@every-app/sdk 0.3.0-rc.8 → 0.3.0

package/dist/server/everyApp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"everyApp.d.ts","sourceRoot":"","sources":["../../src/server/everyApp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAGL,kBAAkB,EAElB,aAAa,EAMb,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,EAEb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAG1C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAEpD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,CACzB,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,SAAS,oBAAoB,GAAG,gBAAgB,IAClD,CACF,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,YAAY,GAAG,IAAI,KACtB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,UAAU,cAAc,CAAC,IAAI,EAAE,IAAI,SAAS,oBAAoB;IAC9D,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAuKD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAW9B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,CAevB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,CAMjD;AA0BD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnE;AAUD,wEAAwE;AACxE,wBAAgB,QAAQ,CACtB,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,SAAS,oBAAoB,GAAG,gBAAgB,EAEpD,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EACpC,OAAO,CAAC,EAAE,eAAe,GACxB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9B;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,SAAS,oBAAoB,GAAG,gBAAgB,EAEpD,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EACpC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,OAAO,CAAC,EAAE,eAAe,GACxB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC"}
+{"version":3,"file":"everyApp.d.ts","sourceRoot":"","sources":["../../src/server/everyApp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAGL,kBAAkB,EAQlB,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,EAEb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;AACvC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAEpD,MAAM,WAAW,eAAe,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC7D,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChC,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,CACzB,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,SAAS,oBAAoB,GAAG,gBAAgB,IAClD,CACF,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,YAAY,GAAG,IAAI,KACtB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,UAAU,cAAc,CAAC,IAAI,EAAE,IAAI,SAAS,oBAAoB;IAC9D,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAqJD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAW9B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,CAevB;AA0BD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,wEAAwE;AACxE,wBAAgB,QAAQ,CACtB,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,SAAS,oBAAoB,GAAG,gBAAgB,EAEpD,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EACpC,OAAO,GAAE,eAAe,CAAC,IAAI,CAAM,GAClC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CA2D5B"}

package/dist/server/everyApp.js

@@ -13,12 +13,12 @@
  * `everyapp.config.ts` (the Cloudflare Vite plugin hides every file
  * `cloudflare.config.ts` imports from the Worker in dev).
  * It also answers the gateway's internal tools contract
- * (`/__everyapp/tools/*`) for the app's `defineTools()` catalog.
+ * (`/__everyapp/tools/*`) for the app's `defineTools()` catalog, and the
+ * event sink's deliveries (`/__everyapp/events`) for `events: { on }`.
  *
  * Around the handler and around each tool call it opens the request
- * context (context.ts): `currentUser()` reads the user anywhere below, and
- * every call back to the Gateway is attributed to the request without a
- * `for`. A deployed Worker is pinned to its organization
+ * context (context.ts): every call back to the Gateway is attributed to
+ * the request without a `for`. A deployed Worker is pinned to its organization
  * (`EVERY_APP_ORG_ID`), and an identity for any other is refused on both
  * paths. The response leaves without `Set-Cookie`: the perimeter strips
  * every `Cookie` before a request reaches the app, so a cookie the app's
@@ -28,7 +28,8 @@
 import { APP_ID_ENV, AUDIENCE_ENV, ConfigurationError, DEV_ENV, IdentityError, IDENTITY_HEADER, ISSUER_ENV, ORG_ID_ENV, PUBLIC_KEYS_ENV, getIdentityFromRequest, isAdmin, } from "../internal/index.js";
 import { currentUser, serveRequest } from "./context.js";
 import { handleToolsRequest } from "./toolsEndpoint.js";
-export { ConfigurationError, IdentityError, isAdmin };
+import { handleEventsRequest, } from "./eventsEndpoint.js";
+export { ConfigurationError, isAdmin };
 const requestIdentities = new WeakMap();
 function envValue(env, key) {
     if (!env || typeof env !== "object")
@@ -36,9 +37,8 @@ function envValue(env, key) {
     const value = env[key];
     return typeof value === "string" && value.length > 0 ? value : undefined;
 }
-function configFrom(manifest, options = {}) {
+function configFrom(options) {
     return {
-        manifestAppId: manifest?.id,
         issuer: options.issuer,
         keysEnvVar: options.keysEnvVar ?? PUBLIC_KEYS_ENV,
         publicKeys: options.publicKeys,
@@ -46,16 +46,9 @@ function configFrom(manifest, options = {}) {
         now: options.now,
     };
 }
-/**
- * The app id: EVERYAPP_APP_ID, or a manifest passed to everyApp() for
- * Workers without it; the two must agree when both are present.
