@every-app/sdk 0.3.0 → 0.3.1

package/README.md

@@ -524,8 +524,8 @@ For a person's own account at a provider (Google, Microsoft 365, Slack,
 GitHub, Notion and the other presets: deploying an app that lists one
 registers it on the gateway), the gateway holds the client, runs the flow
 and keeps the tokens. The
-app lists the provider's own scopes, sends people to connect inside the app,
-and calls the provider's API; it never sees a token.
+app lists the provider's own scopes, sends people to the gateway to connect
+or to allow the app, and calls the provider's API; it never sees a token.
 
 ```ts
 // everyapp.config.ts
@@ -553,8 +553,8 @@ import {
 
 const status = await integrationStatus({ env, provider: "google-workspace" });
 if (!status.connection?.ready) {
-  // A "Connect Google" button: the gateway asks Google for exactly this
-  // app's scopes and sends the person back.
+  // A "Connect Google" button: the gateway sends the person to Google,
+  // or to its own page that allows this app, and then back here.
   return redirect(
     connectUrl({ env, provider: "google-workspace", returnTo: request.url }),
   );
@@ -566,28 +566,32 @@ const sites = await google(
 ```
 
 `connectUrl({ env, provider, returnTo })` is
-`<gateway>/connect/<id>?app=<this app>&return=<returnTo>`. The connection
-belongs to that person and this app: another app that needs the same
-provider connects for its own scopes. The gateway refuses a token that
-carries more scopes than the app lists.
+`<gateway>/connect/<id>?app=<this app>&return=<returnTo>`. A person
+connects a provider once, and the connection belongs to them. The gateway
+asks the provider for every scope the organization's apps list, and
+refuses a token that carries more. Another app that needs the same
+provider sends the person to its own `connectUrl()`. There they select
+Allow on a gateway page, with no trip to the provider. An app they haven't
+allowed can't use the connection. Allowing is a yes or no: an allowed app
+can use every scope the connection holds, not only the ones it lists.
 
 `integrationFetch` reaches https URLs only, and the gateway forwards a call
 to the provider's API hosts alone (a token endpoint or any other host is
 refused, `invalid_integration_route`); it puts the person's token on the
-call. Without a connection, or when the
-connection lacks a scope the app now lists, the gateway answers 409
+call. Without a connection, before the person allowed this app, or when
+the connection lacks a scope the app now lists, the gateway answers 409
 `integration_not_connected` with `connectPath` (and `missingScopes`): send
 the person to `connectUrl()`.
 
 `integrationStatus` for an OAuth provider adds `scopes` (as the manifest
 lists them), `connectPath` (`/connect/<id>?app=<app>`, or null) and
 `connection` (`{ label, scopes, ready, missingScopes?, reconnect? }`, or
-null) for the person.
+null) for the person. `connection` is null until they allowed this app.
 
-An app may use a connection made in it at any time, including from a cron
-or a Durable Object alarm. `for: { background: true, userId }` names any
-member's connection to this app, even while serving another member's
-request: OpenSEO reads a project's Search Console with the connection of the
+An app a person allowed may use their connection at any time, including
+from a cron or a Durable Object alarm. `for: { background: true, userId }`
+names any member's connection, once that member allowed this app, even
+while serving another member's request: OpenSEO reads a project's Search Console with the connection of the
 member who picked the property, whoever is viewing. The call carries that
 member (`x-everyapp-user`), not the person being served. Only an
 organization's own app may, and only for a member who may still open the
@@ -608,9 +612,9 @@ calls to the provider's hosts as the bearer; without it calls answer the same 40
 - `for: { background: true, organizationId }`, for work no request started
   (a cron, a Workflow step, a queue): sent as `x-everyapp-org` with no
   identity.
-- `for: { background: true, userId }`, for a call to an OAuth provider on a
-  member's connection to this app: sent as `x-everyapp-user`, with no
-  identity, even while a request is being served.
+- `for: { background: true, userId }`, for a call to an OAuth provider on
+  the connection of a member who allowed this app: sent as
+  `x-everyapp-user`, with no identity, even while a request is being served.
 - Omitted: allowed only in an organization's own app, whose background
   calls are the app's, in its own organization (the same as
   `{ background: true }`). Naming another organization is refused.

