@every-app/sdk 0.3.0-rc.3 → 0.3.0-rc.4

package/dist/cloudflare/worker.js

@@ -2,7 +2,7 @@ import { createHash, createHmac } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { parseEnv } from "node:util";
-import { DEV_ISSUER, DEV_PUBLIC_KEY_PEM } from "../dev/keypair.js";
+import { DEV_ISSUER, DEV_ORG_ID, DEV_PUBLIC_KEY_PEM } from "../dev/keypair.js";
 import { sentinelDeployTarget, } from "./sentinel.js";
 /** The names of the manifest's `secrets`, whichever form each took. */
 function manifestSecretNames(manifest) {
@@ -256,6 +256,11 @@ function devProviderKeys(manifest, root) {
 }
 /** Cloudflare's limit on a Workflow's name. */
 const MAX_WORKFLOW_NAME_LENGTH = 64;
+/**
+ * The store development binds Secrets Store secrets in: Miniflare keeps
+ * one per id under `.cloudflare/state`, and any id works locally.
+ */
+const LOCAL_SECRETS_STORE_ID = "local";
 /** Cloudflare's limit on a Vectorize index's name. */
 const MAX_VECTORIZE_NAME_LENGTH = 64;
 /** Cloudflare's limit on a Worker's name. */
@@ -312,13 +317,22 @@ export function everyAppWorker(options) {
             value: JSON.stringify([DEV_PUBLIC_KEY_PEM]),
         };
         env["EVERYAPP_IDENTITY_ISSUER"] = { type: "text", value: DEV_ISSUER };
+        // The stub gateway's organization, as the deploy's secret would be, so
+        // background work's withOrganization(env.EVERY_APP_ORG_ID, …) runs
+        // here too. Not a pin: under the dev opt-in everyApp() enforces none,
+        // so `everyapp dev --mode mirror`'s real organizations still open.
+        env["EVERY_APP_ORG_ID"] = { type: "text", value: DEV_ORG_ID };
         addDevProviders(env, options.root);
     }
     Object.assign(env, storageBindings(manifest, name, deploy));
+    addQueueBindings(env, manifest, name, deploy);
     addAiBindings(env, manifest, deploy);
     addBrowserBindings(env, manifest);
     addImagesBindings(env, manifest);
     addAiGatewayBindings(env, manifest, name, deploy);
+    addSendEmailBindings(env, manifest);
+    addSecretsStoreBindings(env, manifest, name, deploy);
+    addAnalyticsEngineBindings(env, manifest, name);
     addDatabaseBindings(env, options, name, undefined, deploy);
     // The app binds every class, a helper Worker's in that Worker, and
     // exports only its own.
@@ -336,13 +350,19 @@ export function everyAppWorker(options) {
         };
     }
     addSecrets(env, options, deploy);
-    const triggers = cronTriggers(options.crons);
+    const triggers = [
+        ...cronTriggers(options.crons),
+        ...queueTriggers(manifest, name, undefined, deploy),
+    ];
     const compatibilityDate = manifest.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE;
     // cf types a Durable Object namespace with its class only when the binding
     // names the defining Worker by a definition whose module it can read, so
     // the classes this Worker defines name it that way; cf resolves the
     // reference to the Worker's name. A path entrypoint gives cf no module.
+    // Only here: `EveryAppBinding` names Workers by name, as the Vite
+    // plugin's `auxiliaryWorkers` require.
     const { entrypoint } = options;
+    const ownClasses = {};
     if (typeof entrypoint === "object") {
         const self = {
             name,
@@ -352,7 +372,7 @@ export function everyAppWorker(options) {
         for (const durableObject of manifest.resources?.durableObjects ?? []) {
             if (durableObject.worker !== undefined)
                 continue;
-            env[durableObject.name] = {
+            ownClasses[durableObject.name] = {
                 type: "durable-object",
                 worker: self,
                 exportName: durableObject.className,
@@ -369,7 +389,8 @@ export function everyAppWorker(options) {
         ...(triggers.length ? { triggers } : {}),
         ...runtimeSettings(manifest, manifest.limits, deploy),
         observability: observability(),
