@every-app/sdk 0.2.0 → 0.3.0-rc.10

package/dist/cloudflare/worker.js

@@ -0,0 +1,997 @@
+import { createHash, createHmac } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { parseEnv } from "node:util";
+import { DEV_ISSUER, DEV_ORG_ID, DEV_PUBLIC_KEY_PEM } from "../dev/keypair.js";
+// The catalog's settings, generated from ../internal/capabilities.ts, which
+// this file must not import (see ./index.ts: the Vite plugin hides whatever
+// cloudflare.config.ts imports from the Worker).
+import { DEV_GATEWAY_KEYS } from "./catalogSettings.generated.js";
+import { helperWorkerName, sentinelDeployTarget, workflowNameFor, } from "./sentinel.js";
+export { helperWorkerName, workflowNameFor } from "./sentinel.js";
+/** The names of the manifest's `secrets`, whichever form each took. */
+function manifestSecretNames(manifest) {
+    return (manifest.secrets ?? []).map((entry) => typeof entry === "string" ? entry : entry.name);
+}
+/** The ids of the manifest's `providers`, whichever form each took. */
+function manifestProviderIds(manifest) {
+    return (manifest.providers ?? []).map((entry) => typeof entry === "string" ? entry : entry.id);
+}
+/**
+ * Observability every Every App Worker ships with: logs (with invocation
+ * logs), sampled traces and Workers Issues, with query strings redacted so
+ * tokens and invitation ids in URLs stay out of logs.
+ */
+export const EVERYAPP_OBSERVABILITY = Object.freeze({
+    enabled: true,
+    headSamplingRate: 1,
+    redactQueryString: true,
+    logs: Object.freeze({
+        enabled: true,
+        invocationLogs: true,
+        persist: true,
+        headSamplingRate: 1,
+    }),
+    traces: Object.freeze({
+        enabled: true,
+        persist: true,
+        headSamplingRate: 0.1,
+    }),
+    issues: Object.freeze({ enabled: true }),
+});
+const DEFAULT_COMPATIBILITY_DATE = "2026-06-01";
+/** Set by `everyapp deploy` around the production build it installs. */
+const BUILD_ENV = "EVERYAPP_BUILD";
+/** Names the deploy sets itself (as `everyapp secret set` refuses). */
+const RESERVED_SECRET_NAME = /^(GATEWAY_URL|CF_VERSION_METADATA|EVERYAPP_\w*|EVERY_APP_\w*|APP__\w*)$/i;
+const GATEWAY_WORKER_NAME = "every-app-gateway";
+const GATEWAY_ENTRYPOINT = "AppGateway";
+/**
+ * Where `everyapp dev` serves its launcher, which it passes to the app's dev
+ * server in EVERYAPP_DEV_GATEWAY_URL; its default address otherwise. The
+ * deployed Worker gets the Gateway's URL from the deploy instead.
+ */
+const DEV_GATEWAY_URL_ENV = "EVERYAPP_DEV_GATEWAY_URL";
+const DEFAULT_DEV_GATEWAY_URL = "http://localhost:8787";
+function devGatewayUrl() {
+    return {
+        type: "text",
+        value: process.env[DEV_GATEWAY_URL_ENV] || DEFAULT_DEV_GATEWAY_URL,
+    };
+}
+/**
+ * The manifest's `capabilities` as the SDK's local-dev twin of the gateway
+ * reads them: with no gateway to hold an OAuth client's calls to the scope
+ * sets the app declares, `integrationFetch()` holds them to these.
+ */
+function devCapabilities(manifest) {
+    return { type: "text", value: JSON.stringify(manifest.capabilities ?? {}) };
+}
+/**
+ * The binding the dev Worker gets the specs of providers registered on a
+ * gateway in (`DEV_PROVIDERS_ENV` in ../internal/devProviders.ts; a copy,
+ * kept in step by a test, since this file may not import ../internal).
+ */
+const DEV_PROVIDERS_ENV = "EVERYAPP_DEV_PROVIDERS";
+/** Linked dev's env names (`LINKED_DEV_URL_ENV`, `LINKED_DEV_NONCE_ENV` in ../internal/protocol.ts; copies, kept in step by the same test). */
+const LINKED_DEV_URL_ENV = "EVERYAPP_LINKED_DEV_URL";
+const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
+/**
+ * The specs `everyapp provider add` (in an app directory) and `everyapp
+ * provider show <id> --save` wrote under the app, in name order; none
+ * without the directory. integrationFetch()'s dev fallback reaches a
+ * provider outside the catalog from them, with the developer's own key.
+ */
+function devProviderFiles(root) {
+    const dir = path.join(root ?? process.cwd(), ".everyapp", "providers");
+    let names;
+    try {
+        names = fs
+            .readdirSync(dir)
+            .filter((name) => name.endsWith(".json"))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+    return names.map((name) => {
+        const text = fs.readFileSync(path.join(dir, name), "utf8");
+        let spec;
+        try {
+            spec = JSON.parse(text);
+        }
+        catch {
+            spec = text;
+        }
+        return { file: `.everyapp/providers/${name}`, spec };
+    });
+}
+/**
+ * Linked dev (`everyapp dev --gateway`, docs/design/linked-dev.md): the
+ * gateway-lite starts the app's dev server with the forwarder's loopback
+ * URL and the run's nonce in the process environment; the dev Worker gets
+ * both as text, and the SDK's `gatewayBinding()` builds the shim from
+ * them in place of the missing service binding. Absent in every other
+ * run, and never in a deploy.
