@every-app/sdk 0.3.0-rc.3 → 0.3.0-rc.5

package/dist/cloudflare/worker.js

@@ -2,7 +2,11 @@ import { createHash, createHmac } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { parseEnv } from "node:util";
-import { DEV_ISSUER, DEV_PUBLIC_KEY_PEM } from "../dev/keypair.js";
+import { DEV_ISSUER, DEV_ORG_ID, DEV_PUBLIC_KEY_PEM } from "../dev/keypair.js";
+// The catalog's settings, generated from ../internal/capabilities.ts, which
+// this file must not import (see ./index.ts: the Vite plugin hides whatever
+// cloudflare.config.ts imports from the Worker).
+import { DEV_GATEWAY_KEYS } from "./catalogSettings.generated.js";
 import { sentinelDeployTarget, } from "./sentinel.js";
 /** The names of the manifest's `secrets`, whichever form each took. */
 function manifestSecretNames(manifest) {
@@ -12,131 +16,6 @@ function manifestSecretNames(manifest) {
 function manifestProviderIds(manifest) {
     return (manifest.providers ?? []).map((entry) => typeof entry === "string" ? entry : entry.id);
 }
-/**
- * The gateway secrets holding the keys of the AI providers and capabilities
- * an app may ask for, with the settings a provider needs besides its key
- * (Workers AI's account, a Basic username held as a setting, a host
- * setting). With no gateway in development, the SDK reaches them with the
- * developer's own values under the same names. A copy of the catalog's
- * settings (`capabilitySettings()` over every entry of
- * ../internal/capabilities.ts), which the Worker loads and this file must
- * not import (see ./index.ts: the Vite plugin hides whatever
- * cloudflare.config.ts imports from the Worker). worker.test.ts keeps the
- * copy in step: a provider added to the catalog is added here.
- */
-const DEV_GATEWAY_KEYS = {
-    providers: {
-        openai: ["OPENAI_API_KEY"],
-        openrouter: ["OPENROUTER_API_KEY"],
-        "workers-ai": ["WORKERS_AI_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID"],
-        // Not Cloudflare AI Gateway (the proxy entry): dev goes to the
-        // providers directly, so its settings are the Gateway's alone.
-        // The AI providers of ../internal/catalog/inference.ts.
-        anthropic: ["ANTHROPIC_API_KEY"],
-        gemini: ["GEMINI_API_KEY"],
-        mistral: ["MISTRAL_API_KEY"],
-        groq: ["GROQ_API_KEY"],
-        cohere: ["COHERE_API_KEY"],
-    },
-    capabilities: {
-        dataforseo: ["DATAFORSEO_API_KEY"],
-        context: ["CONTEXT_API_KEY"],
-        // The sender, and the developer's own Email Sending account: set all
-        // but the name and sendEmail() really sends; otherwise it prints.
-        // Resend's key and EMAIL_PROVIDER pick the provider integrationStatus()
-        // names, as the gateway would.
-        // TODO(integration): the last two added by the email-providers lane
-        // (this file is outside its ownership list).
-        email: [
-            "EMAIL_FROM",
-            "EMAIL_FROM_NAME",
-            "EMAIL_REST_API_TOKEN",
-            "CLOUDFLARE_ACCOUNT_ID",
-            "RESEND_API_KEY",
-            "EMAIL_PROVIDER",
-        ],
-        // The organization's members: nothing to set; listMembers() answers
-        // from the dev identity.
-        members: [],
-        // OAuth clients: the id, the secret, and the instance a provider with
-        // no fixed host is on.
-        linkedin: ["LINKEDIN_CLIENT_ID", "LINKEDIN_CLIENT_SECRET"],
-        facebook: ["FACEBOOK_APP_ID", "FACEBOOK_APP_SECRET"],
-        instagram: ["INSTAGRAM_APP_ID", "INSTAGRAM_APP_SECRET"],
-        threads: ["THREADS_APP_ID", "THREADS_APP_SECRET"],
-        youtube: ["YOUTUBE_CLIENT_ID", "YOUTUBE_CLIENT_SECRET"],
-        tiktok: ["TIKTOK_CLIENT_ID", "TIKTOK_CLIENT_SECRET"],
-        "tiktok-business": [
-            "TIKTOK_BUSINESS_CLIENT_ID",
-            "TIKTOK_BUSINESS_CLIENT_SECRET",
-        ],
-        reddit: ["REDDIT_CLIENT_ID", "REDDIT_CLIENT_SECRET"],
-        pinterest: ["PINTEREST_CLIENT_ID", "PINTEREST_CLIENT_SECRET"],
-        discord: ["DISCORD_CLIENT_ID", "DISCORD_CLIENT_SECRET"],
