@every-app/sdk 0.3.0-rc.8 → 0.3.0

package/dist/server/aiBinding.d.ts

@@ -1,68 +0,0 @@
-/**
- * `gatewayAiBinding(env)`: the Gateway's AI providers as a Workers AI
- * binding, for code written against `env.AI.run(model, inputs, options)`.
- *
- * An app on Every App needs no `ai` binding of its own to call models: the
- * Gateway holds the keys, counts the calls and keeps the app to `ai.models`.
- * Code that already calls `env.AI.run()` (upstream code a port keeps, the
- * Agents SDK, `workers-ai-provider`) gets this object in its place:
- *
- *   const AI = gatewayAiBinding(env, { for: request });
- *   await AI.run("@cf/meta/llama-3.1-8b-instruct-fast", { messages });
- *
- * Each `run()` becomes an OpenAI-compatible call on the provider's route
- * through the Gateway (`createGatewayFetch`): text generation (`messages`
- * or `prompt`) on its chat completions route, text embeddings (`text`) on
- * its embeddings route, answered in Workers AI's shapes (`{ response,
- * tool_calls, usage }`, `{ shape, data }`, or a stream of `data:
- * {"response": …}` events with `stream: true`). In local development
- * without a Gateway, the developer's own key in `.dev.vars` is used, as
- * `createGatewayFetch` does (WORKERS_AI_API_TOKEN and CLOUDFLARE_ACCOUNT_ID
- * for Workers AI).
- */
-import { AI_DEFAULT_PROVIDER, type AiProviderId } from "../internal/index.js";
-import type { GatewayCallFor } from "./attribution.js";
-export interface GatewayAiBindingOptions {
-    /**
-     * Whom the calls are for: the inbound request, or `{ background: true,
-     * organizationId }` (createGatewayFetch's `for`).
-     */
-    for?: GatewayCallFor;
-    /**
-     * The Gateway provider the calls go to: an `ai` entry of the catalog
-     * with OpenAI-compatible routes (`workers-ai`, `openrouter`, `openai`,
-     * …), or `default`, the operator's model (`ai: { chat: true }`).
-     * Default: `workers-ai`, the provider `env.AI` reaches, so `@cf/…` model
-     * ids work as they are. The manifest lists the provider under
-     * `providers` (or says `ai.chat` for `default`).
-     */
-    provider?: AiProviderId | typeof AI_DEFAULT_PROVIDER;
-    /**
-     * The model id to send for a model the code names, e.g.
-     * `{ "@cf/meta/llama-3.1-8b-instruct-fast": "meta-llama/llama-3.1-8b-instruct" }`
-     * with `provider: "openrouter"`. A model not listed is sent as it is,
-     * except that on `default` an `@cf/…` id becomes `default` (the
-     * operator's model).
-     */
-    models?: Readonly<Record<string, string>>;
-}
-/**
- * A Workers AI binding (`Ai`) over the Gateway: pass it where code takes
- * `env.AI`. `run()` covers text generation (messages or prompt; tools;
- * `stream: true`; `returnRawResponse`, which returns the provider's
- * OpenAI-shaped `Response`) and text embeddings; the binding's other
- * methods (`gateway()`, `autorag()`, `models()`, `toMarkdown()`, …) and
- * other tasks (images, audio, batches, websockets) throw
- * `ConfigurationError`. `options.gateway` is ignored: the Gateway's
- * operator decides whether calls go through Cloudflare AI Gateway
- * (`everyapp ai gateway on`).
- *
- * Errors are thrown as a binding throws them: `GatewayRefusalError` when
- * the Gateway refused (`ai_provider_not_configured`, `model_not_allowed`,
- * …), `ConfigurationError` where createGatewayFetch throws one (no binding
- * and no dev key), and an `Error` naming the status when the provider
- * answered with an error. Nothing is checked when the binding is made, so
- * making one per request costs nothing.
- */
-export declare function gatewayAiBinding(env: object, options?: GatewayAiBindingOptions): Ai;
-//# sourceMappingURL=aiBinding.d.ts.map

