fix(trigger): keep each worker's egress gateway address out of the env sync

The Trigger.dev env sync copies the app's OUTBOUND_GATEWAYS over the
worker value. The app reaches a gateway through the VPC load balancer;
workers reach it through their own private endpoint, so the copied URL
is unreachable from a run and every gateway-routed request in a
background run fails with GATEWAY_UNAVAILABLE after two connect
timeouts. OUTBOUND_GATEWAYS is now Trigger-owned like REDIS_URL; the
shared credentials and routing source still sync.

Author: waleedlatif1

packages/runtime-secrets/src/trigger-env.test.ts

@@ -1,5 +1,22 @@
 import { describe, expect, it } from 'vitest'
-import { parseTriggerEnvSyncTargets } from './trigger-env'
+import { buildTriggerEnvVars, parseTriggerEnvSyncTargets } from './trigger-env'
+
+describe('buildTriggerEnvVars', () => {
+  it('leaves the worker-specific network endpoints to the Trigger.dev environment', () => {
+    const synced = buildTriggerEnvVars({
+      REDIS_URL: 'rediss://vpc-redis:6379',
+      INTERNAL_API_BASE_URL: 'http://app.internal',
+      OUTBOUND_GATEWAYS: '{"gw":{"url":"https://vpc-lb:8443"}}',
+      OUTBOUND_GATEWAY_CREDENTIALS: '{"gw":{"token":"t"}}',
+      OUTBOUND_ROUTING_SOURCE: 'appconfig',
+    }).map((v) => v.name)
+    expect(synced).not.toContain('REDIS_URL')
+    expect(synced).not.toContain('INTERNAL_API_BASE_URL')
+    expect(synced).not.toContain('OUTBOUND_GATEWAYS')
+    expect(synced).toContain('OUTBOUND_GATEWAY_CREDENTIALS')
+    expect(synced).toContain('OUTBOUND_ROUTING_SOURCE')
+  })
+})
 
 describe('parseTriggerEnvSyncTargets', () => {
   it('reads an exact comma list', () => {

packages/runtime-secrets/src/trigger-env.ts

@@ -26,6 +26,9 @@ const TRIGGER_OWNED_KEYS: ReadonlySet<string> = new Set([
   'REDIS_TLS_SERVERNAME',
   // A VPC-internal base URL is unreachable from Trigger.dev's cloud.
   'INTERNAL_API_BASE_URL',
+  // The app dials an egress gateway through the VPC load balancer; workers dial it through their
+  // own endpoint, so each gateway's `url` differs. The credentials and routing source are shared.
+  'OUTBOUND_GATEWAYS',
   // Schema-migration credential: runs never migrate, so they never hold it.
   'MIGRATION_DATABASE_URL',
   // `syncEnvVars` refuses to sync it, so it can only ever be set by hand.