@every-app/sdk 0.2.0 → 0.3.0-rc.10

package/dist/internal/catalog/infra.js

@@ -0,0 +1,543 @@
+export const INFRA = {
+    // Not CLOUDFLARE_API_TOKEN, the CLI's own deploy-login variable (packages/cli/src/lib/cf/account.ts): a person setting that name from their environment would hand apps the deploy token (TODO.md).
+    cloudflare: {
+        mode: "api_key",
+        label: "Cloudflare",
+        description: "Cloudflare's API: zones, DNS, Workers, R2, D1, KV and the rest of an account.",
+        auth: {
+            kind: "bearer",
+            secret: "CLOUDFLARE_PROVIDER_API_TOKEN",
+        },
+        docs: "https://dash.cloudflare.com/profile/api-tokens",
+        api: "https://developers.cloudflare.com/api/",
+        hosts: ["api.cloudflare.com"],
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PUT", "PATCH", "DELETE"],
+        accountWidePaths: [
+            ["client", "v4", "user"],
+            ["client", "v4", "memberships"],
+            ["client", "v4", "organizations"],
+            ["client", "v4", "tenants"],
+            ["members"],
+            ["tokens"],
+            ["roles"],
+            ["iam"],
+            ["subscriptions"],
+            ["payment-methods"],
+            ["pay-invoice"],
+            ["receipts"],
+            ["invoices"],
+            ["client-secret"],
+            ["billing"],
+            ["logs", "audit"],
+            ["audit_logs"],
+            ["alerting", "v3", "destinations", "webhooks"],
+            ["ai", "run"],
+            ["ai", "v1"],
+        ],
+        hint: "An API token from My Profile > API Tokens with only the permissions the app needs; the Gateway sends it as a bearer token. A token on the Gateway's own account can read and change the Gateway, so keep it narrow or use another account.",
+        secrets: [
+            {
+                name: "CLOUDFLARE_PROVIDER_API_TOKEN",
+                hint: "A user or account-owned API token scoped to the zones and permissions the app needs, never a Global API Key.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/client/v4/user/tokens/verify",
+            expect: [200],
+            free: true,
+            note: "For a user token; account-owned tokens use /client/v4/accounts/<id>/tokens/verify. Account-wide, so run it from the person's terminal.",
+        },
+        rate: {
+            note: "1,200 requests per 5 minutes per user or account token; 200 a second per IP; GraphQL by query cost, at most 320 per 5 minutes.",
+        },
+        example: "list the DNS records for my domain",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["infrastructure", "dns", "hosting"],
+    },
+    posthog: {
+        mode: "api_key",
+        label: "PostHog",
+        description: "Product analytics: insights, feature flags, persons, cohorts, experiments and HogQL queries.",
+        auth: {
+            kind: "bearer",
+            secret: "POSTHOG_PERSONAL_API_KEY",
+        },
+        docs: "https://us.posthog.com/settings/user-api-keys",
+        api: "https://posthog.com/docs/api",
+        hosts: ["us.posthog.com", "eu.posthog.com"],
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PUT", "PATCH", "DELETE"],
+        accountWidePaths: [
+            ["api", "users"],
+            ["api", "user"],
+            ["api", "organizations"],
+            ["api", "billing"],
+            ["api", "revoke_leaked_key"],
+            ["project_secret_api_keys"],
+            ["billing"],
+            ["activity_log"],
+            ["advanced_activity_logs"],
+            ["hog_functions"],
+            ["batch_exports"],
+            ["integrations"],
+        ],
+        hint: "A personal API key from Settings > Personal API keys, with only the scopes the app needs; the Gateway sends it as a bearer token to us.posthog.com or eu.posthog.com. HogQL queries are POSTs, so an app that runs them asks for write.",
+        secrets: [
+            {
+                name: "POSTHOG_PERSONAL_API_KEY",
+                hint: "A personal API key (phx_...) with only the scopes the app needs, from the region the project lives in; never the project token.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            host: "us.posthog.com",
+            path: "/api/users/@me/",
+            expect: [200],
+            free: true,
+            note: "Needs the user:read scope; use eu.posthog.com for an EU project. Account-wide, so run it from the person's terminal.",
+        },
+        rate: {
+            perMinute: 480,
+            note: "Create, read, update and delete endpoints 480 a minute and 4,800 an hour; analytics endpoints 240 a minute; the query endpoint 2,400 an hour.",
+        },
+        example: "list the feature flags in my project and whether each is on",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["analytics", "product", "feature-flags"],
+    },
+    mixpanel: {
+        mode: "api_key",
+        label: "Mixpanel",
+        description: "Product analytics: saved reports, profiles, raw event export and event import.",
+        auth: {
+            kind: "basic",
+            secret: "MIXPANEL_SERVICE_ACCOUNT_SECRET",
+            as: "password",
+            user: {
+                secret: "MIXPANEL_SERVICE_ACCOUNT_USERNAME",
+            },
