@every-app/sdk 0.3.0-rc.4 → 0.3.0-rc.6

package/dist/internal/capabilities.d.ts

@@ -16,11 +16,14 @@
  *    proxy's rules: inference routes only, the model allowlist, the usage
  *    tap. Never a capability: its key would reach the account's credits
  *    and keys on the same host.
- *  - `oauth_client`: a provider's OAuth client (a social network's), held
- *    the same way. The gateway completes the token endpoint calls only,
- *    putting the client on them; the app builds the authorize URL from the
- *    public client id (`integrationStatus()`), keeps the user tokens and
- *    calls the provider's API with them itself. A client shared by apps
+ *  - `oauth_client`: a provider's OAuth client (Google's, Microsoft's,
+ *    Slack's), held the same way. The gateway completes the token endpoint
+ *    calls only, putting the client on them; the app builds the authorize
+ *    URL from the public client id (`integrationStatus()`), sends people
+ *    back to a callback its manifest entry lists (`redirectPaths`), keeps
+ *    the user tokens and calls the provider's API with them itself. Other
+ *    providers' clients (GitHub, the social networks) are presets
+ *    (./oauthPresets.ts): rows only once an operator adds one. A client shared by apps
  *    with different needs carries a `scopePolicy`: named scope sets an app
  *    lists in its manifest entry's `scopes`, which ./oauthScopes.ts turns
  *    into what the app may ask the provider for and what a token it is
@@ -272,13 +275,26 @@ export interface AiProviderCapability extends ProviderDetails {
      * `providers`, never the default, reached through the entries it fronts.
      */
     kind?: "proxy";
+    /**
+     * The models the provider serves, when the entry says (a registered
+     * `ai` row's `models`): the proxy refuses an inference call naming
+     * another (`model_not_allowed`), and `provider show` lists them. Absent
+     * on the catalog's entries, whose model lists change weekly.
+     */
+    models?: readonly string[];
 }
 /** A route of an AI provider the default route maps onto, with the model used when the app names none. */
 export interface AiRoute {
     /** One of the entry's `inferenceRoutes`: `/api/v1/chat/completions`. */
     path: string;
-    /** The model the Gateway fills in: a cheap, capable one of the provider's. */
-    model: string;
+    /**
+     * The seed: the model the Gateway fills in when its operator set none
+     * for this provider (`everyapp ai model`, `org_settings.ai_models`), a
+     * cheap, capable one of the provider's. Data, never the only answer:
+     * read it through `resolveAiDefault` (./aiDefault.ts), which puts the
+     * operator's setting first.
+     */
+    seedModel: string;
 }
 /** What `access: "write"` adds to a provider's read methods when its entry doesn't say. */
 export declare const DEFAULT_WRITE_METHODS: readonly string[];
@@ -302,27 +318,19 @@ export interface GatewayServiceCapability {
     setup?: string;
 }
 /** Where the gateway puts an OAuth client on a token request. */
-export type OAuthClientInjection = "form" | "basic" | "query" | "json";
+export type OAuthClientInjection = "form" | "basic";
 /** A token endpoint an `oauth_client` capability completes, with its rule. */
 export interface OAuthTokenEndpoint {
-    /**
-     * The endpoint's host, always over https. Absent: the host the
-     * capability's `hostSetting` names (an instance the operator chose).
-     */
-    host?: string;
-    /** The exact pathname, or a RegExp for versioned ones (Meta's `/v25.0/oauth/access_token`). */
-    path: string | RegExp;
+    /** The endpoint's host, always over https. */
+    host: string;
+    /** The exact pathname. */
+    path: string;
     methods: readonly ("GET" | "POST")[];
     /**
-     * Where the client goes: the form body, HTTP Basic, the query string, or
-     * the JSON body (injectClientCredentials() in ./oauthClient.ts).
+     * Where the client goes: the form body or HTTP Basic
+     * (injectClientCredentials() in ./oauthClient.ts).
