@every-app/sdk 0.2.0 → 0.3.0-rc.10

package/dist/cloudflare/catalogSettings.generated.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The Gateway settings holding the keys of the AI providers and
+ * capabilities an app may ask for, with the settings a provider needs
+ * besides its key (Workers AI's account, a Basic username held as a
+ * setting, a host setting), by manifest id. With no Gateway in
+ * development, the SDK reaches them with the developer's own values under
+ * the same names, and `everyAppWorker()` declares the ones set locally.
+ */
+export declare const DEV_GATEWAY_KEYS: {
+    readonly providers: {
+        readonly openai: readonly ["OPENAI_API_KEY"];
+        readonly openrouter: readonly ["OPENROUTER_API_KEY"];
+        readonly "workers-ai": readonly ["WORKERS_AI_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID"];
+        readonly anthropic: readonly ["ANTHROPIC_API_KEY"];
+        readonly gemini: readonly ["GEMINI_API_KEY"];
+        readonly mistral: readonly ["MISTRAL_API_KEY"];
+        readonly groq: readonly ["GROQ_API_KEY"];
+        readonly cohere: readonly ["COHERE_API_KEY"];
+    };
+    readonly capabilities: {
+        readonly dataforseo: readonly ["DATAFORSEO_API_KEY"];
+        readonly context: readonly ["CONTEXT_API_KEY"];
+        readonly email: readonly ["EMAIL_FROM", "EMAIL_FROM_NAME", "EMAIL_REST_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID", "RESEND_API_KEY", "EMAIL_PROVIDER"];
+        readonly members: readonly [];
+        readonly slack: readonly ["SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET"];
+        readonly "google-workspace": readonly ["GOOGLE_WORKSPACE_CLIENT_ID", "GOOGLE_WORKSPACE_CLIENT_SECRET"];
+        readonly "microsoft-365": readonly ["MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET"];
+        readonly stripe: readonly ["STRIPE_API_KEY"];
+        readonly lemonsqueezy: readonly ["LEMONSQUEEZY_API_KEY"];
+        readonly paddle: readonly ["PADDLE_API_KEY"];
+        readonly shopify: readonly ["SHOPIFY_API_TOKEN", "SHOPIFY_HOST"];
+        readonly plaid: readonly ["PLAID_SECRET"];
+        readonly attio: readonly ["ATTIO_API_KEY"];
+        readonly hubspot: readonly ["HUBSPOT_API_TOKEN"];
+        readonly pipedrive: readonly ["PIPEDRIVE_API_TOKEN"];
+        readonly airtable: readonly ["AIRTABLE_API_TOKEN"];
+        readonly notion: readonly ["NOTION_API_TOKEN"];
+        readonly postmark: readonly ["POSTMARK_API_TOKEN"];
+        readonly sendgrid: readonly ["SENDGRID_API_KEY"];
+        readonly twilio: readonly ["TWILIO_API_SECRET", "TWILIO_API_KEY"];
+        readonly intercom: readonly ["INTERCOM_API_TOKEN"];
+        readonly crisp: readonly ["CRISP_API_KEY", "CRISP_API_IDENTIFIER"];
+        readonly granola: readonly ["GRANOLA_API_KEY"];
+        readonly linear: readonly ["LINEAR_API_KEY"];
+        readonly github: readonly ["GITHUB_API_TOKEN"];
+        readonly gitlab: readonly ["GITLAB_API_TOKEN"];
+        readonly vercel: readonly ["VERCEL_API_TOKEN"];
+        readonly cloudflare: readonly ["CLOUDFLARE_PROVIDER_API_TOKEN"];
+        readonly posthog: readonly ["POSTHOG_PERSONAL_API_KEY"];
+        readonly mixpanel: readonly ["MIXPANEL_SERVICE_ACCOUNT_SECRET", "MIXPANEL_SERVICE_ACCOUNT_USERNAME"];