package/dist/internal/capabilities.d.ts

@@ -19,9 +19,10 @@
  *  - `oauth_client`: an OAuth provider whose client the gateway holds and
  *    whose flow it runs. None is in the catalog: each is a registered row,
  *    written from a preset (./oauthPresets.ts: Google, Microsoft, Slack,
- *    GitHub and the rest) or an operator's spec. A person connects in an app,
- *    for exactly the provider scopes the app's manifest entry lists
- *    (`scopes`); the gateway keeps the tokens and puts the person's token
+ *    GitHub and the rest) or an operator's spec. A person connects once,
+ *    for the provider scopes the organization's apps list in their
+ *    manifest entries (`scopes`), and allows each app that asks to use the
+ *    connection; the gateway keeps the tokens and puts the person's token
  *    on the app's calls to the provider's `api` hosts. Each provider is a
  *    spec (./oauthSpec.ts), its differences data; ./oauthScopes.ts holds
  *    the one set of scope rules.
@@ -381,9 +382,9 @@ export interface OAuthFlow {
 }
 /**
  * An OAuth provider the Gateway holds a client for and runs the flow for
- * (docs/design/2026-11-oauth-simplify.md). A person connects in an app;
- * the connection is theirs and that app's, for exactly the scopes the
- * app's `everyapp.config.ts` lists, and the app calls the provider's
+ * (docs/design/2026-11-oauth-one-connection.md). A person connects once;
+ * the connection is theirs, for the scopes the organization's apps list
+ * in `everyapp.config.ts`, and each app they allow calls the provider's
  * `api` hosts through the Gateway, which puts the token on.
  */
 export interface OAuthClientCapability {