-        env: env,
+        // Each class keeps its key's place in `env`: classBindings bound it by name.
+        env: { ...env, ...ownClasses },
         exports: exports,
     };
 }
@@ -377,8 +398,10 @@ export function everyAppWorker(options) {
  * Build the definition of one of the app's helper Workers (the manifest's
  * `workers`), e.g. one that runs a memory-hungry job away from the app's
  * Worker. It is named `<app worker>--<worker>`, is private like the app, and
- * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI, Browser Rendering and Images, the classes it defines, and
- * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI, Browser Rendering and Vectorize indexes, the classes it defines, and
+ * binds the app's  and Analytics Engine datasets, the classes it defines, and
+ * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI,
+ * Browser Rendering, Images, Vectorize indexes, AI Gateways, `send_email`
+ * bindings and Secrets Store secrets, the classes it defines, and
  * the gateway (with the app's identity, for capabilities). Only the app's
  * Worker reaches it. Pass it to the Vite plugin:
  *
@@ -400,6 +423,8 @@ export function everyAppAuxiliaryWorker(options) {
         EVERYAPP_APP_ID: { type: "text", value: manifest.id },
         ...storageBindings(manifest, appWorker, deploy),
     };
+    addQueueBindings(env, manifest, appWorker, deploy);
+    addSendEmailBindings(env, manifest);
     if (deploy) {
         // The app's identity: the gateway treats its helper Workers as the app.
         env["EVERY_APP_GATEWAY"] = gatewayBinding(deploy, manifest.id, appWorker);
@@ -411,17 +436,23 @@ export function everyAppAuxiliaryWorker(options) {
     else {
         env["EVERYAPP_DEV"] = { type: "text", value: "1" };
         env["EVERYAPP_DEV_CAPABILITIES"] = devCapabilities(manifest);
+        env["EVERY_APP_ORG_ID"] = { type: "text", value: DEV_ORG_ID };
         addDevProviders(env, options.root);
     }
     addAiBindings(env, manifest, deploy);
     addBrowserBindings(env, manifest);
     addImagesBindings(env, manifest);
     addAiGatewayBindings(env, manifest, appWorker, deploy);
+    addSecretsStoreBindings(env, manifest, appWorker, deploy);
+    addAnalyticsEngineBindings(env, manifest, appWorker);
     addDatabaseBindings(env, options, appWorker, worker, deploy);
     const { bindings, exports } = classBindings(manifest, appWorker, worker, env);
     Object.assign(env, bindings);
     addSecrets(env, options, deploy);
-    const triggers = cronTriggers(options.crons);
+    const triggers = [
+        ...cronTriggers(options.crons),
+        ...queueTriggers(manifest, appWorker, worker, deploy),
+    ];
     return {
         name,
         entrypoint: options.entrypoint,
@@ -455,7 +486,7 @@ function appWorkerName(options, builder) {
     let deploy;
     if (ctx.mode === "production") {
         if (process.env[BUILD_ENV] !== "1") {
-            throw new Error(`Every App Workers are built for production only by \`everyapp deploy\` (\`pnpm run deploy\`), which sets ${BUILD_ENV}=1 and installs the build: ` +
+            throw new Error(`EveryApp Workers are built for production only by \`everyapp deploy\` (\`pnpm run deploy\`), which sets ${BUILD_ENV}=1 and installs the build: ` +
                 "a bare `cf build` or `cf deploy` would ship a Worker whose name, identity keys, gateway binding and resources are placeholders. " +
                 "For a local build, run Vite in development mode (`vite build --mode development`).");
         }
@@ -557,6 +588,23 @@ function storageBindings(manifest, appWorker, deploy) {
     }
     return env;
 }
+/**
+ * A producer binding to each of the app's queues, which every one of its
+ * Workers gets. Deployed, each names the queue the deploy provisioned (a
+ * placeholder until installed); in development, the queue its rule gives
+ * (Miniflare makes it, shared by the Workers of one `cf dev`).