      */
     inject: OAuthClientInjection;
-    /** The fields' names when not `client_id` / `client_secret` (TikTok's `client_key`). */
-    params?: {
-        clientId?: string;
-        clientSecret?: string;
-    };
 }
 /**
  * One host's allowlist a scope set unlocks. Matched against the raw
@@ -458,14 +466,6 @@ export interface OAuthClientCapability {
     };
     /** The only calls the gateway completes; anything else is refused. */
     token: readonly OAuthTokenEndpoint[];
-    /**
-     * A gateway setting naming the provider's origin, for a provider with no
-     * fixed one (Mastodon's instance): the host of `token` entries without
-     * their own, and of the authorize URL.
-     */
-    hostSetting?: string;
-    /** The origin when `hostSetting` is unset. */
-    defaultOrigin?: string;
     /**
      * Obtaining and refreshing user tokens with the operator's client
      * writes, so a catalog client is `["write"]`. A registered OAuth
@@ -478,9 +478,8 @@ export interface OAuthClientCapability {
     /** The everyapp skill's setup guide for the client, when one exists. */
     setup?: string;
     /**
-     * The authorize endpoint the app sends people to (a path on the
-     * `hostSetting` origin when the provider has none fixed) and the scopes
-     * the client must be allowed: the operator's checklist and the docs. With
+     * The authorize endpoint the app sends people to and the scopes the
+     * client must be allowed: the operator's checklist and the docs. With
      * a `scopePolicy`, the union of its sets' scopes and `alwaysRequested`.
      */
     authorize: {
@@ -490,7 +489,7 @@ export interface OAuthClientCapability {
     /**
      * Named scope sets an app lists in its manifest entry's `scopes`, for a
      * client several apps share with different needs. Absent: the whole
-     * client is the grant, as for Postiz's social networks.
+     * client is the grant.
      */
     scopePolicy?: OAuthScopePolicy;
     /**
@@ -515,12 +514,6 @@ export interface OAuthClientCapability {
      */
     readMethods?: readonly string[];
     writeMethods?: readonly string[];
-    /**
-     * The redirect paths the operator registers, on the app's host
-     * (`https://<app>.<APP_BASE_DOMAIN><path>`): Postiz's callback pages, the
-     * first app to use these clients.
-     */
-    redirectPaths: readonly string[];
 }
 export type Capability = ApiKeyCapability | AiProviderCapability | OAuthClientCapability | GatewayServiceCapability;
 export declare const CAPABILITIES: {
@@ -937,7 +930,7 @@ export declare const CAPABILITIES: {
         readonly shape: "anthropic";
         readonly chat: {
             readonly path: "/v1/chat/completions";
-            readonly model: "claude-haiku-5-5";
+            readonly seedModel: "claude-haiku-5-5";
         };
         readonly aig: {
             readonly slug: "anthropic";
@@ -978,11 +971,11 @@ export declare const CAPABILITIES: {
         readonly inferenceRoutes: readonly ["/v1beta/openai/chat/completions", "/v1beta/openai/embeddings", "/v1beta/openai/images/generations"];
         readonly chat: {
             readonly path: "/v1beta/openai/chat/completions";
-            readonly model: "gemini-3.1-flash-lite";
+            readonly seedModel: "gemini-3.1-flash-lite";
         };
         readonly embeddings: {
             readonly path: "/v1beta/openai/embeddings";
-            readonly model: "gemini-embedding-001";
+            readonly seedModel: "gemini-embedding-001";
         };
         readonly hint: "An API key from Google AI Studio; the Gateway sends it as a bearer token. Apps call Gemini's OpenAI-shaped paths under /v1beta/openai.";
         readonly secrets: readonly [{
@@ -1019,11 +1012,11 @@ export declare const CAPABILITIES: {
         readonly inferenceRoutes: readonly ["/v1/chat/completions", "/v1/fim/completions", "/v1/embeddings", "/v1/moderations", "/v1/chat/moderations", "/v1/classifications", "/v1/chat/classifications", "/v1/ocr", "/v1/audio/transcriptions", "/v1/audio/speech"];
         readonly chat: {
             readonly path: "/v1/chat/completions";
-            readonly model: "mistral-small-latest";
+            readonly seedModel: "mistral-small-latest";
         };
         readonly embeddings: {
             readonly path: "/v1/embeddings";
-            readonly model: "mistral-embed";
