@every-app/sdk 0.3.0-rc.5 → 0.3.0-rc.6

package/dist/server/authorizeUrl.js

@@ -40,7 +40,7 @@ function scopedClientIds() {
  * `codeChallenge`, PKCE as S256. The app keeps its `state` and verifier
  * for the callback.
  *
- * A client without scope sets (LinkedIn, Mastodon, ...) is refused: the
+ * A client without scope sets is refused: the
  * registry's checklist for one isn't what the gateway holds a token to,
  * so an app builds that URL itself from the status's `clientId`.
  *
@@ -66,11 +66,7 @@ export function authorizeUrl({ provider, status, redirectUri, state, codeChallen
             ? `authorizeUrl(${JSON.stringify(provider)}): include_granted_scopes would widen the token to every scope the person granted this client, which the gateway refuses (integration_scope_exceeded); leave it out of params.`
             : `authorizeUrl(${JSON.stringify(provider)}) sets ${name} itself; leave it out of params.`);
     }
-    const base = status.origin ?? capability.defaultOrigin;
-    if (!/^https:/.test(capability.authorize.url) && !base) {
-        throw new TypeError(`authorizeUrl(${JSON.stringify(provider)}) needs the instance ${capability.label} is on: the status carries it as origin once ${capability.hostSetting} is set.`);
-    }
-    const url = new URL(capability.authorize.url, base);
+    const url = new URL(capability.authorize.url);
     // The status speaks for the gateway: its scopes are the token's ceiling.
     const scopes = status.scopes;
     const slack = url.host === "slack.com";

package/dist/server/emailBinding.js

@@ -16,7 +16,7 @@
  * account (EMAIL_REST_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, EMAIL_FROM).
  */
 import { ConfigurationError, } from "../internal/index.js";
-import { GatewayRefusalError } from "./integrationFetch.js";
+import { GatewayRefusalError } from "./refusal.js";
 import { sendEmail } from "./sendEmail.js";
 /**
  * A `send_email` binding (`SendEmail`) over the Gateway: pass it where code

package/dist/server/emit.js

@@ -11,7 +11,7 @@
 import { APP_EVENT_DATA_MAX_BYTES, APP_ID_ENV, ConfigurationError, EVENTS_EMIT_PATH, appEventNameProblem, appEventType, checkEventData, } from "../internal/index.js";
 import { applyAttribution, attributionFor, } from "./attribution.js";
 import { BINDING_ORIGIN } from "./gatewayFetch.js";
-import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
+import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
 /**
  * Put an event on the gateway's event bus, for the organization's webhook
  * and email subscribers. The gateway names it `app.<app id>.<event>`, so an

package/dist/server/gatewayFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatewayFetch.d.ts","sourceRoot":"","sources":["../../src/server/gatewayFetch.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,cAAc,sCAAsC,CAAC;AAGlE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE;AAeD,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACtD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,OAAO,KAAK,CAAC;AAsHhB,sFAAsF;AACtF,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAUT"}
+{"version":3,"file":"gatewayFetch.d.ts","sourceRoot":"","sources":["../../src/server/gatewayFetch.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,cAAc,sCAAsC,CAAC;AAGlE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE;AAeD,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACtD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,OAAO,KAAK,CAAC;AA2HhB,sFAAsF;AACtF,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAUT"}