package/dist/internal/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/internal/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,mDAAmD;AACnD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,UAAU;AACpB,kGAAkG;AAChG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACrD,8FAA8F;GAC5F;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACrE,4CAA4C;GAC1C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAClD;;;;;;;;GAQG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAChC,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,KAAK,CAAC;AAEhF,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC1C,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,wFAAwF;IACxF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,IAAI,EAAE,SAAS,CAAC;IAChB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,IAAI,EAAE,UAAU,CAAC;IACjB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,gJAAgJ;IAChJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iHAAiH;IACjH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B,kFAAkF;IAClF,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,0DAA0D;IAC1D,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,8IAA8I;IAC9I,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,yGAAyG;IACzG,IAAI,EAAE,UAAU,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yFAAyF;IACzF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IACzC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4FAA4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;IACrD;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,0GAA0G;AAC1G,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACpD,0EAA0E;IAC1E,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,oEAAoE;IACpE,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD,qFAAqF;AACrF,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,CAAC;AAEpD,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IACjC,kDAAkD;IAClD,MAAM,EAAE,oBAAoB,CAAC;IAC7B,mEAAmE;IACnE,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,mBAAmB,CAAC;IACpC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,gFAAgF;IAChF,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,kIAAkI;IAClI,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GAClB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,wBAAwB,CAAC;AAI7B,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8PsB,CAAC;AAEhD,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,YAAY,CAAC;AAErD,KAAK,cAAc,CAAC,IAAI,SAAS,UAAU,CAAC,MAAM,CAAC,IAAI;KACpD,CAAC,IAAI,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,GAC9D,CAAC,GACD,KAAK;CACV,CAAC,YAAY,CAAC,CAAC;AAEhB,kGAAkG;AAClG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;AAE3D,6FAA6F;AAC7F,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;AAE5D,mGAAmG;AACnG,KAAK,cAAc,CAAC,CAAC,IACjB,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC,GAC1D,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAEzE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS;IAC7B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC;IAC9C,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC;CACvD,GACG,CAAC,GAAG,CAAC,GACL,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,GAErB,cAAc,CAAC,CAAC,CAAC,GACjB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,EAAE,CAAA;CAAE,GACzD,CAAC,GACD,KAAK,CAAC,GACd,KAAK,CAAC;AAEZ,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/E,6HAA6H;AAC7H,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CAU3D;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAwB5E;AAED,eAAO,MAAM,cAAc,EAAgC,YAAY,EAAE,CAAC;AAE1E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IACxC,gEAAgE;IAChE,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,2FAA2F;AAC3F,eAAO,MAAM,OAAO,EAAE,gBAGrB,CAAC;AAEF,gHAAgH;AAChH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,gBAAgB,GAAG,oBAAoB,EACnD,QAAQ,EAAE,kBAAkB,GAC3B,aAAa,GAAG,IAAI,CAQtB;AAED,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,iHAAiH;AACjH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,kBAAkB,GAC3B,aAAa,GAAG,IAAI,CA+BtB;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAqB9D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,MAAM,EAAE,CAKV;AAED,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,kBAAkB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,QAAQ,EAAE,GAAG,GACZ,MAAM,CAER;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,mBAAmB,EACvB,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,gDAAgD;AAChD,MAAM,MAAM,qBAAqB;AAC/B,6EAA6E;AAC3E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAA;CAAE;AAC9E,+FAA+F;GAC7F;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,qBAAqB,CAAC;IAClC,QAAQ,EAAE,GAAG,CAAC;CACf;AACH,iEAAiE;GAC/D;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,mBAAmB,CAAC;IACxB,UAAU,EAAE,wBAAwB,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEN,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,MAAM,GAAE,gBAA0B,GACjC,qBAAqB,GAAG,IAAI,CAiC9B;AAWD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAER;AAaD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAqBT;AA6BD,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/C"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/internal/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,mDAAmD;AACnD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,UAAU;AACpB,kGAAkG;AAChG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACrD,8FAA8F;GAC5F;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACrE,4CAA4C;GAC1C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAClD;;;;;;;;GAQG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAChC,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,KAAK,CAAC;AAEhF,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC1C,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,wFAAwF;IACxF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,IAAI,EAAE,SAAS,CAAC;IAChB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,IAAI,EAAE,UAAU,CAAC;IACjB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,gJAAgJ;IAChJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iHAAiH;IACjH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B,kFAAkF;IAClF,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,0DAA0D;IAC1D,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,8IAA8I;IAC9I,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,yGAAyG;IACzG,IAAI,EAAE,UAAU,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yFAAyF;IACzF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IACzC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4FAA4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;IACrD;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,0GAA0G;AAC1G,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACpD,0EAA0E;IAC1E,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,oEAAoE;IACpE,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD,qFAAqF;AACrF,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,CAAC;AAEpD,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IACjC,kDAAkD;IAClD,MAAM,EAAE,oBAAoB,CAAC;IAC7B,mEAAmE;IACnE,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,mBAAmB,CAAC;IACpC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,gFAAgF;IAChF,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,kIAAkI;IAClI,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GAClB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,wBAAwB,CAAC;AAI7B,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8PsB,CAAC;AAEhD,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,YAAY,CAAC;AAErD,KAAK,cAAc,CAAC,IAAI,SAAS,UAAU,CAAC,MAAM,CAAC,IAAI;KACpD,CAAC,IAAI,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,GAC9D,CAAC,GACD,KAAK;CACV,CAAC,YAAY,CAAC,CAAC;AAEhB,kGAAkG;AAClG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;AAE3D,6FAA6F;AAC7F,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;AAE5D,mGAAmG;AACnG,KAAK,cAAc,CAAC,CAAC,IACjB,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC,GAC1D,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAEzE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS;IAC7B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC;IAC9C,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC;CACvD,GACG,CAAC,GAAG,CAAC,GACL,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,GAErB,cAAc,CAAC,CAAC,CAAC,GACjB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,EAAE,CAAA;CAAE,GACzD,CAAC,GACD,KAAK,CAAC,GACd,KAAK,CAAC;AAEZ,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/E,6HAA6H;AAC7H,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CAU3D;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAwB5E;AAED,eAAO,MAAM,cAAc,EAAgC,YAAY,EAAE,CAAC;AAE1E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IACxC,gEAAgE;IAChE,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,2FAA2F;AAC3F,eAAO,MAAM,OAAO,EAAE,gBAGrB,CAAC;AAEF,gHAAgH;AAChH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,gBAAgB,GAAG,oBAAoB,EACnD,QAAQ,EAAE,kBAAkB,GAC3B,aAAa,GAAG,IAAI,CAQtB;AAED,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,iHAAiH;AACjH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,kBAAkB,GAC3B,aAAa,GAAG,IAAI,CA+BtB;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAqB9D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,MAAM,EAAE,CAKV;AAED,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,kBAAkB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,QAAQ,EAAE,GAAG,GACZ,MAAM,CAER;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,mBAAmB,EACvB,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,gDAAgD;AAChD,MAAM,MAAM,qBAAqB;AAC/B,6EAA6E;AAC3E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAA;CAAE;AAC9E,+FAA+F;GAC7F;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,qBAAqB,CAAC;IAClC,QAAQ,EAAE,GAAG,CAAC;CACf;AACH,iEAAiE;GAC/D;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,mBAAmB,CAAC;IACxB,UAAU,EAAE,wBAAwB,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEN,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,MAAM,GAAE,gBAA0B,GACjC,qBAAqB,GAAG,IAAI,CAiC9B;AAWD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAER;AAaD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAqBT;AA6BD,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/dist/internal/capabilities.js

