@every-app/sdk 0.3.0-rc.9 → 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (131) hide show
  1. package/README.md +79 -74
  2. package/dist/cloudflare/catalogSettings.generated.d.ts +19 -6
  3. package/dist/cloudflare/catalogSettings.generated.d.ts.map +1 -1
  4. package/dist/cloudflare/catalogSettings.generated.js +43 -14
  5. package/dist/cloudflare/index.d.ts +1 -1
  6. package/dist/cloudflare/index.d.ts.map +1 -1
  7. package/dist/cloudflare/worker.d.ts +63 -9
  8. package/dist/cloudflare/worker.d.ts.map +1 -1
  9. package/dist/cloudflare/worker.js +45 -9
  10. package/dist/index.d.ts +1 -1
  11. package/dist/index.d.ts.map +1 -1
  12. package/dist/internal/aiDefault.d.ts +36 -79
  13. package/dist/internal/aiDefault.d.ts.map +1 -1
  14. package/dist/internal/aiDefault.js +47 -149
  15. package/dist/internal/aiProviders.d.ts +1 -1
  16. package/dist/internal/aiProviders.d.ts.map +1 -1
  17. package/dist/internal/aiProviders.js +2 -2
  18. package/dist/internal/appSettings.d.ts +140 -89
  19. package/dist/internal/appSettings.d.ts.map +1 -1
  20. package/dist/internal/appSettings.js +264 -156
  21. package/dist/internal/capabilities.d.ts +109 -503
  22. package/dist/internal/capabilities.d.ts.map +1 -1
  23. package/dist/internal/capabilities.js +30 -550
  24. package/dist/internal/catalog/commerce.js +1 -1
  25. package/dist/internal/catalog/index.d.ts +35 -0
  26. package/dist/internal/catalog/index.d.ts.map +1 -1
  27. package/dist/internal/catalog/infra.d.ts +35 -0
  28. package/dist/internal/catalog/infra.d.ts.map +1 -1
  29. package/dist/internal/catalog/infra.js +65 -0
  30. package/dist/internal/devProviders.d.ts +1 -19
  31. package/dist/internal/devProviders.d.ts.map +1 -1
  32. package/dist/internal/devProviders.js +7 -1
  33. package/dist/internal/events.d.ts +52 -1
  34. package/dist/internal/events.d.ts.map +1 -1
  35. package/dist/internal/events.js +66 -4
  36. package/dist/internal/gatewaySettings.d.ts +6 -16
  37. package/dist/internal/gatewaySettings.d.ts.map +1 -1
  38. package/dist/internal/gatewaySettings.js +5 -23
  39. package/dist/internal/index.d.ts +1 -0
  40. package/dist/internal/index.d.ts.map +1 -1
  41. package/dist/internal/index.js +1 -0
  42. package/dist/internal/mcpOAuth.d.ts +210 -0
  43. package/dist/internal/mcpOAuth.d.ts.map +1 -0
  44. package/dist/internal/mcpOAuth.js +735 -0
  45. package/dist/internal/oauthClient.d.ts +36 -44
  46. package/dist/internal/oauthClient.d.ts.map +1 -1
  47. package/dist/internal/oauthClient.js +30 -113
  48. package/dist/internal/oauthPresets.d.ts +356 -20
  49. package/dist/internal/oauthPresets.d.ts.map +1 -1
  50. package/dist/internal/oauthPresets.js +183 -861
  51. package/dist/internal/oauthScopes.d.ts +43 -155
  52. package/dist/internal/oauthScopes.d.ts.map +1 -1
  53. package/dist/internal/oauthScopes.js +82 -475
  54. package/dist/internal/oauthSpec.d.ts +28 -71
  55. package/dist/internal/oauthSpec.d.ts.map +1 -1
  56. package/dist/internal/oauthSpec.js +172 -448
  57. package/dist/internal/protocol.d.ts +24 -14
  58. package/dist/internal/protocol.d.ts.map +1 -1
  59. package/dist/internal/protocol.js +26 -7
  60. package/dist/internal/providerApps.d.ts +2 -2
  61. package/dist/internal/providerApps.js +2 -2
  62. package/dist/internal/providerRegistry.d.ts +5 -64
  63. package/dist/internal/providerRegistry.d.ts.map +1 -1
  64. package/dist/internal/providerRegistry.js +19 -118
  65. package/dist/internal/providerSpec.d.ts.map +1 -1
  66. package/dist/internal/providerSpec.js +14 -36
  67. package/dist/internal/remoteMcp.d.ts +191 -47
  68. package/dist/internal/remoteMcp.d.ts.map +1 -1
  69. package/dist/internal/remoteMcp.js +338 -133
  70. package/dist/internal/signInProviders.d.ts +1 -1
  71. package/dist/internal/signInProviders.d.ts.map +1 -1
  72. package/dist/internal/tools.d.ts +15 -8
  73. package/dist/internal/tools.d.ts.map +1 -1
  74. package/dist/internal/tools.js +9 -8
  75. package/dist/manifest.d.ts +96 -40
