@every-app/sdk 0.3.0-rc.9 → 0.3.1

package/dist/server/refusal.d.ts

@@ -14,8 +14,6 @@ export interface GatewayRefusal extends SetupInfo {
     code: string;
     message: string;
 }
-/** The refusal codes that mean no model is set up for the call. */
-export declare const AI_NOT_CONFIGURED_CODES: readonly string[];
 /**
  * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
  * when the gateway won't send (`email_sender_not_allowed`,
@@ -45,11 +43,4 @@ export declare function gatewayRefusal(response: Response): Promise<GatewayRefus
  * (`ai_provider_not_configured`, status 503, the `.dev.vars` names).
  */
 export declare function refusalFromError(error: unknown): GatewayRefusal | null;
-/**
- * Whether `error` (or a refusal already read) means no model is set up:
- * `ai_provider_not_configured` or `ai_default_not_configured`, from the
- * Gateway or, in local development, from the SDK with no key in
- * `.dev.vars`. Show `refusalFromError(error).setup` to the person.
- */
-export declare function isAiNotConfigured(error: unknown): boolean;
 //# sourceMappingURL=refusal.d.ts.map

package/dist/server/refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../../src/server/refusal.ts"],"names":[],"mappings":"AAgBA,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGpD,CAAC;AAEF;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,cAAc;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEpB,EACV,MAAM,EACN,IAAI,EACJ,OAAO,EACP,QAAa,EACb,KAAY,EACZ,OAAc,GACf,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAS5E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAKhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAWtE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../../src/server/refusal.ts"],"names":[],"mappings":"AAgBA,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,cAAc;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEpB,EACV,MAAM,EACN,IAAI,EACJ,OAAO,EACP,QAAa,EACb,KAAY,EACZ,OAAc,GACf,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAS5E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAKhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAWtE"}

package/dist/server/refusal.js

@@ -13,11 +13,6 @@
  * match the message text or hardcode a setting name or a command.
  */
 import { ConfigurationError, GATEWAY_ERROR_HEADER } from "../internal/index.js";
-/** The refusal codes that mean no model is set up for the call. */
-export const AI_NOT_CONFIGURED_CODES = [
-    "ai_provider_not_configured",
-    "ai_default_not_configured",
-];
 /**
  * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
  * when the gateway won't send (`email_sender_not_allowed`,
@@ -73,23 +68,6 @@ export function refusalFromError(error) {
     }
     return null;
 }
-/**
- * Whether `error` (or a refusal already read) means no model is set up:
- * `ai_provider_not_configured` or `ai_default_not_configured`, from the
- * Gateway or, in local development, from the SDK with no key in
- * `.dev.vars`. Show `refusalFromError(error).setup` to the person.
- */
-export function isAiNotConfigured(error) {
-    const refusal = isRefusal(error) ? error : refusalFromError(error);
-    return refusal !== null && AI_NOT_CONFIGURED_CODES.includes(refusal.code);
-}
-function isRefusal(value) {
-    return (!!value &&
-        typeof value === "object" &&
-        !(value instanceof Error) &&
-        typeof value.code === "string" &&
-        typeof value.status === "number");
-}
 function refusalHere(error) {
     // A Response is read with gatewayRefusal(), which can read its body.
     if (error instanceof Response)