+ */
+function addLinkedDev(env) {
+    const url = process.env[LINKED_DEV_URL_ENV]?.trim();
+    const nonce = process.env[LINKED_DEV_NONCE_ENV];
+    if (!url || !nonce)
+        return;
+    env[LINKED_DEV_URL_ENV] = { type: "text", value: url };
+    env[LINKED_DEV_NONCE_ENV] = { type: "text", value: nonce };
+}
+/** EVERYAPP_DEV_PROVIDERS, when the app has any spec files. */
+function addDevProviders(env, root) {
+    const files = devProviderFiles(root);
+    if (files.length === 0)
+        return;
+    env[DEV_PROVIDERS_ENV] = { type: "text", value: JSON.stringify(files) };
+}
+/**
+ * The Gateway settings the spec files name for the capabilities the
+ * manifest lists outside {@link DEV_GATEWAY_KEYS} (a registered provider's
+ * key, a Basic username held as a setting, its host setting), read
+ * loosely: the SDK parses the spec when the app calls the provider.
+ */
+function devProviderKeys(manifest, root) {
+    const listed = Object.keys(manifest.capabilities ?? {}).filter((id) => !Object.hasOwn(DEV_GATEWAY_KEYS.capabilities, id));
+    if (listed.length === 0)
+        return [];
+    const record = (value) => value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+    const names = [];
+    for (const { file, spec } of devProviderFiles(root)) {
+        const fields = record(spec);
+        const id = typeof fields?.["id"] === "string"
+            ? fields["id"]
+            : file
+                .split("/")
+                .at(-1)
+                .replace(/\.json$/, "");
+        if (!fields || !listed.includes(id))
+            continue;
+        const auth = record(fields["auth"]);
+        for (const name of [
+            auth?.["secret"],
+            record(auth?.["user"])?.["secret"],
+            fields["hostSetting"],
+        ]) {
+            if (typeof name === "string" && /^[A-Z][A-Z0-9_]*$/.test(name)) {
+                names.push(name);
+            }
+        }
+    }
+    return names;
+}
+/** Cloudflare's limit on a Workflow's name. */
+const MAX_WORKFLOW_NAME_LENGTH = 64;
+/**
+ * The store development binds Secrets Store secrets in: Miniflare keeps
+ * one per id under `.cloudflare/state`, and any id works locally.
+ */
+const LOCAL_SECRETS_STORE_ID = "local";
+/** Cloudflare's limit on a Vectorize index's name. */
+const MAX_VECTORIZE_NAME_LENGTH = 64;
+/** Cloudflare's limit on a Worker's name. */
+/**
+ * Where a developer puts a local Postgres URL for a Hyperdrive binding
+ * (`.dev.vars` or `.env`), the variable wrangler reads for the same.
+ */
+const LOCAL_HYPERDRIVE_PREFIX = "CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_";
+/**
+ * Build the Worker definition for an Every App app from its manifest.
+ *
+ * - `development` (cf dev) and no mode (cf API commands, `cf workers types`):
+ *   EVERYAPP_DEV is on, the identity keys and issuer are the well-known dev
+ *   ones (`@every-app/sdk/dev`) as plain text, so nothing needs writing to
+ *   `.dev.vars`, and each D1 database gets a fixed local id (see
+ *   {@link localD1Id}) that `cf d1 … --local` can address.
+ * - `production`: tenant-neutral. Everything install-specific (the Worker
+ *   name, organization, gateway URL, identity keys, resource names and ids)
+ *   is a placeholder from {@link sentinelDeployTarget}, which the installer
+ *   rewrites (`everyapp deploy`, or a hosted gateway's deployer), so every
+ *   build of an app is the same. Only with EVERYAPP_BUILD=1, which
+ *   `everyapp deploy` sets: a bare `cf deploy` would upload the
+ *   placeholders.
+ */
+export function everyAppWorker(options) {
+    const { manifest } = options;
+    const { deploy, name } = appWorkerName(options, "everyAppWorker");
+    const env = {
+        EVERYAPP_APP_ID: { type: "text", value: manifest.id },
+        // The manifest itself, for a page that shows what the app asked for:
+        // the Worker can't import everyapp.config.ts (see ./index.ts).
+        EVERYAPP_MANIFEST: {
+            type: "json",
+            value: manifest,
+        },
+        CF_VERSION_METADATA: { type: "version-metadata" },
+    };
+    if (deploy) {
+        // The gateway mints every identity for the Worker's name (`aud`).
+        env["EVERYAPP_AUDIENCE"] = { type: "text", value: name };
+        env["EVERYAPP_IDENTITY_PUBLIC_KEYS"] = {
+            type: "text",
+            value: JSON.stringify(deploy.identityPublicKeys),
+        };
+        env["EVERYAPP_IDENTITY_ISSUER"] = {
+            type: "text",
+            value: deploy.gatewayUrl,
+        };
+        env["EVERY_APP_GATEWAY"] = gatewayBinding(deploy, manifest.id, name);
+        // Sent by the deploy pipeline through `cf deploy --secrets-file`.
