@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/internal/catalog/search.js

@@ -0,0 +1,463 @@
+export const SEARCH = {
+    firecrawl: {
+        mode: "api_key",
+        label: "Firecrawl",
+        description: "Scrapes, crawls, maps and searches the web, returning clean markdown or structured data.",
+        auth: {
+            kind: "bearer",
+            secret: "FIRECRAWL_API_KEY",
+        },
+        docs: "https://www.firecrawl.dev/app/api-keys",
+        api: "https://docs.firecrawl.dev/api-reference/introduction",
+        hosts: ["api.firecrawl.dev"],
+        data: "per-call",
+        access: ["read", "write"],
+        readMethods: ["GET", "POST"],
+        writeMethods: ["DELETE"],
+        accountWidePaths: [
+            ["team"],
+            ["crawl", "active"],
+            ["monitor"],
+            ["agent"],
+            ["interact"],
+            ["support", "ask"],
+        ],
+        hint: "An API key from Firecrawl's API keys page; the Gateway sends it as a bearer token. Scrape, crawl, map, search and extract are POSTs and job status is a GET; cancelling a crawl or batch (DELETE) needs write.",
+        secrets: [
+            {
+                name: "FIRECRAWL_API_KEY",
+                hint: "An API key from Firecrawl's API keys page; it starts with fc-.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/v2/team/credit-usage",
+            expect: [200],
+            free: true,
+            note: "Remaining credits; account-wide, so the Gateway refuses it for apps: run it from the person's terminal.",
+        },
+        cost: {
+            unit: "result",
+            note: "Credits: 1 per page scraped or crawled, 1 per map call, 2 per 10 search results; JSON extraction and other options add more.",
+        },
+        rate: {
+            note: "Per team per minute, by plan: /scrape 10 on Free, 100 Hobby, 500 Standard, 5,000 Growth; /crawl 2, 20, 100, 1,000.",
+        },
+        example: "scrape https://example.com/pricing into markdown",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["scrape", "crawl", "search"],
+    },
+    exa: {
+        mode: "api_key",
+        label: "Exa",
+        description: "Web search built for AI: search results, page contents, similar links and cited answers.",
+        auth: {
+            kind: "header",
+            secret: "EXA_API_KEY",
+            header: "x-api-key",
+        },
+        docs: "https://dashboard.exa.ai/api-keys",
+        api: "https://exa.ai/docs/reference/search",
+        hosts: ["api.exa.ai"],
+        data: "per-call",
+        access: ["read"],
+        readMethods: ["POST"],
+        accountWidePaths: [["websets"], ["monitors"], ["agent"], ["batches"]],
+        hint: "An API key from the Exa dashboard (the free tier gives $10 of credit a month); the Gateway sends it in the x-api-key header. Search, contents, find-similar and answer are POSTs.",
+        secrets: [
+            {
+                name: "EXA_API_KEY",
+                hint: "An API key from the API keys page of the Exa dashboard.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/websets/v0/teams/me",
+            expect: [200],
+            free: true,
+            note: "Team info under the Websets API (the docs page leaves out the /websets prefix); account-wide, so run it from the person's terminal.",
+        },
+        cost: {
+            unit: "call",
+            usd: 0.007,
+            note: "Search $7 per 1k (auto and fast; lite $4), contents $1 per 1k pages, answer $5 per 1k; up to 10 results included.",
+        },
+        rate: {
+            perSecond: 10,
+            note: "Per team: /search and /answer 10 QPS, deep search 5, /contents 100.",
+        },
+        example: "find recent articles about solid-state batteries",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["search"],
+    },
+    tavily: {
+        mode: "api_key",
+        label: "Tavily",
+        description: "Web search, page extraction, crawling and site maps for AI agents, plus research reports.",
+        auth: {
+            kind: "bearer",
+            secret: "TAVILY_API_KEY",
+        },
+        docs: "https://app.tavily.com",
+        api: "https://docs.tavily.com/documentation/api-reference/endpoint/search",
+        hosts: ["api.tavily.com"],
+        data: "per-call",
+        access: ["read"],
+        readMethods: ["GET", "POST"],
+        accountWidePaths: [["usage"], ["logs"], ["org-usage"]],
+        hint: "An API key from app.tavily.com (1,000 free credits a month); the Gateway sends it as a bearer token. Search, extract, crawl, map and research are POSTs; a research result is a GET.",
+        secrets: [
+            {
+                name: "TAVILY_API_KEY",
+                hint: "An API key from the Tavily dashboard; it starts with tvly-.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/usage",
+            expect: [200],
+            free: true,
+            note: "Key and account usage, not an endpoint that costs credits; account-wide, so run it from the person's terminal (10 calls per 10 minutes).",
+        },
+        cost: {
+            unit: "call",
+            usd: 0.008,
+            note: "Pay as you go $0.008 per credit: basic search 1 credit, advanced 2; extract 1 credit per 5 URLs; map 1 per 10 pages.",
+        },
+        rate: {
+            perMinute: 100,
+            note: "Development keys 100 per minute, production keys 1,000; crawl 100 and research 20 per minute for both.",
+        },
+        example: "search the web for this week's news on EU AI rules",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["search", "scrape"],
+    },
+    // Unverified: Serper publishes no API reference; the request shape is read from its playground.