package/dist/server/tools.d.ts

@@ -17,7 +17,8 @@
  *
  * Apps never speak MCP. The gateway snapshots this catalog at deploy, serves
  * MCP clients from the snapshot, and calls a tool over the internal tools
- * contract (../internal/tools.ts) with a verified `chan: "mcp"` identity.
+ * contract (../internal/tools.ts) with a verified `chan: "mcp"`
+ * identity.
  *
  * `input` and `output` accept any validator implementing Standard Schema and
  * Standard JSON Schema (zod >= 4.2 does both), or a plain
@@ -25,8 +26,11 @@
  */
 import { type EveryAppUser, type ToolCallResultV1, type ToolDescriptorV1, type ToolIssueV1, type ToolRisk } from "../internal/index.js";
 import type { ExecutionContextLike } from "./everyApp.js";
-/** Reported with every catalog; must match package.json. */
-export declare const SDK_VERSION = "0.3.0";
+/**
+ * Reported with every catalog; must match package.json (a test checks).
+ * `pnpm release <version>` (scripts/release.mjs) sets both in one commit.
+ */
+export declare const SDK_VERSION = "0.3.1";
 /**
  * Throw from a tool handler to return an error the model can read and act on
  * ("No todo with that id"). Any other error is logged here and reaches the
@@ -81,7 +85,10 @@ export interface PlainToolSchema<Output = unknown> {
 export type ToolSchema<Output = unknown> = StandardSchemaWithJSON<unknown, Output> | PlainToolSchema<Output>;
 /** What a tool handler receives besides its validated input. */
 export interface ToolContext<TEnv = Cloudflare.Env> {
-    /** The verified caller. `channel` is "mcp"; `toolCall` names this call. */
+    /**
+     * The verified caller. `channel` is "mcp" (an AI client); `toolCall`
+     * names this call.
+     */
     user: EveryAppUser;
     env: TEnv;
     ctx: ExecutionContextLike;
@@ -95,11 +102,15 @@ export interface ToolDefinition<TInput = unknown> {
     /** What the tool does and when to use it. The model reads this. */
     description: string;
     /**
-     * `read` changes nothing. `write` creates or changes data. `destructive`
-     * deletes or irreversibly changes data; AI clients can't see or call
-     * destructive tools until approvals exist.
+     * `read` changes nothing; read-only connections and tokens may call it.
+     * `write` creates, changes or deletes data.
      */
     risk: ToolRisk;
+    /**
+     * A write tool that deletes or can't be undone. Clients see
+     * `destructiveHint: true` and ask the person before calling it.
+     */
+    destructive?: boolean;
     /** Arguments schema; must describe an object. */
     input: ToolSchema<TInput>;
     /**

package/dist/server/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/server/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,4DAA4D;AAC5D,eAAO,MAAM,WAAW,UAAU,CAAC;AASnC;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAID,KAAK,mBAAmB,GAAG,WAAW,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvE,UAAU,aAAa;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;CAChE;AAED,KAAK,cAAc,CAAC,MAAM,IACtB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAAE,CAAC;AAEtD,UAAU,mBAAmB,CAAC,KAAK,EAAE,MAAM;IACzC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAC5D,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,CAAC,EACX;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAClD,SAAS,CAAC;CACf;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;IACrE,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG;QACzD,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;KAClD,CAAC;CACH;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe,CAAC,MAAM,GAAG,OAAO;IAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CACN,KAAK,EAAE,OAAO,GACb,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;CAC7D;AAED,MAAM,MAAM,UAAU,CAAC,MAAM,GAAG,OAAO,IACnC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,GACvC,eAAe,CAAC,MAAM,CAAC,CAAC;AAE5B,gEAAgE;AAChE,MAAM,WAAW,WAAW,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG;IAChD,2EAA2E;IAC3E,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,oBAAoB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC9C,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;CAC3D;AAED,QAAA,MAAM,WAAW,eAAoC,CAAC;AAEtD,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GAAG,UAAU,CAMb;AAQD,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,UAAU,gBAAgB;IACxB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC/C,uDAAuD;IACvD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACjC;AAID,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAMnE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,KAAK,EAAE;KAAG,CAAC,IAAI,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CAAE,EAC3D,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CA+BT;AA+ND,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAEzC,qCAAqC;AACrC,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQ/B;AAiBD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CAuC3B"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/server/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,WAAW,UAAU,CAAC;AASnC;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAID,KAAK,mBAAmB,GAAG,WAAW,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvE,UAAU,aAAa;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;CAChE;AAED,KAAK,cAAc,CAAC,MAAM,IACtB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAAE,CAAC;AAEtD,UAAU,mBAAmB,CAAC,KAAK,EAAE,MAAM;IACzC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAC5D,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,CAAC,EACX;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAClD,SAAS,CAAC;CACf;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;IACrE,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG;QACzD,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;KAClD,CAAC;CACH;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe,CAAC,MAAM,GAAG,OAAO;IAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CACN,KAAK,EAAE,OAAO,GACb,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;CAC7D;AAED,MAAM,MAAM,UAAU,CAAC,MAAM,GAAG,OAAO,IACnC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,GACvC,eAAe,CAAC,MAAM,CAAC,CAAC;AAE5B,gEAAgE;AAChE,MAAM,WAAW,WAAW,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG;IAChD;;;OAGG;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,oBAAoB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC9C,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iDAAiD;IACjD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;CAC3D;AAED,QAAA,MAAM,WAAW,eAAoC,CAAC;AAEtD,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GAAG,UAAU,CAMb;AAQD,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,UAAU,gBAAgB;IACxB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC/C,uDAAuD;IACvD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACjC;AAID,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAMnE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,KAAK,EAAE;KAAG,CAAC,IAAI,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CAAE,EAC3D,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CA+BT;AAuOD,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAEzC,qCAAqC;AACrC,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQ/B;AAiBD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CAuC3B"}