+        env["GATEWAY_URL"] = { type: "secret" };
+        env["EVERY_APP_ORG_ID"] = { type: "secret" };
+    }
+    else {
+        env["EVERYAPP_DEV"] = { type: "text", value: "1" };
+        env["EVERYAPP_DEV_CAPABILITIES"] = devCapabilities(manifest);
+        env["EVERYAPP_IDENTITY_PUBLIC_KEYS"] = {
+            type: "text",
+            value: JSON.stringify([DEV_PUBLIC_KEY_PEM]),
+        };
+        env["EVERYAPP_IDENTITY_ISSUER"] = { type: "text", value: DEV_ISSUER };
+        env["GATEWAY_URL"] = devGatewayUrl();
+        // The stub gateway's organization, as the deploy's secret would be, so
+        // background work's withOrganization(env.EVERY_APP_ORG_ID, …) runs
+        // here too. Not a pin: under the dev opt-in everyApp() enforces none,
+        // so `everyapp dev --mode mirror`'s real organizations still open.
+        env["EVERY_APP_ORG_ID"] = { type: "text", value: DEV_ORG_ID };
+        addDevProviders(env, options.root);
+        addLinkedDev(env);
+    }
+    Object.assign(env, storageBindings(manifest, name, deploy));
+    addQueueBindings(env, manifest, name, deploy);
+    addAiBindings(env, manifest, deploy);
+    addBrowserBindings(env, manifest);
+    addImagesBindings(env, manifest);
+    addAiGatewayBindings(env, manifest, name, deploy);
+    addSendEmailBindings(env, manifest);
+    addSecretsStoreBindings(env, manifest, name, deploy);
+    addAnalyticsEngineBindings(env, manifest, name);
+    addDatabaseBindings(env, options, name, undefined, deploy);
+    // The app binds every class, a helper Worker's in that Worker, and
+    // exports only its own.
+    const { bindings, exports } = classBindings(manifest, name, undefined, env);
+    Object.assign(env, bindings);
+    for (const helper of manifest.workers ?? []) {
+        if (!helper.binding)
+            continue;
+        if (env[helper.binding]) {
+            throw new Error(`workers: ${helper.name}'s binding ${helper.binding} reuses a binding name the Worker already has.`);
+        }
+        env[helper.binding] = {
+            type: "worker",
+            worker: helperWorkerName(name, helper.name),
+        };
+    }
+    addSecrets(env, options, deploy);
+    const triggers = [
+        ...cronTriggers(options.crons),
+        ...queueTriggers(manifest, name, undefined, deploy),
+    ];
+    const compatibilityDate = manifest.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE;
+    // cf types a Durable Object namespace with its class only when the binding
+    // names the defining Worker by a definition whose module it can read, so
+    // the classes this Worker defines name it that way; cf resolves the
+    // reference to the Worker's name. A path entrypoint gives cf no module.
+    // Only here: `EveryAppBinding` names Workers by name, as the Vite
+    // plugin's `auxiliaryWorkers` require.
+    const { entrypoint } = options;
+    const ownClasses = {};
+    if (typeof entrypoint === "object") {
+        const self = {
+            name,
+            compatibilityDate,
+            entrypoint,
+        };
+        for (const durableObject of manifest.resources?.durableObjects ?? []) {
+            if (durableObject.worker !== undefined)
+                continue;
+            ownClasses[durableObject.name] = {
+                type: "durable-object",
+                worker: self,
+                exportName: durableObject.className,
+            };
+        }
+    }
+    return {
+        name,
+        entrypoint,
+        compatibilityDate,
+        compatibilityFlags: compatibilityFlags(options.compatibilityFlags),
+        workersDev: false,
+        previewUrls: false,
+        ...(triggers.length ? { triggers } : {}),
+        ...runtimeSettings(manifest, manifest.limits, deploy),
+        observability: observability(),
+        // Each class keeps its key's place in `env`: classBindings bound it by name.
+        env: { ...env, ...ownClasses },
+        exports: exports,
+    };
+}
+/**
+ * Build the definition of one of the app's helper Workers (the manifest's
+ * `workers`), e.g. one that runs a memory-hungry job away from the app's
+ * Worker. It is named `<app worker>--<worker>`, is private like the app, and
+ * binds the app's  and Analytics Engine datasets, the classes it defines, and
+ * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI,
+ * Browser Rendering, Images, Vectorize indexes, AI Gateways, `send_email`
+ * bindings and Secrets Store secrets, the classes it defines, and
+ * the gateway (with the app's identity, for capabilities). Only the app's
+ * Worker reaches it. Pass it to the Vite plugin:
+ *
+ *   cloudflare({
+ *     auxiliaryWorkers: [
+ *       { config: everyAppAuxiliaryWorker({ manifest, worker: "audit", entrypoint: "./src/audit.ts", ctx: { mode } }) },
+ *     ],
+ *   })
+ */
+export function everyAppAuxiliaryWorker(options) {
+    const { manifest, worker } = options;
+    const helper = manifest.workers?.find((entry) => entry.name === worker);
+    if (!helper) {
+        throw new Error(`everyapp.config.ts declares no helper Worker "${worker}" in workers.`);
+    }
+    const { deploy, name: appWorker } = appWorkerName(options, "everyAppAuxiliaryWorker");
+    const name = helperWorkerName(appWorker, worker);
+    const env = {
+        EVERYAPP_APP_ID: { type: "text", value: manifest.id },
+        ...storageBindings(manifest, appWorker, deploy),
+    };
+    addQueueBindings(env, manifest, appWorker, deploy);
+    addSendEmailBindings(env, manifest);
+    if (deploy) {
+        // The app's identity: the gateway treats its helper Workers as the app.
+        env["EVERY_APP_GATEWAY"] = gatewayBinding(deploy, manifest.id, appWorker);
+        // Sent by the deploy pipeline through `cf deploy --secrets-file`, like
+        // the app's Worker: a helper's gateway calls name the organization too.