-        slack: ["SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET"],
-        mastodon: ["MASTODON_CLIENT_ID", "MASTODON_CLIENT_SECRET", "MASTODON_URL"],
-        kick: ["KICK_CLIENT_ID", "KICK_CLIENT_SECRET"],
-        twitch: ["TWITCH_CLIENT_ID", "TWITCH_CLIENT_SECRET"],
-        tumblr: ["TUMBLR_CLIENT_ID", "TUMBLR_CLIENT_SECRET"],
-        dribbble: ["DRIBBBLE_CLIENT_ID", "DRIBBBLE_CLIENT_SECRET"],
-        "google-workspace": [
-            "GOOGLE_WORKSPACE_CLIENT_ID",
-            "GOOGLE_WORKSPACE_CLIENT_SECRET",
-        ],
-        "microsoft-365": ["MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET"],
-        // The API-key providers of ../internal/catalog/*.ts, in catalog order:
-        // the key, then a Basic username held as a setting, then the host
-        // setting of a provider whose host is the operator's.
-        stripe: ["STRIPE_API_KEY"],
-        lemonsqueezy: ["LEMONSQUEEZY_API_KEY"],
-        paddle: ["PADDLE_API_KEY"],
-        shopify: ["SHOPIFY_API_TOKEN", "SHOPIFY_HOST"],
-        plaid: ["PLAID_SECRET"],
-        attio: ["ATTIO_API_KEY"],
-        hubspot: ["HUBSPOT_API_TOKEN"],
-        pipedrive: ["PIPEDRIVE_API_TOKEN"],
-        airtable: ["AIRTABLE_API_TOKEN"],
-        notion: ["NOTION_API_TOKEN"],
-        postmark: ["POSTMARK_API_TOKEN"],
-        sendgrid: ["SENDGRID_API_KEY"],
-        twilio: ["TWILIO_API_SECRET", "TWILIO_API_KEY"],
-        intercom: ["INTERCOM_API_TOKEN"],
-        crisp: ["CRISP_API_KEY", "CRISP_API_IDENTIFIER"],
-        linear: ["LINEAR_API_KEY"],
-        github: ["GITHUB_API_TOKEN"],
-        gitlab: ["GITLAB_API_TOKEN"],
-        vercel: ["VERCEL_API_TOKEN"],
-        cloudflare: ["CLOUDFLARE_PROVIDER_API_TOKEN"],
-        posthog: ["POSTHOG_PERSONAL_API_KEY"],
-        mixpanel: [
-            "MIXPANEL_SERVICE_ACCOUNT_SECRET",
-            "MIXPANEL_SERVICE_ACCOUNT_USERNAME",
-        ],
-        segment: ["SEGMENT_WRITE_KEY"],
-        supabase: ["SUPABASE_SECRET_KEY", "SUPABASE_HOST"],
-        turso: ["TURSO_API_TOKEN"],
-        "turso-db": ["TURSO_DB_AUTH_TOKEN", "TURSO_DB_HOST"],
-        neon: ["NEON_API_KEY"],
-        pinecone: ["PINECONE_API_KEY", "PINECONE_HOST"],
-        mapbox: ["MAPBOX_ACCESS_TOKEN"],
-        openweather: ["OPENWEATHER_API_KEY"],
-        voyage: ["VOYAGE_API_KEY"],
-        perplexity: ["PERPLEXITY_API_KEY"],
-        jina: ["JINA_API_KEY"],
-        replicate: ["REPLICATE_API_TOKEN"],
-        huggingface: ["HUGGINGFACE_API_TOKEN"],
-        firecrawl: ["FIRECRAWL_API_KEY"],
-        exa: ["EXA_API_KEY"],
-        tavily: ["TAVILY_API_KEY"],
-        serper: ["SERPER_API_KEY"],
-        "brave-search": ["BRAVE_SEARCH_API_KEY"],
-        apify: ["APIFY_API_TOKEN"],
-        deepgram: ["DEEPGRAM_API_KEY"],
-        elevenlabs: ["ELEVENLABS_API_KEY"],
-        assemblyai: ["ASSEMBLYAI_API_KEY"],
-        newsapi: ["NEWSAPI_API_KEY"],
-    },
-};
 /**
  * Observability every Every App Worker ships with: logs (with invocation
  * logs), sampled traces and Workers Issues, with query strings redacted so
@@ -166,6 +45,19 @@ const BUILD_ENV = "EVERYAPP_BUILD";
 const RESERVED_SECRET_NAME = /^(GATEWAY_URL|CF_VERSION_METADATA|EVERYAPP_\w*|EVERY_APP_\w*|APP__\w*)$/i;
 const GATEWAY_WORKER_NAME = "every-app-gateway";
 const GATEWAY_ENTRYPOINT = "AppGateway";
+/**
+ * Where `everyapp dev` serves its launcher, which it passes to the app's dev
+ * server in EVERYAPP_DEV_GATEWAY_URL; its default address otherwise. The
+ * deployed Worker gets the Gateway's URL from the deploy instead.
+ */
+const DEV_GATEWAY_URL_ENV = "EVERYAPP_DEV_GATEWAY_URL";
+const DEFAULT_DEV_GATEWAY_URL = "http://localhost:8787";
+function devGatewayUrl() {
+    return {
+        type: "text",
+        value: process.env[DEV_GATEWAY_URL_ENV] || DEFAULT_DEV_GATEWAY_URL,
+    };
+}
 /**
  * The manifest's `capabilities` as the SDK's local-dev twin of the gateway
  * reads them: with no gateway to hold an OAuth client's calls to the scope
@@ -177,7 +69,7 @@ function devCapabilities(manifest) {