package/dist/server/tools.js

@@ -17,15 +17,19 @@
  *
  * Apps never speak MCP. The gateway snapshots this catalog at deploy, serves
  * MCP clients from the snapshot, and calls a tool over the internal tools
- * contract (../internal/tools.ts) with a verified `chan: "mcp"` identity.
+ * contract (../internal/tools.ts) with a verified `chan: "mcp"`
+ * identity.
  *
  * `input` and `output` accept any validator implementing Standard Schema and
  * Standard JSON Schema (zod >= 4.2 does both), or a plain
  * `{ jsonSchema, validate }` pair. The SDK itself takes no dependency.
  */
 import { TOOL_NAME_PATTERN, catalogHash, isToolRisk, } from "../internal/index.js";
-/** Reported with every catalog; must match package.json. */
-export const SDK_VERSION = "0.3.0";
+/**
+ * Reported with every catalog; must match package.json (a test checks).
+ * `pnpm release <version>` (scripts/release.mjs) sets both in one commit.
+ */
+export const SDK_VERSION = "0.3.1";
 const JSON_SCHEMA_TARGET = "draft-2020-12";
 const DRAFT_2020_12 = "https://json-schema.org/draft/2020-12/schema";
 // The 2026-07-28 MCP revision lets a schema property ask clients to mirror an
@@ -114,7 +118,9 @@ function assertToolDefinition(name, definition) {
         throw problem("needs a description");
     }
     if (!isToolRisk(definition.risk)) {
-        throw problem('needs a risk: "read", "write" or "destructive"');
+        throw problem(definition.risk === "destructive"
+            ? 'needs a risk: "read" or "write"; a tool that deletes is risk: "write" with destructive: true'
+            : 'needs a risk: "read" or "write"');
     }
     if (!isToolSchema(definition.input)) {
         throw problem("input must be a Standard Schema with JSON Schema support (zod >= 4.2) or { jsonSchema, validate }");
@@ -128,12 +134,15 @@ function assertToolDefinition(name, definition) {
     if (definition.title !== undefined && typeof definition.title !== "string") {
         throw problem("title must be a string");
     }
-    for (const flag of ["idempotent", "openWorld"]) {
+    for (const flag of ["destructive", "idempotent", "openWorld"]) {
         if (definition[flag] !== undefined &&
             typeof definition[flag] !== "boolean") {
             throw problem(`${flag} must be a boolean`);
         }
     }
+    if (definition.destructive && definition.risk === "read") {
+        throw problem('is destructive, so its risk is "write"');
+    }
 }
 function isRecord(value) {
     return ((typeof value === "object" || typeof value === "function") && value !== null);
@@ -196,6 +205,7 @@ function describeTool(name, definition) {
     if (typeof outputSchema === "string")
         return outputSchema;
     const annotations = {
+        ...(definition.destructive ? { destructiveHint: true } : {}),
         ...(definition.idempotent !== undefined
             ? { idempotentHint: definition.idempotent }
             : {}),

package/dist/server/toolsEndpoint.d.ts

@@ -7,7 +7,8 @@
  *  - `/__everyapp/tools/list` needs the gateway's system token for this app
  *    (purpose "tools.list"). It describes tools; it never runs them.
  *  - `/__everyapp/tools/call` needs an identity token minted for this exact
- *    call: `chan: "mcp"` plus a `tc` claim naming the tool and call id. The
+ *    call: `chan: "mcp"` (an AI client's MCP connection) plus a `tc` claim
+ *    naming the tool and call id. The
  *    token's scopes must include the scope the tool's risk requires; `*` does
  *    not count, because the ToolBus only ever mints explicit scopes.
  *

package/dist/server/toolsEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolsEndpoint.d.ts","sourceRoot":"","sources":["../../src/server/toolsEndpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAcL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAoFD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B"}
+{"version":3,"file":"toolsEndpoint.d.ts","sourceRoot":"","sources":["../../src/server/toolsEndpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAcL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAoFD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B"}