+            readonly seedModel: "mistral-embed";
         };
         readonly aig: {
             readonly slug: "mistral";
@@ -1060,7 +1053,7 @@ export declare const CAPABILITIES: {
         readonly inferenceRoutes: readonly ["/openai/v1/chat/completions", "/openai/v1/responses", "/openai/v1/audio/transcriptions", "/openai/v1/audio/translations", "/openai/v1/audio/speech"];
         readonly chat: {
             readonly path: "/openai/v1/chat/completions";
-            readonly model: "openai/gpt-oss-20b";
+            readonly seedModel: "openai/gpt-oss-20b";
         };
         readonly aig: {
             readonly slug: "groq";
@@ -2474,11 +2467,11 @@ export declare const CAPABILITIES: {
         readonly extraRoutes: true;
         readonly chat: {
             readonly path: "/v1/chat/completions";
-            readonly model: "gpt-6-luna";
+            readonly seedModel: "gpt-6-luna";
         };
         readonly embeddings: {
             readonly path: "/v1/embeddings";
-            readonly model: "text-embedding-3-small";
+            readonly seedModel: "text-embedding-3-small";
         };
         readonly aig: {
             readonly slug: "openai";
@@ -2505,11 +2498,11 @@ export declare const CAPABILITIES: {
         readonly inferenceRoutes: readonly ["/api/v1/chat/completions", "/api/v1/completions", "/api/v1/responses", "/api/v1/embeddings"];
         readonly chat: {
             readonly path: "/api/v1/chat/completions";
-            readonly model: "anthropic/claude-haiku-5.5";
+            readonly seedModel: "anthropic/claude-haiku-5.5";
         };
         readonly embeddings: {
             readonly path: "/api/v1/embeddings";
-            readonly model: "openai/text-embedding-3-small";
+            readonly seedModel: "openai/text-embedding-3-small";
         };
         readonly aig: {
             readonly slug: "openrouter";
@@ -2544,11 +2537,11 @@ export declare const CAPABILITIES: {
         readonly normalize: "workers-ai";
         readonly chat: {
             readonly path: "/v1/chat/completions";
-            readonly model: "@cf/meta/llama-4-scout-17b-16e-instruct";
+            readonly seedModel: "@cf/meta/llama-4-scout-17b-16e-instruct";
         };
         readonly embeddings: {
             readonly path: "/v1/embeddings";
-            readonly model: "@cf/baai/bge-m3";
+            readonly seedModel: "@cf/baai/bge-m3";
         };
         readonly aig: {
             readonly slug: "workers-ai";
@@ -2672,256 +2665,6 @@ export declare const CAPABILITIES: {
         readonly settings: readonly [];
         readonly optionalSettings: readonly [];
     };
-    readonly linkedin: {
-        readonly mode: "oauth_client";
-        readonly label: "LinkedIn";
-        readonly secrets: {
-            readonly clientId: "LINKEDIN_CLIENT_ID";
-            readonly clientSecret: "LINKEDIN_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "www.linkedin.com";
-            readonly path: "/oauth/v2/accessToken";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://www.linkedin.com/developers/apps";
-        readonly authorize: {
-            readonly url: "https://www.linkedin.com/oauth/v2/authorization";
-            readonly scopes: readonly ["openid", "profile", "w_member_social", "r_basicprofile", "rw_organization_admin", "w_organization_social", "r_organization_social"];
-        };
-        readonly api: readonly ["api.linkedin.com"];
-        readonly redirectPaths: readonly ["/integrations/social/linkedin", "/integrations/social/linkedin-page"];
-    };
-    readonly facebook: {
-        readonly mode: "oauth_client";
-        readonly label: "Facebook";
-        readonly secrets: {
-            readonly clientId: "FACEBOOK_APP_ID";
-            readonly clientSecret: "FACEBOOK_APP_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "graph.facebook.com";
-            readonly path: RegExp;
-            readonly methods: readonly ["GET", "POST"];
-            readonly inject: "query";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.facebook.com/apps";
-        readonly authorize: {
-            readonly url: "https://www.facebook.com/v25.0/dialog/oauth";
-            readonly scopes: readonly ["pages_show_list", "business_management", "pages_manage_posts", "pages_manage_engagement", "pages_read_engagement", "read_insights", "instagram_basic", "instagram_content_publish", "instagram_manage_comments", "instagram_manage_insights"];