+        env["GATEWAY_URL"] = { type: "secret" };
+        env["EVERY_APP_ORG_ID"] = { type: "secret" };
+    }
+    else {
+        env["EVERYAPP_DEV"] = { type: "text", value: "1" };
+        env["EVERYAPP_DEV_CAPABILITIES"] = devCapabilities(manifest);
+        env["GATEWAY_URL"] = devGatewayUrl();
+        env["EVERY_APP_ORG_ID"] = { type: "text", value: DEV_ORG_ID };
+        addDevProviders(env, options.root);
+        addLinkedDev(env);
+    }
+    addAiBindings(env, manifest, deploy);
+    addBrowserBindings(env, manifest);
+    addImagesBindings(env, manifest);
+    addAiGatewayBindings(env, manifest, appWorker, deploy);
+    addSecretsStoreBindings(env, manifest, appWorker, deploy);
+    addAnalyticsEngineBindings(env, manifest, appWorker);
+    addDatabaseBindings(env, options, appWorker, worker, deploy);
+    const { bindings, exports } = classBindings(manifest, appWorker, worker, env);
+    Object.assign(env, bindings);
+    addSecrets(env, options, deploy);
+    const triggers = [
+        ...cronTriggers(options.crons),
+        ...queueTriggers(manifest, appWorker, worker, deploy),
+    ];
+    return {
+        name,
+        entrypoint: options.entrypoint,
+        compatibilityDate: manifest.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE,
+        compatibilityFlags: compatibilityFlags(options.compatibilityFlags),
+        workersDev: false,
+        previewUrls: false,
+        ...(triggers.length ? { triggers } : {}),
+        ...runtimeSettings(manifest, helper.limits, deploy),
+        observability: observability(),
+        env,
+        exports,
+    };
+}
+/** The placeholder target (in production) and the app Worker's name. */
+function appWorkerName(options, builder) {
+    const { manifest, ctx } = options;
+    assertAppId(manifest.id);
+    let deploy;
+    if (ctx.mode === "production") {
+        if (process.env[BUILD_ENV] !== "1") {
+            throw new Error(`EveryApp Workers are built for production only by \`everyapp deploy\` (\`pnpm run deploy\`), which sets ${BUILD_ENV}=1 and installs the build: ` +
+                "a bare `cf build` or `cf deploy` would ship a Worker whose name, identity keys, gateway binding and resources are placeholders. " +
+                "For a local build, run Vite in development mode (`vite build --mode development`).");
+        }
+        deploy = sentinelDeployTarget(manifest);
+    }
+    else if (ctx.mode !== undefined && ctx.mode !== "development") {
+        throw new Error(`${builder}() builds in the "development" or "production" mode, not "${ctx.mode}".`);
+    }
+    const name = deploy?.workerName ?? workerNameFor(manifest.id);
+    if (name === GATEWAY_WORKER_NAME) {
+        throw new Error(`App id "${manifest.id}" is reserved: its Worker would be the gateway's own (${GATEWAY_WORKER_NAME}).`);
+    }
+    return { deploy, name };
+}
+function gatewayBinding(deploy, appId, appWorker) {
+    return {
+        type: "worker",
+        worker: GATEWAY_WORKER_NAME,
+        exportName: GATEWAY_ENTRYPOINT,
+        props: {
+            organizationId: deploy.organizationId,
+            appId,
+            workerName: appWorker,
+        },
+    };
+}
+/**
+ * The app's D1 databases, KV namespaces, R2 buckets and Vectorize indexes,
+ * which all its Workers share.
+ */
+function storageBindings(manifest, appWorker, deploy) {
+    const env = {};
+    for (const binding of manifest.resources?.d1 ?? []) {
+        if (deploy) {
+            const d1 = provisioned(deploy.resources.d1, binding);
+            env[binding] = { type: "d1", name: d1.name, id: d1.id };
+        }
+        else {
+            env[binding] = {
+                type: "d1",
+                name: resourceNameFor(appWorker, binding),
+                id: localD1Id(appWorker, binding),
+            };
+        }
+    }
+    for (const binding of manifest.resources?.kv ?? []) {
+        if (deploy) {
+            env[binding] = {
+                type: "kv",
+                id: provisioned(deploy.resources.kv, binding).id,
+            };
+        }
+        else if (manifest.workers?.length) {
+            // The Vite plugin's own default for the app's Worker, named so that
+            // its helpers share the namespace in dev, as deployed ones do.
+            env[binding] = { type: "kv", id: `${binding}-${appWorker}` };
+        }
+        else {
+            env[binding] = { type: "kv" };
+        }
+    }
+    // Deployed, the names the gateway assigns at registration (placeholders
+    // until installed); in dev its rule, so a local bucket is named like a
+    // deployed one.
+    for (const binding of manifest.resources?.r2 ?? []) {
+        if (env[binding]) {
+            throw new Error(`r2: ${binding} reuses a binding name the Worker already has.`);
+        }
+        if (deploy) {
+            env[binding] = {
+                type: "r2",
+                name: provisioned(deploy.resources.r2, binding).name,
+            };
+        }
+        else {
+            env[binding] = { type: "r2", name: bucketNameFor(appWorker, binding) };
+        }
+    }
+    // Deployed, the index the deploy provisioned (a placeholder until
+    // installed); in development the account's index of the dev Worker's
+    // name, reached remotely: Cloudflare has no local Vectorize, so calls
+    // throw until the Vite plugin's remoteBindings is on.