  76. package/dist/manifest.d.ts.map +1 -1
  77. package/dist/manifest.js +1 -1
  78. package/dist/server/ai.d.ts +1 -93
  79. package/dist/server/ai.d.ts.map +1 -1
  80. package/dist/server/ai.js +17 -111
  81. package/dist/server/attribution.d.ts +11 -1
  82. package/dist/server/attribution.d.ts.map +1 -1
  83. package/dist/server/attribution.js +7 -1
  84. package/dist/server/connectUrl.d.ts +5 -10
  85. package/dist/server/connectUrl.d.ts.map +1 -1
  86. package/dist/server/connectUrl.js +22 -14
  87. package/dist/server/context.d.ts +12 -14
  88. package/dist/server/context.d.ts.map +1 -1
  89. package/dist/server/context.js +23 -25
  90. package/dist/server/eventsEndpoint.d.ts +48 -0
  91. package/dist/server/eventsEndpoint.d.ts.map +1 -0
  92. package/dist/server/eventsEndpoint.js +145 -0
  93. package/dist/server/everyApp.d.ts +16 -26
  94. package/dist/server/everyApp.d.ts.map +1 -1
  95. package/dist/server/everyApp.js +22 -46
  96. package/dist/server/gatewayFetch.d.ts +1 -1
  97. package/dist/server/gatewayFetch.js +1 -1
  98. package/dist/server/index.d.ts +6 -9
  99. package/dist/server/index.d.ts.map +1 -1
  100. package/dist/server/index.js +4 -8
  101. package/dist/server/integrationFetch.d.ts +66 -72
  102. package/dist/server/integrationFetch.d.ts.map +1 -1
  103. package/dist/server/integrationFetch.js +120 -392
  104. package/dist/server/refusal.d.ts +0 -9
  105. package/dist/server/refusal.d.ts.map +1 -1
  106. package/dist/server/refusal.js +0 -22
  107. package/dist/server/tools.d.ts +18 -7
  108. package/dist/server/tools.d.ts.map +1 -1
  109. package/dist/server/tools.js +15 -5
  110. package/dist/server/toolsEndpoint.d.ts +2 -1
  111. package/dist/server/toolsEndpoint.d.ts.map +1 -1
  112. package/dist/server/toolsEndpoint.js +4 -3
  113. package/dist/server/webhooks.d.ts +56 -0
  114. package/dist/server/webhooks.d.ts.map +1 -0
  115. package/dist/server/webhooks.js +205 -0
  116. package/dist/testing/index.d.ts +2 -3
  117. package/dist/testing/index.d.ts.map +1 -1
  118. package/dist/testing/index.js +2 -6
  119. package/package.json +6 -1
  120. package/dist/server/aiBinding.d.ts +0 -68
  121. package/dist/server/aiBinding.d.ts.map +0 -1
  122. package/dist/server/aiBinding.js +0 -294
  123. package/dist/server/authorizeUrl.d.ts +0 -43
  124. package/dist/server/authorizeUrl.d.ts.map +0 -1
  125. package/dist/server/authorizeUrl.js +0 -106
  126. package/dist/server/emailBinding.d.ts +0 -72
  127. package/dist/server/emailBinding.d.ts.map +0 -1
  128. package/dist/server/emailBinding.js +0 -124
  129. package/dist/server/fromMcpTools.d.ts +0 -89
  130. package/dist/server/fromMcpTools.d.ts.map +0 -1
  131. package/dist/server/fromMcpTools.js +0 -192
@@ -1,294 +0,0 @@
1
- /**
2
- * `gatewayAiBinding(env)`: the Gateway's AI providers as a Workers AI
3
- * binding, for code written against `env.AI.run(model, inputs, options)`.
4
- *
5
- * An app on Every App needs no `ai` binding of its own to call models: the
6
- * Gateway holds the keys, counts the calls and keeps the app to `ai.models`.
7
- * Code that already calls `env.AI.run()` (upstream code a port keeps, the
8
- * Agents SDK, `workers-ai-provider`) gets this object in its place:
9
- *
10
- * const AI = gatewayAiBinding(env, { for: request });
11
- * await AI.run("@cf/meta/llama-3.1-8b-instruct-fast", { messages });
12
- *
13
- * Each `run()` becomes an OpenAI-compatible call on the provider's route
14
- * through the Gateway (`createGatewayFetch`): text generation (`messages`
15
- * or `prompt`) on its chat completions route, text embeddings (`text`) on
16
- * its embeddings route, answered in Workers AI's shapes (`{ response,
17
- * tool_calls, usage }`, `{ shape, data }`, or a stream of `data:
18
- * {"response": …}` events with `stream: true`). In local development
19
- * without a Gateway, the developer's own key in `.dev.vars` is used, as
20
- * `createGatewayFetch` does (WORKERS_AI_API_TOKEN and CLOUDFLARE_ACCOUNT_ID
21
- * for Workers AI).