- */
-function appIdFor(env, config) {
-    const fromEnv = envValue(env, APP_ID_ENV);
-    if (fromEnv && config.manifestAppId && fromEnv !== config.manifestAppId) {
-        throw new ConfigurationError(`${APP_ID_ENV} ("${fromEnv}") does not match the manifest id ("${config.manifestAppId}").`);
-    }
-    return fromEnv ?? config.manifestAppId;
+/** The app id, from EVERYAPP_APP_ID (which `everyAppWorker()` sets). */
+function appIdFor(env) {
+    return envValue(env, APP_ID_ENV);
 }
 function devIdentitiesAllowed(env, config) {
     const devEnv = envValue(env, DEV_ENV);
@@ -71,7 +64,7 @@ function devIdentitiesAllowed(env, config) {
  * app id stand in when EVERYAPP_AUDIENCE is unset.
  */
 function audienceFor(env, config) {
-    const appId = appIdFor(env, config);
+    const appId = appIdFor(env);
     const audience = envValue(env, AUDIENCE_ENV);
     if (audience)
         return audience;
@@ -153,7 +146,6 @@ const servedRequests = new WeakMap();
  * (a framework that hands out headers alone needs no made-up Request).
  * Answers from the request context or the per-request cache first, then
  * verifies the identity headers from the audience and public keys in env.
- * Inside a handler `everyApp()` serves, `currentUser()` is the shorter way.
  */
 export async function getEveryAppUser(request, env) {
     const cached = requestIdentities.get(request);
@@ -187,19 +179,6 @@ export async function requireEveryAppUser(request, env) {
         throw error;
     }
 }
-/**
- * The user of the request being served (`currentUser()`), or throw the
- * same 401 JSON Response as `requireEveryAppUser()` on a public route.
- * Outside a request (`withOrganization()` work, a handler not under
- * `everyApp()`) it throws `RequestContextError`, as `currentUser()` does.
- */
-export function requireCurrentUser() {
-    const user = currentUser();
-    if (!user) {
-        throw unauthorized("this request does not have an authenticated user");
-    }
-    return user;
-}
 /**
  * `response` without `Set-Cookie`: the perimeter strips every `Cookie`
  * before a request reaches the app, so no cookie the app sets ever comes
@@ -224,26 +203,16 @@ function withoutCookies(response) {
 export function hasScope(user, scope) {
     return user.scopes.includes("*") || user.scopes.includes(scope);
 }
-function isManifest(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        typeof value.id === "string");
-}
-export function everyApp(handler, manifestOrOptions, legacyOptions = {}) {
-    const manifest = isManifest(manifestOrOptions)
-        ? manifestOrOptions
-        : undefined;
-    const options = manifest || manifestOrOptions === undefined
-        ? legacyOptions
-        : manifestOrOptions;
-    const config = configFrom(manifest, options);
+/** Wrap a Worker fetch handler with Every App identity verification. */
+export function everyApp(handler, options = {}) {
+    const config = configFrom(options);
     return {
         async fetch(request, env, ctx) {
             let audience;
             let appId;
             try {
                 audience = audienceFor(env, config);
-                appId = appIdFor(env, config) ?? audience;
+                appId = appIdFor(env) ?? audience;
             }
             catch (err) {
                 if (err instanceof ConfigurationError) {
@@ -261,6 +230,13 @@ export function everyApp(handler, manifestOrOptions, legacyOptions = {}) {
             });
             if (toolsResponse)
                 return toolsResponse;
+            // So does the event sink's delivery path (`/__everyapp/events`).