-        };
-        readonly api: readonly ["graph.facebook.com", "graph.instagram.com"];
-        readonly redirectPaths: readonly ["/integrations/social/facebook", "/integrations/social/instagram"];
-    };
-    readonly instagram: {
-        readonly mode: "oauth_client";
-        readonly label: "Instagram";
-        readonly secrets: {
-            readonly clientId: "INSTAGRAM_APP_ID";
-            readonly clientSecret: "INSTAGRAM_APP_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "api.instagram.com";
-            readonly path: "/oauth/access_token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }, {
-            readonly host: "graph.instagram.com";
-            readonly path: "/access_token";
-            readonly methods: readonly ["GET"];
-            readonly inject: "query";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.facebook.com/apps";
-        readonly authorize: {
-            readonly url: "https://www.instagram.com/oauth/authorize";
-            readonly scopes: readonly ["instagram_business_basic", "instagram_business_content_publish", "instagram_business_manage_comments", "instagram_business_manage_insights"];
-        };
-        readonly api: readonly ["graph.instagram.com"];
-        readonly redirectPaths: readonly ["/integrations/social/instagram-standalone"];
-    };
-    readonly threads: {
-        readonly mode: "oauth_client";
-        readonly label: "Threads";
-        readonly secrets: {
-            readonly clientId: "THREADS_APP_ID";
-            readonly clientSecret: "THREADS_APP_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "graph.threads.net";
-            readonly path: "/oauth/access_token";
-            readonly methods: readonly ["GET", "POST"];
-            readonly inject: "query";
-        }, {
-            readonly host: "graph.threads.net";
-            readonly path: "/access_token";
-            readonly methods: readonly ["GET"];
-            readonly inject: "query";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.facebook.com/apps";
-        readonly authorize: {
-            readonly url: "https://threads.net/oauth/authorize";
-            readonly scopes: readonly ["threads_basic", "threads_content_publish", "threads_manage_replies", "threads_manage_insights"];
-        };
-        readonly api: readonly ["graph.threads.net"];
-        readonly redirectPaths: readonly ["/integrations/social/threads"];
-    };
-    readonly youtube: {
-        readonly mode: "oauth_client";
-        readonly label: "YouTube";
-        readonly secrets: {
-            readonly clientId: "YOUTUBE_CLIENT_ID";
-            readonly clientSecret: "YOUTUBE_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "oauth2.googleapis.com";
-            readonly path: "/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://console.cloud.google.com/apis/credentials";
-        readonly setup: "setup/google.md";
-        readonly authorize: {
-            readonly url: "https://accounts.google.com/o/oauth2/v2/auth";
-            readonly scopes: readonly ["https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/youtube", "https://www.googleapis.com/auth/youtube.force-ssl", "https://www.googleapis.com/auth/youtube.readonly", "https://www.googleapis.com/auth/youtube.upload", "https://www.googleapis.com/auth/youtubepartner", "https://www.googleapis.com/auth/yt-analytics.readonly", "https://www.googleapis.com/auth/business.manage"];
-        };
-        readonly api: readonly ["www.googleapis.com", "youtubeanalytics.googleapis.com", "mybusinessaccountmanagement.googleapis.com", "mybusinessbusinessinformation.googleapis.com", "mybusiness.googleapis.com", "businessprofileperformance.googleapis.com"];
-        readonly redirectPaths: readonly ["/integrations/social/youtube", "/integrations/social/gmb"];
-    };
-    readonly tiktok: {
-        readonly mode: "oauth_client";
-        readonly label: "TikTok";
-        readonly secrets: {
-            readonly clientId: "TIKTOK_CLIENT_ID";
-            readonly clientSecret: "TIKTOK_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "open.tiktokapis.com";
-            readonly path: "/v2/oauth/token/";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-            readonly params: {