+    for (const { name: binding } of manifest.resources?.vectorize ?? []) {
+        if (env[binding]) {
+            throw new Error(`vectorize: ${binding} reuses a binding name the Worker already has.`);
+        }
+        if (deploy) {
+            env[binding] = {
+                type: "vectorize",
+                name: provisioned(deploy.resources.vectorize, binding).name,
+            };
+            continue;
+        }
+        const index = suffixedName(appWorker, binding);
+        if (index.length > MAX_VECTORIZE_NAME_LENGTH) {
+            throw new Error(`vectorize: ${binding} would be the Vectorize index "${index}", longer than Cloudflare's ${MAX_VECTORIZE_NAME_LENGTH} characters; shorten the binding name.`);
+        }
+        env[binding] = { type: "vectorize", name: index, dev: { remote: true } };
+    }
+    return env;
+}
+/**
+ * A producer binding to each of the app's queues, which every one of its
+ * Workers gets. Deployed, each names the queue the deploy provisioned (a
+ * placeholder until installed); in development, the queue its rule gives
+ * (Miniflare makes it, shared by the Workers of one `cf dev`).
+ */
+function addQueueBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.queues ?? []) {
+        if (env[binding]) {
+            throw new Error(`queues: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = {
+            type: "queue",
+            name: queueName(appWorker, binding, deploy),
+        };
+    }
+}
+/**
+ * The manifest's Workers AI bindings, which every one of the app's Workers
+ * gets: `{ type: "ai" }` deployed (account-wide, nothing to provision), and
+ * marked remote in development, where Miniflare has no Workers AI. The
+ * remote mark does nothing until the app's Vite config sets
+ * `remoteBindings: true`, so turning that on is the one switch.
+ */
+function addAiBindings(env, manifest, deploy) {
+    for (const binding of manifest.resources?.ai ?? []) {
+        if (env[binding]) {
+            throw new Error(`ai: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = deploy
+            ? { type: "ai" }
+            : { type: "ai", dev: { remote: true } };
+    }
+}
+/**
+ * The consumer triggers of one of the app's Workers: each queue whose
+ * `consumer` is this Worker (`true`, or no `worker`, for the app's own;
+ * `forWorker` for a helper), with its settings and its dead-letter queue,
+ * another of the app's queues, by name.
+ */
+function queueTriggers(manifest, appWorker, forWorker, deploy) {
+    const triggers = [];
+    for (const queue of manifest.resources?.queues ?? []) {
+        if (queue.consumer === undefined)
+            continue;
+        const settings = queue.consumer === true ? {} : queue.consumer;
+        if (settings.worker !== forWorker)
+            continue;
+        const { deadLetterQueue } = settings;
+        if (deadLetterQueue !== undefined &&
+            !manifest.resources?.queues?.some((other) => other.name === deadLetterQueue)) {
+            throw new Error(`queues: ${queue.name}'s deadLetterQueue "${deadLetterQueue}" isn't one of resources.queues.`);
+        }
+        triggers.push({
+            type: "queue",
+            name: queueName(appWorker, queue.name, deploy),
+            ...(deadLetterQueue !== undefined
+                ? { deadLetterQueue: queueName(appWorker, deadLetterQueue, deploy) }
+                : {}),
+            ...Object.fromEntries(QUEUE_CONSUMER_SETTINGS.flatMap((key) => settings[key] === undefined ? [] : [[key, settings[key]]])),
+        });
+    }
+    return triggers;
+}
+/** The consumer settings a queue trigger carries, in the order it lists them. */
+const QUEUE_CONSUMER_SETTINGS = [
+    "maxBatchSize",
+    "maxBatchTimeout",
+    "maxRetries",
+    "maxConcurrency",
+    "retryDelay",
+    "visibilityTimeoutMs",
+];
+/** A queue binding's queue: the deploy's placeholder, or in development its rule. */
+function queueName(appWorker, binding, deploy) {
+    return deploy
+        ? provisioned(deploy.resources.queues, binding).name
+        : queueNameFor(appWorker, binding);
+}
+/**
+ * The manifest's Browser Rendering bindings, which every one of the app's
+ * Workers gets: `{ type: "browser" }` in both modes (account-wide,
+ * nothing to provision; Miniflare serves a local browser in development).
+ */
+function addBrowserBindings(env, manifest) {
+    for (const binding of manifest.resources?.browser ?? []) {
+        if (env[binding]) {
+            throw new Error(`browser: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = { type: "browser" };
+    }
+}
+/**
+ * The manifest's Images bindings, which every one of the app's Workers
+ * gets: `{ type: "images" }` in both modes (account-wide, nothing to
+ * provision; Miniflare answers it locally in development).
+ */
+function addImagesBindings(env, manifest) {
+    for (const binding of manifest.resources?.images ?? []) {
+        if (env[binding]) {
+            throw new Error(`images: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = { type: "images" };
+    }
+}
+/**
+ * The app's AI Gateways, which all its Workers share, each a `json`
+ * binding of `{ id, accountId, url }`. Deployed, the gateway the deploy
+ * provisioned (a placeholder until installed); in development the id the
+ * deploy's rule gives, with an empty account and URL: there is no gateway,
+ * so the app calls the provider directly.
