallback when no binding exists.
- */
-export function createGatewayFetch({ env, for: explicitTarget, }) {
+export function createGatewayFetch({ env: workerEnv, for: explicitTarget, optional = false, }) {
+    const env = workerEnv;
     // Checked now, so a call nobody's fails where the fetch is made; and
     // again per call, where an identity may since have neared its expiry.
     attributionFor(env, explicitTarget, "createGatewayFetch");
@@ -18,6 +13,8 @@ export function createGatewayFetch({ env, for: explicitTarget, }) {
         throw new ConfigurationError("EVERY_APP_GATEWAY is configured but is not a valid service binding.");
     }
     if (!binding && Object.keys(devProviders).length === 0) {
+        if (optional)
+            return null;
         throw new ConfigurationError(`AI gateway unavailable: deploy with the EVERY_APP_GATEWAY binding, or set the provider's key (${listOf(Object.values(DEV_AI_PROVIDERS).map((spec) => settingsNames(spec, "with")), "or")}) in .dev.vars for direct local development.`);
     }
     return async (input, init) => {

package/dist/server/gatewayUrl.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The Gateway's URL, with `path` on it: `gatewayUrl(env)` for the launcher,
+ * `gatewayUrl(env, "/admin/users")` for the page where owners and admins
+ * invite people.
+ *
+ * Read from `env.GATEWAY_URL`, which the deploy sets on every Worker of the
+ * app and `everyapp dev` sets to its local launcher, so the same link works
+ * in both. `env` is the Worker's env (any object; only `GATEWAY_URL` is
+ * read). Throws {@link ConfigurationError} when it is unset or not an http(s)
+ * URL: a Worker no deploy or `everyapp dev` built.
+ */
+export declare function gatewayUrl(env: object, path?: string): string;
+//# sourceMappingURL=gatewayUrl.d.ts.map

package/dist/server/gatewayUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatewayUrl.d.ts","sourceRoot":"","sources":["../../src/server/gatewayUrl.ts"],"names":[],"mappings":"AASA;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,MAAM,CAgB1D"}

package/dist/server/gatewayUrl.js

@@ -0,0 +1,34 @@
+/**
+ * `gatewayUrl()`: the one rule for a link from an app back to its Gateway
+ * ("‹ Every App", "Invite people", "Sign out").
+ */
+import { ConfigurationError } from "../internal/index.js";
+/** Where the Gateway is: the deploy sets it, and so does `everyapp dev`. */
+const GATEWAY_URL_ENV = "GATEWAY_URL";
+/**
+ * The Gateway's URL, with `path` on it: `gatewayUrl(env)` for the launcher,
+ * `gatewayUrl(env, "/admin/users")` for the page where owners and admins
+ * invite people.
+ *
+ * Read from `env.GATEWAY_URL`, which the deploy sets on every Worker of the
+ * app and `everyapp dev` sets to its local launcher, so the same link works
+ * in both. `env` is the Worker's env (any object; only `GATEWAY_URL` is
+ * read). Throws {@link ConfigurationError} when it is unset or not an http(s)
+ * URL: a Worker no deploy or `everyapp dev` built.
+ */
+export function gatewayUrl(env, path = "/") {
+    const value = env[GATEWAY_URL_ENV];
+    let base;
+    if (typeof value === "string" && value) {
+        try {
+            base = new URL(value);
+        }
+        catch {
+            base = undefined;
+        }
+    }
+    if (!base || (base.protocol !== "https:" && base.protocol !== "http:")) {
+        throw new ConfigurationError(`${GATEWAY_URL_ENV} is ${value ? "not an http(s) URL" : "unset"}: everyapp deploy and everyapp dev set it on the app's Worker.`);
+    }
+    return new URL(path, base.origin).toString();
+}