package/dist/server/aiBinding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"aiBinding.d.ts","sourceRoot":"","sources":["../../src/server/aiBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAEL,mBAAmB,EAInB,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,mBAAmB,CAAC;IACrD;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C;AAUD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,uBAA4B,GACpC,EAAE,CAoEJ"}

package/dist/server/aiBinding.js

@@ -1,294 +0,0 @@
-/**
- * `gatewayAiBinding(env)`: the Gateway's AI providers as a Workers AI
- * binding, for code written against `env.AI.run(model, inputs, options)`.
- *
- * An app on Every App needs no `ai` binding of its own to call models: the
- * Gateway holds the keys, counts the calls and keeps the app to `ai.models`.
- * Code that already calls `env.AI.run()` (upstream code a port keeps, the
- * Agents SDK, `workers-ai-provider`) gets this object in its place:
- *
- *   const AI = gatewayAiBinding(env, { for: request });
- *   await AI.run("@cf/meta/llama-3.1-8b-instruct-fast", { messages });
- *
- * Each `run()` becomes an OpenAI-compatible call on the provider's route
- * through the Gateway (`createGatewayFetch`): text generation (`messages`
- * or `prompt`) on its chat completions route, text embeddings (`text`) on
- * its embeddings route, answered in Workers AI's shapes (`{ response,
- * tool_calls, usage }`, `{ shape, data }`, or a stream of `data:
- * {"response": …}` events with `stream: true`). In local development
- * without a Gateway, the developer's own key in `.dev.vars` is used, as
- * `createGatewayFetch` does (WORKERS_AI_API_TOKEN and CLOUDFLARE_ACCOUNT_ID
- * for Workers AI).
- */
-import { AI_DEFAULT_MODEL, AI_DEFAULT_PROVIDER, AI_DEFAULT_ROUTES, ConfigurationError, devAiProvider, } from "../internal/index.js";
-import { BINDING_ORIGIN, createGatewayFetch } from "./gatewayFetch.js";
-import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
-/**
- * A Workers AI binding (`Ai`) over the Gateway: pass it where code takes
- * `env.AI`. `run()` covers text generation (messages or prompt; tools;
- * `stream: true`; `returnRawResponse`, which returns the provider's
- * OpenAI-shaped `Response`) and text embeddings; the binding's other
- * methods (`gateway()`, `autorag()`, `models()`, `toMarkdown()`, …) and
- * other tasks (images, audio, batches, websockets) throw
- * `ConfigurationError`. `options.gateway` is ignored: the Gateway's
- * operator decides whether calls go through Cloudflare AI Gateway
- * (`everyapp ai gateway on`).
- *
- * Errors are thrown as a binding throws them: `GatewayRefusalError` when
- * the Gateway refused (`ai_provider_not_configured`, `model_not_allowed`,
- * …), `ConfigurationError` where createGatewayFetch throws one (no binding
- * and no dev key), and an `Error` naming the status when the provider
- * answered with an error. Nothing is checked when the binding is made, so
- * making one per request costs nothing.
- */
-export function gatewayAiBinding(env, options = {}) {
-    const provider = options.provider ?? "workers-ai";
-    async function run(model, inputs, runOptions = {}) {
-        if (runOptions.websocket) {
-            throw unsupported("run() with websocket: true");
-        }
-        if (!inputs || typeof inputs !== "object") {
-            throw unsupported("run() without an inputs object");
-        }
-        if (Array.isArray(inputs["requests"])) {
-            throw unsupported("run() with a batch of requests");
-        }
-        const embedding = !("messages" in inputs) && !("prompt" in inputs) && "text" in inputs;
-        if (!embedding && !("messages" in inputs) && !("prompt" in inputs)) {
-            throw unsupported("run() for anything but text generation (messages or prompt) and text embeddings (text)");
-        }
-        const url = `${BINDING_ORIGIN}/api/ai/${provider}${routeOf(provider, embedding ? "embeddings" : "chat")}`;
-        const sent = modelToSend(provider, model, options.models);
-        const body = embedding
-            ? { model: sent, input: inputs["text"] }
-            : chatBody(sent, inputs);
-        const gatewayFetch = createGatewayFetch({
-            env,