+ */
+function addAiGatewayBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.aiGateway ?? []) {
+        if (env[binding]) {
+            throw new Error(`aiGateway: ${binding} reuses a binding name the Worker already has.`);
+        }
+        const value = deploy
+            ? { ...provisioned(deploy.resources.aiGateway, binding) }
+            : { id: aiGatewayIdFor(appWorker, binding), accountId: "", url: "" };
+        env[binding] = { type: "json", value };
+    }
+}
+/**
+ * The manifest's `send_email` bindings, the same on every one of the
+ * app's Workers in both modes: Cloudflare's binding with the addresses
+ * the manifest lists (the deploy's policy holds the built lists to them).
+ * Deployed, Cloudflare checks a message against them and the account's
+ * Email Sending domains when the Worker sends; in development Miniflare
+ * logs the message and checks the senders.
+ */
+function addSendEmailBindings(env, manifest) {
+    for (const entry of manifest.resources?.sendEmail ?? []) {
+        if (env[entry.name]) {
+            throw new Error(`sendEmail: ${entry.name} reuses a binding name the Worker already has.`);
+        }
+        const senders = entry.allowedSenderAddresses
+            ? { allowedSenderAddresses: [...entry.allowedSenderAddresses] }
+            : {};
+        if (entry.destinationAddress !== undefined &&
+            entry.allowedDestinationAddresses !== undefined) {
+            throw new Error(`sendEmail: ${entry.name} sets both destinationAddress and allowedDestinationAddresses; set one.`);
+        }
+        env[entry.name] =
+            entry.destinationAddress !== undefined
+                ? {
+                    type: "send-email",
+                    ...senders,
+                    destinationAddress: entry.destinationAddress,
+                }
+                : entry.allowedDestinationAddresses !== undefined
+                    ? {
+                        type: "send-email",
+                        ...senders,
+                        allowedDestinationAddresses: [
+                            ...entry.allowedDestinationAddresses,
+                        ],
+                    }
+                    : { type: "send-email", ...senders };
+    }
+}
+/**
+ * The manifest's Secrets Store secrets, which every one of the app's
+ * Workers binds. Deployed, the store and secret the deploy provisioned
+ * (placeholders until installed); in development the local store `local`,
+ * under the name the deploy would give the secret, so a seeded local
+ * secret is named like a deployed one.
+ */
+function addSecretsStoreBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.secretsStore ?? []) {
+        if (env[binding]) {
+            throw new Error(`secretsStore: ${binding} reuses a binding name the Worker already has.`);
+        }
+        if (deploy) {
+            const secret = provisioned(deploy.resources.secretsStore, binding);
+            env[binding] = {
+                type: "secrets-store-secret",
+                storeId: secret.storeId,
+                secretName: secret.secretName,
+            };
+        }
+        else {
+            env[binding] = {
+                type: "secrets-store-secret",
+                storeId: LOCAL_SECRETS_STORE_ID,
+                secretName: suffixedName(appWorker, binding),
+            };
+        }
+    }
+}
+/**
+ * The manifest's Analytics Engine datasets, which every one of the app's
+ * Workers writes to: the `dataset` an entry names, or
+ * `<app worker>--<binding>`. Deployed, the app's Worker name is the build's
+ * placeholder, which the install rewrites like every other; a named
+ * dataset holds none and stays as written.
+ */
+function addAnalyticsEngineBindings(env, manifest, appWorker) {
+    for (const entry of manifest.resources?.analyticsEngine ?? []) {
+        if (env[entry.name]) {
+            throw new Error(`analyticsEngine: ${entry.name} reuses a binding name the Worker already has.`);
+        }
+        env[entry.name] = {
+            type: "analytics-engine-dataset",
+            name: entry.dataset ?? suffixedName(appWorker, entry.name),
+        };
+    }
+}
+/**
+ * DATABASE_PROVIDER and the Hyperdrive configs one of the app's Workers
+ * binds: each config every Worker shares, and those a helper (`forWorker`)
+ * alone takes. Deployed, each is the config the deploy provisioned; in
+ * development, a local Postgres URL set as
+ * CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_<binding>, or nothing.
+ */
+function addDatabaseBindings(env, options, appWorker, forWorker, deploy) {
+    const { manifest } = options;
+    if (manifest.database) {
+        env["DATABASE_PROVIDER"] = {
+            type: "text",
+            value: manifest.database.provider,
+        };
+    }
+    const configs = (manifest.resources?.hyperdrive ?? []).filter((config) => config.worker === undefined || config.worker === forWorker);
+    if (configs.length === 0)
+        return;
+    const local = deploy
+        ? {}
+        : localEnv(options.root ?? process.cwd(), options.ctx.mode ?? "development");
+    for (const config of configs) {
+        if (env[config.name]) {
+            throw new Error(`hyperdrive: ${config.name} reuses a binding name the Worker already has.`);
+        }
+        if (deploy) {
+            env[config.name] = {
+                type: "hyperdrive",
+                id: provisioned(deploy.resources.hyperdrive, config.name).id,
+            };
+            continue;
+        }
+        const connectionString = local[`${LOCAL_HYPERDRIVE_PREFIX}${config.name}`];
+        if (connectionString) {
+            env[config.name] = {
+                type: "hyperdrive",
+                id: localD1Id(appWorker, config.name),
+                dev: { connectionString },
+            };
+        }
+    }
+}
+/**
+ * The placement and limits of one of the app's Workers: deployed, it runs
+ * near the database's region; its CPU limit is the manifest's.