+    serper: {
+        mode: "api_key",
+        label: "Serper",
+        description: "Google search results as JSON: web, news, images, places, shopping, scholar and patents.",
+        auth: {
+            kind: "header",
+            secret: "SERPER_API_KEY",
+            header: "X-API-KEY",
+        },
+        docs: "https://serper.dev/api-keys",
+        api: "https://serper.dev/playground",
+        hosts: ["google.serper.dev", "scrape.serper.dev"],
+        data: "per-call",
+        access: ["read"],
+        readMethods: ["POST"],
+        accountWidePaths: [],
+        hint: 'An API key from serper.dev (2,500 free queries to start); the Gateway sends it in the X-API-KEY header. Every search is a POST to google.serper.dev/<type> (search, news, images, places, …) with a JSON body such as {"q": "…"}.',
+        secrets: [
+            {
+                name: "SERPER_API_KEY",
+                hint: "The API key on serper.dev's API keys page.",
+            },
+        ],
+        cost: {
+            unit: "call",
+            usd: 0.001,
+            note: "Prepaid credits, one per successful query: $1.00 per 1k on the 50k pack, down to $0.30 per 1k on the largest.",
+        },
+        rate: {
+            perSecond: 50,
+            note: "Starter credits 50 queries per second; Standard 100, Scale 200, Ultimate 300.",
+        },
+        example: "get the top Google results for best project management software",
+        verified: false,
+        tags: ["search", "serp"],
+    },
+    "brave-search": {
+        mode: "api_key",
+        label: "Brave Search",
+        description: "Brave's independent web index: web, news, images, videos, places, LLM context and answers.",
+        auth: {
+            kind: "header",
+            secret: "BRAVE_SEARCH_API_KEY",
+            header: "X-Subscription-Token",
+        },
+        docs: "https://api-dashboard.search.brave.com/app/keys",
+        api: "https://api-dashboard.search.brave.com/documentation",
+        hosts: ["api.search.brave.com"],
+        data: "per-call",
+        access: ["read"],
+        readMethods: ["GET", "POST"],
+        accountWidePaths: [],
+        hint: "Activate a plan (it includes $5 of free credit a month), then create a key under API Keys; the Gateway sends it in the X-Subscription-Token header. Searches are GETs (POST works too); answers are a POST to /res/v1/chat/completions.",
+        secrets: [
+            {
+                name: "BRAVE_SEARCH_API_KEY",
+                hint: "A key from the API Keys section of the Brave Search API dashboard, made after activating a plan.",
+            },
+        ],
+        cost: {
+            unit: "call",
+            usd: 0.005,
+            note: "Search $5 per 1k requests; Answers $4 per 1k plus $5 per million tokens; $5 free credit a month; only successful calls count.",
+        },
+        rate: {
+            perSecond: 50,
+            note: "Search plan 50 queries per second; Answers 2 per second.",
+        },
+        example: "search the web for the latest Cloudflare Workers release notes",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["search"],
+    },
+    apify: {
+        mode: "api_key",
+        label: "Apify",
+        description: "Runs Apify Actors (ready-made scrapers and automations) and reads their datasets and stores.",
+        auth: {
+            kind: "bearer",
+            secret: "APIFY_API_TOKEN",
+        },
+        docs: "https://console.apify.com/settings/integrations",
+        api: "https://docs.apify.com/api/v2",
+        hosts: ["api.apify.com"],
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "HEAD"],
+        writeMethods: ["POST", "PUT", "DELETE"],
+        accountWidePaths: [
+            ["users"],
+            ["webhooks"],
+            ["webhook-dispatches"],
+            ["env-vars"],
+        ],
+        hint: "The API token from Apify Console, Settings > API & Integrations; the Gateway sends it as a bearer token. Reading Actors, runs and datasets needs read; starting a run is a POST, so it needs write.",
+        secrets: [
+            {
+                name: "APIFY_API_TOKEN",
+                hint: "The API token under Settings > API & Integrations in Apify Console.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/v2/users/me",
+            expect: [200],
+            free: true,
+            note: "The docs' verify call; account-wide, so the Gateway refuses it for apps: run it from the person's terminal.",
+        },
+        rate: {
+            perSecond: 60,