 /**
  * The binding the dev Worker gets the specs of providers registered on a
  * gateway in (`DEV_PROVIDERS_ENV` in ../internal/devProviders.ts; a copy,
- * kept in step by a test, for the reason {@link DEV_GATEWAY_KEYS} is one).
+ * kept in step by a test, since this file may not import ../internal).
  */
 const DEV_PROVIDERS_ENV = "EVERYAPP_DEV_PROVIDERS";
 /**
@@ -256,6 +148,11 @@ function devProviderKeys(manifest, root) {
 }
 /** Cloudflare's limit on a Workflow's name. */
 const MAX_WORKFLOW_NAME_LENGTH = 64;
+/**
+ * The store development binds Secrets Store secrets in: Miniflare keeps
+ * one per id under `.cloudflare/state`, and any id works locally.
+ */
+const LOCAL_SECRETS_STORE_ID = "local";
 /** Cloudflare's limit on a Vectorize index's name. */
 const MAX_VECTORIZE_NAME_LENGTH = 64;
 /** Cloudflare's limit on a Worker's name. */
@@ -286,6 +183,12 @@ export function everyAppWorker(options) {
     const { deploy, name } = appWorkerName(options, "everyAppWorker");
     const env = {
         EVERYAPP_APP_ID: { type: "text", value: manifest.id },
+        // The manifest itself, for a page that shows what the app asked for:
+        // the Worker can't import everyapp.config.ts (see ./index.ts).
+        EVERYAPP_MANIFEST: {
+            type: "json",
+            value: manifest,
+        },
         CF_VERSION_METADATA: { type: "version-metadata" },
     };
     if (deploy) {
@@ -312,13 +215,23 @@ export function everyAppWorker(options) {
             value: JSON.stringify([DEV_PUBLIC_KEY_PEM]),
         };
         env["EVERYAPP_IDENTITY_ISSUER"] = { type: "text", value: DEV_ISSUER };
+        env["GATEWAY_URL"] = devGatewayUrl();
+        // The stub gateway's organization, as the deploy's secret would be, so
+        // background work's withOrganization(env.EVERY_APP_ORG_ID, …) runs
+        // here too. Not a pin: under the dev opt-in everyApp() enforces none,
+        // so `everyapp dev --mode mirror`'s real organizations still open.
+        env["EVERY_APP_ORG_ID"] = { type: "text", value: DEV_ORG_ID };
         addDevProviders(env, options.root);
     }
     Object.assign(env, storageBindings(manifest, name, deploy));
+    addQueueBindings(env, manifest, name, deploy);
     addAiBindings(env, manifest, deploy);
     addBrowserBindings(env, manifest);
     addImagesBindings(env, manifest);
     addAiGatewayBindings(env, manifest, name, deploy);
+    addSendEmailBindings(env, manifest);
+    addSecretsStoreBindings(env, manifest, name, deploy);
+    addAnalyticsEngineBindings(env, manifest, name);
     addDatabaseBindings(env, options, name, undefined, deploy);
     // The app binds every class, a helper Worker's in that Worker, and
     // exports only its own.
@@ -336,13 +249,19 @@ export function everyAppWorker(options) {
         };
     }
     addSecrets(env, options, deploy);
-    const triggers = cronTriggers(options.crons);
+    const triggers = [
+        ...cronTriggers(options.crons),
+        ...queueTriggers(manifest, name, undefined, deploy),
+    ];
     const compatibilityDate = manifest.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE;
     // cf types a Durable Object namespace with its class only when the binding
     // names the defining Worker by a definition whose module it can read, so
     // the classes this Worker defines name it that way; cf resolves the
     // reference to the Worker's name. A path entrypoint gives cf no module.
+    // Only here: `EveryAppBinding` names Workers by name, as the Vite
+    // plugin's `auxiliaryWorkers` require.
     const { entrypoint } = options;
+    const ownClasses = {};
     if (typeof entrypoint === "object") {
         const self = {
             name,
@@ -352,7 +271,7 @@ export function everyAppWorker(options) {
         for (const durableObject of manifest.resources?.durableObjects ?? []) {
             if (durableObject.worker !== undefined)
                 continue;
-            env[durableObject.name] = {
+            ownClasses[durableObject.name] = {
                 type: "durable-object",