22
- */
23
- import { AI_DEFAULT_MODEL, AI_DEFAULT_PROVIDER, AI_DEFAULT_ROUTES, ConfigurationError, devAiProvider, } from "../internal/index.js";
24
- import { BINDING_ORIGIN, createGatewayFetch } from "./gatewayFetch.js";
25
- import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
26
- /**
27
- * A Workers AI binding (`Ai`) over the Gateway: pass it where code takes
28
- * `env.AI`. `run()` covers text generation (messages or prompt; tools;
29
- * `stream: true`; `returnRawResponse`, which returns the provider's
30
- * OpenAI-shaped `Response`) and text embeddings; the binding's other
31
- * methods (`gateway()`, `autorag()`, `models()`, `toMarkdown()`, …) and
32
- * other tasks (images, audio, batches, websockets) throw
33
- * `ConfigurationError`. `options.gateway` is ignored: the Gateway's
34
- * operator decides whether calls go through Cloudflare AI Gateway
35
- * (`everyapp ai gateway on`).
36
- *
37
- * Errors are thrown as a binding throws them: `GatewayRefusalError` when
38
- * the Gateway refused (`ai_provider_not_configured`, `model_not_allowed`,
39
- * …), `ConfigurationError` where createGatewayFetch throws one (no binding
40
- * and no dev key), and an `Error` naming the status when the provider
41
- * answered with an error. Nothing is checked when the binding is made, so
42
- * making one per request costs nothing.
43
- */
44
- export function gatewayAiBinding(env, options = {}) {
45
- const provider = options.provider ?? "workers-ai";
46
- async function run(model, inputs, runOptions = {}) {
47
- if (runOptions.websocket) {
48
- throw unsupported("run() with websocket: true");
49
- }
50
- if (!inputs || typeof inputs !== "object") {
51
- throw unsupported("run() without an inputs object");
52
- }
53
- if (Array.isArray(inputs["requests"])) {
54
- throw unsupported("run() with a batch of requests");
55
- }
56
- const embedding = !("messages" in inputs) && !("prompt" in inputs) && "text" in inputs;
57
- if (!embedding && !("messages" in inputs) && !("prompt" in inputs)) {
58
- throw unsupported("run() for anything but text generation (messages or prompt) and text embeddings (text)");
59
- }
60
- const url = `${BINDING_ORIGIN}/api/ai/${provider}${routeOf(provider, embedding ? "embeddings" : "chat")}`;
61
- const sent = modelToSend(provider, model, options.models);
62
- const body = embedding
63
- ? { model: sent, input: inputs["text"] }
64
- : chatBody(sent, inputs);
65
- const gatewayFetch = createGatewayFetch({
66
- env,
67
- for: options.for,
68
- });
69
- const response = await gatewayFetch(url, {
70
- method: "POST",
71
- headers: { "content-type": "application/json" },
72
- body: JSON.stringify(body),
73
- ...(runOptions.signal ? { signal: runOptions.signal } : {}),
74
- });
75
- if (runOptions.returnRawResponse)
76
- return response;
77
- await throwIfFailed(response, provider);
78
- if (embedding)
79
- return embeddingOutput(await response.json());
80
- if (inputs["stream"] === true) {
81
- if (!response.body)
82
- return new ReadableStream();
83
- return response.body.pipeThrough(toWorkersAiStream());
84
- }
85
- return textOutput(await response.json());
86
- }
87
- const notHere = (method) => () => {
88
- throw unsupported(`env.AI.${method}()`);
89
- };
90
- const binding = {
91
- aiGatewayLogId: null,
92
- run,
93
- gateway: notHere("gateway"),
94
- autorag: notHere("autorag"),
95
- aiSearch: notHere("aiSearch"),
96
- websearch: notHere("websearch"),
97
- models: notHere("models"),
98
- toMarkdown: notHere("toMarkdown"),
99
- };
100
- // `Ai` is the app's own Workers types' class (it changes with each
101
- // version); the object above is its working subset, the rest throwing.
102
- return binding;
103
- }
104
- function unsupported(what) {
105
- return new ConfigurationError(`${what} isn't available through the Every App gateway; call the provider's routes with createGatewayFetch() instead.`);
106
- }
107
- /** The provider's path for a chat or an embeddings call, under `/api/ai/<provider>`. */
108
- function routeOf(provider, kind) {
109
- if (provider === AI_DEFAULT_PROVIDER)
110
- return AI_DEFAULT_ROUTES[kind];
111
- const spec = devAiProvider(provider);
112
- if (!spec) {
113
- throw new ConfigurationError(`gatewayAiBinding: ${JSON.stringify(provider)} is not an AI provider of the catalog.`);
114
- }
115
- const route = spec[kind];
116
- if (!route) {
117
- throw new ConfigurationError(`gatewayAiBinding: ${provider} has no OpenAI-compatible ${kind === "chat" ? "chat completions" : "embeddings"} route.`);
118
- }
119
- return route.path;
120
- }
121
- function modelToSend(provider, model, models) {
122
- const mapped = models && Object.hasOwn(models, model) ? models[model] : null;
123
- if (mapped)
124
- return mapped;
125
- if (provider === AI_DEFAULT_PROVIDER && model.startsWith("@cf/")) {
126
- return AI_DEFAULT_MODEL;
127
- }
128
- return model;
129
- }
130
- /**
131
- * Workers AI's text generation inputs as a chat completions body: `prompt`
132
- * as one user message, legacy tools (`{ name, description, parameters }`)
133
- * as OpenAI's, everything else (max_tokens, temperature, response_format,
134
- * stream, …) as it is. Never adds `stream_options` (Workers AI refuses it
135
- * on a call that doesn't stream).