package/dist/server/toolsEndpoint.js

@@ -7,7 +7,8 @@
  *  - `/__everyapp/tools/list` needs the gateway's system token for this app
  *    (purpose "tools.list"). It describes tools; it never runs them.
  *  - `/__everyapp/tools/call` needs an identity token minted for this exact
- *    call: `chan: "mcp"` plus a `tc` claim naming the tool and call id. The
+ *    call: `chan: "mcp"` (an AI client's MCP connection) plus a `tc` claim
+ *    naming the tool and call id. The
  *    token's scopes must include the scope the tool's risk requires; `*` does
  *    not count, because the ToolBus only ever mints explicit scopes.
  *
@@ -198,8 +199,8 @@ async function callTool(request, env, ctx, verify, options) {
     });
     let result;
     try {
-        // The call runs in the request context like a page would: currentUser()
-        // is the caller, and its Gateway calls are attributed to them.
+        // The call runs in the request context like a page would: its Gateway
+        // calls are attributed to the caller.
         const value = await serveRequest({ request, user, expiresAt }, () => tool.handler(input.value, {
             user,
             env: env,

package/dist/server/webhooks.d.ts

@@ -0,0 +1,56 @@
+export type WebhookProvider = "slack" | "github" | "everyapp";
+export interface VerifyWebhookOptions {
+    provider: WebhookProvider;
+    /** The signing secret, or several while one rotates. Empty ones are ignored. */
+    secret: string | readonly string[];
+    /** How far a signed timestamp may be from now (Slack, EveryApp). Default 300 s. */
+    toleranceSeconds?: number;
+    /** The largest body read before giving up. Default 5 MiB. */
+    maxBytes?: number;
+    /** The clock, for tests. */
+    now?: Date;
+}
+export type WebhookRefusalReason = 
+/** No usable secret was passed: a configuration fault, never the sender's. */
+"no_secret"
+/** The provider's signature header is absent. */
+ | "missing_signature"
+/** A signature or timestamp header that isn't the provider's shape. */
+ | "malformed"
+/** The signed timestamp is outside the tolerance. */
+ | "expired"
+/** The body is larger than `maxBytes`. */
+ | "too_large"
+/** The body was already read, or its stream failed mid-read. */
+ | "unreadable"
+/** No secret verifies the signature. */
+ | "mismatch";
+export type WebhookVerification = {
+    ok: true;
+    /** The body exactly as signed. The request's own body is consumed: parse this. */
+    body: string;
+    /** The provider's id for this delivery, for deduplication; null when it sends none. */
+    deliveryId: string | null;
+    /** The signed timestamp in seconds; null for GitHub, which signs none. */
+    timestamp: number | null;
+} | {
+    ok: false;
+    reason: WebhookRefusalReason;
+};
+/** The default body limit: well above Slack's payloads and most of GitHub's (whose cap is 25 MB). */
+export declare const WEBHOOK_MAX_BYTES_DEFAULT: number;
+/**
+ * Verify `request` as a `provider` webhook signed with `secret`. Reads the
+ * body (at most `maxBytes`) and returns it on success; never throws for a
+ * bad delivery, so a handler answers `401` on `{ ok: false }`. Throws a
+ * `TypeError` only for a programming error: an unknown `provider`, or a
+ * `toleranceSeconds` or `maxBytes` that is negative, NaN or infinite.
+ *
+ * ```ts
+ * const check = await verifyWebhook(request, { provider: "slack", secret: env.SLACK_SIGNING_SECRET });
+ * if (!check.ok) return new Response(null, { status: 401 });
+ * const params = new URLSearchParams(check.body);
+ * ```
+ */
+export declare function verifyWebhook(request: Request, options: VerifyWebhookOptions): Promise<WebhookVerification>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/server/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/server/webhooks.ts"],"names":[],"mappings":"AAiCA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,eAAe,CAAC;IAC1B,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACnC,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,oBAAoB;AAC9B,8EAA8E;AAC5E,WAAW;AACb,iDAAiD;GAC/C,mBAAmB;AACrB,uEAAuE;GACrE,WAAW;AACb,qDAAqD;GACnD,SAAS;AACX,0CAA0C;GACxC,WAAW;AACb,gEAAgE;GAC9D,YAAY;AACd,wCAAwC;GACtC,UAAU,CAAC;AAEf,MAAM,MAAM,mBAAmB,GAC3B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEhD,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,QAAkB,CAAC;AAMzD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B"}