                 worker: self,
                 exportName: durableObject.className,
@@ -369,7 +288,8 @@ export function everyAppWorker(options) {
         ...(triggers.length ? { triggers } : {}),
         ...runtimeSettings(manifest, manifest.limits, deploy),
         observability: observability(),
-        env: env,
+        // Each class keeps its key's place in `env`: classBindings bound it by name.
+        env: { ...env, ...ownClasses },
         exports: exports,
     };
 }
@@ -377,8 +297,10 @@ export function everyAppWorker(options) {
  * Build the definition of one of the app's helper Workers (the manifest's
  * `workers`), e.g. one that runs a memory-hungry job away from the app's
  * Worker. It is named `<app worker>--<worker>`, is private like the app, and
- * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI, Browser Rendering and Images, the classes it defines, and
- * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI, Browser Rendering and Vectorize indexes, the classes it defines, and
+ * binds the app's  and Analytics Engine datasets, the classes it defines, and
+ * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI,
+ * Browser Rendering, Images, Vectorize indexes, AI Gateways, `send_email`
+ * bindings and Secrets Store secrets, the classes it defines, and
  * the gateway (with the app's identity, for capabilities). Only the app's
  * Worker reaches it. Pass it to the Vite plugin:
  *
@@ -400,6 +322,8 @@ export function everyAppAuxiliaryWorker(options) {
         EVERYAPP_APP_ID: { type: "text", value: manifest.id },
         ...storageBindings(manifest, appWorker, deploy),
     };
+    addQueueBindings(env, manifest, appWorker, deploy);
+    addSendEmailBindings(env, manifest);
     if (deploy) {
         // The app's identity: the gateway treats its helper Workers as the app.
         env["EVERY_APP_GATEWAY"] = gatewayBinding(deploy, manifest.id, appWorker);
@@ -411,17 +335,24 @@ export function everyAppAuxiliaryWorker(options) {
     else {
         env["EVERYAPP_DEV"] = { type: "text", value: "1" };
         env["EVERYAPP_DEV_CAPABILITIES"] = devCapabilities(manifest);
+        env["GATEWAY_URL"] = devGatewayUrl();
+        env["EVERY_APP_ORG_ID"] = { type: "text", value: DEV_ORG_ID };
         addDevProviders(env, options.root);
     }
     addAiBindings(env, manifest, deploy);
     addBrowserBindings(env, manifest);
     addImagesBindings(env, manifest);
     addAiGatewayBindings(env, manifest, appWorker, deploy);
+    addSecretsStoreBindings(env, manifest, appWorker, deploy);
+    addAnalyticsEngineBindings(env, manifest, appWorker);
     addDatabaseBindings(env, options, appWorker, worker, deploy);
     const { bindings, exports } = classBindings(manifest, appWorker, worker, env);
     Object.assign(env, bindings);
     addSecrets(env, options, deploy);
-    const triggers = cronTriggers(options.crons);
+    const triggers = [
+        ...cronTriggers(options.crons),
+        ...queueTriggers(manifest, appWorker, worker, deploy),
+    ];
     return {
         name,
         entrypoint: options.entrypoint,
@@ -455,7 +386,7 @@ function appWorkerName(options, builder) {
     let deploy;
     if (ctx.mode === "production") {
         if (process.env[BUILD_ENV] !== "1") {
-            throw new Error(`Every App Workers are built for production only by \`everyapp deploy\` (\`pnpm run deploy\`), which sets ${BUILD_ENV}=1 and installs the build: ` +
+            throw new Error(`EveryApp Workers are built for production only by \`everyapp deploy\` (\`pnpm run deploy\`), which sets ${BUILD_ENV}=1 and installs the build: ` +
                 "a bare `cf build` or `cf deploy` would ship a Worker whose name, identity keys, gateway binding and resources are placeholders. " +
                 "For a local build, run Vite in development mode (`vite build --mode development`).");
         }
@@ -557,6 +488,23 @@ function storageBindings(manifest, appWorker, deploy) {
     }
     return env;
 }
+/**
+ * A producer binding to each of the app's queues, which every one of its