+ */
+function addQueueBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.queues ?? []) {
+        if (env[binding]) {
+            throw new Error(`queues: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = {
+            type: "queue",
+            name: queueName(appWorker, binding, deploy),
+        };
+    }
+}
 /**
  * The manifest's Workers AI bindings, which every one of the app's Workers
  * gets: `{ type: "ai" }` deployed (account-wide, nothing to provision), and
@@ -574,6 +622,51 @@ function addAiBindings(env, manifest, deploy) {
             : { type: "ai", dev: { remote: true } };
     }
 }
+/**
+ * The consumer triggers of one of the app's Workers: each queue whose
+ * `consumer` is this Worker (`true`, or no `worker`, for the app's own;
+ * `forWorker` for a helper), with its settings and its dead-letter queue,
+ * another of the app's queues, by name.
+ */
+function queueTriggers(manifest, appWorker, forWorker, deploy) {
+    const triggers = [];
+    for (const queue of manifest.resources?.queues ?? []) {
+        if (queue.consumer === undefined)
+            continue;
+        const settings = queue.consumer === true ? {} : queue.consumer;
+        if (settings.worker !== forWorker)
+            continue;
+        const { deadLetterQueue } = settings;
+        if (deadLetterQueue !== undefined &&
+            !manifest.resources?.queues?.some((other) => other.name === deadLetterQueue)) {
+            throw new Error(`queues: ${queue.name}'s deadLetterQueue "${deadLetterQueue}" isn't one of resources.queues.`);
+        }
+        triggers.push({
+            type: "queue",
+            name: queueName(appWorker, queue.name, deploy),
+            ...(deadLetterQueue !== undefined
+                ? { deadLetterQueue: queueName(appWorker, deadLetterQueue, deploy) }
+                : {}),
+            ...Object.fromEntries(QUEUE_CONSUMER_SETTINGS.flatMap((key) => settings[key] === undefined ? [] : [[key, settings[key]]])),
+        });
+    }
+    return triggers;
+}
+/** The consumer settings a queue trigger carries, in the order it lists them. */
+const QUEUE_CONSUMER_SETTINGS = [
+    "maxBatchSize",
+    "maxBatchTimeout",
+    "maxRetries",
+    "maxConcurrency",
+    "retryDelay",
+    "visibilityTimeoutMs",
+];
+/** A queue binding's queue: the deploy's placeholder, or in development its rule. */
+function queueName(appWorker, binding, deploy) {
+    return deploy
+        ? provisioned(deploy.resources.queues, binding).name
+        : queueNameFor(appWorker, binding);
+}
 /**
  * The manifest's Browser Rendering bindings, which every one of the app's
  * Workers gets: `{ type: "browser" }` in both modes (account-wide,
@@ -618,6 +711,91 @@ function addAiGatewayBindings(env, manifest, appWorker, deploy) {
         env[binding] = { type: "json", value };
     }
 }
+/**
+ * The manifest's `send_email` bindings, the same on every one of the
+ * app's Workers in both modes: Cloudflare's binding with the addresses
+ * the manifest lists (the deploy's policy holds the built lists to them).
+ * Deployed, Cloudflare checks a message against them and the account's
+ * Email Sending domains when the Worker sends; in development Miniflare
+ * logs the message and checks the senders.
+ */
+function addSendEmailBindings(env, manifest) {
+    for (const entry of manifest.resources?.sendEmail ?? []) {
+        if (env[entry.name]) {
+            throw new Error(`sendEmail: ${entry.name} reuses a binding name the Worker already has.`);
+        }
+        const senders = entry.allowedSenderAddresses
+            ? { allowedSenderAddresses: [...entry.allowedSenderAddresses] }
+            : {};
+        if (entry.destinationAddress !== undefined &&
+            entry.allowedDestinationAddresses !== undefined) {
+            throw new Error(`sendEmail: ${entry.name} sets both destinationAddress and allowedDestinationAddresses; set one.`);
+        }
