@every-app/sdk 0.3.0-rc.9 → 0.3.0

package/dist/internal/protocol.d.ts

@@ -40,16 +40,14 @@ export declare const GATEWAY_ERROR_HEADER = "x-everyapp-error";
  */
 export declare const ORG_HEADER = "x-everyapp-org";
 /**
- * Which connection an app's call to an OAuth provider uses: the person's
- * (`user`, the default when a person is behind the call) or the
- * organization's (`organization`, the default for background work),
- * docs/design/2026-10-oauth-providers.md section 7. Set by
- * `integrationFetch({ account })`; the gateway reads it on the held-token
- * branch and ignores it elsewhere.
+ * On background work's call to an OAuth provider's API: the member whose
+ * connection to this app the call uses. Set by `for: { background: true,
+ * userId }`; the gateway reads it on the held-token branch only, for an
+ * organization's own app, and the perimeter strips it, with every
+ * `x-everyapp-*`, from browsers. It addresses a connection; it is not a
+ * permission: connecting in the app already lets the app use it.
  */
-export declare const ACCOUNT_HEADER = "x-everyapp-account";
-/** The values {@link ACCOUNT_HEADER} may carry. */
-export type ConnectionAccount = "user" | "organization";
+export declare const USER_HEADER = "x-everyapp-user";
 /** 120-second lifetime — caps revocation staleness while surviving clock skew. */
 export declare const IDENTITY_TTL_SECONDS = 120;
 /** System tokens are minted per call and live at most a minute. */
@@ -104,11 +102,11 @@ export declare const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
 export declare const LINKED_DEV_HEADER = "x-everyapp-linked-dev";
 /** Where the gateway-lite serves the forwarder, under the app's own host. */
 export declare const LINKED_DEV_FORWARD_PATH = "/__everyapp/gateway";
-export type IdentityChannel = "web" | "api" | "mcp" | "agent";
+export type IdentityChannel = "web" | "api" | "mcp";
 export type IdentityTokenType = "user" | "public" | "system";
 /** What a system token may open. One purpose per token. */
-export type SystemTokenPurpose = "tools.list";
-/** The actor on whose behalf the request is made (user, MCP client, agent). */
+export type SystemTokenPurpose = "tools.list" | "events.deliver";
+/** The actor on whose behalf the request is made (user, MCP client). */
 export interface IdentityActor {
     sub: string;
 }
@@ -149,12 +147,15 @@ export interface EveryAppUser {
      */
     orgName?: string;
     channel: IdentityChannel;
-    /** The acting principal (user, or `mcp:<client>` / agent). */
+    /**
+     * The acting principal: the user id, the credential acting for them
+     * (`pat:<id>`, `oauth:<id>`, `access:<email>`).
+     */
     actor: IdentityActor;
     scopes: string[];
     jti: string;
     /**
-     * Set only on an MCP tool call (`channel: "mcp"`): the one call this
+     * Set only on a tool call (`channel: "mcp"`): the one call this
      * identity was minted for.
      */
     toolCall?: ToolCallClaim;
@@ -177,6 +178,11 @@ export interface SystemClaims extends JWTPayload {
     typ: "system";
     purpose: SystemTokenPurpose;
     jti: string;
+    /**
+     * `events.deliver` only: the SHA-256 (base64url) of the request body the
+     * token was minted for, so it opens that one delivery and nothing else.
+     */
+    bh?: string;
 }
 export interface PublicMarkerClaims extends JWTPayload {
     typ: "public";
@@ -248,7 +254,11 @@ export interface MintSystemTokenOptions {
     now?: number;
     /** Header kid. Defaults to the production kid; dev mints with the dev kid. */
     keyId?: string;
+    /** `events.deliver`: the body's SHA-256, base64url ({@link bodyHash}). */
+    bodyHash?: string;
 }
+/** SHA-256 of a request body, base64url: what an `events.deliver` token's `bh` names. */
+export declare function bodyHash(body: string): Promise<string>;
 /**
  * Mint the gateway's system token for `x-everyapp-system`: no user, one
  * purpose, one app, one minute. The SDK only accepts it on the endpoint its

