@every-app/sdk 0.3.0-rc.8 → 0.3.0

package/README.md

@@ -69,14 +69,13 @@ export default defineConfig((ctx) => ({
   in `.dev.vars`: `everyAppWorker()` declares it only when it is set there,
   since the Vite plugin passes a `.dev.vars` value through only for a
   declared secret. Type it as optional in `src/env.d.ts`
-  (`GITHUB_TOKEN?: string` in `Cloudflare.Env`). An entry can carry its
-  need: `{ name: "GITHUB_TOKEN", why, docs, optional: true }`, or
-  `anyOf: "<group>"` when one of a group must be set, and
-  `setup: "setup/<name>.md"` names its guide in the everyapp skill;
-  `providers` and `capabilities` entries take `why`, `docs`, `optional` and
-  `anyOf` too. Until every required setting is set the app shows "Needs
-  setup" and its tools stay out of `/mcp`; `pnpm everyapp secret list` says
-  what is missing (`docs/manifest-settings.md`).
+  (`GITHUB_TOKEN?: string` in `Cloudflare.Env`). An entry can carry
+  `{ name: "GITHUB_TOKEN", why, docs, how, generate, file }`; `providers`
+  and `capabilities` entries take `why` and `docs`. The top level is
+  required; what the app works without goes in an optional feature
+  (`features`). Until every required setting is set the app shows "Needs
+  setup" and its tools stay out of `/mcp`; `pnpm everyapp configure <app>`
+  walks what is missing (`docs/manifest-settings.md`).
 
 ## Compatibility flags
 
@@ -361,7 +360,8 @@ export const tools = defineTools(
     },
     delete_todo: {
       description: "Permanently delete one todo.",
-      risk: "destructive", // hidden from AI clients until approvals exist
+      risk: "write",
+      destructive: true, // clients ask the person before calling it
       input: z.object({ id: z.string() }).strict(),
       handler: async ({ id }, { user }) => {
         if (!(await deleteTodo(user.id, id)))
@@ -375,8 +375,9 @@ export const tools = defineTools(
 export default everyApp(handler, { tools });
 ```
 
-- `risk` is `read`, `write` or `destructive`. AI clients never see
-  destructive tools yet.
+- `risk` is `read` or `write`. Read-only connections and tokens see only
+  `read` tools. `destructive: true` marks a write tool that deletes or
+  can't be undone; clients see `destructiveHint` and ask before calling it.
 - `input` (and the optional `output`) take zod >= 4.2 or any validator that
   implements Standard Schema and Standard JSON Schema; a plain
   `{ jsonSchema, validate }` pair works too. Both describe objects: a
@@ -517,88 +518,85 @@ binding, the event is checked as the gateway would, printed as
 `[everyapp dev] event app.<id>.<event>` (never its data) and answered
 `{ id: "dev-<uuid>", type }`.
 
-### Social networks' OAuth clients
+### OAuth providers
 
-The gateway holds a client for each social network its operator set up
-(`docs/capabilities.md`, "OAuth clients": `linkedin`, `facebook`,
-`instagram`, `threads`, `youtube`, `tiktok`, `tiktok-business`, `reddit`,
-`pinterest`, `discord`, `slack`, `mastodon`, `kick`, `twitch`, `tumblr`,
-`dribbble`; and for mail and calendar, `google-workspace` and
-`microsoft-365`). List one for writing, send people to the provider's
-authorize URL (for a client with scope sets, the one `authorizeUrl()`
-builds from its status; for the others, one you build from the status's
-`clientId` and the network's documented scopes), and exchange or refresh
-tokens through the gateway without any client:
+For a person's own account at a provider (Google, Microsoft 365, Slack,
+GitHub, Notion and the other presets: deploying an app that lists one
+registers it on the gateway), the gateway holds the client, runs the flow
+and keeps the tokens. The
+app lists the provider's own scopes, sends people to connect inside the app,
+and calls the provider's API; it never sees a token.
 
 ```ts
 // everyapp.config.ts
 capabilities: {
-  linkedin: { access: "write" },
-  // A client several apps share lists the scope sets it uses.
   "google-workspace": {
-    access: "write",
-    scopes: ["identity", "search-console.read"],
-    why: "Reads Search Console for the sites you connect",
+    scopes: ["webmasters.readonly", "analytics.readonly"],
+    why: "Reads Search Console and Analytics for the sites you connect.",
   },
 }
 ```
 
+A short scope (`gmail.modify`) is joined onto the provider's prefix
+(`https://www.googleapis.com/auth/`); a full one is used as written; `[]`
+for a provider with no scopes (Notion). The gateway adds the scopes that
+name the account (Google's `openid email`), so don't list them. An OAuth
+entry takes no `access`.