+        readonly segment: readonly ["SEGMENT_WRITE_KEY"];
+        readonly supabase: readonly ["SUPABASE_SECRET_KEY", "SUPABASE_HOST"];
+        readonly turso: readonly ["TURSO_API_TOKEN"];
+        readonly "turso-db": readonly ["TURSO_DB_AUTH_TOKEN", "TURSO_DB_HOST"];
+        readonly neon: readonly ["NEON_API_KEY"];
+        readonly pinecone: readonly ["PINECONE_API_KEY", "PINECONE_HOST"];
+        readonly mapbox: readonly ["MAPBOX_ACCESS_TOKEN"];
+        readonly openweather: readonly ["OPENWEATHER_API_KEY"];
+        readonly voyage: readonly ["VOYAGE_API_KEY"];
+        readonly perplexity: readonly ["PERPLEXITY_API_KEY"];
+        readonly jina: readonly ["JINA_API_KEY"];
+        readonly replicate: readonly ["REPLICATE_API_TOKEN"];
+        readonly huggingface: readonly ["HUGGINGFACE_API_TOKEN"];
+        readonly firecrawl: readonly ["FIRECRAWL_API_KEY"];
+        readonly exa: readonly ["EXA_API_KEY"];
+        readonly tavily: readonly ["TAVILY_API_KEY"];
+        readonly serper: readonly ["SERPER_API_KEY"];
+        readonly "brave-search": readonly ["BRAVE_SEARCH_API_KEY"];
+        readonly apify: readonly ["APIFY_API_TOKEN"];
+        readonly deepgram: readonly ["DEEPGRAM_API_KEY"];
+        readonly elevenlabs: readonly ["ELEVENLABS_API_KEY"];
+        readonly assemblyai: readonly ["ASSEMBLYAI_API_KEY"];
+        readonly newsapi: readonly ["NEWSAPI_API_KEY"];
+    };
+};
+/**
+ * Every setting a catalog entry reads, in catalog order, each once: what
+ * the Gateway's cloudflare.config.ts declares for local dev.
+ */
+export declare const CATALOG_GATEWAY_SETTINGS: readonly ["OPENAI_API_KEY", "OPENROUTER_API_KEY", "WORKERS_AI_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID", "AI_GATEWAY_API_KEY", "AI_GATEWAY_ID", "DATAFORSEO_API_KEY", "CONTEXT_API_KEY", "EMAIL_FROM", "EMAIL_FROM_NAME", "EMAIL_REST_API_TOKEN", "RESEND_API_KEY", "EMAIL_PROVIDER", "SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET", "GOOGLE_WORKSPACE_CLIENT_ID", "GOOGLE_WORKSPACE_CLIENT_SECRET", "MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET", "STRIPE_API_KEY", "LEMONSQUEEZY_API_KEY", "PADDLE_API_KEY", "SHOPIFY_API_TOKEN", "SHOPIFY_HOST", "PLAID_SECRET", "ATTIO_API_KEY", "HUBSPOT_API_TOKEN", "PIPEDRIVE_API_TOKEN", "AIRTABLE_API_TOKEN", "NOTION_API_TOKEN", "POSTMARK_API_TOKEN", "SENDGRID_API_KEY", "TWILIO_API_SECRET", "TWILIO_API_KEY", "INTERCOM_API_TOKEN", "CRISP_API_KEY", "CRISP_API_IDENTIFIER", "GRANOLA_API_KEY", "LINEAR_API_KEY", "GITHUB_API_TOKEN", "GITLAB_API_TOKEN", "VERCEL_API_TOKEN", "CLOUDFLARE_PROVIDER_API_TOKEN", "POSTHOG_PERSONAL_API_KEY", "MIXPANEL_SERVICE_ACCOUNT_SECRET", "MIXPANEL_SERVICE_ACCOUNT_USERNAME", "SEGMENT_WRITE_KEY", "SUPABASE_SECRET_KEY", "SUPABASE_HOST", "TURSO_API_TOKEN", "TURSO_DB_AUTH_TOKEN", "TURSO_DB_HOST", "NEON_API_KEY", "PINECONE_API_KEY", "PINECONE_HOST", "MAPBOX_ACCESS_TOKEN", "OPENWEATHER_API_KEY", "ANTHROPIC_API_KEY", "GEMINI_API_KEY", "MISTRAL_API_KEY", "GROQ_API_KEY", "COHERE_API_KEY", "VOYAGE_API_KEY", "PERPLEXITY_API_KEY", "JINA_API_KEY", "REPLICATE_API_TOKEN", "HUGGINGFACE_API_TOKEN", "FIRECRAWL_API_KEY", "EXA_API_KEY", "TAVILY_API_KEY", "SERPER_API_KEY", "BRAVE_SEARCH_API_KEY", "APIFY_API_TOKEN", "DEEPGRAM_API_KEY", "ELEVENLABS_API_KEY", "ASSEMBLYAI_API_KEY", "NEWSAPI_API_KEY"];