136
- */
137
- function chatBody(model, inputs) {
138
- const { prompt, messages, tools, raw: _raw, lora: _lora, ...rest } = inputs;
139
- const body = {
140
- ...rest,
141
- model,
142
- messages: messages ??
143
- (typeof prompt === "string" ? [{ role: "user", content: prompt }] : []),
144
- };
145
- if (Array.isArray(tools))
146
- body["tools"] = tools.map(openAiTool);
147
- return body;
148
- }
149
- function openAiTool(tool) {
150
- if (!isRecord(tool) || "function" in tool)
151
- return tool;
152
- const { name, description, parameters } = tool;
153
- return {
154
- type: "function",
155
- function: {
156
- name,
157
- ...(description === undefined ? {} : { description }),
158
- ...(parameters === undefined ? {} : { parameters }),
159
- },
160
- };
161
- }
162
- async function throwIfFailed(response, provider) {
163
- if (response.ok)
164
- return;
165
- const refusal = await gatewayRefusal(response.clone());
166
- if (refusal)
167
- throw new GatewayRefusalError(refusal);
168
- const text = await response.text().catch(() => "");
169
- throw new Error(`AI (${provider}) answered ${response.status}${text ? `: ${text.slice(0, 500)}` : ""}`);
170
- }
171
- /** A chat completion as Workers AI answers text generation. */
172
- function textOutput(body) {
173
- const choice = firstChoice(body);
174
- const message = isRecord(choice?.["message"]) ? choice["message"] : {};
175
- const toolCalls = workersAiToolCalls(message["tool_calls"]);
176
- const usage = isRecord(body) ? body["usage"] : undefined;
177
- return {
178
- // Workers AI may send an all-digit reply as a JSON number.
179
- response: textOf(message["content"]),
180
- ...(toolCalls ? { tool_calls: toolCalls } : {}),
181
- ...(isRecord(usage) ? { usage } : {}),
182
- };
183
- }
184
- /**
185
- * OpenAI tool calls as both forms Workers AI answers with: the legacy
186
- * `{ name, arguments }` (arguments parsed) and the OpenAI-shaped
187
- * `{ id, type, function }`.
188
- */
189
- function workersAiToolCalls(calls) {
190
- if (!Array.isArray(calls) || calls.length === 0)
191
- return undefined;
192
- return calls.filter(isRecord).map((call) => {
193
- const fn = isRecord(call["function"]) ? call["function"] : {};
194
- const args = fn["arguments"];
195
- return {
196
- ...(call["id"] === undefined ? {} : { id: call["id"] }),
197
- type: "function",
198
- function: { name: fn["name"], arguments: args },
199
- name: fn["name"],
200
- arguments: typeof args === "string" ? parsedOr(args) : args,
201
- };
202
- });
203
- }
204
- /** Embeddings as Workers AI answers them: `{ shape: [rows, dimensions], data }`. */
205
- function embeddingOutput(body) {
206
- const rows = isRecord(body) && Array.isArray(body["data"]) ? body["data"] : [];
207
- const data = rows
208
- .filter(isRecord)
209
- .sort((a, b) => Number(a["index"] ?? 0) - Number(b["index"] ?? 0))
210
- .map((row) => Array.isArray(row["embedding"]) ? row["embedding"] : []);
211
- return { shape: [data.length, data[0]?.length ?? 0], data };
212
- }
213
- /**
214
- * An OpenAI chat completions event stream as Workers AI streams text:
215
- * one `data: {"response": "<token>"}` event per chunk with text (tool call
216
- * deltas and usage alongside), then `data: [DONE]`.