package/dist/server/webhooks.js

@@ -0,0 +1,205 @@
+/**
+ * `verifyWebhook()`: check an inbound provider webhook on a route the
+ * manifest declares `public`, the way the provider signs it.
+ *
+ * The Gateway forwards a public route's body and headers untouched and
+ * verifies nothing (landing-page/content/agent/manifest.md, "Why a route is
+ * public"): the app checks the provider's signature itself, with the signing
+ * secret it declares in `secrets`. Every app that takes a webhook would
+ * otherwise write this HMAC code again, and the easy mistakes (a `===`
+ * compare, no timestamp window, verifying a re-serialized body, reading an
+ * unbounded body first) are the ones that matter. Proposed in
+ * docs/design/2026-11-birds-forcing-function.md (limitation 6).
+ *
+ * Supported signing schemes:
+ *  - `slack`: `X-Slack-Signature: v0=<hex>` over `v0:<timestamp>:<body>`,
+ *    with `X-Slack-Request-Timestamp` inside the tolerance;
+ *  - `github`: `X-Hub-Signature-256: sha256=<hex>` over the body. GitHub
+ *    signs no timestamp, so a replay is the receiver's to drop: dedupe on
+ *    `deliveryId` (`X-GitHub-Delivery`);
+ *  - `everyapp`: a Gateway's own event delivery, `X-EveryApp-Signature:
+ *    t=<seconds>,v1=<hex>` over `<t>.<body>` (the same check as the
+ *    Gateway's `verifyEventSignature`), deduped on `X-EveryApp-Event-Id`.
+ *
+ * WebCrypto only. The compare is `crypto.subtle.verify`, constant time.
+ * Several secrets may be given, so a secret rotates without a gap.
+ */
+import { EVENT_HEADERS, EVENT_SIGNATURE_TOLERANCE_SECONDS, eventSigningInput, parseEventSignature, } from "../internal/events.js";
+/** The default body limit: well above Slack's payloads and most of GitHub's (whose cap is 25 MB). */
+export const WEBHOOK_MAX_BYTES_DEFAULT = 5 * 1024 * 1024;
+const HEX_SHA256 = /^[0-9a-f]{64}$/i;
+const MAX_EVENT_SIGNATURES = 4;
+const encoder = new TextEncoder();
+/**
+ * Verify `request` as a `provider` webhook signed with `secret`. Reads the
+ * body (at most `maxBytes`) and returns it on success; never throws for a
+ * bad delivery, so a handler answers `401` on `{ ok: false }`. Throws a
+ * `TypeError` only for a programming error: an unknown `provider`, or a
+ * `toleranceSeconds` or `maxBytes` that is negative, NaN or infinite.
+ *
+ * ```ts
+ * const check = await verifyWebhook(request, { provider: "slack", secret: env.SLACK_SIGNING_SECRET });
+ * if (!check.ok) return new Response(null, { status: 401 });
+ * const params = new URLSearchParams(check.body);
+ * ```
+ */
+export async function verifyWebhook(request, options) {
+    const secrets = (typeof options.secret === "string" ? [options.secret] : options.secret).filter((secret) => typeof secret === "string" && secret.length > 0);
+    if (secrets.length === 0)
+        return refused("no_secret");
+    // A NaN or infinite tolerance or limit would quietly turn the window or the
+    // read bound off (every comparison with NaN is false): refuse the call.
+    const tolerance = checkedOption("toleranceSeconds", options.toleranceSeconds, EVENT_SIGNATURE_TOLERANCE_SECONDS);
+    const maxBytes = checkedOption("maxBytes", options.maxBytes, WEBHOOK_MAX_BYTES_DEFAULT);
+    const signed = readSignature(request.headers, options.provider);
+    if (!signed.ok)
+        return signed;
+    if (signed.timestamp !== null) {
+        const nowSeconds = Math.floor((options.now ?? new Date()).getTime() / 1000);
+        if (Math.abs(nowSeconds - signed.timestamp) > tolerance) {
+            return refused("expired");
+        }
+    }
+    const bytes = await readBody(request, maxBytes);
+    if (bytes === "unreadable")
+        return refused("unreadable");
+    if (bytes === null)
+        return refused("too_large");
+    // The HMAC runs over the bytes received, never a decoded and re-encoded copy.
+    const prefix = encoder.encode(signed.prefix);
+    const data = new Uint8Array(new ArrayBuffer(prefix.byteLength + bytes.byteLength));
+    data.set(prefix, 0);
+    data.set(bytes, prefix.byteLength);
+    for (const secret of secrets) {
+        const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+        for (const candidate of signed.digests) {