package/dist/server/index.d.ts

@@ -6,13 +6,19 @@
 export { ConfigurationError, IdentityError, everyApp, getEveryAppUser, hasScope, isAdmin, requireCurrentUser, requireEveryAppUser, type EveryAppOptions, type EveryAppManifestLike, type EveryAppHandler, type EveryAppUser, type IdentityResult, type OrgRole, } from "./everyApp.js";
 export { OrganizationMismatchError, RequestContextError, currentUser, withOrganization, } from "./context.js";
 export { AttributionError, type GatewayCallFor } from "./attribution.js";
+export { gatewayUrl } from "./gatewayUrl.js";
+export type { EveryAppEnv } from "./env.js";
+/** The header a Gateway refusal carries its code in; `gatewayRefusal()` reads the rest. */
+export { GATEWAY_ERROR_HEADER } from "../internal/protocol.js";
 export { authorizeUrl, type AuthorizeUrlOptions } from "./authorizeUrl.js";
 export { connectPath, connectUrl, type ConnectUrlOptions, } from "./connectUrl.js";
-export { createGatewayFetch, type CreateGatewayFetchOptions, type GatewayFetchEnv, } from "./gatewayFetch.js";
-export { ai, AI_DEFAULT_BASE_URL, type AiClient } from "./ai.js";
+export { createGatewayFetch, type CreateGatewayFetchOptions, } from "./gatewayFetch.js";
+export { ai, aiBaseUrl, providerBaseUrl, AI_DEFAULT_BASE_URL, type AiClient, } from "./ai.js";
 export { GatewayRefusalError, gatewayRefusal, devAccessTokenName, integrationFetch, integrationStatus, type EmailIntegrationStatus, type GatewayRefusal, type IntegrationFetchOptions, type IntegrationStatus, type IntegrationStatusOf, type OAuthClientIntegrationStatus, } from "./integrationFetch.js";
 export { nodeServerHandler, type NodeServer, type NodeServerHandlerOptions, } from "./nodeServer.js";
 export { sendEmail, type SendEmailOptions } from "./sendEmail.js";
+export { gatewayAiBinding, type GatewayAiBindingOptions } from "./aiBinding.js";
+export { gatewayEmailBinding, type GatewayEmailBindingMessage, type GatewayEmailBindingOptions, } from "./emailBinding.js";
 export { listMembers, type ListMembersOptions } from "./listMembers.js";
 export { emit, type EmitOptions } from "./emit.js";
 export type { ApiKeyCapabilityId, CapabilityId, OAuthClientCapabilityId, ConnectionAccount, EmailAddressInput, EmailAttachmentInput, SendEmailMessage, SendEmailResult, ListMembersResult, OrganizationMember, OrganizationMemberRole, EmitEventResult, } from "../internal/index.js";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,eAAe,EACf,QAAQ,EACR,OAAO,EACP,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,UAAU,EACV,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,SAAS,EACT,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,OAAO,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,eAAe,EACf,QAAQ,EACR,OAAO,EACP,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,2FAA2F;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,UAAU,EACV,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,EAAE,EACF,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,KAAK,QAAQ,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,SAAS,EACT,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,OAAO,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC"}

package/dist/server/index.js

@@ -6,13 +6,18 @@
 export { ConfigurationError, IdentityError, everyApp, getEveryAppUser, hasScope, isAdmin, requireCurrentUser, requireEveryAppUser, } from "./everyApp.js";
 export { OrganizationMismatchError, RequestContextError, currentUser, withOrganization, } from "./context.js";
 export { AttributionError } from "./attribution.js";
+export { gatewayUrl } from "./gatewayUrl.js";
+/** The header a Gateway refusal carries its code in; `gatewayRefusal()` reads the rest. */
+export { GATEWAY_ERROR_HEADER } from "../internal/protocol.js";
 export { authorizeUrl } from "./authorizeUrl.js";
 export { connectPath, connectUrl, } from "./connectUrl.js";
 export { createGatewayFetch, } from "./gatewayFetch.js";
-export { ai, AI_DEFAULT_BASE_URL } from "./ai.js";
+export { ai, aiBaseUrl, providerBaseUrl, AI_DEFAULT_BASE_URL, } from "./ai.js";
 export { GatewayRefusalError, gatewayRefusal, devAccessTokenName, integrationFetch, integrationStatus, } from "./integrationFetch.js";
 export { nodeServerHandler, } from "./nodeServer.js";
 export { sendEmail } from "./sendEmail.js";
+export { gatewayAiBinding } from "./aiBinding.js";
+export { gatewayEmailBinding, } from "./emailBinding.js";
 export { listMembers } from "./listMembers.js";
 export { emit } from "./emit.js";
 export { ToolError, defineTools, toolResult, } from "./tools.js";