package/dist/server/gatewayFetch.js

@@ -15,7 +15,7 @@ export function createGatewayFetch({ env: workerEnv, for: explicitTarget, option
     if (!binding && Object.keys(devProviders).length === 0) {
         if (optional)
             return null;
-        throw new ConfigurationError(`AI gateway unavailable: deploy with the EVERY_APP_GATEWAY binding, or set the provider's key (${listOf(Object.values(DEV_AI_PROVIDERS).map((spec) => settingsNames(spec, "with")), "or")}) in .dev.vars for direct local development.`);
+        throw new ConfigurationError(`AI gateway unavailable: deploy with the EVERY_APP_GATEWAY binding, or set the provider's key (${listOf(Object.values(DEV_AI_PROVIDERS).map((spec) => settingsNames(spec, "with")), "or")}) in .dev.vars for direct local development.`, { code: "ai_provider_not_configured" });
     }
     return async (input, init) => {
         const target = attributionFor(env, explicitTarget, "createGatewayFetch");
@@ -32,7 +32,10 @@ export function createGatewayFetch({ env: workerEnv, for: explicitTarget, option
         const { provider, spec, path, search } = direct;
         const dev = devProviders[provider];
         if (!dev) {
-            throw new ConfigurationError(`Set ${settingsNames(spec)} in .dev.vars to call ${provider} in local development.`);
+            throw new ConfigurationError(`Set ${settingsNames(spec)} in .dev.vars to call ${provider} in local development.`, {
+                code: "ai_provider_not_configured",
+                settings: aiProviderSettings(spec),
+            });
         }
         const url = joinProviderUrl(`${spec.origin}${dev.basePath}`, path, search);
         if (!url)
@@ -129,15 +132,20 @@ function directProviderPath(input, env) {
     let fillModel = null;
     if (provider === AI_DEFAULT_PROVIDER) {
         // The default in dev, by the gateway's rule on the developer's own
-        // `.dev.vars`: the first provider of the order with every setting set.
+        // `.dev.vars`: the first provider of the order with every setting set,
+        // with its seed models (dev has no operator settings; a request that
+        // names a model sends it as it is).
         const values = env;
         const resolution = resolveAiDefault({
-            choice: null,
+            provider: null,
             isSet: (name) => typeof values[name] === "string" &&
                 values[name].trim().length > 0,
         });
         if (!resolution.configured) {
-            throw new ConfigurationError(`Set ${resolution.settings.join(" and ")} (or another model provider's key) in .dev.vars to call the default model in local development.`);
+            throw new ConfigurationError(`Set ${resolution.settings.join(" and ")} (or another model provider's key) in .dev.vars to call the default model in local development.`, {
+                code: "ai_default_not_configured",
+                settings: resolution.settings,
+            });
         }
         const route = path === AI_DEFAULT_ROUTES.chat
             ? resolution.chat
@@ -149,9 +157,14 @@ function directProviderPath(input, env) {
         }
         provider = resolution.provider;
         path = route.path;
-        fillModel = path === resolution.chat.path ? resolution.model : route.model;
+        fillModel =
+            route === resolution.chat
+                ? resolution.model
+                : (resolution.embeddingsModel ?? null);
     }
-    const spec = provider ? devAiProvider(provider) : undefined;
+    const spec = provider
+        ? devAiProvider(provider, env)
+        : undefined;
     if (!provider || !spec) {
         throw new ConfigurationError(`Direct local provider fallback only supports ${listOf([AI_DEFAULT_PROVIDER, ...Object.keys(DEV_AI_PROVIDERS)].map((name) => `${AI_PROXY_PREFIX}${name}`), "and")} paths.`);
     }

package/dist/server/index.d.ts

@@ -13,8 +13,9 @@ export { GATEWAY_ERROR_HEADER } from "../internal/protocol.js";
 export { authorizeUrl, type AuthorizeUrlOptions } from "./authorizeUrl.js";
 export { connectPath, connectUrl, type ConnectUrlOptions, } from "./connectUrl.js";
 export { createGatewayFetch, type CreateGatewayFetchOptions, } from "./gatewayFetch.js";
-export { ai, aiBaseUrl, providerBaseUrl, AI_DEFAULT_BASE_URL, type AiClient, } from "./ai.js";
-export { GatewayRefusalError, gatewayRefusal, devAccessTokenName, integrationFetch, integrationStatus, type EmailIntegrationStatus, type GatewayRefusal, type IntegrationFetchOptions, type IntegrationStatus, type IntegrationStatusOf, type OAuthClientIntegrationStatus, } from "./integrationFetch.js";
+export { ai, aiBaseUrl, aiStatus, providerBaseUrl, AI_DEFAULT_BASE_URL, type AiClient, type AiStatus, } from "./ai.js";
+export { AI_NOT_CONFIGURED_CODES, GatewayRefusalError, gatewayRefusal, isAiNotConfigured, refusalFromError, type GatewayRefusal, type SetupInfo, } from "./refusal.js";
+export { devAccessTokenName, integrationFetch, integrationStatus, type EmailIntegrationStatus, type IntegrationFetchOptions, type IntegrationStatus, type IntegrationStatusOf, type OAuthClientIntegrationStatus, } from "./integrationFetch.js";
 export { nodeServerHandler, type NodeServer, type NodeServerHandlerOptions, } from "./nodeServer.js";
 export { sendEmail, type SendEmailOptions } from "./sendEmail.js";
 export { gatewayAiBinding, type GatewayAiBindingOptions } from "./aiBinding.js";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,eAAe,EACf,QAAQ,EACR,OAAO,EACP,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,2FAA2F;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,UAAU,EACV,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,EAAE,EACF,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,KAAK,QAAQ,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,SAAS,EACT,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,OAAO,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,eAAe,EACf,QAAQ,EACR,OAAO,EACP,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,2FAA2F;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,UAAU,EACV,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,EAAE,EACF,SAAS,EACT,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,QAAQ,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,SAAS,EACT,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,OAAO,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC"}