-            for: options.for,
-        });
-        const response = await gatewayFetch(url, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify(body),
-            ...(runOptions.signal ? { signal: runOptions.signal } : {}),
-        });
-        if (runOptions.returnRawResponse)
-            return response;
-        await throwIfFailed(response, provider);
-        if (embedding)
-            return embeddingOutput(await response.json());
-        if (inputs["stream"] === true) {
-            if (!response.body)
-                return new ReadableStream();
-            return response.body.pipeThrough(toWorkersAiStream());
-        }
-        return textOutput(await response.json());
-    }
-    const notHere = (method) => () => {
-        throw unsupported(`env.AI.${method}()`);
-    };
-    const binding = {
-        aiGatewayLogId: null,
-        run,
-        gateway: notHere("gateway"),
-        autorag: notHere("autorag"),
-        aiSearch: notHere("aiSearch"),
-        websearch: notHere("websearch"),
-        models: notHere("models"),
-        toMarkdown: notHere("toMarkdown"),
-    };
-    // `Ai` is the app's own Workers types' class (it changes with each
-    // version); the object above is its working subset, the rest throwing.
-    return binding;
-}
-function unsupported(what) {
-    return new ConfigurationError(`${what} isn't available through the Every App gateway; call the provider's routes with createGatewayFetch() instead.`);
-}
-/** The provider's path for a chat or an embeddings call, under `/api/ai/<provider>`. */
-function routeOf(provider, kind) {
-    if (provider === AI_DEFAULT_PROVIDER)
-        return AI_DEFAULT_ROUTES[kind];
-    const spec = devAiProvider(provider);
-    if (!spec) {
-        throw new ConfigurationError(`gatewayAiBinding: ${JSON.stringify(provider)} is not an AI provider of the catalog.`);
-    }
-    const route = spec[kind];
-    if (!route) {
-        throw new ConfigurationError(`gatewayAiBinding: ${provider} has no OpenAI-compatible ${kind === "chat" ? "chat completions" : "embeddings"} route.`);
-    }
-    return route.path;
-}
-function modelToSend(provider, model, models) {
-    const mapped = models && Object.hasOwn(models, model) ? models[model] : null;
-    if (mapped)
-        return mapped;
-    if (provider === AI_DEFAULT_PROVIDER && model.startsWith("@cf/")) {
-        return AI_DEFAULT_MODEL;
-    }
-    return model;
-}
-/**
- * Workers AI's text generation inputs as a chat completions body: `prompt`
- * as one user message, legacy tools (`{ name, description, parameters }`)
- * as OpenAI's, everything else (max_tokens, temperature, response_format,
- * stream, …) as it is. Never adds `stream_options` (Workers AI refuses it
- * on a call that doesn't stream).
- */
-function chatBody(model, inputs) {
-    const { prompt, messages, tools, raw: _raw, lora: _lora, ...rest } = inputs;
-    const body = {
-        ...rest,
-        model,
-        messages: messages ??
-            (typeof prompt === "string" ? [{ role: "user", content: prompt }] : []),
-    };
-    if (Array.isArray(tools))
-        body["tools"] = tools.map(openAiTool);
-    return body;
-}
-function openAiTool(tool) {
-    if (!isRecord(tool) || "function" in tool)
-        return tool;
-    const { name, description, parameters } = tool;
-    return {
-        type: "function",
-        function: {
-            name,
-            ...(description === undefined ? {} : { description }),
-            ...(parameters === undefined ? {} : { parameters }),
-        },
-    };
-}
-async function throwIfFailed(response, provider) {
-    if (response.ok)
-        return;
-    const refusal = await gatewayRefusal(response.clone());
-    if (refusal)
-        throw new GatewayRefusalError(refusal);
-    const text = await response.text().catch(() => "");
-    throw new Error(`AI (${provider}) answered ${response.status}${text ? `: ${text.slice(0, 500)}` : ""}`);
-}
-/** A chat completion as Workers AI answers text generation. */
-function textOutput(body) {
-    const choice = firstChoice(body);
-    const message = isRecord(choice?.["message"]) ? choice["message"] : {};
-    const toolCalls = workersAiToolCalls(message["tool_calls"]);