package/dist/server/integrationFetch.d.ts

@@ -33,6 +33,14 @@ export interface IntegrationFetchOptions {
      * the default for background work). Sent as `x-everyapp-account`.
      */
     account?: ConnectionAccount;
+    /**
+     * `true`: answer null instead of throwing `ConfigurationError` when the
+     * provider is unavailable (no binding, and in local dev not its
+     * settings in `.dev.vars`), so a feature that can do without it checks
+     * for null. A wrong provider id, a binding that isn't one, and an
+     * attribution mistake still throw.
+     */
+    optional?: boolean;
 }
 /**
  * A `fetch` for one of the gateway's capabilities. Call the provider's real
@@ -56,7 +64,10 @@ export interface IntegrationFetchOptions {
  * provider show <id> --save` writes it), put on the call as the gateway's
  * spec says.
  */
-export declare function integrationFetch({ env, provider, for: explicitTarget, account, }: IntegrationFetchOptions): typeof fetch;
+export declare function integrationFetch(options: IntegrationFetchOptions & {
+    optional: true;
+}): typeof fetch | null;
+export declare function integrationFetch(options: IntegrationFetchOptions): typeof fetch;
 /**
  * The `.dev.vars` name of a held token for `provider` in local dev
  * (`GOOGLE_WORKSPACE_ACCESS_TOKEN`, `GITHUB_ACCESS_TOKEN`): a token the

package/dist/server/integrationFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrationFetch.d.ts","sourceRoot":"","sources":["../../src/server/integrationFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAgCL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAE1B,KAAK,uBAAuB,EAQ7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAO1B,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,EAAE,kBAAkB,GAAG,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,EACnB,OAAO,GACR,EAAE,uBAAuB,GAAG,OAAO,KAAK,CAyJxC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAwgBD,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GACpD,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;IAClC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,iBAAiB,CAAC;QAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,GACjE,sBAAsB,GACtB,CAAC,SAAS,uBAAuB,GAC/B,4BAA4B,GAC5B,iBAAiB,CAAC;AAExB;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,EACA,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAiFlC;AA0HD,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,cAAc;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc;CAMtD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAWhC"}
+{"version":3,"file":"integrationFetch.d.ts","sourceRoot":"","sources":["../../src/server/integrationFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAgCL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAE1B,KAAK,uBAAuB,EAQ7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAO1B,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,EAAE,kBAAkB,GAAG,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACpD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,KAAK,CAAC;AAmKhB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAwgBD,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GACpD,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;IAClC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,iBAAiB,CAAC;QAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,GACjE,sBAAsB,GACtB,CAAC,SAAS,uBAAuB,GAC/B,4BAA4B,GAC5B,iBAAiB,CAAC;AAExB;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,EACA,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAiFlC;AA0HD,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,cAAc;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc;CAMtD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAWhC"}

package/dist/server/integrationFetch.js

@@ -1,29 +1,7 @@
 import { ACCOUNT_HEADER, CATALOG, ConfigurationError, GATEWAY_ERROR_HEADER, INTEGRATION_PROXY_PREFIX, OAUTH_TOKEN_BODY_LIMIT, allowedScopes, apiKeyHosts, authorizationFor, capabilitySettings, carriesToken, declaredScopeSets, describeTokenEndpoints, devProviderFile, grantedScopes, heldTokenCallAllowed, injectClientCredentials, integrationProxyPath, oauthClientCredentials, oauthClientOrigin, oauthReadMethods, oauthWriteMethods, providerSettingPrefix, requestedScopes, requestedTokenScopes, resolveDevProvider, rewriteTokenRequestScope, scopeExcess, tokenEndpointFor, tokenGrantType, EMAIL_SENDERS_ENV, chooseEmailProvider, parseEmailList, parseEmailSender, } from "../internal/index.js";
 import { applyAttribution, attributionFor, } from "./attribution.js";
 import { BINDING_ORIGIN, streamingRequest, } from "./gatewayFetch.js";
-/**
- * A `fetch` for one of the gateway's capabilities. Call the provider's real
- * URLs (`https://api.dataforseo.com/v3/…`); this sends them over the
- * AppGateway binding, which checks the app's manifest lists the capability,
- * injects the key the gateway holds and forwards the call. The app never
- * sees the key. A refusal the gateway makes itself comes back as a response
- * {@link gatewayRefusal} recognizes; anything else is the provider's answer.
- *
- * For an OAuth client (`linkedin`, `mastodon`, ...) it reaches the
- * provider's token endpoints only, and the gateway puts its client on the
- * request: send the code (or refresh token) without `client_id` or
- * `client_secret`. Build the authorize URL with {@link authorizeUrl} from
- * {@link integrationStatus}, and call the provider's API with the user's
- * token directly.
- *
- * In local dev only, with no binding, the developer's own key or client
- * from `.dev.vars` reaches the provider directly, under the gateway's names:
- * a catalog provider's from the catalog, a provider registered on the
- * gateway from its spec in `.everyapp/providers/<id>.json` (`everyapp
- * provider show <id> --save` writes it), put on the call as the gateway's
- * spec says.
- */
-export function integrationFetch({ env, provider, for: explicitTarget, account, }) {
+export function integrationFetch({ env, provider, for: explicitTarget, account, optional = false, }) {
     const catalogEntry = fetchableCapability(provider);
     const what = `integrationFetch("${provider}")`;
     // Checked now, so a call nobody's fails where the fetch is made; and
@@ -49,6 +27,8 @@ export function integrationFetch({ env, provider, for: explicitTarget, account,
     // endpoint call without the client throws when it is made.
     const decidesLater = integration?.mode === "oauth_client" && integration.flow !== undefined;
     if (!binding && !local && !devToken && integration && !decidesLater) {
+        if (optional)
+            return null;
         const names = [
             ...capabilitySettings(integration),
             ...(integration.mode === "oauth_client" && integration.flow