+
 ```ts
 import {
-  authorizeUrl,
+  connectUrl,
+  gatewayRefusal,
   integrationFetch,
   integrationStatus,
 } from "@every-app/sdk/server";
 
 const status = await integrationStatus({ env, provider: "google-workspace" });
-if (!status.ready) return notAvailable(); // the operator hasn't set it up
-// ...redirect to
-const url = authorizeUrl({
-  provider: "google-workspace",
-  status,
-  redirectUri: `${origin}/integrations/google/callback`,
-  state,
-  codeChallenge, // optional PKCE (S256)
-});
-// ...and on the callback, exchange the code:
-const tokens = await integrationFetch({
-  env,
-  provider: "google-workspace",
-  for: request,
-})("https://oauth2.googleapis.com/token", {
-  method: "POST",
-  headers: { "content-type": "application/x-www-form-urlencoded" },
-  body: new URLSearchParams({
-    grant_type: "authorization_code",
-    code,
-    redirect_uri,
-    code_verifier,
-  }),
-});
+if (!status.connection?.ready) {
+  // A "Connect Google" button: the gateway asks Google for exactly this
+  // app's scopes and sends the person back.
+  return redirect(
+    connectUrl({ env, provider: "google-workspace", returnTo: request.url }),
+  );
+}
+const google = integrationFetch({ env, provider: "google-workspace" });
+const sites = await google(
+  "https://searchconsole.googleapis.com/webmasters/v3/sites",
+);
 ```
 
-The gateway completes the network's token endpoints only, putting its client
-where each one takes it (form body, HTTP Basic, query string or JSON body);
-anything else throws a `TypeError` before it is sent. Call the network's API
-with the user's token directly. Mastodon's status also gives the instance as
-`origin`.
-
-For a client with scope sets (`google-workspace`, `microsoft-365`, `slack`),
-the status carries the sets the manifest declares as `scopeSets` and the
-provider's scope strings they ask for as `scopes`, which `authorizeUrl()`
-puts on the URL (with Google's `access_type=offline`, Microsoft's
-`response_mode=query`, Slack's comma-joined `scope` and `user_scope`, and
-never `include_granted_scopes`); the gateway
-refuses an exchange or refresh whose granted scopes exceed the sets
-(`integration_scope_exceeded`), so a person's wider consent on another app
-never reaches this one. A manifest entry without usable `scopes` is not
-`ready`. The manifest's `scopes` field needs a gateway and CLI from the
-same release as this SDK: an older `everyapp dev` refuses a manifest that
-has it at startup. In local dev, with no binding, `.dev.vars` holds your
-own client under the gateway's names (`LINKEDIN_CLIENT_ID`,
-`LINKEDIN_CLIENT_SECRET`, `MASTODON_URL`, ...), the same rule puts it on
-the call, and the same scope checks apply, from the manifest `everyapp dev`
-passes the Worker.
+`connectUrl({ env, provider, returnTo })` is
+`<gateway>/connect/<id>?app=<this app>&return=<returnTo>`. The connection
+belongs to that person and this app: another app that needs the same
+provider connects for its own scopes. The gateway refuses a token that
+carries more scopes than the app lists.
+
+`integrationFetch` reaches https URLs only, and the gateway forwards a call
+to the provider's API hosts alone (a token endpoint or any other host is
+refused, `invalid_integration_route`); it puts the person's token on the
+call. Without a connection, or when the
+connection lacks a scope the app now lists, the gateway answers 409
+`integration_not_connected` with `connectPath` (and `missingScopes`): send
+the person to `connectUrl()`.
+
+`integrationStatus` for an OAuth provider adds `scopes` (as the manifest
+lists them), `connectPath` (`/connect/<id>?app=<app>`, or null) and
+`connection` (`{ label, scopes, ready, missingScopes?, reconnect? }`, or
+null) for the person.
+
+An app may use a connection made in it at any time, including from a cron
+or a Durable Object alarm. `for: { background: true, userId }` names any
+member's connection to this app, even while serving another member's
+request: OpenSEO reads a project's Search Console with the connection of the
+member who picked the property, whoever is viewing. The call carries that
+member (`x-everyapp-user`), not the person being served. Only an
+organization's own app may, and only for a member who may still open the
+app.