+        env[entry.name] =
+            entry.destinationAddress !== undefined
+                ? {
+                    type: "send-email",
+                    ...senders,
+                    destinationAddress: entry.destinationAddress,
+                }
+                : entry.allowedDestinationAddresses !== undefined
+                    ? {
+                        type: "send-email",
+                        ...senders,
+                        allowedDestinationAddresses: [
+                            ...entry.allowedDestinationAddresses,
+                        ],
+                    }
+                    : { type: "send-email", ...senders };
+    }
+}
+/**
+ * The manifest's Secrets Store secrets, which every one of the app's
+ * Workers binds. Deployed, the store and secret the deploy provisioned
+ * (placeholders until installed); in development the local store `local`,
+ * under the name the deploy would give the secret, so a seeded local
+ * secret is named like a deployed one.
+ */
+function addSecretsStoreBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.secretsStore ?? []) {
+        if (env[binding]) {
+            throw new Error(`secretsStore: ${binding} reuses a binding name the Worker already has.`);
+        }
+        if (deploy) {
+            const secret = provisioned(deploy.resources.secretsStore, binding);
+            env[binding] = {
+                type: "secrets-store-secret",
+                storeId: secret.storeId,
+                secretName: secret.secretName,
+            };
+        }
+        else {
+            env[binding] = {
+                type: "secrets-store-secret",
+                storeId: LOCAL_SECRETS_STORE_ID,
+                secretName: suffixedName(appWorker, binding),
+            };
+        }
+    }
+}
+/**
+ * The manifest's Analytics Engine datasets, which every one of the app's
+ * Workers writes to: the `dataset` an entry names, or
+ * `<app worker>--<binding>`. Deployed, the app's Worker name is the build's
+ * placeholder, which the install rewrites like every other; a named
+ * dataset holds none and stays as written.
+ */
+function addAnalyticsEngineBindings(env, manifest, appWorker) {
+    for (const entry of manifest.resources?.analyticsEngine ?? []) {
+        if (env[entry.name]) {
+            throw new Error(`analyticsEngine: ${entry.name} reuses a binding name the Worker already has.`);
+        }
+        env[entry.name] = {
+            type: "analytics-engine-dataset",
+            name: entry.dataset ?? suffixedName(appWorker, entry.name),
+        };
+    }
+}
 /**
  * DATABASE_PROVIDER and the Hyperdrive configs one of the app's Workers
  * binds: each config every Worker shares, and those a helper (`forWorker`)
@@ -864,9 +1042,10 @@ function workerNameFor(appId) {
 }
 /**
  * Copies of the gateway's naming rules (@every-app/perimeter/manifest's
- * resourceNameFor, bucketNameFor and vectorizeNameFor): `DB` and `KV` (`R2`
- * for a bucket) take the Worker's name, any other binding (and every
- * Vectorize index) `<worker>--<binding>`.
+ * resourceNameFor, bucketNameFor, vectorizeNameFor and storeSecretNameFor):
+ * `DB` and `KV` (`R2` for a bucket) take the Worker's name, any other
+ * binding (and every Vectorize index and Secrets Store secret)
+ * `<worker>--<binding>`.
  */
 function resourceNameFor(workerName, binding) {
     return binding === "DB" || binding === "KV"
@@ -876,6 +1055,10 @@ function resourceNameFor(workerName, binding) {
 function bucketNameFor(workerName, binding) {
     return binding === "R2" ? workerName : suffixedName(workerName, binding);
 }
+/** A copy of @every-app/perimeter/manifest's queueNameFor: `<worker>--<binding>`. */
+function queueNameFor(workerName, binding) {
+    return suffixedName(workerName, binding);
+}
 function suffixedName(workerName, binding) {
     return `${workerName}--${binding.toLowerCase().replaceAll("_", "-")}`;
 }