+            note: "60 requests per second per resource (one Actor, run, dataset or store); 250,000 requests per minute per user overall.",
+        },
+        example: "run the Google Maps scraper Actor for coffee shops in Austin and list the results",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["scrape", "automation"],
+    },
+    deepgram: {
+        mode: "api_key",
+        label: "Deepgram",
+        description: "Speech to text, text to speech and text analysis.",
+        auth: {
+            kind: "bearer",
+            secret: "DEEPGRAM_API_KEY",
+            scheme: "Token",
+        },
+        docs: "https://console.deepgram.com/",
+        api: "https://developers.deepgram.com/reference/deepgram-api-overview",
+        hosts: [
+            "api.deepgram.com",
+            "api.eu.deepgram.com",
+            "api.au.deepgram.com",
+            "api.in.deepgram.com",
+        ],
+        data: "per-call",
+        access: ["read"],
+        readMethods: ["GET", "POST"],
+        accountWidePaths: [["projects"], ["auth", "grant"]],
+        hint: "An API key from the Deepgram Console; the Gateway sends it as Authorization: Token <key>, and the EU, Australia and India hosts take the same key. Transcription (/v1/listen), speech (/v1/speak) and text analysis (/v1/read) are POSTs.",
+        secrets: [
+            {
+                name: "DEEPGRAM_API_KEY",
+                hint: "A project API key created in the Deepgram Console.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/v1/models",
+            expect: [200],
+            free: true,
+            note: "Lists the public models; it needs the key and processes no audio.",
+        },
+        cost: {
+            unit: "call",
+            note: "Nova-3 pre-recorded $0.0043 per audio minute (pay as you go); Aura-2 speech $0.030 per 1k characters; $200 free credit.",
+        },
+        rate: {
+            note: "Concurrency per project on pay as you go: 50 pre-recorded transcriptions, 15 text-to-speech requests.",
+        },
+        example: "transcribe this podcast episode and label the speakers",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["speech", "transcription"],
+    },
+    elevenlabs: {
+        mode: "api_key",
+        label: "ElevenLabs",
+        description: "Text to speech, speech to text, sound effects, music and voice changing.",
+        auth: {
+            kind: "header",
+            secret: "ELEVENLABS_API_KEY",
+            header: "xi-api-key",
+        },
+        docs: "https://elevenlabs.io/app/settings/api-keys",
+        api: "https://elevenlabs.io/docs/api-reference/introduction",
+        hosts: ["api.elevenlabs.io"],
+        data: "per-call",
+        access: ["read"],
+        readMethods: ["GET", "POST"],
+        accountWidePaths: [
+            ["v1", "user"],
+            ["v1", "usage"],
+            ["v1", "workspace"],
+            ["v1", "workspaces"],
+            ["v1", "service-accounts"],
+            ["v1", "history"],
+            ["v1", "single-use-token"],
+            ["v1", "convai"],
+            ["v1", "dubbing"],
+            ["v1", "studio"],
+            ["v1", "pronunciation-dictionaries"],
+            ["v1", "voices", "add"],
+            ["v1", "voices", "pvc"],
+            ["v1", "voices", "collections"],
+            ["edit"],
+            ["replicate-to-isolated-environment"],
+            ["v1", "text-to-voice"],
+            ["v1", "audio-native"],
+            ["v1", "productions"],
+            ["v1", "speech-engine"],
+            ["v1", "music", "finetunes"],
+            ["v1", "flows"],
+            ["v1", "assets"],
+            ["v1", "audio-isolation", "history"],
+        ],
+        hint: "An API key from ElevenLabs' API keys page; the Gateway sends it in the xi-api-key header. Speech, transcription and sound generation are POSTs; listing voices and models are GETs.",
+        secrets: [
+            {
+                name: "ELEVENLABS_API_KEY",
+                hint: "An API key from ElevenLabs' API keys page; it can be scoped to the endpoints the app uses and given a credit cap.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/v1/models",
+            expect: [200],
+            free: true,
+            note: "The first request in ElevenLabs' authentication docs; it generates nothing.",
+        },
+        example: "read this paragraph aloud in a calm narrator voice",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["speech", "audio"],
+    },
+    // `account`, not per-call: GET /v2/transcript lists every transcript on the account and shares its segment with /v2/transcript/<id>.