-    const usage = isRecord(body) ? body["usage"] : undefined;
-    return {
-        // Workers AI may send an all-digit reply as a JSON number.
-        response: textOf(message["content"]),
-        ...(toolCalls ? { tool_calls: toolCalls } : {}),
-        ...(isRecord(usage) ? { usage } : {}),
-    };
-}
-/**
- * OpenAI tool calls as both forms Workers AI answers with: the legacy
- * `{ name, arguments }` (arguments parsed) and the OpenAI-shaped
- * `{ id, type, function }`.
- */
-function workersAiToolCalls(calls) {
-    if (!Array.isArray(calls) || calls.length === 0)
-        return undefined;
-    return calls.filter(isRecord).map((call) => {
-        const fn = isRecord(call["function"]) ? call["function"] : {};
-        const args = fn["arguments"];
-        return {
-            ...(call["id"] === undefined ? {} : { id: call["id"] }),
-            type: "function",
-            function: { name: fn["name"], arguments: args },
-            name: fn["name"],
-            arguments: typeof args === "string" ? parsedOr(args) : args,
-        };
-    });
-}
-/** Embeddings as Workers AI answers them: `{ shape: [rows, dimensions], data }`. */
-function embeddingOutput(body) {
-    const rows = isRecord(body) && Array.isArray(body["data"]) ? body["data"] : [];
-    const data = rows
-        .filter(isRecord)
-        .sort((a, b) => Number(a["index"] ?? 0) - Number(b["index"] ?? 0))
-        .map((row) => Array.isArray(row["embedding"]) ? row["embedding"] : []);
-    return { shape: [data.length, data[0]?.length ?? 0], data };
-}
-/**
- * An OpenAI chat completions event stream as Workers AI streams text:
- * one `data: {"response": "<token>"}` event per chunk with text (tool call
- * deltas and usage alongside), then `data: [DONE]`.
- */
-function toWorkersAiStream() {
-    const decoder = new TextDecoder();
-    const encoder = new TextEncoder();
-    let pending = "";
-    const convert = (line) => {
-        const match = /^data:[ ]?(.*?)\r?$/s.exec(line);
-        if (!match)
-            return "";
-        const data = match[1].trim();
-        if (data === "[DONE]")
-            return "data: [DONE]\n\n";
-        let chunk;
-        try {
-            chunk = JSON.parse(data);
-        }
-        catch {
-            return "";
-        }
-        const choice = firstChoice(chunk);
-        const delta = isRecord(choice?.["delta"]) ? choice["delta"] : {};
-        const usage = isRecord(chunk) ? chunk["usage"] : undefined;
-        const toolCalls = Array.isArray(delta["tool_calls"])
-            ? delta["tool_calls"]
-            : undefined;
-        const event = {
-            response: textOf(delta["content"]),
-            ...(toolCalls ? { tool_calls: toolCalls } : {}),
-            ...(isRecord(usage) ? { usage } : {}),
-        };
-        if (!event.response && !toolCalls && !isRecord(usage))
-            return "";
-        return `data: ${JSON.stringify(event)}\n\n`;
-    };
-    return new TransformStream({
-        transform(bytes, controller) {
-            pending += decoder.decode(bytes, { stream: true });
-            const end = pending.lastIndexOf("\n");
-            if (end === -1)
-                return;
-            const lines = pending.slice(0, end).split("\n");
-            pending = pending.slice(end + 1);
-            const out = lines.map(convert).join("");
-            if (out)
-                controller.enqueue(encoder.encode(out));
-        },
-        flush(controller) {
-            pending += decoder.decode();
-            const out = convert(pending);
-            if (out)
-                controller.enqueue(encoder.encode(out));
-        },
-    });
-}
-function firstChoice(body) {
-    if (!isRecord(body) || !Array.isArray(body["choices"]))
-        return undefined;
-    const choice = body["choices"][0];
-    return isRecord(choice) ? choice : undefined;
-}
-function textOf(content) {
-    if (typeof content === "string")
-        return content;
-    if (typeof content === "number")
-        return String(content);
-    return "";
-}
-function parsedOr(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return text;
-    }
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}