+ * Workers gets. Deployed, each names the queue the deploy provisioned (a
+ * placeholder until installed); in development, the queue its rule gives
+ * (Miniflare makes it, shared by the Workers of one `cf dev`).
+ */
+function addQueueBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.queues ?? []) {
+        if (env[binding]) {
+            throw new Error(`queues: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = {
+            type: "queue",
+            name: queueName(appWorker, binding, deploy),
+        };
+    }
+}
 /**
  * The manifest's Workers AI bindings, which every one of the app's Workers
  * gets: `{ type: "ai" }` deployed (account-wide, nothing to provision), and
@@ -574,6 +522,51 @@ function addAiBindings(env, manifest, deploy) {
             : { type: "ai", dev: { remote: true } };
     }
 }
+/**
+ * The consumer triggers of one of the app's Workers: each queue whose
+ * `consumer` is this Worker (`true`, or no `worker`, for the app's own;
+ * `forWorker` for a helper), with its settings and its dead-letter queue,
+ * another of the app's queues, by name.
+ */
+function queueTriggers(manifest, appWorker, forWorker, deploy) {
+    const triggers = [];
+    for (const queue of manifest.resources?.queues ?? []) {
+        if (queue.consumer === undefined)
+            continue;
+        const settings = queue.consumer === true ? {} : queue.consumer;
+        if (settings.worker !== forWorker)
+            continue;
+        const { deadLetterQueue } = settings;
+        if (deadLetterQueue !== undefined &&
+            !manifest.resources?.queues?.some((other) => other.name === deadLetterQueue)) {
+            throw new Error(`queues: ${queue.name}'s deadLetterQueue "${deadLetterQueue}" isn't one of resources.queues.`);
+        }
+        triggers.push({
+            type: "queue",
+            name: queueName(appWorker, queue.name, deploy),
+            ...(deadLetterQueue !== undefined
+                ? { deadLetterQueue: queueName(appWorker, deadLetterQueue, deploy) }
+                : {}),
+            ...Object.fromEntries(QUEUE_CONSUMER_SETTINGS.flatMap((key) => settings[key] === undefined ? [] : [[key, settings[key]]])),
+        });
+    }
+    return triggers;
+}
+/** The consumer settings a queue trigger carries, in the order it lists them. */
+const QUEUE_CONSUMER_SETTINGS = [
+    "maxBatchSize",
+    "maxBatchTimeout",
+    "maxRetries",
+    "maxConcurrency",
+    "retryDelay",
+    "visibilityTimeoutMs",
+];
+/** A queue binding's queue: the deploy's placeholder, or in development its rule. */
+function queueName(appWorker, binding, deploy) {
+    return deploy
+        ? provisioned(deploy.resources.queues, binding).name
+        : queueNameFor(appWorker, binding);
+}
 /**
  * The manifest's Browser Rendering bindings, which every one of the app's
  * Workers gets: `{ type: "browser" }` in both modes (account-wide,
@@ -618,6 +611,91 @@ function addAiGatewayBindings(env, manifest, appWorker, deploy) {
         env[binding] = { type: "json", value };
     }
 }
+/**
+ * The manifest's `send_email` bindings, the same on every one of the
+ * app's Workers in both modes: Cloudflare's binding with the addresses
+ * the manifest lists (the deploy's policy holds the built lists to them).
+ * Deployed, Cloudflare checks a message against them and the account's
+ * Email Sending domains when the Worker sends; in development Miniflare
+ * logs the message and checks the senders.
+ */
+function addSendEmailBindings(env, manifest) {
+    for (const entry of manifest.resources?.sendEmail ?? []) {
+        if (env[entry.name]) {
+            throw new Error(`sendEmail: ${entry.name} reuses a binding name the Worker already has.`);
+        }
+        const senders = entry.allowedSenderAddresses
+            ? { allowedSenderAddresses: [...entry.allowedSenderAddresses] }
+            : {};
+        if (entry.destinationAddress !== undefined &&
+            entry.allowedDestinationAddresses !== undefined) {