package/dist/server/index.js

@@ -12,8 +12,9 @@ export { GATEWAY_ERROR_HEADER } from "../internal/protocol.js";
 export { authorizeUrl } from "./authorizeUrl.js";
 export { connectPath, connectUrl, } from "./connectUrl.js";
 export { createGatewayFetch, } from "./gatewayFetch.js";
-export { ai, aiBaseUrl, providerBaseUrl, AI_DEFAULT_BASE_URL, } from "./ai.js";
-export { GatewayRefusalError, gatewayRefusal, devAccessTokenName, integrationFetch, integrationStatus, } from "./integrationFetch.js";
+export { ai, aiBaseUrl, aiStatus, providerBaseUrl, AI_DEFAULT_BASE_URL, } from "./ai.js";
+export { AI_NOT_CONFIGURED_CODES, GatewayRefusalError, gatewayRefusal, isAiNotConfigured, refusalFromError, } from "./refusal.js";
+export { devAccessTokenName, integrationFetch, integrationStatus, } from "./integrationFetch.js";
 export { nodeServerHandler, } from "./nodeServer.js";
 export { sendEmail } from "./sendEmail.js";
 export { gatewayAiBinding } from "./aiBinding.js";

package/dist/server/integrationFetch.d.ts

@@ -1,5 +1,6 @@
 import { type ApiKeyCapabilityId, type CapabilityId, type ConnectionAccount, type EmailCapabilityStatus, type OAuthClientCapabilityId } from "../internal/index.js";
 import { type GatewayCallFor } from "./attribution.js";
+import type { SetupInfo } from "./refusal.js";
 export interface IntegrationFetchOptions {
     /**
      * The Worker env: the EVERY_APP_GATEWAY binding when deployed, or in local
@@ -50,7 +51,7 @@ export interface IntegrationFetchOptions {
  * sees the key. A refusal the gateway makes itself comes back as a response
  * {@link gatewayRefusal} recognizes; anything else is the provider's answer.
  *
- * For an OAuth client (`linkedin`, `mastodon`, ...) it reaches the
+ * For an OAuth client (`google-workspace`, `slack`, ...) it reaches the
  * provider's token endpoints only, and the gateway puts its client on the
  * request: send the code (or refresh token) without `client_id` or
  * `client_secret`. Build the authorize URL with {@link authorizeUrl} from
@@ -75,7 +76,7 @@ export declare function integrationFetch(options: IntegrationFetchOptions): type
  * gateway would hold. Dev-only: the gateway never reads it.
  */
 export declare function devAccessTokenName(provider: string): string;
-export interface IntegrationStatus {
+export interface IntegrationStatus extends SetupInfo {
     /** The app's manifest lists the capability. */
     requested: boolean;
     /** The gateway holds a key for it (in local dev: `.dev.vars` sets one). */
@@ -96,13 +97,8 @@ export type EmailIntegrationStatus = IntegrationStatus & Pick<EmailCapabilitySta
  * the app lists the capability and the gateway holds the client.
  */
 export interface OAuthClientIntegrationStatus extends IntegrationStatus {
-    /** The client's public id, for the authorize URL (and Twitch's `Client-Id`). */
+    /** The client's public id, for the authorize URL. */
     clientId?: string;
-    /**
-     * The provider's origin when the operator chose it (Mastodon's instance,
-     * `MASTODON_URL`): the authorize page, token endpoint and API are on it.
-     */
-    origin?: string;
     /**
      * For a client with scope sets (`google-workspace`, `microsoft-365`): the
      * set names the app's manifest entry declares, `[]` when the entry voids
@@ -163,27 +159,4 @@ export declare function integrationStatus<P extends CapabilityId | (string & {})
      */
     for?: GatewayCallFor;
 }): Promise<IntegrationStatusOf<P>>;
-/** A refusal the AppGateway binding made itself, not the provider. */
-export interface GatewayRefusal {
-    status: number;
-    /** e.g. `capability_not_requested`, `integration_not_configured`. */
-    code: string;
-    message: string;
-}
-/**
- * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
- * when the gateway won't send (`email_sender_not_allowed`,
- * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
- */
-export declare class GatewayRefusalError extends Error implements GatewayRefusal {
-    readonly status: number;
-    readonly code: string;
-    constructor({ status, code, message }: GatewayRefusal);
-}
-/**
- * The gateway's own refusal in `response`, or null when the response is the
- * provider's answer (which may be an error of its own). Reads the body only
- * for a refusal, so call it before reading the body yourself.
- */
-export declare function gatewayRefusal(response: Response): Promise<GatewayRefusal | null>;
 //# sourceMappingURL=integrationFetch.d.ts.map