+        },
+        docs: "https://mixpanel.com/settings/org#serviceaccounts",
+        api: "https://docs.mixpanel.com/reference/overview",
+        hosts: [
+            "mixpanel.com",
+            "eu.mixpanel.com",
+            "in.mixpanel.com",
+            "data.mixpanel.com",
+            "data-eu.mixpanel.com",
+            "data-in.mixpanel.com",
+            "api.mixpanel.com",
+            "api-eu.mixpanel.com",
+            "api-in.mixpanel.com",
+        ],
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PUT", "PATCH", "DELETE"],
+        accountWidePaths: [
+            ["api", "app", "me"],
+            ["api", "app", "organizations"],
+            ["service-accounts"],
+            ["data-retrievals"],
+            ["data-deletions"],
+            ["nessie"],
+        ],
+        hint: "A service account from Organization Settings > Service Accounts; the Gateway sends its username and secret as HTTP Basic. Most calls also need the project_id parameter, and an EU or India project uses its own hosts.",
+        secrets: [
+            {
+                name: "MIXPANEL_SERVICE_ACCOUNT_USERNAME",
+                hint: "The service account's username, shown when it is created in Organization Settings > Service Accounts.",
+            },
+            {
+                name: "MIXPANEL_SERVICE_ACCOUNT_SECRET",
+                hint: "The service account's secret, shown once when it is created; give the account the narrowest role and only the projects the app needs.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            host: "mixpanel.com",
+            path: "/api/app/me",
+            expect: [200],
+            free: true,
+            note: "Lists the organizations and projects the service account reaches. Account-wide, so run it from the person's terminal.",
+        },
+        rate: {
+            note: "Per project: Query API 60 queries an hour, 5 at once; Raw Data Export 60 an hour, 3 a second, 100 at once; ingestion about 2 GB a minute.",
+        },
+        example: "pull last week's numbers from my saved Insights report",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["analytics", "product"],
+    },
+    segment: {
+        mode: "api_key",
+        label: "Segment",
+        description: "Sends identify, track, page, group and alias events to a Segment source.",
+        auth: {
+            kind: "basic",
+            secret: "SEGMENT_WRITE_KEY",
+            as: "username",
+        },
+        docs: "https://www.twilio.com/docs/segment/connections/find-writekey",
+        api: "https://www.twilio.com/docs/segment/connections/sources/catalog/libraries/server/http-api",
+        hosts: ["api.segment.io", "events.eu1.segmentapis.com"],
+        data: "account",
+        access: ["write"],
+        readMethods: [],
+        writeMethods: ["POST"],
+        accountWidePaths: [],
+        hint: "The write key of an HTTP API source, from the source's Settings > API Keys; the Gateway sends it as the Basic username with an empty password. It only sends events; an EU workspace uses events.eu1.segmentapis.com.",
+        secrets: [
+            {
+                name: "SEGMENT_WRITE_KEY",
+                hint: "The write key of an HTTP API source, from the source's Settings > API Keys.",
+            },
+        ],
+        rate: {
+            perSecond: 1000,
+            note: "Recommended ceiling per workspace; 32 KB per call, 500 KB and 2,500 events per batch.",
+        },
+        example: "record a Signed Up event for a new user",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["analytics", "events", "cdp"],
+    },
+    supabase: {
+        mode: "api_key",
+        label: "Supabase",
+        description: "A Supabase project's Postgres REST API and Storage, with its secret key.",
+        auth: {
+            kind: "header",
+            secret: "SUPABASE_SECRET_KEY",
+            header: "apikey",
+        },
+        docs: "https://supabase.com/dashboard/project/_/settings/api-keys",
+        api: "https://supabase.com/docs/guides/api",
+        hosts: [],
+        hostSetting: "SUPABASE_HOST",
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PUT", "PATCH", "DELETE"],
+        accountWidePaths: [["auth", "v1", "admin"], ["pg"]],
+        hint: "A secret key (sb_secret_...) from Settings > API Keys and the project's host; the Gateway sends the key in the apikey header. The key bypasses Row Level Security, and RPC calls are POSTs, so they need write.",
+        secrets: [
+            {
+                name: "SUPABASE_SECRET_KEY",
+                hint: "A secret key (sb_secret_...) from Settings > API Keys, made for this Gateway alone; it bypasses Row Level Security.",
+            },
+            {
+                name: "SUPABASE_HOST",
+                hint: "The project's host, <project-ref>.supabase.co, from the project URL.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/rest/v1/",
+            expect: [200],
+            free: true,
+            note: "The REST API's OpenAPI root, which only a secret key may read; sent to the host in SUPABASE_HOST.",
+        },
+        example: "list the ten newest rows in my orders table",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["database", "postgres", "storage"],