package/dist/tanstack-start/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Puts the person the Gateway signed in on `context.user` (an
+ * `EveryAppUser`), verified from the identity the Gateway sent; throws the
+ * 401 Response when there is none (a public route, anonymous).
+ */
+export declare const ensureUserMiddleware: import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, {
+    user: import("../internal/protocol.js").EveryAppUser;
+}, undefined, undefined, undefined>;
+//# sourceMappingURL=index.d.ts.map

package/dist/tanstack-start/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tanstack-start/index.ts"],"names":[],"mappings":"AAmBA;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;mCAK/B,CAAC"}

package/dist/tanstack-start/index.js

@@ -0,0 +1,29 @@
+/**
+ * @every-app/sdk/tanstack-start — identity for a TanStack Start app's server
+ * functions:
+ *
+ *   import { ensureUserMiddleware } from "@every-app/sdk/tanstack-start";
+ *
+ *   export const getTodos = createServerFn()
+ *     .middleware([ensureUserMiddleware])
+ *     .handler(({ context: { user } }) => listTodos(user.id));
+ *
+ * The SDK lists `@tanstack/react-start` as a peer dependency, so the Start
+ * plugin compiles this module like the app's own: the `.server()` part never
+ * reaches the browser.
+ */
+import { createMiddleware } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { env } from "cloudflare:workers";
+import { requireEveryAppUser } from "../server/everyApp.js";
+/**
+ * Puts the person the Gateway signed in on `context.user` (an
+ * `EveryAppUser`), verified from the identity the Gateway sent; throws the
+ * 401 Response when there is none (a public route, anonymous).
+ */
+export const ensureUserMiddleware = createMiddleware({
+    type: "function",
+}).server(async ({ next }) => {
+    const user = await requireEveryAppUser(getRequest(), env);
+    return next({ context: { user } });
+});