+
+In local dev, with no binding, put a token you obtained yourself in
+`.dev.vars` as `<PREFIX>_ACCESS_TOKEN` (`GOOGLE_WORKSPACE_ACCESS_TOKEN`,
+`GITHUB_OAUTH_ACCESS_TOKEN`; `devAccessTokenName(id)` names it). It goes on
+calls to the provider's hosts as the bearer; without it calls answer the same 409.
 
 ### Whom a call is for
 
@@ -610,6 +608,9 @@ passes the Worker.
 - `for: { background: true, organizationId }`, for work no request started
   (a cron, a Workflow step, a queue): sent as `x-everyapp-org` with no
   identity.
+- `for: { background: true, userId }`, for a call to an OAuth provider on a
+  member's connection to this app: sent as `x-everyapp-user`, with no
+  identity, even while a request is being served.
 - Omitted: allowed only in an organization's own app, whose background
   calls are the app's, in its own organization (the same as
   `{ background: true }`). Naming another organization is refused.

package/dist/cloudflare/catalogSettings.generated.d.ts

@@ -5,6 +5,8 @@
  * setting, a host setting), by manifest id. With no Gateway in
  * development, the SDK reaches them with the developer's own values under
  * the same names, and `everyAppWorker()` declares the ones set locally.
+ * An OAuth preset's is the token that stands in for a connection in dev
+ * (`<PREFIX>_ACCESS_TOKEN`), never its client.
  */
 export declare const DEV_GATEWAY_KEYS: {
     readonly providers: {
@@ -22,9 +24,6 @@ export declare const DEV_GATEWAY_KEYS: {
         readonly context: readonly ["CONTEXT_API_KEY"];
         readonly email: readonly ["EMAIL_FROM", "EMAIL_FROM_NAME", "EMAIL_REST_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID", "RESEND_API_KEY", "EMAIL_PROVIDER"];
         readonly members: readonly [];
-        readonly slack: readonly ["SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET"];
-        readonly "google-workspace": readonly ["GOOGLE_WORKSPACE_CLIENT_ID", "GOOGLE_WORKSPACE_CLIENT_SECRET"];
-        readonly "microsoft-365": readonly ["MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET"];
         readonly stripe: readonly ["STRIPE_API_KEY"];
         readonly lemonsqueezy: readonly ["LEMONSQUEEZY_API_KEY"];
         readonly paddle: readonly ["PADDLE_API_KEY"];
@@ -40,6 +39,7 @@ export declare const DEV_GATEWAY_KEYS: {
         readonly twilio: readonly ["TWILIO_API_SECRET", "TWILIO_API_KEY"];
         readonly intercom: readonly ["INTERCOM_API_TOKEN"];
         readonly crisp: readonly ["CRISP_API_KEY", "CRISP_API_IDENTIFIER"];
+        readonly granola: readonly ["GRANOLA_API_KEY"];
         readonly linear: readonly ["LINEAR_API_KEY"];
         readonly github: readonly ["GITHUB_API_TOKEN"];
         readonly gitlab: readonly ["GITLAB_API_TOKEN"];
@@ -55,6 +55,7 @@ export declare const DEV_GATEWAY_KEYS: {
         readonly pinecone: readonly ["PINECONE_API_KEY", "PINECONE_HOST"];
         readonly mapbox: readonly ["MAPBOX_ACCESS_TOKEN"];
         readonly openweather: readonly ["OPENWEATHER_API_KEY"];
+        readonly daytona: readonly ["DAYTONA_API_KEY"];
         readonly voyage: readonly ["VOYAGE_API_KEY"];
         readonly perplexity: readonly ["PERPLEXITY_API_KEY"];
         readonly jina: readonly ["JINA_API_KEY"];
@@ -70,11 +71,24 @@ export declare const DEV_GATEWAY_KEYS: {
         readonly elevenlabs: readonly ["ELEVENLABS_API_KEY"];
         readonly assemblyai: readonly ["ASSEMBLYAI_API_KEY"];
         readonly newsapi: readonly ["NEWSAPI_API_KEY"];
+        readonly "google-workspace": readonly ["GOOGLE_WORKSPACE_ACCESS_TOKEN"];
+        readonly "microsoft-365": readonly ["MICROSOFT_365_ACCESS_TOKEN"];
+        readonly slack: readonly ["SLACK_ACCESS_TOKEN"];
+        readonly "github-oauth": readonly ["GITHUB_OAUTH_ACCESS_TOKEN"];
+        readonly "notion-oauth": readonly ["NOTION_OAUTH_ACCESS_TOKEN"];
+        readonly "linear-oauth": readonly ["LINEAR_OAUTH_ACCESS_TOKEN"];
+        readonly "gitlab-oauth": readonly ["GITLAB_OAUTH_ACCESS_TOKEN"];
+        readonly atlassian: readonly ["ATLASSIAN_ACCESS_TOKEN"];
+        readonly "hubspot-oauth": readonly ["HUBSPOT_OAUTH_ACCESS_TOKEN"];
+        readonly zoom: readonly ["ZOOM_ACCESS_TOKEN"];
+        readonly dropbox: readonly ["DROPBOX_ACCESS_TOKEN"];
+        readonly spotify: readonly ["SPOTIFY_ACCESS_TOKEN"];
     };
 };
 /**
- * Every setting a catalog entry reads, in catalog order, each once: what
- * the Gateway's cloudflare.config.ts declares for local dev.