package/dist/dev/index.d.ts

@@ -3,6 +3,6 @@
  * signs with, its issuer and its key id. For the platform's local dev tools
  * (the CLI, `@every-app/perimeter/dev`); never imported by a Worker.
  */
-export { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
+export { DEV_ISSUER, DEV_ORG_ID, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
 export { IDENTITY_DEV_KEY_ID } from "../internal/protocol.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/dev/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/dev/index.js

@@ -3,5 +3,5 @@
  * signs with, its issuer and its key id. For the platform's local dev tools
  * (the CLI, `@every-app/perimeter/dev`); never imported by a Worker.
  */
-export { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
+export { DEV_ISSUER, DEV_ORG_ID, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
 export { IDENTITY_DEV_KEY_ID } from "../internal/protocol.js";

package/dist/dev/keypair.d.ts

@@ -17,6 +17,8 @@
  */
 /** Issuer of locally minted dev identity tokens. */
 export declare const DEV_ISSUER = "https://gateway.dev.localhost";
+/** The organization the dev gateway's seeded user belongs to (`everyAppWorker()` sets it as `EVERY_APP_ORG_ID` in dev). */
+export declare const DEV_ORG_ID = "dev-org";
 /** SPKI PEM public half of the dev keypair. */
 export declare const DEV_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh40zWf+QK3rJdMTNoy+X\nF9iydV5raWSeEt4DXyeY98c8IZHRjy2UXaaYejweebRsv9Az+bZuL3cfJ0E7pOGd\n4VCOiSG1BjJglmTC1whV4Md6qhLDVOP6iztUJSxDwnlR85UtOyNJ4G5dYY6RrAWl\nPMMXPSYdGWqAP4n5QXAw+7uTFmJMdWy1W8KLbTj//NSGn3DCm+EZJIC8q9yDhMSc\nM0ejJnBVColvp4T8k8dt2kYGu2Wd7dCMrHv/lxUoqD58avpdMOzbaZtwsQ7BAaIa\nmIeQ1AKxmnCj1np23uWvYQmoaZocvupLSALK7fWGUyVDZ+RW4HtN5KqzZypfiyZ8\nkQIDAQAB\n-----END PUBLIC KEY-----\n";
 /** PKCS#8 PEM private half of the dev keypair. Public, see above. */

package/dist/dev/keypair.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../src/dev/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oDAAoD;AACpD,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAE1D,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,idAS9B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,ysDA4B/B,CAAC"}
+{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../src/dev/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oDAAoD;AACpD,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,2HAA2H;AAC3H,eAAO,MAAM,UAAU,YAAY,CAAC;AAEpC,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,idAS9B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,ysDA4B/B,CAAC"}

package/dist/dev/keypair.js

@@ -17,6 +17,8 @@
  */
 /** Issuer of locally minted dev identity tokens. */
 export const DEV_ISSUER = "https://gateway.dev.localhost";
+/** The organization the dev gateway's seeded user belongs to (`everyAppWorker()` sets it as `EVERY_APP_ORG_ID` in dev). */
+export const DEV_ORG_ID = "dev-org";
 /** SPKI PEM public half of the dev keypair. */
 export const DEV_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh40zWf+QK3rJdMTNoy+X

package/dist/internal/capabilities.d.ts

@@ -945,7 +945,7 @@ export declare const CAPABILITIES: {
         readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
         readonly secrets: readonly [{
             readonly name: "ANTHROPIC_API_KEY";
-            readonly hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
         }];
         readonly smoke: {
             readonly method: "GET";

package/dist/internal/catalog/index.d.ts

@@ -420,7 +420,7 @@ export declare const CATALOG_ENTRIES: {
         readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
         readonly secrets: readonly [{
             readonly name: "ANTHROPIC_API_KEY";
-            readonly hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
         }];
         readonly smoke: {
             readonly method: "GET";

package/dist/internal/catalog/inference.d.ts

@@ -23,7 +23,7 @@ export declare const INFERENCE: {
         readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
         readonly secrets: readonly [{
             readonly name: "ANTHROPIC_API_KEY";
-            readonly hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
         }];
         readonly smoke: {
             readonly method: "GET";