+            throw new Error(`sendEmail: ${entry.name} sets both destinationAddress and allowedDestinationAddresses; set one.`);
+        }
+        env[entry.name] =
+            entry.destinationAddress !== undefined
+                ? {
+                    type: "send-email",
+                    ...senders,
+                    destinationAddress: entry.destinationAddress,
+                }
+                : entry.allowedDestinationAddresses !== undefined
+                    ? {
+                        type: "send-email",
+                        ...senders,
+                        allowedDestinationAddresses: [
+                            ...entry.allowedDestinationAddresses,
+                        ],
+                    }
+                    : { type: "send-email", ...senders };
+    }
+}
+/**
+ * The manifest's Secrets Store secrets, which every one of the app's
+ * Workers binds. Deployed, the store and secret the deploy provisioned
+ * (placeholders until installed); in development the local store `local`,
+ * under the name the deploy would give the secret, so a seeded local
+ * secret is named like a deployed one.
+ */
+function addSecretsStoreBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.secretsStore ?? []) {
+        if (env[binding]) {
+            throw new Error(`secretsStore: ${binding} reuses a binding name the Worker already has.`);
+        }
+        if (deploy) {
+            const secret = provisioned(deploy.resources.secretsStore, binding);
+            env[binding] = {
+                type: "secrets-store-secret",
+                storeId: secret.storeId,
+                secretName: secret.secretName,
+            };
+        }
+        else {
+            env[binding] = {
+                type: "secrets-store-secret",
+                storeId: LOCAL_SECRETS_STORE_ID,
+                secretName: suffixedName(appWorker, binding),
+            };
+        }
+    }
+}
+/**
+ * The manifest's Analytics Engine datasets, which every one of the app's
+ * Workers writes to: the `dataset` an entry names, or
+ * `<app worker>--<binding>`. Deployed, the app's Worker name is the build's
+ * placeholder, which the install rewrites like every other; a named
+ * dataset holds none and stays as written.
+ */
+function addAnalyticsEngineBindings(env, manifest, appWorker) {
+    for (const entry of manifest.resources?.analyticsEngine ?? []) {
+        if (env[entry.name]) {
+            throw new Error(`analyticsEngine: ${entry.name} reuses a binding name the Worker already has.`);
+        }
+        env[entry.name] = {
+            type: "analytics-engine-dataset",
+            name: entry.dataset ?? suffixedName(appWorker, entry.name),
+        };
+    }
+}
 /**
  * DATABASE_PROVIDER and the Hyperdrive configs one of the app's Workers
  * binds: each config every Worker shares, and those a helper (`forWorker`)
@@ -864,9 +942,10 @@ function workerNameFor(appId) {
 }
 /**
  * Copies of the gateway's naming rules (@every-app/perimeter/manifest's
- * resourceNameFor, bucketNameFor and vectorizeNameFor): `DB` and `KV` (`R2`
- * for a bucket) take the Worker's name, any other binding (and every
- * Vectorize index) `<worker>--<binding>`.
+ * resourceNameFor, bucketNameFor, vectorizeNameFor and storeSecretNameFor):
+ * `DB` and `KV` (`R2` for a bucket) take the Worker's name, any other
+ * binding (and every Vectorize index and Secrets Store secret)
+ * `<worker>--<binding>`.
  */
 function resourceNameFor(workerName, binding) {
     return binding === "DB" || binding === "KV"
@@ -876,6 +955,10 @@ function resourceNameFor(workerName, binding) {
 function bucketNameFor(workerName, binding) {
     return binding === "R2" ? workerName : suffixedName(workerName, binding);
 }
+/** A copy of @every-app/perimeter/manifest's queueNameFor: `<worker>--<binding>`. */
+function queueNameFor(workerName, binding) {
+    return suffixedName(workerName, binding);
+}
 function suffixedName(workerName, binding) {
     return `${workerName}--${binding.toLowerCase().replaceAll("_", "-")}`;
 }