+ * Every setting a catalog entry or an OAuth preset reads, in catalog
+ * order, each once: what the Gateway's cloudflare.config.ts declares for
+ * local dev.
  */
-export declare const CATALOG_GATEWAY_SETTINGS: readonly ["OPENAI_API_KEY", "OPENROUTER_API_KEY", "WORKERS_AI_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID", "AI_GATEWAY_API_KEY", "AI_GATEWAY_ID", "DATAFORSEO_API_KEY", "CONTEXT_API_KEY", "EMAIL_FROM", "EMAIL_FROM_NAME", "EMAIL_REST_API_TOKEN", "RESEND_API_KEY", "EMAIL_PROVIDER", "SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET", "GOOGLE_WORKSPACE_CLIENT_ID", "GOOGLE_WORKSPACE_CLIENT_SECRET", "MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET", "STRIPE_API_KEY", "LEMONSQUEEZY_API_KEY", "PADDLE_API_KEY", "SHOPIFY_API_TOKEN", "SHOPIFY_HOST", "PLAID_SECRET", "ATTIO_API_KEY", "HUBSPOT_API_TOKEN", "PIPEDRIVE_API_TOKEN", "AIRTABLE_API_TOKEN", "NOTION_API_TOKEN", "POSTMARK_API_TOKEN", "SENDGRID_API_KEY", "TWILIO_API_SECRET", "TWILIO_API_KEY", "INTERCOM_API_TOKEN", "CRISP_API_KEY", "CRISP_API_IDENTIFIER", "LINEAR_API_KEY", "GITHUB_API_TOKEN", "GITLAB_API_TOKEN", "VERCEL_API_TOKEN", "CLOUDFLARE_PROVIDER_API_TOKEN", "POSTHOG_PERSONAL_API_KEY", "MIXPANEL_SERVICE_ACCOUNT_SECRET", "MIXPANEL_SERVICE_ACCOUNT_USERNAME", "SEGMENT_WRITE_KEY", "SUPABASE_SECRET_KEY", "SUPABASE_HOST", "TURSO_API_TOKEN", "TURSO_DB_AUTH_TOKEN", "TURSO_DB_HOST", "NEON_API_KEY", "PINECONE_API_KEY", "PINECONE_HOST", "MAPBOX_ACCESS_TOKEN", "OPENWEATHER_API_KEY", "ANTHROPIC_API_KEY", "GEMINI_API_KEY", "MISTRAL_API_KEY", "GROQ_API_KEY", "COHERE_API_KEY", "VOYAGE_API_KEY", "PERPLEXITY_API_KEY", "JINA_API_KEY", "REPLICATE_API_TOKEN", "HUGGINGFACE_API_TOKEN", "FIRECRAWL_API_KEY", "EXA_API_KEY", "TAVILY_API_KEY", "SERPER_API_KEY", "BRAVE_SEARCH_API_KEY", "APIFY_API_TOKEN", "DEEPGRAM_API_KEY", "ELEVENLABS_API_KEY", "ASSEMBLYAI_API_KEY", "NEWSAPI_API_KEY"];
+export declare const CATALOG_GATEWAY_SETTINGS: readonly ["OPENAI_API_KEY", "OPENROUTER_API_KEY", "WORKERS_AI_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID", "AI_GATEWAY_API_KEY", "AI_GATEWAY_ID", "DATAFORSEO_API_KEY", "CONTEXT_API_KEY", "EMAIL_FROM", "EMAIL_FROM_NAME", "EMAIL_REST_API_TOKEN", "RESEND_API_KEY", "EMAIL_PROVIDER", "STRIPE_API_KEY", "LEMONSQUEEZY_API_KEY", "PADDLE_API_KEY", "SHOPIFY_API_TOKEN", "SHOPIFY_HOST", "PLAID_SECRET", "ATTIO_API_KEY", "HUBSPOT_API_TOKEN", "PIPEDRIVE_API_TOKEN", "AIRTABLE_API_TOKEN", "NOTION_API_TOKEN", "POSTMARK_API_TOKEN", "SENDGRID_API_KEY", "TWILIO_API_SECRET", "TWILIO_API_KEY", "