+            const eventsResponse = await handleEventsRequest(request, env, ctx, {
+                events: options.events,
+                identity: identityOptions(env, config, audience),
+            });
+            if (eventsResponse)
+                return eventsResponse;
             let identity;
             try {
                 identity = await getIdentityFromRequest(request, identityOptions(env, config, audience));

package/dist/server/gatewayFetch.d.ts

@@ -3,6 +3,24 @@ export declare const BINDING_ORIGIN = "http://every-app-gateway.internal";
 export interface GatewayServiceBinding {
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
 }
+/**
+ * The Gateway the SDK's services call: the `EVERY_APP_GATEWAY` service
+ * binding when deployed; under `everyapp dev --gateway` (linked dev,
+ * docs/design/linked-dev.md) a `{ fetch }` that sends the same requests to
+ * the gateway-lite's loopback forwarder, which adds the person's token and
+ * forwards them to the real Gateway's `/linked-dev/<app>` route. Undefined
+ * with neither (stub and mirror modes: the `.dev.vars` fallbacks). A value
+ * under the binding's name that isn't one is answered as before by each
+ * caller (`ConfigurationError`).
+ */
+export declare function gatewayBinding(env: object): GatewayServiceBinding | undefined;
+/**
+ * The linked dev shim: a request to the binding's origin goes to the
+ * forwarder's URL with the same path and query, the run's nonce on it. The
+ * forwarder answers as the Gateway did, refusals included; nothing here
+ * falls back to a local key.
+ */
+export declare function linkedDevBinding(forwarderUrl: string, nonce: string): GatewayServiceBinding;
 export interface CreateGatewayFetchOptions {
     /**
      * The Worker env, as it is: the EVERY_APP_GATEWAY binding when deployed,
@@ -13,7 +31,7 @@ export interface CreateGatewayFetchOptions {
     /**
      * Whom the call is for. Left out, the request `everyApp()` is serving
      * (its user, while the identity is good) or the organization
-     * `withOrganization()` named; outside both, `RequestContextError`.
+     * an event delivery runs under; outside both, `RequestContextError`.
      * Explicitly: the inbound request, or `{ background: true,
      * organizationId }` for work no person started (crons, Workflows,
      * queues). A shared app's Worker must end up with one or the other

package/dist/server/gatewayFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatewayFetch.d.ts","sourceRoot":"","sources":["../../src/server/gatewayFetch.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,cAAc,sCAAsC,CAAC;AAGlE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE;AAeD,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACtD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,OAAO,KAAK,CAAC;AA2HhB,sFAAsF;AACtF,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAUT"}
+{"version":3,"file":"gatewayFetch.d.ts","sourceRoot":"","sources":["../../src/server/gatewayFetch.ts"],"names":[],"mappings":"AAiBA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,cAAc,sCAAsC,CAAC;AAGlE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAW7E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,qBAAqB,CAiBvB;AAeD,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACtD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,OAAO,KAAK,CAAC;AA2HhB,sFAAsF;AACtF,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAUT"}

package/dist/server/gatewayFetch.js

@@ -1,13 +1,55 @@
-import { AI_DEFAULT_MODEL, AI_DEFAULT_PROVIDER, AI_DEFAULT_ROUTES, aiProviderSettings, authorizationOf, ConfigurationError, DEV_AI_PROVIDERS, devAiProvider, joinProviderUrl, resolveAiDefault, } from "../internal/index.js";
+import { AI_DEFAULT_MODEL, AI_DEFAULT_PROVIDER, AI_DEFAULT_ROUTES, aiProviderSettings, authorizationOf, ConfigurationError, DEV_AI_PROVIDERS, DEV_ENV, devAiProvider, joinProviderUrl, LINKED_DEV_HEADER, LINKED_DEV_NONCE_ENV, LINKED_DEV_URL_ENV, resolveAiDefault, } from "../internal/index.js";
 import { applyAttribution, attributionFor, } from "./attribution.js";
 export const BINDING_ORIGIN = "http://every-app-gateway.internal";
 const AI_PROXY_PREFIX = "/api/ai/";
+/**
+ * The Gateway the SDK's services call: the `EVERY_APP_GATEWAY` service
+ * binding when deployed; under `everyapp dev --gateway` (linked dev,
+ * docs/design/linked-dev.md) a `{ fetch }` that sends the same requests to
+ * the gateway-lite's loopback forwarder, which adds the person's token and
+ * forwards them to the real Gateway's `/linked-dev/<app>` route. Undefined
+ * with neither (stub and mirror modes: the `.dev.vars` fallbacks). A value
+ * under the binding's name that isn't one is answered as before by each
+ * caller (`ConfigurationError`).