package/dist/server/authorizeUrl.d.ts

@@ -1,43 +0,0 @@
-import { type OAuthClientCapabilityId } from "../internal/index.js";
-import type { OAuthClientIntegrationStatus } from "./integrationFetch.js";
-export interface AuthorizeUrlOptions {
-    /** The OAuth client, as listed in the manifest's `capabilities`. */
-    provider: OAuthClientCapabilityId;
-    /** What `integrationStatus()` answered for it, ready and with its `clientId`. */
-    status: OAuthClientIntegrationStatus;
-    /** One of the redirect URIs the operator registered on the client. */
-    redirectUri: string;
-    /** The app's own anti-forgery value, checked when the person comes back. */
-    state: string;
-    /** PKCE: the S256 challenge of the verifier the app keeps for the exchange. */
-    codeChallenge?: string;
-    /**
-     * The provider's extras (`prompt`, `login_hint`, Google's `hd`). Never
-     * one of the parameters this helper sets (PKCE's and the provider's own
-     * included), nor Google's `include_granted_scopes`.
-     */
-    params?: Record<string, string>;
-}
-/**
- * The provider's authorize URL to send a person to, for a client with
- * scope sets (`google-workspace`, `microsoft-365`, `slack`), built from the
- * capability's status: the registry's authorize endpoint (or the instance
- * the status names), `client_id`, `response_type=code`, `redirect_uri`,
- * `state`, and the scopes the status allows this app, which are exactly
- * what the gateway will let the token carry. Each provider's own needs
- * are added: Google's `access_type=offline` (a refresh token), Microsoft's
- * `response_mode=query`, Slack's comma-joined `scope` and its `user_scope`
- * (the status's `userScopes`, when the app's sets include a user set). With
- * `codeChallenge`, PKCE as S256. The app keeps its `state` and verifier
- * for the callback.
- *
- * A client without scope sets is refused: the
- * registry's checklist for one isn't what the gateway holds a token to,
- * so an app builds that URL itself from the status's `clientId`.
- *
- * Throws a `TypeError` naming the fix when the client has no scope sets,
- * when the status isn't ready or has no `clientId`, when the status lacks
- * `scopes`, or when `params` names a parameter the helper sets.
- */
-export declare function authorizeUrl({ provider, status, redirectUri, state, codeChallenge, params, }: AuthorizeUrlOptions): URL;
-//# sourceMappingURL=authorizeUrl.d.ts.map

package/dist/server/authorizeUrl.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorizeUrl.d.ts","sourceRoot":"","sources":["../../src/server/authorizeUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAE1E,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,QAAQ,EAAE,uBAAuB,CAAC;IAClC,iFAAiF;IACjF,MAAM,EAAE,4BAA4B,CAAC;IACrC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAgCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,MAAM,EACN,WAAW,EACX,KAAK,EACL,aAAa,EACb,MAAM,GACP,EAAE,mBAAmB,GAAG,GAAG,CAqD3B"}