+ */
+function runtimeSettings(manifest, limits, deploy) {
+    const region = manifest.database?.region;
+    return {
+        ...(deploy && region ? { placement: { region } } : {}),
+        ...(limits?.cpuMs !== undefined ? { limits: { cpuMs: limits.cpuMs } } : {}),
+    };
+}
+/**
+ * Durable Object and Workflow bindings, and the classes to export, for one
+ * of the app's Workers: the app's own (`forWorker` undefined) binds every
+ * class, each in the Worker that defines it, and a helper Worker binds only
+ * its own. Each Worker exports the classes it defines. Workflow names are
+ * account-wide, so all of them are named after the app's Worker.
+ */
+function classBindings(manifest, appWorker, forWorker, 
+/** The bindings the Worker already has, which no class may reuse. */
+taken) {
+    const bindings = {};
+    const exports = {};
+    const definedHere = (resource) => resource.worker === forWorker;
+    const definingWorker = (resource) => resource.worker ? helperWorkerName(appWorker, resource.worker) : appWorker;
+    for (const durableObject of manifest.resources?.durableObjects ?? []) {
+        if (forWorker !== undefined && !definedHere(durableObject))
+            continue;
+        bindings[durableObject.name] = {
+            type: "durable-object",
+            worker: definingWorker(durableObject),
+            exportName: durableObject.className,
+        };
+        if (definedHere(durableObject)) {
+            exports[durableObject.className] = {
+                type: "durable-object",
+                storage: "sqlite",
+            };
+        }
+    }
+    // The defining Worker exports each Workflow, and every Worker that binds
+    // one can start it and look up its instances.
+    for (const workflow of manifest.resources?.workflows ?? []) {
+        if (forWorker !== undefined && !definedHere(workflow))
+            continue;
+        if (taken[workflow.name] ||
+            bindings[workflow.name] ||
+            exports[workflow.className]) {
+            throw new Error(`workflows: ${workflow.name} (${workflow.className}) reuses a binding or class name the Worker already has.`);
+        }
+        const workflowName = workflowNameFor(appWorker, workflow.name);
+        if (workflowName.length > MAX_WORKFLOW_NAME_LENGTH) {
+            throw new Error(`workflows: ${workflow.name} would be the Workflow "${workflowName}", longer than Cloudflare's ${MAX_WORKFLOW_NAME_LENGTH} characters; shorten the binding name.`);
+        }
+        bindings[workflow.name] = {
+            type: "workflow",
+            name: workflowName,
+            worker: definingWorker(workflow),
+            exportName: workflow.className,
+        };
+        if (definedHere(workflow)) {
+            exports[workflow.className] = { type: "workflow", name: workflowName };
+        }
+    }
+    return { bindings, exports };
+}
+/**
+ * Check the names of the manifest's `secrets` and `settings`, and in dev
+ * declare the ones set locally (a setting that isn't, with its default),
+ * with the developer's own keys for the manifest's providers and
+ * capabilities.
+ */
+function addSecrets(env, options, deploy) {
+    const settings = options.manifest.settings ?? [];
+    const secrets = [
+        ...manifestSecretNames(options.manifest),
+        ...settings.map((setting) => setting.name),
+    ];
+    const settingNames = new Set(settings.map((setting) => setting.name));
+    for (const secret of secrets) {
+        const field = settingNames.has(secret) ? "settings" : "secrets";
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(secret)) {
+            throw new Error(`${field}: "${secret}" isn't a valid binding name.`);
+        }
+        if (env[secret] || RESERVED_SECRET_NAME.test(secret)) {
+            throw new Error(`${field}: ${secret} is a name the deploy sets or a binding it builds.`);
+        }
+    }
+    if (!deploy) {
+        // With `.dev.vars` setting it, EVERYAPP_EMAIL_SENDERS stands in for the
+        // senders a gateway holds for an installation (`everyapp email set`).
+        const names = new Set([
+            ...secrets,
+            ...devGatewayKeys(options.manifest),
+            ...devProviderKeys(options.manifest, options.root),
+            ...(options.manifest.capabilities?.["email"]
+                ? ["EVERYAPP_EMAIL_SENDERS"]
+                : []),
+        ]);
+        for (const secret of locallySetSecrets(options.root ?? process.cwd(), options.ctx.mode ?? "development", [...names].filter((name) => !env[name]))) {
+            env[secret] = { type: "secret" };
+        }
+        // A setting nobody set locally reads its default, as a deployed one does.
+        for (const setting of settings) {
+            if (!env[setting.name] && setting.default !== undefined) {
+                env[setting.name] = { type: "text", value: setting.default };
+            }
+        }
+    }
+}
+/** The {@link DEV_GATEWAY_KEYS} of the manifest's providers and capabilities. */
+function devGatewayKeys(manifest) {
+    const keysOf = (table, id) => (Object.hasOwn(table, id) ? table[id] : []);
+    return [
+        ...manifestProviderIds(manifest).flatMap((provider) => keysOf(DEV_GATEWAY_KEYS.providers, provider)),
+        ...Object.keys(manifest.capabilities ?? {}).flatMap((id) => keysOf(DEV_GATEWAY_KEYS.capabilities, id)),
+    ];
+}
+/** `nodejs_compat`, then the app's own flags, each once. */
+function compatibilityFlags(flags) {
+    return [...new Set(["nodejs_compat", ...(flags ?? [])])];
+}
+function cronTriggers(crons) {
+    return (crons ?? []).map((schedule) => {
+        if (!/^\S+( \S+){4}$/.test(schedule)) {
+            throw new Error(`crons: "${schedule}" isn't a five-field cron schedule, e.g. "0 6 * * *".`);
+        }
+        return { type: "scheduled", schedule };
+    });
+}
+function observability() {
+    return {
+        ...EVERYAPP_OBSERVABILITY,
+        logs: { ...EVERYAPP_OBSERVABILITY.logs },
+        traces: { ...EVERYAPP_OBSERVABILITY.traces },
+        issues: { ...EVERYAPP_OBSERVABILITY.issues },
+    };
+}
+/**
+ * The local D1 database id for a binding: a 32-hex string, because
+ * `cf d1 … --local` rejects names. The everyapp CLI computes the same id to
+ * apply local migrations to the database `cf dev` serves.