+//# sourceMappingURL=catalogSettings.generated.d.ts.map

package/dist/cloudflare/catalogSettings.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogSettings.generated.d.ts","sourceRoot":"","sources":["../../src/cloudflare/catalogSettings.generated.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+EnB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,wBAAwB,wmDA8E3B,CAAC"}

package/dist/cloudflare/catalogSettings.generated.js

@@ -0,0 +1,174 @@
+// Generated from packages/sdk/src/internal/capabilities.ts by
+// src/cloudflare/catalogSettings.test.ts. Do not edit: change the catalog
+// and run `pnpm -C packages/sdk catalog:update`.
+/**
+ * The Gateway settings holding the keys of the AI providers and
+ * capabilities an app may ask for, with the settings a provider needs
+ * besides its key (Workers AI's account, a Basic username held as a
+ * setting, a host setting), by manifest id. With no Gateway in
+ * development, the SDK reaches them with the developer's own values under
+ * the same names, and `everyAppWorker()` declares the ones set locally.
+ */
+export const DEV_GATEWAY_KEYS = {
+    providers: {
+        openai: ["OPENAI_API_KEY"],
+        openrouter: ["OPENROUTER_API_KEY"],
+        "workers-ai": ["WORKERS_AI_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID"],
+        anthropic: ["ANTHROPIC_API_KEY"],
+        gemini: ["GEMINI_API_KEY"],
+        mistral: ["MISTRAL_API_KEY"],
+        groq: ["GROQ_API_KEY"],
+        cohere: ["COHERE_API_KEY"],
+    },
+    capabilities: {
+        dataforseo: ["DATAFORSEO_API_KEY"],
+        context: ["CONTEXT_API_KEY"],
+        email: [
+            "EMAIL_FROM",
+            "EMAIL_FROM_NAME",
+            "EMAIL_REST_API_TOKEN",
+            "CLOUDFLARE_ACCOUNT_ID",
+            "RESEND_API_KEY",
+            "EMAIL_PROVIDER",
+        ],
+        members: [],
+        slack: ["SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET"],
+        "google-workspace": [
+            "GOOGLE_WORKSPACE_CLIENT_ID",
+            "GOOGLE_WORKSPACE_CLIENT_SECRET",
+        ],
+        "microsoft-365": ["MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET"],
+        stripe: ["STRIPE_API_KEY"],
+        lemonsqueezy: ["LEMONSQUEEZY_API_KEY"],
+        paddle: ["PADDLE_API_KEY"],
+        shopify: ["SHOPIFY_API_TOKEN", "SHOPIFY_HOST"],
+        plaid: ["PLAID_SECRET"],
+        attio: ["ATTIO_API_KEY"],
+        hubspot: ["HUBSPOT_API_TOKEN"],
+        pipedrive: ["PIPEDRIVE_API_TOKEN"],
+        airtable: ["AIRTABLE_API_TOKEN"],
+        notion: ["NOTION_API_TOKEN"],
+        postmark: ["POSTMARK_API_TOKEN"],
+        sendgrid: ["SENDGRID_API_KEY"],
+        twilio: ["TWILIO_API_SECRET", "TWILIO_API_KEY"],
+        intercom: ["INTERCOM_API_TOKEN"],
+        crisp: ["CRISP_API_KEY", "CRISP_API_IDENTIFIER"],
+        granola: ["GRANOLA_API_KEY"],
+        linear: ["LINEAR_API_KEY"],
+        github: ["GITHUB_API_TOKEN"],
+        gitlab: ["GITLAB_API_TOKEN"],
+        vercel: ["VERCEL_API_TOKEN"],
+        cloudflare: ["CLOUDFLARE_PROVIDER_API_TOKEN"],
+        posthog: ["POSTHOG_PERSONAL_API_KEY"],
+        mixpanel: [