217
- */
218
- function toWorkersAiStream() {
219
- const decoder = new TextDecoder();
220
- const encoder = new TextEncoder();
221
- let pending = "";
222
- const convert = (line) => {
223
- const match = /^data:[ ]?(.*?)\r?$/s.exec(line);
224
- if (!match)
225
- return "";
226
- const data = match[1].trim();
227
- if (data === "[DONE]")
228
- return "data: [DONE]\n\n";
229
- let chunk;
230
- try {
231
- chunk = JSON.parse(data);
232
- }
233
- catch {
234
- return "";
235
- }
236
- const choice = firstChoice(chunk);
237
- const delta = isRecord(choice?.["delta"]) ? choice["delta"] : {};
238
- const usage = isRecord(chunk) ? chunk["usage"] : undefined;
239
- const toolCalls = Array.isArray(delta["tool_calls"])
240
- ? delta["tool_calls"]
241
- : undefined;
242
- const event = {
243
- response: textOf(delta["content"]),
244
- ...(toolCalls ? { tool_calls: toolCalls } : {}),
245
- ...(isRecord(usage) ? { usage } : {}),
246
- };
247
- if (!event.response && !toolCalls && !isRecord(usage))
248
- return "";
249
- return `data: ${JSON.stringify(event)}\n\n`;
250
- };
251
- return new TransformStream({
252
- transform(bytes, controller) {
253
- pending += decoder.decode(bytes, { stream: true });
254
- const end = pending.lastIndexOf("\n");
255
- if (end === -1)
256
- return;
257
- const lines = pending.slice(0, end).split("\n");
258
- pending = pending.slice(end + 1);
259
- const out = lines.map(convert).join("");
260
- if (out)
261
- controller.enqueue(encoder.encode(out));
262
- },
263
- flush(controller) {
264
- pending += decoder.decode();
265
- const out = convert(pending);
266
- if (out)
267
- controller.enqueue(encoder.encode(out));
268
- },
269
- });
270
- }
271
- function firstChoice(body) {
272
- if (!isRecord(body) || !Array.isArray(body["choices"]))
273
- return undefined;
274
- const choice = body["choices"][0];
275
- return isRecord(choice) ? choice : undefined;
276
- }
277
- function textOf(content) {
278
- if (typeof content === "string")
279
- return content;
280
- if (typeof content === "number")
281
- return String(content);
282
- return "";
283
- }
284
- function parsedOr(text) {
285
- try {
286
- return JSON.parse(text);
287
- }
288
- catch {
289
- return text;
290
- }
291
- }
292
- function isRecord(value) {
293
- return typeof value === "object" && value !== null && !Array.isArray(value);
294
- }
@@ -1,43 +0,0 @@
1
- import { type OAuthClientCapabilityId } from "../internal/index.js";
2
- import type { OAuthClientIntegrationStatus } from "./integrationFetch.js";
3
- export interface AuthorizeUrlOptions {
4
- /** The OAuth client, as listed in the manifest's `capabilities`. */
5
- provider: OAuthClientCapabilityId;
6
- /** What `integrationStatus()` answered for it, ready and with its `clientId`. */
7
- status: OAuthClientIntegrationStatus;
8
- /** One of the redirect URIs the operator registered on the client. */
9
- redirectUri: string;
10
- /** The app's own anti-forgery value, checked when the person comes back. */
11
- state: string;
12
- /** PKCE: the S256 challenge of the verifier the app keeps for the exchange. */
13
- codeChallenge?: string;
14
- /**
15
- * The provider's extras (`prompt`, `login_hint`, Google's `hd`). Never
16
- * one of the parameters this helper sets (PKCE's and the provider's own
17
- * included), nor Google's `include_granted_scopes`.
18
- */
19
- params?: Record<string, string>;
20
- }
21
- /**
22
- * The provider's authorize URL to send a person to, for a client with
23
- * scope sets (`google-workspace`, `microsoft-365`, `slack`), built from the
24
- * capability's status: the registry's authorize endpoint (or the instance
25
- * the status names), `client_id`, `response_type=code`, `redirect_uri`,
26
- * `state`, and the scopes the status allows this app, which are exactly
27
- * what the gateway will let the token carry. Each provider's own needs
28
- * are added: Google's `access_type=offline` (a refresh token), Microsoft's
29
- * `response_mode=query`, Slack's comma-joined `scope` and its `user_scope`
30
- * (the status's `userScopes`, when the app's sets include a user set). With
31
- * `codeChallenge`, PKCE as S256. The app keeps its `state` and verifier
32
- * for the callback.
33
- *
34
- * A client without scope sets is refused: the
35
- * registry's checklist for one isn't what the gateway holds a token to,
36
- * so an app builds that URL itself from the status's `clientId`.
37
- *
38
- * Throws a `TypeError` naming the fix when the client has no scope sets,
39
- * when the status isn't ready or has no `clientId`, when the status lacks
40
- * `scopes`, or when `params` names a parameter the helper sets.
41
- */
42
- export declare function authorizeUrl({ provider, status, redirectUri, state, codeChallenge, params, }: AuthorizeUrlOptions): URL;
43
- //# sourceMappingURL=authorizeUrl.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"authorizeUrl.d.ts","sourceRoot":"","sources":["../../src/server/authorizeUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAE1E,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,QAAQ,EAAE,uBAAuB,CAAC;IAClC,iFAAiF;IACjF,MAAM,EAAE,4BAA4B,CAAC;IACrC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAgCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,MAAM,EACN,WAAW,EACX,KAAK,EACL,aAAa,EACb,MAAM,GACP,EAAE,mBAAmB,GAAG,GAAG,CAqD3B"}
@@ -1,106 +0,0 @@
1
- import { CAPABILITIES, ConfigurationError, } from "../internal/index.js";
2
- /**
3
- * Parameters the helper owns: the status decides the scopes, the caller's
4
- * other arguments decide the rest (PKCE from `codeChallenge`, always as
5
- * S256), each provider's own are fixed (Google's `access_type=offline` is
6
- * what gets a refresh token, Microsoft's `response_mode=query` is what
7
- * the callback reads), and Google's `include_granted_scopes` would widen
8
- * the token to every scope the person ever granted this client, which the
9
- * gateway refuses (`integration_scope_exceeded`).