package/dist/internal/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,uBAAuB,CAAC;AACnD,mDAAmD;AACnD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,cAAc,CAAC;AACxD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAEpE;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAehB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CAqCd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAmBd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA0BjB"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/internal/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAC7C,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,mEAAmE;AACnE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,8CAA8C;AAC9C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qEAAqE;AACrE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,mFAAmF;AACnF,eAAO,MAAM,UAAU,6BAA6B,CAAC;AACrD;;;GAGG;AACH,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,qFAAqF;AACrF,eAAO,MAAM,OAAO,iBAAiB,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AACpD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAEjE,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAEpE;AAED,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB;;;OAGG;IACH,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,EAAE,CAAC,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GACA,cAAc,CAehB;AAkBD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,GAClB,YAAY,CAqCd;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CA2Bd;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU5D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

package/dist/internal/protocol.js

@@ -39,14 +39,14 @@ export const GATEWAY_ERROR_HEADER = "x-everyapp-error";
  */
 export const ORG_HEADER = "x-everyapp-org";
 /**
- * Which connection an app's call to an OAuth provider uses: the person's
- * (`user`, the default when a person is behind the call) or the
- * organization's (`organization`, the default for background work),
- * docs/design/2026-10-oauth-providers.md section 7. Set by
- * `integrationFetch({ account })`; the gateway reads it on the held-token
- * branch and ignores it elsewhere.
+ * On background work's call to an OAuth provider's API: the member whose
+ * connection to this app the call uses. Set by `for: { background: true,
+ * userId }`; the gateway reads it on the held-token branch only, for an
+ * organization's own app, and the perimeter strips it, with every
+ * `x-everyapp-*`, from browsers. It addresses a connection; it is not a
+ * permission: connecting in the app already lets the app use it.
  */
-export const ACCOUNT_HEADER = "x-everyapp-account";
+export const USER_HEADER = "x-everyapp-user";
 /** 120-second lifetime — caps revocation staleness while surviving clock skew. */
 export const IDENTITY_TTL_SECONDS = 120;
 /** System tokens are minted per call and live at most a minute. */
@@ -208,6 +208,10 @@ export function assertSystemClaims(payload, purpose) {
         payload.exp - payload.iat > SYSTEM_TOKEN_TTL_SECONDS) {
         throw new ProtocolClaimsError(`system token must expire within ${SYSTEM_TOKEN_TTL_SECONDS}s of issue`);
     }
+    if (purpose === "events.deliver" &&
+        (typeof payload.bh !== "string" || payload.bh.length === 0)) {
+        throw new ProtocolClaimsError("an events.deliver token must name the body it was minted for");
+    }
     return payload;
 }
 let cachedPrivateKey = null;
@@ -269,6 +273,17 @@ export async function mintPublicMarkerJwt(privateKeyPem, opts) {
         .setExpirationTime(nowSec + ttl)
         .sign(key);
 }
+/** SHA-256 of a request body, base64url: what an `events.deliver` token's `bh` names. */
+export async function bodyHash(body) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)));
+    let binary = "";
+    for (const byte of digest)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
 /**
  * Mint the gateway's system token for `x-everyapp-system`: no user, one
  * purpose, one app, one minute. The SDK only accepts it on the endpoint its
@@ -281,10 +296,14 @@ export async function mintSystemJwt(privateKeyPem, opts) {
     }
     const key = await loadPrivateKey(privateKeyPem);
     const nowSec = Math.floor((opts.now ?? Date.now()) / 1000);
+    if (opts.purpose === "events.deliver" && !opts.bodyHash) {
+        throw new RangeError("an events.deliver token needs the body's hash");
+    }
     const claims = {
         typ: "system",
         purpose: opts.purpose,
         jti: crypto.randomUUID(),
+        ...(opts.bodyHash ? { bh: opts.bodyHash } : {}),
     };
     return new SignJWT(claims)
         .setProtectedHeader({