-                readonly clientId: "client_key";
-            };
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.tiktok.com/apps";
-        readonly authorize: {
-            readonly url: "https://www.tiktok.com/v2/auth/authorize/";
-            readonly scopes: readonly ["video.list", "user.info.basic", "video.publish", "video.upload", "user.info.profile", "user.info.stats"];
-        };
-        readonly api: readonly ["open.tiktokapis.com"];
-        readonly redirectPaths: readonly ["/integrations/social/tiktok"];
-    };
-    readonly "tiktok-business": {
-        readonly mode: "oauth_client";
-        readonly label: "TikTok Business";
-        readonly secrets: {
-            readonly clientId: "TIKTOK_BUSINESS_CLIENT_ID";
-            readonly clientSecret: "TIKTOK_BUSINESS_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "business-api.tiktok.com";
-            readonly path: "/open_api/v1.3/tt_user/oauth2/token/";
-            readonly methods: readonly ["POST"];
-            readonly inject: "json";
-        }, {
-            readonly host: "business-api.tiktok.com";
-            readonly path: "/open_api/v1.3/tt_user/oauth2/refresh_token/";
-            readonly methods: readonly ["POST"];
-            readonly inject: "json";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://business-api.tiktok.com/portal/apps";
-        readonly authorize: {
-            readonly url: "https://www.tiktok.com/v2/auth/authorize/";
-            readonly scopes: readonly ["user.info.basic", "user.info.username", "user.info.stats", "video.list", "video.upload", "video.publish"];
-        };
-        readonly api: readonly ["business-api.tiktok.com"];
-        readonly redirectPaths: readonly ["/integrations/social/tiktok-business/"];
-    };
-    readonly reddit: {
-        readonly mode: "oauth_client";
-        readonly label: "Reddit";
-        readonly secrets: {
-            readonly clientId: "REDDIT_CLIENT_ID";
-            readonly clientSecret: "REDDIT_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "www.reddit.com";
-            readonly path: "/api/v1/access_token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "basic";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://www.reddit.com/prefs/apps";
-        readonly authorize: {
-            readonly url: "https://www.reddit.com/api/v1/authorize";
-            readonly scopes: readonly ["read", "identity", "submit", "flair"];
-        };
-        readonly api: readonly ["oauth.reddit.com"];
-        readonly redirectPaths: readonly ["/integrations/social/reddit"];
-    };
-    readonly pinterest: {
-        readonly mode: "oauth_client";
-        readonly label: "Pinterest";
-        readonly secrets: {
-            readonly clientId: "PINTEREST_CLIENT_ID";
-            readonly clientSecret: "PINTEREST_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "api.pinterest.com";
-            readonly path: "/v5/oauth/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "basic";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.pinterest.com/apps/";
-        readonly authorize: {
-            readonly url: "https://www.pinterest.com/oauth/";
-            readonly scopes: readonly ["boards:read", "boards:write", "pins:read", "pins:write", "user_accounts:read"];
-        };
-        readonly api: readonly ["api.pinterest.com"];
-        readonly redirectPaths: readonly ["/integrations/social/pinterest"];
-    };
-    readonly discord: {
-        readonly mode: "oauth_client";
-        readonly label: "Discord";
-        readonly secrets: {
-            readonly clientId: "DISCORD_CLIENT_ID";
-            readonly clientSecret: "DISCORD_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "discord.com";
-            readonly path: "/api/oauth2/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "basic";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://discord.com/developers/applications";
-        readonly authorize: {
-            readonly url: "https://discord.com/oauth2/authorize";
-            readonly scopes: readonly ["bot", "identify", "guilds"];
-        };
-        readonly api: readonly ["discord.com"];
-        readonly redirectPaths: readonly ["/integrations/social/discord"];
-        readonly flow: {