+            "MIXPANEL_SERVICE_ACCOUNT_SECRET",
+            "MIXPANEL_SERVICE_ACCOUNT_USERNAME",
+        ],
+        segment: ["SEGMENT_WRITE_KEY"],
+        supabase: ["SUPABASE_SECRET_KEY", "SUPABASE_HOST"],
+        turso: ["TURSO_API_TOKEN"],
+        "turso-db": ["TURSO_DB_AUTH_TOKEN", "TURSO_DB_HOST"],
+        neon: ["NEON_API_KEY"],
+        pinecone: ["PINECONE_API_KEY", "PINECONE_HOST"],
+        mapbox: ["MAPBOX_ACCESS_TOKEN"],
+        openweather: ["OPENWEATHER_API_KEY"],
+        voyage: ["VOYAGE_API_KEY"],
+        perplexity: ["PERPLEXITY_API_KEY"],
+        jina: ["JINA_API_KEY"],
+        replicate: ["REPLICATE_API_TOKEN"],
+        huggingface: ["HUGGINGFACE_API_TOKEN"],
+        firecrawl: ["FIRECRAWL_API_KEY"],
+        exa: ["EXA_API_KEY"],
+        tavily: ["TAVILY_API_KEY"],
+        serper: ["SERPER_API_KEY"],
+        "brave-search": ["BRAVE_SEARCH_API_KEY"],
+        apify: ["APIFY_API_TOKEN"],
+        deepgram: ["DEEPGRAM_API_KEY"],
+        elevenlabs: ["ELEVENLABS_API_KEY"],
+        assemblyai: ["ASSEMBLYAI_API_KEY"],
+        newsapi: ["NEWSAPI_API_KEY"],
+    },
+};
+/**
+ * Every setting a catalog entry reads, in catalog order, each once: what
+ * the Gateway's cloudflare.config.ts declares for local dev.
+ */
+export const CATALOG_GATEWAY_SETTINGS = [
+    "OPENAI_API_KEY",
+    "OPENROUTER_API_KEY",
+    "WORKERS_AI_API_TOKEN",
+    "CLOUDFLARE_ACCOUNT_ID",
+    "AI_GATEWAY_API_KEY",
+    "AI_GATEWAY_ID",
+    "DATAFORSEO_API_KEY",
+    "CONTEXT_API_KEY",
+    "EMAIL_FROM",
+    "EMAIL_FROM_NAME",
+    "EMAIL_REST_API_TOKEN",
+    "RESEND_API_KEY",
+    "EMAIL_PROVIDER",
+    "SLACK_CLIENT_ID",
+    "SLACK_CLIENT_SECRET",
+    "GOOGLE_WORKSPACE_CLIENT_ID",
+    "GOOGLE_WORKSPACE_CLIENT_SECRET",
+    "MICROSOFT_365_CLIENT_ID",
+    "MICROSOFT_365_CLIENT_SECRET",
+    "STRIPE_API_KEY",
+    "LEMONSQUEEZY_API_KEY",
+    "PADDLE_API_KEY",
+    "SHOPIFY_API_TOKEN",
+    "SHOPIFY_HOST",
+    "PLAID_SECRET",
+    "ATTIO_API_KEY",
+    "HUBSPOT_API_TOKEN",
+    "PIPEDRIVE_API_TOKEN",
+    "AIRTABLE_API_TOKEN",
+    "NOTION_API_TOKEN",
+    "POSTMARK_API_TOKEN",
+    "SENDGRID_API_KEY",
+    "TWILIO_API_SECRET",
+    "TWILIO_API_KEY",
+    "INTERCOM_API_TOKEN",
+    "CRISP_API_KEY",
+    "CRISP_API_IDENTIFIER",
+    "GRANOLA_API_KEY",
+    "LINEAR_API_KEY",
+    "GITHUB_API_TOKEN",
+    "GITLAB_API_TOKEN",
+    "VERCEL_API_TOKEN",
+    "CLOUDFLARE_PROVIDER_API_TOKEN",
+    "POSTHOG_PERSONAL_API_KEY",
+    "MIXPANEL_SERVICE_ACCOUNT_SECRET",
+    "MIXPANEL_SERVICE_ACCOUNT_USERNAME",
+    "SEGMENT_WRITE_KEY",
+    "SUPABASE_SECRET_KEY",
+    "SUPABASE_HOST",
+    "TURSO_API_TOKEN",
+    "TURSO_DB_AUTH_TOKEN",
+    "TURSO_DB_HOST",
+    "NEON_API_KEY",
+    "PINECONE_API_KEY",
+    "PINECONE_HOST",
+    "MAPBOX_ACCESS_TOKEN",
+    "OPENWEATHER_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "GEMINI_API_KEY",
+    "MISTRAL_API_KEY",
+    "GROQ_API_KEY",
+    "COHERE_API_KEY",
+    "VOYAGE_API_KEY",
+    "PERPLEXITY_API_KEY",
+    "JINA_API_KEY",
+    "REPLICATE_API_TOKEN",
+    "HUGGINGFACE_API_TOKEN",
+    "FIRECRAWL_API_KEY",
+    "EXA_API_KEY",
+    "TAVILY_API_KEY",
+    "SERPER_API_KEY",
+    "BRAVE_SEARCH_API_KEY",
+    "APIFY_API_TOKEN",
+    "DEEPGRAM_API_KEY",