package/dist/server/integrationFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrationFetch.d.ts","sourceRoot":"","sources":["../../src/server/integrationFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAgCL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAE1B,KAAK,uBAAuB,EAQ7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAO1B,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,EAAE,kBAAkB,GAAG,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACpD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,KAAK,CAAC;AAmKhB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAwgBD,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GACpD,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;IAClC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,iBAAiB,CAAC;QAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,GACjE,sBAAsB,GACtB,CAAC,SAAS,uBAAuB,GAC/B,4BAA4B,GAC5B,iBAAiB,CAAC;AAExB;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,EACA,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAiFlC;AA0HD,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,cAAc;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc;CAMtD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAWhC"}
+{"version":3,"file":"integrationFetch.d.ts","sourceRoot":"","sources":["../../src/server/integrationFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EA+BL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAE1B,KAAK,uBAAuB,EAQ7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,EAAE,kBAAkB,GAAG,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACpD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,KAAK,CAAC;AA+JhB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAugBD,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GACpD,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;IAClC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,iBAAiB,CAAC;QAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,GACjE,sBAAsB,GACtB,CAAC,SAAS,uBAAuB,GAC/B,4BAA4B,GAC5B,iBAAiB,CAAC;AAExB;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,EACA,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAWlC"}

package/dist/server/integrationFetch.js

@@ -1,4 +1,4 @@
-import { ACCOUNT_HEADER, CATALOG, ConfigurationError, GATEWAY_ERROR_HEADER, INTEGRATION_PROXY_PREFIX, OAUTH_TOKEN_BODY_LIMIT, allowedScopes, apiKeyHosts, authorizationFor, capabilitySettings, carriesToken, declaredScopeSets, describeTokenEndpoints, devProviderFile, grantedScopes, heldTokenCallAllowed, injectClientCredentials, integrationProxyPath, oauthClientCredentials, oauthClientOrigin, oauthReadMethods, oauthWriteMethods, providerSettingPrefix, requestedScopes, requestedTokenScopes, resolveDevProvider, rewriteTokenRequestScope, scopeExcess, tokenEndpointFor, tokenGrantType, EMAIL_SENDERS_ENV, chooseEmailProvider, parseEmailList, parseEmailSender, } from "../internal/index.js";
+import { ACCOUNT_HEADER, CATALOG, ConfigurationError, GATEWAY_ERROR_HEADER, INTEGRATION_PROXY_PREFIX, OAUTH_TOKEN_BODY_LIMIT, allowedScopes, apiKeyHosts, authorizationFor, capabilitySettings, carriesToken, declaredScopeSets, describeTokenEndpoints, devProviderFile, grantedScopes, heldTokenCallAllowed, injectClientCredentials, integrationProxyPath, oauthClientCredentials, oauthReadMethods, oauthWriteMethods, providerSettingPrefix, requestedScopes, requestedTokenScopes, resolveDevProvider, rewriteTokenRequestScope, scopeExcess, tokenEndpointFor, tokenGrantType, EMAIL_SENDERS_ENV, chooseEmailProvider, parseEmailList, parseEmailSender, } from "../internal/index.js";
 import { applyAttribution, attributionFor, } from "./attribution.js";
 import { BINDING_ORIGIN, streamingRequest, } from "./gatewayFetch.js";
 export function integrationFetch({ env, provider, for: explicitTarget, account, optional = false, }) {
@@ -61,7 +61,7 @@ export function integrationFetch({ env, provider, for: explicitTarget, account,
             const toApi = integration.flow !== undefined &&
                 upstream.protocol === "https:" &&
                 integration.api.includes(upstream.host) &&
-                !tokenEndpointFor(integration, upstream, binding && integration.hostSetting ? undefined : values);
+                !tokenEndpointFor(integration, upstream);
             if (toApi) {
                 if (binding) {
                     if (account)
@@ -220,12 +220,7 @@ function localCredentials(integration, values) {
  * with the developer's client put on it by the gateway's own rule.
  */
 async function oauthClientCall({ provider, capability, outbound, upstream, headers, values, binding, target, client, }) {
-    // With the binding the gateway resolves the provider's origin (Mastodon's
-    // instance) and refuses any other, so any origin stands in for it here.
-    const settings = binding && capability.hostSetting
-        ? { [capability.hostSetting]: upstream.origin }
-        : values;