INTERCOM_API_TOKEN", "CRISP_API_KEY", "CRISP_API_IDENTIFIER", "GRANOLA_API_KEY", "LINEAR_API_KEY", "GITHUB_API_TOKEN", "GITLAB_API_TOKEN", "VERCEL_API_TOKEN", "CLOUDFLARE_PROVIDER_API_TOKEN", "POSTHOG_PERSONAL_API_KEY", "MIXPANEL_SERVICE_ACCOUNT_SECRET", "MIXPANEL_SERVICE_ACCOUNT_USERNAME", "SEGMENT_WRITE_KEY", "SUPABASE_SECRET_KEY", "SUPABASE_HOST", "TURSO_API_TOKEN", "TURSO_DB_AUTH_TOKEN", "TURSO_DB_HOST", "NEON_API_KEY", "PINECONE_API_KEY", "PINECONE_HOST", "MAPBOX_ACCESS_TOKEN", "OPENWEATHER_API_KEY", "DAYTONA_API_KEY", "ANTHROPIC_API_KEY", "GEMINI_API_KEY", "MISTRAL_API_KEY", "GROQ_API_KEY", "COHERE_API_KEY", "VOYAGE_API_KEY", "PERPLEXITY_API_KEY", "JINA_API_KEY", "REPLICATE_API_TOKEN", "HUGGINGFACE_API_TOKEN", "FIRECRAWL_API_KEY", "EXA_API_KEY", "TAVILY_API_KEY", "SERPER_API_KEY", "BRAVE_SEARCH_API_KEY", "APIFY_API_TOKEN", "DEEPGRAM_API_KEY", "ELEVENLABS_API_KEY", "ASSEMBLYAI_API_KEY", "NEWSAPI_API_KEY", "GOOGLE_WORKSPACE_CLIENT_ID", "GOOGLE_WORKSPACE_CLIENT_SECRET", "MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET", "SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET", "GITHUB_OAUTH_CLIENT_ID", "GITHUB_OAUTH_CLIENT_SECRET", "NOTION_OAUTH_CLIENT_ID", "NOTION_OAUTH_CLIENT_SECRET", "LINEAR_OAUTH_CLIENT_ID", "LINEAR_OAUTH_CLIENT_SECRET", "GITLAB_OAUTH_CLIENT_ID", "GITLAB_OAUTH_CLIENT_SECRET", "ATLASSIAN_CLIENT_ID", "ATLASSIAN_CLIENT_SECRET", "HUBSPOT_OAUTH_CLIENT_ID", "HUBSPOT_OAUTH_CLIENT_SECRET", "ZOOM_CLIENT_ID", "ZOOM_CLIENT_SECRET", "DROPBOX_OAUTH_CLIENT_ID", "DROPBOX_OAUTH_CLIENT_SECRET", "SPOTIFY_CLIENT_ID", "SPOTIFY_CLIENT_SECRET"];
 //# sourceMappingURL=catalogSettings.generated.d.ts.map

package/dist/cloudflare/catalogSettings.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalogSettings.generated.d.ts","sourceRoot":"","sources":["../../src/cloudflare/catalogSettings.generated.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8EnB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,wBAAwB,qlDA6E3B,CAAC"}
+{"version":3,"file":"catalogSettings.generated.d.ts","sourceRoot":"","sources":["../../src/cloudflare/catalogSettings.generated.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFnB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,ulEAiG3B,CAAC"}

package/dist/cloudflare/catalogSettings.generated.js

@@ -8,6 +8,8 @@
  * setting, a host setting), by manifest id. With no Gateway in
  * development, the SDK reaches them with the developer's own values under
  * the same names, and `everyAppWorker()` declares the ones set locally.