package/dist/internal/providerApps.d.ts

@@ -6,8 +6,8 @@
  * serves the provider's tools on its `/mcp` under `<id>_<tool>` names, with
  * the key never leaving the Gateway, every call attributed to the member
  * who made it, counted and audited like an app's capability calls. The
- * launcher lists it under "MCP apps" and its card opens the "Use it from
- * your agent" dialog instead of a page (docs/design/2026-10-mcp-apps-ui.md).
+ * MCP apps section of Admin → Apps lists it, and its row menu opens the
+ * "Use it from your agent" dialog (docs/design/2026-10-mcp-apps-ui.md).
  *
  * A provider app is an `apps` row of tier {@link PROVIDER_APP_TIER} with no
  * hostname and no Worker name: the perimeter never routes it, and the

package/dist/internal/providerApps.js

@@ -6,8 +6,8 @@
  * serves the provider's tools on its `/mcp` under `<id>_<tool>` names, with
  * the key never leaving the Gateway, every call attributed to the member
  * who made it, counted and audited like an app's capability calls. The
- * launcher lists it under "MCP apps" and its card opens the "Use it from
- * your agent" dialog instead of a page (docs/design/2026-10-mcp-apps-ui.md).
+ * MCP apps section of Admin → Apps lists it, and its row menu opens the
+ * "Use it from your agent" dialog (docs/design/2026-10-mcp-apps-ui.md).
  *
  * A provider app is an `apps` row of tier {@link PROVIDER_APP_TIER} with no
  * hostname and no Worker name: the perimeter never routes it, and the