+            if (await crypto.subtle.verify("HMAC", key, fromHex(candidate), data)) {
+                return {
+                    ok: true,
+                    body: new TextDecoder().decode(bytes),
+                    deliveryId: signed.deliveryId,
+                    timestamp: signed.timestamp,
+                };
+            }
+        }
+    }
+    return refused("mismatch");
+}
+function readSignature(headers, provider) {
+    switch (provider) {
+        case "slack": {
+            const header = headers.get("x-slack-signature");
+            if (!header)
+                return refused("missing_signature");
+            const rawTimestamp = headers.get("x-slack-request-timestamp");
+            const digest = header.startsWith("v0=") ? header.slice(3) : "";
+            if (!HEX_SHA256.test(digest) ||
+                !rawTimestamp ||
+                !/^\d{1,12}$/.test(rawTimestamp)) {
+                return refused("malformed");
+            }
+            return {
+                ok: true,
+                digests: [digest.toLowerCase()],
+                timestamp: Number(rawTimestamp),
+                deliveryId: null,
+                prefix: `v0:${rawTimestamp}:`,
+            };
+        }
+        case "github": {
+            const header = headers.get("x-hub-signature-256");
+            if (!header)
+                return refused("missing_signature");
+            const digest = header.startsWith("sha256=") ? header.slice(7) : "";
+            if (!HEX_SHA256.test(digest))
+                return refused("malformed");
+            return {
+                ok: true,
+                digests: [digest.toLowerCase()],
+                timestamp: null,
+                deliveryId: headers.get("x-github-delivery"),
+                prefix: "",
+            };
+        }
+        case "everyapp": {
+            const header = headers.get(EVENT_HEADERS.signature);
+            if (!header)
+                return refused("missing_signature");
+            const parsed = parseEventSignature(header);
+            // The Gateway sends one v1 (two while a secret rotates): a header with
+            // many isn't one it sent, and each would cost an HMAC per secret.
+            if (!parsed || parsed.v1.length > MAX_EVENT_SIGNATURES) {
+                return refused("malformed");
+            }
+            return {
+                ok: true,
+                digests: parsed.v1,
+                timestamp: parsed.timestamp,
+                deliveryId: headers.get(EVENT_HEADERS.eventId),
+                prefix: eventSigningInput(parsed.timestamp, ""),
+            };
+        }
+        default: {
+            const unknown = provider;
+            throw new TypeError(`verifyWebhook: unknown provider "${String(unknown)}"`);
+        }
+    }
+}
+/** A finite, non-negative option, or its default when not given. */
+function checkedOption(name, value, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        throw new TypeError(`verifyWebhook: ${name} must be a finite number of at least 0`);
+    }
+    return value;
+}
+/**
+ * The body's bytes; null once it passes `maxBytes` (read no further);
+ * "unreadable" when it was already consumed or its stream fails.
+ */
+async function readBody(request, maxBytes) {
+    const declared = Number(request.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > maxBytes)
+        return null;
+    if (request.bodyUsed)
+        return "unreadable";
+    if (!request.body)
+        return new Uint8Array(new ArrayBuffer(0));
+    const chunks = [];
+    let total = 0;
+    try {
+        const reader = request.body.getReader();
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel().catch(() => undefined);
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        return "unreadable";
+    }
+    const bytes = new Uint8Array(new ArrayBuffer(total));
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
+function fromHex(hex) {
+    const bytes = new Uint8Array(new ArrayBuffer(hex.length / 2));
+    for (let index = 0; index < bytes.length; index += 1) {
+        bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+    }
+    return bytes;
+}
+function refused(reason) {
+    return { ok: false, reason };
+}