-            readonly tokenUrl: "https://discord.com/api/oauth2/token";
-            readonly revokeUrl: "https://discord.com/api/oauth2/token/revoke";
-            readonly pkce: true;
-            readonly scopeDialect: "space";
-            readonly identity: {
-                readonly url: "https://discord.com/api/users/@me";
-                readonly label: "username";
-                readonly id: "id";
-            };
-        };
-    };
     readonly slack: {
         readonly mode: "oauth_client";
         readonly label: "Slack";
@@ -3034,7 +2777,6 @@ export declare const CAPABILITIES: {
             };
         };
         readonly api: readonly ["slack.com"];
-        readonly redirectPaths: readonly ["/integrations/social/slack", "/integrations/slack/callback"];
         readonly flow: {
             readonly tokenUrl: "https://slack.com/api/oauth.v2.access";
             readonly revokeUrl: "https://slack.com/api/auth.revoke";
@@ -3047,117 +2789,6 @@ export declare const CAPABILITIES: {
             };
         };
     };
-    readonly mastodon: {
-        readonly mode: "oauth_client";
-        readonly label: "Mastodon";
-        readonly secrets: {
-            readonly clientId: "MASTODON_CLIENT_ID";
-            readonly clientSecret: "MASTODON_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly path: "/oauth/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly hostSetting: "MASTODON_URL";
-        readonly defaultOrigin: "https://mastodon.social";
-        readonly access: readonly ["write"];
-        readonly console: "/settings/applications";
-        readonly authorize: {
-            readonly url: "/oauth/authorize";
-            readonly scopes: readonly ["write:statuses", "profile", "write:media"];
-        };
-        readonly api: readonly [];
-        readonly redirectPaths: readonly ["/integrations/social/mastodon"];
-    };
-    readonly kick: {
-        readonly mode: "oauth_client";
-        readonly label: "Kick";
-        readonly secrets: {
-            readonly clientId: "KICK_CLIENT_ID";
-            readonly clientSecret: "KICK_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "id.kick.com";
-            readonly path: "/oauth/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://kick.com/settings/developer";
-        readonly authorize: {
-            readonly url: "https://id.kick.com/oauth/authorize";
-            readonly scopes: readonly ["chat:write", "user:read", "channel:read"];
-        };
-        readonly api: readonly ["api.kick.com"];
-        readonly redirectPaths: readonly ["/integrations/social/kick"];
-    };
-    readonly twitch: {
-        readonly mode: "oauth_client";
-        readonly label: "Twitch";
-        readonly secrets: {
-            readonly clientId: "TWITCH_CLIENT_ID";
-            readonly clientSecret: "TWITCH_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "id.twitch.tv";
-            readonly path: "/oauth2/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://dev.twitch.tv/console/apps";
-        readonly authorize: {
-            readonly url: "https://id.twitch.tv/oauth2/authorize";
-            readonly scopes: readonly ["user:write:chat", "user:read:chat", "moderator:manage:announcements"];
-        };
-        readonly api: readonly ["api.twitch.tv"];
-        readonly redirectPaths: readonly ["/integrations/social/twitch"];
-    };
-    readonly tumblr: {
-        readonly mode: "oauth_client";
-        readonly label: "Tumblr";
-        readonly secrets: {
-            readonly clientId: "TUMBLR_CLIENT_ID";
-            readonly clientSecret: "TUMBLR_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "api.tumblr.com";
-            readonly path: "/v2/oauth2/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://www.tumblr.com/oauth/apps";
-        readonly authorize: {
-            readonly url: "https://www.tumblr.com/oauth2/authorize";
-            readonly scopes: readonly ["write", "offline_access"];
-        };
-        readonly api: readonly ["api.tumblr.com"];
-        readonly redirectPaths: readonly ["/integrations/social/tumblr"];
-    };
-    readonly dribbble: {
-        readonly mode: "oauth_client";
-        readonly label: "Dribbble";
-        readonly secrets: {
-            readonly clientId: "DRIBBBLE_CLIENT_ID";
-            readonly clientSecret: "DRIBBBLE_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "dribbble.com";