package/dist/internal/providerRegistry.d.ts

@@ -19,19 +19,8 @@
  *    an IP literal, localhost, or a `.local`, `.internal` or `.arpa` name)
  *    and not one the gateway serves itself (`refuseHost`, which knows the
  *    gateway's own host and `APP_BASE_DOMAIN`).
- *
- * A second kind of row, a scope-set overlay (`provider_scope_sets`,
- * `everyapp provider scope-set add`), adds a named scope set to a
- * built-in OAuth client that has scope sets (Google, Microsoft, Slack):
- * its scopes, and the routes on the client's own API hosts it unlocks,
- * checked by the rules a built-in set is checked by
- * (`providers.scope-set-overlay-within-client`). An overlay never replaces
- * one of the client's own sets, never names a host outside the client's
- * `api`, and never applies to a registered row (an operator replaces the
- * row's spec instead). Apps list an overlay set under `scopes` as they
- * list a built-in one.
  */
-import { type Capability, type CapabilityLookup, type OAuthClientCapability, type OAuthScopeSet } from "./capabilities.js";
+import { type Capability, type CapabilityLookup } from "./capabilities.js";
 import { type RegistrableCapability } from "./providerSpec.js";
 /** A `providers` row as the gateway or the CLI read it. */
 export interface ProviderRow {
@@ -50,42 +39,16 @@ export interface ProviderRow {
     /** When, in epoch milliseconds. */
     addedAt?: number | null;
 }
-/** A `provider_scope_sets` row as the gateway or the CLI read it. */
-export interface ScopeSetRow {
-    /** The built-in OAuth client the set belongs to (`google-workspace`). */
-    providerId: string;
-    /** The set's name, what an app lists under `scopes` (`gmail.send`). */
-    name: string;
-    /** The set's spec, as JSON text or already parsed (`parseScopeSetOverlay`'s shape). */
-    spec: unknown;
-    addedBy?: string | null;
-    addedAt?: number | null;
-}
-/** One overlay the registry serves, as `provider show` reports it. */
-export interface RegisteredScopeSet {
-    providerId: string;
-    name: string;
-    set: OAuthScopeSet;
-    addedBy: string | null;
-    addedAt: number | null;
-}
-export type ScopeSetRefusalCode = "SCOPE_SET_INVALID" | "SCOPE_SET_PROVIDER_UNKNOWN" | "SCOPE_SET_BUILTIN";
-/** Why an overlay row is not a scope set on this gateway. */
-export interface ScopeSetRefusal {
-    providerId: string;
-    name: string;
-    code: ScopeSetRefusalCode;
-    message: string;
-}
 /**
  * The part of a row a key is set for: its hosts, its host setting and its
  * auth, as one canonical string (sorted keys, sorted hosts), so that
  * replacing a row's hosts or auth changes the key and the value it held
  * is no longer read until the operator sets it again. For an OAuth
  * provider the client is bound to its authorize, token and revoke URLs,
- * its API hosts, where the client goes on the token request and its
- * client setting names (`oauth.client-bound-to-endpoints`): an admin who
- * re-points `tokenUrl` has to paste the secret again.
+ * its API hosts, where the client goes on the token request, its client
+ * setting names, and its `resource` and `issuer` when it has them
+ * (`oauth.client-bound-to-endpoints`): an admin who re-points `tokenUrl`
+ * has to paste the secret again.
  */
 export declare function providerBindingKey(capability: RegistrableCapability): string;
 /** One registered row as `provider list` and `provider show` report it. */
@@ -123,12 +86,6 @@ export interface ProviderRegistry extends CapabilityLookup {
     rows(): readonly RegisteredProvider[];
     /** The rows this registry left out, each with why. */
     readonly rejected: readonly RowRefusal[];
-    /** The scope-set overlays this registry applied to built-in clients, in row order. */
-    scopeSets(): readonly RegisteredScopeSet[];
-    /** Where a client's scope set comes from: its catalog entry, an overlay row, or nowhere. */
-    scopeSetSource(providerId: string, name: string): "catalog" | "row" | undefined;
-    /** The overlay rows this registry left out, each with why. */
-    readonly rejectedScopeSets: readonly ScopeSetRefusal[];
 }
 export interface ProviderRegistryOptions {
     /**
@@ -137,8 +94,6 @@ export interface ProviderRegistryOptions {
      * the rest (IP literals, localhost, `.internal`).
      */
     refuseHost?: (host: string) => string | null;
-    /** The scope-set overlays (`provider_scope_sets`), applied to the catalog's OAuth clients. */
-    scopeSets?: readonly ScopeSetRow[];
 }
 /** The prefix a provider's own Gateway settings carry: `stripe` → `STRIPE_`, `tiktok-business` → `TIKTOK_BUSINESS_`. */
 export declare function providerSettingPrefix(id: string): string;
@@ -194,20 +149,6 @@ export declare function resolveProviderRow(row: ProviderRow, context: {
     ok: false;
     refusal: RowRefusal;
 };
-/**
- * The built-in OAuth client an overlay may extend: a catalog entry of mode
- * `oauth_client` with a scope policy. Null for anything else (an API-key
- * entry, a client without sets, a registered row, an unknown id).
- */
-export declare function overlayableClient(providerId: string): OAuthClientCapability | null;
-/** An overlay row's spec parsed and checked against its client: the set, or the refusal. */
-export declare function resolveScopeSetRow(row: ScopeSetRow): {
-    ok: true;
-    set: OAuthScopeSet;
-} | {
-    ok: false;
-    refusal: ScopeSetRefusal;
-};
 /**
  * The catalog and `rows` as one registry. Rows are taken in order; a row
  * whose settings another earlier row holds is the one refused.

package/dist/internal/providerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/internal/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC3B,mBAAmB,GACnB,4BAA4B,GAC5B,mBAAmB,CAAC;AAExB,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CA2B5E;AAoBD,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,qBAAqB,CAAC;IAClC,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,mFAAmF;IACnF,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,8DAA8D;IAC9D,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC,sFAAsF;IACtF,SAAS,IAAI,SAAS,kBAAkB,EAAE,CAAC;IAC3C,4FAA4F;IAC5F,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,eAAe,EAAE,CAAC;CACxD;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C,8FAA8F;IAC9F,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACpC;AAOD,wHAAwH;AACxH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,GAClB,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,MAAM,GAAG,IAAI,CAwBf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE;IACP,oCAAoC;IACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GACA,UAAU,GAAG,IAAI,CAuBnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAqB5E;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;IACP,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GAEC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyCrC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,GACjB,qBAAqB,GAAG,IAAI,CAQ9B;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAoC5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,SAAS,WAAW,EAAO,EACjC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAiIlB;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,EAAE,gBAAqC,CAAC"}
+{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/internal/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CAkC5E;AAoBD,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,qBAAqB,CAAC;IAClC,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,mFAAmF;IACnF,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,8DAA8D;IAC9D,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C;AAOD,wHAAwH;AACxH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,GAClB,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC/B,MAAM,GAAG,IAAI,CAwBf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE;IACP,oCAAoC;IACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GACA,UAAU,GAAG,IAAI,CAuBnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAqB5E;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;IACP,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9C,GAEC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyCrC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,SAAS,WAAW,EAAO,EACjC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAqElB;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,EAAE,gBAAqC,CAAC"}