+    "ELEVENLABS_API_KEY",
+    "ASSEMBLYAI_API_KEY",
+    "NEWSAPI_API_KEY",
+];

package/dist/cloudflare/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @every-app/sdk/cloudflare — the Worker definition for an app's
+ * `cloudflare.config.ts`:
+ *
+ *   import { defineConfig } from "cf/config";
+ *   import * as entrypoint from "./src/entry.worker.ts" with { type: "cf-worker" };
+ *   import manifest from "./everyapp.config.ts";
+ *   import { everyAppWorker } from "@every-app/sdk/cloudflare";
+ *
+ *   export default defineConfig((ctx) => ({
+ *     worker: everyAppWorker({ manifest, entrypoint, ctx }),
+ *   }));
+ *
+ * This runs in Node while cf and the Vite plugin load the config, never in the
+ * Worker. Keep it self-contained: the plugin hides every file the config
+ * imports from the Worker in dev, so sharing a module with `/server` or
+ * `/internal` would break `cf dev` wherever the SDK is linked from source.
+ * (The dev keypair it hands the dev Worker is a leaf the Worker never loads.)
+ */
+export { EVERYAPP_OBSERVABILITY, everyAppAuxiliaryWorker, everyAppWorker, helperWorkerName, localD1Id, localD1Path, workflowNameFor, type AiBinding, type AnalyticsEngineDatasetBinding, type BrowserBinding, type AiGatewayBinding, type D1Binding, type DurableObjectBinding, type DurableObjectExport, type EveryAppAuxiliaryWorkerConfig, type EveryAppAuxiliaryWorkerOptions, type EveryAppBinding, type EveryAppConfigContext, type EveryAppDeployEnv, type EveryAppDevEnv, type EveryAppExports, type EveryAppObservability, type EveryAppPlacement, type EveryAppTrigger, type EveryAppWorkerConfig, type EveryAppWorkerManifest, type EveryAppWorkerOptions, type EveryAppWorkerReference, type GatewayBinding, type HyperdriveBinding, type ImagesBinding, type JsonBinding, type KvBinding, type QueueBinding, type QueueConsumerTrigger, type SecretBinding, type SecretsStoreSecretBinding, type SendEmailBinding, type ServiceBinding, type TextBinding, type VectorizeBinding, type VersionMetadataBinding, type WorkflowBinding, type WorkflowExport, } from "./worker.js";
+export { aiGatewayUrl, BUILD_SENTINEL, resourceSentinel, sentinelDeployTarget, type AiGatewayValue, type EveryAppDeployTarget, } from "./sentinel.js";
+export { CATALOG_GATEWAY_SETTINGS } from "./catalogSettings.generated.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,eAAe,EACf,KAAK,SAAS,EACd,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/cloudflare/index.js

@@ -0,0 +1,24 @@
+/**
+ * @every-app/sdk/cloudflare — the Worker definition for an app's
+ * `cloudflare.config.ts`:
+ *
+ *   import { defineConfig } from "cf/config";
+ *   import * as entrypoint from "./src/entry.worker.ts" with { type: "cf-worker" };
+ *   import manifest from "./everyapp.config.ts";
+ *   import { everyAppWorker } from "@every-app/sdk/cloudflare";
+ *
+ *   export default defineConfig((ctx) => ({
+ *     worker: everyAppWorker({ manifest, entrypoint, ctx }),
+ *   }));
+ *
+ * This runs in Node while cf and the Vite plugin load the config, never in the
+ * Worker. Keep it self-contained: the plugin hides every file the config
+ * imports from the Worker in dev, so sharing a module with `/server` or
+ * `/internal` would break `cf dev` wherever the SDK is linked from source.