10
- */
11
- const RESERVED_PARAMS = [
12
- "scope",
13
- "user_scope",
14
- "client_id",
15
- "redirect_uri",
16
- "state",
17
- "response_type",
18
- "code_challenge",
19
- "code_challenge_method",
20
- "access_type",
21
- "response_mode",
22
- "include_granted_scopes",
23
- ];
24
- /** The OAuth clients with scope sets: the ones this helper builds for. */
25
- function scopedClientIds() {
26
- return Object.entries(CAPABILITIES)
27
- .filter(([, found]) => found.mode === "oauth_client" && found.scopePolicy)
28
- .map(([id]) => id);
29
- }
30
- /**
31
- * The provider's authorize URL to send a person to, for a client with
32
- * scope sets (`google-workspace`, `microsoft-365`, `slack`), built from the
33
- * capability's status: the registry's authorize endpoint (or the instance
34
- * the status names), `client_id`, `response_type=code`, `redirect_uri`,
35
- * `state`, and the scopes the status allows this app, which are exactly
36
- * what the gateway will let the token carry. Each provider's own needs
37
- * are added: Google's `access_type=offline` (a refresh token), Microsoft's
38
- * `response_mode=query`, Slack's comma-joined `scope` and its `user_scope`
39
- * (the status's `userScopes`, when the app's sets include a user set). With
40
- * `codeChallenge`, PKCE as S256. The app keeps its `state` and verifier
41
- * for the callback.
42
- *
43
- * A client without scope sets is refused: the
44
- * registry's checklist for one isn't what the gateway holds a token to,
45
- * so an app builds that URL itself from the status's `clientId`.
46
- *
47
- * Throws a `TypeError` naming the fix when the client has no scope sets,
48
- * when the status isn't ready or has no `clientId`, when the status lacks
49
- * `scopes`, or when `params` names a parameter the helper sets.
50
- */
51
- export function authorizeUrl({ provider, status, redirectUri, state, codeChallenge, params, }) {
52
- const capability = oauthClientCapability(provider);
53
- if (!capability.scopePolicy) {
54
- throw new TypeError(`authorizeUrl() builds URLs for clients with scope sets (${scopedClientIds().join(", ")}); build ${capability.label}'s authorize URL yourself from the status's clientId.`);
55
- }
56
- if (!status.ready || !status.clientId) {
57
- throw new TypeError(`authorizeUrl(${JSON.stringify(provider)}) needs a ready status with a clientId, and integrationStatus() answered ready: ${String(status.ready)}. Show ${capability.label} as not available instead: its operator sets the client up on the gateway, and an app lists the scope sets it uses in everyapp.config.ts.`);
58
- }
59
- if (!status.scopes) {
60
- throw new TypeError(`authorizeUrl(${JSON.stringify(provider)}) takes ${capability.label}'s scopes from integrationStatus().scopes, which this status lacks: pass the status as the gateway (or everyapp dev) answered it.`);
61
- }
62
- for (const name of Object.keys(params ?? {})) {
63
- if (!RESERVED_PARAMS.includes(name))
64
- continue;
65
- throw new TypeError(name === "include_granted_scopes"
66
- ? `authorizeUrl(${JSON.stringify(provider)}): include_granted_scopes would widen the token to every scope the person granted this client, which the gateway refuses (integration_scope_exceeded); leave it out of params.`
67
- : `authorizeUrl(${JSON.stringify(provider)}) sets ${name} itself; leave it out of params.`);
68
- }
69
- const url = new URL(capability.authorize.url);
70
- // The status speaks for the gateway: its scopes are the token's ceiling.
71
- const scopes = status.scopes;
72
- const slack = url.host === "slack.com";
73
- url.searchParams.set("client_id", status.clientId);
74
- url.searchParams.set("response_type", "code");
75
- url.searchParams.set("redirect_uri", redirectUri);
76
- url.searchParams.set("state", state);
77
- url.searchParams.set("scope", scopes.join(slack ? "," : " "));
78
- if (status.userScopes && status.userScopes.length > 0) {
79
- url.searchParams.set("user_scope", status.userScopes.join(","));
80
- }
81
- if (codeChallenge) {
82
- url.searchParams.set("code_challenge", codeChallenge);
83
- url.searchParams.set("code_challenge_method", "S256");
84
- }
85
- if (url.host === "accounts.google.com") {
86
- // Without it Google issues no refresh token.