+    assemblyai: {
+        mode: "api_key",
+        label: "AssemblyAI",
+        description: "Transcribes recorded audio and video, with speaker labels, redaction and subtitles.",
+        auth: {
+            kind: "header",
+            secret: "ASSEMBLYAI_API_KEY",
+            header: "Authorization",
+        },
+        docs: "https://www.assemblyai.com/dashboard/home",
+        api: "https://www.assemblyai.com/docs",
+        hosts: ["api.assemblyai.com", "api.eu.assemblyai.com"],
+        data: "account",
+        access: ["read", "write"],
+        readMethods: ["GET", "POST"],
+        writeMethods: ["DELETE"],
+        accountWidePaths: [],
+        hint: "The API key from your AssemblyAI dashboard; the Gateway sends it as the whole Authorization header, with no Bearer word. Audio is submitted with a POST to /v2/transcript and the app polls GET /v2/transcript/<id>; deleting a transcript needs write.",
+        secrets: [
+            {
+                name: "ASSEMBLYAI_API_KEY",
+                hint: "The API key on your AssemblyAI dashboard.",
+            },
+        ],
+        smoke: {
+            method: "GET",
+            path: "/v2/transcript?limit=1",
+            expect: [200],
+            free: true,
+            note: "Lists the account's latest transcript; it transcribes nothing.",
+        },
+        cost: {
+            unit: "call",
+            note: "Per hour of audio submitted: Universal-3.5 Pro $0.21, Universal-2 $0.15; the free tier covers up to 185 hours of pre-recorded audio.",
+        },
+        rate: {
+            perMinute: 4000,
+            note: "20,000 requests per 5 minutes per account; 5 transcriptions in parallel on free accounts, 200 or more on paid.",
+        },
+        example: "transcribe this sales call recording with speaker labels",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["speech", "transcription"],
+    },
+    newsapi: {
+        mode: "api_key",
+        label: "NewsAPI",
+        description: "Searches news articles and live headlines from over 150,000 sources.",
+        auth: {
+            kind: "header",
+            secret: "NEWSAPI_API_KEY",
+            header: "X-Api-Key",
+        },
+        docs: "https://newsapi.org/register",
+        api: "https://newsapi.org/docs",
+        hosts: ["newsapi.org"],
+        data: "per-call",
+        access: ["read"],
+        readMethods: ["GET"],
+        accountWidePaths: [],
+        hint: "An API key from newsapi.org/register; the Gateway sends it in the X-Api-Key header. The free Developer plan allows 100 requests a day, delays articles by 24 hours and is for development only; production needs a paid plan.",
+        secrets: [
+            {
+                name: "NEWSAPI_API_KEY",
+                hint: "The API key NewsAPI shows after you register.",
+            },
+        ],
+        cost: {
+            unit: "call",
+            usd: 0.0018,
+            note: "Developer plan free (100 requests a day, development only); Business $449 a month for 250,000 requests, then $0.0018 each.",
+        },
+        rate: {
+            perDay: 100,
+            note: "Developer plan; Business includes 250,000 requests a month, Advanced 2,000,000.",
+        },
+        example: "find today's top business headlines in the US",
+        verified: {
+            on: "2026-10-25",
+            how: "docs",
+        },
+        tags: ["news"],
+    },
+};

package/dist/internal/devProviders.d.ts

@@ -16,7 +16,7 @@
  * doesn't parse is ignored until an app asks for its id, which then gets
  * a ConfigurationError naming the file.