@@ -19,9 +19,10 @@
  *  - `oauth_client`: an OAuth provider whose client the gateway holds and
  *    whose flow it runs. None is in the catalog: each is a registered row,
  *    written from a preset (./oauthPresets.ts: Google, Microsoft, Slack,
- *    GitHub and the rest) or an operator's spec. A person connects in an app,
- *    for exactly the provider scopes the app's manifest entry lists
- *    (`scopes`); the gateway keeps the tokens and puts the person's token
+ *    GitHub and the rest) or an operator's spec. A person connects once,
+ *    for the provider scopes the organization's apps list in their
+ *    manifest entries (`scopes`), and allows each app that asks to use the
+ *    connection; the gateway keeps the tokens and puts the person's token
  *    on the app's calls to the provider's `api` hosts. Each provider is a
  *    spec (./oauthSpec.ts), its differences data; ./oauthScopes.ts holds
  *    the one set of scope rules.

package/dist/internal/events.js

@@ -67,8 +67,8 @@ export const EVENT_TYPES = [
     entry("provider", "provider.added", "A provider was registered"),
     entry("provider", "provider.removed", "A provider was removed"),
     entry("provider", "provider.updated", "A provider's spec or OAuth client was replaced"),
-    entry("provider", "provider.connected", "Someone connected an account at an OAuth provider in an app"),
-    entry("provider", "provider.disconnected", "An OAuth provider account was disconnected"),
+    entry("provider", "provider.connected", "Someone connected an account at an OAuth provider, from inside an app"),
+    entry("provider", "provider.disconnected", "An OAuth provider account was disconnected: every app stops using it"),
     entry("provider", "provider.connection_expired", "An OAuth provider refused to refresh a connection; it needs reconnecting"),
     entry("subscription", "subscription.created", "An event subscription was added"),
     entry("subscription", "subscription.updated", "An event subscription was changed, paused or resumed"),

package/dist/internal/oauthClient.d.ts

@@ -18,4 +18,36 @@ export interface OAuthClientCredentials {
  * it needs is set: the id, and the secret unless it is a public client.
  */
 export declare function oauthClientCredentials(capability: OAuthClientCapability, settings: CapabilitySettings): OAuthClientCredentials | null;
+/** Where the client the gateway uses for an OAuth provider comes from. */
+export declare enum OAuthClientSource {
+    /** The Worker's settings, set from the terminal (`everyapp secret set`, `provider add`). */
+    Env = "env",
+    /** Pasted under Manage workspace → Providers: the gateway's sealed D1 row. */
+    Pasted = "d1"
+}
+/** What the gateway or the CLI knows of a pasted client, never its value. */
+export interface PastedOAuthClient {
+    /** The provider binding it was pasted for (`providerBindingKey`), or null for none recorded. */
+    boundTo: string | null;
+    hasSecret: boolean;
+    /** Whether its sealed copy opens with the gateway's secret; the CLI, which can't open it, says true. */
+    opens: boolean;
+}
+/**
+ * Which client the gateway uses for an OAuth provider, or null when it has
+ * none it may use (docs/design/2026-10-oauth-providers.md section 6): the
+ * Worker settings' while the registry may read them (`envBound`: a
+ * registered row bound to its hosts), else the pasted one while it was
+ * pasted for the provider as it is now, opens, and has its secret. One rule
+ * for every surface that asks: the gateway's client lookup, whether an app
+ * needs setup (the gate that opens it, the app lists) and the CLI's
+ * `status` and `deploy`.
+ */
+export declare function oauthClientSource(input: {
+    capability: OAuthClientCapability;
+    /** Every setting the Worker's client needs is set (`oauthClientCredentials`). */
+    envSet: boolean;
+    envBound: boolean;
+    pasted: PastedOAuthClient | null;
+}): OAuthClientSource | null;
 //# sourceMappingURL=oauthClient.d.ts.map

package/dist/internal/oauthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthClient.d.ts","sourceRoot":"","sources":["../../src/internal/oauthClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,kBAAkB,GAC3B,sBAAsB,GAAG,IAAI,CAQ/B"}
+{"version":3,"file":"oauthClient.d.ts","sourceRoot":"","sources":["../../src/internal/oauthClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAG3B,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,kBAAkB,GAC3B,sBAAsB,GAAG,IAAI,CAQ/B;AAED,0EAA0E;AAC1E,oBAAY,iBAAiB;IAC3B,4FAA4F;IAC5F,GAAG,QAAQ;IACX,8EAA8E;IAC9E,MAAM,OAAO;CACd;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,wGAAwG;IACxG,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,EAAE,qBAAqB,CAAC;IAClC,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAClC,GAAG,iBAAiB,GAAG,IAAI,CAO3B"}