package/dist/server/authorizeUrl.js

@@ -1,106 +0,0 @@
-import { CAPABILITIES, ConfigurationError, } from "../internal/index.js";
-/**
- * Parameters the helper owns: the status decides the scopes, the caller's
- * other arguments decide the rest (PKCE from `codeChallenge`, always as
- * S256), each provider's own are fixed (Google's `access_type=offline` is
- * what gets a refresh token, Microsoft's `response_mode=query` is what
- * the callback reads), and Google's `include_granted_scopes` would widen
- * the token to every scope the person ever granted this client, which the
- * gateway refuses (`integration_scope_exceeded`).
- */
-const RESERVED_PARAMS = [
-    "scope",
-    "user_scope",
-    "client_id",
-    "redirect_uri",
-    "state",
-    "response_type",
-    "code_challenge",
-    "code_challenge_method",
-    "access_type",
-    "response_mode",
-    "include_granted_scopes",
-];
-/** The OAuth clients with scope sets: the ones this helper builds for. */
-function scopedClientIds() {
-    return Object.entries(CAPABILITIES)
-        .filter(([, found]) => found.mode === "oauth_client" && found.scopePolicy)
-        .map(([id]) => id);
-}
-/**
- * The provider's authorize URL to send a person to, for a client with
- * scope sets (`google-workspace`, `microsoft-365`, `slack`), built from the
- * capability's status: the registry's authorize endpoint (or the instance
- * the status names), `client_id`, `response_type=code`, `redirect_uri`,
- * `state`, and the scopes the status allows this app, which are exactly
- * what the gateway will let the token carry. Each provider's own needs
- * are added: Google's `access_type=offline` (a refresh token), Microsoft's
- * `response_mode=query`, Slack's comma-joined `scope` and its `user_scope`
- * (the status's `userScopes`, when the app's sets include a user set). With
- * `codeChallenge`, PKCE as S256. The app keeps its `state` and verifier
- * for the callback.
- *
- * A client without scope sets is refused: the
- * registry's checklist for one isn't what the gateway holds a token to,
- * so an app builds that URL itself from the status's `clientId`.
- *
- * Throws a `TypeError` naming the fix when the client has no scope sets,
- * when the status isn't ready or has no `clientId`, when the status lacks
- * `scopes`, or when `params` names a parameter the helper sets.
- */
-export function authorizeUrl({ provider, status, redirectUri, state, codeChallenge, params, }) {
-    const capability = oauthClientCapability(provider);
-    if (!capability.scopePolicy) {
-        throw new TypeError(`authorizeUrl() builds URLs for clients with scope sets (${scopedClientIds().join(", ")}); build ${capability.label}'s authorize URL yourself from the status's clientId.`);
-    }
-    if (!status.ready || !status.clientId) {
-        throw new TypeError(`authorizeUrl(${JSON.stringify(provider)}) needs a ready status with a clientId, and integrationStatus() answered ready: ${String(status.ready)}. Show ${capability.label} as not available instead: its operator sets the client up on the gateway, and an app lists the scope sets it uses in everyapp.config.ts.`);
-    }
-    if (!status.scopes) {
-        throw new TypeError(`authorizeUrl(${JSON.stringify(provider)}) takes ${capability.label}'s scopes from integrationStatus().scopes, which this status lacks: pass the status as the gateway (or everyapp dev) answered it.`);
-    }
-    for (const name of Object.keys(params ?? {})) {
-        if (!RESERVED_PARAMS.includes(name))
-            continue;
-        throw new TypeError(name === "include_granted_scopes"
-            ? `authorizeUrl(${JSON.stringify(provider)}): include_granted_scopes would widen the token to every scope the person granted this client, which the gateway refuses (integration_scope_exceeded); leave it out of params.`
-            : `authorizeUrl(${JSON.stringify(provider)}) sets ${name} itself; leave it out of params.`);
-    }
-    const url = new URL(capability.authorize.url);
-    // The status speaks for the gateway: its scopes are the token's ceiling.
-    const scopes = status.scopes;
-    const slack = url.host === "slack.com";
-    url.searchParams.set("client_id", status.clientId);
-    url.searchParams.set("response_type", "code");
-    url.searchParams.set("redirect_uri", redirectUri);
-    url.searchParams.set("state", state);
-    url.searchParams.set("scope", scopes.join(slack ? "," : " "));
-    if (status.userScopes && status.userScopes.length > 0) {
-        url.searchParams.set("user_scope", status.userScopes.join(","));
-    }
-    if (codeChallenge) {
-        url.searchParams.set("code_challenge", codeChallenge);
-        url.searchParams.set("code_challenge_method", "S256");
-    }
-    if (url.host === "accounts.google.com") {
-        // Without it Google issues no refresh token.
-        url.searchParams.set("access_type", "offline");
-    }
-    else if (url.host === "login.microsoftonline.com") {
-        url.searchParams.set("response_mode", "query");
-    }
-    for (const [name, value] of Object.entries(params ?? {})) {
-        url.searchParams.set(name, value);
-    }
-    return url;
-}
-/** The OAuth client `provider` names, from plain JavaScript or a stale type too. */
-function oauthClientCapability(provider) {
-    const found = Object.hasOwn(CAPABILITIES, provider)
-        ? CAPABILITIES[provider]
-        : undefined;
-    if (found?.mode !== "oauth_client") {
-        throw new ConfigurationError(`${JSON.stringify(String(provider))} isn't an OAuth client the gateway holds.`);
-    }
-    return found;
-}