package/dist/internal/catalog/inference.js

@@ -1,5 +1,5 @@
 export const INFERENCE = {
-    // Bearer is the documented header today; x-api-key is the legacy fallback. A workspace-scoped key keeps anthropic-workspace-id harmless.
+    // Bearer is the documented header today; x-api-key is the legacy fallback. The Gateway strips anthropic-workspace-id (and x-api-key), so the key alone decides the workspace.
     anthropic: {
         mode: "ai",
         label: "Anthropic",
@@ -28,7 +28,7 @@ export const INFERENCE = {
         secrets: [
             {
                 name: "ANTHROPIC_API_KEY",
-                hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.",
+                hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.",
             },
         ],
         smoke: {
@@ -420,7 +420,7 @@ export const INFERENCE = {
         },
         tags: ["ai", "images", "video", "audio"],
     },
-    // The router forwards X-HF-Bill-To as sent, so an app can bill any organization the token's user belongs to (TODO.md).
+    // The Gateway strips X-HF-Bill-To, so calls bill the token's own account, never another organization the token's user belongs to.
     huggingface: {
         mode: "api_key",
         label: "Hugging Face Inference",

package/dist/internal/events.d.ts

@@ -9,7 +9,7 @@
  * apps/every-app-gateway/src/server/events/catalogue.ts; this module knows
  * the names, versions and one-line descriptions only.
  */
-export type EventGroup = "member" | "app" | "cap" | "tool" | "connection" | "token" | "access" | "signin_provider" | "mcp_app" | "provider" | "ai" | "ping";
+export type EventGroup = "member" | "organization" | "app" | "cap" | "group" | "tool" | "connection" | "token" | "access" | "signin_provider" | "mcp_app" | "provider" | "subscription" | "ai" | "ping";
 export interface EventTypeInfo {
     /** `member.joined`, `cap.reached`, … */
     readonly type: string;

package/dist/internal/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/internal/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,KAAK,GACL,KAAK,GACL,MAAM,GACN,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,iBAAiB,GACjB,SAAS,GACT,UAAU,GACV,IAAI,GACJ,MAAM,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AASD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,aAAa,EAuE/C,CAAC;AAIF,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,QAA0C,CAAC;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWhE;AAED,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,QAAW,CAAC;AACjD,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAC9C,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,sCAAsC;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,yCAAyC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,8DAA8D;AAC9D,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,6BAA6B;AAC7B,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AACF,eAAO,MAAM,2BAA2B,QAAmC,CAAC;AAC5E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,kDAAkD;AAClD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAWxD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,4CAA4C;AAC5C,eAAO,MAAM,WAAW,+BAAgC,CAAC;AACzD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,+BAAgC,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAM1E;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,OAAO,CAET;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAalE;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QACkE,CAAC;AAEtG,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3B,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,gBAAgB,CAAC,CAAC;AAqBvC;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,QAAQ,SAA2B,GAClC,cAAc,CAmDhB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uBAAuB;AACvB,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAY5C"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/internal/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,cAAc,GACd,KAAK,GACL,KAAK,GACL,OAAO,GACP,MAAM,GACN,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,iBAAiB,GACjB,SAAS,GACT,UAAU,GACV,cAAc,GACd,IAAI,GACJ,MAAM,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AASD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,aAAa,EAkI/C,CAAC;AAIF,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,QAA0C,CAAC;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWhE;AAED,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,QAAW,CAAC;AACjD,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAC9C,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,sCAAsC;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,yCAAyC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,8DAA8D;AAC9D,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,6BAA6B;AAC7B,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AACF,eAAO,MAAM,2BAA2B,QAAmC,CAAC;AAC5E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,kDAAkD;AAClD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,oCAAoC,iCACjB,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAWxD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,4CAA4C;AAC5C,eAAO,MAAM,WAAW,+BAAgC,CAAC;AACzD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,+BAAgC,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAU1E;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,OAAO,CAET;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAalE;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QACkE,CAAC;AAEtG,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3B,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,gBAAgB,CAAC,CAAC;AAqBvC;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,QAAQ,SAA2B,GAClC,cAAc,CAmDhB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uBAAuB;AACvB,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAY5C"}