+ */
+export function gatewayBinding(env) {
+    const values = env;
+    const binding = values["EVERY_APP_GATEWAY"];
+    if (binding)
+        return binding;
+    if (!values[DEV_ENV])
+        return undefined;
+    const url = values[LINKED_DEV_URL_ENV];
+    const nonce = values[LINKED_DEV_NONCE_ENV];
+    if (typeof url !== "string" || !url.trim() || typeof nonce !== "string") {
+        return undefined;
+    }
+    return linkedDevBinding(url.trim(), nonce);
+}
+/**
+ * The linked dev shim: a request to the binding's origin goes to the
+ * forwarder's URL with the same path and query, the run's nonce on it. The
+ * forwarder answers as the Gateway did, refusals included; nothing here
+ * falls back to a local key.
+ */
+export function linkedDevBinding(forwarderUrl, nonce) {
+    const base = forwarderUrl.replace(/\/+$/, "");
+    return {
+        fetch(input, init) {
+            const outbound = new Request(input, init);
+            const url = new URL(outbound.url);
+            const headers = new Headers(outbound.headers);
+            headers.set(LINKED_DEV_HEADER, nonce);
+            return fetch(streamingRequest(`${base}${url.pathname}${url.search}`, outbound, headers));
+        },
+    };
+}
 export function createGatewayFetch({ env: workerEnv, for: explicitTarget, optional = false, }) {
     const env = workerEnv;
     // Checked now, so a call nobody's fails where the fetch is made; and
     // again per call, where an identity may since have neared its expiry.
     attributionFor(env, explicitTarget, "createGatewayFetch");
-    const binding = env.EVERY_APP_GATEWAY;
+    const binding = gatewayBinding(env);
     const devProviders = env.EVERYAPP_DEV ? localProviders(env) : {};
     if (binding && typeof binding.fetch !== "function") {
         throw new ConfigurationError("EVERY_APP_GATEWAY is configured but is not a valid service binding.");
@@ -137,7 +179,7 @@ function directProviderPath(input, env) {
         // names a model sends it as it is).
         const values = env;
         const resolution = resolveAiDefault({
-            provider: null,
+            choice: null,
             isSet: (name) => typeof values[name] === "string" &&
                 values[name].trim().length > 0,
         });

package/dist/server/index.d.ts

@@ -3,27 +3,24 @@
  *
  * There is intentionally no client-side export.
  */
-export { ConfigurationError, IdentityError, everyApp, getEveryAppUser, hasScope, isAdmin, requireCurrentUser, requireEveryAppUser, type EveryAppOptions, type EveryAppManifestLike, type EveryAppHandler, type EveryAppUser, type IdentityResult, type OrgRole, } from "./everyApp.js";
-export { OrganizationMismatchError, RequestContextError, currentUser, withOrganization, } from "./context.js";
+export { ConfigurationError, everyApp, getEveryAppUser, hasScope, isAdmin, requireEveryAppUser, type EveryAppOptions, type EveryAppHandler, type EveryAppUser, type IdentityResult, type OrgRole, } from "./everyApp.js";
 export { AttributionError, type GatewayCallFor } from "./attribution.js";
 export { gatewayUrl } from "./gatewayUrl.js";
 export type { EveryAppEnv } from "./env.js";
 /** The header a Gateway refusal carries its code in; `gatewayRefusal()` reads the rest. */
 export { GATEWAY_ERROR_HEADER } from "../internal/protocol.js";
-export { authorizeUrl, type AuthorizeUrlOptions } from "./authorizeUrl.js";
 export { connectPath, connectUrl, type ConnectUrlOptions, } from "./connectUrl.js";
 export { createGatewayFetch, type CreateGatewayFetchOptions, } from "./gatewayFetch.js";