package/dist/testing/index.d.ts

@@ -0,0 +1,93 @@
+import { IDENTITY_HEADER, type IdentityChannel, type ToolCallResultV1, type ToolsCallResponseV1, type ToolsListResponseV1 } from "../internal/index.js";
+import type { ToolSet } from "../server/tools.js";
+export { IDENTITY_HEADER };
+export type { ToolCallResultV1 as ToolCallResult, ToolsCallResponseV1 as ToolCallResponse, ToolsListResponseV1 as ToolsListResponse, };
+/** The person a test signs in; each field left out takes {@link TEST_USER}'s. */
+export interface TestUser {
+    id?: string;
+    email?: string;
+    orgId?: string;
+    /** `owner`, `admin` or `member`, as the Gateway signs it. */
+    orgRole?: string;
+}
+/** The person a test signs in by default: the owner of `org_test`. */
+export declare const TEST_USER: Readonly<Required<TestUser>>;
+/** The app id {@link testEnv} uses when none is given. */
+export declare const TEST_APP_ID = "test-app";
+/** What an identity is minted for, beside the person. */
+export interface TestIdentityOptions {
+    user?: TestUser;
+    /** The app the identity is for (the token's audience). Default: {@link TEST_APP_ID}. */
+    appId?: string;
+    /** Default `["*"]`: a browser session, which holds every scope. */
+    scopes?: string[];
+    /** Default `"web"`. */
+    channel?: IdentityChannel;
+}
+/**
+ * The Worker env `everyApp()` needs to trust test identities: the app id,
+ * the dev issuer and key, `EVERYAPP_DEV`, and a `GATEWAY_URL`. `overrides`
+ * adds the app's own bindings (a fake `DB`, a secret) or replaces any of
+ * these.
+ */
+export declare function testEnv<T extends object = Record<never, never>>(overrides?: {
+    appId?: string;
+} & T): {
+    EVERYAPP_APP_ID: string;
+    EVERYAPP_DEV: string;
+    EVERYAPP_IDENTITY_ISSUER: string;
+    EVERYAPP_IDENTITY_PUBLIC_KEYS: string;
+    GATEWAY_URL: string;
+} & Omit<T, "appId">;
+/**
+ * An `ExecutionContext` for calling a Worker's `fetch` in a test:
+ * `waitUntil` keeps each promise in `waited`, so a test can await them.
+ */
+export declare function testContext(): ExecutionContext & {
+    waited: Promise<unknown>[];
+};
+/** An identity token for `user`, as the Gateway sends in the identity header. */
+export declare function mintTestIdentity(options?: TestIdentityOptions & {
+    toolCall?: {
+        id: string;
+        name: string;
+    };
+}): Promise<string>;
+/**
+ * A request as the Gateway forwards it: `user` signed in (the default
+ * person when left out), or nobody with `user: null`, as on a public route.
+ */
+export declare function testRequest(input: string | URL, init?: RequestInit & Omit<TestIdentityOptions, "user"> & {
+    user?: TestUser | null;
+}): Promise<Request>;
+/** A Worker as `everyApp()` returns it. */
+export interface TestWorker {
+    fetch(request: Request, env: never, ctx: ExecutionContext): Response | Promise<Response>;
+}
+export interface CallToolOptions {
+    user?: TestUser;
+    /**
+     * The caller's scopes. Default: `mcp:read`, `mcp:write` and
+     * `mcp:destructive`, so every tool may be called; pass fewer to test a
+     * refusal.
+     */
+    scopes?: string[];
+    /** Default: {@link testEnv}() for the worker's app. */
+    env?: object;
+    ctx?: ExecutionContext;
+}
+/**
+ * Call one tool as the Gateway does for an AI client: a `chan: "mcp"`
+ * identity minted for this call, through the app's tools endpoint, so the
+ * SDK checks the scope, validates input and output and maps errors as it
+ * does deployed. `app` is the Worker `everyApp()` returned, or the
+ * `defineTools()` set alone. The answer is `{ result }`, or `{ error }`
+ * when the SDK refused the call.
+ */
+export declare function callTool(app: TestWorker | ToolSet, name: string, args?: Record<string, unknown>, options?: CallToolOptions): Promise<ToolsCallResponseV1>;
+/** The tool catalog, read as the Gateway reads it when the app deploys. */
+export declare function listTools(app: TestWorker | ToolSet, options?: {
+    env?: object;
+    ctx?: ExecutionContext;
+}): Promise<ToolsListResponseV1>;
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAuBA,OAAO,EAIL,eAAe,EASf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,YAAY,EACV,gBAAgB,IAAI,cAAc,EAClC,mBAAmB,IAAI,gBAAgB,EACvC,mBAAmB,IAAI,iBAAiB,GACzC,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sEAAsE;AACtE,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAKjD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,WAAW,aAAa,CAAC;AAEtC,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB;IACvB,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC7D,SAAS,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,CAAgC,GAC/D;IACD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB,EAAE,MAAM,CAAC;IACjC,6BAA6B,EAAE,MAAM,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAUnB;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,gBAAgB,GAAG;IAChD,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5B,CAQA;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CACpC,OAAO,GAAE,mBAAmB,GAAG;IAC7B,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACpC,GACL,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,GAAE,WAAW,GACf,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;CAAO,GACpE,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,gBAAgB,GACpB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,UAAU,GAAG,OAAO,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAwB9B;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAC7B,GAAG,EAAE,UAAU,GAAG,OAAO,EACzB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACrD,OAAO,CAAC,mBAAmB,CAAC,CAuB9B"}