package/dist/internal/oauthClient.js

@@ -1,3 +1,4 @@
+import { providerBindingKey } from "./providerRegistry.js";
 /** The largest token answer the gateway reads: real ones are a few kilobytes. */
 export const OAUTH_TOKEN_BODY_LIMIT = 64 * 1024;
 /**
@@ -14,6 +15,36 @@ export function oauthClientCredentials(capability, settings) {
         return null;
     return { clientId, ...(clientSecret ? { clientSecret } : {}) };
 }
+/** Where the client the gateway uses for an OAuth provider comes from. */
+export var OAuthClientSource;
+(function (OAuthClientSource) {
+    /** The Worker's settings, set from the terminal (`everyapp secret set`, `provider add`). */
+    OAuthClientSource["Env"] = "env";
+    /** Pasted under Manage workspace → Providers: the gateway's sealed D1 row. */
+    OAuthClientSource["Pasted"] = "d1";
+})(OAuthClientSource || (OAuthClientSource = {}));
+/**
+ * Which client the gateway uses for an OAuth provider, or null when it has
+ * none it may use (docs/design/2026-10-oauth-providers.md section 6): the
+ * Worker settings' while the registry may read them (`envBound`: a
+ * registered row bound to its hosts), else the pasted one while it was
+ * pasted for the provider as it is now, opens, and has its secret. One rule
+ * for every surface that asks: the gateway's client lookup, whether an app
+ * needs setup (the gate that opens it, the app lists) and the CLI's
+ * `status` and `deploy`.
+ */
+export function oauthClientSource(input) {
+    if (input.envSet)
+        return input.envBound ? OAuthClientSource.Env : null;
+    const pasted = input.pasted;
+    if (!pasted || !pasted.opens)
+        return null;
+    if (pasted.boundTo !== providerBindingKey(input.capability))
+        return null;
+    if (input.capability.secrets.clientSecret && !pasted.hasSecret)
+        return null;
+    return OAuthClientSource.Pasted;
+}
 function settingValue(value) {
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }

package/dist/server/attribution.d.ts

@@ -13,9 +13,10 @@
  *    leave it out (the gateway knows its organization) and may only name
  *    its own.
  *  - `{ background: true, organizationId, userId }`: a call to an OAuth
- *    provider's API (`integrationFetch`) on the connection member `userId`
- *    made in this app, at any time, even while serving another person's
- *    request: the call carries that member (`x-everyapp-user`) and never
+ *    provider's API (`integrationFetch`) on member `userId`'s connection,
+ *    which they allowed this app to use, at any time, even while serving
+ *    another person's request: the call carries that member
+ *    (`x-everyapp-user`) and never
  *    the identity of the person being served. Only an organization's own
  *    app may name a member, and only one who may still open the app. No
  *    identity for the member reaches the app. Other gateway calls ignore

package/dist/server/attribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,cAAc,GACtB,OAAO,GACP;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,0BAA0B;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,GACX,cAAc,GAAG,SAAS,CAI5B;AAmCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,GAAG,SAAS,GACjC,IAAI,CAYN;AASD,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAO1D"}
+{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,cAAc,GACtB,OAAO,GACP;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,0BAA0B;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,GACX,cAAc,GAAG,SAAS,CAI5B;AAmCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,GAAG,SAAS,GACjC,IAAI,CAYN;AASD,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAO1D"}

package/dist/server/connectUrl.d.ts

@@ -5,12 +5,12 @@ export interface ConnectUrlOptions {
     provider: string;
     /**
      * Where to send the person afterwards: the app's own URL (absolute) or
-     * a path on the Gateway. Absent: Settings → Connected accounts.
+     * a path on the Gateway. Absent: Your connections → Accounts.
      */
     returnTo?: string;
 }
 /** The path of the connect page for `provider` on the Gateway, without the app. */
 export declare function connectPath(provider: string): string;
-/** The absolute URL that connects the person to `provider` in this app. */
+/** The absolute URL where the person connects `provider`, or allows this app to use their connection to it. */
 export declare function connectUrl({ env, provider, returnTo, }: ConnectUrlOptions): string;
 //# sourceMappingURL=connectUrl.d.ts.map