-export { ai, aiBaseUrl, aiStatus, providerBaseUrl, AI_DEFAULT_BASE_URL, type AiClient, type AiStatus, } from "./ai.js";
-export { AI_NOT_CONFIGURED_CODES, GatewayRefusalError, gatewayRefusal, isAiNotConfigured, refusalFromError, type GatewayRefusal, type SetupInfo, } from "./refusal.js";
+export { aiBaseUrl, providerBaseUrl } from "./ai.js";
+export { GatewayRefusalError, gatewayRefusal, refusalFromError, type GatewayRefusal, type SetupInfo, } from "./refusal.js";
 export { devAccessTokenName, integrationFetch, integrationStatus, type EmailIntegrationStatus, type IntegrationFetchOptions, type IntegrationStatus, type IntegrationStatusOf, type OAuthClientIntegrationStatus, } from "./integrationFetch.js";
 export { nodeServerHandler, type NodeServer, type NodeServerHandlerOptions, } from "./nodeServer.js";
 export { sendEmail, type SendEmailOptions } from "./sendEmail.js";
-export { gatewayAiBinding, type GatewayAiBindingOptions } from "./aiBinding.js";
-export { gatewayEmailBinding, type GatewayEmailBindingMessage, type GatewayEmailBindingOptions, } from "./emailBinding.js";
 export { listMembers, type ListMembersOptions } from "./listMembers.js";
 export { emit, type EmitOptions } from "./emit.js";
-export type { ApiKeyCapabilityId, CapabilityId, OAuthClientCapabilityId, ConnectionAccount, EmailAddressInput, EmailAttachmentInput, SendEmailMessage, SendEmailResult, ListMembersResult, OrganizationMember, OrganizationMemberRole, EmitEventResult, } from "../internal/index.js";
+export { WEBHOOK_MAX_BYTES_DEFAULT, verifyWebhook, type VerifyWebhookOptions, type WebhookProvider, type WebhookRefusalReason, type WebhookVerification, } from "./webhooks.js";
+export type { AppEvent, AppEventHandler, AppEventsOptions, } from "./eventsEndpoint.js";
+export type { ApiKeyCapabilityId, CapabilityId, OAuthPresetId, EmailAddressInput, EmailAttachmentInput, SendEmailMessage, SendEmailResult, ListMembersResult, OrganizationMember, OrganizationMemberRole, EmitEventResult, } from "../internal/index.js";
 export { ToolError, defineTools, toolResult, type DefineToolsOptions, type PlainToolSchema, type StandardSchemaWithJSON, type ToolContext, type ToolDefinition, type ToolResult, type ToolSchema, type ToolSet, } from "./tools.js";
 export type { ToolRisk } from "../internal/index.js";
-export { fromMcpTools, type FromMcpToolsOptions, type McpToolAnnotationsLike, type McpToolLike, type McpToolResultLike, type McpToolSchemaLike, } from "./fromMcpTools.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,eAAe,EACf,QAAQ,EACR,OAAO,EACP,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,2FAA2F;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,UAAU,EACV,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,EAAE,EACF,SAAS,EACT,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,QAAQ,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,SAAS,EACT,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,OAAO,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,QAAQ,EACR,OAAO,EACP,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,2FAA2F;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,WAAW,EACX,UAAU,EACV,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,QAAQ,EACR,eAAe,EACf,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,SAAS,EACT,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,OAAO,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/server/index.js

@@ -3,23 +3,19 @@
  *
  * There is intentionally no client-side export.