+ * (The dev keypair it hands the dev Worker is a leaf the Worker never loads.)
+ */
+export { EVERYAPP_OBSERVABILITY, everyAppAuxiliaryWorker, everyAppWorker, helperWorkerName, localD1Id, localD1Path, workflowNameFor, } from "./worker.js";
+export { aiGatewayUrl, BUILD_SENTINEL, resourceSentinel, sentinelDeployTarget, } from "./sentinel.js";
+// Every setting a provider of the built-in catalog reads, generated from
+// it: the Gateway's cloudflare.config.ts declares them for local dev.
+export { CATALOG_GATEWAY_SETTINGS } from "./catalogSettings.generated.js";

package/dist/cloudflare/sentinel.d.ts

@@ -0,0 +1,127 @@
+/**
+ * What a production build of an Every App app is made of in place of the
+ * install's own values. The build is tenant-neutral: whoever builds an
+ * app gets the same Build Output, with these placeholders wherever an
+ * install's Worker name, organization, gateway, identity key or resource
+ * ids belong. The installer rewrites them (`everyapp deploy` for an own
+ * Gateway, the hosted gateway's deployer for a hosted one) and refuses an
+ * output in which any survives.
+ *
+ * A leaf module with no imports, so the gateway Worker can read the same
+ * values (`@every-app/sdk/cloudflare/sentinel`) without loading the
+ * Node-only Worker builder.
+ */
+export declare const BUILD_SENTINEL: Readonly<{
+    workerName: "every-hosted--sentinel";
+    organizationId: "everyapp-hosted-deploy-sentinel";
+    /**
+     * The Cloudflare account the app is installed in (an AI Gateway's URL
+     * holds it). Starts with the Worker name's placeholder, so an install
+     * rewrites it before that one.
+     */
+    accountId: "every-hosted--sentinel-account";
+    /** The gateway's URL, and so the identity issuer. */
+    gatewayUrl: "https://every-hosted--sentinel.invalid";
+    publicKey: "-----BEGIN PUBLIC KEY-----\nEVERYAPPHOSTEDDEPLOYSENTINEL\n-----END PUBLIC KEY-----\n";
+}>;
+/** Runtime-independent resource names used by both release installers. */
+export declare function helperWorkerName(appWorker: string, helper: string): string;
+export declare function workflowNameFor(workerName: string, binding: string): string;
+/**
+ * A manifest binding's placeholder: a D1 database's name and id, an R2
+ * bucket's, queue's or Vectorize index's name, a KV namespace's, Hyperdrive
+ * config's or AI Gateway's id, a Secrets Store secret's store id and name.
+ * The installer rewrites each by its binding name; the value only has to
+ * be recognizable.