+ * An OAuth preset's is the token that stands in for a connection in dev
+ * (`<PREFIX>_ACCESS_TOKEN`), never its client.
  */
 export const DEV_GATEWAY_KEYS = {
     providers: {
@@ -32,12 +34,6 @@ export const DEV_GATEWAY_KEYS = {
             "EMAIL_PROVIDER",
         ],
         members: [],
-        slack: ["SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET"],
-        "google-workspace": [
-            "GOOGLE_WORKSPACE_CLIENT_ID",
-            "GOOGLE_WORKSPACE_CLIENT_SECRET",
-        ],
-        "microsoft-365": ["MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET"],
         stripe: ["STRIPE_API_KEY"],
         lemonsqueezy: ["LEMONSQUEEZY_API_KEY"],
         paddle: ["PADDLE_API_KEY"],
@@ -53,6 +49,7 @@ export const DEV_GATEWAY_KEYS = {
         twilio: ["TWILIO_API_SECRET", "TWILIO_API_KEY"],
         intercom: ["INTERCOM_API_TOKEN"],
         crisp: ["CRISP_API_KEY", "CRISP_API_IDENTIFIER"],
+        granola: ["GRANOLA_API_KEY"],
         linear: ["LINEAR_API_KEY"],
         github: ["GITHUB_API_TOKEN"],
         gitlab: ["GITLAB_API_TOKEN"],
@@ -71,6 +68,7 @@ export const DEV_GATEWAY_KEYS = {
         pinecone: ["PINECONE_API_KEY", "PINECONE_HOST"],
         mapbox: ["MAPBOX_ACCESS_TOKEN"],
         openweather: ["OPENWEATHER_API_KEY"],
+        daytona: ["DAYTONA_API_KEY"],
         voyage: ["VOYAGE_API_KEY"],
         perplexity: ["PERPLEXITY_API_KEY"],
         jina: ["JINA_API_KEY"],
@@ -86,11 +84,24 @@ export const DEV_GATEWAY_KEYS = {
         elevenlabs: ["ELEVENLABS_API_KEY"],
         assemblyai: ["ASSEMBLYAI_API_KEY"],
         newsapi: ["NEWSAPI_API_KEY"],
+        "google-workspace": ["GOOGLE_WORKSPACE_ACCESS_TOKEN"],
+        "microsoft-365": ["MICROSOFT_365_ACCESS_TOKEN"],
+        slack: ["SLACK_ACCESS_TOKEN"],
+        "github-oauth": ["GITHUB_OAUTH_ACCESS_TOKEN"],
+        "notion-oauth": ["NOTION_OAUTH_ACCESS_TOKEN"],
+        "linear-oauth": ["LINEAR_OAUTH_ACCESS_TOKEN"],
+        "gitlab-oauth": ["GITLAB_OAUTH_ACCESS_TOKEN"],
+        atlassian: ["ATLASSIAN_ACCESS_TOKEN"],
+        "hubspot-oauth": ["HUBSPOT_OAUTH_ACCESS_TOKEN"],
+        zoom: ["ZOOM_ACCESS_TOKEN"],
+        dropbox: ["DROPBOX_ACCESS_TOKEN"],
+        spotify: ["SPOTIFY_ACCESS_TOKEN"],
     },
 };
 /**
- * Every setting a catalog entry reads, in catalog order, each once: what
- * the Gateway's cloudflare.config.ts declares for local dev.
+ * Every setting a catalog entry or an OAuth preset reads, in catalog
+ * order, each once: what the Gateway's cloudflare.config.ts declares for
+ * local dev.