  */
-export { ConfigurationError, IdentityError, everyApp, getEveryAppUser, hasScope, isAdmin, requireCurrentUser, requireEveryAppUser, } from "./everyApp.js";
-export { OrganizationMismatchError, RequestContextError, currentUser, withOrganization, } from "./context.js";
+export { ConfigurationError, everyApp, getEveryAppUser, hasScope, isAdmin, requireEveryAppUser, } from "./everyApp.js";
 export { AttributionError } from "./attribution.js";
 export { gatewayUrl } from "./gatewayUrl.js";
 /** The header a Gateway refusal carries its code in; `gatewayRefusal()` reads the rest. */
 export { GATEWAY_ERROR_HEADER } from "../internal/protocol.js";
-export { authorizeUrl } from "./authorizeUrl.js";
 export { connectPath, connectUrl, } from "./connectUrl.js";
 export { createGatewayFetch, } from "./gatewayFetch.js";
-export { ai, aiBaseUrl, aiStatus, providerBaseUrl, AI_DEFAULT_BASE_URL, } from "./ai.js";
-export { AI_NOT_CONFIGURED_CODES, GatewayRefusalError, gatewayRefusal, isAiNotConfigured, refusalFromError, } from "./refusal.js";
+export { aiBaseUrl, providerBaseUrl } from "./ai.js";
+export { GatewayRefusalError, gatewayRefusal, refusalFromError, } from "./refusal.js";
 export { devAccessTokenName, integrationFetch, integrationStatus, } from "./integrationFetch.js";
 export { nodeServerHandler, } from "./nodeServer.js";
 export { sendEmail } from "./sendEmail.js";
-export { gatewayAiBinding } from "./aiBinding.js";
-export { gatewayEmailBinding, } from "./emailBinding.js";
 export { listMembers } from "./listMembers.js";
 export { emit } from "./emit.js";
+export { WEBHOOK_MAX_BYTES_DEFAULT, verifyWebhook, } from "./webhooks.js";
 export { ToolError, defineTools, toolResult, } from "./tools.js";
-export { fromMcpTools, } from "./fromMcpTools.js";

package/dist/server/integrationFetch.d.ts

@@ -1,45 +1,47 @@
-import { type ApiKeyCapabilityId, type CapabilityId, type ConnectionAccount, type EmailCapabilityStatus, type OAuthClientCapabilityId } from "../internal/index.js";
+import { type ApiKeyCapabilityId, type CapabilityId, type EmailCapabilityStatus, type OAuthPresetId } from "../internal/index.js";
 import { type GatewayCallFor } from "./attribution.js";
 import type { SetupInfo } from "./refusal.js";
 export interface IntegrationFetchOptions {
     /**
      * The Worker env: the EVERY_APP_GATEWAY binding when deployed, or in local
      * dev EVERYAPP_DEV and the provider's key (e.g. DATAFORSEO_API_KEY in
-     * `.dev.vars`).
+     * `.dev.vars`), or for an OAuth provider a token you obtained yourself
+     * (`GOOGLE_WORKSPACE_ACCESS_TOKEN`, {@link devAccessTokenName}).
      */
     env: object;
     /**
      * A provider the app lists in its manifest's `capabilities`: one whose
-     * key the gateway holds, or one whose OAuth client it holds (its token
-     * endpoints only). The built-in catalog's ids complete; a provider
-     * registered on the gateway (`everyapp provider add`) is any other id,
+     * key the gateway holds, or an OAuth provider whose connections it
+     * holds. The catalog's ids and the OAuth presets' complete; a provider
+     * registered on the gateway (an OAuth preset's row among them) is
      * reached through the binding, which checks it. The `email` capability
      * is sent with `sendEmail()` instead.
      */
-    provider: ApiKeyCapabilityId | OAuthClientCapabilityId | (string & {});
+    provider: ApiKeyCapabilityId | OAuthPresetId | (string & {});
     /**
      * Whom the call is for. Left out, the request `everyApp()` is serving
-     * (its user, while the identity is good) or the organization
-     * `withOrganization()` named; outside both, `RequestContextError`.
+     * (its person, while the identity is good) or the organization
+     * an event delivery runs under; outside both, `RequestContextError`.
      * Explicitly: the inbound request, or `{ background: true,
      * organizationId }` for work no person started (crons, Workflows,
      * queues). A shared app's Worker must end up with one or the other
      * ({@link AttributionError}).
+     *
+     * For an OAuth provider the call uses the connection the person behind
+     * it made in this app. `{ background: true, userId }` names another
+     * member's connection to this app instead, at any time, even while
+     * serving a different person: the call then carries that member and
+     * not the person being served. Only an organization's own app may.
      */
     for?: GatewayCallFor;
-    /**
-     * For an OAuth provider the gateway holds connections for: whose
-     * connection the call uses, the person's (`user`, the default when a
-     * person is behind the call) or the organization's (`organization`,
-     * the default for background work). Sent as `x-everyapp-account`.
-     */
-    account?: ConnectionAccount;
     /**
      * `true`: answer null instead of throwing `ConfigurationError` when the
      * provider is unavailable (no binding, and in local dev not its
      * settings in `.dev.vars`), so a feature that can do without it checks
      * for null. A wrong provider id, a binding that isn't one, and an
-     * attribution mistake still throw.