package/dist/server/connectUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connectUrl.d.ts","sourceRoot":"","sources":["../../src/server/connectUrl.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,iBAAiB;IAChC,0GAA0G;IAC1G,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,EACzB,GAAG,EACH,QAAQ,EACR,QAAQ,GACT,EAAE,iBAAiB,GAAG,MAAM,CAwB5B"}
+{"version":3,"file":"connectUrl.d.ts","sourceRoot":"","sources":["../../src/server/connectUrl.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,iBAAiB;IAChC,0GAA0G;IAC1G,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,EACzB,GAAG,EACH,QAAQ,EACR,QAAQ,GACT,EAAE,iBAAiB,GAAG,MAAM,CAwB5B"}

package/dist/server/connectUrl.js

@@ -1,20 +1,25 @@
 /**
  * Where an app sends a person to connect an OAuth provider the Gateway
- * runs the flow for (docs/design/2026-11-oauth-simplify.md):
+ * runs the flow for, or to allow this app to use the connection they
+ * already have (docs/design/2026-11-oauth-one-connection.md):
  * `<gateway>/connect/<id>?app=<this app>&return=<back here>`. A
- * connection belongs to one person and one app: the Gateway checks the
- * session and that the person may open the app, asks the provider for
- * exactly the scopes the app's `everyapp.config.ts` lists (plus the ones
- * that name the account), finishes on its own callback and sends the
- * browser back to `returnTo`, which must be a path on the Gateway or an
- * https URL on one of its app hosts (in local dev also localhost).
+ * connection belongs to one person, and each app they allow uses it. The
+ * Gateway checks the session and that the person may open the app. With
+ * no connection, or one that lacks a scope the app's
+ * `everyapp.config.ts` lists, it asks the provider for every scope the
+ * organization's apps list (plus the ones that name the account),
+ * finishes on its own callback and allows this app. With a connection
+ * that holds what the app lists, it shows its own Allow page and asks no
+ * provider. Either way it sends the browser back to `returnTo`, which
+ * must be a path on the Gateway or an https URL on one of its app hosts
+ * (in local dev also localhost).
  */
 import { APP_ID_ENV, ConfigurationError } from "../internal/index.js";
 /** The path of the connect page for `provider` on the Gateway, without the app. */
 export function connectPath(provider) {
     return `/connect/${encodeURIComponent(provider)}`;
 }
-/** The absolute URL that connects the person to `provider` in this app. */
+/** The absolute URL where the person connects `provider`, or allows this app to use their connection to it. */
 export function connectUrl({ env, provider, returnTo, }) {
     const values = env;
     const gateway = values["GATEWAY_URL"];
@@ -30,7 +35,7 @@ export function connectUrl({ env, provider, returnTo, }) {
     }
     const app = values[APP_ID_ENV];
     if (typeof app !== "string" || !app.trim()) {
-        throw new ConfigurationError(`connectUrl() needs ${APP_ID_ENV} in the Worker env: a connection belongs to one app, and the deploy and everyapp dev set it.`);
+        throw new ConfigurationError(`connectUrl() needs ${APP_ID_ENV} in the Worker env: the link names the app that asks, and the deploy and everyapp dev set it.`);
     }
     const url = new URL(connectPath(provider), base.origin);
     url.searchParams.set("app", app.trim());