+ */
+export declare function resourceSentinel(binding: string): string;
+/** The fields of the manifest a build's placeholders are made for. */
+interface SentinelManifest {
+    resources?: {
+        d1?: readonly string[];
+        kv?: readonly string[];
+        r2?: readonly string[];
+        hyperdrive?: readonly {
+            readonly name: string;
+        }[];
+        queues?: readonly {
+            readonly name: string;
+        }[];
+        vectorize?: readonly {
+            readonly name: string;
+        }[];
+        aiGateway?: readonly {
+            readonly name: string;
+        }[];
+        secretsStore?: readonly {
+            readonly name: string;
+        }[];
+    };
+}
+/** Where an AI Gateway takes requests: `https://gateway.ai.cloudflare.com/v1/<account>/<id>`. */
+export declare function aiGatewayUrl(accountId: string, id: string): string;
+/**
+ * What an AI Gateway binding holds (a `json` binding): the gateway's id,
+ * its account, and its URL, under which each provider has a path
+ * (`<url>/openai`, `<url>/anthropic`, `<url>/workers-ai`, `<url>/compat`).
+ * In development `accountId` and `url` are empty: there is no gateway, so
+ * an app calls the provider directly.
+ */
+export type AiGatewayValue = {
+    id: string;
+    accountId: string;
+    url: string;
+};
+/** Everything install-specific a Worker is built from, by binding. */
+export interface EveryAppDeployTarget {
+    /** The Worker name the gateway registry assigned to this app. */
+    workerName: string;
+    /** The organization that owns the app; scopes the AppGateway binding. */
+    organizationId: string;
+    /** The Cloudflare account the app is installed in. */
+    accountId: string;
+    /** The gateway's URL, which is also the identity tokens' issuer. */
+    gatewayUrl: string;
+    /** SPKI PEM public keys (current + next) that verify identity tokens. */
+    identityPublicKeys: string[];
+    /** Provisioned resources keyed by manifest binding name. */
+    resources: {
+        d1?: Record<string, {
+            name: string;
+            id: string;
+        }>;
+        kv?: Record<string, {
+            id: string;
+        }>;
+        hyperdrive?: Record<string, {
+            id: string;
+        }>;
+        /** R2 buckets by binding, under the names the registry assigned. */
+        r2?: Record<string, {
+            name: string;
+        }>;
+        /** Queues by binding: each one's name (which its bindings and triggers use) and id. */
+        queues?: Record<string, {
+            name: string;
+            id: string;
+        }>;
+        /** Vectorize indexes by binding, under the names the deploy provisioned. */
+        vectorize?: Record<string, {
+            name: string;
+        }>;
+        /** AI Gateways by binding: each binding's whole value. */
+        aiGateway?: Record<string, AiGatewayValue>;
+        /**
+         * Secrets Store secrets by binding: the account's store and the
+         * secret the deploy made in it.
+         */
+        secretsStore?: Record<string, {
+            storeId: string;
+            secretName: string;
+        }>;
+    };
+}
+/** The target every production build is made for: placeholders throughout. */
+export declare function sentinelDeployTarget(manifest: SentinelManifest): EveryAppDeployTarget;
+export {};
+//# sourceMappingURL=sentinel.d.ts.map

package/dist/cloudflare/sentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel.d.ts","sourceRoot":"","sources":["../../src/cloudflare/sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,cAAc;;;IAKzB;;;;OAIG;;IAEH,qDAAqD;;;EAIrD,CAAC;AAEH,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO1E;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClD,MAAM,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC9C,SAAS,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACjD,SAAS,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACjD,YAAY,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACrD,CAAC;CACH;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4DAA4D;IAC5D,SAAS,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClD,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5C,oEAAoE;QACpE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtC,uFAAuF;QACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,4EAA4E;QAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC7C,0DAA0D;QAC1D,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3C;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxE,CAAC;CACH;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,GACzB,oBAAoB,CAoDtB"}

package/dist/cloudflare/sentinel.js

@@ -0,0 +1,85 @@
+/**
+ * What a production build of an Every App app is made of in place of the
+ * install's own values. The build is tenant-neutral: whoever builds an
+ * app gets the same Build Output, with these placeholders wherever an
+ * install's Worker name, organization, gateway, identity key or resource
+ * ids belong. The installer rewrites them (`everyapp deploy` for an own
+ * Gateway, the hosted gateway's deployer for a hosted one) and refuses an
+ * output in which any survives.