  */
-import type { ApiKeyCapability } from "./capabilities.js";
+import { type RegistrableCapability } from "./providerSpec.js";
 /** The dev Worker's binding holding the specs (a copy is in ../cloudflare/worker.ts, kept in step by a test). */
 export declare const DEV_PROVIDERS_ENV = "EVERYAPP_DEV_PROVIDERS";
 /** Where the specs live in an app, relative to its directory. */
@@ -33,7 +33,7 @@ export declare function devProviderFile(id: string): string;
 /** A registered provider resolved for local development, or why it can't be. */
 export type DevProviderLookup = {
     found: true;
-    capability: ApiKeyCapability;
+    capability: RegistrableCapability;
     file: string;
 } | {
     found: false;

package/dist/internal/devProviders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devProviders.d.ts","sourceRoot":"","sources":["../../src/internal/devProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,iHAAiH;AACjH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,OAAO,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBtC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,EAAE,EAAE,MAAM,GACT,iBAAiB,CA+BnB"}
+{"version":3,"file":"devProviders.d.ts","sourceRoot":"","sources":["../../src/internal/devProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,iHAAiH;AACjH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,OAAO,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBtC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,EAAE,EAAE,MAAM,GACT,iBAAiB,CA+BnB"}

package/dist/internal/devProviders.js

@@ -1,4 +1,22 @@
-import { describeSpecProblems, parseProviderSpec } from "./providerSpec.js";
+/**
+ * A provider registered on a gateway, in local development
+ * (docs/design/2026-10-provider-registry.md, section 4). There is no
+ * gateway to ask in `everyapp dev`, so the spec comes from the app's
+ * directory: `everyapp provider add` (run in an app directory) and
+ * `everyapp provider show <id> --save` write it to
+ * `.everyapp/providers/<id>.json`, `everyAppWorker()` reads every such
+ * file when it builds the dev Worker and hands them over as one text
+ * binding, {@link DEV_PROVIDERS_ENV}, and `integrationFetch()`'s local
+ * fallback resolves an id outside the catalog from it, with the
+ * developer's own key from `.dev.vars` under the spec's setting names.
+ *
+ * The binding is JSON: `[{ "file": ".everyapp/providers/stripe.json",
+ * "spec": <the file's JSON, or its text when it isn't JSON> }]`. Each spec
+ * is parsed here, with the same parser `provider add` uses; one that
+ * doesn't parse is ignored until an app asks for its id, which then gets
+ * a ConfigurationError naming the file.
+ */
+import { describeSpecProblems, parseProviderSpec, } from "./providerSpec.js";
 /** The dev Worker's binding holding the specs (a copy is in ../cloudflare/worker.ts, kept in step by a test). */
 export const DEV_PROVIDERS_ENV = "EVERYAPP_DEV_PROVIDERS";
 /** Where the specs live in an app, relative to its directory. */

package/dist/internal/events.d.ts

@@ -9,7 +9,7 @@
  * apps/every-app-gateway/src/server/events/catalogue.ts; this module knows
  * the names, versions and one-line descriptions only.
  */
-export type EventGroup = "member" | "app" | "cap" | "tool" | "connection" | "token" | "access" | "mcp_app" | "provider" | "ping";
+export type EventGroup = "member" | "organization" | "app" | "cap" | "group" | "tool" | "connection" | "token" | "access" | "signin_provider" | "mcp_app" | "provider" | "subscription" | "ai" | "ping";
 export interface EventTypeInfo {
     /** `member.joined`, `cap.reached`, … */
     readonly type: string;
@@ -56,8 +56,19 @@ export declare const EVENT_SUBSCRIPTIONS_MAX = 25;
 /** A webhook signing secret's length. */
 export declare const EVENT_SECRET_MIN_LENGTH = 16;
 export declare const EVENT_SECRET_MAX_LENGTH = 128;
-/** Events and deliveries are kept this long. */
+/**
+ * Deliveries (the queue and its log) are kept this long. Events themselves
+ * are the audit log and live longer ({@link AUDIT_RETENTION_DAYS}).
+ */
 export declare const EVENT_RETENTION_DAYS = 30;
+/**
+ * Events are kept this long: Admin → Activity → Audit, `everyapp workspace
+ * audit` and `everyapp_workspace_audit` read them back. A constant, not a
+ * setting.