87
- url.searchParams.set("access_type", "offline");
88
- }
89
- else if (url.host === "login.microsoftonline.com") {
90
- url.searchParams.set("response_mode", "query");
91
- }
92
- for (const [name, value] of Object.entries(params ?? {})) {
93
- url.searchParams.set(name, value);
94
- }
95
- return url;
96
- }
97
- /** The OAuth client `provider` names, from plain JavaScript or a stale type too. */
98
- function oauthClientCapability(provider) {
99
- const found = Object.hasOwn(CAPABILITIES, provider)
100
- ? CAPABILITIES[provider]
101
- : undefined;
102
- if (found?.mode !== "oauth_client") {
103
- throw new ConfigurationError(`${JSON.stringify(String(provider))} isn't an OAuth client the gateway holds.`);
104
- }
105
- return found;
106
- }
@@ -1,72 +0,0 @@
1
- /**
2
- * `gatewayEmailBinding(env)`: the Gateway's `email` capability as a
3
- * `send_email` binding, for code written against `env.EMAIL.send(message)`.
4
- *
5
- * An app on Every App binds no `send_email` of its own: the Gateway sends
6
- * with its sender, checks `from` against the installation's senders and
7
- * keeps the mail budgets. Code that already calls `env.EMAIL.send()` gets
8
- * this object in its place:
9
- *
10
- * const EMAIL = gatewayEmailBinding(env, { for: request });
11
- * await EMAIL.send({ from, to, subject, text });
12
- *
13
- * Each `send()` is a `sendEmail()` (the manifest lists `capabilities: {
14
- * email: { access: "write" } }`), so local development works the same way:
15
- * checked and printed, or sent with the developer's own Email Sending
16
- * account (EMAIL_REST_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, EMAIL_FROM).
17
- */
18
- import { type SendEmailMessage } from "../internal/index.js";
19
- import type { GatewayCallFor } from "./attribution.js";
20
- export interface GatewayEmailBindingOptions {
21
- /**
22
- * Whom the mail is for: the inbound request, or `{ background: true,
23
- * organizationId }` (sendEmail's `for`).
24
- */
25
- for?: GatewayCallFor;
26
- }
27
- /** `name <email>` or a bare address, as the binding takes them. */
28
- type BindingAddress = string | {
29
- email: string;
30
- name?: string;
31
- };
32
- type BindingRecipients = BindingAddress | BindingAddress[];
33
- /** The structured message `send_email`'s `send()` takes (`EmailMessageBuilder`). */
34
- export interface GatewayEmailBindingMessage {
35
- from: BindingAddress;
36
- to?: BindingRecipients;
37
- cc?: BindingRecipients;
38
- bcc?: BindingRecipients;
39
- subject: string;
40
- replyTo?: BindingAddress;
41
- headers?: Record<string, string>;
42
- text?: string;
43
- html?: string;
44
- attachments?: {
45
- disposition?: "inline" | "attachment";
46
- contentId?: string;
47
- filename: string;
48
- type: string;
49
- content: string | ArrayBuffer | ArrayBufferView;
50
- }[];
51
- }
52
- /**
53
- * A `send_email` binding (`SendEmail`) over the Gateway: pass it where code
54
- * takes `env.EMAIL`. `send()` takes the structured message (`from`, `to`,
55
- * `cc`, `bcc`, `subject`, `text`, `html`, `replyTo`, `headers`,
56
- * `attachments`) and resolves `{ messageId }`. A raw MIME `EmailMessage`
57
- * (`new EmailMessage(from, to, raw)`) is refused with `GatewayRefusalError`
58
- * `email_invalid_message`: the Gateway takes structured mail only.
59
- *
60
- * Errors are sendEmail()'s: `GatewayRefusalError` with the Gateway's code
61
- * (`email_sender_not_allowed`, `email_budget_exhausted`,
62
- * `integration_not_configured`, …) and `ConfigurationError` with neither a
63
- * binding nor `everyapp dev`. Nothing is checked when the binding is made.
64
- */
65
- export declare function gatewayEmailBinding(env: object, options?: GatewayEmailBindingOptions): SendEmail;
66
- /**
67
- * The binding's message as sendEmail()'s: recipients as bare addresses,
68
- * `from` and `replyTo` with their display names, attachments base64.
69
- */
70
- export declare function toSendEmailMessage(message: unknown): SendEmailMessage;
71
- export {};
72
- //# sourceMappingURL=emailBinding.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"emailBinding.d.ts","sourceRoot":"","sources":["../../src/server/emailBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED,mEAAmE;AACnE,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChE,KAAK,iBAAiB,GAAG,cAAc,GAAG,cAAc,EAAE,CAAC;AAE3D,oFAAoF;AACpF,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,CAAC,EAAE,iBAAiB,CAAC;IACvB,EAAE,CAAC,EAAE,iBAAiB,CAAC;IACvB,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;QACtC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,CAAC;KACjD,EAAE,CAAC;CACL;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,0BAA+B,GACvC,SAAS,CAcX;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CA6BrE"}
@@ -1,124 +0,0 @@
1
- /**
2
- * `gatewayEmailBinding(env)`: the Gateway's `email` capability as a
3
- * `send_email` binding, for code written against `env.EMAIL.send(message)`.