+     * attribution mistake still throw. An OAuth provider is never
+     * unavailable this way: without a connection its calls answer
+     * `integration_not_connected`.
      */
     optional?: boolean;
 }
@@ -51,19 +53,19 @@ export interface IntegrationFetchOptions {
  * sees the key. A refusal the gateway makes itself comes back as a response
  * {@link gatewayRefusal} recognizes; anything else is the provider's answer.
  *
- * For an OAuth client (`google-workspace`, `slack`, ...) it reaches the
- * provider's token endpoints only, and the gateway puts its client on the
- * request: send the code (or refresh token) without `client_id` or
- * `client_secret`. Build the authorize URL with {@link authorizeUrl} from
- * {@link integrationStatus}, and call the provider's API with the user's
- * token directly.
+ * For an OAuth provider (`google-workspace`, `github`, ...) the gateway
+ * puts the token of the person's connection in this app on the call, to
+ * the provider's API hosts only. Without one the answer is a 409
+ * `integration_not_connected` refusal with the `connectPath` to send the
+ * person to ({@link connectUrl}).
  *
- * In local dev only, with no binding, the developer's own key or client
- * from `.dev.vars` reaches the provider directly, under the gateway's names:
+ * In local dev only, with no binding, the developer's own key from
+ * `.dev.vars` reaches the provider directly, under the gateway's names:
  * a catalog provider's from the catalog, a provider registered on the
  * gateway from its spec in `.everyapp/providers/<id>.json` (`everyapp
  * provider show <id> --save` writes it), put on the call as the gateway's
- * spec says.
+ * spec says. An OAuth provider's calls carry a token you obtained
+ * yourself ({@link devAccessTokenName}), to its API hosts only.
  */
 export declare function integrationFetch(options: IntegrationFetchOptions & {
     optional: true;
@@ -92,70 +94,56 @@ export interface IntegrationStatus extends SetupInfo {
  */
 export type EmailIntegrationStatus = IntegrationStatus & Pick<EmailCapabilityStatus, "sender" | "senders" | "provider">;
 /**
- * An OAuth client's status: as {@link IntegrationStatus}, plus what the app
- * needs to send people to the provider's authorize page, present only when
- * the app lists the capability and the gateway holds the client.
+ * An OAuth provider's status: as {@link IntegrationStatus}, plus the
+ * scopes the app's manifest lists, where the person connects in this app,
+ * and their connection to this app. `configured` means the gateway holds
+ * the client; `ready` that a call for this person would go through.
  */
-export interface OAuthClientIntegrationStatus extends IntegrationStatus {
-    /** The client's public id, for the authorize URL. */
-    clientId?: string;
-    /**
-     * For a client with scope sets (`google-workspace`, `microsoft-365`): the
-     * set names the app's manifest entry declares, `[]` when the entry voids
-     * its grant (no `scopes`, or a set this gateway doesn't offer), in which
-     * case `ready` is false and no token call can complete.
-     */
-    scopeSets?: readonly string[];
+export type OAuthClientIntegrationStatus = IntegrationStatus & {
+    /** The provider's scopes as the app's `everyapp.config.ts` lists them. */
+    scopes: readonly string[];
     /**
-     * The provider's scope strings those sets ask for, in the provider's
-     * spelling and the registry's order, for the authorize URL
-     * ({@link authorizeUrl} puts them on). The gateway refuses a token that
-     * carries more.
+     * Where the person connects the provider in this app:
+     * `/connect/<id>?app=<app>` on the Gateway ({@link connectUrl} builds
+     * the absolute URL); null when the app can't connect (the manifest
+     * doesn't list it, or the gateway holds no client).
      */
-    scopes?: readonly string[];
-    /** Slack's `user_scope` strings, when the sets name any. */
-    userScopes?: readonly string[];
+    connectPath: string | null;
     /**
-     * Which flows the client supports: `app` (the app runs authorize and
-     * callback itself and keeps the tokens, the social networks), `gateway`
-     * (the Gateway holds the connection; API calls go through
-     * `integrationFetch` with the token injected) or `both` (Google,
-     * Microsoft, Slack, Discord and every registered OAuth provider).