package/dist/server/integrationFetch.d.ts

@@ -27,11 +27,12 @@ export interface IntegrationFetchOptions {
      * queues). A shared app's Worker must end up with one or the other
      * ({@link AttributionError}).
      *
-     * For an OAuth provider the call uses the connection the person behind
-     * it made in this app. `{ background: true, userId }` names another
-     * member's connection to this app instead, at any time, even while
-     * serving a different person: the call then carries that member and
-     * not the person being served. Only an organization's own app may.
+     * For an OAuth provider the call uses the connection of the person
+     * behind it, which they allowed this app to use. `{ background: true,
+     * userId }` names another member's connection instead (one who allowed
+     * this app), at any time, even while serving a different person: the
+     * call then carries that member and not the person being served. Only
+     * an organization's own app may.
      */
     for?: GatewayCallFor;
     /**
@@ -54,10 +55,11 @@ export interface IntegrationFetchOptions {
  * {@link gatewayRefusal} recognizes; anything else is the provider's answer.
  *
  * For an OAuth provider (`google-workspace`, `github`, ...) the gateway
- * puts the token of the person's connection in this app on the call, to
- * the provider's API hosts only. Without one the answer is a 409
- * `integration_not_connected` refusal with the `connectPath` to send the
- * person to ({@link connectUrl}).
+ * puts the token of the person's connection on the call, to the
+ * provider's API hosts only, once the person allowed this app to use it.
+ * Without a connection, or before they allowed this app, the answer is a
+ * 409 `integration_not_connected` refusal with the `connectPath` to send
+ * the person to ({@link connectUrl}).
  *
  * In local dev only, with no binding, the developer's own key from
  * `.dev.vars` reaches the provider directly, under the gateway's names:
@@ -95,26 +97,30 @@ export interface IntegrationStatus extends SetupInfo {
 export type EmailIntegrationStatus = IntegrationStatus & Pick<EmailCapabilityStatus, "sender" | "senders" | "provider">;
 /**
  * An OAuth provider's status: as {@link IntegrationStatus}, plus the
- * scopes the app's manifest lists, where the person connects in this app,
- * and their connection to this app. `configured` means the gateway holds
- * the client; `ready` that a call for this person would go through.
+ * scopes the app's manifest lists, where the person connects or allows
+ * this app, and their connection once they allowed this app to use it.
+ * `configured` means the gateway holds the client; `ready` that a call
+ * for this person would go through.
  */
 export type OAuthClientIntegrationStatus = IntegrationStatus & {
     /** The provider's scopes as the app's `everyapp.config.ts` lists them. */
     scopes: readonly string[];
     /**
-     * Where the person connects the provider in this app:
-     * `/connect/<id>?app=<app>` on the Gateway ({@link connectUrl} builds
-     * the absolute URL); null when the app can't connect (the manifest
-     * doesn't list it, or the gateway holds no client).
+     * Where the person connects the provider, or allows this app to use
+     * their connection to it: `/connect/<id>?app=<app>` on the Gateway
+     * ({@link connectUrl} builds the absolute URL); null when the app can't
+     * connect (the manifest doesn't list it, or the gateway holds no
+     * client).
      */
     connectPath: string | null;
     /**
-     * The connection the call would use (the person's in this app, or the
-     * member's `for: { background: true, userId }` names), or null when there
-     * is none. `ready` false with `missingScopes` when it lacks a scope the
-     * app now lists, and `reconnect` when the person has to connect again
-     * (missing scopes, or it expired).
+     * The connection the call would use (the person's, or the member's
+     * `for: { background: true, userId }` names), or null when there is
+     * none or they haven't allowed this app to use it. `ready` false with
+     * `missingScopes` when it lacks a scope the app now lists, or the app
+     * lists one the person hasn't allowed it, and `reconnect` when the
+     * person has to go through `connectPath` again (missing scopes, or it
+     * expired).
      */
     connection: {
         /** The account's name at the provider (an email address, a login). */
@@ -132,18 +138,18 @@ export type IntegrationStatusOf<P extends string> = P extends "email" ? EmailInt
  * Whether the app can use an integration right now, without calling the
  * provider: show "an admin needs to set up DataForSEO" (or "sending isn't
  * set up", or "connect Google") up front instead of failing mid-task. An
- * OAuth provider's status carries the person's connection in this app and
- * where to connect.
+ * OAuth provider's status carries the person's connection, once they
+ * allowed this app to use it, and where to connect or allow.
  */
 export declare function integrationStatus<P extends CapabilityId | (string & {})>({ env, provider, for: explicitTarget, }: {
     env: object;
     provider: P;
     /**
      * Whom the status is for: the request being served (its person), so an
-     * OAuth provider's `connection` is that person's in this app; `{
-     * background: true, userId }` that member's. Explicitly the inbound
-     * request or `{ background: true, organizationId, userId? }`, as on
-     * every call.
+     * OAuth provider's `connection` is that person's, once they allowed
+     * this app; `{ background: true, userId }` that member's. Explicitly
+     * the inbound request or `{ background: true, organizationId, userId?
+     * }`, as on every call.
      */
     for?: GatewayCallFor;
 }): Promise<IntegrationStatusOf<P>>;