package/dist/internal/providerRegistry.js

@@ -19,21 +19,9 @@
  *    an IP literal, localhost, or a `.local`, `.internal` or `.arpa` name)
  *    and not one the gateway serves itself (`refuseHost`, which knows the
  *    gateway's own host and `APP_BASE_DOMAIN`).
- *
- * A second kind of row, a scope-set overlay (`provider_scope_sets`,
- * `everyapp provider scope-set add`), adds a named scope set to a
- * built-in OAuth client that has scope sets (Google, Microsoft, Slack):
- * its scopes, and the routes on the client's own API hosts it unlocks,
- * checked by the rules a built-in set is checked by
- * (`providers.scope-set-overlay-within-client`). An overlay never replaces
- * one of the client's own sets, never names a host outside the client's
- * `api`, and never applies to a registered row (an operator replaces the
- * row's spec instead). Apps list an overlay set under `scopes` as they
- * list a built-in one.
  */
 import { CAPABILITIES, CAPABILITY_IDS, capabilitySettings, } from "./capabilities.js";
 import { isDevOnlyGatewaySetting, isInstallOwnedGatewaySetting, isReservedAppSecretName, isSettableGatewaySetting, } from "./gatewaySettings.js";
-import { parseScopeSetOverlay, withScopeSets } from "./oauthSpec.js";
 import { isSignInSettingName } from "./signInProviders.js";
 import { describeSpecProblems, parseProviderSpec, PROVIDER_ID, } from "./providerSpec.js";
 /**
@@ -42,9 +30,10 @@ import { describeSpecProblems, parseProviderSpec, PROVIDER_ID, } from "./provide
  * replacing a row's hosts or auth changes the key and the value it held
  * is no longer read until the operator sets it again. For an OAuth
  * provider the client is bound to its authorize, token and revoke URLs,
- * its API hosts, where the client goes on the token request and its
- * client setting names (`oauth.client-bound-to-endpoints`): an admin who
- * re-points `tokenUrl` has to paste the secret again.
+ * its API hosts, where the client goes on the token request, its client
+ * setting names, and its `resource` and `issuer` when it has them
+ * (`oauth.client-bound-to-endpoints`): an admin who re-points `tokenUrl`
+ * has to paste the secret again.
  */
 export function providerBindingKey(capability) {
     if (capability.mode === "ai") {
@@ -59,13 +48,20 @@ export function providerBindingKey(capability) {
     if (capability.mode === "oauth_client") {
         return JSON.stringify({
             kind: "oauth2-user",
-            authorizeUrl: capability.authorize.url,
-            tokenUrl: capability.flow?.tokenUrl ?? null,
-            revokeUrl: capability.flow?.revokeUrl ?? null,
-            inject: capability.token[0]?.inject ?? "form",
+            authorizeUrl: capability.flow.authorizeUrl,
+            tokenUrl: capability.flow.tokenUrl,
+            revokeUrl: capability.flow.revokeUrl ?? null,
+            inject: capability.flow.inject,
             clientId: capability.secrets.clientId,
             clientSecret: capability.secrets.clientSecret ?? null,
             hosts: [...capability.api].sort(),
+            // Only when present, so a row without them keeps the key it was bound to.
+            ...(capability.flow?.resource === undefined
+                ? {}
+                : { resource: capability.flow.resource }),
+            ...(capability.flow?.issuer === undefined
+                ? {}
+                : { issuer: capability.flow.issuer }),
         });
     }
     return JSON.stringify({
@@ -207,10 +203,10 @@ export function registrableHosts(capability) {
         return [new URL(capability.origin).hostname.toLowerCase()];
     const hosts = [...capability.api];
     const urls = [
-        capability.authorize.url,
-        capability.flow?.tokenUrl,
-        capability.flow?.revokeUrl,
-        capability.flow?.identity?.url,
+        capability.flow.authorizeUrl,
+        capability.flow.tokenUrl,
+        capability.flow.revokeUrl,
+        capability.flow.identity?.url,
     ];
     for (const url of urls) {
         if (!url)
@@ -270,92 +266,12 @@ export function resolveProviderRow(row, context) {
         ? { ok: false, refusal }
         : { ok: true, capability: parsed.capability };
 }
-/**
- * The built-in OAuth client an overlay may extend: a catalog entry of mode
- * `oauth_client` with a scope policy. Null for anything else (an API-key
- * entry, a client without sets, a registered row, an unknown id).