+     * The connection the call would use (the person's in this app, or the
+     * member's `for: { background: true, userId }` names), or null when there
+     * is none. `ready` false with `missingScopes` when it lacks a scope the
+     * app now lists, and `reconnect` when the person has to connect again
+     * (missing scopes, or it expired).
      */
-    flow?: "app" | "gateway" | "both";
-    /** Where a person connects on the Gateway: `/connect/<id>`; see `connectUrl()`. */
-    connectPath?: string;
-    /**
-     * The connection the caller's account would use (the person's, or the
-     * organization's for background work), or null when there is none yet;
-     * `reconnect` when it exists but lacks a set the app declares or has
-     * expired, so the person has to connect again.
-     */
-    connection?: {
-        account: ConnectionAccount;
+    connection: {
+        /** The account's name at the provider (an email address, a login). */
         label: string | null;
-        scopeSets: readonly string[];
+        /** The scopes it holds, canonical. */
+        scopes: readonly string[];
         ready: boolean;
-        reconnect?: boolean;
+        missingScopes?: readonly string[];
+        reconnect?: true;
     } | null;
-}
-/** The status of a capability: email's carries its senders, an OAuth client's its id. */
-export type IntegrationStatusOf<P extends string> = P extends "email" ? EmailIntegrationStatus : P extends OAuthClientCapabilityId ? OAuthClientIntegrationStatus : IntegrationStatus;
+};
+/** The status of a capability: email's carries its senders, an OAuth provider's the connection. */
+export type IntegrationStatusOf<P extends string> = P extends "email" ? EmailIntegrationStatus : P extends OAuthPresetId ? OAuthClientIntegrationStatus : IntegrationStatus;
 /**
  * Whether the app can use an integration right now, without calling the
  * provider: show "an admin needs to set up DataForSEO" (or "sending isn't
- * set up") up front instead of failing mid-task. An OAuth client's status
- * carries its public `clientId` for the authorize URL.
+ * set up", or "connect Google") up front instead of failing mid-task. An
+ * OAuth provider's status carries the person's connection in this app and
+ * where to connect.
  */
 export declare function integrationStatus<P extends CapabilityId | (string & {})>({ env, provider, for: explicitTarget, }: {
     env: object;
     provider: P;
     /**
      * Whom the status is for: the request being served (its person), so an
-     * OAuth provider's `connection` is that person's; background work
-     * (`withOrganization()`) its organization, whose own connection is then
-     * reported. Explicitly the inbound request or `{ background: true,
-     * organizationId }`, as on every call.
+     * OAuth provider's `connection` is that person's in this app; `{
+     * background: true, userId }` that member's. Explicitly the inbound
+     * request or `{ background: true, organizationId, userId? }`, as on
+     * every call.
      */
     for?: GatewayCallFor;
 }): Promise<IntegrationStatusOf<P>>;

package/dist/server/integrationFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrationFetch.d.ts","sourceRoot":"","sources":["../../src/server/integrationFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EA+BL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAE1B,KAAK,uBAAuB,EAQ7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,EAAE,kBAAkB,GAAG,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACpD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,KAAK,CAAC;AA+JhB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAugBD,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GACpD,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;IAClC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,iBAAiB,CAAC;QAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,GACjE,sBAAsB,GACtB,CAAC,SAAS,uBAAuB,GAC/B,4BAA4B,GAC5B,iBAAiB,CAAC;AAExB;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,EACA,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAWlC"}
+{"version":3,"file":"integrationFetch.d.ts","sourceRoot":"","sources":["../../src/server/integrationFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAE1B,KAAK,aAAa,EAKnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,EAAE,kBAAkB,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7D;;;;;;;;;;;;;;OAcG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACpD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,KAAK,CAAC;AAgHhB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAsLD,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GACpD,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GAAG,iBAAiB,GAAG;IAC7D,0EAA0E;IAC1E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,UAAU,EAAE;QACV,sEAAsE;QACtE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,sCAAsC;QACtC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,mGAAmG;AACnG,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,GACjE,sBAAsB,GACtB,CAAC,SAAS,aAAa,GACrB,4BAA4B,GAC5B,iBAAiB,CAAC;AAExB;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,EACA,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAWlC"}