-    const endpoint = tokenEndpointFor(capability, upstream, settings);
+    const endpoint = tokenEndpointFor(capability, upstream);
     const method = outbound.method.toUpperCase();
     if (!endpoint || !endpoint.methods.includes(method)) {
         throw new TypeError(`integrationFetch("${provider}") only reaches ${capability.label}'s token endpoints (${describeTokenEndpoints(capability)}), not ${method} ${upstream.origin}${upstream.pathname}. Call its API with the user's token directly.`);
@@ -457,6 +452,9 @@ function devRegisteredProvider(provider, values) {
     const resolved = resolveDevProvider(values, provider);
     if (!resolved.found)
         throw new ConfigurationError(resolved.problem);
+    if (resolved.capability.mode === "ai") {
+        throw new ConfigurationError(`${provider} is an AI provider: list it under providers and call it with createGatewayFetch(), not integrationFetch().`);
+    }
     return resolved.capability;
 }
 /**
@@ -486,6 +484,44 @@ function stringValue(value) {
  * carries its public `clientId` for the authorize URL.
  */
 export async function integrationStatus({ env, provider, for: explicitTarget, }) {
+    const status = await readIntegrationStatus({
+        env,
+        provider,
+        ...(explicitTarget === undefined ? {} : { for: explicitTarget }),
+    });
+    return withSetup(status, String(provider), env);
+}
+/**
+ * `status` with its setup fields: the Gateway's as it sent them, or in
+ * local development (no binding) the `.dev.vars` names a status that
+ * isn't configured lacks.
+ */
+function withSetup(status, provider, values) {
+    const binding = values["EVERY_APP_GATEWAY"];
+    if (binding || !status.requested || status.configured) {
+        return {
+            ...status,
+            settings: Array.isArray(status.settings) ? status.settings : [],
+            setup: typeof status.setup === "string" ? status.setup : null,
+            command: typeof status.command === "string" ? status.command : null,
+        };
+    }
+    const integration = CATALOG.get(provider) ?? devRegisteredProvider(provider, values);
+    const settings = provider === "email"
+        ? ["EMAIL_FROM"]
+        : integration
+            ? [...capabilitySettings(integration)]
+            : [];
+    return {
+        ...status,
+        settings,
+        setup: settings.length
+            ? `${integration?.label ?? provider} isn't set up for local development: set ${settings.join(" and ")} in .dev.vars.`
+            : `${integration?.label ?? provider} isn't set up for local development.`,
+        command: null,
+    };
+}
+async function readIntegrationStatus({ env, provider, for: explicitTarget, }) {
     const target = attributionFor(env, explicitTarget, `integrationStatus("${String(provider)}")`);
     const values = env;
     const binding = values["EVERY_APP_GATEWAY"];
@@ -565,7 +601,6 @@ function devOAuthClientStatus(id, capability, values) {
     const client = values["EVERYAPP_DEV"]
         ? oauthClientCredentials(capability, values)
         : null;
-    const origin = oauthClientOrigin(capability, values);
     const policy = capability.scopePolicy;
     // An entry with a Gateway-owned flow is listed for reading or writing;
     // the app-driven flow alone needs the write grant.
@@ -610,7 +645,6 @@ function devOAuthClientStatus(id, capability, values) {
         configured: Boolean(client),
         ready: Boolean(client) || Boolean(devToken),
         ...(client ? { clientId: client.clientId } : {}),
-        ...(client && origin ? { origin } : {}),
         ...((client || devToken) && grant && asked
             ? {
                 scopeSets: grant.sets,
@@ -652,35 +686,3 @@ function devEmailStatus(values) {
         provider: configured && choice.ok ? choice.provider : null,
     };
 }
-/**
- * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
- * when the gateway won't send (`email_sender_not_allowed`,
- * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
- */
-export class GatewayRefusalError extends Error {
-    status;
-    code;
-    constructor({ status, code, message }) {
-        super(message);
-        this.name = "GatewayRefusalError";
-        this.status = status;
-        this.code = code;
-    }
-}
-/**
- * The gateway's own refusal in `response`, or null when the response is the
- * provider's answer (which may be an error of its own). Reads the body only
- * for a refusal, so call it before reading the body yourself.
- */
-export async function gatewayRefusal(response) {
-    const code = response.headers.get(GATEWAY_ERROR_HEADER);
-    if (!code)
-        return null;
-    const body = await response.json().catch(() => null);
-    const message = body &&
-        typeof body === "object" &&
-        typeof body.message === "string"
-        ? body.message
-        : `The EveryApp gateway refused the call (${code}).`;
-    return { status: response.status, code, message };
-}