- */
-export function overlayableClient(providerId) {
-    if (!CAPABILITY_IDS.includes(providerId))
-        return null;
-    const capability = CAPABILITIES[providerId];
-    return capability.mode === "oauth_client" && capability.scopePolicy
-        ? capability
-        : null;
-}
-/** An overlay row's spec parsed and checked against its client: the set, or the refusal. */
-export function resolveScopeSetRow(row) {
-    const refuse = (code, message) => ({
-        ok: false,
-        refusal: { providerId: row.providerId, name: row.name, code, message },
-    });
-    const client = overlayableClient(row.providerId);
-    if (!client) {
-        return refuse("SCOPE_SET_PROVIDER_UNKNOWN", `${row.providerId} isn't a built-in OAuth client with scope sets (google-workspace, microsoft-365, slack); a registered provider's sets are in its spec`);
-    }
-    if (Object.hasOwn(client.scopePolicy.sets, row.name)) {
-        return refuse("SCOPE_SET_BUILTIN", `${row.name} is one of ${row.providerId}'s own sets; an overlay adds a set, never replaces one`);
-    }
-    let spec = row.spec;
-    if (typeof spec === "string") {
-        try {
-            spec = JSON.parse(spec);
-        }
-        catch {
-            return refuse("SCOPE_SET_INVALID", "the stored spec isn't JSON");
-        }
-    }
-    const parsed = parseScopeSetOverlay(typeof spec === "object" && spec !== null && !Array.isArray(spec)
-        ? { ...spec, name: row.name }
-        : spec, { id: row.providerId, capability: client });
-    if (!parsed.ok) {
-        return refuse("SCOPE_SET_INVALID", describeSpecProblems(parsed.problems));
-    }
-    return { ok: true, set: parsed.set };
-}
 /**
  * The catalog and `rows` as one registry. Rows are taken in order; a row
  * whose settings another earlier row holds is the one refused.
  */
 export function providerRegistry(rows = [], options = {}) {
     const catalog = new Map(CAPABILITY_IDS.map((id) => [id, CAPABILITIES[id]]));
-    // Scope-set overlays on the catalog's OAuth clients, before any row is
-    // looked at: a row never shadows the catalog, with or without overlays.
-    const overlays = [];
-    const rejectedScopeSets = [];
-    const overlaySets = new Map();
-    for (const row of options.scopeSets ?? []) {
-        if (overlays.some((each) => each.providerId === row.providerId && each.name === row.name)) {
-            rejectedScopeSets.push({
-                providerId: row.providerId,
-                name: row.name,
-                code: "SCOPE_SET_INVALID",
-                message: "listed twice",
-            });
-            continue;
-        }
-        const resolved = resolveScopeSetRow(row);
-        if (!resolved.ok) {
-            rejectedScopeSets.push(resolved.refusal);
-            continue;
-        }
-        overlays.push({
-            providerId: row.providerId,
-            name: row.name,
-            set: resolved.set,
-            addedBy: row.addedBy ?? null,
-            addedAt: row.addedAt ?? null,
-        });
-        const sets = overlaySets.get(row.providerId) ?? {};
-        sets[row.name] = resolved.set;
-        overlaySets.set(row.providerId, sets);
-    }
-    for (const [id, sets] of overlaySets) {
-        const client = catalog.get(id);
-        if (client?.mode === "oauth_client") {
-            catalog.set(id, withScopeSets(client, sets));
-        }
-    }
     const accepted = new Map();
     const rejected = [];
     const rowSettings = new Set();
@@ -411,21 +327,6 @@ export function providerRegistry(rows = [], options = {}) {
         },
         rows: () => [...accepted.values()],
         rejected,
-        scopeSets: () => [...overlays],
-        scopeSetSource: (providerId, name) => {
-            if (overlays.some((each) => each.providerId === providerId && each.name === name)) {
-                return "row";
-            }
-            const capability = CAPABILITY_IDS.includes(providerId)
-                ? CAPABILITIES[providerId]
-                : undefined;
-            return capability?.mode === "oauth_client" &&
-                capability.scopePolicy &&
-                Object.hasOwn(capability.scopePolicy.sets, name)
-                ? "catalog"
-                : undefined;
-        },
-        rejectedScopeSets,
     };
 }
 /** The catalog alone, as a registry: what every surface reads without a gateway's rows. */