  */
 export const CATALOG_GATEWAY_SETTINGS = [
     "OPENAI_API_KEY",
@@ -106,12 +117,6 @@ export const CATALOG_GATEWAY_SETTINGS = [
     "EMAIL_REST_API_TOKEN",
     "RESEND_API_KEY",
     "EMAIL_PROVIDER",
-    "SLACK_CLIENT_ID",
-    "SLACK_CLIENT_SECRET",
-    "GOOGLE_WORKSPACE_CLIENT_ID",
-    "GOOGLE_WORKSPACE_CLIENT_SECRET",
-    "MICROSOFT_365_CLIENT_ID",
-    "MICROSOFT_365_CLIENT_SECRET",
     "STRIPE_API_KEY",
     "LEMONSQUEEZY_API_KEY",
     "PADDLE_API_KEY",
@@ -130,6 +135,7 @@ export const CATALOG_GATEWAY_SETTINGS = [
     "INTERCOM_API_TOKEN",
     "CRISP_API_KEY",
     "CRISP_API_IDENTIFIER",
+    "GRANOLA_API_KEY",
     "LINEAR_API_KEY",
     "GITHUB_API_TOKEN",
     "GITLAB_API_TOKEN",
@@ -149,6 +155,7 @@ export const CATALOG_GATEWAY_SETTINGS = [
     "PINECONE_HOST",
     "MAPBOX_ACCESS_TOKEN",
     "OPENWEATHER_API_KEY",
+    "DAYTONA_API_KEY",
     "ANTHROPIC_API_KEY",
     "GEMINI_API_KEY",
     "MISTRAL_API_KEY",
@@ -169,4 +176,28 @@ export const CATALOG_GATEWAY_SETTINGS = [
     "ELEVENLABS_API_KEY",
     "ASSEMBLYAI_API_KEY",
     "NEWSAPI_API_KEY",
+    "GOOGLE_WORKSPACE_CLIENT_ID",
+    "GOOGLE_WORKSPACE_CLIENT_SECRET",
+    "MICROSOFT_365_CLIENT_ID",
+    "MICROSOFT_365_CLIENT_SECRET",
+    "SLACK_CLIENT_ID",
+    "SLACK_CLIENT_SECRET",
+    "GITHUB_OAUTH_CLIENT_ID",
+    "GITHUB_OAUTH_CLIENT_SECRET",
+    "NOTION_OAUTH_CLIENT_ID",
+    "NOTION_OAUTH_CLIENT_SECRET",
+    "LINEAR_OAUTH_CLIENT_ID",
+    "LINEAR_OAUTH_CLIENT_SECRET",
+    "GITLAB_OAUTH_CLIENT_ID",
+    "GITLAB_OAUTH_CLIENT_SECRET",
+    "ATLASSIAN_CLIENT_ID",
+    "ATLASSIAN_CLIENT_SECRET",
+    "HUBSPOT_OAUTH_CLIENT_ID",
+    "HUBSPOT_OAUTH_CLIENT_SECRET",
+    "ZOOM_CLIENT_ID",
+    "ZOOM_CLIENT_SECRET",
+    "DROPBOX_OAUTH_CLIENT_ID",
+    "DROPBOX_OAUTH_CLIENT_SECRET",
+    "SPOTIFY_CLIENT_ID",
+    "SPOTIFY_CLIENT_SECRET",
 ];

package/dist/cloudflare/index.d.ts

@@ -17,7 +17,7 @@
  * `/internal` would break `cf dev` wherever the SDK is linked from source.
  * (The dev keypair it hands the dev Worker is a leaf the Worker never loads.)
  */
-export { EVERYAPP_OBSERVABILITY, everyAppAuxiliaryWorker, everyAppWorker, helperWorkerName, localD1Id, localD1Path, workflowNameFor, type AiBinding, type AnalyticsEngineDatasetBinding, type BrowserBinding, type AiGatewayBinding, type D1Binding, type DurableObjectBinding, type DurableObjectExport, type EveryAppAuxiliaryWorkerConfig, type EveryAppAuxiliaryWorkerOptions, type EveryAppBinding, type EveryAppConfigContext, type EveryAppDeployEnv, type EveryAppDevEnv, type EveryAppExports, type EveryAppObservability, type EveryAppPlacement, type EveryAppTrigger, type EveryAppWorkerConfig, type EveryAppWorkerManifest, type EveryAppWorkerOptions, type EveryAppWorkerReference, type GatewayBinding, type HyperdriveBinding, type ImagesBinding, type JsonBinding, type KvBinding, type QueueBinding, type QueueConsumerTrigger, type SecretBinding, type SecretsStoreSecretBinding, type SendEmailBinding, type ServiceBinding, type TextBinding, type VectorizeBinding, type VersionMetadataBinding, type WorkflowBinding, type WorkflowExport, } from "./worker.js";
+export { EVERYAPP_OBSERVABILITY, everyAppAuxiliaryWorker, everyAppWorker, helperWorkerName, localD1Id, localD1Path, workflowNameFor, type AiBinding, type AnalyticsEngineDatasetBinding, type ArtifactsBinding, type BrowserBinding, type AiGatewayBinding, type D1Binding, type DurableObjectBinding, type DurableObjectExport, type EveryAppAuxiliaryWorkerConfig, type EveryAppAuxiliaryWorkerOptions, type EveryAppBinding, type EveryAppConfigContext, type EveryAppDeployEnv, type EveryAppDevEnv, type EveryAppExports, type EveryAppObservability, type EveryAppPlacement, type EveryAppTrigger, type EveryAppWorkerConfig, type EveryAppWorkerManifest, type EveryAppWorkerOptions, type EveryAppWorkerReference, type GatewayBinding, type HyperdriveBinding, type ImagesBinding, type JsonBinding, type KvBinding, type QueueBinding, type QueueConsumerTrigger, type SecretBinding, type SecretsStoreSecretBinding, type SendEmailBinding, type ServiceBinding, type TextBinding, type VectorizeBinding, type VersionMetadataBinding, type WorkflowBinding, type WorkflowExport, } from "./worker.js";