package/dist/server/listMembers.js

@@ -2,7 +2,7 @@ import { ConfigurationError, serviceRoutePath, } from "../internal/index.js";
 import { applyAttribution, attributionFor, isRequest, } from "./attribution.js";
 import { getEveryAppUser } from "./everyApp.js";
 import { BINDING_ORIGIN } from "./gatewayFetch.js";
-import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
+import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
 /**
  * The organization's members who can open the app now, through the
  * gateway's `members` capability: people deactivated, removed from the

package/dist/server/refusal.d.ts

@@ -0,0 +1,55 @@
+/** What would make it work, as the Gateway words it. */
+export interface SetupInfo {
+    /** The Gateway settings it needs (`["DATAFORSEO_API_KEY"]`); `[]` when ready or not a setting. */
+    settings: readonly string[];
+    /** One sentence for a person, naming what to set and how; null when ready. */
+    setup: string | null;
+    /** The command an admin runs (`pnpm everyapp configure crm`), or null. */
+    command: string | null;
+}
+/** A refusal the AppGateway binding made itself, not the provider. */
+export interface GatewayRefusal extends SetupInfo {
+    status: number;
+    /** e.g. `capability_not_requested`, `integration_not_configured`. */
+    code: string;
+    message: string;
+}
+/** The refusal codes that mean no model is set up for the call. */
+export declare const AI_NOT_CONFIGURED_CODES: readonly string[];
+/**
+ * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
+ * when the gateway won't send (`email_sender_not_allowed`,
+ * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
+ */
+export declare class GatewayRefusalError extends Error implements GatewayRefusal {
+    readonly status: number;
+    readonly code: string;
+    readonly settings: readonly string[];
+    readonly setup: string | null;
+    readonly command: string | null;
+    constructor({ status, code, message, settings, setup, command, }: Pick<GatewayRefusal, "status" | "code" | "message"> & Partial<SetupInfo>);
+}
+/**
+ * The gateway's own refusal in `response`, or null when the response is the
+ * provider's answer (which may be an error of its own). Reads the body only
+ * for a refusal, so call it before reading the body yourself.
+ */
+export declare function gatewayRefusal(response: Response): Promise<GatewayRefusal | null>;
+/**
+ * The Gateway's refusal behind a thrown error, or null when it isn't one:
+ * a {@link GatewayRefusalError} (`sendEmail()`, `listMembers()`, `emit()`),
+ * an OpenAI SDK `APIError` or an ai-sdk `APICallError` for a call the
+ * Gateway refused (also inside ai-sdk's `RetryError` or an error's
+ * `cause`), or the SDK's local-development `ConfigurationError` for a
+ * missing key, which answers as the deployed refusal would
+ * (`ai_provider_not_configured`, status 503, the `.dev.vars` names).
+ */
+export declare function refusalFromError(error: unknown): GatewayRefusal | null;
+/**
+ * Whether `error` (or a refusal already read) means no model is set up:
+ * `ai_provider_not_configured` or `ai_default_not_configured`, from the
+ * Gateway or, in local development, from the SDK with no key in
+ * `.dev.vars`. Show `refusalFromError(error).setup` to the person.
+ */
+export declare function isAiNotConfigured(error: unknown): boolean;
+//# sourceMappingURL=refusal.d.ts.map