package/dist/dev/index.d.ts

@@ -3,6 +3,6 @@
  * signs with, its issuer and its key id. For the platform's local dev tools
  * (the CLI, `@every-app/perimeter/dev`); never imported by a Worker.
  */
-export { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
+export { DEV_ISSUER, DEV_ORG_ID, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
 export { IDENTITY_DEV_KEY_ID } from "../internal/protocol.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/dev/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/dev/index.js

@@ -3,5 +3,5 @@
  * signs with, its issuer and its key id. For the platform's local dev tools
  * (the CLI, `@every-app/perimeter/dev`); never imported by a Worker.
  */
-export { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
+export { DEV_ISSUER, DEV_ORG_ID, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
 export { IDENTITY_DEV_KEY_ID } from "../internal/protocol.js";

package/dist/dev/keypair.d.ts

@@ -17,6 +17,8 @@
  */
 /** Issuer of locally minted dev identity tokens. */
 export declare const DEV_ISSUER = "https://gateway.dev.localhost";
+/** The organization the dev gateway's seeded user belongs to (`everyAppWorker()` sets it as `EVERY_APP_ORG_ID` in dev). */
+export declare const DEV_ORG_ID = "dev-org";
 /** SPKI PEM public half of the dev keypair. */
 export declare const DEV_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh40zWf+QK3rJdMTNoy+X\nF9iydV5raWSeEt4DXyeY98c8IZHRjy2UXaaYejweebRsv9Az+bZuL3cfJ0E7pOGd\n4VCOiSG1BjJglmTC1whV4Md6qhLDVOP6iztUJSxDwnlR85UtOyNJ4G5dYY6RrAWl\nPMMXPSYdGWqAP4n5QXAw+7uTFmJMdWy1W8KLbTj//NSGn3DCm+EZJIC8q9yDhMSc\nM0ejJnBVColvp4T8k8dt2kYGu2Wd7dCMrHv/lxUoqD58avpdMOzbaZtwsQ7BAaIa\nmIeQ1AKxmnCj1np23uWvYQmoaZocvupLSALK7fWGUyVDZ+RW4HtN5KqzZypfiyZ8\nkQIDAQAB\n-----END PUBLIC KEY-----\n";
 /** PKCS#8 PEM private half of the dev keypair. Public, see above. */

package/dist/dev/keypair.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../src/dev/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oDAAoD;AACpD,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAE1D,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,idAS9B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,ysDA4B/B,CAAC"}
+{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../src/dev/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oDAAoD;AACpD,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAC1D,2HAA2H;AAC3H,eAAO,MAAM,UAAU,YAAY,CAAC;AAEpC,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,idAS9B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,ysDA4B/B,CAAC"}

package/dist/dev/keypair.js

@@ -17,6 +17,8 @@
  */
 /** Issuer of locally minted dev identity tokens. */
 export const DEV_ISSUER = "https://gateway.dev.localhost";
+/** The organization the dev gateway's seeded user belongs to (`everyAppWorker()` sets it as `EVERY_APP_ORG_ID` in dev). */
+export const DEV_ORG_ID = "dev-org";
 /** SPKI PEM public half of the dev keypair. */
 export const DEV_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh40zWf+QK3rJdMTNoy+X