package/dist/testing/index.d.ts

@@ -67,9 +67,8 @@ export interface TestWorker {
 export interface CallToolOptions {
     user?: TestUser;
     /**
-     * The caller's scopes. Default: `mcp:read`, `mcp:write` and
-     * `mcp:destructive`, so every tool may be called; pass fewer to test a
-     * refusal.
+     * The caller's scopes. Default: `mcp:read` and `mcp:write`, so every
+     * tool may be called; pass `["mcp:read"]` to test a refusal.
      */
     scopes?: string[];
     /** Default: {@link testEnv}() for the worker's app. */

package/dist/testing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAuBA,OAAO,EAIL,eAAe,EASf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,YAAY,EACV,gBAAgB,IAAI,cAAc,EAClC,mBAAmB,IAAI,gBAAgB,EACvC,mBAAmB,IAAI,iBAAiB,GACzC,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sEAAsE;AACtE,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAKjD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,WAAW,aAAa,CAAC;AAEtC,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB;IACvB,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC7D,SAAS,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,CAAgC,GAC/D;IACD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB,EAAE,MAAM,CAAC;IACjC,6BAA6B,EAAE,MAAM,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAUnB;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,gBAAgB,GAAG;IAChD,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5B,CAQA;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CACpC,OAAO,GAAE,mBAAmB,GAAG;IAC7B,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACpC,GACL,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,GAAE,WAAW,GACf,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;CAAO,GACpE,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,gBAAgB,GACpB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,UAAU,GAAG,OAAO,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAwB9B;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAC7B,GAAG,EAAE,UAAU,GAAG,OAAO,EACzB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACrD,OAAO,CAAC,mBAAmB,CAAC,CAuB9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAuBA,OAAO,EAIL,eAAe,EAQf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,YAAY,EACV,gBAAgB,IAAI,cAAc,EAClC,mBAAmB,IAAI,gBAAgB,EACvC,mBAAmB,IAAI,iBAAiB,GACzC,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sEAAsE;AACtE,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAKjD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,WAAW,aAAa,CAAC;AAEtC,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB;IACvB,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC7D,SAAS,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,CAAgC,GAC/D;IACD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB,EAAE,MAAM,CAAC;IACjC,6BAA6B,EAAE,MAAM,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAUnB;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,gBAAgB,GAAG;IAChD,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5B,CAQA;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CACpC,OAAO,GAAE,mBAAmB,GAAG;IAC7B,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACpC,GACL,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,GAAE,WAAW,GACf,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;CAAO,GACpE,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,gBAAgB,GACpB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,UAAU,GAAG,OAAO,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAoB9B;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAC7B,GAAG,EAAE,UAAU,GAAG,OAAO,EACzB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACrD,OAAO,CAAC,mBAAmB,CAAC,CAuB9B"}

package/dist/testing/index.js

@@ -17,7 +17,7 @@
  * deployed Worker. For tests only; a Worker never imports this module.
  */
 import { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "../dev/keypair.js";
-import { APP_ID_ENV, AUDIENCE_ENV, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, MCP_DESTRUCTIVE_SCOPE, MCP_READ_SCOPE, MCP_WRITE_SCOPE, SYSTEM_HEADER, TOOLS_CALL_PATH, TOOLS_LIST_PATH, mintIdentityJwt, mintSystemJwt, } from "../internal/index.js";
+import { APP_ID_ENV, AUDIENCE_ENV, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, MCP_READ_SCOPE, MCP_WRITE_SCOPE, SYSTEM_HEADER, TOOLS_CALL_PATH, TOOLS_LIST_PATH, mintIdentityJwt, mintSystemJwt, } from "../internal/index.js";
 import { everyApp } from "../server/everyApp.js";
 export { IDENTITY_HEADER };
 /** The person a test signs in by default: the owner of `org_test`. */
@@ -104,11 +104,7 @@ export async function callTool(app, name, args = {}, options = {}) {
         user: options.user,
         appId: audienceOf(env),
         channel: "mcp",
-        scopes: options.scopes ?? [
-            MCP_READ_SCOPE,
-            MCP_WRITE_SCOPE,
-            MCP_DESTRUCTIVE_SCOPE,
-        ],
+        scopes: options.scopes ?? [MCP_READ_SCOPE, MCP_WRITE_SCOPE],
         toolCall: { id: callId, name },
     });
     const response = await workerOf(app).fetch(new Request(`https://app.test${TOOLS_CALL_PATH}`, {