+ */
+export function localD1Id(workerName, binding) {
+    return createHash("sha256")
+        .update(`${workerName}:${binding}`)
+        .digest("hex")
+        .slice(0, 32);
+}
+/** Where `cf dev` keeps D1 databases, under the app's state directory. */
+const LOCAL_D1_OBJECT = "miniflare-D1DatabaseObject";
+/**
+ * The sqlite file `cf dev` (and `cf d1 … --local`) keeps the local D1
+ * database `databaseId` in, under the app at `root`, for tools such as
+ * drizzle-kit studio: `.cloudflare/state/v3/d1/miniflare-D1DatabaseObject/
+ * <hash>.sqlite`. The database is a Durable Object named after its id, and
+ * the file after that object's id. `databaseId` is the {@link localD1Id}.
+ */
+export function localD1Path(root, databaseId) {
+    return path.join(root, ".cloudflare", "state", "v3", "d1", LOCAL_D1_OBJECT, `${durableObjectIdFromName(LOCAL_D1_OBJECT, databaseId)}.sqlite`);
+}
+/** The id workerd's `idFromName(name)` gives in the namespace `uniqueKey`. */
+function durableObjectIdFromName(uniqueKey, name) {
+    const key = createHash("sha256").update(uniqueKey).digest();
+    const nameHmac = createHmac("sha256", key)
+        .update(name)
+        .digest()
+        .subarray(0, 16);
+    const hmac = createHmac("sha256", key)
+        .update(nameHmac)
+        .digest()
+        .subarray(0, 16);
+    return Buffer.concat([nameHmac, hmac]).toString("hex");
+}
+/**
+ * The `secrets` set for local dev, read the way the Vite plugin reads them:
+ * `.dev.vars[.<mode>]` alone when present, otherwise `.env` files and the
+ * process environment.
+ */
+function locallySetSecrets(root, mode, names) {
+    if (names.length === 0)
+        return [];
+    const values = localEnv(root, mode);
+    return names.filter((name) => values[name]);
+}
+/** The values local dev sees, read as the Vite plugin reads them. */
+function localEnv(root, mode) {
+    const read = (name) => {
+        const file = path.join(root, name);
+        return fs.existsSync(file) ? parseEnv(fs.readFileSync(file, "utf8")) : {};
+    };
+    const devVars = [`.dev.vars.${mode}`, ".dev.vars"].find((name) => fs.existsSync(path.join(root, name)));
+    return devVars
+        ? read(devVars)
+        : {
+            ...read(".env"),
+            ...read(".env.local"),
+            ...read(`.env.${mode}`),
+            ...read(`.env.${mode}.local`),
+            ...process.env,
+        };
+}
+/** The dev Worker name, e.g. "todo" -> "every-todo". */
+function workerNameFor(appId) {
+    return appId.startsWith("every-") ? appId : `every-${appId}`;
+}
+/**
+ * Copies of the gateway's naming rules (@every-app/perimeter/manifest's
+ * resourceNameFor, bucketNameFor, vectorizeNameFor and storeSecretNameFor):
+ * `DB` and `KV` (`R2` for a bucket) take the Worker's name, any other
+ * binding (and every Vectorize index and Secrets Store secret)
+ * `<worker>--<binding>`.
+ */
+function resourceNameFor(workerName, binding) {
+    return binding === "DB" || binding === "KV"
+        ? workerName
+        : suffixedName(workerName, binding);
+}
+function bucketNameFor(workerName, binding) {
+    return binding === "R2" ? workerName : suffixedName(workerName, binding);
+}
+/** A copy of @every-app/perimeter/manifest's queueNameFor: `<worker>--<binding>`. */
+function queueNameFor(workerName, binding) {
+    return suffixedName(workerName, binding);
+}
+function suffixedName(workerName, binding) {
+    return `${workerName}--${binding.toLowerCase().replaceAll("_", "-")}`;
+}
+/**
+ * A copy of the gateway's aiGatewayIdFor: one hyphen, since an AI
+ * Gateway's id may not hold `--`.
+ */
+function aiGatewayIdFor(workerName, binding) {
+    return `${workerName}-${binding.toLowerCase().replaceAll("_", "-")}`;
+}
+function assertAppId(id) {
+    if (typeof id !== "string" || !/^[a-z]([a-z0-9-]*[a-z0-9])?$/.test(id)) {
+        throw new Error(`everyapp.config.ts id must be kebab-case (lowercase letters, digits, hyphens); got ${JSON.stringify(id)}.`);
+    }
+}
+/** The target's resource for a manifest binding, which it always has. */
+function provisioned(resources, binding) {
+    const resource = resources?.[binding];
+    if (resource === undefined) {
+        throw new Error(`The build has no placeholder for binding "${binding}".`);
+    }
+    return resource;
+}