-            readonly path: "/oauth/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "query";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://dribbble.com/account/applications";
-        readonly authorize: {
-            readonly url: "https://dribbble.com/oauth/authorize";
-            readonly scopes: readonly ["public", "upload"];
-        };
-        readonly api: readonly ["api.dribbble.com"];
-        readonly redirectPaths: readonly ["/integrations/social/dribbble"];
-    };
     readonly "google-workspace": {
         readonly mode: "oauth_client";
         readonly label: "Google (Gmail, Calendar, Search Console and Analytics)";
@@ -3248,7 +2879,6 @@ export declare const CAPABILITIES: {
             };
         };
         readonly api: readonly ["gmail.googleapis.com", "www.googleapis.com", "searchconsole.googleapis.com", "analyticsdata.googleapis.com", "analyticsadmin.googleapis.com", "openidconnect.googleapis.com"];
-        readonly redirectPaths: readonly ["/integrations/google/callback"];
         readonly flow: {
             readonly tokenUrl: "https://oauth2.googleapis.com/token";
             readonly pkce: true;
@@ -3323,7 +2953,6 @@ export declare const CAPABILITIES: {
             };
         };
         readonly api: readonly ["graph.microsoft.com"];
-        readonly redirectPaths: readonly ["/integrations/microsoft/callback"];
         readonly flow: {
             readonly tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token";
             readonly pkce: true;
@@ -3372,9 +3001,7 @@ type SettingsOf<C> = C extends {
 } ? S | O : C extends {
     secrets: infer S;
     token: unknown;
-} ? (S[keyof S] & string) | (C extends {
-    hostSetting: infer H extends string;
-} ? H : never) : C extends {
+} ? S[keyof S] & string : C extends {
     auth: infer A;
 } ? AuthSettingsOf<A> | (C extends {
     alsoNeeds: readonly (infer N extends string)[];
@@ -3477,29 +3104,21 @@ export type CapabilitySettings = Readonly<Record<string, unknown>>;
  * an unknown capability (or an AI provider, which has its own route), a
  * host outside the provider's, a path that could leave that host, a path
  * that isn't one of an OAuth client's token endpoints, or a route a service
- * capability doesn't declare. `settings` resolves an OAuth client's
- * `hostSetting` (Mastodon's instance); `lookup` is where the id is found,
+ * capability doesn't declare. `settings` resolves an API-key provider's
+ * `hostSetting` (a Shopify store's host); `lookup` is where the id is found,
  * the catalog alone by default.
  */
 export declare function parseIntegrationProxyPath(pathname: string, search: string, settings?: CapabilitySettings, lookup?: CapabilityLookup): IntegrationProxyRoute | null;
 /**
- * The origin an OAuth client's `hostSetting` names (its default when the
- * setting is unset), or null for a client with a fixed host or a setting
- * that isn't an https origin. A bare host is taken as https.
- */
-export declare function oauthClientOrigin(capability: OAuthClientCapability, settings: CapabilitySettings | undefined): string | null;
-/**
- * The token endpoint `upstream` is, by its exact host and path (a RegExp
- * for a versioned one), or null. Its method is the caller's to check.
+ * The token endpoint `upstream` is, by its exact host and path, or null.
+ * Its method is the caller's to check.
  */
-export declare function tokenEndpointFor(capability: OAuthClientCapability, upstream: URL, settings: CapabilitySettings | undefined): OAuthTokenEndpoint | null;
+export declare function tokenEndpointFor(capability: OAuthClientCapability, upstream: URL): OAuthTokenEndpoint | null;
 /** An OAuth client's token endpoints, as `POST https://host/path` lines for messages. */
 export declare function describeTokenEndpoints(capability: OAuthClientCapability): string;
-/** A token endpoint's path as people read it: a versioned one as `/v<version>/oauth/access_token`. */
-export declare function tokenPathText(path: string | RegExp): string;
 /**
  * The command that gives the gateway `capability`'s client:
- * `pnpm everyapp secret set <ID> <SECRET> [<HOST SETTING>]`.
+ * `pnpm everyapp secret set <ID> <SECRET>`.
  */
 export declare function oauthClientSecretSetCommand(capability: OAuthClientCapability): string;
 /**