+    },
+    turso: {
+        mode: "api_key",
+        label: "Turso",
+        description: "Turso's Platform API: databases, groups, locations and usage for one organization.",
+        auth: {
+            kind: "bearer",
+            secret: "TURSO_API_TOKEN",
+        },
+        docs: "https://docs.turso.tech/api-reference/authentication",
+        api: "https://docs.turso.tech/api-reference/introduction",
+        hosts: ["api.turso.tech"],
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PATCH", "DELETE"],
+        accountWidePaths: [
+            ["auth"],
+            ["api-tokens"],
+            ["members"],
+            ["invites"],
+            ["invoices"],
+            ["subscription"],
+            ["plans"],
+            ["audit-logs"],
+            ["v1", "user"],
+        ],
+        hint: "An organization-scoped Platform API token (turso auth api-tokens mint <name> --org <org>); the Gateway sends it as a bearer token to api.turso.tech. It manages databases and cannot query them: that is the turso-db entry.",
+        secrets: [
+            {
+                name: "TURSO_API_TOKEN",
+                hint: "An organization-scoped or group-scoped Platform API token from turso auth api-tokens mint <name> --org <org>; never an unrestricted one.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/v1/auth/validate",
+            expect: [200],
+            free: true,
+            note: "Account-wide, so run it from the person's terminal.",
+        },
+        example: "list the databases in my Turso organization",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["database", "sqlite"],
+    },
+    // The data plane, one database per entry (the host is the operator's); `turso` is the platform API.
+    "turso-db": {
+        mode: "api_key",
+        label: "Turso database",
+        description: "SQL over HTTP to one Turso database: queries, dumps and migration status.",
+        auth: {
+            kind: "bearer",
+            secret: "TURSO_DB_AUTH_TOKEN",
+        },
+        docs: "https://docs.turso.tech/sdk/authorization/tokens",
+        api: "https://docs.turso.tech/sdk/http/reference",
+        hosts: [],
+        hostSetting: "TURSO_DB_HOST",
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST"],
+        accountWidePaths: [],
+        hint: "A database token (turso db tokens create <db>) and the database's HTTP host; the Gateway sends the token as a bearer token. Every query is a POST to /v2/pipeline, so an app that queries asks for write; a --read-only token keeps it to reads.",
+        secrets: [
+            {
+                name: "TURSO_DB_AUTH_TOKEN",
+                hint: "A database token from turso db tokens create <db>, with --read-only or fine-grained permissions when the app only reads.",
+            },
+            {
+                name: "TURSO_DB_HOST",
+                hint: "The database's HTTP host, <db>-<org>.turso.io, from turso db show <db> --http-url.",
+            },
+        ],
+        example: "count the rows in my users table",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["database", "sqlite", "sql"],
+    },
+    neon: {
+        mode: "api_key",
+        label: "Neon",
+        description: "Neon's management API: Postgres projects, branches, databases, roles and endpoints.",
+        auth: {
+            kind: "bearer",
+            secret: "NEON_API_KEY",
+        },
+        docs: "https://neon.com/docs/manage/api-keys",
+        api: "https://neon.com/docs/reference/api",
+        hosts: ["console.neon.tech"],
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PUT", "PATCH", "DELETE"],
+        accountWidePaths: [
+            ["api", "v2", "auth"],
+            ["api", "v2", "organizations"],
+            ["users", "me"],
+            ["api_keys"],
+            ["members"],
+            ["invitations"],
+            ["permissions"],
+            ["transfer_requests"],
+            ["billing"],
+            ["consumption_history"],
+            ["connection_uri"],
+            ["reveal_password"],
+            ["reset_password"],
+            ["credentials"],
+            ["realtime", "secret"],
+            ["rotate_secret"],
+            ["auth", "keys"],
+            ["auth", "webhooks"],
+            ["oauth_providers"],
+            ["email_server"],
+            ["email_provider"],
+            ["auth", "plugins"],
+        ],
+        hint: "A project-scoped or organization API key from Settings > API keys; the Gateway sends it as a bearer token to console.neon.tech. It manages projects and branches; the database itself takes Postgres credentials, not this key.",
+        secrets: [
+            {
+                name: "NEON_API_KEY",
+                hint: "A project-scoped or organization API key from Settings > API keys; a project-scoped key reaches one project only.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/api/v2/auth",
+            expect: [200],
+            free: true,
+            note: "Says which credential and identity the key is. Account-wide, so run it from the person's terminal.",
+        },
+        rate: {
+            perMinute: 700,
+            note: "About 11 a second, with bursts of 40 a second per route.",
+        },