+ *
+ * A leaf module with no imports, so the gateway Worker can read the same
+ * values (`@every-app/sdk/cloudflare/sentinel`) without loading the
+ * Node-only Worker builder.
+ */
+export const BUILD_SENTINEL = Object.freeze({
+    // Holds the resource separator, so no registry Worker is ever named so
+    // and a string rewrite of it can't hit anything else.
+    workerName: "every-hosted--sentinel",
+    organizationId: "everyapp-hosted-deploy-sentinel",
+    /**
+     * The Cloudflare account the app is installed in (an AI Gateway's URL
+     * holds it). Starts with the Worker name's placeholder, so an install
+     * rewrites it before that one.
+     */
+    accountId: "every-hosted--sentinel-account",
+    /** The gateway's URL, and so the identity issuer. */
+    gatewayUrl: "https://every-hosted--sentinel.invalid",
+    publicKey: "-----BEGIN PUBLIC KEY-----\nEVERYAPPHOSTEDDEPLOYSENTINEL\n-----END PUBLIC KEY-----\n",
+});
+/** Runtime-independent resource names used by both release installers. */
+export function helperWorkerName(appWorker, helper) {
+    const name = `${appWorker}--${helper}`;
+    if (name.length > 63)
+        throw new Error(`Helper Worker ${name} is longer than Cloudflare's 63 characters; shorten its name in everyapp.config.ts.`);
+    return name;
+}
+export function workflowNameFor(workerName, binding) {
+    return `${workerName}--${binding.toLowerCase().replaceAll("_", "-")}`;
+}
+/**
+ * A manifest binding's placeholder: a D1 database's name and id, an R2
+ * bucket's, queue's or Vectorize index's name, a KV namespace's, Hyperdrive
+ * config's or AI Gateway's id, a Secrets Store secret's store id and name.
+ * The installer rewrites each by its binding name; the value only has to
+ * be recognizable.
+ */
+export function resourceSentinel(binding) {
+    return `${BUILD_SENTINEL.workerName}--${binding}`;
+}
+/** Where an AI Gateway takes requests: `https://gateway.ai.cloudflare.com/v1/<account>/<id>`. */
+export function aiGatewayUrl(accountId, id) {
+    return `https://gateway.ai.cloudflare.com/v1/${accountId}/${id}`;
+}
+/** The target every production build is made for: placeholders throughout. */
+export function sentinelDeployTarget(manifest) {
+    const byBinding = (bindings, value) => Object.fromEntries((bindings ?? []).map((binding) => [
+        binding,
+        value(resourceSentinel(binding)),
+    ]));
+    const { resources } = manifest;
+    return {
+        workerName: BUILD_SENTINEL.workerName,
+        organizationId: BUILD_SENTINEL.organizationId,
+        accountId: BUILD_SENTINEL.accountId,
+        gatewayUrl: BUILD_SENTINEL.gatewayUrl,
+        identityPublicKeys: [BUILD_SENTINEL.publicKey],
+        resources: {
+            d1: byBinding(resources?.d1, (id) => ({ name: id, id })),
+            kv: byBinding(resources?.kv, (id) => ({ id })),
+            hyperdrive: byBinding(resources?.hyperdrive?.map((config) => config.name), (id) => ({ id })),
+            r2: byBinding(resources?.r2, (name) => ({ name })),
+            ...(resources?.queues?.length
+                ? {
+                    queues: byBinding(resources.queues.map((queue) => queue.name), (name) => ({ name, id: name })),
+                }
+                : {}),
+            vectorize: byBinding(resources?.vectorize?.map((index) => index.name), (name) => ({ name })),
+            aiGateway: byBinding(resources?.aiGateway?.map((gateway) => gateway.name), (id) => ({
+                id,
+                accountId: BUILD_SENTINEL.accountId,
+                url: aiGatewayUrl(BUILD_SENTINEL.accountId, id),
+            })),
+            secretsStore: byBinding(resources?.secretsStore?.map((secret) => secret.name), (placeholder) => ({ storeId: placeholder, secretName: placeholder })),
+        },
+    };
+}