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @every-app/sdk — what `everyapp.config.ts` imports: `defineEveryApp` and
+ * the manifest's types. A leaf, like the config itself (see ./manifest.ts).
+ */
+export { defineEveryApp, type EveryAppCapabilityEntry, type EveryAppClassResource, type EveryAppManifest, type EveryAppPublicRoute, type EveryAppQueueConsumer, type EveryAppResources, type EveryAppSecretEntry, type EveryAppSettingNeed, type EveryAppWorkerLimits, } from "./manifest.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,cAAc,EACd,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+/**
+ * @every-app/sdk — what `everyapp.config.ts` imports: `defineEveryApp` and
+ * the manifest's types. A leaf, like the config itself (see ./manifest.ts).
+ */
+export { defineEveryApp, } from "./manifest.js";

package/dist/internal/capabilities.d.ts

@@ -945,7 +945,7 @@ export declare const CAPABILITIES: {
         readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
         readonly secrets: readonly [{
             readonly name: "ANTHROPIC_API_KEY";
-            readonly hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
         }];
         readonly smoke: {
             readonly method: "GET";

package/dist/internal/catalog/index.d.ts

@@ -420,7 +420,7 @@ export declare const CATALOG_ENTRIES: {
         readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
         readonly secrets: readonly [{
             readonly name: "ANTHROPIC_API_KEY";
-            readonly hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
         }];
         readonly smoke: {
             readonly method: "GET";

package/dist/internal/catalog/inference.d.ts

@@ -23,7 +23,7 @@ export declare const INFERENCE: {
         readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
         readonly secrets: readonly [{
             readonly name: "ANTHROPIC_API_KEY";
-            readonly hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
         }];
         readonly smoke: {
             readonly method: "GET";

package/dist/internal/catalog/inference.js

@@ -1,5 +1,5 @@
 export const INFERENCE = {
-    // Bearer is the documented header today; x-api-key is the legacy fallback. A workspace-scoped key keeps anthropic-workspace-id harmless.
+    // Bearer is the documented header today; x-api-key is the legacy fallback. The Gateway strips anthropic-workspace-id (and x-api-key), so the key alone decides the workspace.
     anthropic: {
         mode: "ai",
         label: "Anthropic",
@@ -28,7 +28,7 @@ export const INFERENCE = {
         secrets: [
             {
                 name: "ANTHROPIC_API_KEY",
-                hint: "A key scoped to one workspace, so no call needs an anthropic-workspace-id header.",
+                hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.",
             },
         ],
         smoke: {
@@ -420,7 +420,7 @@ export const INFERENCE = {
         },
         tags: ["ai", "images", "video", "audio"],
     },
-    // The router forwards X-HF-Bill-To as sent, so an app can bill any organization the token's user belongs to (TODO.md).
+    // The Gateway strips X-HF-Bill-To, so calls bill the token's own account, never another organization the token's user belongs to.
     huggingface: {
         mode: "api_key",
         label: "Hugging Face Inference",

package/dist/internal/events.d.ts

@@ -9,7 +9,7 @@
  * apps/every-app-gateway/src/server/events/catalogue.ts; this module knows
  * the names, versions and one-line descriptions only.
  */
-export type EventGroup = "member" | "app" | "cap" | "tool" | "connection" | "token" | "access" | "signin_provider" | "mcp_app" | "provider" | "ai" | "ping";
+export type EventGroup = "member" | "organization" | "app" | "cap" | "group" | "tool" | "connection" | "token" | "access" | "signin_provider" | "mcp_app" | "provider" | "subscription" | "ai" | "ping";
 export interface EventTypeInfo {
     /** `member.joined`, `cap.reached`, … */
     readonly type: string;