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@every-app/sdk",
-  "version": "0.3.0-rc.9",
+  "version": "0.3.1",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/every-app/every-app.git",
+    "directory": "packages/sdk"
+  },
   "type": "module",
   "exports": {
     ".": {

package/dist/server/aiBinding.d.ts

@@ -1,68 +0,0 @@
-/**
- * `gatewayAiBinding(env)`: the Gateway's AI providers as a Workers AI
- * binding, for code written against `env.AI.run(model, inputs, options)`.
- *
- * An app on Every App needs no `ai` binding of its own to call models: the
- * Gateway holds the keys, counts the calls and keeps the app to `ai.models`.
- * Code that already calls `env.AI.run()` (upstream code a port keeps, the
- * Agents SDK, `workers-ai-provider`) gets this object in its place:
- *
- *   const AI = gatewayAiBinding(env, { for: request });
- *   await AI.run("@cf/meta/llama-3.1-8b-instruct-fast", { messages });
- *
- * Each `run()` becomes an OpenAI-compatible call on the provider's route
- * through the Gateway (`createGatewayFetch`): text generation (`messages`
- * or `prompt`) on its chat completions route, text embeddings (`text`) on
- * its embeddings route, answered in Workers AI's shapes (`{ response,
- * tool_calls, usage }`, `{ shape, data }`, or a stream of `data:
- * {"response": …}` events with `stream: true`). In local development
- * without a Gateway, the developer's own key in `.dev.vars` is used, as
- * `createGatewayFetch` does (WORKERS_AI_API_TOKEN and CLOUDFLARE_ACCOUNT_ID
- * for Workers AI).
- */
-import { AI_DEFAULT_PROVIDER, type AiProviderId } from "../internal/index.js";
-import type { GatewayCallFor } from "./attribution.js";
-export interface GatewayAiBindingOptions {
-    /**
-     * Whom the calls are for: the inbound request, or `{ background: true,
-     * organizationId }` (createGatewayFetch's `for`).
-     */
-    for?: GatewayCallFor;
-    /**
-     * The Gateway provider the calls go to: an `ai` entry of the catalog
-     * with OpenAI-compatible routes (`workers-ai`, `openrouter`, `openai`,
-     * …), or `default`, the operator's model (`ai: { chat: true }`).
-     * Default: `workers-ai`, the provider `env.AI` reaches, so `@cf/…` model
-     * ids work as they are. The manifest lists the provider under
-     * `providers` (or says `ai.chat` for `default`).
-     */
-    provider?: AiProviderId | typeof AI_DEFAULT_PROVIDER;
-    /**
-     * The model id to send for a model the code names, e.g.
-     * `{ "@cf/meta/llama-3.1-8b-instruct-fast": "meta-llama/llama-3.1-8b-instruct" }`
-     * with `provider: "openrouter"`. A model not listed is sent as it is,
-     * except that on `default` an `@cf/…` id becomes `default` (the
-     * operator's model).
-     */
-    models?: Readonly<Record<string, string>>;
-}
-/**
- * A Workers AI binding (`Ai`) over the Gateway: pass it where code takes
- * `env.AI`. `run()` covers text generation (messages or prompt; tools;
- * `stream: true`; `returnRawResponse`, which returns the provider's
- * OpenAI-shaped `Response`) and text embeddings; the binding's other
- * methods (`gateway()`, `autorag()`, `models()`, `toMarkdown()`, …) and
- * other tasks (images, audio, batches, websockets) throw
- * `ConfigurationError`. `options.gateway` is ignored: the Gateway's
- * operator decides whether calls go through Cloudflare AI Gateway
- * (`everyapp ai gateway on`).
- *
- * Errors are thrown as a binding throws them: `GatewayRefusalError` when
- * the Gateway refused (`ai_provider_not_configured`, `model_not_allowed`,
- * …), `ConfigurationError` where createGatewayFetch throws one (no binding
- * and no dev key), and an `Error` naming the status when the provider
- * answered with an error. Nothing is checked when the binding is made, so
- * making one per request costs nothing.
- */
-export declare function gatewayAiBinding(env: object, options?: GatewayAiBindingOptions): Ai;
-//# sourceMappingURL=aiBinding.d.ts.map

package/dist/server/aiBinding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"aiBinding.d.ts","sourceRoot":"","sources":["../../src/server/aiBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAEL,mBAAmB,EAInB,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,mBAAmB,CAAC;IACrD;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C;AAUD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,uBAA4B,GACpC,EAAE,CAoEJ"}