package/dist/internal/providerSpec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerSpec.d.ts","sourceRoot":"","sources":["../../src/internal/providerSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAGL,KAAK,oBAAoB,EAEzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAM3B,MAAM,mBAAmB,CAAC;AAG3B,oEAAoE;AACpE,eAAO,MAAM,WAAW,QAA2B,CAAC;AACpD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAC7D,0FAA0F;AAC1F,eAAO,MAAM,aAAa,QACoD,CAAC;AA4C/E,kGAAkG;AAClG,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AA+EzD,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0HAA0H;AAC1H,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AA+iBnD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA2NpE;AAkOD,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,GACvC,MAAM,CAIR;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuGzB;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAC5B,UAAU,EAAE,qBAAqB,GAChC,SAAS,MAAM,EAAE,CAKnB"}
+{"version":3,"file":"providerSpec.d.ts","sourceRoot":"","sources":["../../src/internal/providerSpec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAGL,KAAK,oBAAoB,EAEzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAM3B,MAAM,mBAAmB,CAAC;AAO3B,oEAAoE;AACpE,eAAO,MAAM,WAAW,QAA2B,CAAC;AACpD,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAC7D,0FAA0F;AAC1F,eAAO,MAAM,aAAa,QACoD,CAAC;AA4C/E,kGAAkG;AAClG,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAkEzD,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0HAA0H;AAC1H,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AA+iBnD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAsNpE;AAkOD,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,GACvC,MAAM,CAIR;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+FzB;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAC5B,UAAU,EAAE,qBAAqB,GAChC,SAAS,MAAM,EAAE,CAKnB"}