+ */
+export declare const AUDIT_RETENTION_DAYS = 90;
+/** The most audit rows one page carries, on every surface. */
+export declare const AUDIT_PAGE_MAX = 200;
 /** A subscription's URL. */
 export declare const EVENT_URL_MAX_LENGTH = 2048;
 /** A subscription's name. */

package/dist/internal/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/internal/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,KAAK,GACL,KAAK,GACL,MAAM,GACN,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,SAAS,GACT,UAAU,GACV,MAAM,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AASD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,aAAa,EAwC/C,CAAC;AAIF,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,QAA0C,CAAC;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWhE;AAED,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,QAAW,CAAC;AACjD,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAC9C,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,sCAAsC;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,yCAAyC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,gDAAgD;AAChD,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,6BAA6B;AAC7B,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AACF,eAAO,MAAM,2BAA2B,QAAmC,CAAC;AAC5E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,kDAAkD;AAClD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAWxD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,4CAA4C;AAC5C,eAAO,MAAM,WAAW,+BAAgC,CAAC;AACzD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,+BAAgC,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAM1E;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,OAAO,CAET;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAalE;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QACkE,CAAC;AAEtG,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3B,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,gBAAgB,CAAC,CAAC;AAqBvC;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,QAAQ,SAA2B,GAClC,cAAc,CAmDhB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uBAAuB;AACvB,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAY5C"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/internal/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,cAAc,GACd,KAAK,GACL,KAAK,GACL,OAAO,GACP,MAAM,GACN,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,iBAAiB,GACjB,SAAS,GACT,UAAU,GACV,cAAc,GACd,IAAI,GACJ,MAAM,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AASD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,aAAa,EA6I/C,CAAC;AAIF,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,QAA0C,CAAC;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWhE;AAED,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,QAAW,CAAC;AACjD,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAC9C,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,sCAAsC;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,yCAAyC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,8DAA8D;AAC9D,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,6BAA6B;AAC7B,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AACF,eAAO,MAAM,2BAA2B,QAAmC,CAAC;AAC5E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,kDAAkD;AAClD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAWxD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,4CAA4C;AAC5C,eAAO,MAAM,WAAW,+BAAgC,CAAC;AACzD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,+BAAgC,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAU1E;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,OAAO,CAET;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAalE;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QACkE,CAAC;AAEtG,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3B,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,gBAAgB,CAAC,CAAC;AAqBvC;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,QAAQ,SAA2B,GAClC,cAAc,CAmDhB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uBAAuB;AACvB,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAY5C"}

package/dist/internal/events.js

@@ -24,29 +24,58 @@ export const EVENT_TYPES = [
     entry("member", "member.reactivated", "A member was reactivated"),
     entry("member", "member.removed", "A member was removed"),
     entry("member", "member.password_reset", "A member reset their password"),
+    entry("member", "member.invitation_cancelled", "A pending invitation was cancelled"),
+    entry("organization", "organization.renamed", "The workspace was renamed"),
+    entry("organization", "organization.linked_dev_changed", "Linked dev (everyapp dev against this Gateway) was turned on or off"),
     entry("app", "app.installed", "An app was installed on the Gateway"),
     entry("app", "app.updated", "An app was redeployed"),
+    entry("app", "app.live", "An app went live on the Gateway"),
     entry("app", "app.removed", "An app was removed from the Gateway"),
     entry("app", "app.needs_setup", "An app needs a setting before it opens"),
     entry("app", "app.ready", "An app has every setting it needs"),
     entry("app", "app.paused_cap", "An app is paused: its monthly cap is reached"),
     entry("app", "app.tools_changed", "An app's AI tools changed"),
+    entry("app", "app.renamed", "An app's name or description changed"),