+        example: "list my Neon projects and their branches",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["database", "postgres"],
+    },
+    pinecone: {
+        mode: "api_key",
+        label: "Pinecone",
+        description: "Vector database: indexes, namespaces, vectors and documents, plus hosted embedding and rerank.",
+        auth: {
+            kind: "header",
+            secret: "PINECONE_API_KEY",
+            header: "Api-Key",
+        },
+        docs: "https://app.pinecone.io/organizations/-/projects/-/keys",
+        api: "https://docs.pinecone.io/reference/api/introduction",
+        hosts: ["api.pinecone.io"],
+        hostSetting: "PINECONE_HOST",
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PATCH", "DELETE"],
+        accountWidePaths: [["admin"], ["api-keys"]],
+        hint: "An API key from the project's API keys page and the host of the index the app uses; the Gateway sends the key in the Api-Key header to api.pinecone.io and that host. Query, search, embed and rerank are POSTs, so an app that uses them asks for write.",
+        secrets: [
+            {
+                name: "PINECONE_API_KEY",
+                hint: "An API key from the project's API keys page in the Pinecone console.",
+            },
+            {
+                name: "PINECONE_HOST",
+                hint: "The host of the index the app uses, <index>-<id>.svc.<env>.pinecone.io, from describe_index or the console.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            host: "api.pinecone.io",
+            path: "/indexes",
+            expect: [200],
+            free: true,
+            note: "Lists the project's indexes; the app sends X-Pinecone-Api-Version itself.",
+        },
+        example: "list my Pinecone indexes and their dimensions",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["vector", "database", "search"],
+    },
+    mapbox: {
+        mode: "api_key",
+        label: "Mapbox",
+        description: "Maps and location: geocoding, directions, styles, tilesets and datasets.",
+        auth: {
+            kind: "query",
+            secret: "MAPBOX_ACCESS_TOKEN",
+            param: "access_token",
+        },
+        docs: "https://console.mapbox.com/account/access-tokens/",
+        api: "https://docs.mapbox.com/api/overview/",
+        hosts: ["api.mapbox.com"],
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PUT", "PATCH", "DELETE"],
+        accountWidePaths: [["tokens"]],
+        hint: "An access token from Access tokens in the Mapbox console, with only the scopes the app needs; the Gateway adds it to every call as the access_token parameter.",
+        secrets: [
+            {
+                name: "MAPBOX_ACCESS_TOKEN",
+                hint: "An access token with only the scopes the app needs, from Access tokens in the Mapbox console.",
+            },
+        ],
+        rate: {
+            note: "Per token and per API: Geocoding 1,000 a minute, Directions 300, Static Images 1,250; the Tokens API 100 a minute per account.",
+        },
+        example: "turn a street address into map coordinates",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["maps", "geocoding", "location"],
+    },
+    openweather: {
+        mode: "api_key",
+        label: "OpenWeather",
+        description: "Weather data: current conditions, forecasts, One Call, history and weather map tiles.",
+        auth: {
+            kind: "query",
+            secret: "OPENWEATHER_API_KEY",
+            param: "appid",
+        },
+        docs: "https://home.openweathermap.org/api_keys",
+        api: "https://openweathermap.org/api",
+        hosts: [
+            "api.openweathermap.org",
+            "pro.openweathermap.org",
+            "history.openweathermap.org",
+            "tile.openweathermap.org",
+            "maps.openweathermap.org",
+        ],
+        data: "per-call",
+        access: ["read"],
+        readMethods: ["GET", "HEAD"],
+        accountWidePaths: [
+            ["data", "3", "stations"],
+            ["data", "3", "measurements"],
+        ],
+        hint: "An API key from the API keys tab of your OpenWeather account; the Gateway adds it to every call as the appid parameter. Paid products (hourly forecast, history, Weather Maps 2.0) need a plan that includes them.",
+        secrets: [
+            {
+                name: "OPENWEATHER_API_KEY",
+                hint: "An API key from the API keys tab of the OpenWeather account; a new key can take up to two hours to activate.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            host: "api.openweathermap.org",
+            path: "/data/2.5/weather?lat=51.51&lon=-0.13",
+            expect: [200],
+            free: true,
+            note: "Counts one call against the plan's quota; free within it. A bad or not yet active key answers 401.",
+        },
+        cost: {
+            unit: "call",
+            note: "One Call API 3.0 includes 1,000 calls a day free, then is paid per call.",
+        },
+        rate: {
+            perMinute: 60,
+            note: "The Free plan answers 429 past 60 calls a minute.",
+        },
+        example: "get the current weather in Lisbon",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["weather", "forecast"],
+    },
+};