package/dist/internal/events.js

@@ -24,16 +24,29 @@ export const EVENT_TYPES = [
     entry("member", "member.reactivated", "A member was reactivated"),
     entry("member", "member.removed", "A member was removed"),
     entry("member", "member.password_reset", "A member reset their password"),
+    entry("member", "member.invitation_cancelled", "A pending invitation was cancelled"),
+    entry("organization", "organization.renamed", "The workspace was renamed"),
     entry("app", "app.installed", "An app was installed on the Gateway"),
     entry("app", "app.updated", "An app was redeployed"),
+    entry("app", "app.live", "An app went live on the Gateway"),
     entry("app", "app.removed", "An app was removed from the Gateway"),
     entry("app", "app.needs_setup", "An app needs a setting before it opens"),
     entry("app", "app.ready", "An app has every setting it needs"),
     entry("app", "app.paused_cap", "An app is paused: its monthly cap is reached"),
     entry("app", "app.tools_changed", "An app's AI tools changed"),
+    entry("app", "app.renamed", "An app's name or description changed"),
+    entry("app", "app.settings_changed", "An app's settings were set or unset (names only)"),
+    entry("app", "app.access_changed", "Who can open an app changed"),
+    entry("app", "app.email_changed", "An app's email senders or inbound changed"),
     entry("cap", "cap.warning", "An app is at 80% of its monthly cap"),
     entry("cap", "cap.reached", "An app reached its monthly cap"),
     entry("cap", "cap.raised", "An app's monthly cap, or the workspace default, was raised or removed"),
+    entry("cap", "cap.changed", "An app's monthly cap, or the workspace default, was set or lowered"),
+    entry("group", "group.created", "A group was created"),
+    entry("group", "group.updated", "A group was renamed or described"),
+    entry("group", "group.removed", "A group was removed"),
+    entry("group", "group.members_changed", "A group's members changed"),
+    entry("group", "group.apps_changed", "The apps a group opens changed"),
     entry("tool", "tool.blocked", "An AI client's tool call was blocked"),
     entry("tool", "tool.error", "An AI client's tool call failed"),
     entry("connection", "connection.created", "An AI app was connected"),
@@ -47,12 +60,18 @@ export const EVENT_TYPES = [
     entry("mcp_app", "mcp_app.removed", "An MCP app was removed"),
     entry("mcp_app", "mcp_app.enabled", "An MCP app is being served again"),
     entry("mcp_app", "mcp_app.disabled", "An MCP app stopped being served"),
+    entry("mcp_app", "mcp_app.updated", "An MCP app's risk default, name or description changed"),
+    entry("mcp_app", "mcp_app.tool_changed", "One tool of an MCP app was overridden: its risk, or on/off"),
     entry("provider", "provider.added", "A provider was registered"),
     entry("provider", "provider.removed", "A provider was removed"),
     entry("provider", "provider.updated", "A provider's spec or OAuth client was replaced"),
     entry("provider", "provider.connected", "Someone connected an account at an OAuth provider"),
     entry("provider", "provider.disconnected", "An OAuth provider account was disconnected"),
     entry("provider", "provider.connection_expired", "An OAuth provider refused to refresh a connection; it needs reconnecting"),
+    entry("subscription", "subscription.created", "An event subscription was added"),
+    entry("subscription", "subscription.updated", "An event subscription was changed, paused or resumed"),
+    entry("subscription", "subscription.removed", "An event subscription was removed"),
+    entry("subscription", "subscription.redelivered", "A delivery was queued again by hand"),
     entry("ai", "ai.default_changed", "The default model provider changed"),
     entry("ping", "ping", "A test event, sent to one subscription on request"),
 ];
@@ -190,8 +209,11 @@ export const EVENT_EMAIL_RECIPIENTS = ["owners", "admins"];
  * gateway's app events and every app's own.
  */
 export function eventPatternMatches(pattern, type) {
+    // Everything but a test ping and the bus's own housekeeping: a webhook
+    // hears about subscriptions only when it names `subscription.*`, so a
+    // catch-all's first delivery is the event it was made for, not itself.
     if (pattern === "*")
-        return type !== "ping";
+        return type !== "ping" && !type.startsWith("subscription.");
     if (pattern.endsWith(".*")) {
         return type.startsWith(pattern.slice(0, -1));
     }