package/dist/server/refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../../src/server/refusal.ts"],"names":[],"mappings":"AAgBA,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGpD,CAAC;AAEF;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,cAAc;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEpB,EACV,MAAM,EACN,IAAI,EACJ,OAAO,EACP,QAAa,EACb,KAAY,EACZ,OAAc,GACf,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAS5E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAKhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAWtE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}

package/dist/server/refusal.js

@@ -0,0 +1,193 @@
+/**
+ * The Gateway's own refusals, read the same way wherever they surface: a
+ * `Response` from a gateway fetch ({@link gatewayRefusal}), the error an
+ * SDK helper throws ({@link GatewayRefusalError}), or the error an AI
+ * client throws for a refused call (an OpenAI SDK's `APIError`, ai-sdk's
+ * `APICallError`) ({@link refusalFromError}).
+ *
+ * A refusal that means "not set up" (`integration_not_configured`,
+ * `ai_provider_not_configured`, `ai_default_not_configured`) carries what
+ * to do in the Gateway's words: `settings` (the setting names it needs),
+ * `setup` (one sentence for a person) and `command` (what an admin runs,
+ * `pnpm everyapp configure <app>`, or null). Show them as they are; never
+ * match the message text or hardcode a setting name or a command.
+ */
+import { ConfigurationError, GATEWAY_ERROR_HEADER } from "../internal/index.js";
+/** The refusal codes that mean no model is set up for the call. */
+export const AI_NOT_CONFIGURED_CODES = [
+    "ai_provider_not_configured",
+    "ai_default_not_configured",
+];
+/**
+ * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
+ * when the gateway won't send (`email_sender_not_allowed`,
+ * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
+ */
+export class GatewayRefusalError extends Error {
+    status;
+    code;
+    settings;
+    setup;
+    command;
+    constructor({ status, code, message, settings = [], setup = null, command = null, }) {
+        super(message);
+        this.name = "GatewayRefusalError";
+        this.status = status;
+        this.code = code;
+        this.settings = settings;
+        this.setup = setup;
+        this.command = command;
+    }
+}
+/**
+ * The gateway's own refusal in `response`, or null when the response is the
+ * provider's answer (which may be an error of its own). Reads the body only
+ * for a refusal, so call it before reading the body yourself.
+ */
+export async function gatewayRefusal(response) {
+    const code = response.headers.get(GATEWAY_ERROR_HEADER);
+    if (!code)
+        return null;
+    const body = await response.json().catch(() => null);
+    return refusalOf(response.status, code, body);
+}
+/**
+ * The Gateway's refusal behind a thrown error, or null when it isn't one:
+ * a {@link GatewayRefusalError} (`sendEmail()`, `listMembers()`, `emit()`),
+ * an OpenAI SDK `APIError` or an ai-sdk `APICallError` for a call the
+ * Gateway refused (also inside ai-sdk's `RetryError` or an error's
+ * `cause`), or the SDK's local-development `ConfigurationError` for a
+ * missing key, which answers as the deployed refusal would
+ * (`ai_provider_not_configured`, status 503, the `.dev.vars` names).
+ */
+export function refusalFromError(error) {
+    const seen = new Set();
+    let current = error;
+    while (current && typeof current === "object" && !seen.has(current)) {
+        seen.add(current);
+        const found = refusalHere(current);
+        if (found)
+            return found;
+        const record = current;
+        current = record["lastError"] ?? record["cause"];
+    }
+    return null;
+}
+/**
+ * Whether `error` (or a refusal already read) means no model is set up:
+ * `ai_provider_not_configured` or `ai_default_not_configured`, from the
+ * Gateway or, in local development, from the SDK with no key in
+ * `.dev.vars`. Show `refusalFromError(error).setup` to the person.
+ */
+export function isAiNotConfigured(error) {
+    const refusal = isRefusal(error) ? error : refusalFromError(error);
+    return refusal !== null && AI_NOT_CONFIGURED_CODES.includes(refusal.code);
+}