package/dist/internal/providerSpec.js

@@ -21,7 +21,7 @@
  * registry's (./providerRegistry.ts), run after this parse.
  */
 import { DEFAULT_WRITE_METHODS, authSettingNames, } from "./capabilities.js";
-import { oauthSpecOf, parseOAuthUserSpec } from "./oauthSpec.js";
+import { REMOVED_OAUTH_FIELDS, oauthSpecOf, parseOAuthUserSpec, } from "./oauthSpec.js";
 /** A provider id: lowercase, a letter first, 2 to 40 characters. */
 export const PROVIDER_ID = /^[a-z][a-z0-9-]{1,39}$/;
 /** A Gateway setting name a provider may hold: upper case, 3 to 64 characters. */
@@ -96,10 +96,6 @@ const KNOWN_FIELDS = new Set([
     "example",
     "verified",
     "tags",
-    // An `oauth2-user` spec's own (./oauthSpec.ts).
-    "scopeSets",
-    "alwaysRequested",
-    "tolerated",
     // An `ai` spec's own.
     "baseUrl",
     "models",
@@ -128,11 +124,7 @@ const NOT_AI_FIELDS = [
     "readMethods",
     "writeMethods",
     "accountWidePaths",
-    ...OAUTH_ONLY_FIELDS_LIST(),
 ];
-function OAUTH_ONLY_FIELDS_LIST() {
-    return ["scopeSets", "alwaysRequested", "tolerated"];
-}
 /** Fields an API-key spec has that an `oauth2-user` spec does not. */
 const API_KEY_ONLY_FIELDS = [
     "hostSetting",
@@ -144,11 +136,6 @@ const API_KEY_ONLY_FIELDS = [
     "rate",
     "verified",
 ];
-const OAUTH_ONLY_FIELDS = [
-    "scopeSets",
-    "alwaysRequested",
-    "tolerated",
-];
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -656,7 +643,11 @@ export function parseProviderSpec(input) {
             problems: [{ path: "(root)", message: "must be a JSON object" }],
         };
     }
+    const oauthSpec = isRecord(input["auth"]) && input["auth"]["kind"] === "oauth2-user";
     for (const field of Object.keys(input)) {
+        // An OAuth spec's removed fields get their own message below.
+        if (oauthSpec && Object.hasOwn(REMOVED_OAUTH_FIELDS, field))
+            continue;
         if (!KNOWN_FIELDS.has(field)) {
             problems.push({ path: field, message: "unknown field" });
         }
@@ -715,7 +706,12 @@ export function parseProviderSpec(input) {
         return parseAiSpec(input, problems, { id, name, description, docs, api });
     }
     if (isOAuth) {
-        const { access, readMethods, writeMethods } = grants(input, problems);
+        // Fields an OAuth spec had before scopes moved to each app's config,
+        // each refused with what to write instead.
+        for (const [field, message] of Object.entries(REMOVED_OAUTH_FIELDS)) {
+            if (input[field] !== undefined)
+                problems.push({ path: field, message });
+        }
         const hint = text(input["hint"], "hint", problems, { max: 500 });
         const example = text(input["example"], "example", problems, { max: 200 });
         const tags = tagList(input["tags"], problems);
@@ -746,11 +742,6 @@ export function parseProviderSpec(input) {
                 hosts,
                 ...(description === undefined ? {} : { description }),
                 ...(api === undefined ? {} : { reference: api }),
-                ...(access === undefined
-                    ? {}
-                    : { access: access }),
-                ...(readMethods === undefined ? {} : { readMethods }),
-                ...(writeMethods === undefined ? {} : { writeMethods }),
                 ...(hint === undefined ? {} : { hint }),
                 ...(example === undefined ? {} : { example }),
                 ...(tags === undefined ? {} : { tags }),
@@ -761,14 +752,6 @@ export function parseProviderSpec(input) {
         }
         return { ok: true, id, capability: parsed.capability };
     }
-    for (const field of OAUTH_ONLY_FIELDS) {
-        if (input[field] !== undefined) {
-            problems.push({
-                path: field,
-                message: "only an oauth2-user spec has it",
-            });
-        }
-    }
     const hostSetting = input["hostSetting"] === undefined
         ? undefined
         : secretName(input["hostSetting"], "hostSetting", problems);
@@ -1048,13 +1031,8 @@ export function describeSpecProblems(problems) {
  * gives the entry back.
  */
 export function providerSpecOf(id, capability) {
-    if (capability.mode === "oauth_client") {
-        const spec = oauthSpecOf(id, capability);
-        if (!spec) {
-            throw new Error(`${id} is a catalog OAuth client without a Gateway-owned flow: it has no spec`);
-        }
-        return spec;
-    }
+    if (capability.mode === "oauth_client")
+        return oauthSpecOf(id, capability);
     if (capability.mode === "ai") {
         if (!capability.chat || !capability.models) {
             throw new Error(`${id} is a catalog AI entry without a model list: it has no spec`);
@@ -1149,6 +1127,6 @@ export function providerSpecOf(id, capability) {
 }
 /** The methods an app with `access: "write"` may use on `capability` besides its read methods. */
 export function writeMethodsOf(capability) {
-    return ((capability.mode === "ai" ? undefined : capability.writeMethods) ??
+    return ((capability.mode === "api_key" ? capability.writeMethods : undefined) ??
         DEFAULT_WRITE_METHODS);
 }