package/dist/internal/identity.d.ts

@@ -1,5 +1,5 @@
-import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, type SystemClaims, type SystemTokenPurpose } from "./protocol.js";
-export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, };
+import { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, type SystemClaims, type SystemTokenPurpose } from "./protocol.js";
+export { APP_ID_ENV, DEV_ENV, DEV_ISSUER, IDENTITY_ALG, IDENTITY_DEV_KEY_ID, IDENTITY_HEADER, IDENTITY_KEY_ID, ISSUER_ENV, ORG_ID_ENV, PUBLIC_HEADER, PUBLIC_KEYS_ENV, PUBLIC_MARKER_SUB, type EveryAppUser, type IdentityChannel, };
 export declare class IdentityError extends Error {
     readonly status = 401;
     constructor(message: string);
@@ -35,6 +35,25 @@ export interface VerifyOptions {
  * claims).
  */
 export declare function verifyIdentityJwt(token: string, options: VerifyOptions): Promise<EveryAppUser>;
+/** A verified identity, with when it stops being one. */
+export interface VerifiedIdentity {
+    user: EveryAppUser;
+    /** The token's `exp`, in epoch milliseconds. */
+    expiresAt: number;
+}
+/**
+ * {@link verifyIdentityJwt}, keeping the token's expiry: the SDK's request
+ * context stops forwarding an identity shortly before it, and goes on as
+ * the organization's background work.
+ */
+export declare function verifyIdentity(token: string, options: VerifyOptions): Promise<VerifiedIdentity>;
+/**
+ * The organization pin: a deployed Worker serves one organization
+ * (`EVERY_APP_ORG_ID`), and an identity for any other is refused, whatever
+ * its audience says. Throws {@link IdentityError} on a mismatch; a Worker
+ * with no pin (a shared app's) accepts every organization.
+ */
+export declare function assertOrganizationPin(user: EveryAppUser, organizationId: string | undefined): void;
 /**
  * Verify the gateway's system token (the value of `x-everyapp-system`)
  * fail-closed, for exactly one purpose. A user identity or public marker is
@@ -56,9 +75,16 @@ export interface IdentityResult {
     user: EveryAppUser | null;
     /** True when the gateway marked this request as a public route. */
     isPublic: boolean;
+    /** When the identity expires (epoch ms); null on a public route. */
+    expiresAt: number | null;
 }
 export interface RequestIdentityOptions {
     audience: string;
+    /**
+     * The organization this Worker is pinned to ({@link ORG_ID_ENV}): an
+     * identity for another is refused. Undefined accepts every organization.
+     */
+    organizationId?: string;
     /** Provide keys directly, or let {@link getIdentityFromRequest} read env. */
     publicKeys?: string[];
     /** Env bag to read {@link PUBLIC_KEYS_ENV} / {@link DEV_ENV} from. */
@@ -84,5 +110,5 @@ export declare function resolveVerifyOptions(options: RequestIdentityOptions): V
  * problem — including a bare/forged public header — so a re-exposed worker
  * fails closed.
  */
-export declare function getIdentityFromRequest(request: Request, options: RequestIdentityOptions): Promise<IdentityResult>;
+export declare function getIdentityFromRequest(request: Request | Headers, options: RequestIdentityOptions): Promise<IdentityResult>;
 //# sourceMappingURL=identity.d.ts.map

package/dist/internal/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/internal/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EAKjB,KAAK,YAAY,EACjB,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,CA8B7E;AAYD,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAeD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACvD,OAAO,CAAC,YAAY,CAAC,CAUvB;AAoED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,aAAa,CAwBf;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAiBzB"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/internal/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EAKjB,KAAK,YAAY,EACjB,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,CA8B7E;AAYD,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAeD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAY3B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAMN;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACvD,OAAO,CAAC,YAAY,CAAC,CAUvB;AAoED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAC9B,aAAa,CAwBf;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAmBzB"}