4
- *
5
- * An app on Every App binds no `send_email` of its own: the Gateway sends
6
- * with its sender, checks `from` against the installation's senders and
7
- * keeps the mail budgets. Code that already calls `env.EMAIL.send()` gets
8
- * this object in its place:
9
- *
10
- * const EMAIL = gatewayEmailBinding(env, { for: request });
11
- * await EMAIL.send({ from, to, subject, text });
12
- *
13
- * Each `send()` is a `sendEmail()` (the manifest lists `capabilities: {
14
- * email: { access: "write" } }`), so local development works the same way:
15
- * checked and printed, or sent with the developer's own Email Sending
16
- * account (EMAIL_REST_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, EMAIL_FROM).
17
- */
18
- import { ConfigurationError, } from "../internal/index.js";
19
- import { GatewayRefusalError } from "./refusal.js";
20
- import { sendEmail } from "./sendEmail.js";
21
- /**
22
- * A `send_email` binding (`SendEmail`) over the Gateway: pass it where code
23
- * takes `env.EMAIL`. `send()` takes the structured message (`from`, `to`,
24
- * `cc`, `bcc`, `subject`, `text`, `html`, `replyTo`, `headers`,
25
- * `attachments`) and resolves `{ messageId }`. A raw MIME `EmailMessage`
26
- * (`new EmailMessage(from, to, raw)`) is refused with `GatewayRefusalError`
27
- * `email_invalid_message`: the Gateway takes structured mail only.
28
- *
29
- * Errors are sendEmail()'s: `GatewayRefusalError` with the Gateway's code
30
- * (`email_sender_not_allowed`, `email_budget_exhausted`,
31
- * `integration_not_configured`, …) and `ConfigurationError` with neither a
32
- * binding nor `everyapp dev`. Nothing is checked when the binding is made.
33
- */
34
- export function gatewayEmailBinding(env, options = {}) {
35
- const binding = {
36
- async send(message) {
37
- const result = await sendEmail({
38
- env,
39
- ...(options.for === undefined ? {} : { for: options.for }),
40
- message: toSendEmailMessage(message),
41
- });
42
- return { messageId: result.messageId ?? "" };
43
- },
44
- };
45
- // `SendEmail` is the app's own Workers types' interface, whose `send()`
46
- // overloads change with the version; this `send()` takes both forms.
47
- return binding;
48
- }
49
- /**
50
- * The binding's message as sendEmail()'s: recipients as bare addresses,
51
- * `from` and `replyTo` with their display names, attachments base64.
52
- */
53
- export function toSendEmailMessage(message) {
54
- if (!message || typeof message !== "object") {
55
- throw new ConfigurationError("EMAIL.send() takes a message object.");
56
- }
57
- if (!("subject" in message)) {
58
- throw new GatewayRefusalError({
59
- status: 400,
60
- code: "email_invalid_message",
61
- message: "Raw MIME messages can't be sent through the Every App gateway; send a structured message ({ from, to, subject, text or html }).",
62
- });
63
- }
64
- const m = message;
65
- return {
66
- to: addresses(m.to) ?? [],
67
- ...(m.cc === undefined ? {} : { cc: addresses(m.cc) }),
68
- ...(m.bcc === undefined ? {} : { bcc: addresses(m.bcc) }),
69
- subject: m.subject,
70
- ...(m.text ? { text: m.text } : {}),
71
- ...(m.html ? { html: m.html } : {}),
72
- from: named(m.from),
73
- ...(m.replyTo ? { replyTo: named(m.replyTo) } : {}),
74
- ...(m.headers && Object.keys(m.headers).length > 0
75
- ? { headers: m.headers }
76
- : {}),
77
- ...(m.attachments?.length
78
- ? { attachments: m.attachments.map(attachment) }
79
- : {}),
80
- };
81
- }
82
- /**
83
- * One attachment in the Gateway's shape. An inline part without a content
84
- * id can't be referenced (and the Gateway refuses it), so it goes as an
85
- * ordinary attachment.
86
- */
87
- function attachment(a) {
88
- const contentId = a.contentId?.trim();
89
- return {
90
- filename: a.filename,
91
- contentType: a.type,
92
- content: base64(a.content),
93
- ...(a.disposition === "inline" && contentId
94
- ? { disposition: "inline", contentId }
95
- : {}),
96
- };
97
- }
98
- function named(address) {
99
- if (typeof address === "string")
100
- return { address };
101
- return {
102
- address: address.email,
103
- ...(address.name?.trim() ? { name: address.name } : {}),
104
- };
105
- }
106
- function addresses(recipients) {
107
- if (recipients === undefined)
108
- return undefined;
109
- const of = (a) => (typeof a === "string" ? a : a.email);
110
- return Array.isArray(recipients) ? recipients.map(of) : of(recipients);
111
- }
112
- /** Strings are taken as base64 already, as the binding takes them; bytes are encoded. */
113
- function base64(content) {
114
- if (typeof content === "string")
115
- return content;
116
- const bytes = content instanceof ArrayBuffer
117
- ? new Uint8Array(content)
118
- : new Uint8Array(content.buffer, content.byteOffset, content.byteLength);
119
- let binary = "";
120
- for (let i = 0; i < bytes.length; i += 0x8000) {
121
- binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
122
- }
123
- return btoa(binary);
124
- }