+function isRefusal(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        !(value instanceof Error) &&
+        typeof value.code === "string" &&
+        typeof value.status === "number");
+}
+function refusalHere(error) {
+    // A Response is read with gatewayRefusal(), which can read its body.
+    if (error instanceof Response)
+        return null;
+    if (error instanceof GatewayRefusalError) {
+        return {
+            status: error.status,
+            code: error.code,
+            message: error.message,
+            settings: error.settings,
+            setup: error.setup,
+            command: error.command,
+        };
+    }
+    if (error instanceof ConfigurationError) {
+        if (!error.code)
+            return null;
+        return {
+            status: 503,
+            code: error.code,
+            message: error.message,
+            settings: error.settings,
+            setup: error.message,
+            command: null,
+        };
+    }
+    const record = error;
+    // ai-sdk's APICallError: lowercase header names, the body as text.
+    const responseHeaders = record["responseHeaders"];
+    if (responseHeaders && typeof responseHeaders === "object") {
+        const code = headerOf(responseHeaders, GATEWAY_ERROR_HEADER);
+        if (!code)
+            return null;
+        return refusalOf(numberOf(record["statusCode"]), code, parseJson(record["responseBody"]), messageOf(error));
+    }
+    // An OpenAI SDK APIError: `headers` (Headers or a record), `status`,
+    // and `error`, the body's `error` object (which carries the same fields).
+    const headers = record["headers"];
+    if (headers && typeof headers === "object" && "status" in record) {
+        const code = headerOf(headers, GATEWAY_ERROR_HEADER);
+        if (!code)
+            return null;
+        return refusalOf(numberOf(record["status"]), code, record["error"], messageOf(error));
+    }
+    return null;
+}
+/** A refusal from its status, code and body (the Gateway's `{ code, message, … }`, or OpenAI's `{ error: {…} }`). */
+function refusalOf(status, code, body, fallback) {
+    const top = recordOf(body);
+    const inner = recordOf(top?.["error"]);
+    const field = (name) => top?.[name] ?? inner?.[name];
+    const message = stringOf(top?.["message"]) ??
+        stringOf(inner?.["message"]) ??
+        fallback ??
+        `The EveryApp gateway refused the call (${code}).`;
+    const settings = field("settings");
+    return {
+        status,
+        code,
+        message,
+        settings: Array.isArray(settings)
+            ? settings.filter((name) => typeof name === "string")
+            : [],
+        setup: stringOf(field("setup")) ?? null,
+        command: stringOf(field("command")) ?? null,
+    };
+}
+function headerOf(headers, name) {
+    if (typeof headers.get === "function") {
+        return headers.get(name);
+    }
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === name && typeof value === "string")
+            return value;
+    }
+    return null;
+}
+function recordOf(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function stringOf(value) {
+    return typeof value === "string" && value ? value : undefined;
+}
+function numberOf(value) {
+    return typeof value === "number" ? value : 0;
+}
+function parseJson(value) {
+    if (typeof value !== "string")
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function messageOf(error) {
+    return error instanceof Error && error.message ? error.message : undefined;
+}

package/dist/server/sendEmail.js

@@ -1,7 +1,7 @@
 import { ConfigurationError, EMAIL_SENDERS_ENV, emailDomain, emailProviderRefusal, emailRestBody, emailRestUrl, emailSenderRefusal, parseEmailList, parseEmailSender, parseSendEmailMessage, readEmailRestResponse, senderAllowed, serviceRoutePath, } from "../internal/index.js";
 import { applyAttribution, attributionFor, } from "./attribution.js";
 import { BINDING_ORIGIN } from "./gatewayFetch.js";
-import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
+import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
 /**
  * Send an email through the gateway's `email` capability: its sender
  * (EMAIL_FROM) unless `message.from` names an address the installation's