+    entry("app", "app.settings_changed", "An app's settings were set or unset (names only)"),
+    entry("app", "app.access_changed", "Who can open an app changed"),
+    entry("app", "app.email_changed", "An app's email senders or inbound changed"),
     entry("cap", "cap.warning", "An app is at 80% of its monthly cap"),
     entry("cap", "cap.reached", "An app reached its monthly cap"),
     entry("cap", "cap.raised", "An app's monthly cap, or the workspace default, was raised or removed"),
+    entry("cap", "cap.changed", "An app's monthly cap, or the workspace default, was set or lowered"),
+    entry("group", "group.created", "A group was created"),
+    entry("group", "group.updated", "A group was renamed or described"),
+    entry("group", "group.removed", "A group was removed"),
+    entry("group", "group.members_changed", "A group's members changed"),
+    entry("group", "group.apps_changed", "The apps a group opens changed"),
     entry("tool", "tool.blocked", "An AI client's tool call was blocked"),
     entry("tool", "tool.error", "An AI client's tool call failed"),
     entry("connection", "connection.created", "An AI app was connected"),
     entry("connection", "connection.revoked", "An AI app connection was revoked"),
+    entry("connection", "connection.used", "Linked dev used the Gateway's services (first call of the day)"),
     entry("token", "token.created", "A personal access token was created"),
     entry("token", "token.revoked", "A personal access token was revoked"),
     entry("access", "access.changed", "Cloudflare Access was turned on or off"),
+    entry("signin_provider", "signin_provider.added", "A sign-in provider (Continue with Google, …) was turned on"),
+    entry("signin_provider", "signin_provider.removed", "A sign-in provider was turned off"),
     entry("mcp_app", "mcp_app.added", "An MCP app was added"),
     entry("mcp_app", "mcp_app.removed", "An MCP app was removed"),
     entry("mcp_app", "mcp_app.enabled", "An MCP app is being served again"),
     entry("mcp_app", "mcp_app.disabled", "An MCP app stopped being served"),
-    entry("provider", "provider.added", "An API provider was registered"),
-    entry("provider", "provider.removed", "An API provider was removed"),
+    entry("mcp_app", "mcp_app.updated", "An MCP app's risk default, name or description changed"),
+    entry("mcp_app", "mcp_app.tool_changed", "One tool of an MCP app was overridden: its risk, or on/off"),
+    entry("provider", "provider.added", "A provider was registered"),
+    entry("provider", "provider.removed", "A provider was removed"),
+    entry("provider", "provider.updated", "A provider's spec or OAuth client was replaced"),
+    entry("provider", "provider.connected", "Someone connected an account at an OAuth provider"),
+    entry("provider", "provider.disconnected", "An OAuth provider account was disconnected"),
+    entry("provider", "provider.connection_expired", "An OAuth provider refused to refresh a connection; it needs reconnecting"),
+    entry("subscription", "subscription.created", "An event subscription was added"),
+    entry("subscription", "subscription.updated", "An event subscription was changed, paused or resumed"),
+    entry("subscription", "subscription.removed", "An event subscription was removed"),
+    entry("subscription", "subscription.redelivered", "A delivery was queued again by hand"),
+    entry("ai", "ai.default_changed", "The default model provider changed"),
+    entry("ai", "ai.model_changed", "A provider's default model changed"),
     entry("ping", "ping", "A test event, sent to one subscription on request"),
 ];
 const typesByName = new Map(EVENT_TYPES.map((info) => [info.type, info]));
@@ -99,8 +128,19 @@ export const EVENT_SUBSCRIPTIONS_MAX = 25;
 /** A webhook signing secret's length. */
 export const EVENT_SECRET_MIN_LENGTH = 16;
 export const EVENT_SECRET_MAX_LENGTH = 128;
-/** Events and deliveries are kept this long. */
+/**
+ * Deliveries (the queue and its log) are kept this long. Events themselves
+ * are the audit log and live longer ({@link AUDIT_RETENTION_DAYS}).
+ */
 export const EVENT_RETENTION_DAYS = 30;
+/**
+ * Events are kept this long: Admin → Activity → Audit, `everyapp workspace
+ * audit` and `everyapp_workspace_audit` read them back. A constant, not a
+ * setting.
+ */
+export const AUDIT_RETENTION_DAYS = 90;
+/** The most audit rows one page carries, on every surface. */
+export const AUDIT_PAGE_MAX = 200;
 /** A subscription's URL. */
 export const EVENT_URL_MAX_LENGTH = 2048;
 /** A subscription's name. */
@@ -172,8 +212,11 @@ export const EVENT_EMAIL_RECIPIENTS = ["owners", "admins"];
  * gateway's app events and every app's own.
  */
 export function eventPatternMatches(pattern, type) {
+    // Everything but a test ping and the bus's own housekeeping: a webhook
+    // hears about subscriptions only when it names `subscription.*`, so a
+    // catch-all's first delivery is the event it was made for, not itself.
     if (pattern === "*")
-        return type !== "ping";
+        return type !== "ping" && !type.startsWith("subscription.");
     if (pattern.endsWith(".*")) {
         return type.startsWith(pattern.slice(0, -1));
     }