package/dist/server/integrationFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrationFetch.d.ts","sourceRoot":"","sources":["../../src/server/integrationFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAE1B,KAAK,aAAa,EAKnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,EAAE,kBAAkB,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7D;;;;;;;;;;;;;;OAcG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACpD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,KAAK,CAAC;AAgHhB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAsLD,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GACpD,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GAAG,iBAAiB,GAAG;IAC7D,0EAA0E;IAC1E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,UAAU,EAAE;QACV,sEAAsE;QACtE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,sCAAsC;QACtC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,mGAAmG;AACnG,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,GACjE,sBAAsB,GACtB,CAAC,SAAS,aAAa,GACrB,4BAA4B,GAC5B,iBAAiB,CAAC;AAExB;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,EACA,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAWlC"}
+{"version":3,"file":"integrationFetch.d.ts","sourceRoot":"","sources":["../../src/server/integrationFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAE1B,KAAK,aAAa,EAKnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,EAAE,kBAAkB,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7D;;;;;;;;;;;;;;;OAeG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACpD,OAAO,KAAK,GAAG,IAAI,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,KAAK,CAAC;AAgHhB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAuLD,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GACpD,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,iBAAiB,GAAG;IAC7D,0EAA0E;IAC1E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;;OAQG;IACH,UAAU,EAAE;QACV,sEAAsE;QACtE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,sCAAsC;QACtC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,mGAAmG;AACnG,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,GACjE,sBAAsB,GACtB,CAAC,SAAS,aAAa,GACrB,4BAA4B,GAC5B,iBAAiB,CAAC;AAExB;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,EACtC,EACA,GAAG,EACH,QAAQ,EACR,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAWlC"}

package/dist/server/integrationFetch.js

@@ -90,9 +90,10 @@ export function devAccessTokenName(provider) {
     return `${providerSettingPrefix(provider)}ACCESS_TOKEN`;
 }
 /**
- * Where a person connects `provider` in this app:
- * `/connect/<id>?app=<EVERYAPP_APP_ID>`, as the gateway's refusal and
- * status name it (without the app id when the env has none).
+ * Where a person connects `provider`, or allows this app to use their
+ * connection to it: `/connect/<id>?app=<EVERYAPP_APP_ID>`, as the
+ * gateway's refusal and status name it (without the app id when the env
+ * has none).
  */
 function appConnectPath(provider, values) {
     const app = stringValue(values[APP_ID_ENV]);
@@ -217,8 +218,8 @@ function stringValue(value) {
  * Whether the app can use an integration right now, without calling the
  * provider: show "an admin needs to set up DataForSEO" (or "sending isn't
  * set up", or "connect Google") up front instead of failing mid-task. An
- * OAuth provider's status carries the person's connection in this app and
- * where to connect.
+ * OAuth provider's status carries the person's connection, once they
+ * allowed this app to use it, and where to connect or allow.
  */
 export async function integrationStatus({ env, provider, for: explicitTarget, }) {
     const status = await readIntegrationStatus({
@@ -316,9 +317,9 @@ async function readIntegrationStatus({ env, provider, for: explicitTarget, }) {
             response = await binding.fetch(statusUrl);
         }
         else {
-            // Whose status: the person's identity (their connection in this
-            // app), the member background work names, or the organization's,
-            // as a call would carry it.
+            // Whose status: the person's identity (their connection, which
+            // they allowed this app), the member background work names, or the
+            // organization's, as a call would carry it.
             const headers = new Headers();
             applyAttribution(headers, target);
             response = await binding.fetch(statusUrl, { headers });

package/dist/server/tools.d.ts

@@ -30,7 +30,7 @@ import type { ExecutionContextLike } from "./everyApp.js";
  * Reported with every catalog; must match package.json (a test checks).
  * `pnpm release <version>` (scripts/release.mjs) sets both in one commit.
  */
-export declare const SDK_VERSION = "0.3.0";
+export declare const SDK_VERSION = "0.3.1";
 /**
  * Throw from a tool handler to return an error the model can read and act on
  * ("No todo with that id"). Any other error is logged here and reaches the

package/dist/server/tools.js

@@ -29,7 +29,7 @@ import { TOOL_NAME_PATTERN, catalogHash, isToolRisk, } from "../internal/index.j
  * Reported with every catalog; must match package.json (a test checks).
  * `pnpm release <version>` (scripts/release.mjs) sets both in one commit.
  */
-export const SDK_VERSION = "0.3.0";
+export const SDK_VERSION = "0.3.1";
 const JSON_SCHEMA_TARGET = "draft-2020-12";
 const DRAFT_2020_12 = "https://json-schema.org/draft/2020-12/schema";
 // The 2026-07-28 MCP revision lets a schema property ask clients to mirror an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@every-app/sdk",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "license": "MIT",
   "repository": {
     "type": "git",