package/dist/testing/index.js

@@ -0,0 +1,156 @@
+/**
+ * @every-app/sdk/testing — an app's tests, without a Gateway: a signed-in
+ * person for a request, and the tools called the way the Gateway calls them.
+ *
+ *   import { callTool, testContext, testEnv, testRequest } from "@every-app/sdk/testing";
+ *
+ *   const worker = everyApp(handler, { tools });
+ *   const response = await worker.fetch(
+ *     await testRequest("https://todo.test/api/todos", { user: { id: "ana" } }),
+ *     testEnv(),
+ *     testContext(),
+ *   );
+ *   const result = await callTool(worker, "list_todos", {}, { user: { id: "ana" } });
+ *
+ * Identities are signed with the well-known dev keypair, which `everyApp()`
+ * trusts only with `EVERYAPP_DEV` set, as {@link testEnv} sets it: never in a
+ * deployed Worker. For tests only; a Worker never imports this module.
+ */
+import { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "../dev/keypair.js";
+import { APP_ID_ENV, AUDIENCE_ENV, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, MCP_DESTRUCTIVE_SCOPE, MCP_READ_SCOPE, MCP_WRITE_SCOPE, SYSTEM_HEADER, TOOLS_CALL_PATH, TOOLS_LIST_PATH, mintIdentityJwt, mintSystemJwt, } from "../internal/index.js";
+import { everyApp } from "../server/everyApp.js";
+export { IDENTITY_HEADER };
+/** The person a test signs in by default: the owner of `org_test`. */
+export const TEST_USER = Object.freeze({
+    id: "user_test",
+    email: "test@example.com",
+    orgId: "org_test",
+    orgRole: "owner",
+});
+/** The app id {@link testEnv} uses when none is given. */
+export const TEST_APP_ID = "test-app";
+/**
+ * The Worker env `everyApp()` needs to trust test identities: the app id,
+ * the dev issuer and key, `EVERYAPP_DEV`, and a `GATEWAY_URL`. `overrides`
+ * adds the app's own bindings (a fake `DB`, a secret) or replaces any of
+ * these.
+ */
+export function testEnv(overrides = {}) {
+    const { appId = TEST_APP_ID, ...rest } = overrides;
+    return {
+        EVERYAPP_APP_ID: appId,
+        EVERYAPP_DEV: "1",
+        EVERYAPP_IDENTITY_ISSUER: DEV_ISSUER,
+        EVERYAPP_IDENTITY_PUBLIC_KEYS: JSON.stringify([DEV_PUBLIC_KEY_PEM]),
+        GATEWAY_URL: "https://gateway.test",
+        ...rest,
+    };
+}
+/**
+ * An `ExecutionContext` for calling a Worker's `fetch` in a test:
+ * `waitUntil` keeps each promise in `waited`, so a test can await them.
+ */
+export function testContext() {
+    const waited = [];
+    return {
+        waited,
+        waitUntil: (promise) => void waited.push(promise),
+        passThroughOnException: () => { },
+        props: {},
+    };
+}
+/** An identity token for `user`, as the Gateway sends in the identity header. */
+export async function mintTestIdentity(options = {}) {
+    const user = { ...TEST_USER, ...options.user };
+    return mintIdentityJwt(DEV_PRIVATE_KEY_PEM, {
+        subject: {
+            sub: user.id,
+            email: user.email,
+            orgId: user.orgId,
+            orgRole: user.orgRole,
+        },
+        audience: options.appId ?? TEST_APP_ID,
+        issuer: DEV_ISSUER,
+        keyId: IDENTITY_DEV_KEY_ID,
+        channel: options.channel,
+        scopes: options.scopes,
+        toolCall: options.toolCall,
+    });
+}
+/**
+ * A request as the Gateway forwards it: `user` signed in (the default
+ * person when left out), or nobody with `user: null`, as on a public route.
+ */
+export async function testRequest(input, init = {}) {
+    const { user, appId, scopes, channel, ...requestInit } = init;
+    const headers = new Headers(requestInit.headers);
+    if (user !== null) {
+        headers.set(IDENTITY_HEADER, await mintTestIdentity({ user, appId, scopes, channel }));
+    }
+    return new Request(input, { ...requestInit, headers });
+}
+/**
+ * Call one tool as the Gateway does for an AI client: a `chan: "mcp"`
+ * identity minted for this call, through the app's tools endpoint, so the
+ * SDK checks the scope, validates input and output and maps errors as it
+ * does deployed. `app` is the Worker `everyApp()` returned, or the
+ * `defineTools()` set alone. The answer is `{ result }`, or `{ error }`
+ * when the SDK refused the call.
+ */
+export async function callTool(app, name, args = {}, options = {}) {
+    const env = options.env ?? testEnv();
+    const callId = crypto.randomUUID();
+    const identity = await mintTestIdentity({
+        user: options.user,
+        appId: audienceOf(env),
+        channel: "mcp",
+        scopes: options.scopes ?? [
+            MCP_READ_SCOPE,
+            MCP_WRITE_SCOPE,
+            MCP_DESTRUCTIVE_SCOPE,
+        ],
+        toolCall: { id: callId, name },
+    });
+    const response = await workerOf(app).fetch(new Request(`https://app.test${TOOLS_CALL_PATH}`, {
+        method: "POST",
+        headers: { [IDENTITY_HEADER]: identity },
+        body: JSON.stringify({ v: 1, name, arguments: args, callId }),
+    }), env, options.ctx ?? testContext());
+    return (await response.json());
+}
+/** The tool catalog, read as the Gateway reads it when the app deploys. */
+export async function listTools(app, options = {}) {
+    const env = options.env ?? testEnv();
+    const token = await mintSystemJwt(DEV_PRIVATE_KEY_PEM, {
+        audience: audienceOf(env),
+        issuer: DEV_ISSUER,
+        purpose: "tools.list",
+        keyId: IDENTITY_DEV_KEY_ID,
+    });
+    const response = await workerOf(app).fetch(new Request(`https://app.test${TOOLS_LIST_PATH}`, {
+        method: "POST",
+        headers: { [SYSTEM_HEADER]: token },
+        body: JSON.stringify({ v: 1 }),
+    }), env, options.ctx ?? testContext());
+    if (!response.ok) {
+        throw new Error(`the tools list answered ${response.status}: ${await response.text()}`);
+    }
+    return (await response.json());
+}
+/** Who the app's identities are minted for: the deployed audience, else the app id. */
+function audienceOf(env) {
+    const values = env;
+    for (const key of [AUDIENCE_ENV, APP_ID_ENV]) {
+        const value = values[key];
+        if (typeof value === "string" && value)
+            return value;
+    }
+    return TEST_APP_ID;
+}
+function workerOf(app) {
+    if ("fetch" in app)
+        return app;
+    return everyApp(() => new Response("Not found", { status: 404 }), {
+        tools: app,
+    });
+}