 export { aiGatewayUrl, BUILD_SENTINEL, resourceSentinel, sentinelDeployTarget, type AiGatewayValue, type EveryAppDeployTarget, } from "./sentinel.js";
 export { CATALOG_GATEWAY_SETTINGS } from "./catalogSettings.generated.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,eAAe,EACf,KAAK,SAAS,EACd,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,eAAe,EACf,KAAK,SAAS,EACd,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/cloudflare/sentinel.d.ts

@@ -24,6 +24,9 @@ export declare const BUILD_SENTINEL: Readonly<{
     gatewayUrl: "https://every-hosted--sentinel.invalid";
     publicKey: "-----BEGIN PUBLIC KEY-----\nEVERYAPPHOSTEDDEPLOYSENTINEL\n-----END PUBLIC KEY-----\n";
 }>;
+/** Runtime-independent resource names used by both release installers. */
+export declare function helperWorkerName(appWorker: string, helper: string): string;
+export declare function workflowNameFor(workerName: string, binding: string): string;
 /**
  * A manifest binding's placeholder: a D1 database's name and id, an R2
  * bucket's, queue's or Vectorize index's name, a KV namespace's, Hyperdrive

package/dist/cloudflare/sentinel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sentinel.d.ts","sourceRoot":"","sources":["../../src/cloudflare/sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,cAAc;;;IAKzB;;;;OAIG;;IAEH,qDAAqD;;;EAIrD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClD,MAAM,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC9C,SAAS,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACjD,SAAS,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACjD,YAAY,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACrD,CAAC;CACH;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4DAA4D;IAC5D,SAAS,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClD,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5C,oEAAoE;QACpE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtC,uFAAuF;QACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,4EAA4E;QAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC7C,0DAA0D;QAC1D,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3C;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxE,CAAC;CACH;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,GACzB,oBAAoB,CAoDtB"}
+{"version":3,"file":"sentinel.d.ts","sourceRoot":"","sources":["../../src/cloudflare/sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,cAAc;;;IAKzB;;;;OAIG;;IAEH,qDAAqD;;;EAIrD,CAAC;AAEH,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO1E;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClD,MAAM,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC9C,SAAS,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACjD,SAAS,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACjD,YAAY,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACrD,CAAC;CACH;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4DAA4D;IAC5D,SAAS,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClD,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5C,oEAAoE;QACpE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtC,uFAAuF;QACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,4EAA4E;QAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC7C,0DAA0D;QAC1D,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3C;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxE,CAAC;CACH;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,GACzB,oBAAoB,CAoDtB"}

package/dist/cloudflare/sentinel.js

@@ -26,6 +26,16 @@ export const BUILD_SENTINEL = Object.freeze({
     gatewayUrl: "https://every-hosted--sentinel.invalid",
     publicKey: "-----BEGIN PUBLIC KEY-----\nEVERYAPPHOSTEDDEPLOYSENTINEL\n-----END PUBLIC KEY-----\n",
 });
+/** Runtime-independent resource names used by both release installers. */
+export function helperWorkerName(appWorker, helper) {
+    const name = `${appWorker}--${helper}`;
+    if (name.length > 63)
+        throw new Error(`Helper Worker ${name} is longer than Cloudflare's 63 characters; shorten its name in everyapp.config.ts.`);
+    return name;
+}
+export function workflowNameFor(workerName, binding) {
+    return `${workerName}--${binding.toLowerCase().replaceAll("_", "-")}`;
+}
 /**
  * A manifest binding's placeholder: a D1 database's name and id, an R2
  * bucket's, queue's or Vectorize index's name, a KV namespace's, Hyperdrive