package/dist/server/emailBinding.d.ts

@@ -1,72 +0,0 @@
-/**
- * `gatewayEmailBinding(env)`: the Gateway's `email` capability as a
- * `send_email` binding, for code written against `env.EMAIL.send(message)`.
- *
- * An app on Every App binds no `send_email` of its own: the Gateway sends
- * with its sender, checks `from` against the installation's senders and
- * keeps the mail budgets. Code that already calls `env.EMAIL.send()` gets
- * this object in its place:
- *
- *   const EMAIL = gatewayEmailBinding(env, { for: request });
- *   await EMAIL.send({ from, to, subject, text });
- *
- * Each `send()` is a `sendEmail()` (the manifest lists `capabilities: {
- * email: { access: "write" } }`), so local development works the same way:
- * checked and printed, or sent with the developer's own Email Sending
- * account (EMAIL_REST_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, EMAIL_FROM).
- */
-import { type SendEmailMessage } from "../internal/index.js";
-import type { GatewayCallFor } from "./attribution.js";
-export interface GatewayEmailBindingOptions {
-    /**
-     * Whom the mail is for: the inbound request, or `{ background: true,
-     * organizationId }` (sendEmail's `for`).
-     */
-    for?: GatewayCallFor;
-}
-/** `name <email>` or a bare address, as the binding takes them. */
-type BindingAddress = string | {
-    email: string;
-    name?: string;
-};
-type BindingRecipients = BindingAddress | BindingAddress[];
-/** The structured message `send_email`'s `send()` takes (`EmailMessageBuilder`). */
-export interface GatewayEmailBindingMessage {
-    from: BindingAddress;
-    to?: BindingRecipients;
-    cc?: BindingRecipients;
-    bcc?: BindingRecipients;
-    subject: string;
-    replyTo?: BindingAddress;
-    headers?: Record<string, string>;
-    text?: string;
-    html?: string;
-    attachments?: {
-        disposition?: "inline" | "attachment";
-        contentId?: string;
-        filename: string;
-        type: string;
-        content: string | ArrayBuffer | ArrayBufferView;
-    }[];
-}
-/**
- * A `send_email` binding (`SendEmail`) over the Gateway: pass it where code
- * takes `env.EMAIL`. `send()` takes the structured message (`from`, `to`,
- * `cc`, `bcc`, `subject`, `text`, `html`, `replyTo`, `headers`,
- * `attachments`) and resolves `{ messageId }`. A raw MIME `EmailMessage`
- * (`new EmailMessage(from, to, raw)`) is refused with `GatewayRefusalError`
- * `email_invalid_message`: the Gateway takes structured mail only.
- *
- * Errors are sendEmail()'s: `GatewayRefusalError` with the Gateway's code
- * (`email_sender_not_allowed`, `email_budget_exhausted`,
- * `integration_not_configured`, …) and `ConfigurationError` with neither a
- * binding nor `everyapp dev`. Nothing is checked when the binding is made.
- */
-export declare function gatewayEmailBinding(env: object, options?: GatewayEmailBindingOptions): SendEmail;
-/**
- * The binding's message as sendEmail()'s: recipients as bare addresses,
- * `from` and `replyTo` with their display names, attachments base64.
- */
-export declare function toSendEmailMessage(message: unknown): SendEmailMessage;
-export {};
-//# sourceMappingURL=emailBinding.d.ts.map

package/dist/server/emailBinding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"emailBinding.d.ts","sourceRoot":"","sources":["../../src/server/emailBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED,mEAAmE;AACnE,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChE,KAAK,iBAAiB,GAAG,cAAc,GAAG,cAAc,EAAE,CAAC;AAE3D,oFAAoF;AACpF,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,CAAC,EAAE,iBAAiB,CAAC;IACvB,EAAE,CAAC,EAAE,iBAAiB,CAAC;IACvB,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;QACtC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,CAAC;KACjD,EAAE,CAAC;CACL;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,0BAA+B,GACvC,SAAS,CAcX;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CA6BrE"}