package/package.json

@@ -1,9 +1,13 @@
 {
   "name": "@every-app/sdk",
-  "version": "0.3.0-rc.4",
+  "version": "0.3.0-rc.5",
   "license": "MIT",
   "type": "module",
   "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
     "./server": {
       "types": "./dist/server/index.d.ts",
       "default": "./dist/server/index.js"
@@ -24,27 +28,29 @@
       "types": "./dist/dev/index.d.ts",
       "default": "./dist/dev/index.js"
     },
+    "./tanstack-start": {
+      "types": "./dist/tanstack-start/index.d.ts",
+      "default": "./dist/tanstack-start/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "default": "./dist/testing/index.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [
     "dist",
     "README.md"
   ],
-  "scripts": {
-    "prebuild": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
-    "build": "tsc -p tsconfig.build.json",
-    "types:check": "tsc --noEmit",
-    "format:check": "prettier --check .",
-    "format:write": "prettier . --write",
-    "test": "vitest run --silent",
-    "test:watch": "vitest",
-    "check:esm-relative-imports": "node ./scripts/check-esm-relative-imports.mjs"
-  },
   "dependencies": {
     "jose": "^6.2.5"
   },
+  "peerDependencies": {
+    "@tanstack/react-start": "^1.168.61"
+  },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20251014.0",
+    "@tanstack/react-start": "1.168.61",
     "@types/node": "^22.18.13",
     "prettier": "^3.6.2",
     "typescript": "^5.9.3",
@@ -52,5 +58,21 @@
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^3.2.6",
     "zod": "^4.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@tanstack/react-start": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "prebuild": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "build": "tsc -p tsconfig.build.json",
+    "types:check": "tsc --noEmit",
+    "format:check": "prettier --check .",
+    "format:write": "prettier . --write",
+    "test": "vitest run --silent",
+    "test:watch": "vitest",
+    "check:esm-relative-imports": "node ./scripts/check-esm-relative-imports.mjs",
+    "catalog:update": "UPDATE_CATALOG=1 vitest run src/cloudflare/catalogSettings.test.ts --silent"
   }
-}
+}